655 files changed, 32687 insertions, 13939 deletions

diff --git a/Documentation/networking/LICENSE.qlcnic b/Documentation/networking/LICENSE.qlcnic
new file mode 100644
index 00000000000..29ad4b10642
--- /dev/null
+++ b/Documentation/networking/LICENSE.qlcnic
@@ -0,0 +1,327 @@
+Copyright (c) 2009-2010 QLogic Corporation
+QLogic Linux qlcnic NIC Driver
+
+This program includes a device driver for Linux 2.6 that may be
+distributed with QLogic hardware specific firmware binary file.
+You may modify and redistribute the device driver code under the
+GNU General Public License (a copy of which is attached hereto as
+Exhibit A) published by the Free Software Foundation (version 2).
+
+You may redistribute the hardware specific firmware binary file
+under the following terms:
+
+       1. Redistribution of source code (only if applicable),
+          must retain the above copyright notice, this list of
+          conditions and the following disclaimer.
+
+       2. Redistribution in binary form must reproduce the above
+          copyright notice, this list of conditions and the
+          following disclaimer in the documentation and/or other
+          materials provided with the distribution.
+
+       3. The name of QLogic Corporation may not be used to
+          endorse or promote products derived from this software
+          without specific prior written permission
+
+REGARDLESS OF WHAT LICENSING MECHANISM IS USED OR APPLICABLE,
+THIS PROGRAM IS PROVIDED BY QLOGIC CORPORATION "AS IS'' AND ANY
+EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR
+BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGE.
+
+USER ACKNOWLEDGES AND AGREES THAT USE OF THIS PROGRAM WILL NOT
+CREATE OR GIVE GROUNDS FOR A LICENSE BY IMPLICATION, ESTOPPEL, OR
+OTHERWISE IN ANY INTELLECTUAL PROPERTY RIGHTS (PATENT, COPYRIGHT,
+TRADE SECRET, MASK WORK, OR OTHER PROPRIETARY RIGHT) EMBODIED IN
+ANY OTHER QLOGIC HARDWARE OR SOFTWARE EITHER SOLELY OR IN
+COMBINATION WITH THIS PROGRAM.
+
+
+EXHIBIT A
+
+                   GNU GENERAL PUBLIC LICENSE
+                      Version 2, June 1991
+
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.
+ 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                           Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users.  This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it.  (Some other Free Software Foundation software is covered by
+the GNU Lesser General Public License instead.)  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+  To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have.  You must make sure that they, too, receive or can get the
+source code.  And you must show them these terms so they know their
+rights.
+
+  We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+  Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software.  If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+  Finally, any free program is threatened constantly by software
+patents.  We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary.  To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                   GNU GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License.  The "Program", below,
+refers to any such program or work, and a "work based on the Program"
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language.  (Hereinafter, translation is included without limitation in
+the term "modification".)  Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+  1. You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+  2. You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) You must cause the modified files to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    b) You must cause any work that you distribute or publish, that in
+    whole or in part contains or is derived from the Program or any
+    part thereof, to be licensed as a whole at no charge to all third
+    parties under the terms of this License.
+
+    c) If the modified program normally reads commands interactively
+    when run, you must cause it, when started running for such
+    interactive use in the most ordinary way, to print or display an
+    announcement including an appropriate copyright notice and a
+    notice that there is no warranty (or else, saying that you provide
+    a warranty) and that users may redistribute the program under
+    these conditions, and telling the user how to view a copy of this
+    License.  (Exception: if the Program itself is interactive but
+    does not normally print such an announcement, your work based on
+    the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+    a) Accompany it with the complete corresponding machine-readable
+    source code, which must be distributed under the terms of Sections
+    1 and 2 above on a medium customarily used for software interchange; or,
+
+    b) Accompany it with a written offer, valid for at least three
+    years, to give any third party, for a charge no more than your
+    cost of physically performing source distribution, a complete
+    machine-readable copy of the corresponding source code, to be
+    distributed under the terms of Sections 1 and 2 above on a medium
+    customarily used for software interchange; or,
+
+    c) Accompany it with the information you received as to the offer
+    to distribute corresponding source code.  (This alternative is
+    allowed only for noncommercial distribution and only if you
+    received the program in object code or executable form with such
+    an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it.  For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable.  However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  4. You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License.  Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+  5. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Program or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+  6. Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+  7. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Program at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Program by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  8. If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded.  In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+  9. The Free Software Foundation may publish revised and/or new versions
+of the General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Program
+specifies a version number of this License which applies to it and "any
+later version", you have the option of following the terms and conditions
+either of that version or of any later version published by the Free
+Software Foundation.  If the Program does not specify a version number of
+this License, you may choose any version ever published by the Free Software
+Foundation.
+
+  10. If you wish to incorporate parts of the Program into other free
+programs whose distribution conditions are different, write to the author
+to ask for permission.  For software which is copyrighted by the Free
+Software Foundation, write to the Free Software Foundation; we sometimes
+make exceptions for this.  Our decision will be guided by the two goals
+of preserving the free status of all derivatives of our free software and
+of promoting the sharing and reuse of software generally.
+
+                           NO WARRANTY
+
+  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+REPAIR OR CORRECTION.
+
+  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
diff --git a/Documentation/networking/dccp.txt b/Documentation/networking/dccp.txt
index 271d524a4c8..b395ca6a49f 100644
--- a/Documentation/networking/dccp.txt
+++ b/Documentation/networking/dccp.txt
@@ -47,6 +47,26 @@ http://linux-net.osdl.org/index.php/DCCP_Testing#Experimental_DCCP_source_tree
 
 Socket options
 ==============
+DCCP_SOCKOPT_QPOLICY_ID sets the dequeuing policy for outgoing packets. It takes
+a policy ID as argument and can only be set before the connection (i.e. changes
+during an established connection are not supported). Currently, two policies are
+defined: the "simple" policy (DCCPQ_POLICY_SIMPLE), which does nothing special,
+and a priority-based variant (DCCPQ_POLICY_PRIO). The latter allows to pass an
+u32 priority value as ancillary data to sendmsg(), where higher numbers indicate
+a higher packet priority (similar to SO_PRIORITY). This ancillary data needs to
+be formatted using a cmsg(3) message header filled in as follows:
+        cmsg->cmsg_level = SOL_DCCP;
+        cmsg->cmsg_type  = DCCP_SCM_PRIORITY;
+        cmsg->cmsg_len   = CMSG_LEN(sizeof(uint32_t));  /* or CMSG_LEN(4) */
+
+DCCP_SOCKOPT_QPOLICY_TXQLEN sets the maximum length of the output queue. A zero
+value is always interpreted as unbounded queue length. If different from zero,
+the interpretation of this parameter depends on the current dequeuing policy
+(see above): the "simple" policy will enforce a fixed queue size by returning
+EAGAIN, whereas the "prio" policy enforces a fixed queue length by dropping the
+lowest-priority packet first. The default value for this parameter is
+initialised from /proc/sys/net/dccp/default/tx_qlen.
+
 DCCP_SOCKOPT_SERVICE sets the service. The specification mandates use of
 service codes (RFC 4340, sec. 8.1.2); if this socket option is not set,
 the socket will fall back to 0 (which means that no meaningful service code
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index 3c5e465296e..2193a5d124c 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -708,10 +708,28 @@ igmp_max_memberships - INTEGER
         Change the maximum number of multicast groups we can subscribe to.
         Default: 20
 
-conf/interface/*  changes special settings per interface (where "interface" is
-                  the name of your network interface)
-conf/all/*        is special, changes the settings for all interfaces
+        Theoretical maximum value is bounded by having to send a membership
+        report in a single datagram (i.e. the report can't span multiple
+        datagrams, or risk confusing the switch and leaving groups you don't
+        intend to).
 
+        The number of supported groups 'M' is bounded by the number of group
+        report entries you can fit into a single datagram of 65535 bytes.
+
+        M = 65536-sizeof (ip header)/(sizeof(Group record))
+
+        Group records are variable length, with a minimum of 12 bytes.
+        So net.ipv4.igmp_max_memberships should not be set higher than:
+
+        (65536-24) / 12 = 5459
+
+        The value 5459 assumes no IP header options, so in practice
+        this number may be lower.
+
+        conf/interface/*  changes special settings per interface (where
+        "interface" is the name of your network interface)
+
+        conf/all/*        is special, changes the settings for all interfaces
 
 log_martians - BOOLEAN
         Log packets with impossible addresses to kernel log.
diff --git a/Documentation/networking/stmmac.txt b/Documentation/networking/stmmac.txt
index 7ee770b5ef5..80a7a345490 100644
--- a/Documentation/networking/stmmac.txt
+++ b/Documentation/networking/stmmac.txt
@@ -7,7 +7,7 @@ This is the driver for the MAC 10/100/1000 on-chip Ethernet controllers
 (Synopsys IP blocks); it has been fully tested on STLinux platforms.
 
 Currently this network device driver is for all STM embedded MAC/GMAC
-(7xxx SoCs).
+(7xxx SoCs). Other platforms start using it i.e. ARM SPEAr.
 
 DWC Ether MAC 10/100/1000 Universal version 3.41a and DWC Ether MAC 10/100
 Universal version 4.0 have been used for developing the first code
@@ -95,9 +95,14 @@ Several information came from the platform; please refer to the
 driver's Header file in include/linux directory.
 
 struct plat_stmmacenet_data {
-        int bus_id;
-        int pbl;
-        int has_gmac;
+        int bus_id;
+        int pbl;
+        int clk_csr;
+        int has_gmac;
+        int enh_desc;
+        int tx_coe;
+        int bugged_jumbo;
+        int pmt;
         void (*fix_mac_speed)(void *priv, unsigned int speed);
         void (*bus_setup)(unsigned long ioaddr);
 #ifdef CONFIG_STM_DRIVERS
@@ -114,6 +119,12 @@ Where:
   registers (on STM platforms);
 - has_gmac: GMAC core is on board (get it at run-time in the next step);
 - bus_id: bus identifier.
+- tx_coe: core is able to perform the tx csum in HW.
+- enh_desc: if sets the MAC will use the enhanced descriptor structure.
+- clk_csr: CSR Clock range selection.
+- bugged_jumbo: some HWs are not able to perform the csum in HW for
+  over-sized frames due to limited buffer sizes. Setting this
+  flag the csum will be done in SW on JUMBO frames.
 
 struct plat_stmmacphy_data {
         int bus_id;
@@ -131,13 +142,28 @@ Where:
 - interface: physical MII interface mode;
 - phy_reset: hook to reset HW function.
 
+SOURCES:
+- Kconfig
+- Makefile
+- stmmac_main.c: main network device driver;
+- stmmac_mdio.c: mdio functions;
+- stmmac_ethtool.c: ethtool support;
+- stmmac_timer.[ch]: timer code used for mitigating the driver dma interrupts
+  Only tested on ST40 platforms based.
+- stmmac.h: private driver structure;
+- common.h: common definitions and VFTs;
+- descs.h: descriptor structure definitions;
+- dwmac1000_core.c: GMAC core functions;
+- dwmac1000_dma.c:  dma functions for the GMAC chip;
+- dwmac1000.h: specific header file for the GMAC;
+- dwmac100_core: MAC 100 core and dma code;
+- dwmac100_dma.c: dma funtions for the MAC chip;
+- dwmac1000.h: specific header file for the MAC;
+- dwmac_lib.c: generic DMA functions shared among chips
+- enh_desc.c: functions for handling enhanced descriptors
+- norm_desc.c: functions for handling normal descriptors
+
 TODO:
-- Continue to make the driver more generic and suitable for other Synopsys
-  Ethernet controllers used on other architectures (i.e. ARM).
-- 10G controllers are not supported.
-- MAC uses Normal descriptors and GMAC uses enhanced ones.
-  This is a limit that should be reviewed. MAC could want to
-  use the enhanced structure.
-- Checksumming: Rx/Tx csum is done in HW in case of GMAC only.
+- XGMAC controller is not supported.
 - Review the timer optimisation code to use an embedded device that seems to be
   available in new chip generations.
diff --git a/arch/arm/mach-omap2/board-omap3pandora.c b/arch/arm/mach-omap2/board-omap3pandora.c
index 89ed1be2d62..8be26150605 100644
--- a/arch/arm/mach-omap2/board-omap3pandora.c
+++ b/arch/arm/mach-omap2/board-omap3pandora.c
@@ -642,31 +642,13 @@ static void __init omap3pandora_init_irq(void)
         omap_gpio_init();
 }
 
-static void pandora_wl1251_set_power(bool enable)
-{
-        /*
-         * Keep power always on until wl1251_sdio driver learns to re-init
-         * the chip after powering it down and back up.
-         */
-}
-
-static struct wl12xx_platform_data pandora_wl1251_pdata = {
-        .set_power      = pandora_wl1251_set_power,
-        .use_eeprom     = true,
-};
-
-static struct platform_device pandora_wl1251_data = {
-        .name           = "wl1251_data",
-        .id             = -1,
-        .dev            = {
-                .platform_data  = &pandora_wl1251_pdata,
-        },
-};
-
-static void pandora_wl1251_init(void)
+static void __init pandora_wl1251_init(void)
 {
+        struct wl12xx_platform_data pandora_wl1251_pdata;
         int ret;
 
+        memset(&pandora_wl1251_pdata, 0, sizeof(pandora_wl1251_pdata));
+
         ret = gpio_request(PANDORA_WIFI_IRQ_GPIO, "wl1251 irq");
         if (ret < 0)
                 goto fail;
@@ -679,6 +661,11 @@ static void pandora_wl1251_init(void)
         if (pandora_wl1251_pdata.irq < 0)
                 goto fail_irq;
 
+        pandora_wl1251_pdata.use_eeprom = true;
+        ret = wl12xx_set_platform_data(&pandora_wl1251_pdata);
+        if (ret < 0)
+                goto fail_irq;
+
         return;
 
 fail_irq:
@@ -691,7 +678,6 @@ static struct platform_device *omap3pandora_devices[] __initdata = {
         &pandora_leds_gpio,
         &pandora_keys_gpio,
         &pandora_dss_device,
-        &pandora_wl1251_data,
         &pandora_vwlan_device,
 };
 
diff --git a/drivers/atm/fore200e.c b/drivers/atm/fore200e.c
index c8fc69c85a0..c0976195935 100644
--- a/drivers/atm/fore200e.c
+++ b/drivers/atm/fore200e.c
@@ -92,7 +92,7 @@
 
 #define FORE200E_INDEX(virt_addr, type, index)     (&((type *)(virt_addr))[ index ])
 
-#define FORE200E_NEXT_ENTRY(index, modulo)         (index = ++(index) % (modulo))
+#define FORE200E_NEXT_ENTRY(index, modulo)         (index = ((index) + 1) % (modulo))
 
 #if 1
 #define ASSERT(expr)     if (!(expr)) { \
diff --git a/drivers/atm/lanai.c b/drivers/atm/lanai.c
index cbe15a86c66..930051d941a 100644
--- a/drivers/atm/lanai.c
+++ b/drivers/atm/lanai.c
@@ -2241,11 +2241,8 @@ static int __devinit lanai_dev_open(struct atm_dev *atmdev)
         memcpy(atmdev->esi, eeprom_mac(lanai), ESI_LEN);
         lanai_timed_poll_start(lanai);
         printk(KERN_NOTICE DEV_LABEL "(itf %d): rev.%d, base=0x%lx, irq=%u "
-            "(%02X-%02X-%02X-%02X-%02X-%02X)\n", lanai->number,
-            (int) lanai->pci->revision, (unsigned long) lanai->base,
-            lanai->pci->irq,
-            atmdev->esi[0], atmdev->esi[1], atmdev->esi[2],
-            atmdev->esi[3], atmdev->esi[4], atmdev->esi[5]);
+                "(%pMF)\n", lanai->number, (int) lanai->pci->revision,
+                (unsigned long) lanai->base, lanai->pci->irq, atmdev->esi);
         printk(KERN_NOTICE DEV_LABEL "(itf %d): LANAI%s, serialno=%u(0x%X), "
             "board_rev=%d\n", lanai->number,
             lanai->type==lanai2 ? "2" : "HB", (unsigned int) lanai->serialno,
diff --git a/drivers/block/aoe/aoecmd.c b/drivers/block/aoe/aoecmd.c
index 5674bd01d96..de0435e63b0 100644
--- a/drivers/block/aoe/aoecmd.c
+++ b/drivers/block/aoe/aoecmd.c
@@ -297,8 +297,8 @@ aoecmd_cfg_pkts(ushort aoemajor, unsigned char aoeminor, struct sk_buff_head *qu
         struct sk_buff *skb;
         struct net_device *ifp;
 
-        read_lock(&dev_base_lock);
-        for_each_netdev(&init_net, ifp) {
+        rcu_read_lock();
+        for_each_netdev_rcu(&init_net, ifp) {
                 dev_hold(ifp);
                 if (!is_aoe_netif(ifp))
                         goto cont;
@@ -325,7 +325,7 @@ aoecmd_cfg_pkts(ushort aoemajor, unsigned char aoeminor, struct sk_buff_head *qu
 cont:
                 dev_put(ifp);
         }
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 }
 
 static void
diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
index a5ea1bce968..8aba0ba57de 100644
--- a/drivers/infiniband/core/addr.c
+++ b/drivers/infiniband/core/addr.c
@@ -130,8 +130,8 @@ int rdma_translate_ip(struct sockaddr *addr, struct rdma_dev_addr *dev_addr)
 
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
         case AF_INET6:
-                read_lock(&dev_base_lock);
-                for_each_netdev(&init_net, dev) {
+                rcu_read_lock();
+                for_each_netdev_rcu(&init_net, dev) {
                         if (ipv6_chk_addr(&init_net,
                                           &((struct sockaddr_in6 *) addr)->sin6_addr,
                                           dev, 1)) {
@@ -139,7 +139,7 @@ int rdma_translate_ip(struct sockaddr *addr, struct rdma_dev_addr *dev_addr)
                                 break;
                         }
                 }
-                read_unlock(&dev_base_lock);
+                rcu_read_unlock();
                 break;
 #endif
         }
@@ -200,7 +200,7 @@ static int addr4_resolve(struct sockaddr_in *src_in,
         src_in->sin_family = AF_INET;
         src_in->sin_addr.s_addr = rt->rt_src;
 
-        if (rt->idev->dev->flags & IFF_LOOPBACK) {
+        if (rt->dst.dev->flags & IFF_LOOPBACK) {
                 ret = rdma_translate_ip((struct sockaddr *) dst_in, addr);
                 if (!ret)
                         memcpy(addr->dst_dev_addr, addr->src_dev_addr, MAX_ADDR_LEN);
@@ -208,12 +208,12 @@ static int addr4_resolve(struct sockaddr_in *src_in,
         }
 
         /* If the device does ARP internally, return 'done' */
-        if (rt->idev->dev->flags & IFF_NOARP) {
-                rdma_copy_addr(addr, rt->idev->dev, NULL);
+        if (rt->dst.dev->flags & IFF_NOARP) {
+                rdma_copy_addr(addr, rt->dst.dev, NULL);
                 goto put;
         }
 
-        neigh = neigh_lookup(&arp_tbl, &rt->rt_gateway, rt->idev->dev);
+        neigh = neigh_lookup(&arp_tbl, &rt->rt_gateway, rt->dst.dev);
         if (!neigh || !(neigh->nud_state & NUD_VALID)) {
                 neigh_event_send(rt->dst.neighbour, NULL);
                 ret = -ENODATA;
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index bf3e20cd029..4e55a28fb6d 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -848,8 +848,8 @@ static int update_ipv6_gids(struct mlx4_ib_dev *dev, int port, int clear)
                 goto out;
         }
 
-        read_lock(&dev_base_lock);
-        for_each_netdev(&init_net, tmp) {
+        rcu_read_lock();
+        for_each_netdev_rcu(&init_net, tmp) {
                 if (ndev && (tmp == ndev || rdma_vlan_dev_real_dev(tmp) == ndev)) {
                         gid.global.subnet_prefix = cpu_to_be64(0xfe80000000000000LL);
                         vid = rdma_vlan_dev_vlan_id(tmp);
@@ -884,7 +884,7 @@ static int update_ipv6_gids(struct mlx4_ib_dev *dev, int port, int clear)
                         }
                 }
         }
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 
         for (i = 0; i < 128; ++i)
                 if (!hits[i]) {
diff --git a/drivers/isdn/hardware/mISDN/mISDNinfineon.c b/drivers/isdn/hardware/mISDN/mISDNinfineon.c
index e90db8870b6..bc0529ac88a 100644
--- a/drivers/isdn/hardware/mISDN/mISDNinfineon.c
+++ b/drivers/isdn/hardware/mISDN/mISDNinfineon.c
@@ -420,7 +420,7 @@ enable_hwirq(struct inf_hw *hw)
                 break;
         case INF_NICCY:
                 val = inl((u32)hw->cfg.start + NICCY_IRQ_CTRL_REG);
-                val |= NICCY_IRQ_ENABLE;;
+                val |= NICCY_IRQ_ENABLE;
                 outl(val, (u32)hw->cfg.start + NICCY_IRQ_CTRL_REG);
                 break;
         case INF_SCT_1:
@@ -924,7 +924,7 @@ setup_instance(struct inf_hw *card)
                 mISDNipac_init(&card->ipac, card);
 
         if (card->ipac.isac.dch.dev.Bprotocols == 0)
-                goto error_setup;;
+                goto error_setup;
 
         err = mISDN_register_device(&card->ipac.isac.dch.dev,
                 &card->pdev->dev, card->name);
diff --git a/drivers/isdn/hardware/mISDN/mISDNisar.c b/drivers/isdn/hardware/mISDN/mISDNisar.c
index 38eb31439a7..d13fa5b119f 100644
--- a/drivers/isdn/hardware/mISDN/mISDNisar.c
+++ b/drivers/isdn/hardware/mISDN/mISDNisar.c
@@ -264,7 +264,7 @@ load_firmware(struct isar_hw *isar, const u8 *buf, int size)
                         while (noc) {
                                 val = le16_to_cpu(*sp++);
                                 *mp++ = val >> 8;
-                                *mp++ = val & 0xFF;;
+                                *mp++ = val & 0xFF;
                                 noc--;
                         }
                         spin_lock_irqsave(isar->hwlock, flags);
diff --git a/drivers/isdn/hisax/avm_pci.c b/drivers/isdn/hisax/avm_pci.c
index fcf4ed1cb4b..0e66af1decd 100644
--- a/drivers/isdn/hisax/avm_pci.c
+++ b/drivers/isdn/hisax/avm_pci.c
@@ -314,7 +314,7 @@ hdlc_fill_fifo(struct BCState *bcs)
                         bcs->hw.hdlc.ctrl.sr.cmd |= HDLC_CMD_XME;
         }
         if ((cs->debug & L1_DEB_HSCX) && !(cs->debug & L1_DEB_HSCX_FIFO))
-                debugl1(cs, "hdlc_fill_fifo %d/%ld", count, bcs->tx_skb->len);
+                debugl1(cs, "hdlc_fill_fifo %d/%u", count, bcs->tx_skb->len);
         p = bcs->tx_skb->data;
         ptr = (u_int *)p;
         skb_pull(bcs->tx_skb, count);
diff --git a/drivers/isdn/hisax/callc.c b/drivers/isdn/hisax/callc.c
index f150330b5a2..37e685eafd2 100644
--- a/drivers/isdn/hisax/callc.c
+++ b/drivers/isdn/hisax/callc.c
@@ -65,7 +65,7 @@ hisax_findcard(int driverid)
         return (struct IsdnCardState *) 0;
 }
 
-static void
+static __attribute__((format(printf, 3, 4))) void
 link_debug(struct Channel *chanp, int direction, char *fmt, ...)
 {
         va_list args;
@@ -1068,7 +1068,7 @@ init_d_st(struct Channel *chanp)
         return 0;
 }
 
-static void
+static __attribute__((format(printf, 2, 3))) void
 callc_debug(struct FsmInst *fi, char *fmt, ...)
 {
         va_list args;
diff --git a/drivers/isdn/hisax/config.c b/drivers/isdn/hisax/config.c
index b133378d4dc..c110f8679ba 100644
--- a/drivers/isdn/hisax/config.c
+++ b/drivers/isdn/hisax/config.c
@@ -1917,7 +1917,7 @@ static void EChannel_proc_rcv(struct hisax_d_if *d_if)
 #ifdef CONFIG_PCI
 #include <linux/pci.h>
 
-static struct pci_device_id hisax_pci_tbl[] __devinitdata = {
+static struct pci_device_id hisax_pci_tbl[] __devinitdata __used = {
 #ifdef CONFIG_HISAX_FRITZPCI
         {PCI_VDEVICE(AVM,      PCI_DEVICE_ID_AVM_A1)                    },
 #endif
diff --git a/drivers/isdn/hisax/hfc_2bds0.c b/drivers/isdn/hisax/hfc_2bds0.c
index 7250f56a524..a16459a1332 100644
--- a/drivers/isdn/hisax/hfc_2bds0.c
+++ b/drivers/isdn/hisax/hfc_2bds0.c
@@ -292,7 +292,7 @@ hfc_fill_fifo(struct BCState *bcs)
         }
         count = GetFreeFifoBytes_B(bcs);
         if (cs->debug & L1_DEB_HSCX)
-                debugl1(cs, "hfc_fill_fifo %d count(%ld/%d),%lx",
+                debugl1(cs, "hfc_fill_fifo %d count(%u/%d),%lx",
                         bcs->channel, bcs->tx_skb->len,
                         count, current->state);
         if (count < bcs->tx_skb->len) {
@@ -719,7 +719,7 @@ hfc_fill_dfifo(struct IsdnCardState *cs)
         }
         count = GetFreeFifoBytes_D(cs);
         if (cs->debug & L1_DEB_ISAC)
-                debugl1(cs, "hfc_fill_Dfifo count(%ld/%d)",
+                debugl1(cs, "hfc_fill_Dfifo count(%u/%d)",
                         cs->tx_skb->len, count);
         if (count < cs->tx_skb->len) {
                 if (cs->debug & L1_DEB_ISAC)
diff --git a/drivers/isdn/hisax/hfc_2bs0.c b/drivers/isdn/hisax/hfc_2bs0.c
index b1f6481e119..626f85df302 100644
--- a/drivers/isdn/hisax/hfc_2bs0.c
+++ b/drivers/isdn/hisax/hfc_2bs0.c
@@ -282,7 +282,7 @@ hfc_fill_fifo(struct BCState *bcs)
             count += cs->hw.hfc.fifosize; 
         } /* L1_MODE_TRANS */
         if (cs->debug & L1_DEB_HSCX)
-                debugl1(cs, "hfc_fill_fifo %d count(%ld/%d)",
+                debugl1(cs, "hfc_fill_fifo %d count(%u/%d)",
                         bcs->channel, bcs->tx_skb->len,
                         count);
         if (count < bcs->tx_skb->len) {
diff --git a/drivers/isdn/hisax/hfc_pci.c b/drivers/isdn/hisax/hfc_pci.c
index 917cc84065b..3147020d188 100644
--- a/drivers/isdn/hisax/hfc_pci.c
+++ b/drivers/isdn/hisax/hfc_pci.c
@@ -550,7 +550,7 @@ hfcpci_fill_dfifo(struct IsdnCardState *cs)
                 count += D_FIFO_SIZE;   /* count now contains available bytes */
 
         if (cs->debug & L1_DEB_ISAC)
-                debugl1(cs, "hfcpci_fill_Dfifo count(%ld/%d)",
+                debugl1(cs, "hfcpci_fill_Dfifo count(%u/%d)",
                         cs->tx_skb->len, count);
         if (count < cs->tx_skb->len) {
                 if (cs->debug & L1_DEB_ISAC)
@@ -681,7 +681,7 @@ hfcpci_fill_fifo(struct BCState *bcs)
                 count += B_FIFO_SIZE;   /* count now contains available bytes */
 
         if (cs->debug & L1_DEB_HSCX)
-                debugl1(cs, "hfcpci_fill_fifo %d count(%ld/%d),%lx",
+                debugl1(cs, "hfcpci_fill_fifo %d count(%u/%d),%lx",
                         bcs->channel, bcs->tx_skb->len,
                         count, current->state);
 
diff --git a/drivers/isdn/hisax/hfc_sx.c b/drivers/isdn/hisax/hfc_sx.c
index 5aa138eb0b3..1235b7131ae 100644
--- a/drivers/isdn/hisax/hfc_sx.c
+++ b/drivers/isdn/hisax/hfc_sx.c
@@ -179,7 +179,7 @@ write_fifo(struct IsdnCardState *cs, struct sk_buff *skb, u_char fifo, int trans
           count += fifo_size;   /* count now contains available bytes */
 
         if (cs->debug & L1_DEB_ISAC_FIFO)
-          debugl1(cs, "hfcsx_write_fifo %d count(%ld/%d)",
+          debugl1(cs, "hfcsx_write_fifo %d count(%u/%d)",
                   fifo, skb->len, count);
         if (count < skb->len) {
           if (cs->debug & L1_DEB_ISAC_FIFO)
@@ -265,7 +265,7 @@ read_fifo(struct IsdnCardState *cs, u_char fifo, int trans_max)
           count++;
 
           if (cs->debug & L1_DEB_ISAC_FIFO)
-            debugl1(cs, "hfcsx_read_fifo %d count %ld)",
+            debugl1(cs, "hfcsx_read_fifo %d count %u)",
                     fifo, count);
 
           if ((count > fifo_size) || (count < 4)) {
@@ -986,7 +986,7 @@ HFCSX_l1hw(struct PStack *st, int pr, void *arg)
                                 default:
                                         spin_unlock_irqrestore(&cs->lock, flags);
                                         if (cs->debug & L1_DEB_WARN)
-                                                debugl1(cs, "hfcsx_l1hw loop invalid %4lx", arg);
+                                                debugl1(cs, "hfcsx_l1hw loop invalid %4lx", (unsigned long)arg);
                                         return;
                         }
                         cs->hw.hfcsx.trm |= 0x80;       /* enable IOM-loop */
diff --git a/drivers/isdn/hisax/hisax.h b/drivers/isdn/hisax/hisax.h
index 32ab3924aa7..de1c669c7b1 100644
--- a/drivers/isdn/hisax/hisax.h
+++ b/drivers/isdn/hisax/hisax.h
@@ -1286,7 +1286,9 @@ int jiftime(char *s, long mark);
 
 int HiSax_command(isdn_ctrl * ic);
 int HiSax_writebuf_skb(int id, int chan, int ack, struct sk_buff *skb);
+__attribute__((format(printf, 3, 4)))
 void HiSax_putstatus(struct IsdnCardState *cs, char *head, char *fmt, ...);
+__attribute__((format(printf, 3, 0)))
 void VHiSax_putstatus(struct IsdnCardState *cs, char *head, char *fmt, va_list args);
 void HiSax_reportcard(int cardnr, int sel);
 int QuickHex(char *txt, u_char * p, int cnt);
diff --git a/drivers/isdn/hisax/ipacx.c b/drivers/isdn/hisax/ipacx.c
index 751b25f2ff5..332104103e1 100644
--- a/drivers/isdn/hisax/ipacx.c
+++ b/drivers/isdn/hisax/ipacx.c
@@ -717,7 +717,7 @@ bch_mode(struct BCState *bcs, int mode, int bc)
 
         bc = bc ? 1 : 0;  // in case bc is greater than 1
         if (cs->debug & L1_DEB_HSCX)
-                debugl1(cs, "mode_bch() switch B-% mode %d chan %d", hscx, mode, bc);
+                debugl1(cs, "mode_bch() switch B-%d mode %d chan %d", hscx, mode, bc);
         bcs->mode = mode;
         bcs->channel = bc;
   
diff --git a/drivers/isdn/hisax/isar.c b/drivers/isdn/hisax/isar.c
index 2e72227bd07..1be4552d94b 100644
--- a/drivers/isdn/hisax/isar.c
+++ b/drivers/isdn/hisax/isar.c
@@ -953,7 +953,7 @@ isar_pump_statev_modem(struct BCState *bcs, u_char devt) {
                         break;
                 case PSEV_GSTN_CLR:
                         if (cs->debug & L1_DEB_HSCX)
-                                debugl1(cs, "pump stev GSTN CLEAR", devt);
+                                debugl1(cs, "pump stev GSTN CLEAR");
                         break;
                 default:
                         if (cs->debug & L1_DEB_HSCX)
@@ -1268,7 +1268,7 @@ isar_int_main(struct IsdnCardState *cs)
 static void
 ftimer_handler(struct BCState *bcs) {
         if (bcs->cs->debug)
-                debugl1(bcs->cs, "ftimer flags %04x",
+                debugl1(bcs->cs, "ftimer flags %04lx",
                         bcs->Flag);
         test_and_clear_bit(BC_FLG_FTI_RUN, &bcs->Flag);
         if (test_and_clear_bit(BC_FLG_LL_CONN, &bcs->Flag)) {
@@ -1748,7 +1748,7 @@ isar_auxcmd(struct IsdnCardState *cs, isdn_ctrl *ic) {
         struct BCState *bcs;
 
         if (cs->debug & L1_DEB_HSCX)
-                debugl1(cs, "isar_auxcmd cmd/ch %x/%d", ic->command, ic->arg);
+                debugl1(cs, "isar_auxcmd cmd/ch %x/%ld", ic->command, ic->arg);
         switch (ic->command) {
                 case (ISDN_CMD_FAXCMD):
                         bcs = cs->channel[ic->arg].bcs;
diff --git a/drivers/isdn/hisax/isdnl1.h b/drivers/isdn/hisax/isdnl1.h
index 172ad4c8c96..425d86116f2 100644
--- a/drivers/isdn/hisax/isdnl1.h
+++ b/drivers/isdn/hisax/isdnl1.h
@@ -21,6 +21,7 @@
 #define B_XMTBUFREADY   1
 #define B_ACKPENDING    2
 
+__attribute__((format(printf, 2, 3)))
 void debugl1(struct IsdnCardState *cs, char *fmt, ...);
 void DChannel_proc_xmt(struct IsdnCardState *cs);
 void DChannel_proc_rcv(struct IsdnCardState *cs);
diff --git a/drivers/isdn/hisax/isdnl3.c b/drivers/isdn/hisax/isdnl3.c
index fd0b643ab74..ad291f21b20 100644
--- a/drivers/isdn/hisax/isdnl3.c
+++ b/drivers/isdn/hisax/isdnl3.c
@@ -66,7 +66,7 @@ static char *strL3Event[] =
         "EV_TIMEOUT",
 };
 
-static void
+static __attribute__((format(printf, 2, 3))) void
 l3m_debug(struct FsmInst *fi, char *fmt, ...)
 {
         va_list args;
diff --git a/drivers/isdn/hisax/netjet.c b/drivers/isdn/hisax/netjet.c
index 5d7f0f2ff9b..644891efc26 100644
--- a/drivers/isdn/hisax/netjet.c
+++ b/drivers/isdn/hisax/netjet.c
@@ -254,7 +254,7 @@ static int make_raw_data(struct BCState *bcs) {
                 val >>= 1;
         }
         if (bcs->cs->debug & L1_DEB_HSCX)
-                debugl1(bcs->cs,"tiger make_raw: in %ld out %d.%d",
+                debugl1(bcs->cs,"tiger make_raw: in %u out %d.%d",
                         bcs->tx_skb->len, s_cnt, bitcnt);
         if (bitcnt) {
                 while (8>bitcnt++) {
@@ -361,7 +361,7 @@ static int make_raw_data_56k(struct BCState *bcs) {
                 val >>= 1;
         }
         if (bcs->cs->debug & L1_DEB_HSCX)
-                debugl1(bcs->cs,"tiger make_raw_56k: in %ld out %d.%d",
+                debugl1(bcs->cs,"tiger make_raw_56k: in %u out %d.%d",
                         bcs->tx_skb->len, s_cnt, bitcnt);
         if (bitcnt) {
                 while (8>bitcnt++) {
@@ -612,7 +612,7 @@ void netjet_fill_dma(struct BCState *bcs)
         if (!bcs->tx_skb)
                 return;
         if (bcs->cs->debug & L1_DEB_HSCX)
-                debugl1(bcs->cs,"tiger fill_dma1: c%d %4x", bcs->channel,
+                debugl1(bcs->cs,"tiger fill_dma1: c%d %4lx", bcs->channel,
                         bcs->Flag);
         if (test_and_set_bit(BC_FLG_BUSY, &bcs->Flag))
                 return;
@@ -625,7 +625,7 @@ void netjet_fill_dma(struct BCState *bcs)
                         return;         
         };
         if (bcs->cs->debug & L1_DEB_HSCX)
-                debugl1(bcs->cs,"tiger fill_dma2: c%d %4x", bcs->channel,
+                debugl1(bcs->cs,"tiger fill_dma2: c%d %4lx", bcs->channel,
                         bcs->Flag);
         if (test_and_clear_bit(BC_FLG_NOFRAME, &bcs->Flag)) {
                 write_raw(bcs, bcs->hw.tiger.sendp, bcs->hw.tiger.free);
@@ -667,7 +667,7 @@ void netjet_fill_dma(struct BCState *bcs)
                 write_raw(bcs, p, cnt);
         }
         if (bcs->cs->debug & L1_DEB_HSCX)
-                debugl1(bcs->cs,"tiger fill_dma3: c%d %4x", bcs->channel,
+                debugl1(bcs->cs,"tiger fill_dma3: c%d %4lx", bcs->channel,
                         bcs->Flag);
 }
 
diff --git a/drivers/isdn/hisax/st5481_d.c b/drivers/isdn/hisax/st5481_d.c
index b7876b19fe7..44082637a09 100644
--- a/drivers/isdn/hisax/st5481_d.c
+++ b/drivers/isdn/hisax/st5481_d.c
@@ -167,7 +167,8 @@ static struct FsmNode L1FnList[] __initdata =
         {ST_L1_F8, EV_IND_RSY,           l1_ignore},
 };
 
-static void l1m_debug(struct FsmInst *fi, char *fmt, ...)
+static __attribute__((format(printf, 2, 3)))
+void l1m_debug(struct FsmInst *fi, char *fmt, ...)
 {
         va_list args;
         char buf[256];
@@ -269,7 +270,8 @@ static char *strDoutEvent[] =
         "EV_DOUT_UNDERRUN",
 };
 
-static void dout_debug(struct FsmInst *fi, char *fmt, ...)
+static __attribute__((format(printf, 2, 3)))
+void dout_debug(struct FsmInst *fi, char *fmt, ...)
 {
         va_list args;
         char buf[256];
diff --git a/drivers/isdn/i4l/isdn_concap.c b/drivers/isdn/i4l/isdn_concap.c
index 46048e55f24..d568689669f 100644
--- a/drivers/isdn/i4l/isdn_concap.c
+++ b/drivers/isdn/i4l/isdn_concap.c
@@ -61,7 +61,7 @@ static int isdn_concap_dl_data_req(struct concap_proto *concap, struct sk_buff *
 static int isdn_concap_dl_connect_req(struct concap_proto *concap)
 {
         struct net_device *ndev = concap -> net_dev;
-        isdn_net_local *lp = (isdn_net_local *) netdev_priv(ndev);
+        isdn_net_local *lp = netdev_priv(ndev);
         int ret;
         IX25DEBUG( "isdn_concap_dl_connect_req: %s \n", ndev -> name);
 
diff --git a/drivers/isdn/i4l/isdn_net.c b/drivers/isdn/i4l/isdn_net.c
index 26d44c3ca1d..afeede7ee29 100644
--- a/drivers/isdn/i4l/isdn_net.c
+++ b/drivers/isdn/i4l/isdn_net.c
@@ -827,7 +827,7 @@ isdn_net_dial(void)
 void
 isdn_net_hangup(struct net_device *d)
 {
-        isdn_net_local *lp = (isdn_net_local *) netdev_priv(d);
+        isdn_net_local *lp = netdev_priv(d);
         isdn_ctrl cmd;
 #ifdef CONFIG_ISDN_X25
         struct concap_proto *cprot = lp->netdev->cprot;
@@ -1052,7 +1052,7 @@ isdn_net_xmit(struct net_device *ndev, struct sk_buff *skb)
 {
         isdn_net_dev *nd;
         isdn_net_local *slp;
-        isdn_net_local *lp = (isdn_net_local *) netdev_priv(ndev);
+        isdn_net_local *lp = netdev_priv(ndev);
         int retv = NETDEV_TX_OK;
 
         if (((isdn_net_local *) netdev_priv(ndev))->master) {
@@ -1116,7 +1116,7 @@ isdn_net_xmit(struct net_device *ndev, struct sk_buff *skb)
 static void
 isdn_net_adjust_hdr(struct sk_buff *skb, struct net_device *dev)
 {
-        isdn_net_local *lp = (isdn_net_local *) netdev_priv(dev);
+        isdn_net_local *lp = netdev_priv(dev);
         if (!skb)
                 return;
         if (lp->p_encap == ISDN_NET_ENCAP_ETHER) {
@@ -1131,7 +1131,7 @@ isdn_net_adjust_hdr(struct sk_buff *skb, struct net_device *dev)
 
 static void isdn_net_tx_timeout(struct net_device * ndev)
 {
-        isdn_net_local *lp = (isdn_net_local *) netdev_priv(ndev);
+        isdn_net_local *lp = netdev_priv(ndev);
 
         printk(KERN_WARNING "isdn_tx_timeout dev %s dialstate %d\n", ndev->name, lp->dialstate);
         if (!lp->dialstate){
@@ -1165,7 +1165,7 @@ static void isdn_net_tx_timeout(struct net_device * ndev)
 static netdev_tx_t
 isdn_net_start_xmit(struct sk_buff *skb, struct net_device *ndev)
 {
-        isdn_net_local *lp = (isdn_net_local *) netdev_priv(ndev);
+        isdn_net_local *lp = netdev_priv(ndev);
 #ifdef CONFIG_ISDN_X25
         struct concap_proto * cprot = lp -> netdev -> cprot;
 /* At this point hard_start_xmit() passes control to the encapsulation
@@ -1347,7 +1347,7 @@ isdn_net_close(struct net_device *dev)
 static struct net_device_stats *
 isdn_net_get_stats(struct net_device *dev)
 {
-        isdn_net_local *lp = (isdn_net_local *) netdev_priv(dev);
+        isdn_net_local *lp = netdev_priv(dev);
         return &lp->stats;
 }
 
@@ -1426,7 +1426,7 @@ isdn_net_ciscohdlck_alloc_skb(isdn_net_local *lp, int len)
 static int
 isdn_ciscohdlck_dev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 {
-        isdn_net_local *lp = (isdn_net_local *) netdev_priv(dev);
+        isdn_net_local *lp = netdev_priv(dev);
         unsigned long len = 0;
         unsigned long expires = 0;
         int tmp = 0;
@@ -1493,7 +1493,7 @@ isdn_ciscohdlck_dev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 static int isdn_net_ioctl(struct net_device *dev,
                           struct ifreq *ifr, int cmd)
 {
-        isdn_net_local *lp = (isdn_net_local *) netdev_priv(dev);
+        isdn_net_local *lp = netdev_priv(dev);
 
         switch (lp->p_encap) {
 #ifdef CONFIG_ISDN_PPP
@@ -1786,7 +1786,7 @@ isdn_net_ciscohdlck_receive(isdn_net_local *lp, struct sk_buff *skb)
 static void
 isdn_net_receive(struct net_device *ndev, struct sk_buff *skb)
 {
-        isdn_net_local *lp = (isdn_net_local *) netdev_priv(ndev);
+        isdn_net_local *lp = netdev_priv(ndev);
         isdn_net_local *olp = lp;       /* original 'lp' */
 #ifdef CONFIG_ISDN_X25
         struct concap_proto *cprot = lp -> netdev -> cprot;
@@ -1800,7 +1800,7 @@ isdn_net_receive(struct net_device *ndev, struct sk_buff *skb)
                  * handle master's statistics and hangup-timeout
                  */
                 ndev = lp->master;
-                lp = (isdn_net_local *) netdev_priv(ndev);
+                lp = netdev_priv(ndev);
                 lp->stats.rx_packets++;
                 lp->stats.rx_bytes += skb->len;
         }
diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c
index fe824e0cbb2..9e8162c80bb 100644
--- a/drivers/isdn/i4l/isdn_ppp.c
+++ b/drivers/isdn/i4l/isdn_ppp.c
@@ -1147,15 +1147,14 @@ isdn_ppp_push_higher(isdn_net_dev * net_dev, isdn_net_local * lp, struct sk_buff
         }
 
         if (is->pass_filter
-            && sk_run_filter(skb, is->pass_filter, is->pass_len) == 0) {
+            && sk_run_filter(skb, is->pass_filter) == 0) {
                 if (is->debug & 0x2)
                         printk(KERN_DEBUG "IPPP: inbound frame filtered.\n");
                 kfree_skb(skb);
                 return;
         }
         if (!(is->active_filter
-              && sk_run_filter(skb, is->active_filter,
-                               is->active_len) == 0)) {
+              && sk_run_filter(skb, is->active_filter) == 0)) {
                 if (is->debug & 0x2)
                         printk(KERN_DEBUG "IPPP: link-active filter: reseting huptimer.\n");
                 lp->huptimer = 0;
@@ -1221,7 +1220,7 @@ isdn_ppp_xmit(struct sk_buff *skb, struct net_device *netdev)
         struct ippp_struct *ipt,*ipts;
         int slot, retval = NETDEV_TX_OK;
 
-        mlp = (isdn_net_local *) netdev_priv(netdev);
+        mlp = netdev_priv(netdev);
         nd = mlp->netdev;       /* get master lp */
 
         slot = mlp->ppp_slot;
@@ -1294,15 +1293,14 @@ isdn_ppp_xmit(struct sk_buff *skb, struct net_device *netdev)
         }
 
         if (ipt->pass_filter
-            && sk_run_filter(skb, ipt->pass_filter, ipt->pass_len) == 0) {
+            && sk_run_filter(skb, ipt->pass_filter) == 0) {
                 if (ipt->debug & 0x4)
                         printk(KERN_DEBUG "IPPP: outbound frame filtered.\n");
                 kfree_skb(skb);
                 goto unlock;
         }
         if (!(ipt->active_filter
-              && sk_run_filter(skb, ipt->active_filter,
-                               ipt->active_len) == 0)) {
+              && sk_run_filter(skb, ipt->active_filter) == 0)) {
                 if (ipt->debug & 0x4)
                         printk(KERN_DEBUG "IPPP: link-active filter: reseting huptimer.\n");
                 lp->huptimer = 0;
@@ -1492,9 +1490,9 @@ int isdn_ppp_autodial_filter(struct sk_buff *skb, isdn_net_local *lp)
         }
         
         drop |= is->pass_filter
-                && sk_run_filter(skb, is->pass_filter, is->pass_len) == 0;
+                && sk_run_filter(skb, is->pass_filter) == 0;
         drop |= is->active_filter
-                && sk_run_filter(skb, is->active_filter, is->active_len) == 0;
+                && sk_run_filter(skb, is->active_filter) == 0;
         
         skb_push(skb, IPPP_MAX_HEADER - 4);
         return drop;
@@ -1985,7 +1983,7 @@ isdn_ppp_dev_ioctl_stats(int slot, struct ifreq *ifr, struct net_device *dev)
 {
         struct ppp_stats __user *res = ifr->ifr_data;
         struct ppp_stats t;
-        isdn_net_local *lp = (isdn_net_local *) netdev_priv(dev);
+        isdn_net_local *lp = netdev_priv(dev);
 
         if (!access_ok(VERIFY_WRITE, res, sizeof(struct ppp_stats)))
                 return -EFAULT;
@@ -2024,7 +2022,7 @@ isdn_ppp_dev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 {
         int error=0;
         int len;
-        isdn_net_local *lp = (isdn_net_local *) netdev_priv(dev);
+        isdn_net_local *lp = netdev_priv(dev);
 
 
         if (lp->p_encap != ISDN_NET_ENCAP_SYNCPPP)
@@ -2091,7 +2089,7 @@ isdn_ppp_dial_slave(char *name)
 
         sdev = lp->slave;
         while (sdev) {
-                isdn_net_local *mlp = (isdn_net_local *) netdev_priv(sdev);
+                isdn_net_local *mlp = netdev_priv(sdev);
                 if (!(mlp->flags & ISDN_NET_CONNECTED))
                         break;
                 sdev = mlp->slave;
@@ -2099,7 +2097,7 @@ isdn_ppp_dial_slave(char *name)
         if (!sdev)
                 return 2;
 
-        isdn_net_dial_req((isdn_net_local *) netdev_priv(sdev));
+        isdn_net_dial_req(netdev_priv(sdev));
         return 0;
 #else
         return -1;
@@ -2122,7 +2120,7 @@ isdn_ppp_hangup_slave(char *name)
 
         sdev = lp->slave;
         while (sdev) {
-                isdn_net_local *mlp = (isdn_net_local *) netdev_priv(sdev);
+                isdn_net_local *mlp = netdev_priv(sdev);
 
                 if (mlp->slave) { /* find last connected link in chain */
                         isdn_net_local *nlp = ISDN_SLAVE_PRIV(mlp);
diff --git a/drivers/isdn/mISDN/layer1.c b/drivers/isdn/mISDN/layer1.c
index ac4aa18c632..5cc7c001c52 100644
--- a/drivers/isdn/mISDN/layer1.c
+++ b/drivers/isdn/mISDN/layer1.c
@@ -99,12 +99,16 @@ static void
 l1m_debug(struct FsmInst *fi, char *fmt, ...)
 {
         struct layer1 *l1 = fi->userdata;
+        struct va_format vaf;
         va_list va;
 
         va_start(va, fmt);
-        printk(KERN_DEBUG "%s: ", dev_name(&l1->dch->dev.dev));
-        vprintk(fmt, va);
-        printk("\n");
+
+        vaf.fmt = fmt;
+        vaf.va = &va;
+
+        printk(KERN_DEBUG "%s: %pV\n", dev_name(&l1->dch->dev.dev), &vaf);
+
         va_end(va);
 }
 
diff --git a/drivers/isdn/mISDN/layer2.c b/drivers/isdn/mISDN/layer2.c
index c9737178876..4ae75053c9d 100644
--- a/drivers/isdn/mISDN/layer2.c
+++ b/drivers/isdn/mISDN/layer2.c
@@ -95,14 +95,20 @@ static void
 l2m_debug(struct FsmInst *fi, char *fmt, ...)
 {
         struct layer2 *l2 = fi->userdata;
+        struct va_format vaf;
         va_list va;
 
         if (!(*debug & DEBUG_L2_FSM))
                 return;
+
         va_start(va, fmt);
-        printk(KERN_DEBUG "l2 (sapi %d tei %d): ", l2->sapi, l2->tei);
-        vprintk(fmt, va);
-        printk("\n");
+
+        vaf.fmt = fmt;
+        vaf.va = &va;
+
+        printk(KERN_DEBUG "l2 (sapi %d tei %d): %pV\n",
+               l2->sapi, l2->tei, &vaf);
+
         va_end(va);
 }
 
diff --git a/drivers/isdn/mISDN/tei.c b/drivers/isdn/mISDN/tei.c
index 1b85d9d2749..687c9b6264a 100644
--- a/drivers/isdn/mISDN/tei.c
+++ b/drivers/isdn/mISDN/tei.c
@@ -79,14 +79,19 @@ static void
 da_debug(struct FsmInst *fi, char *fmt, ...)
 {
         struct manager  *mgr = fi->userdata;
+        struct va_format vaf;
         va_list va;
 
         if (!(*debug & DEBUG_L2_TEIFSM))
                 return;
+
         va_start(va, fmt);
-        printk(KERN_DEBUG "mgr(%d): ", mgr->ch.st->dev->id);
-        vprintk(fmt, va);
-        printk("\n");
+
+        vaf.fmt = fmt;
+        vaf.va = &va;
+
+        printk(KERN_DEBUG "mgr(%d): %pV\n", mgr->ch.st->dev->id, &vaf);
+
         va_end(va);
 }
 
@@ -223,14 +228,20 @@ static void
 tei_debug(struct FsmInst *fi, char *fmt, ...)
 {
         struct teimgr   *tm = fi->userdata;
+        struct va_format vaf;
         va_list va;
 
         if (!(*debug & DEBUG_L2_TEIFSM))
                 return;
+
         va_start(va, fmt);
-        printk(KERN_DEBUG "sapi(%d) tei(%d): ", tm->l2->sapi, tm->l2->tei);
-        vprintk(fmt, va);
-        printk("\n");
+
+        vaf.fmt = fmt;
+        vaf.va = &va;
+
+        printk(KERN_DEBUG "sapi(%d) tei(%d): %pV\n",
+               tm->l2->sapi, tm->l2->tei, &vaf);
+
         va_end(va);
 }
 
diff --git a/drivers/net/3c507.c b/drivers/net/3c507.c
index ea9b7a098c9..475a66d95b3 100644
--- a/drivers/net/3c507.c
+++ b/drivers/net/3c507.c
@@ -201,7 +201,7 @@ struct net_local {
 #define RX_BUF_SIZE     (1518+14+18)    /* packet+header+RBD */
 #define RX_BUF_END              (dev->mem_end - dev->mem_start)
 
-#define TX_TIMEOUT 5
+#define TX_TIMEOUT (HZ/20)
 
 /*
   That's it: only 86 bytes to set up the beast, including every extra
diff --git a/drivers/net/3c515.c b/drivers/net/3c515.c
index cdf7226a7c4..d2bb4b254c5 100644
--- a/drivers/net/3c515.c
+++ b/drivers/net/3c515.c
@@ -98,7 +98,7 @@ static int rx_nocopy, rx_copy, queued_packet;
 #define WAIT_TX_AVAIL 200
 
 /* Operational parameter that usually are not changed. */
-#define TX_TIMEOUT  40          /* Time in jiffies before concluding Tx hung */
+#define TX_TIMEOUT  ((4*HZ)/10) /* Time in jiffies before concluding Tx hung */
 
 /* The size here is somewhat misleading: the Corkscrew also uses the ISA
    aliased registers at <base>+0x400.
diff --git a/drivers/net/82596.c b/drivers/net/82596.c
index e2c9c5b949f..be1f1970c84 100644
--- a/drivers/net/82596.c
+++ b/drivers/net/82596.c
@@ -191,7 +191,7 @@ enum commands {
 #define  RX_SUSPEND     0x0030
 #define  RX_ABORT       0x0040
 
-#define TX_TIMEOUT      5
+#define TX_TIMEOUT      (HZ/20)
 
 
 struct i596_reg {
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index a445a0492c5..a20693fcb32 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -1533,7 +1533,7 @@ config E100
 
           <http://support.intel.com/support/network/adapter/pro100/21397.htm>
 
-          to identify the adapter.
+          to identify the adapter.
 
           For the latest Intel PRO/100 network driver for Linux, see:
 
@@ -1786,17 +1786,17 @@ config KS8842
         tristate "Micrel KSZ8841/42 with generic bus interface"
         depends on HAS_IOMEM && DMA_ENGINE
         help
-         This platform driver is for KSZ8841(1-port) / KS8842(2-port)
-         ethernet switch chip (managed, VLAN, QoS) from Micrel or
-         Timberdale(FPGA).
+          This platform driver is for KSZ8841(1-port) / KS8842(2-port)
+          ethernet switch chip (managed, VLAN, QoS) from Micrel or
+          Timberdale(FPGA).
 
 config KS8851
-       tristate "Micrel KS8851 SPI"
-       depends on SPI
-       select MII
+        tristate "Micrel KS8851 SPI"
+        depends on SPI
+        select MII
         select CRC32
-       help
-         SPI driver for Micrel KS8851 SPI attached network chip.
+        help
+          SPI driver for Micrel KS8851 SPI attached network chip.
 
 config KS8851_MLL
         tristate "Micrel KS8851 MLL"
@@ -2133,25 +2133,25 @@ config IP1000
           will be called ipg.  This is recommended.
 
 config IGB
-       tristate "Intel(R) 82575/82576 PCI-Express Gigabit Ethernet support"
-       depends on PCI
-       ---help---
-         This driver supports Intel(R) 82575/82576 gigabit ethernet family of
-         adapters.  For more information on how to identify your adapter, go
-         to the Adapter & Driver ID Guide at:
+        tristate "Intel(R) 82575/82576 PCI-Express Gigabit Ethernet support"
+        depends on PCI
+        ---help---
+          This driver supports Intel(R) 82575/82576 gigabit ethernet family of
+          adapters.  For more information on how to identify your adapter, go
+          to the Adapter & Driver ID Guide at:
 
-         <http://support.intel.com/support/network/adapter/pro100/21397.htm>
+          <http://support.intel.com/support/network/adapter/pro100/21397.htm>
 
-         For general information and support, go to the Intel support
-         website at:
+          For general information and support, go to the Intel support
+          website at:
 
-         <http://support.intel.com>
+          <http://support.intel.com>
 
-         More specific information on configuring the driver is in
-         <file:Documentation/networking/e1000.txt>.
+          More specific information on configuring the driver is in
+          <file:Documentation/networking/e1000.txt>.
 
-         To compile this driver as a module, choose M here. The module
-         will be called igb.
+          To compile this driver as a module, choose M here. The module
+          will be called igb.
 
 config IGB_DCA
         bool "Direct Cache Access (DCA) Support"
@@ -2163,25 +2163,25 @@ config IGB_DCA
           is used, with the intent of lessening the impact of cache misses.
 
 config IGBVF
-       tristate "Intel(R) 82576 Virtual Function Ethernet support"
-       depends on PCI
-       ---help---
-         This driver supports Intel(R) 82576 virtual functions.  For more
-         information on how to identify your adapter, go to the Adapter &
-         Driver ID Guide at:
+        tristate "Intel(R) 82576 Virtual Function Ethernet support"
+        depends on PCI
+        ---help---
+          This driver supports Intel(R) 82576 virtual functions.  For more
+          information on how to identify your adapter, go to the Adapter &
+          Driver ID Guide at:
 
-         <http://support.intel.com/support/network/adapter/pro100/21397.htm>
+          <http://support.intel.com/support/network/adapter/pro100/21397.htm>
 
-         For general information and support, go to the Intel support
-         website at:
+          For general information and support, go to the Intel support
+          website at:
 
-         <http://support.intel.com>
+          <http://support.intel.com>
 
-         More specific information on configuring the driver is in
-         <file:Documentation/networking/e1000.txt>.
+          More specific information on configuring the driver is in
+          <file:Documentation/networking/e1000.txt>.
 
-         To compile this driver as a module, choose M here. The module
-         will be called igbvf.
+          To compile this driver as a module, choose M here. The module
+          will be called igbvf.
 
 source "drivers/net/ixp2000/Kconfig"
 
@@ -2300,14 +2300,14 @@ config SKGE
           will be called skge.  This is recommended.
 
 config SKGE_DEBUG
-       bool "Debugging interface"
-       depends on SKGE && DEBUG_FS
-       help
-         This option adds the ability to dump driver state for debugging.
-         The file /sys/kernel/debug/skge/ethX displays the state of the internal
-         transmit and receive rings.
+        bool "Debugging interface"
+        depends on SKGE && DEBUG_FS
+        help
+          This option adds the ability to dump driver state for debugging.
+          The file /sys/kernel/debug/skge/ethX displays the state of the internal
+          transmit and receive rings.
 
-         If unsure, say N.
+          If unsure, say N.
 
 config SKY2
         tristate "SysKonnect Yukon2 support"
@@ -2326,14 +2326,14 @@ config SKY2
           will be called sky2.  This is recommended.
 
 config SKY2_DEBUG
-       bool "Debugging interface"
-       depends on SKY2 && DEBUG_FS
-       help
-         This option adds the ability to dump driver state for debugging.
-         The file /sys/kernel/debug/sky2/ethX displays the state of the internal
-         transmit and receive rings.
+        bool "Debugging interface"
+        depends on SKY2 && DEBUG_FS
+        help
+          This option adds the ability to dump driver state for debugging.
+          The file /sys/kernel/debug/sky2/ethX displays the state of the internal
+          transmit and receive rings.
 
-         If unsure, say N.
+          If unsure, say N.
 
 config VIA_VELOCITY
         tristate "VIA Velocity support"
@@ -2389,12 +2389,12 @@ config SPIDER_NET
           Cell Processor-Based Blades from IBM.
 
 config TSI108_ETH
-           tristate "Tundra TSI108 gigabit Ethernet support"
-           depends on TSI108_BRIDGE
-           help
-             This driver supports Tundra TSI108 gigabit Ethernet ports.
-             To compile this driver as a module, choose M here: the module
-             will be called tsi108_eth.
+        tristate "Tundra TSI108 gigabit Ethernet support"
+        depends on TSI108_BRIDGE
+        help
+          This driver supports Tundra TSI108 gigabit Ethernet ports.
+          To compile this driver as a module, choose M here: the module
+          will be called tsi108_eth.
 
 config GELIC_NET
         tristate "PS3 Gigabit Ethernet driver"
@@ -2573,32 +2573,32 @@ config MDIO
         tristate
 
 config CHELSIO_T1
-        tristate "Chelsio 10Gb Ethernet support"
-        depends on PCI
+        tristate "Chelsio 10Gb Ethernet support"
+        depends on PCI
         select CRC32
         select MDIO
-        help
-          This driver supports Chelsio gigabit and 10-gigabit
-          Ethernet cards. More information about adapter features and
+        help
+          This driver supports Chelsio gigabit and 10-gigabit
+          Ethernet cards. More information about adapter features and
           performance tuning is in <file:Documentation/networking/cxgb.txt>.
 
-          For general information about Chelsio and our products, visit
-          our website at <http://www.chelsio.com>.
+          For general information about Chelsio and our products, visit
+          our website at <http://www.chelsio.com>.
 
-          For customer support, please visit our customer support page at
-          <http://www.chelsio.com/support.html>.
+          For customer support, please visit our customer support page at
+          <http://www.chelsio.com/support.html>.
 
-          Please send feedback to <linux-bugs@chelsio.com>.
+          Please send feedback to <linux-bugs@chelsio.com>.
 
-          To compile this driver as a module, choose M here: the module
-          will be called cxgb.
+          To compile this driver as a module, choose M here: the module
+          will be called cxgb.
 
 config CHELSIO_T1_1G
-        bool "Chelsio gigabit Ethernet support"
-        depends on CHELSIO_T1
-        help
-          Enables support for Chelsio's gigabit Ethernet PCI cards.  If you
-          are using only 10G cards say 'N' here.
+        bool "Chelsio gigabit Ethernet support"
+        depends on CHELSIO_T1
+        help
+          Enables support for Chelsio's gigabit Ethernet PCI cards.  If you
+          are using only 10G cards say 'N' here.
 
 config CHELSIO_T3_DEPENDS
         tristate
@@ -2728,26 +2728,26 @@ config IXGBE_DCB
           If unsure, say N.
 
 config IXGBEVF
-       tristate "Intel(R) 82599 Virtual Function Ethernet support"
-       depends on PCI_MSI
-       ---help---
-         This driver supports Intel(R) 82599 virtual functions.  For more
-         information on how to identify your adapter, go to the Adapter &
-         Driver ID Guide at:
+        tristate "Intel(R) 82599 Virtual Function Ethernet support"
+        depends on PCI_MSI
+        ---help---
+          This driver supports Intel(R) 82599 virtual functions.  For more
+          information on how to identify your adapter, go to the Adapter &
+          Driver ID Guide at:
 
-         <http://support.intel.com/support/network/sb/CS-008441.htm>
+          <http://support.intel.com/support/network/sb/CS-008441.htm>
 
-         For general information and support, go to the Intel support
-         website at:
+          For general information and support, go to the Intel support
+          website at:
 
-         <http://support.intel.com>
+          <http://support.intel.com>
 
-         More specific information on configuring the driver is in
-         <file:Documentation/networking/ixgbevf.txt>.
+          More specific information on configuring the driver is in
+          <file:Documentation/networking/ixgbevf.txt>.
 
-         To compile this driver as a module, choose M here. The module
-         will be called ixgbevf.  MSI-X interrupt support is required
-         for this driver to work correctly.
+          To compile this driver as a module, choose M here. The module
+          will be called ixgbevf.  MSI-X interrupt support is required
+          for this driver to work correctly.
 
 config IXGB
         tristate "Intel(R) PRO/10GbE support"
@@ -2772,29 +2772,38 @@ config IXGB
           will be called ixgb.
 
 config S2IO
-        tristate "S2IO 10Gbe XFrame NIC"
+        tristate "Exar Xframe 10Gb Ethernet Adapter"
         depends on PCI
         ---help---
-          This driver supports the 10Gbe XFrame NIC of S2IO. 
+          This driver supports Exar Corp's Xframe Series 10Gb Ethernet Adapters.
+
           More specific information on configuring the driver is in 
           <file:Documentation/networking/s2io.txt>.
 
+          To compile this driver as a module, choose M here. The module
+          will be called s2io.
+
 config VXGE
-        tristate "Neterion X3100 Series 10GbE PCIe Server Adapter"
+        tristate "Exar X3100 Series 10GbE PCIe Server Adapter"
         depends on PCI && INET
         ---help---
-          This driver supports Neterion Inc's X3100 Series 10 GbE PCIe
+          This driver supports Exar Corp's X3100 Series 10 GbE PCIe
           I/O Virtualized Server Adapter.
+
           More specific information on configuring the driver is in
           <file:Documentation/networking/vxge.txt>.
 
+          To compile this driver as a module, choose M here. The module
+          will be called vxge.
+
 config VXGE_DEBUG_TRACE_ALL
         bool "Enabling All Debug trace statments in driver"
         default n
         depends on VXGE
         ---help---
           Say Y here if you want to enabling all the debug trace statements in
-          driver. By  default only few debug trace statements are enabled.
+          the vxge driver. By default only few debug trace statements are
+          enabled.
 
 config MYRI10GE
         tristate "Myricom Myri-10G Ethernet support"
@@ -2906,18 +2915,18 @@ config QLGE
           will be called qlge.
 
 config BNA
-        tristate "Brocade 1010/1020 10Gb Ethernet Driver support"
-        depends on PCI
-        ---help---
-          This driver supports Brocade 1010/1020 10Gb CEE capable Ethernet
-          cards.
-          To compile this driver as a module, choose M here: the module
-          will be called bna.
+        tristate "Brocade 1010/1020 10Gb Ethernet Driver support"
+        depends on PCI
+        ---help---
+          This driver supports Brocade 1010/1020 10Gb CEE capable Ethernet
+          cards.
+          To compile this driver as a module, choose M here: the module
+          will be called bna.
 
-          For general information and support, go to the Brocade support
-          website at:
+          For general information and support, go to the Brocade support
+          website at:
 
-          <http://support.brocade.com>
+          <http://support.brocade.com>
 
 source "drivers/net/sfc/Kconfig"
 
@@ -3227,18 +3236,18 @@ config PPP_BSDCOMP
           modules once you have said "make modules". If unsure, say N.
 
 config PPP_MPPE
-       tristate "PPP MPPE compression (encryption) (EXPERIMENTAL)"
-       depends on PPP && EXPERIMENTAL
-       select CRYPTO
-       select CRYPTO_SHA1
-       select CRYPTO_ARC4
-       select CRYPTO_ECB
-       ---help---
-         Support for the MPPE Encryption protocol, as employed by the
-         Microsoft Point-to-Point Tunneling Protocol.
-
-         See http://pptpclient.sourceforge.net/ for information on
-         configuring PPTP clients and servers to utilize this method.
+        tristate "PPP MPPE compression (encryption) (EXPERIMENTAL)"
+        depends on PPP && EXPERIMENTAL
+        select CRYPTO
+        select CRYPTO_SHA1
+        select CRYPTO_ARC4
+        select CRYPTO_ECB
+        ---help---
+          Support for the MPPE Encryption protocol, as employed by the
+          Microsoft Point-to-Point Tunneling Protocol.
+
+          See http://pptpclient.sourceforge.net/ for information on
+          configuring PPTP clients and servers to utilize this method.
 
 config PPPOE
         tristate "PPP over Ethernet (EXPERIMENTAL)"
@@ -3397,14 +3406,14 @@ config VIRTIO_NET
         depends on EXPERIMENTAL && VIRTIO
         ---help---
           This is the virtual network driver for virtio.  It can be used with
-          lguest or QEMU based VMMs (like KVM or Xen).  Say Y or M.
+          lguest or QEMU based VMMs (like KVM or Xen).  Say Y or M.
 
 config VMXNET3
-       tristate "VMware VMXNET3 ethernet driver"
-       depends on PCI && INET
-       help
-         This driver supports VMware's vmxnet3 virtual ethernet NIC.
-         To compile this driver as a module, choose M here: the
-         module will be called vmxnet3.
+        tristate "VMware VMXNET3 ethernet driver"
+        depends on PCI && INET
+        help
+          This driver supports VMware's vmxnet3 virtual ethernet NIC.
+          To compile this driver as a module, choose M here: the
+          module will be called vmxnet3.
 
 endif # NETDEVICES
diff --git a/drivers/net/arm/am79c961a.c b/drivers/net/arm/am79c961a.c
index 62f21106efe..0c9217f48b7 100644
--- a/drivers/net/arm/am79c961a.c
+++ b/drivers/net/arm/am79c961a.c
@@ -340,14 +340,6 @@ am79c961_close(struct net_device *dev)
         return 0;
 }
 
-/*
- * Get the current statistics.
- */
-static struct net_device_stats *am79c961_getstats (struct net_device *dev)
-{
-        return &dev->stats;
-}
-
 static void am79c961_mc_hash(char *addr, unsigned short *hash)
 {
         if (addr[0] & 0x01) {
@@ -665,7 +657,6 @@ static const struct net_device_ops am79c961_netdev_ops = {
         .ndo_open               = am79c961_open,
         .ndo_stop               = am79c961_close,
         .ndo_start_xmit         = am79c961_sendpacket,
-        .ndo_get_stats          = am79c961_getstats,
         .ndo_set_multicast_list = am79c961_setmulticastlist,
         .ndo_tx_timeout         = am79c961_timeout,
         .ndo_validate_addr      = eth_validate_addr,
diff --git a/drivers/net/arm/w90p910_ether.c b/drivers/net/arm/w90p910_ether.c
index 4545d5a06c2..bfea499a351 100644
--- a/drivers/net/arm/w90p910_ether.c
+++ b/drivers/net/arm/w90p910_ether.c
@@ -117,7 +117,7 @@
 #define TX_DESC_SIZE            10
 #define MAX_RBUFF_SZ            0x600
 #define MAX_TBUFF_SZ            0x600
-#define TX_TIMEOUT              50
+#define TX_TIMEOUT              (HZ/2)
 #define DELAY                   1000
 #define CAM0                    0x0
 
diff --git a/drivers/net/at1700.c b/drivers/net/at1700.c
index 89876897a6f..871b1633f54 100644
--- a/drivers/net/at1700.c
+++ b/drivers/net/at1700.c
@@ -150,7 +150,7 @@ struct net_local {
 #define PORT_OFFSET(o) (o)
 
 
-#define TX_TIMEOUT              10
+#define TX_TIMEOUT              (HZ/10)
 
 
 /* Index to functions, as function prototypes. */
diff --git a/drivers/net/atarilance.c b/drivers/net/atarilance.c
index 8cb27cb7bca..ce0091eb06f 100644
--- a/drivers/net/atarilance.c
+++ b/drivers/net/atarilance.c
@@ -116,7 +116,7 @@ MODULE_LICENSE("GPL");
 #define RX_RING_LEN_BITS                (RX_LOG_RING_SIZE << 5)
 #define RX_RING_MOD_MASK                (RX_RING_SIZE - 1)
 
-#define TX_TIMEOUT      20
+#define TX_TIMEOUT      (HZ/5)
 
 /* The LANCE Rx and Tx ring descriptors. */
 struct lance_rx_head {
diff --git a/drivers/net/ax88796.c b/drivers/net/ax88796.c
index b6da4cf3694..4bebff3faea 100644
--- a/drivers/net/ax88796.c
+++ b/drivers/net/ax88796.c
@@ -325,7 +325,7 @@ static void ax_block_output(struct net_device *dev, int count,
 static void
 ax_mii_ei_outbits(struct net_device *dev, unsigned int bits, int len)
 {
-        struct ei_device *ei_local = (struct ei_device *) netdev_priv(dev);
+        struct ei_device *ei_local = netdev_priv(dev);
         void __iomem *memr_addr = (void __iomem *)dev->base_addr + AX_MEMR;
         unsigned int memr;
 
@@ -364,7 +364,7 @@ ax_mii_ei_outbits(struct net_device *dev, unsigned int bits, int len)
 static unsigned int
 ax_phy_ei_inbits(struct net_device *dev, int no)
 {
-        struct ei_device *ei_local = (struct ei_device *) netdev_priv(dev);
+        struct ei_device *ei_local = netdev_priv(dev);
         void __iomem *memr_addr = (void __iomem *)dev->base_addr + AX_MEMR;
         unsigned int memr;
         unsigned int result = 0;
@@ -412,7 +412,7 @@ ax_phy_issueaddr(struct net_device *dev, int phy_addr, int reg, int opc)
 static int
 ax_phy_read(struct net_device *dev, int phy_addr, int reg)
 {
-        struct ei_device *ei_local = (struct ei_device *) netdev_priv(dev);
+        struct ei_device *ei_local = netdev_priv(dev);
         unsigned long flags;
         unsigned int result;
 
@@ -435,7 +435,7 @@ ax_phy_read(struct net_device *dev, int phy_addr, int reg)
 static void
 ax_phy_write(struct net_device *dev, int phy_addr, int reg, int value)
 {
-        struct ei_device *ei = (struct ei_device *) netdev_priv(dev);
+        struct ei_device *ei = netdev_priv(dev);
         struct ax_device  *ax = to_ax_dev(dev);
         unsigned long flags;
 
diff --git a/drivers/net/benet/be.h b/drivers/net/benet/be.h
index 4594a28b1f6..9cab32328bb 100644
--- a/drivers/net/benet/be.h
+++ b/drivers/net/benet/be.h
@@ -38,14 +38,17 @@
 #define BE_NAME                 "ServerEngines BladeEngine2 10Gbps NIC"
 #define BE3_NAME                "ServerEngines BladeEngine3 10Gbps NIC"
 #define OC_NAME                 "Emulex OneConnect 10Gbps NIC"
-#define OC_NAME1                "Emulex OneConnect 10Gbps NIC (be3)"
+#define OC_NAME_BE              OC_NAME "(be3)"
+#define OC_NAME_LANCER          OC_NAME "(Lancer)"
 #define DRV_DESC                "ServerEngines BladeEngine 10Gbps NIC Driver"
 
 #define BE_VENDOR_ID            0x19a2
+#define EMULEX_VENDOR_ID        0x10df
 #define BE_DEVICE_ID1           0x211
 #define BE_DEVICE_ID2           0x221
-#define OC_DEVICE_ID1           0x700
-#define OC_DEVICE_ID2           0x710
+#define OC_DEVICE_ID1           0x700   /* Device Id for BE2 cards */
+#define OC_DEVICE_ID2           0x710   /* Device Id for BE3 cards */
+#define OC_DEVICE_ID3           0xe220  /* Device id for Lancer cards */
 
 static inline char *nic_name(struct pci_dev *pdev)
 {
@@ -53,7 +56,9 @@ static inline char *nic_name(struct pci_dev *pdev)
         case OC_DEVICE_ID1:
                 return OC_NAME;
         case OC_DEVICE_ID2:
-                return OC_NAME1;
+                return OC_NAME_BE;
+        case OC_DEVICE_ID3:
+                return OC_NAME_LANCER;
         case BE_DEVICE_ID2:
                 return BE3_NAME;
         default:
@@ -149,6 +154,7 @@ struct be_eq_obj {
         u16 min_eqd;            /* in usecs */
         u16 max_eqd;            /* in usecs */
         u16 cur_eqd;            /* in usecs */
+        u8  msix_vec_idx;
 
         struct napi_struct napi;
 };
@@ -214,7 +220,9 @@ struct be_rx_obj {
         struct be_rx_stats stats;
         u8 rss_id;
         bool rx_post_starved;   /* Zero rx frags have been posted to BE */
-        u32 cache_line_barrier[16];
+        u16 last_frag_index;
+        u16 rsvd;
+        u32 cache_line_barrier[15];
 };
 
 struct be_vf_cfg {
@@ -260,6 +268,8 @@ struct be_adapter {
         u32 num_rx_qs;
         u32 big_page_size;      /* Compounded page size shared by rx wrbs */
 
+        u8 msix_vec_next_idx;
+
         struct vlan_group *vlan_grp;
         u16 vlans_added;
         u16 max_vlans;  /* Number of vlans supported */
@@ -299,8 +309,8 @@ struct be_adapter {
 
         bool sriov_enabled;
         struct be_vf_cfg vf_cfg[BE_MAX_VF];
-        u8 base_eq_id;
         u8 is_virtfn;
+        u32 sli_family;
 };
 
 #define be_physfn(adapter) (!adapter->is_virtfn)
@@ -309,6 +319,8 @@ struct be_adapter {
 #define BE_GEN2 2
 #define BE_GEN3 3
 
+#define lancer_chip(adapter)            (adapter->pdev->device == OC_DEVICE_ID3)
+
 extern const struct ethtool_ops be_ethtool_ops;
 
 #define tx_stats(adapter)               (&adapter->tx_stats)
@@ -416,10 +428,17 @@ static inline u8 is_udp_pkt(struct sk_buff *skb)
 static inline void be_check_sriov_fn_type(struct be_adapter *adapter)
 {
         u8 data;
-
-        pci_write_config_byte(adapter->pdev, 0xFE, 0xAA);
-        pci_read_config_byte(adapter->pdev, 0xFE, &data);
-        adapter->is_virtfn = (data != 0xAA);
+        u32 sli_intf;
+
+        if (lancer_chip(adapter)) {
+                pci_read_config_dword(adapter->pdev, SLI_INTF_REG_OFFSET,
+                                                                &sli_intf);
+                adapter->is_virtfn = (sli_intf & SLI_INTF_FT_MASK) ? 1 : 0;
+        } else {
+                pci_write_config_byte(adapter->pdev, 0xFE, 0xAA);
+                pci_read_config_byte(adapter->pdev, 0xFE, &data);
+                adapter->is_virtfn = (data != 0xAA);
+        }
 }
 
 static inline void be_vf_eth_addr_generate(struct be_adapter *adapter, u8 *mac)
diff --git a/drivers/net/benet/be_cmds.c b/drivers/net/benet/be_cmds.c
index e4465d222a7..171a08caf2b 100644
--- a/drivers/net/benet/be_cmds.c
+++ b/drivers/net/benet/be_cmds.c
@@ -323,7 +323,12 @@ static int be_mbox_notify_wait(struct be_adapter *adapter)
 
 static int be_POST_stage_get(struct be_adapter *adapter, u16 *stage)
 {
-        u32 sem = ioread32(adapter->csr + MPU_EP_SEMAPHORE_OFFSET);
+        u32 sem;
+
+        if (lancer_chip(adapter))
+                sem  = ioread32(adapter->db + MPU_EP_SEMAPHORE_IF_TYPE2_OFFSET);
+        else
+                sem  = ioread32(adapter->csr + MPU_EP_SEMAPHORE_OFFSET);
 
         *stage = sem & EP_SEMAPHORE_POST_STAGE_MASK;
         if ((sem >> EP_SEMAPHORE_POST_ERR_SHIFT) & EP_SEMAPHORE_POST_ERR_MASK)
@@ -680,16 +685,36 @@ int be_cmd_cq_create(struct be_adapter *adapter,
                 OPCODE_COMMON_CQ_CREATE, sizeof(*req));
 
         req->num_pages =  cpu_to_le16(PAGES_4K_SPANNED(q_mem->va, q_mem->size));
+        if (lancer_chip(adapter)) {
+                req->hdr.version = 1;
+                req->page_size = 1; /* 1 for 4K */
+                AMAP_SET_BITS(struct amap_cq_context_lancer, coalescwm, ctxt,
+                                                                coalesce_wm);
+                AMAP_SET_BITS(struct amap_cq_context_lancer, nodelay, ctxt,
+                                                                no_delay);
+                AMAP_SET_BITS(struct amap_cq_context_lancer, count, ctxt,
+                                                __ilog2_u32(cq->len/256));
+                AMAP_SET_BITS(struct amap_cq_context_lancer, valid, ctxt, 1);
+                AMAP_SET_BITS(struct amap_cq_context_lancer, eventable,
+                                                                ctxt, 1);
+                AMAP_SET_BITS(struct amap_cq_context_lancer, eqid,
+                                                                ctxt, eq->id);
+                AMAP_SET_BITS(struct amap_cq_context_lancer, armed, ctxt, 1);
+        } else {
+                AMAP_SET_BITS(struct amap_cq_context_be, coalescwm, ctxt,
+                                                                coalesce_wm);
+                AMAP_SET_BITS(struct amap_cq_context_be, nodelay,
+                                                                ctxt, no_delay);
+                AMAP_SET_BITS(struct amap_cq_context_be, count, ctxt,
+                                                __ilog2_u32(cq->len/256));
+                AMAP_SET_BITS(struct amap_cq_context_be, valid, ctxt, 1);
+                AMAP_SET_BITS(struct amap_cq_context_be, solevent,
+                                                                ctxt, sol_evts);
+                AMAP_SET_BITS(struct amap_cq_context_be, eventable, ctxt, 1);
+                AMAP_SET_BITS(struct amap_cq_context_be, eqid, ctxt, eq->id);
+                AMAP_SET_BITS(struct amap_cq_context_be, armed, ctxt, 1);
+        }
 
-        AMAP_SET_BITS(struct amap_cq_context, coalescwm, ctxt, coalesce_wm);
-        AMAP_SET_BITS(struct amap_cq_context, nodelay, ctxt, no_delay);
-        AMAP_SET_BITS(struct amap_cq_context, count, ctxt,
-                        __ilog2_u32(cq->len/256));
-        AMAP_SET_BITS(struct amap_cq_context, valid, ctxt, 1);
-        AMAP_SET_BITS(struct amap_cq_context, solevent, ctxt, sol_evts);
-        AMAP_SET_BITS(struct amap_cq_context, eventable, ctxt, 1);
-        AMAP_SET_BITS(struct amap_cq_context, eqid, ctxt, eq->id);
-        AMAP_SET_BITS(struct amap_cq_context, armed, ctxt, 1);
         be_dws_cpu_to_le(ctxt, sizeof(req->context));
 
         be_cmd_page_addrs_prepare(req->pages, ARRAY_SIZE(req->pages), q_mem);
@@ -737,13 +762,27 @@ int be_cmd_mccq_create(struct be_adapter *adapter,
                         OPCODE_COMMON_MCC_CREATE_EXT, sizeof(*req));
 
         req->num_pages = cpu_to_le16(PAGES_4K_SPANNED(q_mem->va, q_mem->size));
+        if (lancer_chip(adapter)) {
+                req->hdr.version = 1;
+                req->cq_id = cpu_to_le16(cq->id);
+
+                AMAP_SET_BITS(struct amap_mcc_context_lancer, ring_size, ctxt,
+                                                be_encoded_q_len(mccq->len));
+                AMAP_SET_BITS(struct amap_mcc_context_lancer, valid, ctxt, 1);
+                AMAP_SET_BITS(struct amap_mcc_context_lancer, async_cq_id,
+                                                                ctxt, cq->id);
+                AMAP_SET_BITS(struct amap_mcc_context_lancer, async_cq_valid,
+                                                                 ctxt, 1);
+
+        } else {
+                AMAP_SET_BITS(struct amap_mcc_context_be, valid, ctxt, 1);
+                AMAP_SET_BITS(struct amap_mcc_context_be, ring_size, ctxt,
+                                                be_encoded_q_len(mccq->len));
+                AMAP_SET_BITS(struct amap_mcc_context_be, cq_id, ctxt, cq->id);
+        }
 
-        AMAP_SET_BITS(struct amap_mcc_context, valid, ctxt, 1);
-        AMAP_SET_BITS(struct amap_mcc_context, ring_size, ctxt,
-                be_encoded_q_len(mccq->len));
-        AMAP_SET_BITS(struct amap_mcc_context, cq_id, ctxt, cq->id);
         /* Subscribe to Link State and Group 5 Events(bits 1 and 5 set) */
-        req->async_event_bitmap[0] |= 0x00000022;
+        req->async_event_bitmap[0] = cpu_to_le32(0x00000022);
         be_dws_cpu_to_le(ctxt, sizeof(req->context));
 
         be_cmd_page_addrs_prepare(req->pages, ARRAY_SIZE(req->pages), q_mem);
diff --git a/drivers/net/benet/be_cmds.h b/drivers/net/benet/be_cmds.h
index 8469ff061f3..83d15c8a9fa 100644
--- a/drivers/net/benet/be_cmds.h
+++ b/drivers/net/benet/be_cmds.h
@@ -309,7 +309,7 @@ struct be_cmd_req_pmac_del {
 /******************** Create CQ ***************************/
 /* Pseudo amap definition in which each bit of the actual structure is defined
  * as a byte: used to calculate offset/shift/mask of each field */
-struct amap_cq_context {
+struct amap_cq_context_be {
         u8 cidx[11];            /* dword 0*/
         u8 rsvd0;               /* dword 0*/
         u8 coalescwm[2];        /* dword 0*/
@@ -332,14 +332,32 @@ struct amap_cq_context {
         u8 rsvd5[32];           /* dword 3*/
 } __packed;
 
+struct amap_cq_context_lancer {
+        u8 rsvd0[12];           /* dword 0*/
+        u8 coalescwm[2];        /* dword 0*/
+        u8 nodelay;             /* dword 0*/
+        u8 rsvd1[12];           /* dword 0*/
+        u8 count[2];            /* dword 0*/
+        u8 valid;               /* dword 0*/
+        u8 rsvd2;               /* dword 0*/
+        u8 eventable;           /* dword 0*/
+        u8 eqid[16];            /* dword 1*/
+        u8 rsvd3[15];           /* dword 1*/
+        u8 armed;               /* dword 1*/
+        u8 rsvd4[32];           /* dword 2*/
+        u8 rsvd5[32];           /* dword 3*/
+} __packed;
+
 struct be_cmd_req_cq_create {
         struct be_cmd_req_hdr hdr;
         u16 num_pages;
-        u16 rsvd0;
-        u8 context[sizeof(struct amap_cq_context) / 8];
+        u8 page_size;
+        u8 rsvd0;
+        u8 context[sizeof(struct amap_cq_context_be) / 8];
         struct phys_addr pages[8];
 } __packed;
 
+
 struct be_cmd_resp_cq_create {
         struct be_cmd_resp_hdr hdr;
         u16 cq_id;
@@ -349,7 +367,7 @@ struct be_cmd_resp_cq_create {
 /******************** Create MCCQ ***************************/
 /* Pseudo amap definition in which each bit of the actual structure is defined
  * as a byte: used to calculate offset/shift/mask of each field */
-struct amap_mcc_context {
+struct amap_mcc_context_be {
         u8 con_index[14];
         u8 rsvd0[2];
         u8 ring_size[4];
@@ -364,12 +382,23 @@ struct amap_mcc_context {
         u8 rsvd2[32];
 } __packed;
 
+struct amap_mcc_context_lancer {
+        u8 async_cq_id[16];
+        u8 ring_size[4];
+        u8 rsvd0[12];
+        u8 rsvd1[31];
+        u8 valid;
+        u8 async_cq_valid[1];
+        u8 rsvd2[31];
+        u8 rsvd3[32];
+} __packed;
+
 struct be_cmd_req_mcc_create {
         struct be_cmd_req_hdr hdr;
         u16 num_pages;
-        u16 rsvd0;
+        u16 cq_id;
         u32 async_event_bitmap[1];
-        u8 context[sizeof(struct amap_mcc_context) / 8];
+        u8 context[sizeof(struct amap_mcc_context_be) / 8];
         struct phys_addr pages[8];
 } __packed;
 
@@ -605,6 +634,7 @@ struct be_hw_stats {
         struct be_rxf_stats rxf;
         u32 rsvd[48];
         struct be_erx_stats erx;
+        u32 rsvd1[6];
 };
 
 struct be_cmd_req_get_stats {
diff --git a/drivers/net/benet/be_hw.h b/drivers/net/benet/be_hw.h
index a2ec5df0d73..4096d977823 100644
--- a/drivers/net/benet/be_hw.h
+++ b/drivers/net/benet/be_hw.h
@@ -32,10 +32,12 @@
 #define MPU_EP_CONTROL          0
 
 /********** MPU semphore ******************/
-#define MPU_EP_SEMAPHORE_OFFSET         0xac
-#define EP_SEMAPHORE_POST_STAGE_MASK    0x0000FFFF
-#define EP_SEMAPHORE_POST_ERR_MASK      0x1
-#define EP_SEMAPHORE_POST_ERR_SHIFT     31
+#define MPU_EP_SEMAPHORE_OFFSET         0xac
+#define MPU_EP_SEMAPHORE_IF_TYPE2_OFFSET        0x400
+#define EP_SEMAPHORE_POST_STAGE_MASK            0x0000FFFF
+#define EP_SEMAPHORE_POST_ERR_MASK              0x1
+#define EP_SEMAPHORE_POST_ERR_SHIFT             31
+
 /* MPU semphore POST stage values */
 #define POST_STAGE_AWAITING_HOST_RDY    0x1 /* FW awaiting goahead from host */
 #define POST_STAGE_HOST_RDY             0x2 /* Host has given go-ahed to FW */
@@ -66,6 +68,28 @@
 #define PCICFG_UE_STATUS_LOW_MASK               0xA8
 #define PCICFG_UE_STATUS_HI_MASK                0xAC
 
+/******** SLI_INTF ***********************/
+#define SLI_INTF_REG_OFFSET                     0x58
+#define SLI_INTF_VALID_MASK                     0xE0000000
+#define SLI_INTF_VALID                          0xC0000000
+#define SLI_INTF_HINT2_MASK                     0x1F000000
+#define SLI_INTF_HINT2_SHIFT                    24
+#define SLI_INTF_HINT1_MASK                     0x00FF0000
+#define SLI_INTF_HINT1_SHIFT                    16
+#define SLI_INTF_FAMILY_MASK                    0x00000F00
+#define SLI_INTF_FAMILY_SHIFT                   8
+#define SLI_INTF_IF_TYPE_MASK                   0x0000F000
+#define SLI_INTF_IF_TYPE_SHIFT                  12
+#define SLI_INTF_REV_MASK                       0x000000F0
+#define SLI_INTF_REV_SHIFT                      4
+#define SLI_INTF_FT_MASK                        0x00000001
+
+
+/* SLI family */
+#define BE_SLI_FAMILY           0x0
+#define LANCER_A0_SLI_FAMILY    0xA
+
+
 /********* ISR0 Register offset **********/
 #define CEV_ISR0_OFFSET                         0xC18
 #define CEV_ISR_SIZE                            4
@@ -73,6 +97,9 @@
 /********* Event Q door bell *************/
 #define DB_EQ_OFFSET                    DB_CQ_OFFSET
 #define DB_EQ_RING_ID_MASK              0x1FF   /* bits 0 - 8 */
+#define DB_EQ_RING_ID_EXT_MASK          0x3e00  /* bits 9-13 */
+#define DB_EQ_RING_ID_EXT_MASK_SHIFT    (2) /* qid bits 9-13 placing at 11-15 */
+
 /* Clear the interrupt for this eq */
 #define DB_EQ_CLR_SHIFT                 (9)     /* bit 9 */
 /* Must be 1 */
@@ -85,6 +112,10 @@
 /********* Compl Q door bell *************/
 #define DB_CQ_OFFSET                    0x120
 #define DB_CQ_RING_ID_MASK              0x3FF   /* bits 0 - 9 */
+#define DB_CQ_RING_ID_EXT_MASK          0x7C00  /* bits 10-14 */
+#define DB_CQ_RING_ID_EXT_MASK_SHIFT    (1)     /* qid bits 10-14
+                                                 placing at 11-15 */
+
 /* Number of event entries processed */
 #define DB_CQ_NUM_POPPED_SHIFT          (16)    /* bits 16 - 28 */
 /* Rearm bit */
diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
index 93354eee2cf..0b35e4a8bf1 100644
--- a/drivers/net/benet/be_main.c
+++ b/drivers/net/benet/be_main.c
@@ -41,6 +41,7 @@ static DEFINE_PCI_DEVICE_TABLE(be_dev_ids) = {
         { PCI_DEVICE(BE_VENDOR_ID, BE_DEVICE_ID2) },
         { PCI_DEVICE(BE_VENDOR_ID, OC_DEVICE_ID1) },
         { PCI_DEVICE(BE_VENDOR_ID, OC_DEVICE_ID2) },
+        { PCI_DEVICE(EMULEX_VENDOR_ID, OC_DEVICE_ID3)},
         { 0 }
 };
 MODULE_DEVICE_TABLE(pci, be_dev_ids);
@@ -188,6 +189,8 @@ static void be_eq_notify(struct be_adapter *adapter, u16 qid,
 {
         u32 val = 0;
         val |= qid & DB_EQ_RING_ID_MASK;
+        val |= ((qid & DB_EQ_RING_ID_EXT_MASK) <<
+                        DB_EQ_RING_ID_EXT_MASK_SHIFT);
 
         if (adapter->eeh_err)
                 return;
@@ -205,6 +208,8 @@ void be_cq_notify(struct be_adapter *adapter, u16 qid, bool arm, u16 num_popped)
 {
         u32 val = 0;
         val |= qid & DB_CQ_RING_ID_MASK;
+        val |= ((qid & DB_CQ_RING_ID_EXT_MASK) <<
+                        DB_CQ_RING_ID_EXT_MASK_SHIFT);
 
         if (adapter->eeh_err)
                 return;
@@ -404,7 +409,8 @@ static void be_tx_stats_update(struct be_adapter *adapter,
 }
 
 /* Determine number of WRB entries needed to xmit data in an skb */
-static u32 wrb_cnt_for_skb(struct sk_buff *skb, bool *dummy)
+static u32 wrb_cnt_for_skb(struct be_adapter *adapter, struct sk_buff *skb,
+                                                                bool *dummy)
 {
         int cnt = (skb->len > skb->data_len);
 
@@ -412,12 +418,13 @@ static u32 wrb_cnt_for_skb(struct sk_buff *skb, bool *dummy)
 
         /* to account for hdr wrb */
         cnt++;
-        if (cnt & 1) {
+        if (lancer_chip(adapter) || !(cnt & 1)) {
+                *dummy = false;
+        } else {
                 /* add a dummy to make it an even num */
                 cnt++;
                 *dummy = true;
-        } else
-                *dummy = false;
+        }
         BUG_ON(cnt > BE_MAX_TX_FRAG_COUNT);
         return cnt;
 }
@@ -443,8 +450,18 @@ static void wrb_fill_hdr(struct be_adapter *adapter, struct be_eth_hdr_wrb *hdr,
                 AMAP_SET_BITS(struct amap_eth_hdr_wrb, lso, hdr, 1);
                 AMAP_SET_BITS(struct amap_eth_hdr_wrb, lso_mss,
                         hdr, skb_shinfo(skb)->gso_size);
-                if (skb_is_gso_v6(skb))
+                if (skb_is_gso_v6(skb) && !lancer_chip(adapter))
                         AMAP_SET_BITS(struct amap_eth_hdr_wrb, lso6, hdr, 1);
+                if (lancer_chip(adapter) && adapter->sli_family  ==
+                                                        LANCER_A0_SLI_FAMILY) {
+                        AMAP_SET_BITS(struct amap_eth_hdr_wrb, ipcs, hdr, 1);
+                        if (is_tcp_pkt(skb))
+                                AMAP_SET_BITS(struct amap_eth_hdr_wrb,
+                                                                tcpcs, hdr, 1);
+                        else if (is_udp_pkt(skb))
+                                AMAP_SET_BITS(struct amap_eth_hdr_wrb,
+                                                                udpcs, hdr, 1);
+                }
         } else if (skb->ip_summed == CHECKSUM_PARTIAL) {
                 if (is_tcp_pkt(skb))
                         AMAP_SET_BITS(struct amap_eth_hdr_wrb, tcpcs, hdr, 1);
@@ -566,7 +583,7 @@ static netdev_tx_t be_xmit(struct sk_buff *skb,
         u32 start = txq->head;
         bool dummy_wrb, stopped = false;
 
-        wrb_cnt = wrb_cnt_for_skb(skb, &dummy_wrb);
+        wrb_cnt = wrb_cnt_for_skb(adapter, skb, &dummy_wrb);
 
         copied = make_tx_wrbs(adapter, skb, wrb_cnt, dummy_wrb);
         if (copied) {
@@ -894,11 +911,17 @@ static void be_rx_compl_discard(struct be_adapter *adapter,
         rxq_idx = AMAP_GET_BITS(struct amap_eth_rx_compl, fragndx, rxcp);
         num_rcvd = AMAP_GET_BITS(struct amap_eth_rx_compl, numfrags, rxcp);
 
-        for (i = 0; i < num_rcvd; i++) {
-                page_info = get_rx_page_info(adapter, rxo, rxq_idx);
-                put_page(page_info->page);
-                memset(page_info, 0, sizeof(*page_info));
-                index_inc(&rxq_idx, rxq->len);
+         /* Skip out-of-buffer compl(lancer) or flush compl(BE) */
+        if (likely(rxq_idx != rxo->last_frag_index && num_rcvd != 0)) {
+
+                rxo->last_frag_index = rxq_idx;
+
+                for (i = 0; i < num_rcvd; i++) {
+                        page_info = get_rx_page_info(adapter, rxo, rxq_idx);
+                        put_page(page_info->page);
+                        memset(page_info, 0, sizeof(*page_info));
+                        index_inc(&rxq_idx, rxq->len);
+                }
         }
 }
 
@@ -999,9 +1022,6 @@ static void be_rx_compl_process(struct be_adapter *adapter,
         u8 vtm;
 
         num_rcvd = AMAP_GET_BITS(struct amap_eth_rx_compl, numfrags, rxcp);
-        /* Is it a flush compl that has no data */
-        if (unlikely(num_rcvd == 0))
-                return;
 
         skb = netdev_alloc_skb_ip_align(adapter->netdev, BE_HDR_LEN);
         if (unlikely(!skb)) {
@@ -1035,7 +1055,8 @@ static void be_rx_compl_process(struct be_adapter *adapter,
                         return;
                 }
                 vid = AMAP_GET_BITS(struct amap_eth_rx_compl, vlan_tag, rxcp);
-                vid = swab16(vid);
+                if (!lancer_chip(adapter))
+                        vid = swab16(vid);
                 vlan_hwaccel_receive_skb(skb, adapter->vlan_grp, vid);
         } else {
                 netif_receive_skb(skb);
@@ -1057,10 +1078,6 @@ static void be_rx_compl_process_gro(struct be_adapter *adapter,
         u8 pkt_type;
 
         num_rcvd = AMAP_GET_BITS(struct amap_eth_rx_compl, numfrags, rxcp);
-        /* Is it a flush compl that has no data */
-        if (unlikely(num_rcvd == 0))
-                return;
-
         pkt_size = AMAP_GET_BITS(struct amap_eth_rx_compl, pktsize, rxcp);
         vlanf = AMAP_GET_BITS(struct amap_eth_rx_compl, vtp, rxcp);
         rxq_idx = AMAP_GET_BITS(struct amap_eth_rx_compl, fragndx, rxcp);
@@ -1113,7 +1130,8 @@ static void be_rx_compl_process_gro(struct be_adapter *adapter,
                 napi_gro_frags(&eq_obj->napi);
         } else {
                 vid = AMAP_GET_BITS(struct amap_eth_rx_compl, vlan_tag, rxcp);
-                vid = swab16(vid);
+                if (!lancer_chip(adapter))
+                        vid = swab16(vid);
 
                 if (!adapter->vlan_grp || adapter->vlans_added == 0)
                         return;
@@ -1330,7 +1348,7 @@ static void be_rx_q_clean(struct be_adapter *adapter, struct be_rx_obj *rxo)
         while ((rxcp = be_rx_compl_get(rxo)) != NULL) {
                 be_rx_compl_discard(adapter, rxo, rxcp);
                 be_rx_compl_reset(rxcp);
-                be_cq_notify(adapter, rx_cq->id, true, 1);
+                be_cq_notify(adapter, rx_cq->id, false, 1);
         }
 
         /* Then free posted rx buffer that were not used */
@@ -1381,7 +1399,8 @@ static void be_tx_compl_clean(struct be_adapter *adapter)
                 sent_skb = sent_skbs[txq->tail];
                 end_idx = txq->tail;
                 index_adv(&end_idx,
-                        wrb_cnt_for_skb(sent_skb, &dummy_wrb) - 1, txq->len);
+                        wrb_cnt_for_skb(adapter, sent_skb, &dummy_wrb) - 1,
+                        txq->len);
                 be_tx_compl_process(adapter, end_idx);
         }
 }
@@ -1476,7 +1495,9 @@ static int be_tx_queues_create(struct be_adapter *adapter)
         /* Ask BE to create Tx Event queue */
         if (be_cmd_eq_create(adapter, eq, adapter->tx_eq.cur_eqd))
                 goto tx_eq_free;
-        adapter->base_eq_id = adapter->tx_eq.q.id;
+
+        adapter->tx_eq.msix_vec_idx = adapter->msix_vec_next_idx++;
+
 
         /* Alloc TX eth compl queue */
         cq = &adapter->tx_obj.cq;
@@ -1554,6 +1575,9 @@ static int be_rx_queues_create(struct be_adapter *adapter)
         adapter->big_page_size = (1 << get_order(rx_frag_size)) * PAGE_SIZE;
         for_all_rx_queues(adapter, rxo, i) {
                 rxo->adapter = adapter;
+                /* Init last_frag_index so that the frag index in the first
+                 * completion will never match */
+                rxo->last_frag_index = 0xffff;
                 rxo->rx_eq.max_eqd = BE_MAX_EQD;
                 rxo->rx_eq.enable_aic = true;
 
@@ -1568,6 +1592,8 @@ static int be_rx_queues_create(struct be_adapter *adapter)
                 if (rc)
                         goto err;
 
+                rxo->rx_eq.msix_vec_idx = adapter->msix_vec_next_idx++;
+
                 /* CQ */
                 cq = &rxo->cq;
                 rc = be_queue_alloc(adapter, cq, RX_CQ_LEN,
@@ -1578,7 +1604,6 @@ static int be_rx_queues_create(struct be_adapter *adapter)
                 rc = be_cmd_cq_create(adapter, cq, eq, false, false, 3);
                 if (rc)
                         goto err;
-
                 /* Rx Q */
                 q = &rxo->q;
                 rc = be_queue_alloc(adapter, q, RX_Q_LEN,
@@ -1611,29 +1636,45 @@ err:
         return -1;
 }
 
-/* There are 8 evt ids per func. Retruns the evt id's bit number */
-static inline int be_evt_bit_get(struct be_adapter *adapter, u32 eq_id)
+static bool event_peek(struct be_eq_obj *eq_obj)
 {
-        return eq_id - adapter->base_eq_id;
+        struct be_eq_entry *eqe = queue_tail_node(&eq_obj->q);
+        if (!eqe->evt)
+                return false;
+        else
+                return true;
 }
 
 static irqreturn_t be_intx(int irq, void *dev)
 {
         struct be_adapter *adapter = dev;
         struct be_rx_obj *rxo;
-        int isr, i;
+        int isr, i, tx = 0 , rx = 0;
 
-        isr = ioread32(adapter->csr + CEV_ISR0_OFFSET +
-                (adapter->tx_eq.q.id/ 8) * CEV_ISR_SIZE);
-        if (!isr)
-                return IRQ_NONE;
+        if (lancer_chip(adapter)) {
+                if (event_peek(&adapter->tx_eq))
+                        tx = event_handle(adapter, &adapter->tx_eq);
+                for_all_rx_queues(adapter, rxo, i) {
+                        if (event_peek(&rxo->rx_eq))
+                                rx |= event_handle(adapter, &rxo->rx_eq);
+                }
 
-        if ((1 << be_evt_bit_get(adapter, adapter->tx_eq.q.id) & isr))
-                event_handle(adapter, &adapter->tx_eq);
+                if (!(tx || rx))
+                        return IRQ_NONE;
 
-        for_all_rx_queues(adapter, rxo, i) {
-                if ((1 << be_evt_bit_get(adapter, rxo->rx_eq.q.id) & isr))
-                        event_handle(adapter, &rxo->rx_eq);
+        } else {
+                isr = ioread32(adapter->csr + CEV_ISR0_OFFSET +
+                        (adapter->tx_eq.q.id / 8) * CEV_ISR_SIZE);
+                if (!isr)
+                        return IRQ_NONE;
+
+                if ((1 << adapter->tx_eq.msix_vec_idx & isr))
+                        event_handle(adapter, &adapter->tx_eq);
+
+                for_all_rx_queues(adapter, rxo, i) {
+                        if ((1 << rxo->rx_eq.msix_vec_idx & isr))
+                                event_handle(adapter, &rxo->rx_eq);
+                }
         }
 
         return IRQ_HANDLED;
@@ -1658,10 +1699,9 @@ static irqreturn_t be_msix_tx_mcc(int irq, void *dev)
         return IRQ_HANDLED;
 }
 
-static inline bool do_gro(struct be_adapter *adapter, struct be_rx_obj *rxo,
-                        struct be_eth_rx_compl *rxcp)
+static inline bool do_gro(struct be_rx_obj *rxo,
+                        struct be_eth_rx_compl *rxcp, u8 err)
 {
-        int err = AMAP_GET_BITS(struct amap_eth_rx_compl, err, rxcp);
         int tcp_frame = AMAP_GET_BITS(struct amap_eth_rx_compl, tcpf, rxcp);
 
         if (err)
@@ -1678,6 +1718,8 @@ static int be_poll_rx(struct napi_struct *napi, int budget)
         struct be_queue_info *rx_cq = &rxo->cq;
         struct be_eth_rx_compl *rxcp;
         u32 work_done;
+        u16 frag_index, num_rcvd;
+        u8 err;
 
         rxo->stats.rx_polls++;
         for (work_done = 0; work_done < budget; work_done++) {
@@ -1685,10 +1727,22 @@ static int be_poll_rx(struct napi_struct *napi, int budget)
                 if (!rxcp)
                         break;
 
-                if (do_gro(adapter, rxo, rxcp))
-                        be_rx_compl_process_gro(adapter, rxo, rxcp);
-                else
-                        be_rx_compl_process(adapter, rxo, rxcp);
+                err = AMAP_GET_BITS(struct amap_eth_rx_compl, err, rxcp);
+                frag_index = AMAP_GET_BITS(struct amap_eth_rx_compl, fragndx,
+                                                                rxcp);
+                num_rcvd = AMAP_GET_BITS(struct amap_eth_rx_compl, numfrags,
+                                                                rxcp);
+
+                /* Skip out-of-buffer compl(lancer) or flush compl(BE) */
+                if (likely(frag_index != rxo->last_frag_index &&
+                                num_rcvd != 0)) {
+                        rxo->last_frag_index = frag_index;
+
+                        if (do_gro(rxo, rxcp, err))
+                                be_rx_compl_process_gro(adapter, rxo, rxcp);
+                        else
+                                be_rx_compl_process(adapter, rxo, rxcp);
+                }
 
                 be_rx_compl_reset(rxcp);
         }
@@ -1830,8 +1884,7 @@ static void be_worker(struct work_struct *work)
                         be_post_rx_frags(rxo);
                 }
         }
-
-        if (!adapter->ue_detected)
+        if (!adapter->ue_detected && !lancer_chip(adapter))
                 be_detect_dump_ue(adapter);
 
 reschedule:
@@ -1910,10 +1963,10 @@ static void be_sriov_disable(struct be_adapter *adapter)
 #endif
 }
 
-static inline int be_msix_vec_get(struct be_adapter *adapter, u32 eq_id)
+static inline int be_msix_vec_get(struct be_adapter *adapter,
+                                        struct be_eq_obj *eq_obj)
 {
-        return adapter->msix_entries[
-                        be_evt_bit_get(adapter, eq_id)].vector;
+        return adapter->msix_entries[eq_obj->msix_vec_idx].vector;
 }
 
 static int be_request_irq(struct be_adapter *adapter,
@@ -1924,14 +1977,14 @@ static int be_request_irq(struct be_adapter *adapter,
         int vec;
 
         sprintf(eq_obj->desc, "%s-%s", netdev->name, desc);
-        vec = be_msix_vec_get(adapter, eq_obj->q.id);
+        vec = be_msix_vec_get(adapter, eq_obj);
         return request_irq(vec, handler, 0, eq_obj->desc, context);
 }
 
 static void be_free_irq(struct be_adapter *adapter, struct be_eq_obj *eq_obj,
                         void *context)
 {
-        int vec = be_msix_vec_get(adapter, eq_obj->q.id);
+        int vec = be_msix_vec_get(adapter, eq_obj);
         free_irq(vec, context);
 }
 
@@ -2036,14 +2089,15 @@ static int be_close(struct net_device *netdev)
         netif_carrier_off(netdev);
         adapter->link_up = false;
 
-        be_intr_set(adapter, false);
+        if (!lancer_chip(adapter))
+                be_intr_set(adapter, false);
 
         if (adapter->msix_enabled) {
-                vec = be_msix_vec_get(adapter, tx_eq->q.id);
+                vec = be_msix_vec_get(adapter, tx_eq);
                 synchronize_irq(vec);
 
                 for_all_rx_queues(adapter, rxo, i) {
-                        vec = be_msix_vec_get(adapter, rxo->rx_eq.q.id);
+                        vec = be_msix_vec_get(adapter, &rxo->rx_eq);
                         synchronize_irq(vec);
                 }
         } else {
@@ -2082,7 +2136,8 @@ static int be_open(struct net_device *netdev)
 
         be_irq_register(adapter);
 
-        be_intr_set(adapter, true);
+        if (!lancer_chip(adapter))
+                be_intr_set(adapter, true);
 
         /* The evt queues are created in unarmed state; arm them */
         for_all_rx_queues(adapter, rxo, i) {
@@ -2543,10 +2598,15 @@ static void be_netdev_init(struct net_device *netdev)
         int i;
 
         netdev->features |= NETIF_F_SG | NETIF_F_HW_VLAN_RX | NETIF_F_TSO |
-                NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_FILTER | NETIF_F_HW_CSUM |
+                NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_FILTER |
+                NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
                 NETIF_F_GRO | NETIF_F_TSO6;
 
-        netdev->vlan_features |= NETIF_F_SG | NETIF_F_TSO | NETIF_F_HW_CSUM;
+        netdev->vlan_features |= NETIF_F_SG | NETIF_F_TSO |
+                NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
+
+        if (lancer_chip(adapter))
+                netdev->vlan_features |= NETIF_F_TSO6;
 
         netdev->flags |= IFF_MULTICAST;
 
@@ -2587,6 +2647,15 @@ static int be_map_pci_bars(struct be_adapter *adapter)
         u8 __iomem *addr;
         int pcicfg_reg, db_reg;
 
+        if (lancer_chip(adapter)) {
+                addr = ioremap_nocache(pci_resource_start(adapter->pdev, 0),
+                        pci_resource_len(adapter->pdev, 0));
+                if (addr == NULL)
+                        return -ENOMEM;
+                adapter->db = addr;
+                return 0;
+        }
+
         if (be_physfn(adapter)) {
                 addr = ioremap_nocache(pci_resource_start(adapter->pdev, 2),
                                 pci_resource_len(adapter->pdev, 2));
@@ -2783,6 +2852,44 @@ static int be_get_config(struct be_adapter *adapter)
         return 0;
 }
 
+static int be_dev_family_check(struct be_adapter *adapter)
+{
+        struct pci_dev *pdev = adapter->pdev;
+        u32 sli_intf = 0, if_type;
+
+        switch (pdev->device) {
+        case BE_DEVICE_ID1:
+        case OC_DEVICE_ID1:
+                adapter->generation = BE_GEN2;
+                break;
+        case BE_DEVICE_ID2:
+        case OC_DEVICE_ID2:
+                adapter->generation = BE_GEN3;
+                break;
+        case OC_DEVICE_ID3:
+                pci_read_config_dword(pdev, SLI_INTF_REG_OFFSET, &sli_intf);
+                if_type = (sli_intf & SLI_INTF_IF_TYPE_MASK) >>
+                                                SLI_INTF_IF_TYPE_SHIFT;
+
+                if (((sli_intf & SLI_INTF_VALID_MASK) != SLI_INTF_VALID) ||
+                        if_type != 0x02) {
+                        dev_err(&pdev->dev, "SLI_INTF reg val is not valid\n");
+                        return -EINVAL;
+                }
+                if (num_vfs > 0) {
+                        dev_err(&pdev->dev, "VFs not supported\n");
+                        return -EINVAL;
+                }
+                adapter->sli_family = ((sli_intf & SLI_INTF_FAMILY_MASK) >>
+                                         SLI_INTF_FAMILY_SHIFT);
+                adapter->generation = BE_GEN3;
+                break;
+        default:
+                adapter->generation = 0;
+        }
+        return 0;
+}
+
 static int __devinit be_probe(struct pci_dev *pdev,
                         const struct pci_device_id *pdev_id)
 {
@@ -2805,22 +2912,13 @@ static int __devinit be_probe(struct pci_dev *pdev,
                 goto rel_reg;
         }
         adapter = netdev_priv(netdev);
-
-        switch (pdev->device) {
-        case BE_DEVICE_ID1:
-        case OC_DEVICE_ID1:
-                adapter->generation = BE_GEN2;
-                break;
-        case BE_DEVICE_ID2:
-        case OC_DEVICE_ID2:
-                adapter->generation = BE_GEN3;
-                break;
-        default:
-                adapter->generation = 0;
-        }
-
         adapter->pdev = pdev;
         pci_set_drvdata(pdev, adapter);
+
+        status = be_dev_family_check(adapter);
+        if (status)
+                goto free_netdev;
+
         adapter->netdev = netdev;
         SET_NETDEV_DEV(netdev, &pdev->dev);
 
@@ -2895,7 +2993,7 @@ ctrl_clean:
         be_ctrl_cleanup(adapter);
 free_netdev:
         be_sriov_disable(adapter);
-        free_netdev(adapter->netdev);
+        free_netdev(netdev);
         pci_set_drvdata(pdev, NULL);
 rel_reg:
         pci_release_regions(pdev);
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index 062600be073..03209a37883 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -56,8 +56,8 @@
 #include "bnx2_fw.h"
 
 #define DRV_MODULE_NAME         "bnx2"
-#define DRV_MODULE_VERSION      "2.0.18"
-#define DRV_MODULE_RELDATE      "Oct 7, 2010"
+#define DRV_MODULE_VERSION      "2.0.20"
+#define DRV_MODULE_RELDATE      "Nov 24, 2010"
 #define FW_MIPS_FILE_06         "bnx2/bnx2-mips-06-6.0.15.fw"
 #define FW_RV2P_FILE_06         "bnx2/bnx2-rv2p-06-6.0.15.fw"
 #define FW_MIPS_FILE_09         "bnx2/bnx2-mips-09-6.0.17.fw"
@@ -766,13 +766,10 @@ bnx2_alloc_rx_mem(struct bnx2 *bp)
                 int j;
 
                 rxr->rx_buf_ring =
-                        vmalloc(SW_RXBD_RING_SIZE * bp->rx_max_ring);
+                        vzalloc(SW_RXBD_RING_SIZE * bp->rx_max_ring);
                 if (rxr->rx_buf_ring == NULL)
                         return -ENOMEM;
 
-                memset(rxr->rx_buf_ring, 0,
-                       SW_RXBD_RING_SIZE * bp->rx_max_ring);
-
                 for (j = 0; j < bp->rx_max_ring; j++) {
                         rxr->rx_desc_ring[j] =
                                 dma_alloc_coherent(&bp->pdev->dev,
@@ -785,13 +782,11 @@ bnx2_alloc_rx_mem(struct bnx2 *bp)
                 }
 
                 if (bp->rx_pg_ring_size) {
-                        rxr->rx_pg_ring = vmalloc(SW_RXPG_RING_SIZE *
+                        rxr->rx_pg_ring = vzalloc(SW_RXPG_RING_SIZE *
                                                   bp->rx_max_pg_ring);
                         if (rxr->rx_pg_ring == NULL)
                                 return -ENOMEM;
 
-                        memset(rxr->rx_pg_ring, 0, SW_RXPG_RING_SIZE *
-                               bp->rx_max_pg_ring);
                 }
 
                 for (j = 0; j < bp->rx_max_pg_ring; j++) {
@@ -4645,13 +4640,28 @@ bnx2_reset_chip(struct bnx2 *bp, u32 reset_code)
 
         /* Wait for the current PCI transaction to complete before
          * issuing a reset. */
-        REG_WR(bp, BNX2_MISC_ENABLE_CLR_BITS,
-               BNX2_MISC_ENABLE_CLR_BITS_TX_DMA_ENABLE |
-               BNX2_MISC_ENABLE_CLR_BITS_DMA_ENGINE_ENABLE |
-               BNX2_MISC_ENABLE_CLR_BITS_RX_DMA_ENABLE |
-               BNX2_MISC_ENABLE_CLR_BITS_HOST_COALESCE_ENABLE);
-        val = REG_RD(bp, BNX2_MISC_ENABLE_CLR_BITS);
-        udelay(5);
+        if ((CHIP_NUM(bp) == CHIP_NUM_5706) ||
+            (CHIP_NUM(bp) == CHIP_NUM_5708)) {
+                REG_WR(bp, BNX2_MISC_ENABLE_CLR_BITS,
+                       BNX2_MISC_ENABLE_CLR_BITS_TX_DMA_ENABLE |
+                       BNX2_MISC_ENABLE_CLR_BITS_DMA_ENGINE_ENABLE |
+                       BNX2_MISC_ENABLE_CLR_BITS_RX_DMA_ENABLE |
+                       BNX2_MISC_ENABLE_CLR_BITS_HOST_COALESCE_ENABLE);
+                val = REG_RD(bp, BNX2_MISC_ENABLE_CLR_BITS);
+                udelay(5);
+        } else {  /* 5709 */
+                val = REG_RD(bp, BNX2_MISC_NEW_CORE_CTL);
+                val &= ~BNX2_MISC_NEW_CORE_CTL_DMA_ENABLE;
+                REG_WR(bp, BNX2_MISC_NEW_CORE_CTL, val);
+                val = REG_RD(bp, BNX2_MISC_NEW_CORE_CTL);
+
+                for (i = 0; i < 100; i++) {
+                        msleep(1);
+                        val = REG_RD(bp, BNX2_PCICFG_DEVICE_CONTROL);
+                        if (!(val & BNX2_PCICFG_DEVICE_STATUS_NO_PEND))
+                                break;
+                }
+        }
 
         /* Wait for the firmware to tell us it is ok to issue a reset. */
         bnx2_fw_sync(bp, BNX2_DRV_MSG_DATA_WAIT0 | reset_code, 1, 1);
@@ -4673,7 +4683,7 @@ bnx2_reset_chip(struct bnx2 *bp, u32 reset_code)
                 val = BNX2_PCICFG_MISC_CONFIG_REG_WINDOW_ENA |
                       BNX2_PCICFG_MISC_CONFIG_TARGET_MB_WORD_SWAP;
 
-                pci_write_config_dword(bp->pdev, BNX2_PCICFG_MISC_CONFIG, val);
+                REG_WR(bp, BNX2_PCICFG_MISC_CONFIG, val);
 
         } else {
                 val = BNX2_PCICFG_MISC_CONFIG_CORE_RST_REQ |
@@ -7914,15 +7924,15 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
                 goto err_out_release;
         }
 
+        bnx2_set_power_state(bp, PCI_D0);
+
         /* Configure byte swap and enable write to the reg_window registers.
          * Rely on CPU to do target byte swapping on big endian systems
          * The chip's target access swapping will not swap all accesses
          */
-        pci_write_config_dword(bp->pdev, BNX2_PCICFG_MISC_CONFIG,
-                               BNX2_PCICFG_MISC_CONFIG_REG_WINDOW_ENA |
-                               BNX2_PCICFG_MISC_CONFIG_TARGET_MB_WORD_SWAP);
-
-        bnx2_set_power_state(bp, PCI_D0);
+        REG_WR(bp, BNX2_PCICFG_MISC_CONFIG,
+                   BNX2_PCICFG_MISC_CONFIG_REG_WINDOW_ENA |
+                   BNX2_PCICFG_MISC_CONFIG_TARGET_MB_WORD_SWAP);
 
         bp->chip_id = REG_RD(bp, BNX2_MISC_ID);
 
diff --git a/drivers/net/bnx2.h b/drivers/net/bnx2.h
index bf4c3421067..5488a2e82fe 100644
--- a/drivers/net/bnx2.h
+++ b/drivers/net/bnx2.h
@@ -461,6 +461,8 @@ struct l2_fhdr {
 #define BNX2_PCICFG_MAILBOX_QUEUE_ADDR                  0x00000090
 #define BNX2_PCICFG_MAILBOX_QUEUE_DATA                  0x00000094
 
+#define BNX2_PCICFG_DEVICE_CONTROL                      0x000000b4
+#define BNX2_PCICFG_DEVICE_STATUS_NO_PEND                ((1L<<5)<<16)
 
 /*
  *  pci_reg definition
diff --git a/drivers/net/bnx2x/bnx2x.h b/drivers/net/bnx2x/bnx2x.h
index 863e73a85fb..cfc25cf064d 100644
--- a/drivers/net/bnx2x/bnx2x.h
+++ b/drivers/net/bnx2x/bnx2x.h
@@ -20,8 +20,8 @@
  * (you will need to reboot afterwards) */
 /* #define BNX2X_STOP_ON_ERROR */
 
-#define DRV_MODULE_VERSION      "1.60.00-4"
-#define DRV_MODULE_RELDATE      "2010/11/01"
+#define DRV_MODULE_VERSION      "1.60.00-6"
+#define DRV_MODULE_RELDATE      "2010/11/29"
 #define BNX2X_BC_VER            0x040200
 
 #define BNX2X_MULTI_QUEUE
@@ -671,6 +671,10 @@ enum {
         CAM_ISCSI_ETH_LINE,
         CAM_MAX_PF_LINE = CAM_ISCSI_ETH_LINE
 };
+/* number of MACs per function in NIG memory - used for SI mode */
+#define NIG_LLH_FUNC_MEM_SIZE           16
+/* number of entries in NIG_REG_LLHX_FUNC_MEM */
+#define NIG_LLH_FUNC_MEM_MAX_OFFSET     8
 
 #define BNX2X_VF_ID_INVALID     0xFF
 
@@ -967,6 +971,8 @@ struct bnx2x {
         u16                     mf_ov;
         u8                      mf_mode;
 #define IS_MF(bp)               (bp->mf_mode != 0)
+#define IS_MF_SI(bp)            (bp->mf_mode == MULTI_FUNCTION_SI)
+#define IS_MF_SD(bp)            (bp->mf_mode == MULTI_FUNCTION_SD)
 
         u8                      wol;
 
@@ -1010,6 +1016,7 @@ struct bnx2x {
 #define BNX2X_ACCEPT_ALL_UNICAST        0x0004
 #define BNX2X_ACCEPT_ALL_MULTICAST      0x0008
 #define BNX2X_ACCEPT_BROADCAST          0x0010
+#define BNX2X_ACCEPT_UNMATCHED_UCAST    0x0020
 #define BNX2X_PROMISCUOUS_MODE          0x10000
 
         u32                     rx_mode;
diff --git a/drivers/net/bnx2x/bnx2x_cmn.c b/drivers/net/bnx2x/bnx2x_cmn.c
index 94d5f59d5a6..a4555edbe9c 100644
--- a/drivers/net/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/bnx2x/bnx2x_cmn.c
@@ -698,6 +698,29 @@ void bnx2x_release_phy_lock(struct bnx2x *bp)
         mutex_unlock(&bp->port.phy_mutex);
 }
 
+/* calculates MF speed according to current linespeed and MF configuration */
+u16 bnx2x_get_mf_speed(struct bnx2x *bp)
+{
+        u16 line_speed = bp->link_vars.line_speed;
+        if (IS_MF(bp)) {
+                u16 maxCfg = (bp->mf_config[BP_VN(bp)] &
+                                                FUNC_MF_CFG_MAX_BW_MASK) >>
+                                                FUNC_MF_CFG_MAX_BW_SHIFT;
+                /* Calculate the current MAX line speed limit for the DCC
+                 * capable devices
+                 */
+                if (IS_MF_SD(bp)) {
+                        u16 vn_max_rate = maxCfg * 100;
+
+                        if (vn_max_rate < line_speed)
+                                line_speed = vn_max_rate;
+                } else /* IS_MF_SI(bp)) */
+                        line_speed = (line_speed * maxCfg) / 100;
+        }
+
+        return line_speed;
+}
+
 void bnx2x_link_report(struct bnx2x *bp)
 {
         if (bp->flags & MF_FUNC_DIS) {
@@ -713,17 +736,8 @@ void bnx2x_link_report(struct bnx2x *bp)
                         netif_carrier_on(bp->dev);
                 netdev_info(bp->dev, "NIC Link is Up, ");
 
-                line_speed = bp->link_vars.line_speed;
-                if (IS_MF(bp)) {
-                        u16 vn_max_rate;
+                line_speed = bnx2x_get_mf_speed(bp);
 
-                        vn_max_rate =
-                                ((bp->mf_config[BP_VN(bp)] &
-                                  FUNC_MF_CFG_MAX_BW_MASK) >>
-                                                FUNC_MF_CFG_MAX_BW_SHIFT) * 100;
-                        if (vn_max_rate < line_speed)
-                                line_speed = vn_max_rate;
-                }
                 pr_cont("%d Mbps ", line_speed);
 
                 if (bp->link_vars.duplex == DUPLEX_FULL)
@@ -1692,11 +1706,10 @@ static inline u32 bnx2x_xmit_type(struct bnx2x *bp, struct sk_buff *skb)
                 }
         }
 
-        if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4)
-                rc |= (XMIT_GSO_V4 | XMIT_CSUM_V4 | XMIT_CSUM_TCP);
-
-        else if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6)
-                rc |= (XMIT_GSO_V6 | XMIT_CSUM_TCP | XMIT_CSUM_V6);
+        if (skb_is_gso_v6(skb))
+                rc |= XMIT_GSO_V6 | XMIT_CSUM_TCP | XMIT_CSUM_V6;
+        else if (skb_is_gso(skb))
+                rc |= XMIT_GSO_V4 | XMIT_CSUM_V4 | XMIT_CSUM_TCP;
 
         return rc;
 }
diff --git a/drivers/net/bnx2x/bnx2x_cmn.h b/drivers/net/bnx2x/bnx2x_cmn.h
index 6b28739c530..cb8f2a040a1 100644
--- a/drivers/net/bnx2x/bnx2x_cmn.h
+++ b/drivers/net/bnx2x/bnx2x_cmn.h
@@ -73,6 +73,16 @@ void bnx2x__link_status_update(struct bnx2x *bp);
 void bnx2x_link_report(struct bnx2x *bp);
 
 /**
+ * calculates MF speed according to current linespeed and MF
+ * configuration
+ *
+ * @param bp
+ *
+ * @return u16
+ */
+u16 bnx2x_get_mf_speed(struct bnx2x *bp);
+
+/**
  * MSI-X slowpath interrupt handler
  *
  * @param irq
diff --git a/drivers/net/bnx2x/bnx2x_ethtool.c b/drivers/net/bnx2x/bnx2x_ethtool.c
index d02ffbdc9f0..bd94827e5e5 100644
--- a/drivers/net/bnx2x/bnx2x_ethtool.c
+++ b/drivers/net/bnx2x/bnx2x_ethtool.c
@@ -45,14 +45,9 @@ static int bnx2x_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
                 cmd->speed = bp->link_params.req_line_speed[cfg_idx];
                 cmd->duplex = bp->link_params.req_duplex[cfg_idx];
         }
-        if (IS_MF(bp)) {
-                u16 vn_max_rate = ((bp->mf_config[BP_VN(bp)] &
-                        FUNC_MF_CFG_MAX_BW_MASK) >> FUNC_MF_CFG_MAX_BW_SHIFT) *
-                        100;
 
-                if (vn_max_rate < cmd->speed)
-                        cmd->speed = vn_max_rate;
-        }
+        if (IS_MF(bp))
+                cmd->speed = bnx2x_get_mf_speed(bp);
 
         if (bp->port.supported[cfg_idx] & SUPPORTED_TP)
                 cmd->port = PORT_TP;
@@ -87,18 +82,57 @@ static int bnx2x_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
 {
         struct bnx2x *bp = netdev_priv(dev);
         u32 advertising, cfg_idx, old_multi_phy_config, new_multi_phy_config;
+        u32 speed;
 
-        if (IS_MF(bp))
+        if (IS_MF_SD(bp))
                 return 0;
 
         DP(NETIF_MSG_LINK, "ethtool_cmd: cmd %d\n"
-           DP_LEVEL "  supported 0x%x  advertising 0x%x  speed %d\n"
-           DP_LEVEL "  duplex %d  port %d  phy_address %d  transceiver %d\n"
-           DP_LEVEL "  autoneg %d  maxtxpkt %d  maxrxpkt %d\n",
+           "  supported 0x%x  advertising 0x%x  speed %d speed_hi %d\n"
+           "  duplex %d  port %d  phy_address %d  transceiver %d\n"
+           "  autoneg %d  maxtxpkt %d  maxrxpkt %d\n",
            cmd->cmd, cmd->supported, cmd->advertising, cmd->speed,
+           cmd->speed_hi,
            cmd->duplex, cmd->port, cmd->phy_address, cmd->transceiver,
            cmd->autoneg, cmd->maxtxpkt, cmd->maxrxpkt);
 
+        speed = cmd->speed;
+        speed |= (cmd->speed_hi << 16);
+
+        if (IS_MF_SI(bp)) {
+                u32 param = 0;
+                u32 line_speed = bp->link_vars.line_speed;
+
+                /* use 10G if no link detected */
+                if (!line_speed)
+                        line_speed = 10000;
+
+                if (bp->common.bc_ver < REQ_BC_VER_4_SET_MF_BW) {
+                        BNX2X_DEV_INFO("To set speed BC %X or higher "
+                                       "is required, please upgrade BC\n",
+                                       REQ_BC_VER_4_SET_MF_BW);
+                        return -EINVAL;
+                }
+                if (line_speed < speed) {
+                        BNX2X_DEV_INFO("New speed should be less or equal "
+                                       "to actual line speed\n");
+                        return -EINVAL;
+                }
+                /* load old values */
+                param = bp->mf_config[BP_VN(bp)];
+
+                /* leave only MIN value */
+                param &= FUNC_MF_CFG_MIN_BW_MASK;
+
+                /* set new MAX value */
+                param |= (((speed * 100) / line_speed)
+                                 << FUNC_MF_CFG_MAX_BW_SHIFT)
+                                  & FUNC_MF_CFG_MAX_BW_MASK;
+
+                bnx2x_fw_command(bp, DRV_MSG_CODE_SET_MF_BW, param);
+                return 0;
+        }
+
         cfg_idx = bnx2x_get_link_cfg_idx(bp);
         old_multi_phy_config = bp->link_params.multi_phy_config;
         switch (cmd->port) {
@@ -168,8 +202,6 @@ static int bnx2x_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
 
         } else { /* forced speed */
                 /* advertise the requested speed and duplex if supported */
-                u32 speed = cmd->speed;
-                speed |= (cmd->speed_hi << 16);
                 switch (speed) {
                 case SPEED_10:
                         if (cmd->duplex == DUPLEX_FULL) {
@@ -1499,8 +1531,15 @@ static int bnx2x_run_loopback(struct bnx2x *bp, int loopback_mode, u8 link_up)
          * updates that have been performed while interrupts were
          * disabled.
          */
-        if (bp->common.int_block == INT_BLOCK_IGU)
+        if (bp->common.int_block == INT_BLOCK_IGU) {
+                /* Disable local BHes to prevent a dead-lock situation between
+                 * sch_direct_xmit() and bnx2x_run_loopback() (calling
+                 * bnx2x_tx_int()), as both are taking netif_tx_lock().
+                 */
+                local_bh_disable();
                 bnx2x_tx_int(fp_tx);
+                local_bh_enable();
+        }
 
         rx_idx = le16_to_cpu(*fp_rx->rx_cons_sb);
         if (rx_idx != rx_start_idx + num_pkts)
diff --git a/drivers/net/bnx2x/bnx2x_hsi.h b/drivers/net/bnx2x/bnx2x_hsi.h
index 4cfd4e9b558..6555c477f89 100644
--- a/drivers/net/bnx2x/bnx2x_hsi.h
+++ b/drivers/net/bnx2x/bnx2x_hsi.h
@@ -434,7 +434,12 @@ struct shared_feat_cfg {				 /* NVRAM Offset */
 #define SHARED_FEAT_CFG_OVERRIDE_PREEMPHASIS_CFG_DISABLED     0x00000000
 #define SHARED_FEAT_CFG_OVERRIDE_PREEMPHASIS_CFG_ENABLED      0x00000002
 
-#define SHARED_FEATURE_MF_MODE_DISABLED             0x00000100
+#define SHARED_FEAT_CFG_FORCE_SF_MODE_MASK                    0x00000700
+#define SHARED_FEAT_CFG_FORCE_SF_MODE_SHIFT                   8
+#define SHARED_FEAT_CFG_FORCE_SF_MODE_MF_ALLOWED              0x00000000
+#define SHARED_FEAT_CFG_FORCE_SF_MODE_FORCED_SF               0x00000100
+#define SHARED_FEAT_CFG_FORCE_SF_MODE_SPIO4                   0x00000200
+#define SHARED_FEAT_CFG_FORCE_SF_MODE_SWITCH_INDEPT           0x00000300
 
 };
 
@@ -815,6 +820,9 @@ struct drv_func_mb {
 #define DRV_MSG_CODE_VRFY_SPECIFIC_PHY_OPT_MDL      0xa1000000
 #define REQ_BC_VER_4_VRFY_SPECIFIC_PHY_OPT_MDL      0x00050234
 
+#define DRV_MSG_CODE_SET_MF_BW                          0xe0000000
+#define REQ_BC_VER_4_SET_MF_BW                          0x00060202
+#define DRV_MSG_CODE_SET_MF_BW_ACK                      0xe1000000
 #define BIOS_MSG_CODE_LIC_CHALLENGE                     0xff010000
 #define BIOS_MSG_CODE_LIC_RESPONSE                      0xff020000
 #define BIOS_MSG_CODE_VIRT_MAC_PRIM                     0xff030000
@@ -888,6 +896,7 @@ struct drv_func_mb {
 
         u32 drv_status;
 #define DRV_STATUS_PMF                                  0x00000001
+#define DRV_STATUS_SET_MF_BW                            0x00000004
 
 #define DRV_STATUS_DCC_EVENT_MASK                       0x0000ff00
 #define DRV_STATUS_DCC_DISABLE_ENABLE_PF                0x00000100
@@ -988,12 +997,43 @@ struct func_mf_cfg {
 
 };
 
+/* This structure is not applicable and should not be accessed on 57711 */
+struct func_ext_cfg {
+        u32 func_cfg;
+#define MACP_FUNC_CFG_FLAGS_MASK                              0x000000FF
+#define MACP_FUNC_CFG_FLAGS_SHIFT                             0
+#define MACP_FUNC_CFG_FLAGS_ENABLED                           0x00000001
+#define MACP_FUNC_CFG_FLAGS_ETHERNET                          0x00000002
+#define MACP_FUNC_CFG_FLAGS_ISCSI_OFFLOAD                     0x00000004
+#define MACP_FUNC_CFG_FLAGS_FCOE_OFFLOAD                      0x00000008
+
+        u32 iscsi_mac_addr_upper;
+        u32 iscsi_mac_addr_lower;
+
+        u32 fcoe_mac_addr_upper;
+        u32 fcoe_mac_addr_lower;
+
+        u32 fcoe_wwn_port_name_upper;
+        u32 fcoe_wwn_port_name_lower;
+
+        u32 fcoe_wwn_node_name_upper;
+        u32 fcoe_wwn_node_name_lower;
+
+        u32 preserve_data;
+#define MF_FUNC_CFG_PRESERVE_L2_MAC                          (1<<0)
+#define MF_FUNC_CFG_PRESERVE_ISCSI_MAC                       (1<<1)
+#define MF_FUNC_CFG_PRESERVE_FCOE_MAC                        (1<<2)
+#define MF_FUNC_CFG_PRESERVE_FCOE_WWN_P                      (1<<3)
+#define MF_FUNC_CFG_PRESERVE_FCOE_WWN_N                      (1<<4)
+};
+
 struct mf_cfg {
 
         struct shared_mf_cfg    shared_mf_config;
         struct port_mf_cfg      port_mf_config[PORT_MAX];
         struct func_mf_cfg      func_mf_config[E1H_FUNC_MAX];
 
+        struct func_ext_cfg func_ext_config[E1H_FUNC_MAX];
 };
 
 
diff --git a/drivers/net/bnx2x/bnx2x_link.c b/drivers/net/bnx2x/bnx2x_link.c
index 58091961925..38aeffef2a8 100644
--- a/drivers/net/bnx2x/bnx2x_link.c
+++ b/drivers/net/bnx2x/bnx2x_link.c
@@ -3904,7 +3904,7 @@ static u8 bnx2x_8726_read_sfp_module_eeprom(struct bnx2x_phy *phy,
                               MDIO_PMA_REG_SFP_TWO_WIRE_CTRL, &val);
                 if ((val & MDIO_PMA_REG_SFP_TWO_WIRE_CTRL_STATUS_MASK) ==
                     MDIO_PMA_REG_SFP_TWO_WIRE_STATUS_IDLE)
-                        return 0;;
+                        return 0;
                 msleep(1);
         }
         return -EINVAL;
@@ -3988,7 +3988,7 @@ static u8 bnx2x_8727_read_sfp_module_eeprom(struct bnx2x_phy *phy,
                               MDIO_PMA_REG_SFP_TWO_WIRE_CTRL, &val);
                 if ((val & MDIO_PMA_REG_SFP_TWO_WIRE_CTRL_STATUS_MASK) ==
                     MDIO_PMA_REG_SFP_TWO_WIRE_STATUS_IDLE)
-                        return 0;;
+                        return 0;
                 msleep(1);
         }
 
diff --git a/drivers/net/bnx2x/bnx2x_main.c b/drivers/net/bnx2x/bnx2x_main.c
index 9709b856966..0068a1dbc06 100644
--- a/drivers/net/bnx2x/bnx2x_main.c
+++ b/drivers/net/bnx2x/bnx2x_main.c
@@ -2026,13 +2026,28 @@ static int bnx2x_get_cmng_fns_mode(struct bnx2x *bp)
 
 static void bnx2x_read_mf_cfg(struct bnx2x *bp)
 {
-        int vn;
+        int vn, n = (CHIP_MODE_IS_4_PORT(bp) ? 2 : 1);
 
         if (BP_NOMCP(bp))
                 return; /* what should be the default bvalue in this case */
 
+        /* For 2 port configuration the absolute function number formula
+         * is:
+         *      abs_func = 2 * vn + BP_PORT + BP_PATH
+         *
+         *      and there are 4 functions per port
+         *
+         * For 4 port configuration it is
+         *      abs_func = 4 * vn + 2 * BP_PORT + BP_PATH
+         *
+         *      and there are 2 functions per port
+         */
         for (vn = VN_0; vn < E1HVN_MAX; vn++) {
-                int /*abs*/func = 2*vn + BP_PORT(bp);
+                int /*abs*/func = n * (2 * vn + BP_PORT(bp)) + BP_PATH(bp);
+
+                if (func >= E1H_FUNC_MAX)
+                        break;
+
                 bp->mf_config[vn] =
                         MF_CFG_RD(bp, func_mf_config[func].config);
         }
@@ -2248,10 +2263,21 @@ static void bnx2x_rxq_set_mac_filters(struct bnx2x *bp, u16 cl_id, u32 filters)
         u8 accp_all_ucast = 0, accp_all_bcast = 0, accp_all_mcast = 0;
         u8 unmatched_unicast = 0;
 
+        if (filters & BNX2X_ACCEPT_UNMATCHED_UCAST)
+                unmatched_unicast = 1;
+
         if (filters & BNX2X_PROMISCUOUS_MODE) {
                 /* promiscious - accept all, drop none */
                 drop_all_ucast = drop_all_bcast = drop_all_mcast = 0;
                 accp_all_ucast = accp_all_bcast = accp_all_mcast = 1;
+                if (IS_MF_SI(bp)) {
+                        /*
+                         * SI mode defines to accept in promiscuos mode
+                         * only unmatched packets
+                         */
+                        unmatched_unicast = 1;
+                        accp_all_ucast = 0;
+                }
         }
         if (filters & BNX2X_ACCEPT_UNICAST) {
                 /* accept matched ucast */
@@ -2260,6 +2286,11 @@ static void bnx2x_rxq_set_mac_filters(struct bnx2x *bp, u16 cl_id, u32 filters)
         if (filters & BNX2X_ACCEPT_MULTICAST) {
                 /* accept matched mcast */
                 drop_all_mcast = 0;
+                if (IS_MF_SI(bp))
+                        /* since mcast addresses won't arrive with ovlan,
+                         * fw needs to accept all of them in
+                         * switch-independent mode */
+                        accp_all_mcast = 1;
         }
         if (filters & BNX2X_ACCEPT_ALL_UNICAST) {
                 /* accept all mcast */
@@ -2372,7 +2403,7 @@ static inline u16 bnx2x_get_cl_flags(struct bnx2x *bp,
         /* calculate queue flags */
         flags |= QUEUE_FLG_CACHE_ALIGN;
         flags |= QUEUE_FLG_HC;
-        flags |= IS_MF(bp) ? QUEUE_FLG_OV : 0;
+        flags |= IS_MF_SD(bp) ? QUEUE_FLG_OV : 0;
 
         flags |= QUEUE_FLG_VLAN;
         DP(NETIF_MSG_IFUP, "vlan removal enabled\n");
@@ -2573,6 +2604,26 @@ static void bnx2x_e1h_enable(struct bnx2x *bp)
          */
 }
 
+/* called due to MCP event (on pmf):
+ *      reread new bandwidth configuration
+ *      configure FW
+ *      notify others function about the change
+ */
+static inline void bnx2x_config_mf_bw(struct bnx2x *bp)
+{
+        if (bp->link_vars.link_up) {
+                bnx2x_cmng_fns_init(bp, true, CMNG_FNS_MINMAX);
+                bnx2x_link_sync_notify(bp);
+        }
+        storm_memset_cmng(bp, &bp->cmng, BP_PORT(bp));
+}
+
+static inline void bnx2x_set_mf_bw(struct bnx2x *bp)
+{
+        bnx2x_config_mf_bw(bp);
+        bnx2x_fw_command(bp, DRV_MSG_CODE_SET_MF_BW_ACK, 0);
+}
+
 static void bnx2x_dcc_event(struct bnx2x *bp, u32 dcc_event)
 {
         DP(BNX2X_MSG_MCP, "dcc_event 0x%x\n", dcc_event);
@@ -2598,10 +2649,7 @@ static void bnx2x_dcc_event(struct bnx2x *bp, u32 dcc_event)
                 dcc_event &= ~DRV_STATUS_DCC_DISABLE_ENABLE_PF;
         }
         if (dcc_event & DRV_STATUS_DCC_BANDWIDTH_ALLOCATION) {
-
-                bnx2x_cmng_fns_init(bp, true, CMNG_FNS_MINMAX);
-                bnx2x_link_sync_notify(bp);
-                storm_memset_cmng(bp, &bp->cmng, BP_PORT(bp));
+                bnx2x_config_mf_bw(bp);
                 dcc_event &= ~DRV_STATUS_DCC_BANDWIDTH_ALLOCATION;
         }
 
@@ -3022,6 +3070,10 @@ static inline void bnx2x_attn_int_deasserted3(struct bnx2x *bp, u32 attn)
                         if (val & DRV_STATUS_DCC_EVENT_MASK)
                                 bnx2x_dcc_event(bp,
                                             (val & DRV_STATUS_DCC_EVENT_MASK));
+
+                        if (val & DRV_STATUS_SET_MF_BW)
+                                bnx2x_set_mf_bw(bp);
+
                         bnx2x__link_status_update(bp);
                         if ((bp->port.pmf == 0) && (val & DRV_STATUS_PMF))
                                 bnx2x_pmf_update(bp);
@@ -4232,6 +4284,15 @@ static void bnx2x_init_internal_common(struct bnx2x *bp)
                         bp->mf_mode);
         }
 
+        if (IS_MF_SI(bp))
+                /*
+                 * In switch independent mode, the TSTORM needs to accept
+                 * packets that failed classification, since approximate match
+                 * mac addresses aren't written to NIG LLH
+                 */
+                REG_WR8(bp, BAR_TSTRORM_INTMEM +
+                            TSTORM_ACCEPT_CLASSIFY_FAILED_OFFSET, 2);
+
         /* Zero this manually as its initialization is
            currently missing in the initTool */
         for (i = 0; i < (USTORM_AGG_DATA_SIZE >> 2); i++)
@@ -5048,12 +5109,12 @@ static int bnx2x_init_hw_common(struct bnx2x *bp, u32 load_code)
         REG_WR(bp, PRS_REG_NIC_MODE, 1);
 #endif
         if (!CHIP_IS_E1(bp))
-                REG_WR(bp, PRS_REG_E1HOV_MODE, IS_MF(bp));
+                REG_WR(bp, PRS_REG_E1HOV_MODE, IS_MF_SD(bp));
 
         if (CHIP_IS_E2(bp)) {
                 /* Bit-map indicating which L2 hdrs may appear after the
                    basic Ethernet header */
-                int has_ovlan = IS_MF(bp);
+                int has_ovlan = IS_MF_SD(bp);
                 REG_WR(bp, PRS_REG_HDRS_AFTER_BASIC, (has_ovlan ? 7 : 6));
                 REG_WR(bp, PRS_REG_MUST_HAVE_HDRS, (has_ovlan ? 1 : 0));
         }
@@ -5087,7 +5148,7 @@ static int bnx2x_init_hw_common(struct bnx2x *bp, u32 load_code)
         bnx2x_init_block(bp, PBF_BLOCK, COMMON_STAGE);
 
         if (CHIP_IS_E2(bp)) {
-                int has_ovlan = IS_MF(bp);
+                int has_ovlan = IS_MF_SD(bp);
                 REG_WR(bp, PBF_REG_HDRS_AFTER_BASIC, (has_ovlan ? 7 : 6));
                 REG_WR(bp, PBF_REG_MUST_HAVE_HDRS, (has_ovlan ? 1 : 0));
         }
@@ -5164,12 +5225,12 @@ static int bnx2x_init_hw_common(struct bnx2x *bp, u32 load_code)
         bnx2x_init_block(bp, NIG_BLOCK, COMMON_STAGE);
         if (!CHIP_IS_E1(bp)) {
                 REG_WR(bp, NIG_REG_LLH_MF_MODE, IS_MF(bp));
-                REG_WR(bp, NIG_REG_LLH_E1HOV_MODE, IS_MF(bp));
+                REG_WR(bp, NIG_REG_LLH_E1HOV_MODE, IS_MF_SD(bp));
         }
         if (CHIP_IS_E2(bp)) {
                 /* Bit-map indicating which L2 hdrs may appear after the
                    basic Ethernet header */
-                REG_WR(bp, NIG_REG_P0_HDRS_AFTER_BASIC, (IS_MF(bp) ? 7 : 6));
+                REG_WR(bp, NIG_REG_P0_HDRS_AFTER_BASIC, (IS_MF_SD(bp) ? 7 : 6));
         }
 
         if (CHIP_REV_IS_SLOW(bp))
@@ -5386,7 +5447,7 @@ static int bnx2x_init_hw_port(struct bnx2x *bp)
         if (!CHIP_IS_E1(bp)) {
                 /* 0x2 disable mf_ov, 0x1 enable */
                 REG_WR(bp, NIG_REG_LLH0_BRB1_DRV_MASK_MF + port*4,
-                       (IS_MF(bp) ? 0x1 : 0x2));
+                       (IS_MF_SD(bp) ? 0x1 : 0x2));
 
                 if (CHIP_IS_E2(bp)) {
                         val = 0;
@@ -6170,6 +6231,70 @@ static u8 bnx2x_e1h_cam_offset(struct bnx2x *bp, u8 rel_offset)
                 return BP_VN(bp) * 32  + rel_offset;
 }
 
+/**
+ *  LLH CAM line allocations: currently only iSCSI and ETH macs are
+ *  relevant. In addition, current implementation is tuned for a
+ *  single ETH MAC.
+ *
+ *  When multiple unicast ETH MACs PF configuration in switch
+ *  independent mode is required (NetQ, multiple netdev MACs,
+ *  etc.), consider better utilisation of 16 per function MAC
+ *  entries in the LLH memory.
+ */
+enum {
+        LLH_CAM_ISCSI_ETH_LINE = 0,
+        LLH_CAM_ETH_LINE,
+        LLH_CAM_MAX_PF_LINE = NIG_REG_LLH1_FUNC_MEM_SIZE
+};
+
+static void bnx2x_set_mac_in_nig(struct bnx2x *bp,
+                          int set,
+                          unsigned char *dev_addr,
+                          int index)
+{
+        u32 wb_data[2];
+        u32 mem_offset, ena_offset, mem_index;
+        /**
+         * indexes mapping:
+         * 0..7 - goes to MEM
+         * 8..15 - goes to MEM2
+         */
+
+        if (!IS_MF_SI(bp) || index > LLH_CAM_MAX_PF_LINE)
+                return;
+
+        /* calculate memory start offset according to the mapping
+         * and index in the memory */
+        if (index < NIG_LLH_FUNC_MEM_MAX_OFFSET) {
+                mem_offset = BP_PORT(bp) ? NIG_REG_LLH1_FUNC_MEM :
+                                           NIG_REG_LLH0_FUNC_MEM;
+                ena_offset = BP_PORT(bp) ? NIG_REG_LLH1_FUNC_MEM_ENABLE :
+                                           NIG_REG_LLH0_FUNC_MEM_ENABLE;
+                mem_index = index;
+        } else {
+                mem_offset = BP_PORT(bp) ? NIG_REG_P1_LLH_FUNC_MEM2 :
+                                           NIG_REG_P0_LLH_FUNC_MEM2;
+                ena_offset = BP_PORT(bp) ? NIG_REG_P1_LLH_FUNC_MEM2_ENABLE :
+                                           NIG_REG_P0_LLH_FUNC_MEM2_ENABLE;
+                mem_index = index - NIG_LLH_FUNC_MEM_MAX_OFFSET;
+        }
+
+        if (set) {
+                /* LLH_FUNC_MEM is a u64 WB register */
+                mem_offset += 8*mem_index;
+
+                wb_data[0] = ((dev_addr[2] << 24) | (dev_addr[3] << 16) |
+                              (dev_addr[4] <<  8) |  dev_addr[5]);
+                wb_data[1] = ((dev_addr[0] <<  8) |  dev_addr[1]);
+
+                REG_WR_DMAE(bp, mem_offset, wb_data, 2);
+        }
+
+        /* enable/disable the entry */
+        REG_WR(bp, ena_offset + 4*mem_index, set);
+
+}
+
 void bnx2x_set_eth_mac(struct bnx2x *bp, int set)
 {
         u8 cam_offset = (CHIP_IS_E1(bp) ? (BP_PORT(bp) ? 32 : 0) :
@@ -6179,6 +6304,8 @@ void bnx2x_set_eth_mac(struct bnx2x *bp, int set)
         bnx2x_set_mac_addr_gen(bp, set, bp->dev->dev_addr,
                                (1 << bp->fp->cl_id), cam_offset , 0);
 
+        bnx2x_set_mac_in_nig(bp, set, bp->dev->dev_addr, LLH_CAM_ETH_LINE);
+
         if (CHIP_IS_E1(bp)) {
                 /* broadcast MAC */
                 u8 bcast[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
@@ -6289,6 +6416,8 @@ static int bnx2x_set_iscsi_eth_mac_addr(struct bnx2x *bp, int set)
         /* Send a SET_MAC ramrod */
         bnx2x_set_mac_addr_gen(bp, set, bp->iscsi_mac, cl_bit_vec,
                                cam_offset, 0);
+
+        bnx2x_set_mac_in_nig(bp, set, bp->iscsi_mac, LLH_CAM_ISCSI_ETH_LINE);
         return 0;
 }
 #endif
@@ -8076,9 +8205,8 @@ static void __devinit bnx2x_set_mac_buf(u8 *mac_buf, u32 mac_lo, u16 mac_hi)
 static void __devinit bnx2x_get_port_hwinfo(struct bnx2x *bp)
 {
         int port = BP_PORT(bp);
-        u32 val, val2;
         u32 config;
-        u32 ext_phy_type, ext_phy_config;;
+        u32 ext_phy_type, ext_phy_config;
 
         bp->link_params.bp = bp;
         bp->link_params.port = port;
@@ -8135,25 +8263,62 @@ static void __devinit bnx2x_get_port_hwinfo(struct bnx2x *bp)
                  (ext_phy_type != PORT_HW_CFG_XGXS_EXT_PHY_TYPE_NOT_CONN))
                 bp->mdio.prtad =
                         XGXS_EXT_PHY_ADDR(ext_phy_config);
+}
 
-        val2 = SHMEM_RD(bp, dev_info.port_hw_config[port].mac_upper);
-        val = SHMEM_RD(bp, dev_info.port_hw_config[port].mac_lower);
-        bnx2x_set_mac_buf(bp->dev->dev_addr, val, val2);
-        memcpy(bp->link_params.mac_addr, bp->dev->dev_addr, ETH_ALEN);
-        memcpy(bp->dev->perm_addr, bp->dev->dev_addr, ETH_ALEN);
+static void __devinit bnx2x_get_mac_hwinfo(struct bnx2x *bp)
+{
+        u32 val, val2;
+        int func = BP_ABS_FUNC(bp);
+        int port = BP_PORT(bp);
+
+        if (BP_NOMCP(bp)) {
+                BNX2X_ERROR("warning: random MAC workaround active\n");
+                random_ether_addr(bp->dev->dev_addr);
+        } else if (IS_MF(bp)) {
+                val2 = MF_CFG_RD(bp, func_mf_config[func].mac_upper);
+                val = MF_CFG_RD(bp, func_mf_config[func].mac_lower);
+                if ((val2 != FUNC_MF_CFG_UPPERMAC_DEFAULT) &&
+                    (val != FUNC_MF_CFG_LOWERMAC_DEFAULT))
+                        bnx2x_set_mac_buf(bp->dev->dev_addr, val, val2);
+
+#ifdef BCM_CNIC
+                /* iSCSI NPAR MAC */
+                if (IS_MF_SI(bp)) {
+                        u32 cfg = MF_CFG_RD(bp, func_ext_config[func].func_cfg);
+                        if (cfg & MACP_FUNC_CFG_FLAGS_ISCSI_OFFLOAD) {
+                                val2 = MF_CFG_RD(bp, func_ext_config[func].
+                                                     iscsi_mac_addr_upper);
+                                val = MF_CFG_RD(bp, func_ext_config[func].
+                                                    iscsi_mac_addr_lower);
+                                bnx2x_set_mac_buf(bp->iscsi_mac, val, val2);
+                        }
+                }
+#endif
+        } else {
+                /* in SF read MACs from port configuration */
+                val2 = SHMEM_RD(bp, dev_info.port_hw_config[port].mac_upper);
+                val = SHMEM_RD(bp, dev_info.port_hw_config[port].mac_lower);
+                bnx2x_set_mac_buf(bp->dev->dev_addr, val, val2);
 
 #ifdef BCM_CNIC
-        val2 = SHMEM_RD(bp, dev_info.port_hw_config[port].iscsi_mac_upper);
-        val = SHMEM_RD(bp, dev_info.port_hw_config[port].iscsi_mac_lower);
-        bnx2x_set_mac_buf(bp->iscsi_mac, val, val2);
+                val2 = SHMEM_RD(bp, dev_info.port_hw_config[port].
+                                    iscsi_mac_upper);
+                val = SHMEM_RD(bp, dev_info.port_hw_config[port].
+                                   iscsi_mac_lower);
+                bnx2x_set_mac_buf(bp->iscsi_mac, val, val2);
 #endif
+        }
+
+        memcpy(bp->link_params.mac_addr, bp->dev->dev_addr, ETH_ALEN);
+        memcpy(bp->dev->perm_addr, bp->dev->dev_addr, ETH_ALEN);
+
 }
 
 static int __devinit bnx2x_get_hwinfo(struct bnx2x *bp)
 {
-        int func = BP_ABS_FUNC(bp);
-        int vn;
-        u32 val, val2;
+        int /*abs*/func = BP_ABS_FUNC(bp);
+        int vn, port;
+        u32 val = 0;
         int rc = 0;
 
         bnx2x_get_common_hwinfo(bp);
@@ -8186,44 +8351,99 @@ static int __devinit bnx2x_get_hwinfo(struct bnx2x *bp)
         bp->mf_ov = 0;
         bp->mf_mode = 0;
         vn = BP_E1HVN(bp);
+        port = BP_PORT(bp);
+
         if (!CHIP_IS_E1(bp) && !BP_NOMCP(bp)) {
+                DP(NETIF_MSG_PROBE,
+                            "shmem2base 0x%x, size %d, mfcfg offset %d\n",
+                            bp->common.shmem2_base, SHMEM2_RD(bp, size),
+                            (u32)offsetof(struct shmem2_region, mf_cfg_addr));
                 if (SHMEM2_HAS(bp, mf_cfg_addr))
                         bp->common.mf_cfg_base = SHMEM2_RD(bp, mf_cfg_addr);
                 else
                         bp->common.mf_cfg_base = bp->common.shmem_base +
                                 offsetof(struct shmem_region, func_mb) +
                                 E1H_FUNC_MAX * sizeof(struct drv_func_mb);
-                bp->mf_config[vn] =
-                        MF_CFG_RD(bp, func_mf_config[func].config);
+                /*
+                 * get mf configuration:
+                 * 1. existance of MF configuration
+                 * 2. MAC address must be legal (check only upper bytes)
+                 *    for  Switch-Independent mode;
+                 *    OVLAN must be legal for Switch-Dependent mode
+                 * 3. SF_MODE configures specific MF mode
+                 */
+                if (bp->common.mf_cfg_base != SHMEM_MF_CFG_ADDR_NONE) {
+                        /* get mf configuration */
+                        val = SHMEM_RD(bp,
+                                       dev_info.shared_feature_config.config);
+                        val &= SHARED_FEAT_CFG_FORCE_SF_MODE_MASK;
+
+                        switch (val) {
+                        case SHARED_FEAT_CFG_FORCE_SF_MODE_SWITCH_INDEPT:
+                                val = MF_CFG_RD(bp, func_mf_config[func].
+                                                mac_upper);
+                                /* check for legal mac (upper bytes)*/
+                                if (val != 0xffff) {
+                                        bp->mf_mode = MULTI_FUNCTION_SI;
+                                        bp->mf_config[vn] = MF_CFG_RD(bp,
+                                                   func_mf_config[func].config);
+                                } else
+                                        DP(NETIF_MSG_PROBE, "illegal MAC "
+                                                            "address for SI\n");
+                                break;
+                        case SHARED_FEAT_CFG_FORCE_SF_MODE_MF_ALLOWED:
+                                /* get OV configuration */
+                                val = MF_CFG_RD(bp,
+                                        func_mf_config[FUNC_0].e1hov_tag);
+                                val &= FUNC_MF_CFG_E1HOV_TAG_MASK;
+
+                                if (val != FUNC_MF_CFG_E1HOV_TAG_DEFAULT) {
+                                        bp->mf_mode = MULTI_FUNCTION_SD;
+                                        bp->mf_config[vn] = MF_CFG_RD(bp,
+                                                func_mf_config[func].config);
+                                } else
+                                        DP(NETIF_MSG_PROBE, "illegal OV for "
+                                                            "SD\n");
+                                break;
+                        default:
+                                /* Unknown configuration: reset mf_config */
+                                bp->mf_config[vn] = 0;
+                                DP(NETIF_MSG_PROBE, "Unkown MF mode 0x%x\n",
+                                   val);
+                        }
+                }
 
-                val = (MF_CFG_RD(bp, func_mf_config[FUNC_0].e1hov_tag) &
-                       FUNC_MF_CFG_E1HOV_TAG_MASK);
-                if (val != FUNC_MF_CFG_E1HOV_TAG_DEFAULT)
-                        bp->mf_mode = 1;
                 BNX2X_DEV_INFO("%s function mode\n",
                                IS_MF(bp) ? "multi" : "single");
 
-                if (IS_MF(bp)) {
-                        val = (MF_CFG_RD(bp, func_mf_config[func].
-                                                                e1hov_tag) &
-                               FUNC_MF_CFG_E1HOV_TAG_MASK);
+                switch (bp->mf_mode) {
+                case MULTI_FUNCTION_SD:
+                        val = MF_CFG_RD(bp, func_mf_config[func].e1hov_tag) &
+                              FUNC_MF_CFG_E1HOV_TAG_MASK;
                         if (val != FUNC_MF_CFG_E1HOV_TAG_DEFAULT) {
                                 bp->mf_ov = val;
-                                BNX2X_DEV_INFO("MF OV for func %d is %d "
-                                               "(0x%04x)\n",
-                                               func, bp->mf_ov, bp->mf_ov);
+                                BNX2X_DEV_INFO("MF OV for func %d is %d"
+                                               " (0x%04x)\n", func,
+                                               bp->mf_ov, bp->mf_ov);
                         } else {
-                                BNX2X_ERROR("No valid MF OV for func %d,"
-                                            "  aborting\n", func);
+                                BNX2X_ERR("No valid MF OV for func %d,"
+                                          "  aborting\n", func);
                                 rc = -EPERM;
                         }
-                } else {
-                        if (BP_VN(bp)) {
-                                BNX2X_ERROR("VN %d in single function mode,"
-                                            "  aborting\n", BP_E1HVN(bp));
+                        break;
+                case MULTI_FUNCTION_SI:
+                        BNX2X_DEV_INFO("func %d is in MF "
+                                       "switch-independent mode\n", func);
+                        break;
+                default:
+                        if (vn) {
+                                BNX2X_ERR("VN %d in single function mode,"
+                                          "  aborting\n", vn);
                                 rc = -EPERM;
                         }
+                        break;
                 }
+
         }
 
         /* adjust igu_sb_cnt to MF for E1x */
@@ -8248,32 +8468,8 @@ static int __devinit bnx2x_get_hwinfo(struct bnx2x *bp)
                 BNX2X_DEV_INFO("fw_seq 0x%08x\n", bp->fw_seq);
         }
 
-        if (IS_MF(bp)) {
-                val2 = MF_CFG_RD(bp, func_mf_config[func].mac_upper);
-                val = MF_CFG_RD(bp,  func_mf_config[func].mac_lower);
-                if ((val2 != FUNC_MF_CFG_UPPERMAC_DEFAULT) &&
-                    (val != FUNC_MF_CFG_LOWERMAC_DEFAULT)) {
-                        bp->dev->dev_addr[0] = (u8)(val2 >> 8 & 0xff);
-                        bp->dev->dev_addr[1] = (u8)(val2 & 0xff);
-                        bp->dev->dev_addr[2] = (u8)(val >> 24 & 0xff);
-                        bp->dev->dev_addr[3] = (u8)(val >> 16 & 0xff);
-                        bp->dev->dev_addr[4] = (u8)(val >> 8  & 0xff);
-                        bp->dev->dev_addr[5] = (u8)(val & 0xff);
-                        memcpy(bp->link_params.mac_addr, bp->dev->dev_addr,
-                               ETH_ALEN);
-                        memcpy(bp->dev->perm_addr, bp->dev->dev_addr,
-                               ETH_ALEN);
-                }
-
-                return rc;
-        }
-
-        if (BP_NOMCP(bp)) {
-                /* only supposed to happen on emulation/FPGA */
-                BNX2X_ERROR("warning: random MAC workaround active\n");
-                random_ether_addr(bp->dev->dev_addr);
-                memcpy(bp->dev->perm_addr, bp->dev->dev_addr, ETH_ALEN);
-        }
+        /* Get MAC addresses */
+        bnx2x_get_mac_hwinfo(bp);
 
         return rc;
 }
@@ -8761,7 +8957,7 @@ static int __devinit bnx2x_init_dev(struct pci_dev *pdev,
         dev->netdev_ops = &bnx2x_netdev_ops;
         bnx2x_set_ethtool_ops(dev);
         dev->features |= NETIF_F_SG;
-        dev->features |= NETIF_F_HW_CSUM;
+        dev->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
         if (bp->flags & USING_DAC_FLAG)
                 dev->features |= NETIF_F_HIGHDMA;
         dev->features |= (NETIF_F_TSO | NETIF_F_TSO_ECN);
@@ -8769,7 +8965,7 @@ static int __devinit bnx2x_init_dev(struct pci_dev *pdev,
         dev->features |= (NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX);
 
         dev->vlan_features |= NETIF_F_SG;
-        dev->vlan_features |= NETIF_F_HW_CSUM;
+        dev->vlan_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
         if (bp->flags & USING_DAC_FLAG)
                 dev->vlan_features |= NETIF_F_HIGHDMA;
         dev->vlan_features |= (NETIF_F_TSO | NETIF_F_TSO_ECN);
@@ -9096,12 +9292,6 @@ static int __devinit bnx2x_init_one(struct pci_dev *pdev,
         /* calc qm_cid_count */
         bp->qm_cid_count = bnx2x_set_qm_cid_count(bp, cid_count);
 
-        rc = register_netdev(dev);
-        if (rc) {
-                dev_err(&pdev->dev, "Cannot register net device\n");
-                goto init_one_exit;
-        }
-
         /* Configure interupt mode: try to enable MSI-X/MSI if
          * needed, set bp->num_queues appropriately.
          */
@@ -9110,6 +9300,12 @@ static int __devinit bnx2x_init_one(struct pci_dev *pdev,
         /* Add all NAPI objects */
         bnx2x_add_all_napi(bp);
 
+        rc = register_netdev(dev);
+        if (rc) {
+                dev_err(&pdev->dev, "Cannot register net device\n");
+                goto init_one_exit;
+        }
+
         bnx2x_get_pcie_width_speed(bp, &pcie_width, &pcie_speed);
 
         netdev_info(dev, "%s (%c%d) PCI-E x%d %s found at mem %lx,"
diff --git a/drivers/net/bnx2x/bnx2x_reg.h b/drivers/net/bnx2x/bnx2x_reg.h
index 1cefe489a95..64bdda189e5 100644
--- a/drivers/net/bnx2x/bnx2x_reg.h
+++ b/drivers/net/bnx2x/bnx2x_reg.h
@@ -1774,6 +1774,8 @@
 /* [RW 8] event id for llh0 */
 #define NIG_REG_LLH0_EVENT_ID                                    0x10084
 #define NIG_REG_LLH0_FUNC_EN                                     0x160fc
+#define NIG_REG_LLH0_FUNC_MEM                                    0x16180
+#define NIG_REG_LLH0_FUNC_MEM_ENABLE                             0x16140
 #define NIG_REG_LLH0_FUNC_VLAN_ID                                0x16100
 /* [RW 1] Determine the IP version to look for in
    ~nig_registers_llh0_dest_ip_0.llh0_dest_ip_0. 0 - IPv6; 1-IPv4 */
@@ -1797,6 +1799,9 @@
 #define NIG_REG_LLH1_ERROR_MASK                                  0x10090
 /* [RW 8] event id for llh1 */
 #define NIG_REG_LLH1_EVENT_ID                                    0x10088
+#define NIG_REG_LLH1_FUNC_MEM                                    0x161c0
+#define NIG_REG_LLH1_FUNC_MEM_ENABLE                             0x16160
+#define NIG_REG_LLH1_FUNC_MEM_SIZE                               16
 /* [RW 8] init credit counter for port1 in LLH */
 #define NIG_REG_LLH1_XCM_INIT_CREDIT                             0x10564
 #define NIG_REG_LLH1_XCM_MASK                                    0x10134
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index 881914bc4e9..48cf24ff4e6 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -2474,8 +2474,7 @@ int bond_3ad_lacpdu_recv(struct sk_buff *skb, struct net_device *dev, struct pac
                 goto out;
 
         read_lock(&bond->lock);
-        slave = bond_get_slave_by_dev((struct bonding *)netdev_priv(dev),
-                                        orig_dev);
+        slave = bond_get_slave_by_dev(netdev_priv(dev), orig_dev);
         if (!slave)
                 goto out_unlock;
 
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 2fee00a4c9e..bb33b3b347f 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -873,17 +873,11 @@ static void bond_mc_del(struct bonding *bond, void *addr)
 static void __bond_resend_igmp_join_requests(struct net_device *dev)
 {
         struct in_device *in_dev;
-        struct ip_mc_list *im;
 
         rcu_read_lock();
         in_dev = __in_dev_get_rcu(dev);
-        if (in_dev) {
-                read_lock(&in_dev->mc_list_lock);
-                for (im = in_dev->mc_list; im; im = im->next)
-                        ip_mc_rejoin_group(im);
-                read_unlock(&in_dev->mc_list_lock);
-        }
-
+        if (in_dev)
+                ip_mc_rejoin_groups(in_dev);
         rcu_read_unlock();
 }
 
@@ -3211,7 +3205,7 @@ out:
 #ifdef CONFIG_PROC_FS
 
 static void *bond_info_seq_start(struct seq_file *seq, loff_t *pos)
-        __acquires(&dev_base_lock)
+        __acquires(RCU)
         __acquires(&bond->lock)
 {
         struct bonding *bond = seq->private;
@@ -3220,7 +3214,7 @@ static void *bond_info_seq_start(struct seq_file *seq, loff_t *pos)
         int i;
 
         /* make sure the bond won't be taken away */
-        read_lock(&dev_base_lock);
+        rcu_read_lock();
         read_lock(&bond->lock);
 
         if (*pos == 0)
@@ -3250,12 +3244,12 @@ static void *bond_info_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 
 static void bond_info_seq_stop(struct seq_file *seq, void *v)
         __releases(&bond->lock)
-        __releases(&dev_base_lock)
+        __releases(RCU)
 {
         struct bonding *bond = seq->private;
 
         read_unlock(&bond->lock);
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 }
 
 static void bond_info_show_master(struct seq_file *seq)
diff --git a/drivers/net/bonding/bonding.h b/drivers/net/bonding/bonding.h
index 4eedb12df6c..ad3ae46a4c0 100644
--- a/drivers/net/bonding/bonding.h
+++ b/drivers/net/bonding/bonding.h
@@ -286,7 +286,7 @@ static inline struct bonding *bond_get_bond_by_slave(struct slave *slave)
                 return NULL;
         }
 
-        return (struct bonding *)netdev_priv(slave->dev->master);
+        return netdev_priv(slave->dev->master);
 }
 
 static inline bool bond_is_lb(const struct bonding *bond)
diff --git a/drivers/net/can/Kconfig b/drivers/net/can/Kconfig
index 080574b0fff..d5a9db60ade 100644
--- a/drivers/net/can/Kconfig
+++ b/drivers/net/can/Kconfig
@@ -12,6 +12,27 @@ config CAN_VCAN
           This driver can also be built as a module.  If so, the module
           will be called vcan.
 
+config CAN_SLCAN
+        tristate "Serial / USB serial CAN Adaptors (slcan)"
+        depends on CAN
+        default N
+        ---help---
+          CAN driver for several 'low cost' CAN interfaces that are attached
+          via serial lines or via USB-to-serial adapters using the LAWICEL
+          ASCII protocol. The driver implements the tty linediscipline N_SLCAN.
+
+          As only the sending and receiving of CAN frames is implemented, this
+          driver should work with the (serial/USB) CAN hardware from:
+          www.canusb.com / www.can232.com / www.mictronic.com / www.canhack.de
+
+          Userspace tools to attach the SLCAN line discipline (slcan_attach,
+          slcand) can be found in the can-utils at the SocketCAN SVN, see
+          http://developer.berlios.de/projects/socketcan for details.
+
+          The slcan driver supports up to 10 CAN netdevices by default which
+          can be changed by the 'maxdev=xx' module option. This driver can
+          also be built as a module. If so, the module will be called slcan.
+
 config CAN_DEV
         tristate "Platform CAN drivers with Netlink support"
         depends on CAN
diff --git a/drivers/net/can/Makefile b/drivers/net/can/Makefile
index 90af15a4f10..07ca159ba3f 100644
--- a/drivers/net/can/Makefile
+++ b/drivers/net/can/Makefile
@@ -3,6 +3,7 @@
 #
 
 obj-$(CONFIG_CAN_VCAN)          += vcan.o
+obj-$(CONFIG_CAN_SLCAN)         += slcan.o
 
 obj-$(CONFIG_CAN_DEV)           += can-dev.o
 can-dev-y                       := dev.o
diff --git a/drivers/net/can/mscan/mscan.c b/drivers/net/can/mscan/mscan.c
index 64c378cd0c3..74cd880c7e0 100644
--- a/drivers/net/can/mscan/mscan.c
+++ b/drivers/net/can/mscan/mscan.c
@@ -182,7 +182,7 @@ static int mscan_restart(struct net_device *dev)
 
                 priv->can.state = CAN_STATE_ERROR_ACTIVE;
                 WARN(!(in_8(&regs->canmisc) & MSCAN_BOHOLD),
-                     "bus-off state expected");
+                     "bus-off state expected\n");
                 out_8(&regs->canmisc, MSCAN_BOHOLD);
                 /* Re-enable receive interrupts. */
                 out_8(&regs->canrier, MSCAN_RX_INTS_ENABLE);
diff --git a/drivers/net/can/pch_can.c b/drivers/net/can/pch_can.c
index 672718261c6..a9b6a6525a6 100644
--- a/drivers/net/can/pch_can.c
+++ b/drivers/net/can/pch_can.c
@@ -32,99 +32,91 @@
 #include <linux/can/dev.h>
 #include <linux/can/error.h>
 
-#define MAX_MSG_OBJ             32
-#define MSG_OBJ_RX              0 /* The receive message object flag. */
-#define MSG_OBJ_TX              1 /* The transmit message object flag. */
-
-#define ENABLE                  1 /* The enable flag */
-#define DISABLE                 0 /* The disable flag */
-#define CAN_CTRL_INIT           0x0001 /* The INIT bit of CANCONT register. */
-#define CAN_CTRL_IE             0x0002 /* The IE bit of CAN control register */
-#define CAN_CTRL_IE_SIE_EIE     0x000e
-#define CAN_CTRL_CCE            0x0040
-#define CAN_CTRL_OPT            0x0080 /* The OPT bit of CANCONT register. */
-#define CAN_OPT_SILENT          0x0008 /* The Silent bit of CANOPT reg. */
-#define CAN_OPT_LBACK           0x0010 /* The LoopBack bit of CANOPT reg. */
-#define CAN_CMASK_RX_TX_SET     0x00f3
-#define CAN_CMASK_RX_TX_GET     0x0073
-#define CAN_CMASK_ALL           0xff
-#define CAN_CMASK_RDWR          0x80
-#define CAN_CMASK_ARB           0x20
-#define CAN_CMASK_CTRL          0x10
-#define CAN_CMASK_MASK          0x40
-#define CAN_CMASK_NEWDAT        0x04
-#define CAN_CMASK_CLRINTPND     0x08
-
-#define CAN_IF_MCONT_NEWDAT     0x8000
-#define CAN_IF_MCONT_INTPND     0x2000
-#define CAN_IF_MCONT_UMASK      0x1000
-#define CAN_IF_MCONT_TXIE       0x0800
-#define CAN_IF_MCONT_RXIE       0x0400
-#define CAN_IF_MCONT_RMTEN      0x0200
-#define CAN_IF_MCONT_TXRQXT     0x0100
-#define CAN_IF_MCONT_EOB        0x0080
-#define CAN_IF_MCONT_DLC        0x000f
-#define CAN_IF_MCONT_MSGLOST    0x4000
-#define CAN_MASK2_MDIR_MXTD     0xc000
-#define CAN_ID2_DIR             0x2000
-#define CAN_ID_MSGVAL           0x8000
-
-#define CAN_STATUS_INT          0x8000
-#define CAN_IF_CREQ_BUSY        0x8000
-#define CAN_ID2_XTD             0x4000
-
-#define CAN_REC                 0x00007f00
-#define CAN_TEC                 0x000000ff
-
-#define PCH_RX_OK               0x00000010
-#define PCH_TX_OK               0x00000008
-#define PCH_BUS_OFF             0x00000080
-#define PCH_EWARN               0x00000040
-#define PCH_EPASSIV             0x00000020
-#define PCH_LEC0                0x00000001
-#define PCH_LEC1                0x00000002
-#define PCH_LEC2                0x00000004
-#define PCH_LEC_ALL             (PCH_LEC0 | PCH_LEC1 | PCH_LEC2)
-#define PCH_STUF_ERR            PCH_LEC0
-#define PCH_FORM_ERR            PCH_LEC1
-#define PCH_ACK_ERR             (PCH_LEC0 | PCH_LEC1)
-#define PCH_BIT1_ERR            PCH_LEC2
-#define PCH_BIT0_ERR            (PCH_LEC0 | PCH_LEC2)
-#define PCH_CRC_ERR             (PCH_LEC1 | PCH_LEC2)
+#define PCH_ENABLE              1 /* The enable flag */
+#define PCH_DISABLE             0 /* The disable flag */
+#define PCH_CTRL_INIT           BIT(0) /* The INIT bit of CANCONT register. */
+#define PCH_CTRL_IE             BIT(1) /* The IE bit of CAN control register */
+#define PCH_CTRL_IE_SIE_EIE     (BIT(3) | BIT(2) | BIT(1))
+#define PCH_CTRL_CCE            BIT(6)
+#define PCH_CTRL_OPT            BIT(7) /* The OPT bit of CANCONT register. */
+#define PCH_OPT_SILENT          BIT(3) /* The Silent bit of CANOPT reg. */
+#define PCH_OPT_LBACK           BIT(4) /* The LoopBack bit of CANOPT reg. */
+
+#define PCH_CMASK_RX_TX_SET     0x00f3
+#define PCH_CMASK_RX_TX_GET     0x0073
+#define PCH_CMASK_ALL           0xff
+#define PCH_CMASK_NEWDAT        BIT(2)
+#define PCH_CMASK_CLRINTPND     BIT(3)
+#define PCH_CMASK_CTRL          BIT(4)
+#define PCH_CMASK_ARB           BIT(5)
+#define PCH_CMASK_MASK          BIT(6)
+#define PCH_CMASK_RDWR          BIT(7)
+#define PCH_IF_MCONT_NEWDAT     BIT(15)
+#define PCH_IF_MCONT_MSGLOST    BIT(14)
+#define PCH_IF_MCONT_INTPND     BIT(13)
+#define PCH_IF_MCONT_UMASK      BIT(12)
+#define PCH_IF_MCONT_TXIE       BIT(11)
+#define PCH_IF_MCONT_RXIE       BIT(10)
+#define PCH_IF_MCONT_RMTEN      BIT(9)
+#define PCH_IF_MCONT_TXRQXT     BIT(8)
+#define PCH_IF_MCONT_EOB        BIT(7)
+#define PCH_IF_MCONT_DLC        (BIT(0) | BIT(1) | BIT(2) | BIT(3))
+#define PCH_MASK2_MDIR_MXTD     (BIT(14) | BIT(15))
+#define PCH_ID2_DIR             BIT(13)
+#define PCH_ID2_XTD             BIT(14)
+#define PCH_ID_MSGVAL           BIT(15)
+#define PCH_IF_CREQ_BUSY        BIT(15)
+
+#define PCH_STATUS_INT          0x8000
+#define PCH_REC                 0x00007f00
+#define PCH_TEC                 0x000000ff
+
+#define PCH_TX_OK               BIT(3)
+#define PCH_RX_OK               BIT(4)
+#define PCH_EPASSIV             BIT(5)
+#define PCH_EWARN               BIT(6)
+#define PCH_BUS_OFF             BIT(7)
 
 /* bit position of certain controller bits. */
-#define BIT_BITT_BRP            0
-#define BIT_BITT_SJW            6
-#define BIT_BITT_TSEG1          8
-#define BIT_BITT_TSEG2          12
-#define BIT_IF1_MCONT_RXIE      10
-#define BIT_IF2_MCONT_TXIE      11
-#define BIT_BRPE_BRPE           6
-#define BIT_ES_TXERRCNT         0
-#define BIT_ES_RXERRCNT         8
-#define MSK_BITT_BRP            0x3f
-#define MSK_BITT_SJW            0xc0
-#define MSK_BITT_TSEG1          0xf00
-#define MSK_BITT_TSEG2          0x7000
-#define MSK_BRPE_BRPE           0x3c0
-#define MSK_BRPE_GET            0x0f
-#define MSK_CTRL_IE_SIE_EIE     0x07
-#define MSK_MCONT_TXIE          0x08
-#define MSK_MCONT_RXIE          0x10
-#define PCH_CAN_NO_TX_BUFF      1
-#define COUNTER_LIMIT           10
+#define PCH_BIT_BRP             0
+#define PCH_BIT_SJW             6
+#define PCH_BIT_TSEG1           8
+#define PCH_BIT_TSEG2           12
+#define PCH_BIT_BRPE_BRPE       6
+#define PCH_MSK_BITT_BRP        0x3f
+#define PCH_MSK_BRPE_BRPE       0x3c0
+#define PCH_MSK_CTRL_IE_SIE_EIE 0x07
+#define PCH_COUNTER_LIMIT       10
 
 #define PCH_CAN_CLK             50000000        /* 50MHz */
 
 /* Define the number of message object.
  * PCH CAN communications are done via Message RAM.
  * The Message RAM consists of 32 message objects. */
-#define PCH_RX_OBJ_NUM          26  /* 1~ PCH_RX_OBJ_NUM is Rx*/
-#define PCH_TX_OBJ_NUM          6  /* PCH_RX_OBJ_NUM is RX ~ Tx*/
-#define PCH_OBJ_NUM             (PCH_TX_OBJ_NUM + PCH_RX_OBJ_NUM)
+#define PCH_RX_OBJ_NUM          26
+#define PCH_TX_OBJ_NUM          6
+#define PCH_RX_OBJ_START        1
+#define PCH_RX_OBJ_END          PCH_RX_OBJ_NUM
+#define PCH_TX_OBJ_START        (PCH_RX_OBJ_END + 1)
+#define PCH_TX_OBJ_END          (PCH_RX_OBJ_NUM + PCH_TX_OBJ_NUM)
 
 #define PCH_FIFO_THRESH         16
 
+enum pch_ifreg {
+        PCH_RX_IFREG,
+        PCH_TX_IFREG,
+};
+
+enum pch_can_err {
+        PCH_STUF_ERR = 1,
+        PCH_FORM_ERR,
+        PCH_ACK_ERR,
+        PCH_BIT1_ERR,
+        PCH_BIT0_ERR,
+        PCH_CRC_ERR,
+        PCH_LEC_ALL,
+};
+
 enum pch_can_mode {
         PCH_CAN_ENABLE,
         PCH_CAN_DISABLE,
@@ -134,6 +126,21 @@ enum pch_can_mode {
         PCH_CAN_RUN
 };
 
+struct pch_can_if_regs {
+        u32 creq;
+        u32 cmask;
+        u32 mask1;
+        u32 mask2;
+        u32 id1;
+        u32 id2;
+        u32 mcont;
+        u32 dataa1;
+        u32 dataa2;
+        u32 datab1;
+        u32 datab2;
+        u32 rsv[13];
+};
+
 struct pch_can_regs {
         u32 cont;
         u32 stat;
@@ -142,38 +149,21 @@ struct pch_can_regs {
         u32 intr;
         u32 opt;
         u32 brpe;
-        u32 reserve1;
-        u32 if1_creq;
-        u32 if1_cmask;
-        u32 if1_mask1;
-        u32 if1_mask2;
-        u32 if1_id1;
-        u32 if1_id2;
-        u32 if1_mcont;
-        u32 if1_dataa1;
-        u32 if1_dataa2;
-        u32 if1_datab1;
-        u32 if1_datab2;
-        u32 reserve2;
-        u32 reserve3[12];
-        u32 if2_creq;
-        u32 if2_cmask;
-        u32 if2_mask1;
-        u32 if2_mask2;
-        u32 if2_id1;
-        u32 if2_id2;
-        u32 if2_mcont;
-        u32 if2_dataa1;
-        u32 if2_dataa2;
-        u32 if2_datab1;
-        u32 if2_datab2;
-        u32 reserve4;
-        u32 reserve5[20];
+        u32 reserve;
+        struct pch_can_if_regs ifregs[2]; /* [0]=if1  [1]=if2 */
+        u32 reserve1[8];
         u32 treq1;
         u32 treq2;
-        u32 reserve6[2];
-        u32 reserve7[56];
-        u32 reserve8[3];
+        u32 reserve2[6];
+        u32 data1;
+        u32 data2;
+        u32 reserve3[6];
+        u32 canipend1;
+        u32 canipend2;
+        u32 reserve4[6];
+        u32 canmval1;
+        u32 canmval2;
+        u32 reserve5[37];
         u32 srst;
 };
 
@@ -181,14 +171,13 @@ struct pch_can_priv {
         struct can_priv can;
         unsigned int can_num;
         struct pci_dev *dev;
-        unsigned int tx_enable[MAX_MSG_OBJ];
-        unsigned int rx_enable[MAX_MSG_OBJ];
-        unsigned int rx_link[MAX_MSG_OBJ];
+        int tx_enable[PCH_TX_OBJ_END];
+        int rx_enable[PCH_TX_OBJ_END];
+        int rx_link[PCH_TX_OBJ_END];
         unsigned int int_enables;
         unsigned int int_stat;
         struct net_device *ndev;
-        spinlock_t msgif_reg_lock; /* Message Interface Registers Access Lock*/
-        unsigned int msg_obj[MAX_MSG_OBJ];
+        unsigned int msg_obj[PCH_TX_OBJ_END];
         struct pch_can_regs __iomem *regs;
         struct napi_struct napi;
         unsigned int tx_obj;    /* Point next Tx Obj index */
@@ -228,11 +217,11 @@ static void pch_can_set_run_mode(struct pch_can_priv *priv,
 {
         switch (mode) {
         case PCH_CAN_RUN:
-                pch_can_bit_clear(&priv->regs->cont, CAN_CTRL_INIT);
+                pch_can_bit_clear(&priv->regs->cont, PCH_CTRL_INIT);
                 break;
 
         case PCH_CAN_STOP:
-                pch_can_bit_set(&priv->regs->cont, CAN_CTRL_INIT);
+                pch_can_bit_set(&priv->regs->cont, PCH_CTRL_INIT);
                 break;
 
         default:
@@ -246,30 +235,30 @@ static void pch_can_set_optmode(struct pch_can_priv *priv)
         u32 reg_val = ioread32(&priv->regs->opt);
 
         if (priv->can.ctrlmode & CAN_CTRLMODE_LISTENONLY)
-                reg_val |= CAN_OPT_SILENT;
+                reg_val |= PCH_OPT_SILENT;
 
         if (priv->can.ctrlmode & CAN_CTRLMODE_LOOPBACK)
-                reg_val |= CAN_OPT_LBACK;
+                reg_val |= PCH_OPT_LBACK;
 
-        pch_can_bit_set(&priv->regs->cont, CAN_CTRL_OPT);
+        pch_can_bit_set(&priv->regs->cont, PCH_CTRL_OPT);
         iowrite32(reg_val, &priv->regs->opt);
 }
 
 static void pch_can_set_int_custom(struct pch_can_priv *priv)
 {
         /* Clearing the IE, SIE and EIE bits of Can control register. */
-        pch_can_bit_clear(&priv->regs->cont, CAN_CTRL_IE_SIE_EIE);
+        pch_can_bit_clear(&priv->regs->cont, PCH_CTRL_IE_SIE_EIE);
 
         /* Appropriately setting them. */
         pch_can_bit_set(&priv->regs->cont,
-                        ((priv->int_enables & MSK_CTRL_IE_SIE_EIE) << 1));
+                        ((priv->int_enables & PCH_MSK_CTRL_IE_SIE_EIE) << 1));
 }
 
 /* This function retrieves interrupt enabled for the CAN device. */
 static void pch_can_get_int_enables(struct pch_can_priv *priv, u32 *enables)
 {
         /* Obtaining the status of IE, SIE and EIE interrupt bits. */
-        *enables = ((ioread32(&priv->regs->cont) & CAN_CTRL_IE_SIE_EIE) >> 1);
+        *enables = ((ioread32(&priv->regs->cont) & PCH_CTRL_IE_SIE_EIE) >> 1);
 }
 
 static void pch_can_set_int_enables(struct pch_can_priv *priv,
@@ -277,19 +266,19 @@ static void pch_can_set_int_enables(struct pch_can_priv *priv,
 {
         switch (interrupt_no) {
         case PCH_CAN_ENABLE:
-                pch_can_bit_set(&priv->regs->cont, CAN_CTRL_IE);
+                pch_can_bit_set(&priv->regs->cont, PCH_CTRL_IE);
                 break;
 
         case PCH_CAN_DISABLE:
-                pch_can_bit_clear(&priv->regs->cont, CAN_CTRL_IE);
+                pch_can_bit_clear(&priv->regs->cont, PCH_CTRL_IE);
                 break;
 
         case PCH_CAN_ALL:
-                pch_can_bit_set(&priv->regs->cont, CAN_CTRL_IE_SIE_EIE);
+                pch_can_bit_set(&priv->regs->cont, PCH_CTRL_IE_SIE_EIE);
                 break;
 
         case PCH_CAN_NONE:
-                pch_can_bit_clear(&priv->regs->cont, CAN_CTRL_IE_SIE_EIE);
+                pch_can_bit_clear(&priv->regs->cont, PCH_CTRL_IE_SIE_EIE);
                 break;
 
         default:
@@ -300,12 +289,12 @@ static void pch_can_set_int_enables(struct pch_can_priv *priv,
 
 static void pch_can_check_if_busy(u32 __iomem *creq_addr, u32 num)
 {
-        u32 counter = COUNTER_LIMIT;
+        u32 counter = PCH_COUNTER_LIMIT;
         u32 ifx_creq;
 
         iowrite32(num, creq_addr);
         while (counter) {
-                ifx_creq = ioread32(creq_addr) & CAN_IF_CREQ_BUSY;
+                ifx_creq = ioread32(creq_addr) & PCH_IF_CREQ_BUSY;
                 if (!ifx_creq)
                         break;
                 counter--;
@@ -315,143 +304,76 @@ static void pch_can_check_if_busy(u32 __iomem *creq_addr, u32 num)
                 pr_err("%s:IF1 BUSY Flag is set forever.\n", __func__);
 }
 
-static void pch_can_set_rx_enable(struct pch_can_priv *priv, u32 buff_num,
-                                  u32 set)
+static void pch_can_set_rxtx(struct pch_can_priv *priv, u32 buff_num,
+                             u32 set, enum pch_ifreg dir)
 {
-        unsigned long flags;
+        u32 ie;
+
+        if (dir)
+                ie = PCH_IF_MCONT_TXIE;
+        else
+                ie = PCH_IF_MCONT_RXIE;
 
-        spin_lock_irqsave(&priv->msgif_reg_lock, flags);
         /* Reading the receive buffer data from RAM to Interface1 registers */
-        iowrite32(CAN_CMASK_RX_TX_GET, &priv->regs->if1_cmask);
-        pch_can_check_if_busy(&priv->regs->if1_creq, buff_num);
+        iowrite32(PCH_CMASK_RX_TX_GET, &priv->regs->ifregs[dir].cmask);
+        pch_can_check_if_busy(&priv->regs->ifregs[dir].creq, buff_num);
 
         /* Setting the IF1MASK1 register to access MsgVal and RxIE bits */
-        iowrite32(CAN_CMASK_RDWR | CAN_CMASK_ARB | CAN_CMASK_CTRL,
-                  &priv->regs->if1_cmask);
+        iowrite32(PCH_CMASK_RDWR | PCH_CMASK_ARB | PCH_CMASK_CTRL,
+                  &priv->regs->ifregs[dir].cmask);
 
-        if (set == ENABLE) {
+        if (set == PCH_ENABLE) {
                 /* Setting the MsgVal and RxIE bits */
-                pch_can_bit_set(&priv->regs->if1_mcont, CAN_IF_MCONT_RXIE);
-                pch_can_bit_set(&priv->regs->if1_id2, CAN_ID_MSGVAL);
+                pch_can_bit_set(&priv->regs->ifregs[dir].mcont, ie);
+                pch_can_bit_set(&priv->regs->ifregs[dir].id2, PCH_ID_MSGVAL);
 
-        } else if (set == DISABLE) {
+        } else if (set == PCH_DISABLE) {
                 /* Resetting the MsgVal and RxIE bits */
-                pch_can_bit_clear(&priv->regs->if1_mcont, CAN_IF_MCONT_RXIE);
-                pch_can_bit_clear(&priv->regs->if1_id2, CAN_ID_MSGVAL);
+                pch_can_bit_clear(&priv->regs->ifregs[dir].mcont, ie);
+                pch_can_bit_clear(&priv->regs->ifregs[dir].id2, PCH_ID_MSGVAL);
         }
 
-        pch_can_check_if_busy(&priv->regs->if1_creq, buff_num);
-        spin_unlock_irqrestore(&priv->msgif_reg_lock, flags);
+        pch_can_check_if_busy(&priv->regs->ifregs[dir].creq, buff_num);
 }
 
-static void pch_can_rx_enable_all(struct pch_can_priv *priv)
+static void pch_can_set_rx_all(struct pch_can_priv *priv, u32 set)
 {
         int i;
 
         /* Traversing to obtain the object configured as receivers. */
-        for (i = 0; i < PCH_OBJ_NUM; i++) {
-                if (priv->msg_obj[i] == MSG_OBJ_RX)
-                        pch_can_set_rx_enable(priv, i + 1, ENABLE);
-        }
-}
-
-static void pch_can_rx_disable_all(struct pch_can_priv *priv)
-{
-        int i;
-
-        /* Traversing to obtain the object configured as receivers. */
-        for (i = 0; i < PCH_OBJ_NUM; i++) {
-                if (priv->msg_obj[i] == MSG_OBJ_RX)
-                        pch_can_set_rx_enable(priv, i + 1, DISABLE);
-        }
-}
-
-static void pch_can_set_tx_enable(struct pch_can_priv *priv, u32 buff_num,
-                                 u32 set)
-{
-        unsigned long flags;
-
-        spin_lock_irqsave(&priv->msgif_reg_lock, flags);
-        /* Reading the Msg buffer from Message RAM to Interface2 registers. */
-        iowrite32(CAN_CMASK_RX_TX_GET, &priv->regs->if2_cmask);
-        pch_can_check_if_busy(&priv->regs->if2_creq, buff_num);
-
-        /* Setting the IF2CMASK register for accessing the
-                MsgVal and TxIE bits */
-        iowrite32(CAN_CMASK_RDWR | CAN_CMASK_ARB | CAN_CMASK_CTRL,
-                 &priv->regs->if2_cmask);
-
-        if (set == ENABLE) {
-                /* Setting the MsgVal and TxIE bits */
-                pch_can_bit_set(&priv->regs->if2_mcont, CAN_IF_MCONT_TXIE);
-                pch_can_bit_set(&priv->regs->if2_id2, CAN_ID_MSGVAL);
-        } else if (set == DISABLE) {
-                /* Resetting the MsgVal and TxIE bits. */
-                pch_can_bit_clear(&priv->regs->if2_mcont, CAN_IF_MCONT_TXIE);
-                pch_can_bit_clear(&priv->regs->if2_id2, CAN_ID_MSGVAL);
-        }
-
-        pch_can_check_if_busy(&priv->regs->if2_creq, buff_num);
-        spin_unlock_irqrestore(&priv->msgif_reg_lock, flags);
+        for (i = PCH_RX_OBJ_START; i <= PCH_RX_OBJ_END; i++)
+                pch_can_set_rxtx(priv, i, set, PCH_RX_IFREG);
 }
 
-static void pch_can_tx_enable_all(struct pch_can_priv *priv)
+static void pch_can_set_tx_all(struct pch_can_priv *priv, u32 set)
 {
         int i;
 
         /* Traversing to obtain the object configured as transmit object. */
-        for (i = 0; i < PCH_OBJ_NUM; i++) {
-                if (priv->msg_obj[i] == MSG_OBJ_TX)
-                        pch_can_set_tx_enable(priv, i + 1, ENABLE);
-        }
-}
-
-static void pch_can_tx_disable_all(struct pch_can_priv *priv)
-{
-        int i;
-
-        /* Traversing to obtain the object configured as transmit object. */
-        for (i = 0; i < PCH_OBJ_NUM; i++) {
-                if (priv->msg_obj[i] == MSG_OBJ_TX)
-                        pch_can_set_tx_enable(priv, i + 1, DISABLE);
-        }
+        for (i = PCH_TX_OBJ_START; i <= PCH_TX_OBJ_END; i++)
+                pch_can_set_rxtx(priv, i, set, PCH_TX_IFREG);
 }
 
-static void pch_can_get_rx_enable(struct pch_can_priv *priv, u32 buff_num,
-                                 u32 *enable)
+static u32 pch_can_get_rxtx_ir(struct pch_can_priv *priv, u32 buff_num,
+                               enum pch_ifreg dir)
 {
-        unsigned long flags;
+        u32 ie, enable;
 
-        spin_lock_irqsave(&priv->msgif_reg_lock, flags);
-        iowrite32(CAN_CMASK_RX_TX_GET, &priv->regs->if1_cmask);
-        pch_can_check_if_busy(&priv->regs->if1_creq, buff_num);
-
-        if (((ioread32(&priv->regs->if1_id2)) & CAN_ID_MSGVAL) &&
-                        ((ioread32(&priv->regs->if1_mcont)) &
-                        CAN_IF_MCONT_RXIE))
-                *enable = ENABLE;
+        if (dir)
+                ie = PCH_IF_MCONT_RXIE;
         else
-                *enable = DISABLE;
-        spin_unlock_irqrestore(&priv->msgif_reg_lock, flags);
-}
+                ie = PCH_IF_MCONT_TXIE;
 
-static void pch_can_get_tx_enable(struct pch_can_priv *priv, u32 buff_num,
-                                 u32 *enable)
-{
-        unsigned long flags;
-
-        spin_lock_irqsave(&priv->msgif_reg_lock, flags);
-        iowrite32(CAN_CMASK_RX_TX_GET, &priv->regs->if2_cmask);
-        pch_can_check_if_busy(&priv->regs->if2_creq, buff_num);
+        iowrite32(PCH_CMASK_RX_TX_GET, &priv->regs->ifregs[dir].cmask);
+        pch_can_check_if_busy(&priv->regs->ifregs[dir].creq, buff_num);
 
-        if (((ioread32(&priv->regs->if2_id2)) & CAN_ID_MSGVAL) &&
-                        ((ioread32(&priv->regs->if2_mcont)) &
-                        CAN_IF_MCONT_TXIE)) {
-                *enable = ENABLE;
+        if (((ioread32(&priv->regs->ifregs[dir].id2)) & PCH_ID_MSGVAL) &&
+                        ((ioread32(&priv->regs->ifregs[dir].mcont)) & ie)) {
+                enable = 1;
         } else {
-                *enable = DISABLE;
+                enable = 0;
         }
-        spin_unlock_irqrestore(&priv->msgif_reg_lock, flags);
+        return enable;
 }
 
 static int pch_can_int_pending(struct pch_can_priv *priv)
@@ -462,141 +384,131 @@ static int pch_can_int_pending(struct pch_can_priv *priv)
 static void pch_can_set_rx_buffer_link(struct pch_can_priv *priv,
                                        u32 buffer_num, u32 set)
 {
-        unsigned long flags;
-
-        spin_lock_irqsave(&priv->msgif_reg_lock, flags);
-        iowrite32(CAN_CMASK_RX_TX_GET, &priv->regs->if1_cmask);
-        pch_can_check_if_busy(&priv->regs->if1_creq, buffer_num);
-        iowrite32(CAN_CMASK_RDWR | CAN_CMASK_CTRL, &priv->regs->if1_cmask);
-        if (set == ENABLE)
-                pch_can_bit_clear(&priv->regs->if1_mcont, CAN_IF_MCONT_EOB);
+        iowrite32(PCH_CMASK_RX_TX_GET, &priv->regs->ifregs[0].cmask);
+        pch_can_check_if_busy(&priv->regs->ifregs[0].creq, buffer_num);
+        iowrite32(PCH_CMASK_RDWR | PCH_CMASK_CTRL,
+                  &priv->regs->ifregs[0].cmask);
+        if (set == PCH_ENABLE)
+                pch_can_bit_clear(&priv->regs->ifregs[0].mcont,
+                                  PCH_IF_MCONT_EOB);
         else
-                pch_can_bit_set(&priv->regs->if1_mcont, CAN_IF_MCONT_EOB);
+                pch_can_bit_set(&priv->regs->ifregs[0].mcont, PCH_IF_MCONT_EOB);
 
-        pch_can_check_if_busy(&priv->regs->if1_creq, buffer_num);
-        spin_unlock_irqrestore(&priv->msgif_reg_lock, flags);
+        pch_can_check_if_busy(&priv->regs->ifregs[0].creq, buffer_num);
 }
 
 static void pch_can_get_rx_buffer_link(struct pch_can_priv *priv,
                                        u32 buffer_num, u32 *link)
 {
-        unsigned long flags;
-
-        spin_lock_irqsave(&priv->msgif_reg_lock, flags);
-        iowrite32(CAN_CMASK_RX_TX_GET, &priv->regs->if1_cmask);
-        pch_can_check_if_busy(&priv->regs->if1_creq, buffer_num);
+        iowrite32(PCH_CMASK_RX_TX_GET, &priv->regs->ifregs[0].cmask);
+        pch_can_check_if_busy(&priv->regs->ifregs[0].creq, buffer_num);
 
-        if (ioread32(&priv->regs->if1_mcont) & CAN_IF_MCONT_EOB)
-                *link = DISABLE;
+        if (ioread32(&priv->regs->ifregs[0].mcont) & PCH_IF_MCONT_EOB)
+                *link = PCH_DISABLE;
         else
-                *link = ENABLE;
-        spin_unlock_irqrestore(&priv->msgif_reg_lock, flags);
+                *link = PCH_ENABLE;
 }
 
 static void pch_can_clear_buffers(struct pch_can_priv *priv)
 {
         int i;
 
-        for (i = 0; i < PCH_RX_OBJ_NUM; i++) {
-                iowrite32(CAN_CMASK_RX_TX_SET, &priv->regs->if1_cmask);
-                iowrite32(0xffff, &priv->regs->if1_mask1);
-                iowrite32(0xffff, &priv->regs->if1_mask2);
-                iowrite32(0x0, &priv->regs->if1_id1);
-                iowrite32(0x0, &priv->regs->if1_id2);
-                iowrite32(0x0, &priv->regs->if1_mcont);
-                iowrite32(0x0, &priv->regs->if1_dataa1);
-                iowrite32(0x0, &priv->regs->if1_dataa2);
-                iowrite32(0x0, &priv->regs->if1_datab1);
-                iowrite32(0x0, &priv->regs->if1_datab2);
-                iowrite32(CAN_CMASK_RDWR | CAN_CMASK_MASK |
-                          CAN_CMASK_ARB | CAN_CMASK_CTRL,
-                          &priv->regs->if1_cmask);
-                pch_can_check_if_busy(&priv->regs->if1_creq, i+1);
+        for (i = PCH_RX_OBJ_START; i <= PCH_RX_OBJ_END; i++) {
+                iowrite32(PCH_CMASK_RX_TX_SET, &priv->regs->ifregs[0].cmask);
+                iowrite32(0xffff, &priv->regs->ifregs[0].mask1);
+                iowrite32(0xffff, &priv->regs->ifregs[0].mask2);
+                iowrite32(0x0, &priv->regs->ifregs[0].id1);
+                iowrite32(0x0, &priv->regs->ifregs[0].id2);
+                iowrite32(0x0, &priv->regs->ifregs[0].mcont);
+                iowrite32(0x0, &priv->regs->ifregs[0].dataa1);
+                iowrite32(0x0, &priv->regs->ifregs[0].dataa2);
+                iowrite32(0x0, &priv->regs->ifregs[0].datab1);
+                iowrite32(0x0, &priv->regs->ifregs[0].datab2);
+                iowrite32(PCH_CMASK_RDWR | PCH_CMASK_MASK |
+                          PCH_CMASK_ARB | PCH_CMASK_CTRL,
+                          &priv->regs->ifregs[0].cmask);
+                pch_can_check_if_busy(&priv->regs->ifregs[0].creq, i);
         }
 
-        for (i = i;  i < PCH_OBJ_NUM; i++) {
-                iowrite32(CAN_CMASK_RX_TX_SET, &priv->regs->if2_cmask);
-                iowrite32(0xffff, &priv->regs->if2_mask1);
-                iowrite32(0xffff, &priv->regs->if2_mask2);
-                iowrite32(0x0, &priv->regs->if2_id1);
-                iowrite32(0x0, &priv->regs->if2_id2);
-                iowrite32(0x0, &priv->regs->if2_mcont);
-                iowrite32(0x0, &priv->regs->if2_dataa1);
-                iowrite32(0x0, &priv->regs->if2_dataa2);
-                iowrite32(0x0, &priv->regs->if2_datab1);
-                iowrite32(0x0, &priv->regs->if2_datab2);
-                iowrite32(CAN_CMASK_RDWR | CAN_CMASK_MASK |
-                          CAN_CMASK_ARB | CAN_CMASK_CTRL,
-                          &priv->regs->if2_cmask);
-                pch_can_check_if_busy(&priv->regs->if2_creq, i+1);
+        for (i = PCH_TX_OBJ_START;  i <= PCH_TX_OBJ_END; i++) {
+                iowrite32(PCH_CMASK_RX_TX_SET, &priv->regs->ifregs[1].cmask);
+                iowrite32(0xffff, &priv->regs->ifregs[1].mask1);
+                iowrite32(0xffff, &priv->regs->ifregs[1].mask2);
+                iowrite32(0x0, &priv->regs->ifregs[1].id1);
+                iowrite32(0x0, &priv->regs->ifregs[1].id2);
+                iowrite32(0x0, &priv->regs->ifregs[1].mcont);
+                iowrite32(0x0, &priv->regs->ifregs[1].dataa1);
+                iowrite32(0x0, &priv->regs->ifregs[1].dataa2);
+                iowrite32(0x0, &priv->regs->ifregs[1].datab1);
+                iowrite32(0x0, &priv->regs->ifregs[1].datab2);
+                iowrite32(PCH_CMASK_RDWR | PCH_CMASK_MASK |
+                          PCH_CMASK_ARB | PCH_CMASK_CTRL,
+                          &priv->regs->ifregs[1].cmask);
+                pch_can_check_if_busy(&priv->regs->ifregs[1].creq, i);
         }
 }
 
 static void pch_can_config_rx_tx_buffers(struct pch_can_priv *priv)
 {
         int i;
-        unsigned long flags;
 
-        spin_lock_irqsave(&priv->msgif_reg_lock, flags);
+        for (i = PCH_RX_OBJ_START; i <= PCH_RX_OBJ_END; i++) {
+                iowrite32(PCH_CMASK_RX_TX_GET,
+                        &priv->regs->ifregs[0].cmask);
+                pch_can_check_if_busy(&priv->regs->ifregs[0].creq, i);
 
-        for (i = 0; i < PCH_OBJ_NUM; i++) {
-                if (priv->msg_obj[i] == MSG_OBJ_RX) {
-                        iowrite32(CAN_CMASK_RX_TX_GET,
-                                &priv->regs->if1_cmask);
-                        pch_can_check_if_busy(&priv->regs->if1_creq, i+1);
+                iowrite32(0x0, &priv->regs->ifregs[0].id1);
+                iowrite32(0x0, &priv->regs->ifregs[0].id2);
 
-                        iowrite32(0x0, &priv->regs->if1_id1);
-                        iowrite32(0x0, &priv->regs->if1_id2);
+                pch_can_bit_set(&priv->regs->ifregs[0].mcont,
+                                PCH_IF_MCONT_UMASK);
 
-                        pch_can_bit_set(&priv->regs->if1_mcont,
-                                        CAN_IF_MCONT_UMASK);
+                /* Set FIFO mode set to 0 except last Rx Obj*/
+                pch_can_bit_clear(&priv->regs->ifregs[0].mcont,
+                                  PCH_IF_MCONT_EOB);
+                /* In case FIFO mode, Last EoB of Rx Obj must be 1 */
+                if (i == PCH_RX_OBJ_END)
+                        pch_can_bit_set(&priv->regs->ifregs[0].mcont,
+                                          PCH_IF_MCONT_EOB);
 
-                        /* Set FIFO mode set to 0 except last Rx Obj*/
-                        pch_can_bit_clear(&priv->regs->if1_mcont,
-                                          CAN_IF_MCONT_EOB);
-                        /* In case FIFO mode, Last EoB of Rx Obj must be 1 */
-                        if (i == (PCH_RX_OBJ_NUM - 1))
-                                pch_can_bit_set(&priv->regs->if1_mcont,
-                                                  CAN_IF_MCONT_EOB);
+                iowrite32(0, &priv->regs->ifregs[0].mask1);
+                pch_can_bit_clear(&priv->regs->ifregs[0].mask2,
+                                  0x1fff | PCH_MASK2_MDIR_MXTD);
 
-                        iowrite32(0, &priv->regs->if1_mask1);
-                        pch_can_bit_clear(&priv->regs->if1_mask2,
-                                          0x1fff | CAN_MASK2_MDIR_MXTD);
+                /* Setting CMASK for writing */
+                iowrite32(PCH_CMASK_RDWR | PCH_CMASK_MASK |
+                          PCH_CMASK_ARB | PCH_CMASK_CTRL,
+                          &priv->regs->ifregs[0].cmask);
 
-                        /* Setting CMASK for writing */
-                        iowrite32(CAN_CMASK_RDWR | CAN_CMASK_MASK |
-                                  CAN_CMASK_ARB | CAN_CMASK_CTRL,
-                                  &priv->regs->if1_cmask);
+                pch_can_check_if_busy(&priv->regs->ifregs[0].creq, i);
+        }
 
-                        pch_can_check_if_busy(&priv->regs->if1_creq, i+1);
-                } else if (priv->msg_obj[i] == MSG_OBJ_TX) {
-                        iowrite32(CAN_CMASK_RX_TX_GET,
-                                &priv->regs->if2_cmask);
-                        pch_can_check_if_busy(&priv->regs->if2_creq, i+1);
+        for (i = PCH_TX_OBJ_START; i <= PCH_TX_OBJ_END; i++) {
+                iowrite32(PCH_CMASK_RX_TX_GET,
+                        &priv->regs->ifregs[1].cmask);
+                pch_can_check_if_busy(&priv->regs->ifregs[1].creq, i);
 
-                        /* Resetting DIR bit for reception */
-                        iowrite32(0x0, &priv->regs->if2_id1);
-                        iowrite32(0x0, &priv->regs->if2_id2);
-                        pch_can_bit_set(&priv->regs->if2_id2, CAN_ID2_DIR);
+                /* Resetting DIR bit for reception */
+                iowrite32(0x0, &priv->regs->ifregs[1].id1);
+                iowrite32(0x0, &priv->regs->ifregs[1].id2);
+                pch_can_bit_set(&priv->regs->ifregs[1].id2, PCH_ID2_DIR);
 
-                        /* Setting EOB bit for transmitter */
-                        iowrite32(CAN_IF_MCONT_EOB, &priv->regs->if2_mcont);
+                /* Setting EOB bit for transmitter */
+                iowrite32(PCH_IF_MCONT_EOB, &priv->regs->ifregs[1].mcont);
 
-                        pch_can_bit_set(&priv->regs->if2_mcont,
-                                        CAN_IF_MCONT_UMASK);
+                pch_can_bit_set(&priv->regs->ifregs[1].mcont,
+                                PCH_IF_MCONT_UMASK);
 
-                        iowrite32(0, &priv->regs->if2_mask1);
-                        pch_can_bit_clear(&priv->regs->if2_mask2, 0x1fff);
+                iowrite32(0, &priv->regs->ifregs[1].mask1);
+                pch_can_bit_clear(&priv->regs->ifregs[1].mask2, 0x1fff);
 
-                        /* Setting CMASK for writing */
-                        iowrite32(CAN_CMASK_RDWR | CAN_CMASK_MASK |
-                                  CAN_CMASK_ARB | CAN_CMASK_CTRL,
-                                  &priv->regs->if2_cmask);
+                /* Setting CMASK for writing */
+                iowrite32(PCH_CMASK_RDWR | PCH_CMASK_MASK |
+                          PCH_CMASK_ARB | PCH_CMASK_CTRL,
+                          &priv->regs->ifregs[1].cmask);
 
-                        pch_can_check_if_busy(&priv->regs->if2_creq, i+1);
-                }
+                pch_can_check_if_busy(&priv->regs->ifregs[1].creq, i);
         }
-        spin_unlock_irqrestore(&priv->msgif_reg_lock, flags);
 }
 
 static void pch_can_init(struct pch_can_priv *priv)
@@ -623,50 +535,50 @@ static void pch_can_release(struct pch_can_priv *priv)
         pch_can_set_int_enables(priv, PCH_CAN_NONE);
 
         /* Disabling all the receive object. */
-        pch_can_rx_disable_all(priv);
+        pch_can_set_rx_all(priv, 0);
 
         /* Disabling all the transmit object. */
-        pch_can_tx_disable_all(priv);
+        pch_can_set_tx_all(priv, 0);
 }
 
 /* This function clears interrupt(s) from the CAN device. */
 static void pch_can_int_clr(struct pch_can_priv *priv, u32 mask)
 {
-        if (mask == CAN_STATUS_INT) {
+        if (mask == PCH_STATUS_INT) {
                 ioread32(&priv->regs->stat);
                 return;
         }
 
         /* Clear interrupt for transmit object */
-        if (priv->msg_obj[mask - 1] == MSG_OBJ_TX) {
-                /* Setting CMASK for clearing interrupts for
-                                         frame transmission. */
-                iowrite32(CAN_CMASK_RDWR | CAN_CMASK_CTRL | CAN_CMASK_ARB,
-                          &priv->regs->if2_cmask);
-
-                /* Resetting the ID registers. */
-                pch_can_bit_set(&priv->regs->if2_id2,
-                               CAN_ID2_DIR | (0x7ff << 2));
-                iowrite32(0x0, &priv->regs->if2_id1);
-
-                /* Claring NewDat, TxRqst & IntPnd */
-                pch_can_bit_clear(&priv->regs->if2_mcont,
-                                  CAN_IF_MCONT_NEWDAT | CAN_IF_MCONT_INTPND |
-                                  CAN_IF_MCONT_TXRQXT);
-                pch_can_check_if_busy(&priv->regs->if2_creq, mask);
-        } else if (priv->msg_obj[mask - 1] == MSG_OBJ_RX) {
+        if ((mask >= PCH_RX_OBJ_START) && (mask <= PCH_RX_OBJ_END)) {
                 /* Setting CMASK for clearing the reception interrupts. */
-                iowrite32(CAN_CMASK_RDWR | CAN_CMASK_CTRL | CAN_CMASK_ARB,
-                          &priv->regs->if1_cmask);
+                iowrite32(PCH_CMASK_RDWR | PCH_CMASK_CTRL | PCH_CMASK_ARB,
+                          &priv->regs->ifregs[0].cmask);
 
                 /* Clearing the Dir bit. */
-                pch_can_bit_clear(&priv->regs->if1_id2, CAN_ID2_DIR);
+                pch_can_bit_clear(&priv->regs->ifregs[0].id2, PCH_ID2_DIR);
 
                 /* Clearing NewDat & IntPnd */
-                pch_can_bit_clear(&priv->regs->if1_mcont,
-                                  CAN_IF_MCONT_NEWDAT | CAN_IF_MCONT_INTPND);
+                pch_can_bit_clear(&priv->regs->ifregs[0].mcont,
+                                  PCH_IF_MCONT_NEWDAT | PCH_IF_MCONT_INTPND);
+
+                pch_can_check_if_busy(&priv->regs->ifregs[0].creq, mask);
+        } else if ((mask >= PCH_TX_OBJ_START) && (mask <= PCH_TX_OBJ_END)) {
+                /* Setting CMASK for clearing interrupts for
+                                         frame transmission. */
+                iowrite32(PCH_CMASK_RDWR | PCH_CMASK_CTRL | PCH_CMASK_ARB,
+                          &priv->regs->ifregs[1].cmask);
+
+                /* Resetting the ID registers. */
+                pch_can_bit_set(&priv->regs->ifregs[1].id2,
+                               PCH_ID2_DIR | (0x7ff << 2));
+                iowrite32(0x0, &priv->regs->ifregs[1].id1);
 
-                pch_can_check_if_busy(&priv->regs->if1_creq, mask);
+                /* Claring NewDat, TxRqst & IntPnd */
+                pch_can_bit_clear(&priv->regs->ifregs[1].mcont,
+                                  PCH_IF_MCONT_NEWDAT | PCH_IF_MCONT_INTPND |
+                                  PCH_IF_MCONT_TXRQXT);
+                pch_can_check_if_busy(&priv->regs->ifregs[1].creq, mask);
         }
 }
 
@@ -688,7 +600,7 @@ static void pch_can_error(struct net_device *ndev, u32 status)
         struct sk_buff *skb;
         struct pch_can_priv *priv = netdev_priv(ndev);
         struct can_frame *cf;
-        u32 errc;
+        u32 errc, lec;
         struct net_device_stats *stats = &(priv->ndev->stats);
         enum can_state state = priv->can.state;
 
@@ -697,8 +609,8 @@ static void pch_can_error(struct net_device *ndev, u32 status)
                 return;
 
         if (status & PCH_BUS_OFF) {
-                pch_can_tx_disable_all(priv);
-                pch_can_rx_disable_all(priv);
+                pch_can_set_tx_all(priv, 0);
+                pch_can_set_rx_all(priv, 0);
                 state = CAN_STATE_BUS_OFF;
                 cf->can_id |= CAN_ERR_BUSOFF;
                 can_bus_off(ndev);
@@ -712,9 +624,9 @@ static void pch_can_error(struct net_device *ndev, u32 status)
                 priv->can.can_stats.error_warning++;
                 cf->can_id |= CAN_ERR_CRTL;
                 errc = ioread32(&priv->regs->errc);
-                if (((errc & CAN_REC) >> 8) > 96)
+                if (((errc & PCH_REC) >> 8) > 96)
                         cf->data[1] |= CAN_ERR_CRTL_RX_WARNING;
-                if ((errc & CAN_TEC) > 96)
+                if ((errc & PCH_TEC) > 96)
                         cf->data[1] |= CAN_ERR_CRTL_TX_WARNING;
                 dev_warn(&ndev->dev,
                         "%s -> Error Counter is more than 96.\n", __func__);
@@ -725,41 +637,45 @@ static void pch_can_error(struct net_device *ndev, u32 status)
                 state = CAN_STATE_ERROR_PASSIVE;
                 cf->can_id |= CAN_ERR_CRTL;
                 errc = ioread32(&priv->regs->errc);
-                if (((errc & CAN_REC) >> 8) > 127)
+                if (((errc & PCH_REC) >> 8) > 127)
                         cf->data[1] |= CAN_ERR_CRTL_RX_PASSIVE;
-                if ((errc & CAN_TEC) > 127)
+                if ((errc & PCH_TEC) > 127)
                         cf->data[1] |= CAN_ERR_CRTL_TX_PASSIVE;
                 dev_err(&ndev->dev,
                         "%s -> CAN controller is ERROR PASSIVE .\n", __func__);
         }
 
-        if (status & PCH_LEC_ALL) {
+        lec = status & PCH_LEC_ALL;
+        switch (lec) {
+        case PCH_STUF_ERR:
+                cf->data[2] |= CAN_ERR_PROT_STUFF;
                 priv->can.can_stats.bus_error++;
                 stats->rx_errors++;
-                switch (status & PCH_LEC_ALL) {
-                case PCH_STUF_ERR:
-                        cf->data[2] |= CAN_ERR_PROT_STUFF;
-                        break;
-                case PCH_FORM_ERR:
-                        cf->data[2] |= CAN_ERR_PROT_FORM;
-                        break;
-                case PCH_ACK_ERR:
-                        cf->data[2] |= CAN_ERR_PROT_LOC_ACK |
-                                       CAN_ERR_PROT_LOC_ACK_DEL;
-                        break;
-                case PCH_BIT1_ERR:
-                case PCH_BIT0_ERR:
-                        cf->data[2] |= CAN_ERR_PROT_BIT;
-                        break;
-                case PCH_CRC_ERR:
-                        cf->data[2] |= CAN_ERR_PROT_LOC_CRC_SEQ |
-                                       CAN_ERR_PROT_LOC_CRC_DEL;
-                        break;
-                default:
-                        iowrite32(status | PCH_LEC_ALL, &priv->regs->stat);
-                        break;
-                }
-
+                break;
+        case PCH_FORM_ERR:
+                cf->data[2] |= CAN_ERR_PROT_FORM;
+                priv->can.can_stats.bus_error++;
+                stats->rx_errors++;
+                break;
+        case PCH_ACK_ERR:
+                cf->can_id |= CAN_ERR_ACK;
+                priv->can.can_stats.bus_error++;
+                stats->rx_errors++;
+                break;
+        case PCH_BIT1_ERR:
+        case PCH_BIT0_ERR:
+                cf->data[2] |= CAN_ERR_PROT_BIT;
+                priv->can.can_stats.bus_error++;
+                stats->rx_errors++;
+                break;
+        case PCH_CRC_ERR:
+                cf->data[2] |= CAN_ERR_PROT_LOC_CRC_SEQ |
+                               CAN_ERR_PROT_LOC_CRC_DEL;
+                priv->can.can_stats.bus_error++;
+                stats->rx_errors++;
+                break;
+        case PCH_LEC_ALL: /* Written by CPU. No error status */
+                break;
         }
 
         priv->can.state = state;
@@ -795,22 +711,22 @@ static int pch_can_rx_normal(struct net_device *ndev, u32 int_stat)
         struct net_device_stats *stats = &(priv->ndev->stats);
 
         /* Reading the messsage object from the Message RAM */
-        iowrite32(CAN_CMASK_RX_TX_GET, &priv->regs->if1_cmask);
-        pch_can_check_if_busy(&priv->regs->if1_creq, int_stat);
+        iowrite32(PCH_CMASK_RX_TX_GET, &priv->regs->ifregs[0].cmask);
+        pch_can_check_if_busy(&priv->regs->ifregs[0].creq, int_stat);
 
         /* Reading the MCONT register. */
-        reg = ioread32(&priv->regs->if1_mcont);
+        reg = ioread32(&priv->regs->ifregs[0].mcont);
         reg &= 0xffff;
 
-        for (k = int_stat; !(reg & CAN_IF_MCONT_EOB); k++) {
+        for (k = int_stat; !(reg & PCH_IF_MCONT_EOB); k++) {
                 /* If MsgLost bit set. */
-                if (reg & CAN_IF_MCONT_MSGLOST) {
+                if (reg & PCH_IF_MCONT_MSGLOST) {
                         dev_err(&priv->ndev->dev, "Msg Obj is overwritten.\n");
-                        pch_can_bit_clear(&priv->regs->if1_mcont,
-                                          CAN_IF_MCONT_MSGLOST);
-                        iowrite32(CAN_CMASK_RDWR | CAN_CMASK_CTRL,
-                                  &priv->regs->if1_cmask);
-                        pch_can_check_if_busy(&priv->regs->if1_creq, k);
+                        pch_can_bit_clear(&priv->regs->ifregs[0].mcont,
+                                          PCH_IF_MCONT_MSGLOST);
+                        iowrite32(PCH_CMASK_RDWR | PCH_CMASK_CTRL,
+                                  &priv->regs->ifregs[0].cmask);
+                        pch_can_check_if_busy(&priv->regs->ifregs[0].creq, k);
 
                         skb = alloc_can_err_skb(ndev, &cf);
                         if (!skb)
@@ -828,7 +744,7 @@ static int pch_can_rx_normal(struct net_device *ndev, u32 int_stat)
                         rcv_pkts++;
                         goto RX_NEXT;
                 }
-                if (!(reg & CAN_IF_MCONT_NEWDAT))
+                if (!(reg & PCH_IF_MCONT_NEWDAT))
                         goto RX_NEXT;
 
                 skb = alloc_can_skb(priv->ndev, &cf);
@@ -836,29 +752,30 @@ static int pch_can_rx_normal(struct net_device *ndev, u32 int_stat)
                         return -ENOMEM;
 
                 /* Get Received data */
-                ide = ((ioread32(&priv->regs->if1_id2)) & CAN_ID2_XTD) >> 14;
+                ide = ((ioread32(&priv->regs->ifregs[0].id2)) & PCH_ID2_XTD) >>
+                                                                             14;
                 if (ide) {
-                        id = (ioread32(&priv->regs->if1_id1) & 0xffff);
-                        id |= (((ioread32(&priv->regs->if1_id2)) &
+                        id = (ioread32(&priv->regs->ifregs[0].id1) & 0xffff);
+                        id |= (((ioread32(&priv->regs->ifregs[0].id2)) &
                                             0x1fff) << 16);
                         cf->can_id = (id & CAN_EFF_MASK) | CAN_EFF_FLAG;
                 } else {
-                        id = (((ioread32(&priv->regs->if1_id2)) &
-                                          (CAN_SFF_MASK << 2)) >> 2);
+                        id = (((ioread32(&priv->regs->ifregs[0].id2)) &
+                                                     (CAN_SFF_MASK << 2)) >> 2);
                         cf->can_id = (id & CAN_SFF_MASK);
                 }
 
-                rtr = (ioread32(&priv->regs->if1_id2) &  CAN_ID2_DIR);
+                rtr = (ioread32(&priv->regs->ifregs[0].id2) &  PCH_ID2_DIR);
                 if (rtr) {
                         cf->can_dlc = 0;
                         cf->can_id |= CAN_RTR_FLAG;
                 } else {
-                        cf->can_dlc = ((ioread32(&priv->regs->if1_mcont)) &
-                                                   0x0f);
+                        cf->can_dlc =
+                              ((ioread32(&priv->regs->ifregs[0].mcont)) & 0x0f);
                 }
 
                 for (i = 0, j = 0; i < cf->can_dlc; j++) {
-                        reg = ioread32(&priv->regs->if1_dataa1 + j*4);
+                        reg = ioread32(&priv->regs->ifregs[0].dataa1 + j*4);
                         cf->data[i++] = cpu_to_le32(reg & 0xff);
                         if (i == cf->can_dlc)
                                 break;
@@ -871,16 +788,17 @@ static int pch_can_rx_normal(struct net_device *ndev, u32 int_stat)
                 stats->rx_bytes += cf->can_dlc;
 
                 if (k < PCH_FIFO_THRESH) {
-                        iowrite32(CAN_CMASK_RDWR | CAN_CMASK_CTRL |
-                                  CAN_CMASK_ARB, &priv->regs->if1_cmask);
+                        iowrite32(PCH_CMASK_RDWR | PCH_CMASK_CTRL |
+                                  PCH_CMASK_ARB, &priv->regs->ifregs[0].cmask);
 
                         /* Clearing the Dir bit. */
-                        pch_can_bit_clear(&priv->regs->if1_id2, CAN_ID2_DIR);
+                        pch_can_bit_clear(&priv->regs->ifregs[0].id2,
+                                          PCH_ID2_DIR);
 
                         /* Clearing NewDat & IntPnd */
-                        pch_can_bit_clear(&priv->regs->if1_mcont,
-                                          CAN_IF_MCONT_INTPND);
-                        pch_can_check_if_busy(&priv->regs->if1_creq, k);
+                        pch_can_bit_clear(&priv->regs->ifregs[0].mcont,
+                                          PCH_IF_MCONT_INTPND);
+                        pch_can_check_if_busy(&priv->regs->ifregs[0].creq, k);
                 } else if (k > PCH_FIFO_THRESH) {
                         pch_can_int_clr(priv, k);
                 } else if (k == PCH_FIFO_THRESH) {
@@ -890,9 +808,9 @@ static int pch_can_rx_normal(struct net_device *ndev, u32 int_stat)
                 }
 RX_NEXT:
                 /* Reading the messsage object from the Message RAM */
-                iowrite32(CAN_CMASK_RX_TX_GET, &priv->regs->if1_cmask);
-                pch_can_check_if_busy(&priv->regs->if1_creq, k + 1);
-                reg = ioread32(&priv->regs->if1_mcont);
+                iowrite32(PCH_CMASK_RX_TX_GET, &priv->regs->ifregs[0].cmask);
+                pch_can_check_if_busy(&priv->regs->ifregs[0].creq, k);
+                reg = ioread32(&priv->regs->ifregs[0].mcont);
         }
 
         return rcv_pkts;
@@ -906,14 +824,13 @@ static int pch_can_rx_poll(struct napi_struct *napi, int quota)
         u32 int_stat;
         int rcv_pkts = 0;
         u32 reg_stat;
-        unsigned long flags;
 
         int_stat = pch_can_int_pending(priv);
         if (!int_stat)
                 return 0;
 
 INT_STAT:
-        if (int_stat == CAN_STATUS_INT) {
+        if (int_stat == PCH_STATUS_INT) {
                 reg_stat = ioread32(&priv->regs->stat);
                 if (reg_stat & (PCH_BUS_OFF | PCH_LEC_ALL)) {
                         if ((reg_stat & PCH_LEC_ALL) != PCH_LEC_ALL)
@@ -921,11 +838,10 @@ INT_STAT:
                 }
 
                 if (reg_stat & PCH_TX_OK) {
-                        spin_lock_irqsave(&priv->msgif_reg_lock, flags);
-                        iowrite32(CAN_CMASK_RX_TX_GET, &priv->regs->if2_cmask);
-                        pch_can_check_if_busy(&priv->regs->if2_creq,
+                        iowrite32(PCH_CMASK_RX_TX_GET,
+                                  &priv->regs->ifregs[1].cmask);
+                        pch_can_check_if_busy(&priv->regs->ifregs[1].creq,
                                                ioread32(&priv->regs->intr));
-                        spin_unlock_irqrestore(&priv->msgif_reg_lock, flags);
                         pch_can_bit_clear(&priv->regs->stat, PCH_TX_OK);
                 }
 
@@ -933,37 +849,32 @@ INT_STAT:
                         pch_can_bit_clear(&priv->regs->stat, PCH_RX_OK);
 
                 int_stat = pch_can_int_pending(priv);
-                if (int_stat == CAN_STATUS_INT)
+                if (int_stat == PCH_STATUS_INT)
                         goto INT_STAT;
         }
 
 MSG_OBJ:
-        if ((int_stat >= 1) && (int_stat <= PCH_RX_OBJ_NUM)) {
-                spin_lock_irqsave(&priv->msgif_reg_lock, flags);
+        if ((int_stat >= PCH_RX_OBJ_START) && (int_stat <= PCH_RX_OBJ_END)) {
                 rcv_pkts = pch_can_rx_normal(ndev, int_stat);
-                spin_unlock_irqrestore(&priv->msgif_reg_lock, flags);
                 if (rcv_pkts < 0)
                         return 0;
-        } else if ((int_stat > PCH_RX_OBJ_NUM) && (int_stat <= PCH_OBJ_NUM)) {
-                if (priv->msg_obj[int_stat - 1] == MSG_OBJ_TX) {
-                        /* Handle transmission interrupt */
-                        can_get_echo_skb(ndev, int_stat - PCH_RX_OBJ_NUM - 1);
-                        spin_lock_irqsave(&priv->msgif_reg_lock, flags);
-                        iowrite32(CAN_CMASK_RX_TX_GET | CAN_CMASK_CLRINTPND,
-                                  &priv->regs->if2_cmask);
-                        dlc = ioread32(&priv->regs->if2_mcont) &
-                                       CAN_IF_MCONT_DLC;
-                        pch_can_check_if_busy(&priv->regs->if2_creq, int_stat);
-                        spin_unlock_irqrestore(&priv->msgif_reg_lock, flags);
-                        if (dlc > 8)
-                                dlc = 8;
-                        stats->tx_bytes += dlc;
-                        stats->tx_packets++;
-                }
+        } else if ((int_stat >= PCH_TX_OBJ_START) &&
+                   (int_stat <= PCH_TX_OBJ_END)) {
+                /* Handle transmission interrupt */
+                can_get_echo_skb(ndev, int_stat - PCH_RX_OBJ_END - 1);
+                iowrite32(PCH_CMASK_RX_TX_GET | PCH_CMASK_CLRINTPND,
+                          &priv->regs->ifregs[1].cmask);
+                dlc = ioread32(&priv->regs->ifregs[1].mcont) &
+                               PCH_IF_MCONT_DLC;
+                pch_can_check_if_busy(&priv->regs->ifregs[1].creq, int_stat);
+                if (dlc > 8)
+                        dlc = 8;
+                stats->tx_bytes += dlc;
+                stats->tx_packets++;
         }
 
         int_stat = pch_can_int_pending(priv);
-        if (int_stat == CAN_STATUS_INT)
+        if (int_stat == PCH_STATUS_INT)
                 goto INT_STAT;
         else if (int_stat >= 1 && int_stat <= 32)
                 goto MSG_OBJ;
@@ -983,17 +894,17 @@ static int pch_set_bittiming(struct net_device *ndev)
         u32 brp;
 
         /* Setting the CCE bit for accessing the Can Timing register. */
-        pch_can_bit_set(&priv->regs->cont, CAN_CTRL_CCE);
+        pch_can_bit_set(&priv->regs->cont, PCH_CTRL_CCE);
 
         brp = (bt->tq) / (1000000000/PCH_CAN_CLK) - 1;
-        canbit = brp & MSK_BITT_BRP;
-        canbit |= (bt->sjw - 1) << BIT_BITT_SJW;
-        canbit |= (bt->phase_seg1 + bt->prop_seg - 1) << BIT_BITT_TSEG1;
-        canbit |= (bt->phase_seg2 - 1) << BIT_BITT_TSEG2;
-        bepe = (brp & MSK_BRPE_BRPE) >> BIT_BRPE_BRPE;
+        canbit = brp & PCH_MSK_BITT_BRP;
+        canbit |= (bt->sjw - 1) << PCH_BIT_SJW;
+        canbit |= (bt->phase_seg1 + bt->prop_seg - 1) << PCH_BIT_TSEG1;
+        canbit |= (bt->phase_seg2 - 1) << PCH_BIT_TSEG2;
+        bepe = (brp & PCH_MSK_BRPE_BRPE) >> PCH_BIT_BRPE_BRPE;
         iowrite32(canbit, &priv->regs->bitt);
         iowrite32(bepe, &priv->regs->brpe);
-        pch_can_bit_clear(&priv->regs->cont, CAN_CTRL_CCE);
+        pch_can_bit_clear(&priv->regs->cont, PCH_CTRL_CCE);
 
         return 0;
 }
@@ -1008,8 +919,8 @@ static void pch_can_start(struct net_device *ndev)
         pch_set_bittiming(ndev);
         pch_can_set_optmode(priv);
 
-        pch_can_tx_enable_all(priv);
-        pch_can_rx_enable_all(priv);
+        pch_can_set_tx_all(priv, 1);
+        pch_can_set_rx_all(priv, 1);
 
         /* Setting the CAN to run mode. */
         pch_can_set_run_mode(priv, PCH_CAN_RUN);
@@ -1113,7 +1024,6 @@ static int pch_get_msg_obj_sts(struct net_device *ndev, u32 obj_id)
 static netdev_tx_t pch_xmit(struct sk_buff *skb, struct net_device *ndev)
 {
         int i, j;
-        unsigned long flags;
         struct pch_can_priv *priv = netdev_priv(ndev);
         struct can_frame *cf = (struct can_frame *)skb->data;
         int tx_buffer_avail = 0;
@@ -1121,72 +1031,68 @@ static netdev_tx_t pch_xmit(struct sk_buff *skb, struct net_device *ndev)
         if (can_dropped_invalid_skb(ndev, skb))
                 return NETDEV_TX_OK;
 
-        if (priv->tx_obj == (PCH_OBJ_NUM + 1)) { /* Point tail Obj */
+        if (priv->tx_obj == PCH_TX_OBJ_END) { /* Point tail Obj */
                 while (pch_get_msg_obj_sts(ndev, (((1 << PCH_TX_OBJ_NUM)-1) <<
                                            PCH_RX_OBJ_NUM)))
                         udelay(500);
 
-                priv->tx_obj = PCH_RX_OBJ_NUM + 1; /* Point head of Tx Obj ID */
+                priv->tx_obj = PCH_TX_OBJ_START; /* Point head of Tx Obj ID */
                 tx_buffer_avail = priv->tx_obj; /* Point Tail of Tx Obj */
         } else {
                 tx_buffer_avail = priv->tx_obj;
         }
         priv->tx_obj++;
 
-        /* Attaining the lock. */
-        spin_lock_irqsave(&priv->msgif_reg_lock, flags);
-
         /* Reading the Msg Obj from the Msg RAM to the Interface register. */
-        iowrite32(CAN_CMASK_RX_TX_GET, &priv->regs->if2_cmask);
-        pch_can_check_if_busy(&priv->regs->if2_creq, tx_buffer_avail);
+        iowrite32(PCH_CMASK_RX_TX_GET, &priv->regs->ifregs[1].cmask);
+        pch_can_check_if_busy(&priv->regs->ifregs[1].creq, tx_buffer_avail);
 
         /* Setting the CMASK register. */
-        pch_can_bit_set(&priv->regs->if2_cmask, CAN_CMASK_ALL);
+        pch_can_bit_set(&priv->regs->ifregs[1].cmask, PCH_CMASK_ALL);
 
         /* If ID extended is set. */
-        pch_can_bit_clear(&priv->regs->if2_id1, 0xffff);
-        pch_can_bit_clear(&priv->regs->if2_id2, 0x1fff | CAN_ID2_XTD);
+        pch_can_bit_clear(&priv->regs->ifregs[1].id1, 0xffff);
+        pch_can_bit_clear(&priv->regs->ifregs[1].id2, 0x1fff | PCH_ID2_XTD);
         if (cf->can_id & CAN_EFF_FLAG) {
-                pch_can_bit_set(&priv->regs->if2_id1, cf->can_id & 0xffff);
-                pch_can_bit_set(&priv->regs->if2_id2,
-                                ((cf->can_id >> 16) & 0x1fff) | CAN_ID2_XTD);
+                pch_can_bit_set(&priv->regs->ifregs[1].id1,
+                                cf->can_id & 0xffff);
+                pch_can_bit_set(&priv->regs->ifregs[1].id2,
+                                ((cf->can_id >> 16) & 0x1fff) | PCH_ID2_XTD);
         } else {
-                pch_can_bit_set(&priv->regs->if2_id1, 0);
-                pch_can_bit_set(&priv->regs->if2_id2,
+                pch_can_bit_set(&priv->regs->ifregs[1].id1, 0);
+                pch_can_bit_set(&priv->regs->ifregs[1].id2,
                                 (cf->can_id & CAN_SFF_MASK) << 2);
         }
 
         /* If remote frame has to be transmitted.. */
         if (cf->can_id & CAN_RTR_FLAG)
-                pch_can_bit_clear(&priv->regs->if2_id2, CAN_ID2_DIR);
+                pch_can_bit_clear(&priv->regs->ifregs[1].id2, PCH_ID2_DIR);
 
         for (i = 0, j = 0; i < cf->can_dlc; j++) {
                 iowrite32(le32_to_cpu(cf->data[i++]),
-                         (&priv->regs->if2_dataa1) + j*4);
+                         (&priv->regs->ifregs[1].dataa1) + j*4);
                 if (i == cf->can_dlc)
                         break;
                 iowrite32(le32_to_cpu(cf->data[i++] << 8),
-                         (&priv->regs->if2_dataa1) + j*4);
+                         (&priv->regs->ifregs[1].dataa1) + j*4);
         }
 
-        can_put_echo_skb(skb, ndev, tx_buffer_avail - PCH_RX_OBJ_NUM - 1);
+        can_put_echo_skb(skb, ndev, tx_buffer_avail - PCH_RX_OBJ_END - 1);
 
         /* Updating the size of the data. */
-        pch_can_bit_clear(&priv->regs->if2_mcont, 0x0f);
-        pch_can_bit_set(&priv->regs->if2_mcont, cf->can_dlc);
+        pch_can_bit_clear(&priv->regs->ifregs[1].mcont, 0x0f);
+        pch_can_bit_set(&priv->regs->ifregs[1].mcont, cf->can_dlc);
 
         /* Clearing IntPend, NewDat & TxRqst */
-        pch_can_bit_clear(&priv->regs->if2_mcont,
-                          CAN_IF_MCONT_NEWDAT | CAN_IF_MCONT_INTPND |
-                          CAN_IF_MCONT_TXRQXT);
+        pch_can_bit_clear(&priv->regs->ifregs[1].mcont,
+                          PCH_IF_MCONT_NEWDAT | PCH_IF_MCONT_INTPND |
+                          PCH_IF_MCONT_TXRQXT);
 
         /* Setting NewDat, TxRqst bits */
-        pch_can_bit_set(&priv->regs->if2_mcont,
-                        CAN_IF_MCONT_NEWDAT | CAN_IF_MCONT_TXRQXT);
-
-        pch_can_check_if_busy(&priv->regs->if2_creq, tx_buffer_avail);
+        pch_can_bit_set(&priv->regs->ifregs[1].mcont,
+                        PCH_IF_MCONT_NEWDAT | PCH_IF_MCONT_TXRQXT);
 
-        spin_unlock_irqrestore(&priv->msgif_reg_lock, flags);
+        pch_can_check_if_busy(&priv->regs->ifregs[1].creq, tx_buffer_avail);
 
         return NETDEV_TX_OK;
 }
@@ -1244,27 +1150,20 @@ static int pch_can_suspend(struct pci_dev *pdev, pm_message_t state)
         pch_can_set_int_enables(priv, PCH_CAN_DISABLE);
 
         /* Save Tx buffer enable state */
-        for (i = 0; i < PCH_OBJ_NUM; i++) {
-                if (priv->msg_obj[i] == MSG_OBJ_TX)
-                        pch_can_get_tx_enable(priv, i + 1,
-                                              &(priv->tx_enable[i]));
-        }
+        for (i = PCH_TX_OBJ_START; i <= PCH_TX_OBJ_END; i++)
+                priv->tx_enable[i] = pch_can_get_rxtx_ir(priv, i, PCH_TX_IFREG);
 
         /* Disable all Transmit buffers */
-        pch_can_tx_disable_all(priv);
+        pch_can_set_tx_all(priv, 0);
 
         /* Save Rx buffer enable state */
-        for (i = 0; i < PCH_OBJ_NUM; i++) {
-                if (priv->msg_obj[i] == MSG_OBJ_RX) {
-                        pch_can_get_rx_enable(priv, i + 1,
-                                                &(priv->rx_enable[i]));
-                        pch_can_get_rx_buffer_link(priv, i + 1,
-                                                &(priv->rx_link[i]));
-                }
+        for (i = PCH_RX_OBJ_START; i <= PCH_RX_OBJ_END; i++) {
+                priv->rx_enable[i] = pch_can_get_rxtx_ir(priv, i, PCH_RX_IFREG);
+                pch_can_get_rx_buffer_link(priv, i, &priv->rx_link[i]);
         }
 
         /* Disable all Receive buffers */
-        pch_can_rx_disable_all(priv);
+        pch_can_set_rx_all(priv, 0);
         retval = pci_save_state(pdev);
         if (retval) {
                 dev_err(&pdev->dev, "pci_save_state failed.\n");
@@ -1312,23 +1211,16 @@ static int pch_can_resume(struct pci_dev *pdev)
         pch_can_set_optmode(priv);
 
         /* Enabling the transmit buffer. */
-        for (i = 0; i < PCH_OBJ_NUM; i++) {
-                if (priv->msg_obj[i] == MSG_OBJ_TX) {
-                        pch_can_set_tx_enable(priv, i + 1,
-                                              priv->tx_enable[i]);
-                }
-        }
+        for (i = PCH_TX_OBJ_START; i <= PCH_TX_OBJ_END; i++)
+                pch_can_set_rxtx(priv, i, priv->tx_enable[i], PCH_TX_IFREG);
 
         /* Configuring the receive buffer and enabling them. */
-        for (i = 0; i < PCH_OBJ_NUM; i++) {
-                if (priv->msg_obj[i] == MSG_OBJ_RX) {
-                        /* Restore buffer link */
-                        pch_can_set_rx_buffer_link(priv, i + 1,
-                                                   priv->rx_link[i]);
-
-                        /* Restore buffer enables */
-                        pch_can_set_rx_enable(priv, i + 1, priv->rx_enable[i]);
-                }
+        for (i = PCH_RX_OBJ_START; i <= PCH_RX_OBJ_END; i++) {
+                /* Restore buffer link */
+                pch_can_set_rx_buffer_link(priv, i, priv->rx_link[i]);
+
+                /* Restore buffer enables */
+                pch_can_set_rxtx(priv, i, priv->rx_enable[i], PCH_RX_IFREG);
         }
 
         /* Enable CAN Interrupts */
@@ -1349,8 +1241,8 @@ static int pch_can_get_berr_counter(const struct net_device *dev,
 {
         struct pch_can_priv *priv = netdev_priv(dev);
 
-        bec->txerr = ioread32(&priv->regs->errc) & CAN_TEC;
-        bec->rxerr = (ioread32(&priv->regs->errc) & CAN_REC) >> 8;
+        bec->txerr = ioread32(&priv->regs->errc) & PCH_TEC;
+        bec->rxerr = (ioread32(&priv->regs->errc) & PCH_REC) >> 8;
 
         return 0;
 }
@@ -1361,7 +1253,6 @@ static int __devinit pch_can_probe(struct pci_dev *pdev,
         struct net_device *ndev;
         struct pch_can_priv *priv;
         int rc;
-        int index;
         void __iomem *addr;
 
         rc = pci_enable_device(pdev);
@@ -1383,7 +1274,7 @@ static int __devinit pch_can_probe(struct pci_dev *pdev,
                 goto probe_exit_ipmap;
         }
 
-        ndev = alloc_candev(sizeof(struct pch_can_priv), PCH_TX_OBJ_NUM);
+        ndev = alloc_candev(sizeof(struct pch_can_priv), PCH_TX_OBJ_END);
         if (!ndev) {
                 rc = -ENOMEM;
                 dev_err(&pdev->dev, "Failed alloc_candev\n");
@@ -1399,7 +1290,7 @@ static int __devinit pch_can_probe(struct pci_dev *pdev,
         priv->can.do_get_berr_counter = pch_can_get_berr_counter;
         priv->can.ctrlmode_supported = CAN_CTRLMODE_LISTENONLY |
                                        CAN_CTRLMODE_LOOPBACK;
-        priv->tx_obj = PCH_RX_OBJ_NUM + 1; /* Point head of Tx Obj */
+        priv->tx_obj = PCH_TX_OBJ_START; /* Point head of Tx Obj */
 
         ndev->irq = pdev->irq;
         ndev->flags |= IFF_ECHO;
@@ -1407,15 +1298,9 @@ static int __devinit pch_can_probe(struct pci_dev *pdev,
         pci_set_drvdata(pdev, ndev);
         SET_NETDEV_DEV(ndev, &pdev->dev);
         ndev->netdev_ops = &pch_can_netdev_ops;
-
         priv->can.clock.freq = PCH_CAN_CLK; /* Hz */
-        for (index = 0; index < PCH_RX_OBJ_NUM;)
-                priv->msg_obj[index++] = MSG_OBJ_RX;
-
-        for (index = index;  index < PCH_OBJ_NUM;)
-                priv->msg_obj[index++] = MSG_OBJ_TX;
 
-        netif_napi_add(ndev, &priv->napi, pch_can_rx_poll, PCH_RX_OBJ_NUM);
+        netif_napi_add(ndev, &priv->napi, pch_can_rx_poll, PCH_RX_OBJ_END);
 
         rc = register_candev(ndev);
         if (rc) {
diff --git a/drivers/net/can/sja1000/sja1000_of_platform.c b/drivers/net/can/sja1000/sja1000_of_platform.c
index 5bfccfdf3bb..09c3e9db931 100644
--- a/drivers/net/can/sja1000/sja1000_of_platform.c
+++ b/drivers/net/can/sja1000/sja1000_of_platform.c
@@ -107,17 +107,13 @@ static int __devinit sja1000_ofp_probe(struct platform_device *ofdev,
         res_size = resource_size(&res);
 
         if (!request_mem_region(res.start, res_size, DRV_NAME)) {
-                dev_err(&ofdev->dev, "couldn't request %#llx..%#llx\n",
-                        (unsigned long long)res.start,
-                        (unsigned long long)res.end);
+                dev_err(&ofdev->dev, "couldn't request %pR\n", &res);
                 return -EBUSY;
         }
 
         base = ioremap_nocache(res.start, res_size);
         if (!base) {
-                dev_err(&ofdev->dev, "couldn't ioremap %#llx..%#llx\n",
-                        (unsigned long long)res.start,
-                        (unsigned long long)res.end);
+                dev_err(&ofdev->dev, "couldn't ioremap %pR\n", &res);
                 err = -ENOMEM;
                 goto exit_release_mem;
         }
diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c
new file mode 100644
index 00000000000..420e95ecc19
--- /dev/null
+++ b/drivers/net/can/slcan.c
@@ -0,0 +1,755 @@
+/*
+ * slcan.c - serial line CAN interface driver (using tty line discipline)
+ *
+ * This file is derived from linux/drivers/net/slip.c
+ *
+ * slip.c Authors  : Laurence Culhane <loz@holmes.demon.co.uk>
+ *                   Fred N. van Kempen <waltje@uwalt.nl.mugnet.org>
+ * slcan.c Author  : Oliver Hartkopp <socketcan@hartkopp.net>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 59 Temple Place, Suite 330, Boston, MA 02111-1307. You can also get it
+ * at http://www.gnu.org/licenses/gpl.html
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ *
+ * Send feedback to <socketcan-users@lists.berlios.de>
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+
+#include <asm/system.h>
+#include <linux/uaccess.h>
+#include <linux/bitops.h>
+#include <linux/string.h>
+#include <linux/tty.h>
+#include <linux/errno.h>
+#include <linux/netdevice.h>
+#include <linux/skbuff.h>
+#include <linux/rtnetlink.h>
+#include <linux/if_arp.h>
+#include <linux/if_ether.h>
+#include <linux/delay.h>
+#include <linux/init.h>
+#include <linux/can.h>
+
+static __initdata const char banner[] =
+        KERN_INFO "slcan: serial line CAN interface driver\n";
+
+MODULE_ALIAS_LDISC(N_SLCAN);
+MODULE_DESCRIPTION("serial line CAN interface");
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Oliver Hartkopp <socketcan@hartkopp.net>");
+
+#define SLCAN_MAGIC 0x53CA
+
+static int maxdev = 10;         /* MAX number of SLCAN channels;
+                                   This can be overridden with
+                                   insmod slcan.ko maxdev=nnn   */
+module_param(maxdev, int, 0);
+MODULE_PARM_DESC(maxdev, "Maximum number of slcan interfaces");
+
+/* maximum rx buffer len: extended CAN frame with timestamp */
+#define SLC_MTU (sizeof("T1111222281122334455667788EA5F\r")+1)
+
+struct slcan {
+        int                     magic;
+
+        /* Various fields. */
+        struct tty_struct       *tty;           /* ptr to TTY structure      */
+        struct net_device       *dev;           /* easy for intr handling    */
+        spinlock_t              lock;
+
+        /* These are pointers to the malloc()ed frame buffers. */
+        unsigned char           rbuff[SLC_MTU]; /* receiver buffer           */
+        int                     rcount;         /* received chars counter    */
+        unsigned char           xbuff[SLC_MTU]; /* transmitter buffer        */
+        unsigned char           *xhead;         /* pointer to next XMIT byte */
+        int                     xleft;          /* bytes left in XMIT queue  */
+
+        unsigned long           flags;          /* Flag values/ mode etc     */
+#define SLF_INUSE               0               /* Channel in use            */
+#define SLF_ERROR               1               /* Parity, etc. error        */
+
+        unsigned char           leased;
+        dev_t                   line;
+        pid_t                   pid;
+};
+
+static struct net_device **slcan_devs;
+
+ /************************************************************************
+  *                     SLCAN ENCAPSULATION FORMAT                       *
+  ************************************************************************/
+
+/*
+ * A CAN frame has a can_id (11 bit standard frame format OR 29 bit extended
+ * frame format) a data length code (can_dlc) which can be from 0 to 8
+ * and up to <can_dlc> data bytes as payload.
+ * Additionally a CAN frame may become a remote transmission frame if the
+ * RTR-bit is set. This causes another ECU to send a CAN frame with the
+ * given can_id.
+ *
+ * The SLCAN ASCII representation of these different frame types is:
+ * <type> <id> <dlc> <data>*
+ *
+ * Extended frames (29 bit) are defined by capital characters in the type.
+ * RTR frames are defined as 'r' types - normal frames have 't' type:
+ * t => 11 bit data frame
+ * r => 11 bit RTR frame
+ * T => 29 bit data frame
+ * R => 29 bit RTR frame
+ *
+ * The <id> is 3 (standard) or 8 (extended) bytes in ASCII Hex (base64).
+ * The <dlc> is a one byte ASCII number ('0' - '8')
+ * The <data> section has at much ASCII Hex bytes as defined by the <dlc>
+ *
+ * Examples:
+ *
+ * t1230 : can_id 0x123, can_dlc 0, no data
+ * t4563112233 : can_id 0x456, can_dlc 3, data 0x11 0x22 0x33
+ * T12ABCDEF2AA55 : extended can_id 0x12ABCDEF, can_dlc 2, data 0xAA 0x55
+ * r1230 : can_id 0x123, can_dlc 0, no data, remote transmission request
+ *
+ */
+
+ /************************************************************************
+  *                     STANDARD SLCAN DECAPSULATION                     *
+  ************************************************************************/
+
+static int asc2nibble(char c)
+{
+
+        if ((c >= '0') && (c <= '9'))
+                return c - '0';
+
+        if ((c >= 'A') && (c <= 'F'))
+                return c - 'A' + 10;
+
+        if ((c >= 'a') && (c <= 'f'))
+                return c - 'a' + 10;
+
+        return 16; /* error */
+}
+
+/* Send one completely decapsulated can_frame to the network layer */
+static void slc_bump(struct slcan *sl)
+{
+        struct sk_buff *skb;
+        struct can_frame cf;
+        int i, dlc_pos, tmp;
+        unsigned long ultmp;
+        char cmd = sl->rbuff[0];
+
+        if ((cmd != 't') && (cmd != 'T') && (cmd != 'r') && (cmd != 'R'))
+                return;
+
+        if (cmd & 0x20) /* tiny chars 'r' 't' => standard frame format */
+                dlc_pos = 4; /* dlc position tiiid */
+        else
+                dlc_pos = 9; /* dlc position Tiiiiiiiid */
+
+        if (!((sl->rbuff[dlc_pos] >= '0') && (sl->rbuff[dlc_pos] < '9')))
+                return;
+
+        cf.can_dlc = sl->rbuff[dlc_pos] - '0'; /* get can_dlc from ASCII val */
+
+        sl->rbuff[dlc_pos] = 0; /* terminate can_id string */
+
+        if (strict_strtoul(sl->rbuff+1, 16, &ultmp))
+                return;
+
+        cf.can_id = ultmp;
+
+        if (!(cmd & 0x20)) /* NO tiny chars => extended frame format */
+                cf.can_id |= CAN_EFF_FLAG;
+
+        if ((cmd | 0x20) == 'r') /* RTR frame */
+                cf.can_id |= CAN_RTR_FLAG;
+
+        *(u64 *) (&cf.data) = 0; /* clear payload */
+
+        for (i = 0, dlc_pos++; i < cf.can_dlc; i++) {
+
+                tmp = asc2nibble(sl->rbuff[dlc_pos++]);
+                if (tmp > 0x0F)
+                        return;
+                cf.data[i] = (tmp << 4);
+                tmp = asc2nibble(sl->rbuff[dlc_pos++]);
+                if (tmp > 0x0F)
+                        return;
+                cf.data[i] |= tmp;
+        }
+
+
+        skb = dev_alloc_skb(sizeof(struct can_frame));
+        if (!skb)
+                return;
+
+        skb->dev = sl->dev;
+        skb->protocol = htons(ETH_P_CAN);
+        skb->pkt_type = PACKET_BROADCAST;
+        skb->ip_summed = CHECKSUM_UNNECESSARY;
+        memcpy(skb_put(skb, sizeof(struct can_frame)),
+               &cf, sizeof(struct can_frame));
+        netif_rx(skb);
+
+        sl->dev->stats.rx_packets++;
+        sl->dev->stats.rx_bytes += cf.can_dlc;
+}
+
+/* parse tty input stream */
+static void slcan_unesc(struct slcan *sl, unsigned char s)
+{
+
+        if ((s == '\r') || (s == '\a')) { /* CR or BEL ends the pdu */
+                if (!test_and_clear_bit(SLF_ERROR, &sl->flags) &&
+                    (sl->rcount > 4))  {
+                        slc_bump(sl);
+                }
+                sl->rcount = 0;
+        } else {
+                if (!test_bit(SLF_ERROR, &sl->flags))  {
+                        if (sl->rcount < SLC_MTU)  {
+                                sl->rbuff[sl->rcount++] = s;
+                                return;
+                        } else {
+                                sl->dev->stats.rx_over_errors++;
+                                set_bit(SLF_ERROR, &sl->flags);
+                        }
+                }
+        }
+}
+
+ /************************************************************************
+  *                     STANDARD SLCAN ENCAPSULATION                     *
+  ************************************************************************/
+
+/* Encapsulate one can_frame and stuff into a TTY queue. */
+static void slc_encaps(struct slcan *sl, struct can_frame *cf)
+{
+        int actual, idx, i;
+        char cmd;
+
+        if (cf->can_id & CAN_RTR_FLAG)
+                cmd = 'R'; /* becomes 'r' in standard frame format */
+        else
+                cmd = 'T'; /* becomes 't' in standard frame format */
+
+        if (cf->can_id & CAN_EFF_FLAG)
+                sprintf(sl->xbuff, "%c%08X%d", cmd,
+                        cf->can_id & CAN_EFF_MASK, cf->can_dlc);
+        else
+                sprintf(sl->xbuff, "%c%03X%d", cmd | 0x20,
+                        cf->can_id & CAN_SFF_MASK, cf->can_dlc);
+
+        idx = strlen(sl->xbuff);
+
+        for (i = 0; i < cf->can_dlc; i++)
+                sprintf(&sl->xbuff[idx + 2*i], "%02X", cf->data[i]);
+
+        strcat(sl->xbuff, "\r"); /* add terminating character */
+
+        /* Order of next two lines is *very* important.
+         * When we are sending a little amount of data,
+         * the transfer may be completed inside the ops->write()
+         * routine, because it's running with interrupts enabled.
+         * In this case we *never* got WRITE_WAKEUP event,
+         * if we did not request it before write operation.
+         *       14 Oct 1994  Dmitry Gorodchanin.
+         */
+        set_bit(TTY_DO_WRITE_WAKEUP, &sl->tty->flags);
+        actual = sl->tty->ops->write(sl->tty, sl->xbuff, strlen(sl->xbuff));
+        sl->xleft = strlen(sl->xbuff) - actual;
+        sl->xhead = sl->xbuff + actual;
+        sl->dev->stats.tx_bytes += cf->can_dlc;
+}
+
+/*
+ * Called by the driver when there's room for more data.  If we have
+ * more packets to send, we send them here.
+ */
+static void slcan_write_wakeup(struct tty_struct *tty)
+{
+        int actual;
+        struct slcan *sl = (struct slcan *) tty->disc_data;
+
+        /* First make sure we're connected. */
+        if (!sl || sl->magic != SLCAN_MAGIC || !netif_running(sl->dev))
+                return;
+
+        if (sl->xleft <= 0)  {
+                /* Now serial buffer is almost free & we can start
+                 * transmission of another packet */
+                sl->dev->stats.tx_packets++;
+                clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
+                netif_wake_queue(sl->dev);
+                return;
+        }
+
+        actual = tty->ops->write(tty, sl->xhead, sl->xleft);
+        sl->xleft -= actual;
+        sl->xhead += actual;
+}
+
+/* Send a can_frame to a TTY queue. */
+static netdev_tx_t slc_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+        struct slcan *sl = netdev_priv(dev);
+
+        if (skb->len != sizeof(struct can_frame))
+                goto out;
+
+        spin_lock(&sl->lock);
+        if (!netif_running(dev))  {
+                spin_unlock(&sl->lock);
+                printk(KERN_WARNING "%s: xmit: iface is down\n", dev->name);
+                goto out;
+        }
+        if (sl->tty == NULL) {
+                spin_unlock(&sl->lock);
+                goto out;
+        }
+
+        netif_stop_queue(sl->dev);
+        slc_encaps(sl, (struct can_frame *) skb->data); /* encaps & send */
+        spin_unlock(&sl->lock);
+
+out:
+        kfree_skb(skb);
+        return NETDEV_TX_OK;
+}
+
+
+/******************************************
+ *   Routines looking at netdevice side.
+ ******************************************/
+
+/* Netdevice UP -> DOWN routine */
+static int slc_close(struct net_device *dev)
+{
+        struct slcan *sl = netdev_priv(dev);
+
+        spin_lock_bh(&sl->lock);
+        if (sl->tty) {
+                /* TTY discipline is running. */
+                clear_bit(TTY_DO_WRITE_WAKEUP, &sl->tty->flags);
+        }
+        netif_stop_queue(dev);
+        sl->rcount   = 0;
+        sl->xleft    = 0;
+        spin_unlock_bh(&sl->lock);
+
+        return 0;
+}
+
+/* Netdevice DOWN -> UP routine */
+static int slc_open(struct net_device *dev)
+{
+        struct slcan *sl = netdev_priv(dev);
+
+        if (sl->tty == NULL)
+                return -ENODEV;
+
+        sl->flags &= (1 << SLF_INUSE);
+        netif_start_queue(dev);
+        return 0;
+}
+
+/* Hook the destructor so we can free slcan devs at the right point in time */
+static void slc_free_netdev(struct net_device *dev)
+{
+        int i = dev->base_addr;
+        free_netdev(dev);
+        slcan_devs[i] = NULL;
+}
+
+static const struct net_device_ops slc_netdev_ops = {
+        .ndo_open               = slc_open,
+        .ndo_stop               = slc_close,
+        .ndo_start_xmit         = slc_xmit,
+};
+
+static void slc_setup(struct net_device *dev)
+{
+        dev->netdev_ops         = &slc_netdev_ops;
+        dev->destructor         = slc_free_netdev;
+
+        dev->hard_header_len    = 0;
+        dev->addr_len           = 0;
+        dev->tx_queue_len       = 10;
+
+        dev->mtu                = sizeof(struct can_frame);
+        dev->type               = ARPHRD_CAN;
+
+        /* New-style flags. */
+        dev->flags              = IFF_NOARP;
+        dev->features           = NETIF_F_NO_CSUM;
+}
+
+/******************************************
+  Routines looking at TTY side.
+ ******************************************/
+
+/*
+ * Handle the 'receiver data ready' interrupt.
+ * This function is called by the 'tty_io' module in the kernel when
+ * a block of SLCAN data has been received, which can now be decapsulated
+ * and sent on to some IP layer for further processing. This will not
+ * be re-entered while running but other ldisc functions may be called
+ * in parallel
+ */
+
+static void slcan_receive_buf(struct tty_struct *tty,
+                              const unsigned char *cp, char *fp, int count)
+{
+        struct slcan *sl = (struct slcan *) tty->disc_data;
+
+        if (!sl || sl->magic != SLCAN_MAGIC || !netif_running(sl->dev))
+                return;
+
+        /* Read the characters out of the buffer */
+        while (count--) {
+                if (fp && *fp++) {
+                        if (!test_and_set_bit(SLF_ERROR, &sl->flags))
+                                sl->dev->stats.rx_errors++;
+                        cp++;
+                        continue;
+                }
+                slcan_unesc(sl, *cp++);
+        }
+}
+
+/************************************
+ *  slcan_open helper routines.
+ ************************************/
+
+/* Collect hanged up channels */
+static void slc_sync(void)
+{
+        int i;
+        struct net_device *dev;
+        struct slcan      *sl;
+
+        for (i = 0; i < maxdev; i++) {
+                dev = slcan_devs[i];
+                if (dev == NULL)
+                        break;
+
+                sl = netdev_priv(dev);
+                if (sl->tty || sl->leased)
+                        continue;
+                if (dev->flags & IFF_UP)
+                        dev_close(dev);
+        }
+}
+
+/* Find a free SLCAN channel, and link in this `tty' line. */
+static struct slcan *slc_alloc(dev_t line)
+{
+        int i;
+        struct net_device *dev = NULL;
+        struct slcan       *sl;
+
+        if (slcan_devs == NULL)
+                return NULL;    /* Master array missing ! */
+
+        for (i = 0; i < maxdev; i++) {
+                dev = slcan_devs[i];
+                if (dev == NULL)
+                        break;
+
+        }
+
+        /* Sorry, too many, all slots in use */
+        if (i >= maxdev)
+                return NULL;
+
+        if (dev) {
+                sl = netdev_priv(dev);
+                if (test_bit(SLF_INUSE, &sl->flags)) {
+                        unregister_netdevice(dev);
+                        dev = NULL;
+                        slcan_devs[i] = NULL;
+                }
+        }
+
+        if (!dev) {
+                char name[IFNAMSIZ];
+                sprintf(name, "slcan%d", i);
+
+                dev = alloc_netdev(sizeof(*sl), name, slc_setup);
+                if (!dev)
+                        return NULL;
+                dev->base_addr  = i;
+        }
+
+        sl = netdev_priv(dev);
+
+        /* Initialize channel control data */
+        sl->magic = SLCAN_MAGIC;
+        sl->dev = dev;
+        spin_lock_init(&sl->lock);
+        slcan_devs[i] = dev;
+
+        return sl;
+}
+
+/*
+ * Open the high-level part of the SLCAN channel.
+ * This function is called by the TTY module when the
+ * SLCAN line discipline is called for.  Because we are
+ * sure the tty line exists, we only have to link it to
+ * a free SLCAN channel...
+ *
+ * Called in process context serialized from other ldisc calls.
+ */
+
+static int slcan_open(struct tty_struct *tty)
+{
+        struct slcan *sl;
+        int err;
+
+        if (!capable(CAP_NET_ADMIN))
+                return -EPERM;
+
+        if (tty->ops->write == NULL)
+                return -EOPNOTSUPP;
+
+        /* RTnetlink lock is misused here to serialize concurrent
+           opens of slcan channels. There are better ways, but it is
+           the simplest one.
+         */
+        rtnl_lock();
+
+        /* Collect hanged up channels. */
+        slc_sync();
+
+        sl = tty->disc_data;
+
+        err = -EEXIST;
+        /* First make sure we're not already connected. */
+        if (sl && sl->magic == SLCAN_MAGIC)
+                goto err_exit;
+
+        /* OK.  Find a free SLCAN channel to use. */
+        err = -ENFILE;
+        sl = slc_alloc(tty_devnum(tty));
+        if (sl == NULL)
+                goto err_exit;
+
+        sl->tty = tty;
+        tty->disc_data = sl;
+        sl->line = tty_devnum(tty);
+        sl->pid = current->pid;
+
+        if (!test_bit(SLF_INUSE, &sl->flags)) {
+                /* Perform the low-level SLCAN initialization. */
+                sl->rcount   = 0;
+                sl->xleft    = 0;
+
+                set_bit(SLF_INUSE, &sl->flags);
+
+                err = register_netdevice(sl->dev);
+                if (err)
+                        goto err_free_chan;
+        }
+
+        /* Done.  We have linked the TTY line to a channel. */
+        rtnl_unlock();
+        tty->receive_room = 65536;      /* We don't flow control */
+        return sl->dev->base_addr;
+
+err_free_chan:
+        sl->tty = NULL;
+        tty->disc_data = NULL;
+        clear_bit(SLF_INUSE, &sl->flags);
+
+err_exit:
+        rtnl_unlock();
+
+        /* Count references from TTY module */
+        return err;
+}
+
+/*
+ * Close down a SLCAN channel.
+ * This means flushing out any pending queues, and then returning. This
+ * call is serialized against other ldisc functions.
+ *
+ * We also use this method for a hangup event.
+ */
+
+static void slcan_close(struct tty_struct *tty)
+{
+        struct slcan *sl = (struct slcan *) tty->disc_data;
+
+        /* First make sure we're connected. */
+        if (!sl || sl->magic != SLCAN_MAGIC || sl->tty != tty)
+                return;
+
+        tty->disc_data = NULL;
+        sl->tty = NULL;
+        if (!sl->leased)
+                sl->line = 0;
+
+        /* Flush network side */
+        unregister_netdev(sl->dev);
+        /* This will complete via sl_free_netdev */
+}
+
+static int slcan_hangup(struct tty_struct *tty)
+{
+        slcan_close(tty);
+        return 0;
+}
+
+/* Perform I/O control on an active SLCAN channel. */
+static int slcan_ioctl(struct tty_struct *tty, struct file *file,
+                       unsigned int cmd, unsigned long arg)
+{
+        struct slcan *sl = (struct slcan *) tty->disc_data;
+        unsigned int tmp;
+
+        /* First make sure we're connected. */
+        if (!sl || sl->magic != SLCAN_MAGIC)
+                return -EINVAL;
+
+        switch (cmd) {
+        case SIOCGIFNAME:
+                tmp = strlen(sl->dev->name) + 1;
+                if (copy_to_user((void __user *)arg, sl->dev->name, tmp))
+                        return -EFAULT;
+                return 0;
+
+        case SIOCSIFHWADDR:
+                return -EINVAL;
+
+        default:
+                return tty_mode_ioctl(tty, file, cmd, arg);
+        }
+}
+
+static struct tty_ldisc_ops slc_ldisc = {
+        .owner          = THIS_MODULE,
+        .magic          = TTY_LDISC_MAGIC,
+        .name           = "slcan",
+        .open           = slcan_open,
+        .close          = slcan_close,
+        .hangup         = slcan_hangup,
+        .ioctl          = slcan_ioctl,
+        .receive_buf    = slcan_receive_buf,
+        .write_wakeup   = slcan_write_wakeup,
+};
+
+static int __init slcan_init(void)
+{
+        int status;
+
+        if (maxdev < 4)
+                maxdev = 4; /* Sanity */
+
+        printk(banner);
+        printk(KERN_INFO "slcan: %d dynamic interface channels.\n", maxdev);
+
+        slcan_devs = kzalloc(sizeof(struct net_device *)*maxdev, GFP_KERNEL);
+        if (!slcan_devs) {
+                printk(KERN_ERR "slcan: can't allocate slcan device array!\n");
+                return -ENOMEM;
+        }
+
+        /* Fill in our line protocol discipline, and register it */
+        status = tty_register_ldisc(N_SLCAN, &slc_ldisc);
+        if (status)  {
+                printk(KERN_ERR "slcan: can't register line discipline\n");
+                kfree(slcan_devs);
+        }
+        return status;
+}
+
+static void __exit slcan_exit(void)
+{
+        int i;
+        struct net_device *dev;
+        struct slcan *sl;
+        unsigned long timeout = jiffies + HZ;
+        int busy = 0;
+
+        if (slcan_devs == NULL)
+                return;
+
+        /* First of all: check for active disciplines and hangup them.
+         */
+        do {
+                if (busy)
+                        msleep_interruptible(100);
+
+                busy = 0;
+                for (i = 0; i < maxdev; i++) {
+                        dev = slcan_devs[i];
+                        if (!dev)
+                                continue;
+                        sl = netdev_priv(dev);
+                        spin_lock_bh(&sl->lock);
+                        if (sl->tty) {
+                                busy++;
+                                tty_hangup(sl->tty);
+                        }
+                        spin_unlock_bh(&sl->lock);
+                }
+        } while (busy && time_before(jiffies, timeout));
+
+        /* FIXME: hangup is async so we should wait when doing this second
+           phase */
+
+        for (i = 0; i < maxdev; i++) {
+                dev = slcan_devs[i];
+                if (!dev)
+                        continue;
+                slcan_devs[i] = NULL;
+
+                sl = netdev_priv(dev);
+                if (sl->tty) {
+                        printk(KERN_ERR "%s: tty discipline still running\n",
+                               dev->name);
+                        /* Intentionally leak the control block. */
+                        dev->destructor = NULL;
+                }
+
+                unregister_netdev(dev);
+        }
+
+        kfree(slcan_devs);
+        slcan_devs = NULL;
+
+        i = tty_unregister_ldisc(N_SLCAN);
+        if (i)
+                printk(KERN_ERR "slcan: can't unregister ldisc (err %d)\n", i);
+}
+
+module_init(slcan_init);
+module_exit(slcan_exit);
diff --git a/drivers/net/cnic.c b/drivers/net/cnic.c
index 92bac19ad60..594ca9c2c10 100644
--- a/drivers/net/cnic.c
+++ b/drivers/net/cnic.c
@@ -1695,7 +1695,7 @@ static int cnic_bnx2x_iscsi_ofld1(struct cnic_dev *dev, struct kwqe *wqes[],
                 *work = num;
                 return -EINVAL;
         }
-        *work = 2 + req2->num_additional_wqes;;
+        *work = 2 + req2->num_additional_wqes;
 
         l5_cid = req1->iscsi_conn_id;
         if (l5_cid >= MAX_ISCSI_TBL_SZ)
diff --git a/drivers/net/cris/eth_v10.c b/drivers/net/cris/eth_v10.c
index 81475cc80e1..80c2feeefec 100644
--- a/drivers/net/cris/eth_v10.c
+++ b/drivers/net/cris/eth_v10.c
@@ -59,7 +59,6 @@ static struct sockaddr default_mac = {
 
 /* Information that need to be kept for each board. */
 struct net_local {
-        struct net_device_stats stats;
         struct mii_if_info mii_if;
 
         /* Tx control lock.  This protects the transmit buffer ring
@@ -1059,7 +1058,7 @@ e100_tx_timeout(struct net_device *dev)
 
         /* remember we got an error */
 
-        np->stats.tx_errors++;
+        dev->stats.tx_errors++;
 
         /* reset the TX DMA in case it has hung on something */
 
@@ -1157,7 +1156,7 @@ e100rxtx_interrupt(int irq, void *dev_id)
                          * allocate a new buffer to put a packet in.
                          */
                         e100_rx(dev);
-                        np->stats.rx_packets++;
+                        dev->stats.rx_packets++;
                         /* restart/continue on the channel, for safety */
                         *R_DMA_CH1_CMD = IO_STATE(R_DMA_CH1_CMD, cmd, restart);
                         /* clear dma channel 1 eop/descr irq bits */
@@ -1173,8 +1172,8 @@ e100rxtx_interrupt(int irq, void *dev_id)
         /* Report any packets that have been sent */
         while (virt_to_phys(myFirstTxDesc) != *R_DMA_CH0_FIRST &&
                (netif_queue_stopped(dev) || myFirstTxDesc != myNextTxDesc)) {
-                np->stats.tx_bytes += myFirstTxDesc->skb->len;
-                np->stats.tx_packets++;
+                dev->stats.tx_bytes += myFirstTxDesc->skb->len;
+                dev->stats.tx_packets++;
 
                 /* dma is ready with the transmission of the data in tx_skb, so now
                    we can release the skb memory */
@@ -1197,7 +1196,6 @@ static irqreturn_t
 e100nw_interrupt(int irq, void *dev_id)
 {
         struct net_device *dev = (struct net_device *)dev_id;
-        struct net_local *np = netdev_priv(dev);
         unsigned long irqbits = *R_IRQ_MASK0_RD;
 
         /* check for underrun irq */
@@ -1205,13 +1203,13 @@ e100nw_interrupt(int irq, void *dev_id)
                 SETS(network_tr_ctrl_shadow, R_NETWORK_TR_CTRL, clr_error, clr);
                 *R_NETWORK_TR_CTRL = network_tr_ctrl_shadow;
                 SETS(network_tr_ctrl_shadow, R_NETWORK_TR_CTRL, clr_error, nop);
-                np->stats.tx_errors++;
+                dev->stats.tx_errors++;
                 D(printk("ethernet receiver underrun!\n"));
         }
 
         /* check for overrun irq */
         if (irqbits & IO_STATE(R_IRQ_MASK0_RD, overrun, active)) {
-                update_rx_stats(&np->stats); /* this will ack the irq */
+                update_rx_stats(&dev->stats); /* this will ack the irq */
                 D(printk("ethernet receiver overrun!\n"));
         }
         /* check for excessive collision irq */
@@ -1219,7 +1217,7 @@ e100nw_interrupt(int irq, void *dev_id)
                 SETS(network_tr_ctrl_shadow, R_NETWORK_TR_CTRL, clr_error, clr);
                 *R_NETWORK_TR_CTRL = network_tr_ctrl_shadow;
                 SETS(network_tr_ctrl_shadow, R_NETWORK_TR_CTRL, clr_error, nop);
-                np->stats.tx_errors++;
+                dev->stats.tx_errors++;
                 D(printk("ethernet excessive collisions!\n"));
         }
         return IRQ_HANDLED;
@@ -1250,7 +1248,7 @@ e100_rx(struct net_device *dev)
         spin_unlock(&np->led_lock);
 
         length = myNextRxDesc->descr.hw_len - 4;
-        np->stats.rx_bytes += length;
+        dev->stats.rx_bytes += length;
 
 #ifdef ETHDEBUG
         printk("Got a packet of length %d:\n", length);
@@ -1268,7 +1266,7 @@ e100_rx(struct net_device *dev)
                 /* Small packet, copy data */
                 skb = dev_alloc_skb(length - ETHER_HEAD_LEN);
                 if (!skb) {
-                        np->stats.rx_errors++;
+                        dev->stats.rx_errors++;
                         printk(KERN_NOTICE "%s: Memory squeeze, dropping packet.\n", dev->name);
                         goto update_nextrxdesc;
                 }
@@ -1294,7 +1292,7 @@ e100_rx(struct net_device *dev)
                 int align;
                 struct sk_buff *new_skb = dev_alloc_skb(MAX_MEDIA_DATA_SIZE + 2 * L1_CACHE_BYTES);
                 if (!new_skb) {
-                        np->stats.rx_errors++;
+                        dev->stats.rx_errors++;
                         printk(KERN_NOTICE "%s: Memory squeeze, dropping packet.\n", dev->name);
                         goto update_nextrxdesc;
                 }
@@ -1333,8 +1331,6 @@ e100_rx(struct net_device *dev)
 static int
 e100_close(struct net_device *dev)
 {
-        struct net_local *np = netdev_priv(dev);
-
         printk(KERN_INFO "Closing %s.\n", dev->name);
 
         netif_stop_queue(dev);
@@ -1366,8 +1362,8 @@ e100_close(struct net_device *dev)
 
         /* Update the statistics here. */
 
-        update_rx_stats(&np->stats);
-        update_tx_stats(&np->stats);
+        update_rx_stats(&dev->stats);
+        update_tx_stats(&dev->stats);
 
         /* Stop speed/duplex timers */
         del_timer(&speed_timer);
@@ -1545,11 +1541,11 @@ e100_get_stats(struct net_device *dev)
 
         spin_lock_irqsave(&lp->lock, flags);
 
-        update_rx_stats(&lp->stats);
-        update_tx_stats(&lp->stats);
+        update_rx_stats(&dev->stats);
+        update_tx_stats(&dev->stats);
 
         spin_unlock_irqrestore(&lp->lock, flags);
-        return &lp->stats;
+        return &dev->stats;
 }
 
 /*
diff --git a/drivers/net/cxgb3/cxgb3_main.c b/drivers/net/cxgb3/cxgb3_main.c
index 046d846c652..386461750d0 100644
--- a/drivers/net/cxgb3/cxgb3_main.c
+++ b/drivers/net/cxgb3/cxgb3_main.c
@@ -3006,12 +3006,11 @@ static pci_ers_result_t t3_io_error_detected(struct pci_dev *pdev,
                                              pci_channel_state_t state)
 {
         struct adapter *adapter = pci_get_drvdata(pdev);
-        int ret;
 
         if (state == pci_channel_io_perm_failure)
                 return PCI_ERS_RESULT_DISCONNECT;
 
-        ret = t3_adapter_error(adapter, 0, 0);
+        t3_adapter_error(adapter, 0, 0);
 
         /* Request a slot reset. */
         return PCI_ERS_RESULT_NEED_RESET;
diff --git a/drivers/net/cxgb3/cxgb3_offload.c b/drivers/net/cxgb3/cxgb3_offload.c
index bcf07532953..ef02aa68c92 100644
--- a/drivers/net/cxgb3/cxgb3_offload.c
+++ b/drivers/net/cxgb3/cxgb3_offload.c
@@ -1164,12 +1164,10 @@ static void cxgb_redirect(struct dst_entry *old, struct dst_entry *new)
  */
 void *cxgb_alloc_mem(unsigned long size)
 {
-        void *p = kmalloc(size, GFP_KERNEL);
+        void *p = kzalloc(size, GFP_KERNEL);
 
         if (!p)
-                p = vmalloc(size);
-        if (p)
-                memset(p, 0, size);
+                p = vzalloc(size);
         return p;
 }
 
diff --git a/drivers/net/cxgb4/cxgb4_main.c b/drivers/net/cxgb4/cxgb4_main.c
index f50bc98310f..848f89d19fb 100644
--- a/drivers/net/cxgb4/cxgb4_main.c
+++ b/drivers/net/cxgb4/cxgb4_main.c
@@ -868,12 +868,10 @@ out:	release_firmware(fw);
  */
 void *t4_alloc_mem(size_t size)
 {
-        void *p = kmalloc(size, GFP_KERNEL);
+        void *p = kzalloc(size, GFP_KERNEL);
 
         if (!p)
-                p = vmalloc(size);
-        if (p)
-                memset(p, 0, size);
+                p = vzalloc(size);
         return p;
 }
 
diff --git a/drivers/net/cxgb4vf/adapter.h b/drivers/net/cxgb4vf/adapter.h
index 8ea01962e04..4766b4116b4 100644
--- a/drivers/net/cxgb4vf/adapter.h
+++ b/drivers/net/cxgb4vf/adapter.h
@@ -60,7 +60,7 @@ enum {
          * MSI-X interrupt index usage.
          */
         MSIX_FW         = 0,            /* MSI-X index for firmware Q */
-        MSIX_NIQFLINT   = 1,            /* MSI-X index base for Ingress Qs */
+        MSIX_IQFLINT    = 1,            /* MSI-X index base for Ingress Qs */
         MSIX_EXTRAS     = 1,
         MSIX_ENTRIES    = MAX_ETH_QSETS + MSIX_EXTRAS,
 
diff --git a/drivers/net/cxgb4vf/cxgb4vf_main.c b/drivers/net/cxgb4vf/cxgb4vf_main.c
index d887a76cd39..f54af48edb9 100644
--- a/drivers/net/cxgb4vf/cxgb4vf_main.c
+++ b/drivers/net/cxgb4vf/cxgb4vf_main.c
@@ -280,9 +280,7 @@ static void name_msix_vecs(struct adapter *adapter)
                 const struct port_info *pi = netdev_priv(dev);
                 int qs, msi;
 
-                for (qs = 0, msi = MSIX_NIQFLINT;
-                     qs < pi->nqsets;
-                     qs++, msi++) {
+                for (qs = 0, msi = MSIX_IQFLINT; qs < pi->nqsets; qs++, msi++) {
                         snprintf(adapter->msix_info[msi].desc, namelen,
                                  "%s-%d", dev->name, qs);
                         adapter->msix_info[msi].desc[namelen] = 0;
@@ -309,7 +307,7 @@ static int request_msix_queue_irqs(struct adapter *adapter)
         /*
          * Ethernet queues.
          */
-        msi = MSIX_NIQFLINT;
+        msi = MSIX_IQFLINT;
         for_each_ethrxq(s, rxq) {
                 err = request_irq(adapter->msix_info[msi].vec,
                                   t4vf_sge_intr_msix, 0,
@@ -337,7 +335,7 @@ static void free_msix_queue_irqs(struct adapter *adapter)
         int rxq, msi;
 
         free_irq(adapter->msix_info[MSIX_FW].vec, &s->fw_evtq);
-        msi = MSIX_NIQFLINT;
+        msi = MSIX_IQFLINT;
         for_each_ethrxq(s, rxq)
                 free_irq(adapter->msix_info[msi++].vec,
                          &s->ethrxq[rxq].rspq);
@@ -527,7 +525,7 @@ static int setup_sge_queues(struct adapter *adapter)
          * brought up at which point lots of things get nailed down
          * permanently ...
          */
-        msix = MSIX_NIQFLINT;
+        msix = MSIX_IQFLINT;
         for_each_port(adapter, pidx) {
                 struct net_device *dev = adapter->port[pidx];
                 struct port_info *pi = netdev_priv(dev);
@@ -1365,6 +1363,8 @@ struct queue_port_stats {
         u64 rx_csum;
         u64 vlan_ex;
         u64 vlan_ins;
+        u64 lro_pkts;
+        u64 lro_merged;
 };
 
 /*
@@ -1402,6 +1402,8 @@ static const char stats_strings[][ETH_GSTRING_LEN] = {
         "RxCsumGood        ",
         "VLANextractions   ",
         "VLANinsertions    ",
+        "GROPackets        ",
+        "GROMerged         ",
 };
 
 /*
@@ -1451,6 +1453,8 @@ static void collect_sge_port_stats(const struct adapter *adapter,
                 stats->rx_csum += rxq->stats.rx_cso;
                 stats->vlan_ex += rxq->stats.vlan_ex;
                 stats->vlan_ins += txq->vlan_ins;
+                stats->lro_pkts += rxq->stats.lro_pkts;
+                stats->lro_merged += rxq->stats.lro_merged;
         }
 }
 
@@ -1547,14 +1551,19 @@ static void cxgb4vf_get_wol(struct net_device *dev,
 }
 
 /*
+ * TCP Segmentation Offload flags which we support.
+ */
+#define TSO_FLAGS (NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_TSO_ECN)
+
+/*
  * Set TCP Segmentation Offloading feature capabilities.
  */
 static int cxgb4vf_set_tso(struct net_device *dev, u32 tso)
 {
         if (tso)
-                dev->features |= NETIF_F_TSO | NETIF_F_TSO6;
+                dev->features |= TSO_FLAGS;
         else
-                dev->features &= ~(NETIF_F_TSO | NETIF_F_TSO6);
+                dev->features &= ~TSO_FLAGS;
         return 0;
 }
 
@@ -2045,7 +2054,7 @@ static int __devinit setup_debugfs(struct adapter *adapter)
  * Tear down the /sys/kernel/debug/cxgb4vf sub-nodes created above.  We leave
  * it to our caller to tear down the directory (debugfs_root).
  */
-static void __devexit cleanup_debugfs(struct adapter *adapter)
+static void cleanup_debugfs(struct adapter *adapter)
 {
         BUG_ON(adapter->debugfs_root == NULL);
 
@@ -2063,7 +2072,7 @@ static void __devexit cleanup_debugfs(struct adapter *adapter)
  * adapter parameters we're going to be using and initialize basic adapter
  * hardware support.
  */
-static int adap_init0(struct adapter *adapter)
+static int __devinit adap_init0(struct adapter *adapter)
 {
         struct vf_resources *vfres = &adapter->params.vfres;
         struct sge_params *sge_params = &adapter->params.sge;
@@ -2487,7 +2496,6 @@ static int __devinit cxgb4vf_pci_probe(struct pci_dev *pdev,
                 version_printed = 1;
         }
 
-
         /*
          * Initialize generic PCI device state.
          */
@@ -2624,7 +2632,7 @@ static int __devinit cxgb4vf_pci_probe(struct pci_dev *pdev,
                 netif_carrier_off(netdev);
                 netdev->irq = pdev->irq;
 
-                netdev->features = (NETIF_F_SG | NETIF_F_TSO | NETIF_F_TSO6 |
+                netdev->features = (NETIF_F_SG | TSO_FLAGS |
                                     NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
                                     NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX |
                                     NETIF_F_GRO);
diff --git a/drivers/net/cxgb4vf/sge.c b/drivers/net/cxgb4vf/sge.c
index ecf0770bf0f..e0b3d1bc2fd 100644
--- a/drivers/net/cxgb4vf/sge.c
+++ b/drivers/net/cxgb4vf/sge.c
@@ -1568,6 +1568,9 @@ int t4vf_ethrx_handler(struct sge_rspq *rspq, const __be64 *rsp,
         } else
                 skb_checksum_none_assert(skb);
 
+        /*
+         * Deliver the packet to the stack.
+         */
         if (unlikely(pkt->vlan_ex)) {
                 struct vlan_group *grp = pi->vlan_grp;
 
@@ -2143,7 +2146,7 @@ int t4vf_sge_alloc_rxq(struct adapter *adapter, struct sge_rspq *rspq,
 
                 /*
                  * Calculate the size of the hardware free list ring plus
-                 * status page (which the SGE will place at the end of the
+                 * Status Page (which the SGE will place after the end of the
                  * free list ring) in Egress Queue Units.
                  */
                 flsz = (fl->size / FL_PER_EQ_UNIT +
@@ -2240,8 +2243,8 @@ int t4vf_sge_alloc_eth_txq(struct adapter *adapter, struct sge_eth_txq *txq,
         struct port_info *pi = netdev_priv(dev);
 
         /*
-         * Calculate the size of the hardware TX Queue (including the
-         * status age on the end) in units of TX Descriptors.
+         * Calculate the size of the hardware TX Queue (including the Status
+         * Page on the end of the TX Queue) in units of TX Descriptors.
          */
         nentries = txq->q.size + STAT_LEN / sizeof(struct tx_desc);
 
diff --git a/drivers/net/cxgb4vf/t4vf_hw.c b/drivers/net/cxgb4vf/t4vf_hw.c
index 19520afe1a1..35fc803a6a0 100644
--- a/drivers/net/cxgb4vf/t4vf_hw.c
+++ b/drivers/net/cxgb4vf/t4vf_hw.c
@@ -1300,7 +1300,7 @@ int t4vf_eth_eq_free(struct adapter *adapter, unsigned int eqid)
  */
 int t4vf_handle_fw_rpl(struct adapter *adapter, const __be64 *rpl)
 {
-        struct fw_cmd_hdr *cmd_hdr = (struct fw_cmd_hdr *)rpl;
+        const struct fw_cmd_hdr *cmd_hdr = (const struct fw_cmd_hdr *)rpl;
         u8 opcode = FW_CMD_OP_GET(be32_to_cpu(cmd_hdr->hi));
 
         switch (opcode) {
@@ -1308,7 +1308,8 @@ int t4vf_handle_fw_rpl(struct adapter *adapter, const __be64 *rpl)
                 /*
                  * Link/module state change message.
                  */
-                const struct fw_port_cmd *port_cmd = (void *)rpl;
+                const struct fw_port_cmd *port_cmd =
+                        (const struct fw_port_cmd *)rpl;
                 u32 word;
                 int action, port_id, link_ok, speed, fc, pidx;
 
diff --git a/drivers/net/dm9000.c b/drivers/net/dm9000.c
index 9f6aeefa06b..2d4c4fc1d90 100644
--- a/drivers/net/dm9000.c
+++ b/drivers/net/dm9000.c
@@ -1675,7 +1675,7 @@ dm9000_drv_remove(struct platform_device *pdev)
         platform_set_drvdata(pdev, NULL);
 
         unregister_netdev(ndev);
-        dm9000_release_board(pdev, (board_info_t *) netdev_priv(ndev));
+        dm9000_release_board(pdev, netdev_priv(ndev));
         free_netdev(ndev);              /* free device structure */
 
         dev_dbg(&pdev->dev, "released and freed device\n");
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 4d62f7bfa03..06c7d1c6751 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -1429,13 +1429,12 @@ static int e1000_setup_tx_resources(struct e1000_adapter *adapter,
         int size;
 
         size = sizeof(struct e1000_buffer) * txdr->count;
-        txdr->buffer_info = vmalloc(size);
+        txdr->buffer_info = vzalloc(size);
         if (!txdr->buffer_info) {
                 e_err(probe, "Unable to allocate memory for the Tx descriptor "
                       "ring\n");
                 return -ENOMEM;
         }
-        memset(txdr->buffer_info, 0, size);
 
         /* round up to nearest 4K */
 
@@ -1625,13 +1624,12 @@ static int e1000_setup_rx_resources(struct e1000_adapter *adapter,
         int size, desc_len;
 
         size = sizeof(struct e1000_buffer) * rxdr->count;
-        rxdr->buffer_info = vmalloc(size);
+        rxdr->buffer_info = vzalloc(size);
         if (!rxdr->buffer_info) {
                 e_err(probe, "Unable to allocate memory for the Rx descriptor "
                       "ring\n");
                 return -ENOMEM;
         }
-        memset(rxdr->buffer_info, 0, size);
 
         desc_len = sizeof(struct e1000_rx_desc);
 
diff --git a/drivers/net/e1000e/82571.c b/drivers/net/e1000e/82571.c
index 7236f1a53ba..9333921010c 100644
--- a/drivers/net/e1000e/82571.c
+++ b/drivers/net/e1000e/82571.c
@@ -74,6 +74,9 @@ static bool e1000_check_mng_mode_82574(struct e1000_hw *hw);
 static s32 e1000_led_on_82574(struct e1000_hw *hw);
 static void e1000_put_hw_semaphore_82571(struct e1000_hw *hw);
 static void e1000_power_down_phy_copper_82571(struct e1000_hw *hw);
+static void e1000_put_hw_semaphore_82573(struct e1000_hw *hw);
+static s32 e1000_get_hw_semaphore_82574(struct e1000_hw *hw);
+static void e1000_put_hw_semaphore_82574(struct e1000_hw *hw);
 
 /**
  *  e1000_init_phy_params_82571 - Init PHY func ptrs.
@@ -107,6 +110,8 @@ static s32 e1000_init_phy_params_82571(struct e1000_hw *hw)
         case e1000_82574:
         case e1000_82583:
                 phy->type                = e1000_phy_bm;
+                phy->ops.acquire = e1000_get_hw_semaphore_82574;
+                phy->ops.release = e1000_put_hw_semaphore_82574;
                 break;
         default:
                 return -E1000_ERR_PHY;
@@ -200,6 +205,17 @@ static s32 e1000_init_nvm_params_82571(struct e1000_hw *hw)
                 break;
         }
 
+        /* Function Pointers */
+        switch (hw->mac.type) {
+        case e1000_82574:
+        case e1000_82583:
+                nvm->ops.acquire = e1000_get_hw_semaphore_82574;
+                nvm->ops.release = e1000_put_hw_semaphore_82574;
+                break;
+        default:
+                break;
+        }
+
         return 0;
 }
 
@@ -542,6 +558,94 @@ static void e1000_put_hw_semaphore_82571(struct e1000_hw *hw)
         swsm &= ~(E1000_SWSM_SMBI | E1000_SWSM_SWESMBI);
         ew32(SWSM, swsm);
 }
+/**
+ *  e1000_get_hw_semaphore_82573 - Acquire hardware semaphore
+ *  @hw: pointer to the HW structure
+ *
+ *  Acquire the HW semaphore during reset.
+ *
+ **/
+static s32 e1000_get_hw_semaphore_82573(struct e1000_hw *hw)
+{
+        u32 extcnf_ctrl;
+        s32 ret_val = 0;
+        s32 i = 0;
+
+        extcnf_ctrl = er32(EXTCNF_CTRL);
+        extcnf_ctrl |= E1000_EXTCNF_CTRL_MDIO_SW_OWNERSHIP;
+        do {
+                ew32(EXTCNF_CTRL, extcnf_ctrl);
+                extcnf_ctrl = er32(EXTCNF_CTRL);
+
+                if (extcnf_ctrl & E1000_EXTCNF_CTRL_MDIO_SW_OWNERSHIP)
+                        break;
+
+                extcnf_ctrl |= E1000_EXTCNF_CTRL_MDIO_SW_OWNERSHIP;
+
+                msleep(2);
+                i++;
+        } while (i < MDIO_OWNERSHIP_TIMEOUT);
+
+        if (i == MDIO_OWNERSHIP_TIMEOUT) {
+                /* Release semaphores */
+                e1000_put_hw_semaphore_82573(hw);
+                e_dbg("Driver can't access the PHY\n");
+                ret_val = -E1000_ERR_PHY;
+                goto out;
+        }
+
+out:
+        return ret_val;
+}
+
+/**
+ *  e1000_put_hw_semaphore_82573 - Release hardware semaphore
+ *  @hw: pointer to the HW structure
+ *
+ *  Release hardware semaphore used during reset.
+ *
+ **/
+static void e1000_put_hw_semaphore_82573(struct e1000_hw *hw)
+{
+        u32 extcnf_ctrl;
+
+        extcnf_ctrl = er32(EXTCNF_CTRL);
+        extcnf_ctrl &= ~E1000_EXTCNF_CTRL_MDIO_SW_OWNERSHIP;
+        ew32(EXTCNF_CTRL, extcnf_ctrl);
+}
+
+static DEFINE_MUTEX(swflag_mutex);
+
+/**
+ *  e1000_get_hw_semaphore_82574 - Acquire hardware semaphore
+ *  @hw: pointer to the HW structure
+ *
+ *  Acquire the HW semaphore to access the PHY or NVM.
+ *
+ **/
+static s32 e1000_get_hw_semaphore_82574(struct e1000_hw *hw)
+{
+        s32 ret_val;
+
+        mutex_lock(&swflag_mutex);
+        ret_val = e1000_get_hw_semaphore_82573(hw);
+        if (ret_val)
+                mutex_unlock(&swflag_mutex);
+        return ret_val;
+}
+
+/**
+ *  e1000_put_hw_semaphore_82574 - Release hardware semaphore
+ *  @hw: pointer to the HW structure
+ *
+ *  Release hardware semaphore used to access the PHY or NVM
+ *
+ **/
+static void e1000_put_hw_semaphore_82574(struct e1000_hw *hw)
+{
+        e1000_put_hw_semaphore_82573(hw);
+        mutex_unlock(&swflag_mutex);
+}
 
 /**
  *  e1000_acquire_nvm_82571 - Request for access to the EEPROM
@@ -562,8 +666,6 @@ static s32 e1000_acquire_nvm_82571(struct e1000_hw *hw)
 
         switch (hw->mac.type) {
         case e1000_82573:
-        case e1000_82574:
-        case e1000_82583:
                 break;
         default:
                 ret_val = e1000e_acquire_nvm(hw);
@@ -853,9 +955,8 @@ static s32 e1000_set_d0_lplu_state_82571(struct e1000_hw *hw, bool active)
  **/
 static s32 e1000_reset_hw_82571(struct e1000_hw *hw)
 {
-        u32 ctrl, extcnf_ctrl, ctrl_ext, icr;
+        u32 ctrl, ctrl_ext, icr;
         s32 ret_val;
-        u16 i = 0;
 
         /*
          * Prevent the PCI-E bus from sticking if there is no TLP connection
@@ -880,33 +981,33 @@ static s32 e1000_reset_hw_82571(struct e1000_hw *hw)
          */
         switch (hw->mac.type) {
         case e1000_82573:
+                ret_val = e1000_get_hw_semaphore_82573(hw);
+                break;
         case e1000_82574:
         case e1000_82583:
-                extcnf_ctrl = er32(EXTCNF_CTRL);
-                extcnf_ctrl |= E1000_EXTCNF_CTRL_MDIO_SW_OWNERSHIP;
-
-                do {
-                        ew32(EXTCNF_CTRL, extcnf_ctrl);
-                        extcnf_ctrl = er32(EXTCNF_CTRL);
-
-                        if (extcnf_ctrl & E1000_EXTCNF_CTRL_MDIO_SW_OWNERSHIP)
-                                break;
-
-                        extcnf_ctrl |= E1000_EXTCNF_CTRL_MDIO_SW_OWNERSHIP;
-
-                        msleep(2);
-                        i++;
-                } while (i < MDIO_OWNERSHIP_TIMEOUT);
+                ret_val = e1000_get_hw_semaphore_82574(hw);
                 break;
         default:
                 break;
         }
+        if (ret_val)
+                e_dbg("Cannot acquire MDIO ownership\n");
 
         ctrl = er32(CTRL);
 
         e_dbg("Issuing a global reset to MAC\n");
         ew32(CTRL, ctrl | E1000_CTRL_RST);
 
+        /* Must release MDIO ownership and mutex after MAC reset. */
+        switch (hw->mac.type) {
+        case e1000_82574:
+        case e1000_82583:
+                e1000_put_hw_semaphore_82574(hw);
+                break;
+        default:
+                break;
+        }
+
         if (hw->nvm.type == e1000_nvm_flash_hw) {
                 udelay(10);
                 ctrl_ext = er32(CTRL_EXT);
@@ -1431,8 +1532,10 @@ static s32 e1000_check_for_serdes_link_82571(struct e1000_hw *hw)
                          * auto-negotiation in the TXCW register and disable
                          * forced link in the Device Control register in an
                          * attempt to auto-negotiate with our link partner.
+                         * If the partner code word is null, stop forcing
+                         * and restart auto negotiation.
                          */
-                        if (rxcw & E1000_RXCW_C) {
+                        if ((rxcw & E1000_RXCW_C) || !(rxcw & E1000_RXCW_CW))  {
                                 /* Enable autoneg, and unforce link up */
                                 ew32(TXCW, mac->txcw);
                                 ew32(CTRL, (ctrl & ~E1000_CTRL_SLU));
diff --git a/drivers/net/e1000e/defines.h b/drivers/net/e1000e/defines.h
index d3f7a9c3f97..016ea383145 100644
--- a/drivers/net/e1000e/defines.h
+++ b/drivers/net/e1000e/defines.h
@@ -516,6 +516,7 @@
 #define E1000_TXCW_ANE        0x80000000        /* Auto-neg enable */
 
 /* Receive Configuration Word */
+#define E1000_RXCW_CW         0x0000ffff        /* RxConfigWord mask */
 #define E1000_RXCW_IV         0x08000000        /* Receive config invalid */
 #define E1000_RXCW_C          0x20000000        /* Receive config */
 #define E1000_RXCW_SYNCH      0x40000000        /* Receive config synch */
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index c4ca1629f53..0adcb79e638 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -2059,10 +2059,9 @@ int e1000e_setup_tx_resources(struct e1000_adapter *adapter)
         int err = -ENOMEM, size;
 
         size = sizeof(struct e1000_buffer) * tx_ring->count;
-        tx_ring->buffer_info = vmalloc(size);
+        tx_ring->buffer_info = vzalloc(size);
         if (!tx_ring->buffer_info)
                 goto err;
-        memset(tx_ring->buffer_info, 0, size);
 
         /* round up to nearest 4K */
         tx_ring->size = tx_ring->count * sizeof(struct e1000_tx_desc);
@@ -2095,10 +2094,9 @@ int e1000e_setup_rx_resources(struct e1000_adapter *adapter)
         int i, size, desc_len, err = -ENOMEM;
 
         size = sizeof(struct e1000_buffer) * rx_ring->count;
-        rx_ring->buffer_info = vmalloc(size);
+        rx_ring->buffer_info = vzalloc(size);
         if (!rx_ring->buffer_info)
                 goto err;
-        memset(rx_ring->buffer_info, 0, size);
 
         for (i = 0; i < rx_ring->count; i++) {
                 buffer_info = &rx_ring->buffer_info[i];
@@ -4595,7 +4593,7 @@ dma_error:
                         i += tx_ring->count;
                 i--;
                 buffer_info = &tx_ring->buffer_info[i];
-                e1000_put_txbuf(adapter, buffer_info);;
+                e1000_put_txbuf(adapter, buffer_info);
         }
 
         return 0;
@@ -5465,6 +5463,36 @@ static void e1000_shutdown(struct pci_dev *pdev)
 }
 
 #ifdef CONFIG_NET_POLL_CONTROLLER
+
+static irqreturn_t e1000_intr_msix(int irq, void *data)
+{
+        struct net_device *netdev = data;
+        struct e1000_adapter *adapter = netdev_priv(netdev);
+        int vector, msix_irq;
+
+        if (adapter->msix_entries) {
+                vector = 0;
+                msix_irq = adapter->msix_entries[vector].vector;
+                disable_irq(msix_irq);
+                e1000_intr_msix_rx(msix_irq, netdev);
+                enable_irq(msix_irq);
+
+                vector++;
+                msix_irq = adapter->msix_entries[vector].vector;
+                disable_irq(msix_irq);
+                e1000_intr_msix_tx(msix_irq, netdev);
+                enable_irq(msix_irq);
+
+                vector++;
+                msix_irq = adapter->msix_entries[vector].vector;
+                disable_irq(msix_irq);
+                e1000_msix_other(msix_irq, netdev);
+                enable_irq(msix_irq);
+        }
+
+        return IRQ_HANDLED;
+}
+
 /*
  * Polling 'interrupt' - used by things like netconsole to send skbs
  * without having to re-enable interrupts. It's not called while
@@ -5474,10 +5502,21 @@ static void e1000_netpoll(struct net_device *netdev)
 {
         struct e1000_adapter *adapter = netdev_priv(netdev);
 
-        disable_irq(adapter->pdev->irq);
-        e1000_intr(adapter->pdev->irq, netdev);
-
-        enable_irq(adapter->pdev->irq);
+        switch (adapter->int_mode) {
+        case E1000E_INT_MODE_MSIX:
+                e1000_intr_msix(adapter->pdev->irq, netdev);
+                break;
+        case E1000E_INT_MODE_MSI:
+                disable_irq(adapter->pdev->irq);
+                e1000_intr_msi(adapter->pdev->irq, netdev);
+                enable_irq(adapter->pdev->irq);
+                break;
+        default: /* E1000E_INT_MODE_LEGACY */
+                disable_irq(adapter->pdev->irq);
+                e1000_intr(adapter->pdev->irq, netdev);
+                enable_irq(adapter->pdev->irq);
+                break;
+        }
 }
 #endif
 
diff --git a/drivers/net/eepro.c b/drivers/net/eepro.c
index 7c826319ee5..9e19fbc2f17 100644
--- a/drivers/net/eepro.c
+++ b/drivers/net/eepro.c
@@ -302,7 +302,7 @@ struct eepro_local {
 #define ee_id_eepro10p0 0x10   /* ID for eepro/10+ */
 #define ee_id_eepro10p1 0x31
 
-#define TX_TIMEOUT 40
+#define TX_TIMEOUT ((4*HZ)/10)
 
 /* Index to functions, as function prototypes. */
 
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index b95f087cd5a..69f61523fcc 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -1506,12 +1506,10 @@ static int ehea_init_q_skba(struct ehea_q_skb_arr *q_skba, int max_q_entries)
 {
         int arr_size = sizeof(void *) * max_q_entries;
 
-        q_skba->arr = vmalloc(arr_size);
+        q_skba->arr = vzalloc(arr_size);
         if (!q_skba->arr)
                 return -ENOMEM;
 
-        memset(q_skba->arr, 0, arr_size);
-
         q_skba->len = max_q_entries;
         q_skba->index = 0;
         q_skba->os_skbs = 0;
diff --git a/drivers/net/enic/enic.h b/drivers/net/enic/enic.h
index c91d364c552..70672541364 100644
--- a/drivers/net/enic/enic.h
+++ b/drivers/net/enic/enic.h
@@ -32,7 +32,7 @@
 
 #define DRV_NAME                "enic"
 #define DRV_DESCRIPTION         "Cisco VIC Ethernet NIC Driver"
-#define DRV_VERSION             "1.4.1.6"
+#define DRV_VERSION             "1.4.1.7"
 #define DRV_COPYRIGHT           "Copyright 2008-2010 Cisco Systems, Inc"
 
 #define ENIC_BARS_MAX           6
diff --git a/drivers/net/enic/enic_main.c b/drivers/net/enic/enic_main.c
index a466ef91dd4..9f293fa2476 100644
--- a/drivers/net/enic/enic_main.c
+++ b/drivers/net/enic/enic_main.c
@@ -2042,7 +2042,7 @@ static int enic_dev_hang_reset(struct enic *enic)
 
 static int enic_set_rsskey(struct enic *enic)
 {
-        u64 rss_key_buf_pa;
+        dma_addr_t rss_key_buf_pa;
         union vnic_rss_key *rss_key_buf_va = NULL;
         union vnic_rss_key rss_key = {
                 .key[0].b = {85, 67, 83, 97, 119, 101, 115, 111, 109, 101},
@@ -2073,7 +2073,7 @@ static int enic_set_rsskey(struct enic *enic)
 
 static int enic_set_rsscpu(struct enic *enic, u8 rss_hash_bits)
 {
-        u64 rss_cpu_buf_pa;
+        dma_addr_t rss_cpu_buf_pa;
         union vnic_rss_cpu *rss_cpu_buf_va = NULL;
         unsigned int i;
         int err;
diff --git a/drivers/net/ethoc.c b/drivers/net/ethoc.c
index c5a2fe099a8..b79d7e1555d 100644
--- a/drivers/net/ethoc.c
+++ b/drivers/net/ethoc.c
@@ -19,6 +19,7 @@
 #include <linux/platform_device.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
+#include <linux/of.h>
 #include <net/ethoc.h>
 
 static int buffer_size = 0x8000; /* 32 KBytes */
@@ -184,7 +185,6 @@ MODULE_PARM_DESC(buffer_size, "DMA buffer allocation size");
  * @netdev:     pointer to network device structure
  * @napi:       NAPI structure
  * @msg_enable: device state flags
- * @rx_lock:    receive lock
  * @lock:       device lock
  * @phy:        attached PHY
  * @mdio:       MDIO bus for PHY access
@@ -209,7 +209,6 @@ struct ethoc {
         struct napi_struct napi;
         u32 msg_enable;
 
-        spinlock_t rx_lock;
         spinlock_t lock;
 
         struct phy_device *phy;
@@ -413,10 +412,21 @@ static int ethoc_rx(struct net_device *dev, int limit)
                 unsigned int entry;
                 struct ethoc_bd bd;
 
-                entry = priv->num_tx + (priv->cur_rx % priv->num_rx);
+                entry = priv->num_tx + priv->cur_rx;
                 ethoc_read_bd(priv, entry, &bd);
-                if (bd.stat & RX_BD_EMPTY)
-                        break;
+                if (bd.stat & RX_BD_EMPTY) {
+                        ethoc_ack_irq(priv, INT_MASK_RX);
+                        /* If packet (interrupt) came in between checking
+                         * BD_EMTPY and clearing the interrupt source, then we
+                         * risk missing the packet as the RX interrupt won't
+                         * trigger right away when we reenable it; hence, check
+                         * BD_EMTPY here again to make sure there isn't such a
+                         * packet waiting for us...
+                         */
+                        ethoc_read_bd(priv, entry, &bd);
+                        if (bd.stat & RX_BD_EMPTY)
+                                break;
+                }
 
                 if (ethoc_update_rx_stats(priv, &bd) == 0) {
                         int size = bd.stat >> 16;
@@ -446,13 +456,14 @@ static int ethoc_rx(struct net_device *dev, int limit)
                 bd.stat &= ~RX_BD_STATS;
                 bd.stat |=  RX_BD_EMPTY;
                 ethoc_write_bd(priv, entry, &bd);
-                priv->cur_rx++;
+                if (++priv->cur_rx == priv->num_rx)
+                        priv->cur_rx = 0;
         }
 
         return count;
 }
 
-static int ethoc_update_tx_stats(struct ethoc *dev, struct ethoc_bd *bd)
+static void ethoc_update_tx_stats(struct ethoc *dev, struct ethoc_bd *bd)
 {
         struct net_device *netdev = dev->netdev;
 
@@ -482,32 +493,44 @@ static int ethoc_update_tx_stats(struct ethoc *dev, struct ethoc_bd *bd)
         netdev->stats.collisions += (bd->stat >> 4) & 0xf;
         netdev->stats.tx_bytes += bd->stat >> 16;
         netdev->stats.tx_packets++;
-        return 0;
 }
 
-static void ethoc_tx(struct net_device *dev)
+static int ethoc_tx(struct net_device *dev, int limit)
 {
         struct ethoc *priv = netdev_priv(dev);
+        int count;
+        struct ethoc_bd bd;
 
-        spin_lock(&priv->lock);
+        for (count = 0; count < limit; ++count) {
+                unsigned int entry;
 
-        while (priv->dty_tx != priv->cur_tx) {
-                unsigned int entry = priv->dty_tx % priv->num_tx;
-                struct ethoc_bd bd;
+                entry = priv->dty_tx & (priv->num_tx-1);
 
                 ethoc_read_bd(priv, entry, &bd);
-                if (bd.stat & TX_BD_READY)
-                        break;
 
-                entry = (++priv->dty_tx) % priv->num_tx;
-                (void)ethoc_update_tx_stats(priv, &bd);
+                if (bd.stat & TX_BD_READY || (priv->dty_tx == priv->cur_tx)) {
+                        ethoc_ack_irq(priv, INT_MASK_TX);
+                        /* If interrupt came in between reading in the BD
+                         * and clearing the interrupt source, then we risk
+                         * missing the event as the TX interrupt won't trigger
+                         * right away when we reenable it; hence, check
+                         * BD_EMPTY here again to make sure there isn't such an
+                         * event pending...
+                         */
+                        ethoc_read_bd(priv, entry, &bd);
+                        if (bd.stat & TX_BD_READY ||
+                            (priv->dty_tx == priv->cur_tx))
+                                break;
+                }
+
+                ethoc_update_tx_stats(priv, &bd);
+                priv->dty_tx++;
         }
 
         if ((priv->cur_tx - priv->dty_tx) <= (priv->num_tx / 2))
                 netif_wake_queue(dev);
 
-        ethoc_ack_irq(priv, INT_MASK_TX);
-        spin_unlock(&priv->lock);
+        return count;
 }
 
 static irqreturn_t ethoc_interrupt(int irq, void *dev_id)
@@ -515,32 +538,38 @@ static irqreturn_t ethoc_interrupt(int irq, void *dev_id)
         struct net_device *dev = dev_id;
         struct ethoc *priv = netdev_priv(dev);
         u32 pending;
-
-        ethoc_disable_irq(priv, INT_MASK_ALL);
+        u32 mask;
+
+        /* Figure out what triggered the interrupt...
+         * The tricky bit here is that the interrupt source bits get
+         * set in INT_SOURCE for an event irregardless of whether that
+         * event is masked or not.  Thus, in order to figure out what
+         * triggered the interrupt, we need to remove the sources
+         * for all events that are currently masked.  This behaviour
+         * is not particularly well documented but reasonable...
+         */
+        mask = ethoc_read(priv, INT_MASK);
         pending = ethoc_read(priv, INT_SOURCE);
+        pending &= mask;
+
         if (unlikely(pending == 0)) {
-                ethoc_enable_irq(priv, INT_MASK_ALL);
                 return IRQ_NONE;
         }
 
         ethoc_ack_irq(priv, pending);
 
+        /* We always handle the dropped packet interrupt */
         if (pending & INT_MASK_BUSY) {
                 dev_err(&dev->dev, "packet dropped\n");
                 dev->stats.rx_dropped++;
         }
 
-        if (pending & INT_MASK_RX) {
-                if (napi_schedule_prep(&priv->napi))
-                        __napi_schedule(&priv->napi);
-        } else {
-                ethoc_enable_irq(priv, INT_MASK_RX);
+        /* Handle receive/transmit event by switching to polling */
+        if (pending & (INT_MASK_TX | INT_MASK_RX)) {
+                ethoc_disable_irq(priv, INT_MASK_TX | INT_MASK_RX);
+                napi_schedule(&priv->napi);
         }
 
-        if (pending & INT_MASK_TX)
-                ethoc_tx(dev);
-
-        ethoc_enable_irq(priv, INT_MASK_ALL & ~INT_MASK_RX);
         return IRQ_HANDLED;
 }
 
@@ -566,26 +595,29 @@ static int ethoc_get_mac_address(struct net_device *dev, void *addr)
 static int ethoc_poll(struct napi_struct *napi, int budget)
 {
         struct ethoc *priv = container_of(napi, struct ethoc, napi);
-        int work_done = 0;
+        int rx_work_done = 0;
+        int tx_work_done = 0;
+
+        rx_work_done = ethoc_rx(priv->netdev, budget);
+        tx_work_done = ethoc_tx(priv->netdev, budget);
 
-        work_done = ethoc_rx(priv->netdev, budget);
-        if (work_done < budget) {
-                ethoc_enable_irq(priv, INT_MASK_RX);
+        if (rx_work_done < budget && tx_work_done < budget) {
                 napi_complete(napi);
+                ethoc_enable_irq(priv, INT_MASK_TX | INT_MASK_RX);
         }
 
-        return work_done;
+        return rx_work_done;
 }
 
 static int ethoc_mdio_read(struct mii_bus *bus, int phy, int reg)
 {
-        unsigned long timeout = jiffies + ETHOC_MII_TIMEOUT;
         struct ethoc *priv = bus->priv;
+        int i;
 
         ethoc_write(priv, MIIADDRESS, MIIADDRESS_ADDR(phy, reg));
         ethoc_write(priv, MIICOMMAND, MIICOMMAND_READ);
 
-        while (time_before(jiffies, timeout)) {
+        for (i=0; i < 5; i++) {
                 u32 status = ethoc_read(priv, MIISTATUS);
                 if (!(status & MIISTATUS_BUSY)) {
                         u32 data = ethoc_read(priv, MIIRX_DATA);
@@ -593,8 +625,7 @@ static int ethoc_mdio_read(struct mii_bus *bus, int phy, int reg)
                         ethoc_write(priv, MIICOMMAND, 0);
                         return data;
                 }
-
-                schedule();
+                usleep_range(100,200);
         }
 
         return -EBUSY;
@@ -602,22 +633,21 @@ static int ethoc_mdio_read(struct mii_bus *bus, int phy, int reg)
 
 static int ethoc_mdio_write(struct mii_bus *bus, int phy, int reg, u16 val)
 {
-        unsigned long timeout = jiffies + ETHOC_MII_TIMEOUT;
         struct ethoc *priv = bus->priv;
+        int i;
 
         ethoc_write(priv, MIIADDRESS, MIIADDRESS_ADDR(phy, reg));
         ethoc_write(priv, MIITX_DATA, val);
         ethoc_write(priv, MIICOMMAND, MIICOMMAND_WRITE);
 
-        while (time_before(jiffies, timeout)) {
+        for (i=0; i < 5; i++) {
                 u32 stat = ethoc_read(priv, MIISTATUS);
                 if (!(stat & MIISTATUS_BUSY)) {
                         /* reset MII command register */
                         ethoc_write(priv, MIICOMMAND, 0);
                         return 0;
                 }
-
-                schedule();
+                usleep_range(100,200);
         }
 
         return -EBUSY;
@@ -971,9 +1001,17 @@ static int __devinit ethoc_probe(struct platform_device *pdev)
         /* calculate the number of TX/RX buffers, maximum 128 supported */
         num_bd = min_t(unsigned int,
                 128, (netdev->mem_end - netdev->mem_start + 1) / ETHOC_BUFSIZ);
-        priv->num_tx = max(2, num_bd / 4);
+        if (num_bd < 4) {
+                ret = -ENODEV;
+                goto error;
+        }
+        /* num_tx must be a power of two */
+        priv->num_tx = rounddown_pow_of_two(num_bd >> 1);
         priv->num_rx = num_bd - priv->num_tx;
 
+        dev_dbg(&pdev->dev, "ethoc: num_tx: %d num_rx: %d\n",
+                priv->num_tx, priv->num_rx);
+
         priv->vma = devm_kzalloc(&pdev->dev, num_bd*sizeof(void*), GFP_KERNEL);
         if (!priv->vma) {
                 ret = -ENOMEM;
@@ -982,10 +1020,23 @@ static int __devinit ethoc_probe(struct platform_device *pdev)
 
         /* Allow the platform setup code to pass in a MAC address. */
         if (pdev->dev.platform_data) {
-                struct ethoc_platform_data *pdata =
-                        (struct ethoc_platform_data *)pdev->dev.platform_data;
+                struct ethoc_platform_data *pdata = pdev->dev.platform_data;
                 memcpy(netdev->dev_addr, pdata->hwaddr, IFHWADDRLEN);
                 priv->phy_id = pdata->phy_id;
+        } else {
+                priv->phy_id = -1;
+
+#ifdef CONFIG_OF
+                {
+                const uint8_t* mac;
+
+                mac = of_get_property(pdev->dev.of_node,
+                                      "local-mac-address",
+                                      NULL);
+                if (mac)
+                        memcpy(netdev->dev_addr, mac, IFHWADDRLEN);
+                }
+#endif
         }
 
         /* Check that the given MAC address is valid. If it isn't, read the
@@ -1046,7 +1097,6 @@ static int __devinit ethoc_probe(struct platform_device *pdev)
         /* setup NAPI */
         netif_napi_add(netdev, &priv->napi, ethoc_poll, 64);
 
-        spin_lock_init(&priv->rx_lock);
         spin_lock_init(&priv->lock);
 
         ret = register_netdev(netdev);
@@ -1113,6 +1163,16 @@ static int ethoc_resume(struct platform_device *pdev)
 # define ethoc_resume  NULL
 #endif
 
+#ifdef CONFIG_OF
+static struct of_device_id ethoc_match[] = {
+        {
+                .compatible = "opencores,ethoc",
+        },
+        {},
+};
+MODULE_DEVICE_TABLE(of, ethoc_match);
+#endif
+
 static struct platform_driver ethoc_driver = {
         .probe   = ethoc_probe,
         .remove  = __devexit_p(ethoc_remove),
@@ -1120,6 +1180,10 @@ static struct platform_driver ethoc_driver = {
         .resume  = ethoc_resume,
         .driver  = {
                 .name = "ethoc",
+                .owner = THIS_MODULE,
+#ifdef CONFIG_OF
+                .of_match_table = ethoc_match,
+#endif
         },
 };
 
diff --git a/drivers/net/fec_mpc52xx.c b/drivers/net/fec_mpc52xx.c
index e9f5d030bc2..50c1213f61f 100644
--- a/drivers/net/fec_mpc52xx.c
+++ b/drivers/net/fec_mpc52xx.c
@@ -366,9 +366,8 @@ static irqreturn_t mpc52xx_fec_tx_interrupt(int irq, void *dev_id)
 {
         struct net_device *dev = dev_id;
         struct mpc52xx_fec_priv *priv = netdev_priv(dev);
-        unsigned long flags;
 
-        spin_lock_irqsave(&priv->lock, flags);
+        spin_lock(&priv->lock);
         while (bcom_buffer_done(priv->tx_dmatsk)) {
                 struct sk_buff *skb;
                 struct bcom_fec_bd *bd;
@@ -379,7 +378,7 @@ static irqreturn_t mpc52xx_fec_tx_interrupt(int irq, void *dev_id)
 
                 dev_kfree_skb_irq(skb);
         }
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock(&priv->lock);
 
         netif_wake_queue(dev);
 
@@ -395,9 +394,8 @@ static irqreturn_t mpc52xx_fec_rx_interrupt(int irq, void *dev_id)
         struct bcom_fec_bd *bd;
         u32 status, physaddr;
         int length;
-        unsigned long flags;
 
-        spin_lock_irqsave(&priv->lock, flags);
+        spin_lock(&priv->lock);
 
         while (bcom_buffer_done(priv->rx_dmatsk)) {
 
@@ -429,7 +427,7 @@ static irqreturn_t mpc52xx_fec_rx_interrupt(int irq, void *dev_id)
 
                 /* Process the received skb - Drop the spin lock while
                  * calling into the network stack */
-                spin_unlock_irqrestore(&priv->lock, flags);
+                spin_unlock(&priv->lock);
 
                 dma_unmap_single(dev->dev.parent, physaddr, rskb->len,
                                  DMA_FROM_DEVICE);
@@ -438,10 +436,10 @@ static irqreturn_t mpc52xx_fec_rx_interrupt(int irq, void *dev_id)
                 rskb->protocol = eth_type_trans(rskb, dev);
                 netif_rx(rskb);
 
-                spin_lock_irqsave(&priv->lock, flags);
+                spin_lock(&priv->lock);
         }
 
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock(&priv->lock);
 
         return IRQ_HANDLED;
 }
@@ -452,7 +450,6 @@ static irqreturn_t mpc52xx_fec_interrupt(int irq, void *dev_id)
         struct mpc52xx_fec_priv *priv = netdev_priv(dev);
         struct mpc52xx_fec __iomem *fec = priv->fec;
         u32 ievent;
-        unsigned long flags;
 
         ievent = in_be32(&fec->ievent);
 
@@ -470,9 +467,9 @@ static irqreturn_t mpc52xx_fec_interrupt(int irq, void *dev_id)
                 if (net_ratelimit() && (ievent & FEC_IEVENT_XFIFO_ERROR))
                         dev_warn(&dev->dev, "FEC_IEVENT_XFIFO_ERROR\n");
 
-                spin_lock_irqsave(&priv->lock, flags);
+                spin_lock(&priv->lock);
                 mpc52xx_fec_reset(dev);
-                spin_unlock_irqrestore(&priv->lock, flags);
+                spin_unlock(&priv->lock);
 
                 return IRQ_HANDLED;
         }
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index 0fa1776563a..cd2d72d825d 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -39,6 +39,9 @@
  * DEV_NEED_TIMERIRQ will not harm you on sane hardware, only generating a few
  * superfluous timer interrupts from the nic.
  */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #define FORCEDETH_VERSION               "0.64"
 #define DRV_NAME                        "forcedeth"
 
@@ -60,18 +63,12 @@
 #include <linux/if_vlan.h>
 #include <linux/dma-mapping.h>
 #include <linux/slab.h>
+#include <linux/uaccess.h>
+#include  <linux/io.h>
 
 #include <asm/irq.h>
-#include <asm/io.h>
-#include <asm/uaccess.h>
 #include <asm/system.h>
 
-#if 0
-#define dprintk                 printk
-#else
-#define dprintk(x...)           do { } while (0)
-#endif
-
 #define TX_WORK_PER_LOOP  64
 #define RX_WORK_PER_LOOP  64
 
@@ -186,9 +183,9 @@ enum {
         NvRegSlotTime = 0x9c,
 #define NVREG_SLOTTIME_LEGBF_ENABLED    0x80000000
 #define NVREG_SLOTTIME_10_100_FULL      0x00007f00
-#define NVREG_SLOTTIME_1000_FULL        0x0003ff00
+#define NVREG_SLOTTIME_1000_FULL        0x0003ff00
 #define NVREG_SLOTTIME_HALF             0x0000ff00
-#define NVREG_SLOTTIME_DEFAULT          0x00007f00
+#define NVREG_SLOTTIME_DEFAULT          0x00007f00
 #define NVREG_SLOTTIME_MASK             0x000000ff
 
         NvRegTxDeferral = 0xA0,
@@ -297,7 +294,7 @@ enum {
 #define NVREG_WAKEUPFLAGS_ENABLE        0x1111
 
         NvRegMgmtUnitGetVersion = 0x204,
-#define NVREG_MGMTUNITGETVERSION        0x01
+#define NVREG_MGMTUNITGETVERSION        0x01
         NvRegMgmtUnitVersion = 0x208,
 #define NVREG_MGMTUNITVERSION           0x08
         NvRegPowerCap = 0x268,
@@ -368,8 +365,8 @@ struct ring_desc_ex {
 };
 
 union ring_type {
-        struct ring_desc* orig;
-        struct ring_desc_ex* ex;
+        struct ring_desc *orig;
+        struct ring_desc_ex *ex;
 };
 
 #define FLAG_MASK_V1 0xffff0000
@@ -444,10 +441,10 @@ union ring_type {
 #define NV_RX3_VLAN_TAG_MASK    (0x0000FFFF)
 
 /* Miscelaneous hardware related defines: */
-#define NV_PCI_REGSZ_VER1       0x270
-#define NV_PCI_REGSZ_VER2       0x2d4
-#define NV_PCI_REGSZ_VER3       0x604
-#define NV_PCI_REGSZ_MAX        0x604
+#define NV_PCI_REGSZ_VER1       0x270
+#define NV_PCI_REGSZ_VER2       0x2d4
+#define NV_PCI_REGSZ_VER3       0x604
+#define NV_PCI_REGSZ_MAX        0x604
 
 /* various timeout delays: all in usec */
 #define NV_TXRX_RESET_DELAY     4
@@ -717,7 +714,7 @@ static const struct register_test nv_registers_test[] = {
         { NvRegMulticastAddrA, 0xffffffff },
         { NvRegTxWatermark, 0x0ff },
         { NvRegWakeUpFlags, 0x07777 },
-        { 0,0 }
+        { 0, 0 }
 };
 
 struct nv_skb_map {
@@ -911,7 +908,7 @@ static int phy_cross = NV_CROSSOVER_DETECTION_DISABLED;
  * Power down phy when interface is down (persists through reboot;
  * older Linux and other OSes may not power it up again)
  */
-static int phy_power_down = 0;
+static int phy_power_down;
 
 static inline struct fe_priv *get_nvpriv(struct net_device *dev)
 {
@@ -948,7 +945,7 @@ static bool nv_optimized(struct fe_priv *np)
 }
 
 static int reg_delay(struct net_device *dev, int offset, u32 mask, u32 target,
-                                int delay, int delaymax, const char *msg)
+                     int delay, int delaymax)
 {
         u8 __iomem *base = get_hwbase(dev);
 
@@ -956,11 +953,8 @@ static int reg_delay(struct net_device *dev, int offset, u32 mask, u32 target,
         do {
                 udelay(delay);
                 delaymax -= delay;
-                if (delaymax < 0) {
-                        if (msg)
-                                printk("%s", msg);
+                if (delaymax < 0)
                         return 1;
-                }
         } while ((readl(base + offset) & mask) != target);
         return 0;
 }
@@ -984,12 +978,10 @@ static void setup_hw_rings(struct net_device *dev, int rxtx_flags)
         u8 __iomem *base = get_hwbase(dev);
 
         if (!nv_optimized(np)) {
-                if (rxtx_flags & NV_SETUP_RX_RING) {
+                if (rxtx_flags & NV_SETUP_RX_RING)
                         writel(dma_low(np->ring_addr), base + NvRegRxRingPhysAddr);
-                }
-                if (rxtx_flags & NV_SETUP_TX_RING) {
+                if (rxtx_flags & NV_SETUP_TX_RING)
                         writel(dma_low(np->ring_addr + np->rx_ring_size*sizeof(struct ring_desc)), base + NvRegTxRingPhysAddr);
-                }
         } else {
                 if (rxtx_flags & NV_SETUP_RX_RING) {
                         writel(dma_low(np->ring_addr), base + NvRegRxRingPhysAddr);
@@ -1015,10 +1007,8 @@ static void free_rings(struct net_device *dev)
                         pci_free_consistent(np->pci_dev, sizeof(struct ring_desc_ex) * (np->rx_ring_size + np->tx_ring_size),
                                             np->rx_ring.ex, np->ring_addr);
         }
-        if (np->rx_skb)
-                kfree(np->rx_skb);
-        if (np->tx_skb)
-                kfree(np->tx_skb);
+        kfree(np->rx_skb);
+        kfree(np->tx_skb);
 }
 
 static int using_multi_irqs(struct net_device *dev)
@@ -1145,23 +1135,15 @@ static int mii_rw(struct net_device *dev, int addr, int miireg, int value)
         writel(reg, base + NvRegMIIControl);
 
         if (reg_delay(dev, NvRegMIIControl, NVREG_MIICTL_INUSE, 0,
-                        NV_MIIPHY_DELAY, NV_MIIPHY_DELAYMAX, NULL)) {
-                dprintk(KERN_DEBUG "%s: mii_rw of reg %d at PHY %d timed out.\n",
-                                dev->name, miireg, addr);
+                        NV_MIIPHY_DELAY, NV_MIIPHY_DELAYMAX)) {
                 retval = -1;
         } else if (value != MII_READ) {
                 /* it was a write operation - fewer failures are detectable */
-                dprintk(KERN_DEBUG "%s: mii_rw wrote 0x%x to reg %d at PHY %d\n",
-                                dev->name, value, miireg, addr);
                 retval = 0;
         } else if (readl(base + NvRegMIIStatus) & NVREG_MIISTAT_ERROR) {
-                dprintk(KERN_DEBUG "%s: mii_rw of reg %d at PHY %d failed.\n",
-                                dev->name, miireg, addr);
                 retval = -1;
         } else {
                 retval = readl(base + NvRegMIIData);
-                dprintk(KERN_DEBUG "%s: mii_rw read from reg %d at PHY %d: 0x%x.\n",
-                                dev->name, miireg, addr, retval);
         }
 
         return retval;
@@ -1174,16 +1156,15 @@ static int phy_reset(struct net_device *dev, u32 bmcr_setup)
         unsigned int tries = 0;
 
         miicontrol = BMCR_RESET | bmcr_setup;
-        if (mii_rw(dev, np->phyaddr, MII_BMCR, miicontrol)) {
+        if (mii_rw(dev, np->phyaddr, MII_BMCR, miicontrol))
                 return -1;
-        }
 
         /* wait for 500ms */
         msleep(500);
 
         /* must wait till reset is deasserted */
         while (miicontrol & BMCR_RESET) {
-                msleep(10);
+                usleep_range(10000, 20000);
                 miicontrol = mii_rw(dev, np->phyaddr, MII_BMCR, MII_READ);
                 /* FIXME: 100 tries seem excessive */
                 if (tries++ > 100)
@@ -1192,106 +1173,239 @@ static int phy_reset(struct net_device *dev, u32 bmcr_setup)
         return 0;
 }
 
+static int init_realtek_8211b(struct net_device *dev, struct fe_priv *np)
+{
+        static const struct {
+                int reg;
+                int init;
+        } ri[] = {
+                { PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT1 },
+                { PHY_REALTEK_INIT_REG2, PHY_REALTEK_INIT2 },
+                { PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT3 },
+                { PHY_REALTEK_INIT_REG3, PHY_REALTEK_INIT4 },
+                { PHY_REALTEK_INIT_REG4, PHY_REALTEK_INIT5 },
+                { PHY_REALTEK_INIT_REG5, PHY_REALTEK_INIT6 },
+                { PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT1 },
+        };
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(ri); i++) {
+                if (mii_rw(dev, np->phyaddr, ri[i].reg, ri[i].init))
+                        return PHY_ERROR;
+        }
+
+        return 0;
+}
+
+static int init_realtek_8211c(struct net_device *dev, struct fe_priv *np)
+{
+        u32 reg;
+        u8 __iomem *base = get_hwbase(dev);
+        u32 powerstate = readl(base + NvRegPowerState2);
+
+        /* need to perform hw phy reset */
+        powerstate |= NVREG_POWERSTATE2_PHY_RESET;
+        writel(powerstate, base + NvRegPowerState2);
+        msleep(25);
+
+        powerstate &= ~NVREG_POWERSTATE2_PHY_RESET;
+        writel(powerstate, base + NvRegPowerState2);
+        msleep(25);
+
+        reg = mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG6, MII_READ);
+        reg |= PHY_REALTEK_INIT9;
+        if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG6, reg))
+                return PHY_ERROR;
+        if (mii_rw(dev, np->phyaddr,
+                   PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT10))
+                return PHY_ERROR;
+        reg = mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG7, MII_READ);
+        if (!(reg & PHY_REALTEK_INIT11)) {
+                reg |= PHY_REALTEK_INIT11;
+                if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG7, reg))
+                        return PHY_ERROR;
+        }
+        if (mii_rw(dev, np->phyaddr,
+                   PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT1))
+                return PHY_ERROR;
+
+        return 0;
+}
+
+static int init_realtek_8201(struct net_device *dev, struct fe_priv *np)
+{
+        u32 phy_reserved;
+
+        if (np->driver_data & DEV_NEED_PHY_INIT_FIX) {
+                phy_reserved = mii_rw(dev, np->phyaddr,
+                                      PHY_REALTEK_INIT_REG6, MII_READ);
+                phy_reserved |= PHY_REALTEK_INIT7;
+                if (mii_rw(dev, np->phyaddr,
+                           PHY_REALTEK_INIT_REG6, phy_reserved))
+                        return PHY_ERROR;
+        }
+
+        return 0;
+}
+
+static int init_realtek_8201_cross(struct net_device *dev, struct fe_priv *np)
+{
+        u32 phy_reserved;
+
+        if (phy_cross == NV_CROSSOVER_DETECTION_DISABLED) {
+                if (mii_rw(dev, np->phyaddr,
+                           PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT3))
+                        return PHY_ERROR;
+                phy_reserved = mii_rw(dev, np->phyaddr,
+                                      PHY_REALTEK_INIT_REG2, MII_READ);
+                phy_reserved &= ~PHY_REALTEK_INIT_MSK1;
+                phy_reserved |= PHY_REALTEK_INIT3;
+                if (mii_rw(dev, np->phyaddr,
+                           PHY_REALTEK_INIT_REG2, phy_reserved))
+                        return PHY_ERROR;
+                if (mii_rw(dev, np->phyaddr,
+                           PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT1))
+                        return PHY_ERROR;
+        }
+
+        return 0;
+}
+
+static int init_cicada(struct net_device *dev, struct fe_priv *np,
+                       u32 phyinterface)
+{
+        u32 phy_reserved;
+
+        if (phyinterface & PHY_RGMII) {
+                phy_reserved = mii_rw(dev, np->phyaddr, MII_RESV1, MII_READ);
+                phy_reserved &= ~(PHY_CICADA_INIT1 | PHY_CICADA_INIT2);
+                phy_reserved |= (PHY_CICADA_INIT3 | PHY_CICADA_INIT4);
+                if (mii_rw(dev, np->phyaddr, MII_RESV1, phy_reserved))
+                        return PHY_ERROR;
+                phy_reserved = mii_rw(dev, np->phyaddr, MII_NCONFIG, MII_READ);
+                phy_reserved |= PHY_CICADA_INIT5;
+                if (mii_rw(dev, np->phyaddr, MII_NCONFIG, phy_reserved))
+                        return PHY_ERROR;
+        }
+        phy_reserved = mii_rw(dev, np->phyaddr, MII_SREVISION, MII_READ);
+        phy_reserved |= PHY_CICADA_INIT6;
+        if (mii_rw(dev, np->phyaddr, MII_SREVISION, phy_reserved))
+                return PHY_ERROR;
+
+        return 0;
+}
+
+static int init_vitesse(struct net_device *dev, struct fe_priv *np)
+{
+        u32 phy_reserved;
+
+        if (mii_rw(dev, np->phyaddr,
+                   PHY_VITESSE_INIT_REG1, PHY_VITESSE_INIT1))
+                return PHY_ERROR;
+        if (mii_rw(dev, np->phyaddr,
+                   PHY_VITESSE_INIT_REG2, PHY_VITESSE_INIT2))
+                return PHY_ERROR;
+        phy_reserved = mii_rw(dev, np->phyaddr,
+                              PHY_VITESSE_INIT_REG4, MII_READ);
+        if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG4, phy_reserved))
+                return PHY_ERROR;
+        phy_reserved = mii_rw(dev, np->phyaddr,
+                              PHY_VITESSE_INIT_REG3, MII_READ);
+        phy_reserved &= ~PHY_VITESSE_INIT_MSK1;
+        phy_reserved |= PHY_VITESSE_INIT3;
+        if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG3, phy_reserved))
+                return PHY_ERROR;
+        if (mii_rw(dev, np->phyaddr,
+                   PHY_VITESSE_INIT_REG2, PHY_VITESSE_INIT4))
+                return PHY_ERROR;
+        if (mii_rw(dev, np->phyaddr,
+                   PHY_VITESSE_INIT_REG2, PHY_VITESSE_INIT5))
+                return PHY_ERROR;
+        phy_reserved = mii_rw(dev, np->phyaddr,
+                              PHY_VITESSE_INIT_REG4, MII_READ);
+        phy_reserved &= ~PHY_VITESSE_INIT_MSK1;
+        phy_reserved |= PHY_VITESSE_INIT3;
+        if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG4, phy_reserved))
+                return PHY_ERROR;
+        phy_reserved = mii_rw(dev, np->phyaddr,
+                              PHY_VITESSE_INIT_REG3, MII_READ);
+        if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG3, phy_reserved))
+                return PHY_ERROR;
+        if (mii_rw(dev, np->phyaddr,
+                   PHY_VITESSE_INIT_REG2, PHY_VITESSE_INIT6))
+                return PHY_ERROR;
+        if (mii_rw(dev, np->phyaddr,
+                   PHY_VITESSE_INIT_REG2, PHY_VITESSE_INIT7))
+                return PHY_ERROR;
+        phy_reserved = mii_rw(dev, np->phyaddr,
+                              PHY_VITESSE_INIT_REG4, MII_READ);
+        if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG4, phy_reserved))
+                return PHY_ERROR;
+        phy_reserved = mii_rw(dev, np->phyaddr,
+                              PHY_VITESSE_INIT_REG3, MII_READ);
+        phy_reserved &= ~PHY_VITESSE_INIT_MSK2;
+        phy_reserved |= PHY_VITESSE_INIT8;
+        if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG3, phy_reserved))
+                return PHY_ERROR;
+        if (mii_rw(dev, np->phyaddr,
+                   PHY_VITESSE_INIT_REG2, PHY_VITESSE_INIT9))
+                return PHY_ERROR;
+        if (mii_rw(dev, np->phyaddr,
+                   PHY_VITESSE_INIT_REG1, PHY_VITESSE_INIT10))
+                return PHY_ERROR;
+
+        return 0;
+}
+
 static int phy_init(struct net_device *dev)
 {
         struct fe_priv *np = get_nvpriv(dev);
         u8 __iomem *base = get_hwbase(dev);
-        u32 phyinterface, phy_reserved, mii_status, mii_control, mii_control_1000,reg;
+        u32 phyinterface;
+        u32 mii_status, mii_control, mii_control_1000, reg;
 
         /* phy errata for E3016 phy */
         if (np->phy_model == PHY_MODEL_MARVELL_E3016) {
                 reg = mii_rw(dev, np->phyaddr, MII_NCONFIG, MII_READ);
                 reg &= ~PHY_MARVELL_E3016_INITMASK;
                 if (mii_rw(dev, np->phyaddr, MII_NCONFIG, reg)) {
-                        printk(KERN_INFO "%s: phy write to errata reg failed.\n", pci_name(np->pci_dev));
+                        netdev_info(dev, "%s: phy write to errata reg failed\n",
+                                    pci_name(np->pci_dev));
                         return PHY_ERROR;
                 }
         }
         if (np->phy_oui == PHY_OUI_REALTEK) {
                 if (np->phy_model == PHY_MODEL_REALTEK_8211 &&
                     np->phy_rev == PHY_REV_REALTEK_8211B) {
-                        if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT1)) {
-                                printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                                return PHY_ERROR;
-                        }
-                        if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG2, PHY_REALTEK_INIT2)) {
-                                printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                                return PHY_ERROR;
-                        }
-                        if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT3)) {
-                                printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
+                        if (init_realtek_8211b(dev, np)) {
+                                netdev_info(dev, "%s: phy init failed\n",
+                                            pci_name(np->pci_dev));
                                 return PHY_ERROR;
                         }
-                        if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG3, PHY_REALTEK_INIT4)) {
-                                printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
+                } else if (np->phy_model == PHY_MODEL_REALTEK_8211 &&
+                           np->phy_rev == PHY_REV_REALTEK_8211C) {
+                        if (init_realtek_8211c(dev, np)) {
+                                netdev_info(dev, "%s: phy init failed\n",
+                                            pci_name(np->pci_dev));
                                 return PHY_ERROR;
                         }
-                        if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG4, PHY_REALTEK_INIT5)) {
-                                printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
+                } else if (np->phy_model == PHY_MODEL_REALTEK_8201) {
+                        if (init_realtek_8201(dev, np)) {
+                                netdev_info(dev, "%s: phy init failed\n",
+                                            pci_name(np->pci_dev));
                                 return PHY_ERROR;
                         }
-                        if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG5, PHY_REALTEK_INIT6)) {
-                                printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                                return PHY_ERROR;
-                        }
-                        if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT1)) {
-                                printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                                return PHY_ERROR;
-                        }
-                }
-                if (np->phy_model == PHY_MODEL_REALTEK_8211 &&
-                    np->phy_rev == PHY_REV_REALTEK_8211C) {
-                        u32 powerstate = readl(base + NvRegPowerState2);
-
-                        /* need to perform hw phy reset */
-                        powerstate |= NVREG_POWERSTATE2_PHY_RESET;
-                        writel(powerstate, base + NvRegPowerState2);
-                        msleep(25);
-
-                        powerstate &= ~NVREG_POWERSTATE2_PHY_RESET;
-                        writel(powerstate, base + NvRegPowerState2);
-                        msleep(25);
-
-                        reg = mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG6, MII_READ);
-                        reg |= PHY_REALTEK_INIT9;
-                        if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG6, reg)) {
-                                printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                                return PHY_ERROR;
-                        }
-                        if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT10)) {
-                                printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                                return PHY_ERROR;
-                        }
-                        reg = mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG7, MII_READ);
-                        if (!(reg & PHY_REALTEK_INIT11)) {
-                                reg |= PHY_REALTEK_INIT11;
-                                if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG7, reg)) {
-                                        printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                                        return PHY_ERROR;
-                                }
-                        }
-                        if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT1)) {
-                                printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                                return PHY_ERROR;
-                        }
-                }
-                if (np->phy_model == PHY_MODEL_REALTEK_8201) {
-                        if (np->driver_data & DEV_NEED_PHY_INIT_FIX) {
-                                phy_reserved = mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG6, MII_READ);
-                                phy_reserved |= PHY_REALTEK_INIT7;
-                                if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG6, phy_reserved)) {
-                                        printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                                        return PHY_ERROR;
-                                }
-                        }
                 }
         }
 
         /* set advertise register */
         reg = mii_rw(dev, np->phyaddr, MII_ADVERTISE, MII_READ);
-        reg |= (ADVERTISE_10HALF|ADVERTISE_10FULL|ADVERTISE_100HALF|ADVERTISE_100FULL|ADVERTISE_PAUSE_ASYM|ADVERTISE_PAUSE_CAP);
+        reg |= (ADVERTISE_10HALF | ADVERTISE_10FULL |
+                ADVERTISE_100HALF | ADVERTISE_100FULL |
+                ADVERTISE_PAUSE_ASYM | ADVERTISE_PAUSE_CAP);
         if (mii_rw(dev, np->phyaddr, MII_ADVERTISE, reg)) {
-                printk(KERN_INFO "%s: phy write to advertise failed.\n", pci_name(np->pci_dev));
+                netdev_info(dev, "%s: phy write to advertise failed\n",
+                            pci_name(np->pci_dev));
                 return PHY_ERROR;
         }
 
@@ -1302,7 +1416,8 @@ static int phy_init(struct net_device *dev)
         mii_status = mii_rw(dev, np->phyaddr, MII_BMSR, MII_READ);
         if (mii_status & PHY_GIGABIT) {
                 np->gigabit = PHY_GIGABIT;
-                mii_control_1000 = mii_rw(dev, np->phyaddr, MII_CTRL1000, MII_READ);
+                mii_control_1000 = mii_rw(dev, np->phyaddr,
+                                          MII_CTRL1000, MII_READ);
                 mii_control_1000 &= ~ADVERTISE_1000HALF;
                 if (phyinterface & PHY_RGMII)
                         mii_control_1000 |= ADVERTISE_1000FULL;
@@ -1310,11 +1425,11 @@ static int phy_init(struct net_device *dev)
                         mii_control_1000 &= ~ADVERTISE_1000FULL;
 
                 if (mii_rw(dev, np->phyaddr, MII_CTRL1000, mii_control_1000)) {
-                        printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
+                        netdev_info(dev, "%s: phy init failed\n",
+                                    pci_name(np->pci_dev));
                         return PHY_ERROR;
                 }
-        }
-        else
+        } else
                 np->gigabit = 0;
 
         mii_control = mii_rw(dev, np->phyaddr, MII_BMCR, MII_READ);
@@ -1326,7 +1441,8 @@ static int phy_init(struct net_device *dev)
                 /* start autoneg since we already performed hw reset above */
                 mii_control |= BMCR_ANRESTART;
                 if (mii_rw(dev, np->phyaddr, MII_BMCR, mii_control)) {
-                        printk(KERN_INFO "%s: phy init failed\n", pci_name(np->pci_dev));
+                        netdev_info(dev, "%s: phy init failed\n",
+                                    pci_name(np->pci_dev));
                         return PHY_ERROR;
                 }
         } else {
@@ -1334,165 +1450,42 @@ static int phy_init(struct net_device *dev)
                  * (certain phys need bmcr to be setup with reset)
                  */
                 if (phy_reset(dev, mii_control)) {
-                        printk(KERN_INFO "%s: phy reset failed\n", pci_name(np->pci_dev));
+                        netdev_info(dev, "%s: phy reset failed\n",
+                                    pci_name(np->pci_dev));
                         return PHY_ERROR;
                 }
         }
 
         /* phy vendor specific configuration */
-        if ((np->phy_oui == PHY_OUI_CICADA) && (phyinterface & PHY_RGMII) ) {
-                phy_reserved = mii_rw(dev, np->phyaddr, MII_RESV1, MII_READ);
-                phy_reserved &= ~(PHY_CICADA_INIT1 | PHY_CICADA_INIT2);
-                phy_reserved |= (PHY_CICADA_INIT3 | PHY_CICADA_INIT4);
-                if (mii_rw(dev, np->phyaddr, MII_RESV1, phy_reserved)) {
-                        printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                        return PHY_ERROR;
-                }
-                phy_reserved = mii_rw(dev, np->phyaddr, MII_NCONFIG, MII_READ);
-                phy_reserved |= PHY_CICADA_INIT5;
-                if (mii_rw(dev, np->phyaddr, MII_NCONFIG, phy_reserved)) {
-                        printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                        return PHY_ERROR;
-                }
-        }
-        if (np->phy_oui == PHY_OUI_CICADA) {
-                phy_reserved = mii_rw(dev, np->phyaddr, MII_SREVISION, MII_READ);
-                phy_reserved |= PHY_CICADA_INIT6;
-                if (mii_rw(dev, np->phyaddr, MII_SREVISION, phy_reserved)) {
-                        printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                        return PHY_ERROR;
-                }
-        }
-        if (np->phy_oui == PHY_OUI_VITESSE) {
-                if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG1, PHY_VITESSE_INIT1)) {
-                        printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                        return PHY_ERROR;
-                }
-                if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG2, PHY_VITESSE_INIT2)) {
-                        printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                        return PHY_ERROR;
-                }
-                phy_reserved = mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG4, MII_READ);
-                if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG4, phy_reserved)) {
-                        printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                        return PHY_ERROR;
-                }
-                phy_reserved = mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG3, MII_READ);
-                phy_reserved &= ~PHY_VITESSE_INIT_MSK1;
-                phy_reserved |= PHY_VITESSE_INIT3;
-                if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG3, phy_reserved)) {
-                        printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                        return PHY_ERROR;
-                }
-                if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG2, PHY_VITESSE_INIT4)) {
-                        printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                        return PHY_ERROR;
-                }
-                if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG2, PHY_VITESSE_INIT5)) {
-                        printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                        return PHY_ERROR;
-                }
-                phy_reserved = mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG4, MII_READ);
-                phy_reserved &= ~PHY_VITESSE_INIT_MSK1;
-                phy_reserved |= PHY_VITESSE_INIT3;
-                if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG4, phy_reserved)) {
-                        printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                        return PHY_ERROR;
-                }
-                phy_reserved = mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG3, MII_READ);
-                if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG3, phy_reserved)) {
-                        printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
+        if ((np->phy_oui == PHY_OUI_CICADA)) {
+                if (init_cicada(dev, np, phyinterface)) {
+                        netdev_info(dev, "%s: phy init failed\n",
+                                    pci_name(np->pci_dev));
                         return PHY_ERROR;
                 }
-                if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG2, PHY_VITESSE_INIT6)) {
-                        printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
+        } else if (np->phy_oui == PHY_OUI_VITESSE) {
+                if (init_vitesse(dev, np)) {
+                        netdev_info(dev, "%s: phy init failed\n",
+                                    pci_name(np->pci_dev));
                         return PHY_ERROR;
                 }
-                if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG2, PHY_VITESSE_INIT7)) {
-                        printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                        return PHY_ERROR;
-                }
-                phy_reserved = mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG4, MII_READ);
-                if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG4, phy_reserved)) {
-                        printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                        return PHY_ERROR;
-                }
-                phy_reserved = mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG3, MII_READ);
-                phy_reserved &= ~PHY_VITESSE_INIT_MSK2;
-                phy_reserved |= PHY_VITESSE_INIT8;
-                if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG3, phy_reserved)) {
-                        printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                        return PHY_ERROR;
-                }
-                if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG2, PHY_VITESSE_INIT9)) {
-                        printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                        return PHY_ERROR;
-                }
-                if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG1, PHY_VITESSE_INIT10)) {
-                        printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                        return PHY_ERROR;
-                }
-        }
-        if (np->phy_oui == PHY_OUI_REALTEK) {
+        } else if (np->phy_oui == PHY_OUI_REALTEK) {
                 if (np->phy_model == PHY_MODEL_REALTEK_8211 &&
                     np->phy_rev == PHY_REV_REALTEK_8211B) {
                         /* reset could have cleared these out, set them back */
-                        if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT1)) {
-                                printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                                return PHY_ERROR;
-                        }
-                        if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG2, PHY_REALTEK_INIT2)) {
-                                printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                                return PHY_ERROR;
-                        }
-                        if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT3)) {
-                                printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                                return PHY_ERROR;
-                        }
-                        if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG3, PHY_REALTEK_INIT4)) {
-                                printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                                return PHY_ERROR;
-                        }
-                        if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG4, PHY_REALTEK_INIT5)) {
-                                printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                                return PHY_ERROR;
-                        }
-                        if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG5, PHY_REALTEK_INIT6)) {
-                                printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
+                        if (init_realtek_8211b(dev, np)) {
+                                netdev_info(dev, "%s: phy init failed\n",
+                                            pci_name(np->pci_dev));
                                 return PHY_ERROR;
                         }
-                        if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT1)) {
-                                printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
+                } else if (np->phy_model == PHY_MODEL_REALTEK_8201) {
+                        if (init_realtek_8201(dev, np) ||
+                            init_realtek_8201_cross(dev, np)) {
+                                netdev_info(dev, "%s: phy init failed\n",
+                                            pci_name(np->pci_dev));
                                 return PHY_ERROR;
                         }
                 }
-                if (np->phy_model == PHY_MODEL_REALTEK_8201) {
-                        if (np->driver_data & DEV_NEED_PHY_INIT_FIX) {
-                                phy_reserved = mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG6, MII_READ);
-                                phy_reserved |= PHY_REALTEK_INIT7;
-                                if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG6, phy_reserved)) {
-                                        printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                                        return PHY_ERROR;
-                                }
-                        }
-                        if (phy_cross == NV_CROSSOVER_DETECTION_DISABLED) {
-                                if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT3)) {
-                                        printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                                        return PHY_ERROR;
-                                }
-                                phy_reserved = mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG2, MII_READ);
-                                phy_reserved &= ~PHY_REALTEK_INIT_MSK1;
-                                phy_reserved |= PHY_REALTEK_INIT3;
-                                if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG2, phy_reserved)) {
-                                        printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                                        return PHY_ERROR;
-                                }
-                                if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT1)) {
-                                        printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                                        return PHY_ERROR;
-                                }
-                        }
-                }
         }
 
         /* some phys clear out pause advertisment on reset, set it back */
@@ -1501,12 +1494,10 @@ static int phy_init(struct net_device *dev)
         /* restart auto negotiation, power down phy */
         mii_control = mii_rw(dev, np->phyaddr, MII_BMCR, MII_READ);
         mii_control |= (BMCR_ANRESTART | BMCR_ANENABLE);
-        if (phy_power_down) {
+        if (phy_power_down)
                 mii_control |= BMCR_PDOWN;
-        }
-        if (mii_rw(dev, np->phyaddr, MII_BMCR, mii_control)) {
+        if (mii_rw(dev, np->phyaddr, MII_BMCR, mii_control))
                 return PHY_ERROR;
-        }
 
         return 0;
 }
@@ -1517,7 +1508,6 @@ static void nv_start_rx(struct net_device *dev)
         u8 __iomem *base = get_hwbase(dev);
         u32 rx_ctrl = readl(base + NvRegReceiverControl);
 
-        dprintk(KERN_DEBUG "%s: nv_start_rx\n", dev->name);
         /* Already running? Stop it. */
         if ((readl(base + NvRegReceiverControl) & NVREG_RCVCTL_START) && !np->mac_in_use) {
                 rx_ctrl &= ~NVREG_RCVCTL_START;
@@ -1526,12 +1516,10 @@ static void nv_start_rx(struct net_device *dev)
         }
         writel(np->linkspeed, base + NvRegLinkSpeed);
         pci_push(base);
-        rx_ctrl |= NVREG_RCVCTL_START;
-        if (np->mac_in_use)
+        rx_ctrl |= NVREG_RCVCTL_START;
+        if (np->mac_in_use)
                 rx_ctrl &= ~NVREG_RCVCTL_RX_PATH_EN;
         writel(rx_ctrl, base + NvRegReceiverControl);
-        dprintk(KERN_DEBUG "%s: nv_start_rx to duplex %d, speed 0x%08x.\n",
-                                dev->name, np->duplex, np->linkspeed);
         pci_push(base);
 }
 
@@ -1541,15 +1529,15 @@ static void nv_stop_rx(struct net_device *dev)
         u8 __iomem *base = get_hwbase(dev);
         u32 rx_ctrl = readl(base + NvRegReceiverControl);
 
-        dprintk(KERN_DEBUG "%s: nv_stop_rx\n", dev->name);
         if (!np->mac_in_use)
                 rx_ctrl &= ~NVREG_RCVCTL_START;
         else
                 rx_ctrl |= NVREG_RCVCTL_RX_PATH_EN;
         writel(rx_ctrl, base + NvRegReceiverControl);
-        reg_delay(dev, NvRegReceiverStatus, NVREG_RCVSTAT_BUSY, 0,
-                        NV_RXSTOP_DELAY1, NV_RXSTOP_DELAY1MAX,
-                        KERN_INFO "nv_stop_rx: ReceiverStatus remained busy");
+        if (reg_delay(dev, NvRegReceiverStatus, NVREG_RCVSTAT_BUSY, 0,
+                      NV_RXSTOP_DELAY1, NV_RXSTOP_DELAY1MAX))
+                netdev_info(dev, "%s: ReceiverStatus remained busy\n",
+                            __func__);
 
         udelay(NV_RXSTOP_DELAY2);
         if (!np->mac_in_use)
@@ -1562,7 +1550,6 @@ static void nv_start_tx(struct net_device *dev)
         u8 __iomem *base = get_hwbase(dev);
         u32 tx_ctrl = readl(base + NvRegTransmitterControl);
 
-        dprintk(KERN_DEBUG "%s: nv_start_tx\n", dev->name);
         tx_ctrl |= NVREG_XMITCTL_START;
         if (np->mac_in_use)
                 tx_ctrl &= ~NVREG_XMITCTL_TX_PATH_EN;
@@ -1576,15 +1563,15 @@ static void nv_stop_tx(struct net_device *dev)
         u8 __iomem *base = get_hwbase(dev);
         u32 tx_ctrl = readl(base + NvRegTransmitterControl);
 
-        dprintk(KERN_DEBUG "%s: nv_stop_tx\n", dev->name);
         if (!np->mac_in_use)
                 tx_ctrl &= ~NVREG_XMITCTL_START;
         else
                 tx_ctrl |= NVREG_XMITCTL_TX_PATH_EN;
         writel(tx_ctrl, base + NvRegTransmitterControl);
-        reg_delay(dev, NvRegTransmitterStatus, NVREG_XMITSTAT_BUSY, 0,
-                        NV_TXSTOP_DELAY1, NV_TXSTOP_DELAY1MAX,
-                        KERN_INFO "nv_stop_tx: TransmitterStatus remained busy");
+        if (reg_delay(dev, NvRegTransmitterStatus, NVREG_XMITSTAT_BUSY, 0,
+                      NV_TXSTOP_DELAY1, NV_TXSTOP_DELAY1MAX))
+                netdev_info(dev, "%s: TransmitterStatus remained busy\n",
+                            __func__);
 
         udelay(NV_TXSTOP_DELAY2);
         if (!np->mac_in_use)
@@ -1609,7 +1596,6 @@ static void nv_txrx_reset(struct net_device *dev)
         struct fe_priv *np = netdev_priv(dev);
         u8 __iomem *base = get_hwbase(dev);
 
-        dprintk(KERN_DEBUG "%s: nv_txrx_reset\n", dev->name);
         writel(NVREG_TXRXCTL_BIT2 | NVREG_TXRXCTL_RESET | np->txrxctl_bits, base + NvRegTxRxControl);
         pci_push(base);
         udelay(NV_TXRX_RESET_DELAY);
@@ -1623,8 +1609,6 @@ static void nv_mac_reset(struct net_device *dev)
         u8 __iomem *base = get_hwbase(dev);
         u32 temp1, temp2, temp3;
 
-        dprintk(KERN_DEBUG "%s: nv_mac_reset\n", dev->name);
-
         writel(NVREG_TXRXCTL_BIT2 | NVREG_TXRXCTL_RESET | np->txrxctl_bits, base + NvRegTxRxControl);
         pci_push(base);
 
@@ -1745,7 +1729,7 @@ static struct net_device_stats *nv_get_stats(struct net_device *dev)
 static int nv_alloc_rx(struct net_device *dev)
 {
         struct fe_priv *np = netdev_priv(dev);
-        struct ring_desc* less_rx;
+        struct ring_desc *less_rx;
 
         less_rx = np->get_rx.orig;
         if (less_rx-- == np->first_rx.orig)
@@ -1767,9 +1751,8 @@ static int nv_alloc_rx(struct net_device *dev)
                                 np->put_rx.orig = np->first_rx.orig;
                         if (unlikely(np->put_rx_ctx++ == np->last_rx_ctx))
                                 np->put_rx_ctx = np->first_rx_ctx;
-                } else {
+                } else
                         return 1;
-                }
         }
         return 0;
 }
@@ -1777,7 +1760,7 @@ static int nv_alloc_rx(struct net_device *dev)
 static int nv_alloc_rx_optimized(struct net_device *dev)
 {
         struct fe_priv *np = netdev_priv(dev);
-        struct ring_desc_ex* less_rx;
+        struct ring_desc_ex *less_rx;
 
         less_rx = np->get_rx.ex;
         if (less_rx-- == np->first_rx.ex)
@@ -1800,9 +1783,8 @@ static int nv_alloc_rx_optimized(struct net_device *dev)
                                 np->put_rx.ex = np->first_rx.ex;
                         if (unlikely(np->put_rx_ctx++ == np->last_rx_ctx))
                                 np->put_rx_ctx = np->first_rx_ctx;
-                } else {
+                } else
                         return 1;
-                }
         }
         return 0;
 }
@@ -2018,24 +2000,24 @@ static void nv_legacybackoff_reseed(struct net_device *dev)
 
 /* Known Good seed sets */
 static const u32 main_seedset[BACKOFF_SEEDSET_ROWS][BACKOFF_SEEDSET_LFSRS] = {
-    {145, 155, 165, 175, 185, 196, 235, 245, 255, 265, 275, 285, 660, 690, 874},
-    {245, 255, 265, 575, 385, 298, 335, 345, 355, 366, 375, 385, 761, 790, 974},
-    {145, 155, 165, 175, 185, 196, 235, 245, 255, 265, 275, 285, 660, 690, 874},
-    {245, 255, 265, 575, 385, 298, 335, 345, 355, 366, 375, 386, 761, 790, 974},
-    {266, 265, 276, 585, 397, 208, 345, 355, 365, 376, 385, 396, 771, 700, 984},
-    {266, 265, 276, 586, 397, 208, 346, 355, 365, 376, 285, 396, 771, 700, 984},
-    {366, 365, 376, 686, 497, 308, 447, 455, 466, 476, 485, 496, 871, 800,  84},
-    {466, 465, 476, 786, 597, 408, 547, 555, 566, 576, 585, 597, 971, 900, 184}};
+        {145, 155, 165, 175, 185, 196, 235, 245, 255, 265, 275, 285, 660, 690, 874},
+        {245, 255, 265, 575, 385, 298, 335, 345, 355, 366, 375, 385, 761, 790, 974},
+        {145, 155, 165, 175, 185, 196, 235, 245, 255, 265, 275, 285, 660, 690, 874},
+        {245, 255, 265, 575, 385, 298, 335, 345, 355, 366, 375, 386, 761, 790, 974},
+        {266, 265, 276, 585, 397, 208, 345, 355, 365, 376, 385, 396, 771, 700, 984},
+        {266, 265, 276, 586, 397, 208, 346, 355, 365, 376, 285, 396, 771, 700, 984},
+        {366, 365, 376, 686, 497, 308, 447, 455, 466, 476, 485, 496, 871, 800,  84},
+        {466, 465, 476, 786, 597, 408, 547, 555, 566, 576, 585, 597, 971, 900, 184} };
 
 static const u32 gear_seedset[BACKOFF_SEEDSET_ROWS][BACKOFF_SEEDSET_LFSRS] = {
-    {251, 262, 273, 324, 319, 508, 375, 364, 341, 371, 398, 193, 375,  30, 295},
-    {351, 375, 373, 469, 551, 639, 477, 464, 441, 472, 498, 293, 476, 130, 395},
-    {351, 375, 373, 469, 551, 639, 477, 464, 441, 472, 498, 293, 476, 130, 397},
-    {251, 262, 273, 324, 319, 508, 375, 364, 341, 371, 398, 193, 375,  30, 295},
-    {251, 262, 273, 324, 319, 508, 375, 364, 341, 371, 398, 193, 375,  30, 295},
-    {351, 375, 373, 469, 551, 639, 477, 464, 441, 472, 498, 293, 476, 130, 395},
-    {351, 375, 373, 469, 551, 639, 477, 464, 441, 472, 498, 293, 476, 130, 395},
-    {351, 375, 373, 469, 551, 639, 477, 464, 441, 472, 498, 293, 476, 130, 395}};
+        {251, 262, 273, 324, 319, 508, 375, 364, 341, 371, 398, 193, 375,  30, 295},
+        {351, 375, 373, 469, 551, 639, 477, 464, 441, 472, 498, 293, 476, 130, 395},
+        {351, 375, 373, 469, 551, 639, 477, 464, 441, 472, 498, 293, 476, 130, 397},
+        {251, 262, 273, 324, 319, 508, 375, 364, 341, 371, 398, 193, 375,  30, 295},
+        {251, 262, 273, 324, 319, 508, 375, 364, 341, 371, 398, 193, 375,  30, 295},
+        {351, 375, 373, 469, 551, 639, 477, 464, 441, 472, 498, 293, 476, 130, 395},
+        {351, 375, 373, 469, 551, 639, 477, 464, 441, 472, 498, 293, 476, 130, 395},
+        {351, 375, 373, 469, 551, 639, 477, 464, 441, 472, 498, 293, 476, 130, 395} };
 
 static void nv_gear_backoff_reseed(struct net_device *dev)
 {
@@ -2083,13 +2065,12 @@ static void nv_gear_backoff_reseed(struct net_device *dev)
         temp = NVREG_BKOFFCTRL_DEFAULT | (0 << NVREG_BKOFFCTRL_SELECT);
         temp |= combinedSeed & NVREG_BKOFFCTRL_SEED_MASK;
         temp |= combinedSeed >> NVREG_BKOFFCTRL_GEAR;
-        writel(temp,base + NvRegBackOffControl);
+        writel(temp, base + NvRegBackOffControl);
 
-        /* Setup seeds for all gear LFSRs. */
+        /* Setup seeds for all gear LFSRs. */
         get_random_bytes(&seedset, sizeof(seedset));
         seedset = seedset % BACKOFF_SEEDSET_ROWS;
-        for (i = 1; i <= BACKOFF_SEEDSET_LFSRS; i++)
-        {
+        for (i = 1; i <= BACKOFF_SEEDSET_LFSRS; i++) {
                 temp = NVREG_BKOFFCTRL_DEFAULT | (i << NVREG_BKOFFCTRL_SELECT);
                 temp |= main_seedset[seedset][i-1] & 0x3ff;
                 temp |= ((gear_seedset[seedset][i-1] & 0x3ff) << NVREG_BKOFFCTRL_GEAR);
@@ -2113,10 +2094,10 @@ static netdev_tx_t nv_start_xmit(struct sk_buff *skb, struct net_device *dev)
         u32 size = skb_headlen(skb);
         u32 entries = (size >> NV_TX2_TSO_MAX_SHIFT) + ((size & (NV_TX2_TSO_MAX_SIZE-1)) ? 1 : 0);
         u32 empty_slots;
-        struct ring_desc* put_tx;
-        struct ring_desc* start_tx;
-        struct ring_desc* prev_tx;
-        struct nv_skb_map* prev_tx_ctx;
+        struct ring_desc *put_tx;
+        struct ring_desc *start_tx;
+        struct ring_desc *prev_tx;
+        struct nv_skb_map *prev_tx_ctx;
         unsigned long flags;
 
         /* add fragments to entries count */
@@ -2204,18 +2185,6 @@ static netdev_tx_t nv_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         spin_unlock_irqrestore(&np->lock, flags);
 
-        dprintk(KERN_DEBUG "%s: nv_start_xmit: entries %d queued for transmission. tx_flags_extra: %x\n",
-                dev->name, entries, tx_flags_extra);
-        {
-                int j;
-                for (j=0; j<64; j++) {
-                        if ((j%16) == 0)
-                                dprintk("\n%03x:", j);
-                        dprintk(" %02x", ((unsigned char*)skb->data)[j]);
-                }
-                dprintk("\n");
-        }
-
         writel(NVREG_TXRXCTL_KICK|np->txrxctl_bits, get_hwbase(dev) + NvRegTxRxControl);
         return NETDEV_TX_OK;
 }
@@ -2233,11 +2202,11 @@ static netdev_tx_t nv_start_xmit_optimized(struct sk_buff *skb,
         u32 size = skb_headlen(skb);
         u32 entries = (size >> NV_TX2_TSO_MAX_SHIFT) + ((size & (NV_TX2_TSO_MAX_SIZE-1)) ? 1 : 0);
         u32 empty_slots;
-        struct ring_desc_ex* put_tx;
-        struct ring_desc_ex* start_tx;
-        struct ring_desc_ex* prev_tx;
-        struct nv_skb_map* prev_tx_ctx;
-        struct nv_skb_map* start_tx_ctx;
+        struct ring_desc_ex *put_tx;
+        struct ring_desc_ex *start_tx;
+        struct ring_desc_ex *prev_tx;
+        struct nv_skb_map *prev_tx_ctx;
+        struct nv_skb_map *start_tx_ctx;
         unsigned long flags;
 
         /* add fragments to entries count */
@@ -2355,18 +2324,6 @@ static netdev_tx_t nv_start_xmit_optimized(struct sk_buff *skb,
 
         spin_unlock_irqrestore(&np->lock, flags);
 
-        dprintk(KERN_DEBUG "%s: nv_start_xmit_optimized: entries %d queued for transmission. tx_flags_extra: %x\n",
-                dev->name, entries, tx_flags_extra);
-        {
-                int j;
-                for (j=0; j<64; j++) {
-                        if ((j%16) == 0)
-                                dprintk("\n%03x:", j);
-                        dprintk(" %02x", ((unsigned char*)skb->data)[j]);
-                }
-                dprintk("\n");
-        }
-
         writel(NVREG_TXRXCTL_KICK|np->txrxctl_bits, get_hwbase(dev) + NvRegTxRxControl);
         return NETDEV_TX_OK;
 }
@@ -2399,15 +2356,12 @@ static int nv_tx_done(struct net_device *dev, int limit)
         struct fe_priv *np = netdev_priv(dev);
         u32 flags;
         int tx_work = 0;
-        struct ring_desc* orig_get_tx = np->get_tx.orig;
+        struct ring_desc *orig_get_tx = np->get_tx.orig;
 
         while ((np->get_tx.orig != np->put_tx.orig) &&
                !((flags = le32_to_cpu(np->get_tx.orig->flaglen)) & NV_TX_VALID) &&
                (tx_work < limit)) {
 
-                dprintk(KERN_DEBUG "%s: nv_tx_done: flags 0x%x.\n",
-                                        dev->name, flags);
-
                 nv_unmap_txskb(np, np->get_tx_ctx);
 
                 if (np->desc_ver == DESC_VER_1) {
@@ -2464,15 +2418,12 @@ static int nv_tx_done_optimized(struct net_device *dev, int limit)
         struct fe_priv *np = netdev_priv(dev);
         u32 flags;
         int tx_work = 0;
-        struct ring_desc_ex* orig_get_tx = np->get_tx.ex;
+        struct ring_desc_ex *orig_get_tx = np->get_tx.ex;
 
         while ((np->get_tx.ex != np->put_tx.ex) &&
                !((flags = le32_to_cpu(np->get_tx.ex->flaglen)) & NV_TX2_VALID) &&
                (tx_work < limit)) {
 
-                dprintk(KERN_DEBUG "%s: nv_tx_done_optimized: flags 0x%x.\n",
-                                        dev->name, flags);
-
                 nv_unmap_txskb(np, np->get_tx_ctx);
 
                 if (flags & NV_TX2_LASTPACKET) {
@@ -2491,9 +2442,8 @@ static int nv_tx_done_optimized(struct net_device *dev, int limit)
                         np->get_tx_ctx->skb = NULL;
                         tx_work++;
 
-                        if (np->tx_limit) {
+                        if (np->tx_limit)
                                 nv_tx_flip_ownership(dev);
-                        }
                 }
                 if (unlikely(np->get_tx.ex++ == np->last_tx.ex))
                         np->get_tx.ex = np->first_tx.ex;
@@ -2518,57 +2468,56 @@ static void nv_tx_timeout(struct net_device *dev)
         u32 status;
         union ring_type put_tx;
         int saved_tx_limit;
+        int i;
 
         if (np->msi_flags & NV_MSI_X_ENABLED)
                 status = readl(base + NvRegMSIXIrqStatus) & NVREG_IRQSTAT_MASK;
         else
                 status = readl(base + NvRegIrqStatus) & NVREG_IRQSTAT_MASK;
 
-        printk(KERN_INFO "%s: Got tx_timeout. irq: %08x\n", dev->name, status);
-
-        {
-                int i;
-
-                printk(KERN_INFO "%s: Ring at %lx\n",
-                       dev->name, (unsigned long)np->ring_addr);
-                printk(KERN_INFO "%s: Dumping tx registers\n", dev->name);
-                for (i=0;i<=np->register_size;i+= 32) {
-                        printk(KERN_INFO "%3x: %08x %08x %08x %08x %08x %08x %08x %08x\n",
-                                        i,
-                                        readl(base + i + 0), readl(base + i + 4),
-                                        readl(base + i + 8), readl(base + i + 12),
-                                        readl(base + i + 16), readl(base + i + 20),
-                                        readl(base + i + 24), readl(base + i + 28));
-                }
-                printk(KERN_INFO "%s: Dumping tx ring\n", dev->name);
-                for (i=0;i<np->tx_ring_size;i+= 4) {
-                        if (!nv_optimized(np)) {
-                                printk(KERN_INFO "%03x: %08x %08x // %08x %08x // %08x %08x // %08x %08x\n",
-                                       i,
-                                       le32_to_cpu(np->tx_ring.orig[i].buf),
-                                       le32_to_cpu(np->tx_ring.orig[i].flaglen),
-                                       le32_to_cpu(np->tx_ring.orig[i+1].buf),
-                                       le32_to_cpu(np->tx_ring.orig[i+1].flaglen),
-                                       le32_to_cpu(np->tx_ring.orig[i+2].buf),
-                                       le32_to_cpu(np->tx_ring.orig[i+2].flaglen),
-                                       le32_to_cpu(np->tx_ring.orig[i+3].buf),
-                                       le32_to_cpu(np->tx_ring.orig[i+3].flaglen));
-                        } else {
-                                printk(KERN_INFO "%03x: %08x %08x %08x // %08x %08x %08x // %08x %08x %08x // %08x %08x %08x\n",
-                                       i,
-                                       le32_to_cpu(np->tx_ring.ex[i].bufhigh),
-                                       le32_to_cpu(np->tx_ring.ex[i].buflow),
-                                       le32_to_cpu(np->tx_ring.ex[i].flaglen),
-                                       le32_to_cpu(np->tx_ring.ex[i+1].bufhigh),
-                                       le32_to_cpu(np->tx_ring.ex[i+1].buflow),
-                                       le32_to_cpu(np->tx_ring.ex[i+1].flaglen),
-                                       le32_to_cpu(np->tx_ring.ex[i+2].bufhigh),
-                                       le32_to_cpu(np->tx_ring.ex[i+2].buflow),
-                                       le32_to_cpu(np->tx_ring.ex[i+2].flaglen),
-                                       le32_to_cpu(np->tx_ring.ex[i+3].bufhigh),
-                                       le32_to_cpu(np->tx_ring.ex[i+3].buflow),
-                                       le32_to_cpu(np->tx_ring.ex[i+3].flaglen));
-                        }
+        netdev_info(dev, "Got tx_timeout. irq: %08x\n", status);
+
+        netdev_info(dev, "Ring at %lx\n", (unsigned long)np->ring_addr);
+        netdev_info(dev, "Dumping tx registers\n");
+        for (i = 0; i <= np->register_size; i += 32) {
+                netdev_info(dev,
+                            "%3x: %08x %08x %08x %08x %08x %08x %08x %08x\n",
+                            i,
+                            readl(base + i + 0), readl(base + i + 4),
+                            readl(base + i + 8), readl(base + i + 12),
+                            readl(base + i + 16), readl(base + i + 20),
+                            readl(base + i + 24), readl(base + i + 28));
+        }
+        netdev_info(dev, "Dumping tx ring\n");
+        for (i = 0; i < np->tx_ring_size; i += 4) {
+                if (!nv_optimized(np)) {
+                        netdev_info(dev,
+                                    "%03x: %08x %08x // %08x %08x // %08x %08x // %08x %08x\n",
+                                    i,
+                                    le32_to_cpu(np->tx_ring.orig[i].buf),
+                                    le32_to_cpu(np->tx_ring.orig[i].flaglen),
+                                    le32_to_cpu(np->tx_ring.orig[i+1].buf),
+                                    le32_to_cpu(np->tx_ring.orig[i+1].flaglen),
+                                    le32_to_cpu(np->tx_ring.orig[i+2].buf),
+                                    le32_to_cpu(np->tx_ring.orig[i+2].flaglen),
+                                    le32_to_cpu(np->tx_ring.orig[i+3].buf),
+                                    le32_to_cpu(np->tx_ring.orig[i+3].flaglen));
+                } else {
+                        netdev_info(dev,
+                                    "%03x: %08x %08x %08x // %08x %08x %08x // %08x %08x %08x // %08x %08x %08x\n",
+                                    i,
+                                    le32_to_cpu(np->tx_ring.ex[i].bufhigh),
+                                    le32_to_cpu(np->tx_ring.ex[i].buflow),
+                                    le32_to_cpu(np->tx_ring.ex[i].flaglen),
+                                    le32_to_cpu(np->tx_ring.ex[i+1].bufhigh),
+                                    le32_to_cpu(np->tx_ring.ex[i+1].buflow),
+                                    le32_to_cpu(np->tx_ring.ex[i+1].flaglen),
+                                    le32_to_cpu(np->tx_ring.ex[i+2].bufhigh),
+                                    le32_to_cpu(np->tx_ring.ex[i+2].buflow),
+                                    le32_to_cpu(np->tx_ring.ex[i+2].flaglen),
+                                    le32_to_cpu(np->tx_ring.ex[i+3].bufhigh),
+                                    le32_to_cpu(np->tx_ring.ex[i+3].buflow),
+                                    le32_to_cpu(np->tx_ring.ex[i+3].flaglen));
                 }
         }
 
@@ -2616,15 +2565,13 @@ static int nv_getlen(struct net_device *dev, void *packet, int datalen)
         int protolen;   /* length as stored in the proto field */
 
         /* 1) calculate len according to header */
-        if ( ((struct vlan_ethhdr *)packet)->h_vlan_proto == htons(ETH_P_8021Q)) {
-                protolen = ntohs( ((struct vlan_ethhdr *)packet)->h_vlan_encapsulated_proto );
+        if (((struct vlan_ethhdr *)packet)->h_vlan_proto == htons(ETH_P_8021Q)) {
+                protolen = ntohs(((struct vlan_ethhdr *)packet)->h_vlan_encapsulated_proto);
                 hdrlen = VLAN_HLEN;
         } else {
-                protolen = ntohs( ((struct ethhdr *)packet)->h_proto);
+                protolen = ntohs(((struct ethhdr *)packet)->h_proto);
                 hdrlen = ETH_HLEN;
         }
-        dprintk(KERN_DEBUG "%s: nv_getlen: datalen %d, protolen %d, hdrlen %d\n",
-                                dev->name, datalen, protolen, hdrlen);
         if (protolen > ETH_DATA_LEN)
                 return datalen; /* Value in proto field not a len, no checks possible */
 
@@ -2635,26 +2582,18 @@ static int nv_getlen(struct net_device *dev, void *packet, int datalen)
                         /* more data on wire than in 802 header, trim of
                          * additional data.
                          */
-                        dprintk(KERN_DEBUG "%s: nv_getlen: accepting %d bytes.\n",
-                                        dev->name, protolen);
                         return protolen;
                 } else {
                         /* less data on wire than mentioned in header.
                          * Discard the packet.
                          */
-                        dprintk(KERN_DEBUG "%s: nv_getlen: discarding long packet.\n",
-                                        dev->name);
                         return -1;
                 }
         } else {
                 /* short packet. Accept only if 802 values are also short */
                 if (protolen > ETH_ZLEN) {
-                        dprintk(KERN_DEBUG "%s: nv_getlen: discarding short packet.\n",
-                                        dev->name);
                         return -1;
                 }
-                dprintk(KERN_DEBUG "%s: nv_getlen: accepting %d bytes.\n",
-                                dev->name, datalen);
                 return datalen;
         }
 }
@@ -2667,13 +2606,10 @@ static int nv_rx_process(struct net_device *dev, int limit)
         struct sk_buff *skb;
         int len;
 
-        while((np->get_rx.orig != np->put_rx.orig) &&
+        while ((np->get_rx.orig != np->put_rx.orig) &&
               !((flags = le32_to_cpu(np->get_rx.orig->flaglen)) & NV_RX_AVAIL) &&
                 (rx_work < limit)) {
 
-                dprintk(KERN_DEBUG "%s: nv_rx_process: flags 0x%x.\n",
-                                        dev->name, flags);
-
                 /*
                  * the packet is for us - immediately tear down the pci mapping.
                  * TODO: check if a prefetch of the first cacheline improves
@@ -2685,16 +2621,6 @@ static int nv_rx_process(struct net_device *dev, int limit)
                 skb = np->get_rx_ctx->skb;
                 np->get_rx_ctx->skb = NULL;
 
-                {
-                        int j;
-                        dprintk(KERN_DEBUG "Dumping packet (flags 0x%x).",flags);
-                        for (j=0; j<64; j++) {
-                                if ((j%16) == 0)
-                                        dprintk("\n%03x:", j);
-                                dprintk(" %02x", ((unsigned char*)skb->data)[j]);
-                        }
-                        dprintk("\n");
-                }
                 /* look at what we actually got: */
                 if (np->desc_ver == DESC_VER_1) {
                         if (likely(flags & NV_RX_DESCRIPTORVALID)) {
@@ -2710,9 +2636,8 @@ static int nv_rx_process(struct net_device *dev, int limit)
                                         }
                                         /* framing errors are soft errors */
                                         else if ((flags & NV_RX_ERROR_MASK) == NV_RX_FRAMINGERR) {
-                                                if (flags & NV_RX_SUBSTRACT1) {
+                                                if (flags & NV_RX_SUBSTRACT1)
                                                         len--;
-                                                }
                                         }
                                         /* the rest are hard errors */
                                         else {
@@ -2745,9 +2670,8 @@ static int nv_rx_process(struct net_device *dev, int limit)
                                         }
                                         /* framing errors are soft errors */
                                         else if ((flags & NV_RX2_ERROR_MASK) == NV_RX2_FRAMINGERR) {
-                                                if (flags & NV_RX2_SUBSTRACT1) {
+                                                if (flags & NV_RX2_SUBSTRACT1)
                                                         len--;
-                                                }
                                         }
                                         /* the rest are hard errors */
                                         else {
@@ -2771,8 +2695,6 @@ static int nv_rx_process(struct net_device *dev, int limit)
                 /* got a valid packet - forward it to the network core */
                 skb_put(skb, len);
                 skb->protocol = eth_type_trans(skb, dev);
-                dprintk(KERN_DEBUG "%s: nv_rx_process: %d bytes, proto %d accepted.\n",
-                                        dev->name, len, skb->protocol);
                 napi_gro_receive(&np->napi, skb);
                 dev->stats.rx_packets++;
                 dev->stats.rx_bytes += len;
@@ -2797,13 +2719,10 @@ static int nv_rx_process_optimized(struct net_device *dev, int limit)
         struct sk_buff *skb;
         int len;
 
-        while((np->get_rx.ex != np->put_rx.ex) &&
+        while ((np->get_rx.ex != np->put_rx.ex) &&
               !((flags = le32_to_cpu(np->get_rx.ex->flaglen)) & NV_RX2_AVAIL) &&
               (rx_work < limit)) {
 
-                dprintk(KERN_DEBUG "%s: nv_rx_process_optimized: flags 0x%x.\n",
-                                        dev->name, flags);
-
                 /*
                  * the packet is for us - immediately tear down the pci mapping.
                  * TODO: check if a prefetch of the first cacheline improves
@@ -2815,16 +2734,6 @@ static int nv_rx_process_optimized(struct net_device *dev, int limit)
                 skb = np->get_rx_ctx->skb;
                 np->get_rx_ctx->skb = NULL;
 
-                {
-                        int j;
-                        dprintk(KERN_DEBUG "Dumping packet (flags 0x%x).",flags);
-                        for (j=0; j<64; j++) {
-                                if ((j%16) == 0)
-                                        dprintk("\n%03x:", j);
-                                dprintk(" %02x", ((unsigned char*)skb->data)[j]);
-                        }
-                        dprintk("\n");
-                }
                 /* look at what we actually got: */
                 if (likely(flags & NV_RX2_DESCRIPTORVALID)) {
                         len = flags & LEN_MASK_V2;
@@ -2838,9 +2747,8 @@ static int nv_rx_process_optimized(struct net_device *dev, int limit)
                                 }
                                 /* framing errors are soft errors */
                                 else if ((flags & NV_RX2_ERROR_MASK) == NV_RX2_FRAMINGERR) {
-                                        if (flags & NV_RX2_SUBSTRACT1) {
+                                        if (flags & NV_RX2_SUBSTRACT1)
                                                 len--;
-                                        }
                                 }
                                 /* the rest are hard errors */
                                 else {
@@ -2858,9 +2766,6 @@ static int nv_rx_process_optimized(struct net_device *dev, int limit)
                         skb->protocol = eth_type_trans(skb, dev);
                         prefetch(skb->data);
 
-                        dprintk(KERN_DEBUG "%s: nv_rx_process_optimized: %d bytes, proto %d accepted.\n",
-                                dev->name, len, skb->protocol);
-
                         if (likely(!np->vlangrp)) {
                                 napi_gro_receive(&np->napi, skb);
                         } else {
@@ -2949,7 +2854,7 @@ static int nv_change_mtu(struct net_device *dev, int new_mtu)
                 /* reinit nic view of the rx queue */
                 writel(np->rx_buf_sz, base + NvRegOffloadConfig);
                 setup_hw_rings(dev, NV_SETUP_RX_RING | NV_SETUP_TX_RING);
-                writel( ((np->rx_ring_size-1) << NVREG_RINGSZ_RXSHIFT) + ((np->tx_ring_size-1) << NVREG_RINGSZ_TXSHIFT),
+                writel(((np->rx_ring_size-1) << NVREG_RINGSZ_RXSHIFT) + ((np->tx_ring_size-1) << NVREG_RINGSZ_TXSHIFT),
                         base + NvRegRingSizes);
                 pci_push(base);
                 writel(NVREG_TXRXCTL_KICK|np->txrxctl_bits, get_hwbase(dev) + NvRegTxRxControl);
@@ -2986,7 +2891,7 @@ static void nv_copy_mac_to_hw(struct net_device *dev)
 static int nv_set_mac_address(struct net_device *dev, void *addr)
 {
         struct fe_priv *np = netdev_priv(dev);
-        struct sockaddr *macaddr = (struct sockaddr*)addr;
+        struct sockaddr *macaddr = (struct sockaddr *)addr;
 
         if (!is_valid_ether_addr(macaddr->sa_data))
                 return -EADDRNOTAVAIL;
@@ -3076,8 +2981,6 @@ static void nv_set_multicast(struct net_device *dev)
         writel(mask[0], base + NvRegMulticastMaskA);
         writel(mask[1], base + NvRegMulticastMaskB);
         writel(pff, base + NvRegPacketFilterFlags);
-        dprintk(KERN_INFO "%s: reconfiguration for multicast lists.\n",
-                dev->name);
         nv_start_rx(dev);
         spin_unlock_irq(&np->lock);
 }
@@ -3152,8 +3055,6 @@ static int nv_update_linkspeed(struct net_device *dev)
         mii_status = mii_rw(dev, np->phyaddr, MII_BMSR, MII_READ);
 
         if (!(mii_status & BMSR_LSTATUS)) {
-                dprintk(KERN_DEBUG "%s: no link detected by phy - falling back to 10HD.\n",
-                                dev->name);
                 newls = NVREG_LINKSPEED_FORCE|NVREG_LINKSPEED_10;
                 newdup = 0;
                 retval = 0;
@@ -3161,8 +3062,6 @@ static int nv_update_linkspeed(struct net_device *dev)
         }
 
         if (np->autoneg == 0) {
-                dprintk(KERN_DEBUG "%s: nv_update_linkspeed: autoneg off, PHY set to 0x%04x.\n",
-                                dev->name, np->fixed_mode);
                 if (np->fixed_mode & LPA_100FULL) {
                         newls = NVREG_LINKSPEED_FORCE|NVREG_LINKSPEED_100;
                         newdup = 1;
@@ -3185,14 +3084,11 @@ static int nv_update_linkspeed(struct net_device *dev)
                 newls = NVREG_LINKSPEED_FORCE|NVREG_LINKSPEED_10;
                 newdup = 0;
                 retval = 0;
-                dprintk(KERN_DEBUG "%s: autoneg not completed - falling back to 10HD.\n", dev->name);
                 goto set_speed;
         }
 
         adv = mii_rw(dev, np->phyaddr, MII_ADVERTISE, MII_READ);
         lpa = mii_rw(dev, np->phyaddr, MII_LPA, MII_READ);
-        dprintk(KERN_DEBUG "%s: nv_update_linkspeed: PHY advertises 0x%04x, lpa 0x%04x.\n",
-                                dev->name, adv, lpa);
 
         retval = 1;
         if (np->gigabit == PHY_GIGABIT) {
@@ -3201,8 +3097,6 @@ static int nv_update_linkspeed(struct net_device *dev)
 
                 if ((control_1000 & ADVERTISE_1000FULL) &&
                         (status_1000 & LPA_1000FULL)) {
-                        dprintk(KERN_DEBUG "%s: nv_update_linkspeed: GBit ethernet detected.\n",
-                                dev->name);
                         newls = NVREG_LINKSPEED_FORCE|NVREG_LINKSPEED_1000;
                         newdup = 1;
                         goto set_speed;
@@ -3224,7 +3118,6 @@ static int nv_update_linkspeed(struct net_device *dev)
                 newls = NVREG_LINKSPEED_FORCE|NVREG_LINKSPEED_10;
                 newdup = 0;
         } else {
-                dprintk(KERN_DEBUG "%s: bad ability %04x - falling back to 10HD.\n", dev->name, adv_lpa);
                 newls = NVREG_LINKSPEED_FORCE|NVREG_LINKSPEED_10;
                 newdup = 0;
         }
@@ -3233,9 +3126,6 @@ set_speed:
         if (np->duplex == newdup && np->linkspeed == newls)
                 return retval;
 
-        dprintk(KERN_INFO "%s: changing link setting from %d/%d to %d/%d.\n",
-                        dev->name, np->linkspeed, np->duplex, newls, newdup);
-
         np->duplex = newdup;
         np->linkspeed = newls;
 
@@ -3302,7 +3192,7 @@ set_speed:
         }
         writel(txreg, base + NvRegTxWatermark);
 
-        writel(NVREG_MISC1_FORCE | ( np->duplex ? 0 : NVREG_MISC1_HD),
+        writel(NVREG_MISC1_FORCE | (np->duplex ? 0 : NVREG_MISC1_HD),
                 base + NvRegMisc1);
         pci_push(base);
         writel(np->linkspeed, base + NvRegLinkSpeed);
@@ -3312,8 +3202,8 @@ set_speed:
         /* setup pause frame */
         if (np->duplex != 0) {
                 if (np->autoneg && np->pause_flags & NV_PAUSEFRAME_AUTONEG) {
-                        adv_pause = adv & (ADVERTISE_PAUSE_CAP| ADVERTISE_PAUSE_ASYM);
-                        lpa_pause = lpa & (LPA_PAUSE_CAP| LPA_PAUSE_ASYM);
+                        adv_pause = adv & (ADVERTISE_PAUSE_CAP | ADVERTISE_PAUSE_ASYM);
+                        lpa_pause = lpa & (LPA_PAUSE_CAP | LPA_PAUSE_ASYM);
 
                         switch (adv_pause) {
                         case ADVERTISE_PAUSE_CAP:
@@ -3324,22 +3214,17 @@ set_speed:
                                 }
                                 break;
                         case ADVERTISE_PAUSE_ASYM:
-                                if (lpa_pause == (LPA_PAUSE_CAP| LPA_PAUSE_ASYM))
-                                {
+                                if (lpa_pause == (LPA_PAUSE_CAP | LPA_PAUSE_ASYM))
                                         pause_flags |= NV_PAUSEFRAME_TX_ENABLE;
-                                }
                                 break;
-                        case ADVERTISE_PAUSE_CAP| ADVERTISE_PAUSE_ASYM:
-                                if (lpa_pause & LPA_PAUSE_CAP)
-                                {
+                        case ADVERTISE_PAUSE_CAP | ADVERTISE_PAUSE_ASYM:
+                                if (lpa_pause & LPA_PAUSE_CAP) {
                                         pause_flags |=  NV_PAUSEFRAME_RX_ENABLE;
                                         if (np->pause_flags & NV_PAUSEFRAME_TX_REQ)
                                                 pause_flags |= NV_PAUSEFRAME_TX_ENABLE;
                                 }
                                 if (lpa_pause == LPA_PAUSE_ASYM)
-                                {
                                         pause_flags |= NV_PAUSEFRAME_RX_ENABLE;
-                                }
                                 break;
                         }
                 } else {
@@ -3361,14 +3246,14 @@ static void nv_linkchange(struct net_device *dev)
         if (nv_update_linkspeed(dev)) {
                 if (!netif_carrier_ok(dev)) {
                         netif_carrier_on(dev);
-                        printk(KERN_INFO "%s: link up.\n", dev->name);
+                        netdev_info(dev, "link up\n");
                         nv_txrx_gate(dev, false);
                         nv_start_rx(dev);
                 }
         } else {
                 if (netif_carrier_ok(dev)) {
                         netif_carrier_off(dev);
-                        printk(KERN_INFO "%s: link down.\n", dev->name);
+                        netdev_info(dev, "link down\n");
                         nv_txrx_gate(dev, true);
                         nv_stop_rx(dev);
                 }
@@ -3382,11 +3267,9 @@ static void nv_link_irq(struct net_device *dev)
 
         miistat = readl(base + NvRegMIIStatus);
         writel(NVREG_MIISTAT_LINKCHANGE, base + NvRegMIIStatus);
-        dprintk(KERN_INFO "%s: link change irq, status 0x%x.\n", dev->name, miistat);
 
         if (miistat & (NVREG_MIISTAT_LINKCHANGE))
                 nv_linkchange(dev);
-        dprintk(KERN_DEBUG "%s: link change notification done.\n", dev->name);
 }
 
 static void nv_msi_workaround(struct fe_priv *np)
@@ -3437,8 +3320,6 @@ static irqreturn_t nv_nic_irq(int foo, void *data)
         struct fe_priv *np = netdev_priv(dev);
         u8 __iomem *base = get_hwbase(dev);
 
-        dprintk(KERN_DEBUG "%s: nv_nic_irq\n", dev->name);
-
         if (!(np->msi_flags & NV_MSI_X_ENABLED)) {
                 np->events = readl(base + NvRegIrqStatus);
                 writel(np->events, base + NvRegIrqStatus);
@@ -3446,7 +3327,6 @@ static irqreturn_t nv_nic_irq(int foo, void *data)
                 np->events = readl(base + NvRegMSIXIrqStatus);
                 writel(np->events, base + NvRegMSIXIrqStatus);
         }
-        dprintk(KERN_DEBUG "%s: irq: %08x\n", dev->name, np->events);
         if (!(np->events & np->irqmask))
                 return IRQ_NONE;
 
@@ -3460,8 +3340,6 @@ static irqreturn_t nv_nic_irq(int foo, void *data)
                 __napi_schedule(&np->napi);
         }
 
-        dprintk(KERN_DEBUG "%s: nv_nic_irq completed\n", dev->name);
-
         return IRQ_HANDLED;
 }
 
@@ -3476,8 +3354,6 @@ static irqreturn_t nv_nic_irq_optimized(int foo, void *data)
         struct fe_priv *np = netdev_priv(dev);
         u8 __iomem *base = get_hwbase(dev);
 
-        dprintk(KERN_DEBUG "%s: nv_nic_irq_optimized\n", dev->name);
-
         if (!(np->msi_flags & NV_MSI_X_ENABLED)) {
                 np->events = readl(base + NvRegIrqStatus);
                 writel(np->events, base + NvRegIrqStatus);
@@ -3485,7 +3361,6 @@ static irqreturn_t nv_nic_irq_optimized(int foo, void *data)
                 np->events = readl(base + NvRegMSIXIrqStatus);
                 writel(np->events, base + NvRegMSIXIrqStatus);
         }
-        dprintk(KERN_DEBUG "%s: irq: %08x\n", dev->name, np->events);
         if (!(np->events & np->irqmask))
                 return IRQ_NONE;
 
@@ -3498,7 +3373,6 @@ static irqreturn_t nv_nic_irq_optimized(int foo, void *data)
                 writel(0, base + NvRegIrqMask);
                 __napi_schedule(&np->napi);
         }
-        dprintk(KERN_DEBUG "%s: nv_nic_irq_optimized completed\n", dev->name);
 
         return IRQ_HANDLED;
 }
@@ -3512,12 +3386,9 @@ static irqreturn_t nv_nic_irq_tx(int foo, void *data)
         int i;
         unsigned long flags;
 
-        dprintk(KERN_DEBUG "%s: nv_nic_irq_tx\n", dev->name);
-
-        for (i=0; ; i++) {
+        for (i = 0;; i++) {
                 events = readl(base + NvRegMSIXIrqStatus) & NVREG_IRQ_TX_ALL;
                 writel(NVREG_IRQ_TX_ALL, base + NvRegMSIXIrqStatus);
-                dprintk(KERN_DEBUG "%s: tx irq: %08x\n", dev->name, events);
                 if (!(events & np->irqmask))
                         break;
 
@@ -3536,12 +3407,12 @@ static irqreturn_t nv_nic_irq_tx(int foo, void *data)
                                 mod_timer(&np->nic_poll, jiffies + POLL_WAIT);
                         }
                         spin_unlock_irqrestore(&np->lock, flags);
-                        printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq_tx.\n", dev->name, i);
+                        netdev_dbg(dev, "%s: too many iterations (%d)\n",
+                                   __func__, i);
                         break;
                 }
 
         }
-        dprintk(KERN_DEBUG "%s: nv_nic_irq_tx completed\n", dev->name);
 
         return IRQ_RETVAL(i);
 }
@@ -3553,7 +3424,7 @@ static int nv_napi_poll(struct napi_struct *napi, int budget)
         u8 __iomem *base = get_hwbase(dev);
         unsigned long flags;
         int retcode;
-        int rx_count, tx_work=0, rx_work=0;
+        int rx_count, tx_work = 0, rx_work = 0;
 
         do {
                 if (!nv_optimized(np)) {
@@ -3626,12 +3497,9 @@ static irqreturn_t nv_nic_irq_rx(int foo, void *data)
         int i;
         unsigned long flags;
 
-        dprintk(KERN_DEBUG "%s: nv_nic_irq_rx\n", dev->name);
-
-        for (i=0; ; i++) {
+        for (i = 0;; i++) {
                 events = readl(base + NvRegMSIXIrqStatus) & NVREG_IRQ_RX_ALL;
                 writel(NVREG_IRQ_RX_ALL, base + NvRegMSIXIrqStatus);
-                dprintk(KERN_DEBUG "%s: rx irq: %08x\n", dev->name, events);
                 if (!(events & np->irqmask))
                         break;
 
@@ -3655,11 +3523,11 @@ static irqreturn_t nv_nic_irq_rx(int foo, void *data)
                                 mod_timer(&np->nic_poll, jiffies + POLL_WAIT);
                         }
                         spin_unlock_irqrestore(&np->lock, flags);
-                        printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq_rx.\n", dev->name, i);
+                        netdev_dbg(dev, "%s: too many iterations (%d)\n",
+                                   __func__, i);
                         break;
                 }
         }
-        dprintk(KERN_DEBUG "%s: nv_nic_irq_rx completed\n", dev->name);
 
         return IRQ_RETVAL(i);
 }
@@ -3673,12 +3541,9 @@ static irqreturn_t nv_nic_irq_other(int foo, void *data)
         int i;
         unsigned long flags;
 
-        dprintk(KERN_DEBUG "%s: nv_nic_irq_other\n", dev->name);
-
-        for (i=0; ; i++) {
+        for (i = 0;; i++) {
                 events = readl(base + NvRegMSIXIrqStatus) & NVREG_IRQ_OTHER;
                 writel(NVREG_IRQ_OTHER, base + NvRegMSIXIrqStatus);
-                dprintk(KERN_DEBUG "%s: irq: %08x\n", dev->name, events);
                 if (!(events & np->irqmask))
                         break;
 
@@ -3723,12 +3588,12 @@ static irqreturn_t nv_nic_irq_other(int foo, void *data)
                                 mod_timer(&np->nic_poll, jiffies + POLL_WAIT);
                         }
                         spin_unlock_irqrestore(&np->lock, flags);
-                        printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq_other.\n", dev->name, i);
+                        netdev_dbg(dev, "%s: too many iterations (%d)\n",
+                                   __func__, i);
                         break;
                 }
 
         }
-        dprintk(KERN_DEBUG "%s: nv_nic_irq_other completed\n", dev->name);
 
         return IRQ_RETVAL(i);
 }
@@ -3740,8 +3605,6 @@ static irqreturn_t nv_nic_irq_test(int foo, void *data)
         u8 __iomem *base = get_hwbase(dev);
         u32 events;
 
-        dprintk(KERN_DEBUG "%s: nv_nic_irq_test\n", dev->name);
-
         if (!(np->msi_flags & NV_MSI_X_ENABLED)) {
                 events = readl(base + NvRegIrqStatus) & NVREG_IRQSTAT_MASK;
                 writel(NVREG_IRQ_TIMER, base + NvRegIrqStatus);
@@ -3750,7 +3613,6 @@ static irqreturn_t nv_nic_irq_test(int foo, void *data)
                 writel(NVREG_IRQ_TIMER, base + NvRegMSIXIrqStatus);
         }
         pci_push(base);
-        dprintk(KERN_DEBUG "%s: irq: %08x\n", dev->name, events);
         if (!(events & NVREG_IRQ_TIMER))
                 return IRQ_RETVAL(0);
 
@@ -3760,8 +3622,6 @@ static irqreturn_t nv_nic_irq_test(int foo, void *data)
         np->intr_test = 1;
         spin_unlock(&np->lock);
 
-        dprintk(KERN_DEBUG "%s: nv_nic_irq_test completed\n", dev->name);
-
         return IRQ_RETVAL(1);
 }
 
@@ -3776,17 +3636,15 @@ static void set_msix_vector_map(struct net_device *dev, u32 vector, u32 irqmask)
          * the remaining 8 interrupts.
          */
         for (i = 0; i < 8; i++) {
-                if ((irqmask >> i) & 0x1) {
+                if ((irqmask >> i) & 0x1)
                         msixmap |= vector << (i << 2);
-                }
         }
         writel(readl(base + NvRegMSIXMap0) | msixmap, base + NvRegMSIXMap0);
 
         msixmap = 0;
         for (i = 0; i < 8; i++) {
-                if ((irqmask >> (i + 8)) & 0x1) {
+                if ((irqmask >> (i + 8)) & 0x1)
                         msixmap |= vector << (i << 2);
-                }
         }
         writel(readl(base + NvRegMSIXMap1) | msixmap, base + NvRegMSIXMap1);
 }
@@ -3809,17 +3667,19 @@ static int nv_request_irq(struct net_device *dev, int intr_test)
         }
 
         if (np->msi_flags & NV_MSI_X_CAPABLE) {
-                for (i = 0; i < (np->msi_flags & NV_MSI_X_VECTORS_MASK); i++) {
+                for (i = 0; i < (np->msi_flags & NV_MSI_X_VECTORS_MASK); i++)
                         np->msi_x_entry[i].entry = i;
-                }
-                if ((ret = pci_enable_msix(np->pci_dev, np->msi_x_entry, (np->msi_flags & NV_MSI_X_VECTORS_MASK))) == 0) {
+                ret = pci_enable_msix(np->pci_dev, np->msi_x_entry, (np->msi_flags & NV_MSI_X_VECTORS_MASK));
+                if (ret == 0) {
                         np->msi_flags |= NV_MSI_X_ENABLED;
                         if (optimization_mode == NV_OPTIMIZATION_MODE_THROUGHPUT && !intr_test) {
                                 /* Request irq for rx handling */
                                 sprintf(np->name_rx, "%s-rx", dev->name);
                                 if (request_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector,
                                                 nv_nic_irq_rx, IRQF_SHARED, np->name_rx, dev) != 0) {
-                                        printk(KERN_INFO "forcedeth: request_irq failed for rx %d\n", ret);
+                                        netdev_info(dev,
+                                                    "request_irq failed for rx %d\n",
+                                                    ret);
                                         pci_disable_msix(np->pci_dev);
                                         np->msi_flags &= ~NV_MSI_X_ENABLED;
                                         goto out_err;
@@ -3828,7 +3688,9 @@ static int nv_request_irq(struct net_device *dev, int intr_test)
                                 sprintf(np->name_tx, "%s-tx", dev->name);
                                 if (request_irq(np->msi_x_entry[NV_MSI_X_VECTOR_TX].vector,
                                                 nv_nic_irq_tx, IRQF_SHARED, np->name_tx, dev) != 0) {
-                                        printk(KERN_INFO "forcedeth: request_irq failed for tx %d\n", ret);
+                                        netdev_info(dev,
+                                                    "request_irq failed for tx %d\n",
+                                                    ret);
                                         pci_disable_msix(np->pci_dev);
                                         np->msi_flags &= ~NV_MSI_X_ENABLED;
                                         goto out_free_rx;
@@ -3837,7 +3699,9 @@ static int nv_request_irq(struct net_device *dev, int intr_test)
                                 sprintf(np->name_other, "%s-other", dev->name);
                                 if (request_irq(np->msi_x_entry[NV_MSI_X_VECTOR_OTHER].vector,
                                                 nv_nic_irq_other, IRQF_SHARED, np->name_other, dev) != 0) {
-                                        printk(KERN_INFO "forcedeth: request_irq failed for link %d\n", ret);
+                                        netdev_info(dev,
+                                                    "request_irq failed for link %d\n",
+                                                    ret);
                                         pci_disable_msix(np->pci_dev);
                                         np->msi_flags &= ~NV_MSI_X_ENABLED;
                                         goto out_free_tx;
@@ -3851,7 +3715,9 @@ static int nv_request_irq(struct net_device *dev, int intr_test)
                         } else {
                                 /* Request irq for all interrupts */
                                 if (request_irq(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector, handler, IRQF_SHARED, dev->name, dev) != 0) {
-                                        printk(KERN_INFO "forcedeth: request_irq failed %d\n", ret);
+                                        netdev_info(dev,
+                                                    "request_irq failed %d\n",
+                                                    ret);
                                         pci_disable_msix(np->pci_dev);
                                         np->msi_flags &= ~NV_MSI_X_ENABLED;
                                         goto out_err;
@@ -3864,11 +3730,13 @@ static int nv_request_irq(struct net_device *dev, int intr_test)
                 }
         }
         if (ret != 0 && np->msi_flags & NV_MSI_CAPABLE) {
-                if ((ret = pci_enable_msi(np->pci_dev)) == 0) {
+                ret = pci_enable_msi(np->pci_dev);
+                if (ret == 0) {
                         np->msi_flags |= NV_MSI_ENABLED;
                         dev->irq = np->pci_dev->irq;
                         if (request_irq(np->pci_dev->irq, handler, IRQF_SHARED, dev->name, dev) != 0) {
-                                printk(KERN_INFO "forcedeth: request_irq failed %d\n", ret);
+                                netdev_info(dev, "request_irq failed %d\n",
+                                            ret);
                                 pci_disable_msi(np->pci_dev);
                                 np->msi_flags &= ~NV_MSI_ENABLED;
                                 dev->irq = np->pci_dev->irq;
@@ -3903,9 +3771,8 @@ static void nv_free_irq(struct net_device *dev)
         int i;
 
         if (np->msi_flags & NV_MSI_X_ENABLED) {
-                for (i = 0; i < (np->msi_flags & NV_MSI_X_VECTORS_MASK); i++) {
+                for (i = 0; i < (np->msi_flags & NV_MSI_X_VECTORS_MASK); i++)
                         free_irq(np->msi_x_entry[i].vector, dev);
-                }
                 pci_disable_msix(np->pci_dev);
                 np->msi_flags &= ~NV_MSI_X_ENABLED;
         } else {
@@ -3954,7 +3821,7 @@ static void nv_do_nic_poll(unsigned long data)
 
         if (np->recover_error) {
                 np->recover_error = 0;
-                printk(KERN_INFO "%s: MAC in recoverable error state\n", dev->name);
+                netdev_info(dev, "MAC in recoverable error state\n");
                 if (netif_running(dev)) {
                         netif_tx_lock_bh(dev);
                         netif_addr_lock(dev);
@@ -3975,7 +3842,7 @@ static void nv_do_nic_poll(unsigned long data)
                         /* reinit nic view of the rx queue */
                         writel(np->rx_buf_sz, base + NvRegOffloadConfig);
                         setup_hw_rings(dev, NV_SETUP_RX_RING | NV_SETUP_TX_RING);
-                        writel( ((np->rx_ring_size-1) << NVREG_RINGSZ_RXSHIFT) + ((np->tx_ring_size-1) << NVREG_RINGSZ_TXSHIFT),
+                        writel(((np->rx_ring_size-1) << NVREG_RINGSZ_RXSHIFT) + ((np->tx_ring_size-1) << NVREG_RINGSZ_TXSHIFT),
                                 base + NvRegRingSizes);
                         pci_push(base);
                         writel(NVREG_TXRXCTL_KICK|np->txrxctl_bits, get_hwbase(dev) + NvRegTxRxControl);
@@ -4105,7 +3972,7 @@ static int nv_get_settings(struct net_device *dev, struct ethtool_cmd *ecmd)
         }
 
         if (netif_carrier_ok(dev)) {
-                switch(np->linkspeed & (NVREG_LINKSPEED_MASK)) {
+                switch (np->linkspeed & (NVREG_LINKSPEED_MASK)) {
                 case NVREG_LINKSPEED_10:
                         ecmd->speed = SPEED_10;
                         break;
@@ -4250,14 +4117,14 @@ static int nv_set_settings(struct net_device *dev, struct ethtool_cmd *ecmd)
                 }
 
                 if (netif_running(dev))
-                        printk(KERN_INFO "%s: link down.\n", dev->name);
+                        netdev_info(dev, "link down\n");
                 bmcr = mii_rw(dev, np->phyaddr, MII_BMCR, MII_READ);
                 if (np->phy_model == PHY_MODEL_MARVELL_E3016) {
                         bmcr |= BMCR_ANENABLE;
                         /* reset the phy in order for settings to stick,
                          * and cause autoneg to start */
                         if (phy_reset(dev, bmcr)) {
-                                printk(KERN_INFO "%s: phy reset failed\n", dev->name);
+                                netdev_info(dev, "phy reset failed\n");
                                 return -EINVAL;
                         }
                 } else {
@@ -4306,7 +4173,7 @@ static int nv_set_settings(struct net_device *dev, struct ethtool_cmd *ecmd)
                 if (np->phy_oui == PHY_OUI_MARVELL) {
                         /* reset the phy in order for forced mode settings to stick */
                         if (phy_reset(dev, bmcr)) {
-                                printk(KERN_INFO "%s: phy reset failed\n", dev->name);
+                                netdev_info(dev, "phy reset failed\n");
                                 return -EINVAL;
                         }
                 } else {
@@ -4344,7 +4211,7 @@ static void nv_get_regs(struct net_device *dev, struct ethtool_regs *regs, void
 
         regs->version = FORCEDETH_REGS_VER;
         spin_lock_irq(&np->lock);
-        for (i = 0;i <= np->register_size/sizeof(u32); i++)
+        for (i = 0; i <= np->register_size/sizeof(u32); i++)
                 rbuf[i] = readl(base + i*sizeof(u32));
         spin_unlock_irq(&np->lock);
 }
@@ -4368,7 +4235,7 @@ static int nv_nway_reset(struct net_device *dev)
                         spin_unlock(&np->lock);
                         netif_addr_unlock(dev);
                         netif_tx_unlock_bh(dev);
-                        printk(KERN_INFO "%s: link down.\n", dev->name);
+                        netdev_info(dev, "link down\n");
                 }
 
                 bmcr = mii_rw(dev, np->phyaddr, MII_BMCR, MII_READ);
@@ -4376,7 +4243,7 @@ static int nv_nway_reset(struct net_device *dev)
                         bmcr |= BMCR_ANENABLE;
                         /* reset the phy in order for settings to stick*/
                         if (phy_reset(dev, bmcr)) {
-                                printk(KERN_INFO "%s: phy reset failed\n", dev->name);
+                                netdev_info(dev, "phy reset failed\n");
                                 return -EINVAL;
                         }
                 } else {
@@ -4464,10 +4331,9 @@ static int nv_set_ringparam(struct net_device *dev, struct ethtool_ringparam* ri
                                 pci_free_consistent(np->pci_dev, sizeof(struct ring_desc_ex) * (ring->rx_pending + ring->tx_pending),
                                                     rxtx_ring, ring_addr);
                 }
-                if (rx_skbuff)
-                        kfree(rx_skbuff);
-                if (tx_skbuff)
-                        kfree(tx_skbuff);
+
+                kfree(rx_skbuff);
+                kfree(tx_skbuff);
                 goto exit;
         }
 
@@ -4491,14 +4357,14 @@ static int nv_set_ringparam(struct net_device *dev, struct ethtool_ringparam* ri
         np->tx_ring_size = ring->tx_pending;
 
         if (!nv_optimized(np)) {
-                np->rx_ring.orig = (struct ring_desc*)rxtx_ring;
+                np->rx_ring.orig = (struct ring_desc *)rxtx_ring;
                 np->tx_ring.orig = &np->rx_ring.orig[np->rx_ring_size];
         } else {
-                np->rx_ring.ex = (struct ring_desc_ex*)rxtx_ring;
+                np->rx_ring.ex = (struct ring_desc_ex *)rxtx_ring;
                 np->tx_ring.ex = &np->rx_ring.ex[np->rx_ring_size];
         }
-        np->rx_skb = (struct nv_skb_map*)rx_skbuff;
-        np->tx_skb = (struct nv_skb_map*)tx_skbuff;
+        np->rx_skb = (struct nv_skb_map *)rx_skbuff;
+        np->tx_skb = (struct nv_skb_map *)tx_skbuff;
         np->ring_addr = ring_addr;
 
         memset(np->rx_skb, 0, sizeof(struct nv_skb_map) * np->rx_ring_size);
@@ -4515,7 +4381,7 @@ static int nv_set_ringparam(struct net_device *dev, struct ethtool_ringparam* ri
                 /* reinit nic view of the queues */
                 writel(np->rx_buf_sz, base + NvRegOffloadConfig);
                 setup_hw_rings(dev, NV_SETUP_RX_RING | NV_SETUP_TX_RING);
-                writel( ((np->rx_ring_size-1) << NVREG_RINGSZ_RXSHIFT) + ((np->tx_ring_size-1) << NVREG_RINGSZ_TXSHIFT),
+                writel(((np->rx_ring_size-1) << NVREG_RINGSZ_RXSHIFT) + ((np->tx_ring_size-1) << NVREG_RINGSZ_TXSHIFT),
                         base + NvRegRingSizes);
                 pci_push(base);
                 writel(NVREG_TXRXCTL_KICK|np->txrxctl_bits, get_hwbase(dev) + NvRegTxRxControl);
@@ -4550,12 +4416,11 @@ static int nv_set_pauseparam(struct net_device *dev, struct ethtool_pauseparam*
 
         if ((!np->autoneg && np->duplex == 0) ||
             (np->autoneg && !pause->autoneg && np->duplex == 0)) {
-                printk(KERN_INFO "%s: can not set pause settings when forced link is in half duplex.\n",
-                       dev->name);
+                netdev_info(dev, "can not set pause settings when forced link is in half duplex\n");
                 return -EINVAL;
         }
         if (pause->tx_pause && !(np->pause_flags & NV_PAUSEFRAME_TX_CAPABLE)) {
-                printk(KERN_INFO "%s: hardware does not support tx pause frames.\n", dev->name);
+                netdev_info(dev, "hardware does not support tx pause frames\n");
                 return -EINVAL;
         }
 
@@ -4590,7 +4455,7 @@ static int nv_set_pauseparam(struct net_device *dev, struct ethtool_pauseparam*
                 mii_rw(dev, np->phyaddr, MII_ADVERTISE, adv);
 
                 if (netif_running(dev))
-                        printk(KERN_INFO "%s: link down.\n", dev->name);
+                        netdev_info(dev, "link down\n");
                 bmcr = mii_rw(dev, np->phyaddr, MII_BMCR, MII_READ);
                 bmcr |= (BMCR_ANENABLE | BMCR_ANRESTART);
                 mii_rw(dev, np->phyaddr, MII_BMCR, bmcr);
@@ -4841,7 +4706,7 @@ static int nv_loopback_test(struct net_device *dev)
         /* reinit nic view of the rx queue */
         writel(np->rx_buf_sz, base + NvRegOffloadConfig);
         setup_hw_rings(dev, NV_SETUP_RX_RING | NV_SETUP_TX_RING);
-        writel( ((np->rx_ring_size-1) << NVREG_RINGSZ_RXSHIFT) + ((np->tx_ring_size-1) << NVREG_RINGSZ_TXSHIFT),
+        writel(((np->rx_ring_size-1) << NVREG_RINGSZ_RXSHIFT) + ((np->tx_ring_size-1) << NVREG_RINGSZ_TXSHIFT),
                 base + NvRegRingSizes);
         pci_push(base);
 
@@ -4852,8 +4717,7 @@ static int nv_loopback_test(struct net_device *dev)
         pkt_len = ETH_DATA_LEN;
         tx_skb = dev_alloc_skb(pkt_len);
         if (!tx_skb) {
-                printk(KERN_ERR "dev_alloc_skb() failed during loopback test"
-                         " of %s\n", dev->name);
+                netdev_err(dev, "dev_alloc_skb() failed during loopback test\n");
                 ret = 0;
                 goto out;
         }
@@ -4893,29 +4757,22 @@ static int nv_loopback_test(struct net_device *dev)
                 if (flags & NV_RX_ERROR)
                         ret = 0;
         } else {
-                if (flags & NV_RX2_ERROR) {
+                if (flags & NV_RX2_ERROR)
                         ret = 0;
-                }
         }
 
         if (ret) {
                 if (len != pkt_len) {
                         ret = 0;
-                        dprintk(KERN_DEBUG "%s: loopback len mismatch %d vs %d\n",
-                                dev->name, len, pkt_len);
                 } else {
                         rx_skb = np->rx_skb[0].skb;
                         for (i = 0; i < pkt_len; i++) {
                                 if (rx_skb->data[i] != (u8)(i & 0xff)) {
                                         ret = 0;
-                                        dprintk(KERN_DEBUG "%s: loopback pattern check failed on byte %d\n",
-                                                dev->name, i);
                                         break;
                                 }
                         }
                 }
-        } else {
-                dprintk(KERN_DEBUG "%s: loopback - did not receive test packet\n", dev->name);
         }
 
         pci_unmap_single(np->pci_dev, test_dma_addr,
@@ -4958,11 +4815,10 @@ static void nv_self_test(struct net_device *dev, struct ethtool_test *test, u64
                         netif_addr_lock(dev);
                         spin_lock_irq(&np->lock);
                         nv_disable_hw_interrupts(dev, np->irqmask);
-                        if (!(np->msi_flags & NV_MSI_X_ENABLED)) {
+                        if (!(np->msi_flags & NV_MSI_X_ENABLED))
                                 writel(NVREG_IRQSTAT_MASK, base + NvRegIrqStatus);
-                        } else {
+                        else
                                 writel(NVREG_IRQSTAT_MASK, base + NvRegMSIXIrqStatus);
-                        }
                         /* stop engines */
                         nv_stop_rxtx(dev);
                         nv_txrx_reset(dev);
@@ -5003,7 +4859,7 @@ static void nv_self_test(struct net_device *dev, struct ethtool_test *test, u64
                         /* reinit nic view of the rx queue */
                         writel(np->rx_buf_sz, base + NvRegOffloadConfig);
                         setup_hw_rings(dev, NV_SETUP_RX_RING | NV_SETUP_TX_RING);
-                        writel( ((np->rx_ring_size-1) << NVREG_RINGSZ_RXSHIFT) + ((np->tx_ring_size-1) << NVREG_RINGSZ_TXSHIFT),
+                        writel(((np->rx_ring_size-1) << NVREG_RINGSZ_RXSHIFT) + ((np->tx_ring_size-1) << NVREG_RINGSZ_TXSHIFT),
                                 base + NvRegRingSizes);
                         pci_push(base);
                         writel(NVREG_TXRXCTL_KICK|np->txrxctl_bits, get_hwbase(dev) + NvRegTxRxControl);
@@ -5106,8 +4962,7 @@ static int nv_mgmt_acquire_sema(struct net_device *dev)
                     ((tx_ctrl & NVREG_XMITCTL_MGMT_SEMA_MASK) == NVREG_XMITCTL_MGMT_SEMA_FREE)) {
                         np->mgmt_sema = 1;
                         return 1;
-                }
-                else
+                } else
                         udelay(50);
         }
 
@@ -5167,8 +5022,6 @@ static int nv_open(struct net_device *dev)
         int oom, i;
         u32 low;
 
-        dprintk(KERN_DEBUG "nv_open: begin\n");
-
         /* power up phy */
         mii_rw(dev, np->phyaddr, MII_BMCR,
                mii_rw(dev, np->phyaddr, MII_BMCR, MII_READ) & ~BMCR_PDOWN);
@@ -5204,7 +5057,7 @@ static int nv_open(struct net_device *dev)
 
         /* give hw rings */
         setup_hw_rings(dev, NV_SETUP_RX_RING | NV_SETUP_TX_RING);
-        writel( ((np->rx_ring_size-1) << NVREG_RINGSZ_RXSHIFT) + ((np->tx_ring_size-1) << NVREG_RINGSZ_TXSHIFT),
+        writel(((np->rx_ring_size-1) << NVREG_RINGSZ_RXSHIFT) + ((np->tx_ring_size-1) << NVREG_RINGSZ_TXSHIFT),
                 base + NvRegRingSizes);
 
         writel(np->linkspeed, base + NvRegLinkSpeed);
@@ -5216,9 +5069,11 @@ static int nv_open(struct net_device *dev)
         writel(np->vlanctl_bits, base + NvRegVlanControl);
         pci_push(base);
         writel(NVREG_TXRXCTL_BIT1|np->txrxctl_bits, base + NvRegTxRxControl);
-        reg_delay(dev, NvRegUnknownSetupReg5, NVREG_UNKSETUP5_BIT31, NVREG_UNKSETUP5_BIT31,
-                        NV_SETUP5_DELAY, NV_SETUP5_DELAYMAX,
-                        KERN_INFO "open: SetupReg5, Bit 31 remained off\n");
+        if (reg_delay(dev, NvRegUnknownSetupReg5,
+                      NVREG_UNKSETUP5_BIT31, NVREG_UNKSETUP5_BIT31,
+                      NV_SETUP5_DELAY, NV_SETUP5_DELAYMAX))
+                netdev_info(dev,
+                            "%s: SetupReg5, Bit 31 remained off\n", __func__);
 
         writel(0, base + NvRegMIIMask);
         writel(NVREG_IRQSTAT_MASK, base + NvRegIrqStatus);
@@ -5251,8 +5106,7 @@ static int nv_open(struct net_device *dev)
                         writel(NVREG_POLL_DEFAULT_THROUGHPUT, base + NvRegPollingInterval);
                 else
                         writel(NVREG_POLL_DEFAULT_CPU, base + NvRegPollingInterval);
-        }
-        else
+        } else
                 writel(poll_interval & 0xFFFF, base + NvRegPollingInterval);
         writel(NVREG_UNKSETUP6_VAL, base + NvRegUnknownSetupReg6);
         writel((np->phyaddr << NVREG_ADAPTCTL_PHYSHIFT)|NVREG_ADAPTCTL_PHYVALID|NVREG_ADAPTCTL_RUNNING,
@@ -5263,7 +5117,7 @@ static int nv_open(struct net_device *dev)
                 writel(NVREG_WAKEUPFLAGS_ENABLE , base + NvRegWakeUpFlags);
 
         i = readl(base + NvRegPowerState);
-        if ( (i & NVREG_POWERSTATE_POWEREDUP) == 0)
+        if ((i & NVREG_POWERSTATE_POWEREDUP) == 0)
                 writel(NVREG_POWERSTATE_POWEREDUP|i, base + NvRegPowerState);
 
         pci_push(base);
@@ -5276,9 +5130,8 @@ static int nv_open(struct net_device *dev)
         writel(NVREG_IRQSTAT_MASK, base + NvRegIrqStatus);
         pci_push(base);
 
-        if (nv_request_irq(dev, 0)) {
+        if (nv_request_irq(dev, 0))
                 goto out_drain;
-        }
 
         /* ask for interrupts */
         nv_enable_hw_interrupts(dev, np->irqmask);
@@ -5296,7 +5149,6 @@ static int nv_open(struct net_device *dev)
                 u32 miistat;
                 miistat = readl(base + NvRegMIIStatus);
                 writel(NVREG_MIISTAT_MASK_ALL, base + NvRegMIIStatus);
-                dprintk(KERN_INFO "startup: got 0x%08x.\n", miistat);
         }
         /* set linkspeed to invalid value, thus force nv_update_linkspeed
          * to init hw */
@@ -5309,7 +5161,7 @@ static int nv_open(struct net_device *dev)
         if (ret) {
                 netif_carrier_on(dev);
         } else {
-                printk(KERN_INFO "%s: no link during initialization.\n", dev->name);
+                netdev_info(dev, "no link during initialization\n");
                 netif_carrier_off(dev);
         }
         if (oom)
@@ -5352,7 +5204,6 @@ static int nv_close(struct net_device *dev)
         base = get_hwbase(dev);
         nv_disable_hw_interrupts(dev, np->irqmask);
         pci_push(base);
-        dprintk(KERN_INFO "%s: Irqmask is zero again\n", dev->name);
 
         spin_unlock_irq(&np->lock);
 
@@ -5421,8 +5272,8 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
         static int printed_version;
 
         if (!printed_version++)
-                printk(KERN_INFO "%s: Reverse Engineered nForce ethernet"
-                       " driver. Version %s.\n", DRV_NAME, FORCEDETH_VERSION);
+                pr_info("Reverse Engineered nForce ethernet driver. Version %s.\n",
+                        FORCEDETH_VERSION);
 
         dev = alloc_etherdev(sizeof(struct fe_priv));
         err = -ENOMEM;
@@ -5465,10 +5316,6 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
         err = -EINVAL;
         addr = 0;
         for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) {
-                dprintk(KERN_DEBUG "%s: resource %d start %p len %ld flags 0x%08lx.\n",
-                                pci_name(pci_dev), i, (void*)pci_resource_start(pci_dev, i),
-                                pci_resource_len(pci_dev, i),
-                                pci_resource_flags(pci_dev, i));
                 if (pci_resource_flags(pci_dev, i) & IORESOURCE_MEM &&
                                 pci_resource_len(pci_dev, i) >= np->register_size) {
                         addr = pci_resource_start(pci_dev, i);
@@ -5476,8 +5323,7 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
                 }
         }
         if (i == DEVICE_COUNT_RESOURCE) {
-                dev_printk(KERN_INFO, &pci_dev->dev,
-                           "Couldn't find register window\n");
+                dev_info(&pci_dev->dev, "Couldn't find register window\n");
                 goto out_relreg;
         }
 
@@ -5493,13 +5339,13 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
                 np->txrxctl_bits = NVREG_TXRXCTL_DESC_3;
                 if (dma_64bit) {
                         if (pci_set_dma_mask(pci_dev, DMA_BIT_MASK(39)))
-                                dev_printk(KERN_INFO, &pci_dev->dev,
-                                        "64-bit DMA failed, using 32-bit addressing\n");
+                                dev_info(&pci_dev->dev,
+                                         "64-bit DMA failed, using 32-bit addressing\n");
                         else
                                 dev->features |= NETIF_F_HIGHDMA;
                         if (pci_set_consistent_dma_mask(pci_dev, DMA_BIT_MASK(39))) {
-                                dev_printk(KERN_INFO, &pci_dev->dev,
-                                        "64-bit DMA (consistent) failed, using 32-bit ring buffers\n");
+                                dev_info(&pci_dev->dev,
+                                         "64-bit DMA (consistent) failed, using 32-bit ring buffers\n");
                         }
                 }
         } else if (id->driver_data & DEV_HAS_LARGEDESC) {
@@ -5620,7 +5466,9 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
                 dev->dev_addr[4] = (np->orig_mac[0] >>  8) & 0xff;
                 dev->dev_addr[5] = (np->orig_mac[0] >>  0) & 0xff;
                 writel(txreg|NVREG_TRANSMITPOLL_MAC_ADDR_REV, base + NvRegTransmitPoll);
-                printk(KERN_DEBUG "nv_probe: set workaround bit for reversed mac addr\n");
+                dev_dbg(&pci_dev->dev,
+                        "%s: set workaround bit for reversed mac addr\n",
+                        __func__);
         }
         memcpy(dev->perm_addr, dev->dev_addr, dev->addr_len);
 
@@ -5629,17 +5477,14 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
                  * Bad mac address. At least one bios sets the mac address
                  * to 01:23:45:67:89:ab
                  */
-                dev_printk(KERN_ERR, &pci_dev->dev,
-                        "Invalid Mac address detected: %pM\n",
-                        dev->dev_addr);
-                dev_printk(KERN_ERR, &pci_dev->dev,
-                        "Please complain to your hardware vendor. Switching to a random MAC.\n");
+                dev_err(&pci_dev->dev,
+                        "Invalid MAC address detected: %pM - Please complain to your hardware vendor.\n",
+                        dev->dev_addr);
                 random_ether_addr(dev->dev_addr);
+                dev_err(&pci_dev->dev,
+                        "Using random MAC address: %pM\n", dev->dev_addr);
         }
 
-        dprintk(KERN_DEBUG "%s: MAC Address %pM\n",
-                pci_name(pci_dev), dev->dev_addr);
-
         /* set mac address */
         nv_copy_mac_to_hw(dev);
 
@@ -5663,16 +5508,15 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
                 writel(powerstate, base + NvRegPowerState2);
         }
 
-        if (np->desc_ver == DESC_VER_1) {
+        if (np->desc_ver == DESC_VER_1)
                 np->tx_flags = NV_TX_VALID;
-        } else {
+        else
                 np->tx_flags = NV_TX2_VALID;
-        }
 
         np->msi_flags = 0;
-        if ((id->driver_data & DEV_HAS_MSI) && msi) {
+        if ((id->driver_data & DEV_HAS_MSI) && msi)
                 np->msi_flags |= NV_MSI_CAPABLE;
-        }
+
         if ((id->driver_data & DEV_HAS_MSI_X) && msix) {
                 /* msix has had reported issues when modifying irqmask
                    as in the case of napi, therefore, disable for now
@@ -5702,11 +5546,9 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
         if (id->driver_data & DEV_NEED_TIMERIRQ)
                 np->irqmask |= NVREG_IRQ_TIMER;
         if (id->driver_data & DEV_NEED_LINKTIMER) {
-                dprintk(KERN_INFO "%s: link timer on.\n", pci_name(pci_dev));
                 np->need_linktimer = 1;
                 np->link_timeout = jiffies + LINK_TIMEOUT;
         } else {
-                dprintk(KERN_INFO "%s: link timer off.\n", pci_name(pci_dev));
                 np->need_linktimer = 0;
         }
 
@@ -5735,19 +5577,14 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
                     nv_mgmt_acquire_sema(dev) &&
                     nv_mgmt_get_version(dev)) {
                         np->mac_in_use = 1;
-                        if (np->mgmt_version > 0) {
+                        if (np->mgmt_version > 0)
                                 np->mac_in_use = readl(base + NvRegMgmtUnitControl) & NVREG_MGMTUNITCONTROL_INUSE;
-                        }
-                        dprintk(KERN_INFO "%s: mgmt unit is running. mac in use %x.\n",
-                                pci_name(pci_dev), np->mac_in_use);
                         /* management unit setup the phy already? */
                         if (np->mac_in_use &&
                             ((readl(base + NvRegTransmitterControl) & NVREG_XMITCTL_SYNC_MASK) ==
                              NVREG_XMITCTL_SYNC_PHY_INIT)) {
                                 /* phy is inited by mgmt unit */
                                 phyinitialized = 1;
-                                dprintk(KERN_INFO "%s: Phy already initialized by mgmt unit.\n",
-                                        pci_name(pci_dev));
                         } else {
                                 /* we need to init the phy */
                         }
@@ -5773,8 +5610,6 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
                 np->phy_model = id2 & PHYID2_MODEL_MASK;
                 id1 = (id1 & PHYID1_OUI_MASK) << PHYID1_OUI_SHFT;
                 id2 = (id2 & PHYID2_OUI_MASK) >> PHYID2_OUI_SHFT;
-                dprintk(KERN_DEBUG "%s: open: Found PHY %04x:%04x at address %d.\n",
-                        pci_name(pci_dev), id1, id2, phyaddr);
                 np->phyaddr = phyaddr;
                 np->phy_oui = id1 | id2;
 
@@ -5788,8 +5623,7 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
                 break;
         }
         if (i == 33) {
-                dev_printk(KERN_INFO, &pci_dev->dev,
-                        "open: Could not find a valid PHY.\n");
+                dev_info(&pci_dev->dev, "open: Could not find a valid PHY\n");
                 goto out_error;
         }
 
@@ -5799,9 +5633,8 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
         } else {
                 /* see if it is a gigabit phy */
                 u32 mii_status = mii_rw(dev, np->phyaddr, MII_BMSR, MII_READ);
-                if (mii_status & PHY_GIGABIT) {
+                if (mii_status & PHY_GIGABIT)
                         np->gigabit = PHY_GIGABIT;
-                }
         }
 
         /* set default link speed settings */
@@ -5811,37 +5644,27 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
 
         err = register_netdev(dev);
         if (err) {
-                dev_printk(KERN_INFO, &pci_dev->dev,
-                           "unable to register netdev: %d\n", err);
+                dev_info(&pci_dev->dev, "unable to register netdev: %d\n", err);
                 goto out_error;
         }
 
-        dev_printk(KERN_INFO, &pci_dev->dev, "ifname %s, PHY OUI 0x%x @ %d, "
-                   "addr %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x\n",
-                   dev->name,
-                   np->phy_oui,
-                   np->phyaddr,
-                   dev->dev_addr[0],
-                   dev->dev_addr[1],
-                   dev->dev_addr[2],
-                   dev->dev_addr[3],
-                   dev->dev_addr[4],
-                   dev->dev_addr[5]);
-
-        dev_printk(KERN_INFO, &pci_dev->dev, "%s%s%s%s%s%s%s%s%s%sdesc-v%u\n",
-                   dev->features & NETIF_F_HIGHDMA ? "highdma " : "",
-                   dev->features & (NETIF_F_IP_CSUM | NETIF_F_SG) ?
-                        "csum " : "",
-                   dev->features & (NETIF_F_HW_VLAN_RX | NETIF_F_HW_VLAN_TX) ?
-                        "vlan " : "",
-                   id->driver_data & DEV_HAS_POWER_CNTRL ? "pwrctl " : "",
-                   id->driver_data & DEV_HAS_MGMT_UNIT ? "mgmt " : "",
-                   id->driver_data & DEV_NEED_TIMERIRQ ? "timirq " : "",
-                   np->gigabit == PHY_GIGABIT ? "gbit " : "",
-                   np->need_linktimer ? "lnktim " : "",
-                   np->msi_flags & NV_MSI_CAPABLE ? "msi " : "",
-                   np->msi_flags & NV_MSI_X_CAPABLE ? "msi-x " : "",
-                   np->desc_ver);
+        dev_info(&pci_dev->dev, "ifname %s, PHY OUI 0x%x @ %d, addr %pM\n",
+                 dev->name, np->phy_oui, np->phyaddr, dev->dev_addr);
+
+        dev_info(&pci_dev->dev, "%s%s%s%s%s%s%s%s%s%sdesc-v%u\n",
+                 dev->features & NETIF_F_HIGHDMA ? "highdma " : "",
+                 dev->features & (NETIF_F_IP_CSUM | NETIF_F_SG) ?
+                        "csum " : "",
+                 dev->features & (NETIF_F_HW_VLAN_RX | NETIF_F_HW_VLAN_TX) ?
+                        "vlan " : "",
+                 id->driver_data & DEV_HAS_POWER_CNTRL ? "pwrctl " : "",
+                 id->driver_data & DEV_HAS_MGMT_UNIT ? "mgmt " : "",
+                 id->driver_data & DEV_NEED_TIMERIRQ ? "timirq " : "",
+                 np->gigabit == PHY_GIGABIT ? "gbit " : "",
+                 np->need_linktimer ? "lnktim " : "",
+                 np->msi_flags & NV_MSI_CAPABLE ? "msi " : "",
+                 np->msi_flags & NV_MSI_X_CAPABLE ? "msi-x " : "",
+                 np->desc_ver);
 
         return 0;
 
@@ -5931,13 +5754,13 @@ static int nv_suspend(struct pci_dev *pdev, pm_message_t state)
         int i;
 
         if (netif_running(dev)) {
-                // Gross.
+                /* Gross. */
                 nv_close(dev);
         }
         netif_device_detach(dev);
 
         /* save non-pci configuration space */
-        for (i = 0;i <= np->register_size/sizeof(u32); i++)
+        for (i = 0; i <= np->register_size/sizeof(u32); i++)
                 np->saved_config_space[i] = readl(base + i*sizeof(u32));
 
         pci_save_state(pdev);
@@ -5960,7 +5783,7 @@ static int nv_resume(struct pci_dev *pdev)
         pci_enable_wake(pdev, PCI_D0, 0);
 
         /* restore non-pci configuration space */
-        for (i = 0;i <= np->register_size/sizeof(u32); i++)
+        for (i = 0; i <= np->register_size/sizeof(u32); i++)
                 writel(np->saved_config_space[i], base+i*sizeof(u32));
 
         if (np->driver_data & DEV_NEED_MSI_FIX)
@@ -5990,9 +5813,8 @@ static void nv_shutdown(struct pci_dev *pdev)
          * If we really go for poweroff, we must not restore the MAC,
          * otherwise the MAC for WOL will be reversed at least on some boards.
          */
-        if (system_state != SYSTEM_POWER_OFF) {
+        if (system_state != SYSTEM_POWER_OFF)
                 nv_restore_mac_addr(pdev);
-        }
 
         pci_disable_device(pdev);
         /*
diff --git a/drivers/net/igb/igb_main.c b/drivers/net/igb/igb_main.c
index 892d196f17a..67ea262e482 100644
--- a/drivers/net/igb/igb_main.c
+++ b/drivers/net/igb/igb_main.c
@@ -2436,10 +2436,9 @@ int igb_setup_tx_resources(struct igb_ring *tx_ring)
         int size;
 
         size = sizeof(struct igb_buffer) * tx_ring->count;
-        tx_ring->buffer_info = vmalloc(size);
+        tx_ring->buffer_info = vzalloc(size);
         if (!tx_ring->buffer_info)
                 goto err;
-        memset(tx_ring->buffer_info, 0, size);
 
         /* round up to nearest 4K */
         tx_ring->size = tx_ring->count * sizeof(union e1000_adv_tx_desc);
@@ -2587,10 +2586,9 @@ int igb_setup_rx_resources(struct igb_ring *rx_ring)
         int size, desc_len;
 
         size = sizeof(struct igb_buffer) * rx_ring->count;
-        rx_ring->buffer_info = vmalloc(size);
+        rx_ring->buffer_info = vzalloc(size);
         if (!rx_ring->buffer_info)
                 goto err;
-        memset(rx_ring->buffer_info, 0, size);
 
         desc_len = sizeof(union e1000_adv_rx_desc);
 
diff --git a/drivers/net/igbvf/Makefile b/drivers/net/igbvf/Makefile
index c2f150d8f2d..0fa3db3dd8b 100644
--- a/drivers/net/igbvf/Makefile
+++ b/drivers/net/igbvf/Makefile
@@ -1,7 +1,7 @@
 ################################################################################
 #
 # Intel(R) 82576 Virtual Function Linux driver
-# Copyright(c) 2009 Intel Corporation.
+# Copyright(c) 2009 - 2010 Intel Corporation.
 #
 # This program is free software; you can redistribute it and/or modify it
 # under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/igbvf/defines.h b/drivers/net/igbvf/defines.h
index 88a47537518..79f2604673f 100644
--- a/drivers/net/igbvf/defines.h
+++ b/drivers/net/igbvf/defines.h
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel(R) 82576 Virtual Function Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/igbvf/ethtool.c b/drivers/net/igbvf/ethtool.c
index 33add708bcb..abb3606928f 100644
--- a/drivers/net/igbvf/ethtool.c
+++ b/drivers/net/igbvf/ethtool.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel(R) 82576 Virtual Function Linux driver
-  Copyright(c) 2009 Intel Corporation.
+  Copyright(c) 2009 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/igbvf/igbvf.h b/drivers/net/igbvf/igbvf.h
index debeee2dc71..9d4d63e536d 100644
--- a/drivers/net/igbvf/igbvf.h
+++ b/drivers/net/igbvf/igbvf.h
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel(R) 82576 Virtual Function Linux driver
-  Copyright(c) 2009 Intel Corporation.
+  Copyright(c) 2009 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
@@ -126,7 +126,6 @@ struct igbvf_buffer {
                         unsigned int page_offset;
                 };
         };
-        struct page *page;
 };
 
 union igbvf_desc {
diff --git a/drivers/net/igbvf/mbx.c b/drivers/net/igbvf/mbx.c
index 819a8ec901d..3d6f4cc3998 100644
--- a/drivers/net/igbvf/mbx.c
+++ b/drivers/net/igbvf/mbx.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel(R) 82576 Virtual Function Linux driver
-  Copyright(c) 2009 Intel Corporation.
+  Copyright(c) 2009 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/igbvf/mbx.h b/drivers/net/igbvf/mbx.h
index 4938609dbfb..c2883c45d47 100644
--- a/drivers/net/igbvf/mbx.h
+++ b/drivers/net/igbvf/mbx.h
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel(R) 82576 Virtual Function Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/igbvf/netdev.c b/drivers/net/igbvf/netdev.c
index 28af019c97b..8dbde2397c1 100644
--- a/drivers/net/igbvf/netdev.c
+++ b/drivers/net/igbvf/netdev.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel(R) 82576 Virtual Function Linux driver
-  Copyright(c) 2009 Intel Corporation.
+  Copyright(c) 2009 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
@@ -44,12 +44,13 @@
 
 #include "igbvf.h"
 
-#define DRV_VERSION "1.0.0-k0"
+#define DRV_VERSION "1.0.8-k0"
 char igbvf_driver_name[] = "igbvf";
 const char igbvf_driver_version[] = DRV_VERSION;
 static const char igbvf_driver_string[] =
                                 "Intel(R) Virtual Function Network Driver";
-static const char igbvf_copyright[] = "Copyright (c) 2009 Intel Corporation.";
+static const char igbvf_copyright[] =
+                                "Copyright (c) 2009 - 2010 Intel Corporation.";
 
 static int igbvf_poll(struct napi_struct *napi, int budget);
 static void igbvf_reset(struct igbvf_adapter *);
@@ -429,10 +430,9 @@ int igbvf_setup_tx_resources(struct igbvf_adapter *adapter,
         int size;
 
         size = sizeof(struct igbvf_buffer) * tx_ring->count;
-        tx_ring->buffer_info = vmalloc(size);
+        tx_ring->buffer_info = vzalloc(size);
         if (!tx_ring->buffer_info)
                 goto err;
-        memset(tx_ring->buffer_info, 0, size);
 
         /* round up to nearest 4K */
         tx_ring->size = tx_ring->count * sizeof(union e1000_adv_tx_desc);
@@ -469,10 +469,9 @@ int igbvf_setup_rx_resources(struct igbvf_adapter *adapter,
         int size, desc_len;
 
         size = sizeof(struct igbvf_buffer) * rx_ring->count;
-        rx_ring->buffer_info = vmalloc(size);
+        rx_ring->buffer_info = vzalloc(size);
         if (!rx_ring->buffer_info)
                 goto err;
-        memset(rx_ring->buffer_info, 0, size);
 
         desc_len = sizeof(union e1000_adv_rx_desc);
 
@@ -1851,8 +1850,6 @@ static void igbvf_watchdog_task(struct work_struct *work)
 
         if (link) {
                 if (!netif_carrier_ok(netdev)) {
-                        bool txb2b = 1;
-
                         mac->ops.get_link_up_info(&adapter->hw,
                                                   &adapter->link_speed,
                                                   &adapter->link_duplex);
@@ -1862,11 +1859,9 @@ static void igbvf_watchdog_task(struct work_struct *work)
                         adapter->tx_timeout_factor = 1;
                         switch (adapter->link_speed) {
                         case SPEED_10:
-                                txb2b = 0;
                                 adapter->tx_timeout_factor = 16;
                                 break;
                         case SPEED_100:
-                                txb2b = 0;
                                 /* maybe add some timeout factor ? */
                                 break;
                         }
diff --git a/drivers/net/igbvf/regs.h b/drivers/net/igbvf/regs.h
index b9e24ed70d0..77e18d3d6b1 100644
--- a/drivers/net/igbvf/regs.h
+++ b/drivers/net/igbvf/regs.h
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel(R) 82576 Virtual Function Linux driver
-  Copyright(c) 2009 Intel Corporation.
+  Copyright(c) 2009 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/igbvf/vf.c b/drivers/net/igbvf/vf.c
index a9a61efa964..0cc13c6ed41 100644
--- a/drivers/net/igbvf/vf.c
+++ b/drivers/net/igbvf/vf.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel(R) 82576 Virtual Function Linux driver
-  Copyright(c) 2009 Intel Corporation.
+  Copyright(c) 2009 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/igbvf/vf.h b/drivers/net/igbvf/vf.h
index 1e8ce3741a6..c36ea21f17f 100644
--- a/drivers/net/igbvf/vf.h
+++ b/drivers/net/igbvf/vf.h
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel(R) 82576 Virtual Function Linux driver
-  Copyright(c) 2009 Intel Corporation.
+  Copyright(c) 2009 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/iseries_veth.c b/drivers/net/iseries_veth.c
index 8df645e78f2..38e15be6d51 100644
--- a/drivers/net/iseries_veth.c
+++ b/drivers/net/iseries_veth.c
@@ -1605,7 +1605,7 @@ static int veth_probe(struct vio_dev *vdev, const struct vio_device_id *id)
         }
         veth_dev[i] = dev;
 
-        port = (struct veth_port*)netdev_priv(dev);
+        port = netdev_priv(dev);
 
         /* Start the state machine on each connection on this vlan. If we're
          * the first dev to do so this will commence link negotiation */
diff --git a/drivers/net/ixgb/ixgb_main.c b/drivers/net/ixgb/ixgb_main.c
index caa8192fff2..211a1694667 100644
--- a/drivers/net/ixgb/ixgb_main.c
+++ b/drivers/net/ixgb/ixgb_main.c
@@ -669,13 +669,12 @@ ixgb_setup_tx_resources(struct ixgb_adapter *adapter)
         int size;
 
         size = sizeof(struct ixgb_buffer) * txdr->count;
-        txdr->buffer_info = vmalloc(size);
+        txdr->buffer_info = vzalloc(size);
         if (!txdr->buffer_info) {
                 netif_err(adapter, probe, adapter->netdev,
                           "Unable to allocate transmit descriptor ring memory\n");
                 return -ENOMEM;
         }
-        memset(txdr->buffer_info, 0, size);
 
         /* round up to nearest 4K */
 
@@ -759,13 +758,12 @@ ixgb_setup_rx_resources(struct ixgb_adapter *adapter)
         int size;
 
         size = sizeof(struct ixgb_buffer) * rxdr->count;
-        rxdr->buffer_info = vmalloc(size);
+        rxdr->buffer_info = vzalloc(size);
         if (!rxdr->buffer_info) {
                 netif_err(adapter, probe, adapter->netdev,
                           "Unable to allocate receive descriptor ring\n");
                 return -ENOMEM;
         }
-        memset(rxdr->buffer_info, 0, size);
 
         /* Round up to nearest 4K */
 
diff --git a/drivers/net/ixgbe/Makefile b/drivers/net/ixgbe/Makefile
index 8f81efb4916..7d7387fbdec 100644
--- a/drivers/net/ixgbe/Makefile
+++ b/drivers/net/ixgbe/Makefile
@@ -34,7 +34,7 @@ obj-$(CONFIG_IXGBE) += ixgbe.o
 
 ixgbe-objs := ixgbe_main.o ixgbe_common.o ixgbe_ethtool.o \
               ixgbe_82599.o ixgbe_82598.o ixgbe_phy.o ixgbe_sriov.o \
-              ixgbe_mbx.o
+              ixgbe_mbx.o ixgbe_x540.o
 
 ixgbe-$(CONFIG_IXGBE_DCB) +=  ixgbe_dcb.o ixgbe_dcb_82598.o \
                               ixgbe_dcb_82599.o ixgbe_dcb_nl.o
diff --git a/drivers/net/ixgbe/ixgbe.h b/drivers/net/ixgbe/ixgbe.h
index ed8703cfffb..3ae30b8cb7d 100644
--- a/drivers/net/ixgbe/ixgbe.h
+++ b/drivers/net/ixgbe/ixgbe.h
@@ -61,10 +61,8 @@
 #define IXGBE_MIN_RXD                        64
 
 /* flow control */
-#define IXGBE_DEFAULT_FCRTL             0x10000
 #define IXGBE_MIN_FCRTL                    0x40
 #define IXGBE_MAX_FCRTL                 0x7FF80
-#define IXGBE_DEFAULT_FCRTH             0x20000
 #define IXGBE_MIN_FCRTH                   0x600
 #define IXGBE_MAX_FCRTH                 0x7FFF0
 #define IXGBE_DEFAULT_FCPAUSE            0xFFFF
@@ -130,7 +128,9 @@ struct ixgbe_tx_buffer {
         unsigned long time_stamp;
         u16 length;
         u16 next_to_watch;
-        u16 mapped_as_page;
+        unsigned int bytecount;
+        u16 gso_segs;
+        u8 mapped_as_page;
 };
 
 struct ixgbe_rx_buffer {
@@ -146,12 +146,56 @@ struct ixgbe_queue_stats {
         u64 bytes;
 };
 
+struct ixgbe_tx_queue_stats {
+        u64 restart_queue;
+        u64 tx_busy;
+        u64 completed;
+        u64 tx_done_old;
+};
+
+struct ixgbe_rx_queue_stats {
+        u64 rsc_count;
+        u64 rsc_flush;
+        u64 non_eop_descs;
+        u64 alloc_rx_page_failed;
+        u64 alloc_rx_buff_failed;
+};
+
+enum ixbge_ring_state_t {
+        __IXGBE_TX_FDIR_INIT_DONE,
+        __IXGBE_TX_DETECT_HANG,
+        __IXGBE_HANG_CHECK_ARMED,
+        __IXGBE_RX_PS_ENABLED,
+        __IXGBE_RX_RSC_ENABLED,
+};
+
+#define ring_is_ps_enabled(ring) \
+        test_bit(__IXGBE_RX_PS_ENABLED, &(ring)->state)
+#define set_ring_ps_enabled(ring) \
+        set_bit(__IXGBE_RX_PS_ENABLED, &(ring)->state)
+#define clear_ring_ps_enabled(ring) \
+        clear_bit(__IXGBE_RX_PS_ENABLED, &(ring)->state)
+#define check_for_tx_hang(ring) \
+        test_bit(__IXGBE_TX_DETECT_HANG, &(ring)->state)
+#define set_check_for_tx_hang(ring) \
+        set_bit(__IXGBE_TX_DETECT_HANG, &(ring)->state)
+#define clear_check_for_tx_hang(ring) \
+        clear_bit(__IXGBE_TX_DETECT_HANG, &(ring)->state)
+#define ring_is_rsc_enabled(ring) \
+        test_bit(__IXGBE_RX_RSC_ENABLED, &(ring)->state)
+#define set_ring_rsc_enabled(ring) \
+        set_bit(__IXGBE_RX_RSC_ENABLED, &(ring)->state)
+#define clear_ring_rsc_enabled(ring) \
+        clear_bit(__IXGBE_RX_RSC_ENABLED, &(ring)->state)
 struct ixgbe_ring {
         void *desc;                     /* descriptor ring memory */
+        struct device *dev;             /* device for DMA mapping */
+        struct net_device *netdev;      /* netdev ring belongs to */
         union {
                 struct ixgbe_tx_buffer *tx_buffer_info;
                 struct ixgbe_rx_buffer *rx_buffer_info;
         };
+        unsigned long state;
         u8 atr_sample_rate;
         u8 atr_count;
         u16 count;                      /* amount of descriptors */
@@ -160,38 +204,30 @@ struct ixgbe_ring {
         u16 next_to_clean;
 
         u8 queue_index; /* needed for multiqueue queue management */
-
-#define IXGBE_RING_RX_PS_ENABLED                (u8)(1)
-        u8 flags;                       /* per ring feature flags */
-        u16 head;
-        u16 tail;
-
-        unsigned int total_bytes;
-        unsigned int total_packets;
-
-#ifdef CONFIG_IXGBE_DCA
-        /* cpu for tx queue */
-        int cpu;
-#endif
-
-        u16 work_limit;                 /* max work per interrupt */
-        u16 reg_idx;                    /* holds the special value that gets
+        u8 reg_idx;                     /* holds the special value that gets
                                          * the hardware register offset
                                          * associated with this ring, which is
                                          * different for DCB and RSS modes
                                          */
 
+        u16 work_limit;                 /* max work per interrupt */
+
+        u8 __iomem *tail;
+
+        unsigned int total_bytes;
+        unsigned int total_packets;
+
         struct ixgbe_queue_stats stats;
         struct u64_stats_sync syncp;
+        union {
+                struct ixgbe_tx_queue_stats tx_stats;
+                struct ixgbe_rx_queue_stats rx_stats;
+        };
         int numa_node;
-        unsigned long reinit_state;
-        u64 rsc_count;                  /* stat for coalesced packets */
-        u64 rsc_flush;                  /* stats for flushed packets */
-        u32 restart_queue;              /* track tx queue restarts */
-        u32 non_eop_descs;              /* track hardware descriptor chaining */
-
         unsigned int size;              /* length in bytes */
         dma_addr_t dma;                 /* phys. address of descriptor ring */
+        struct rcu_head rcu;
+        struct ixgbe_q_vector *q_vector; /* back-pointer to host q_vector */
 } ____cacheline_internodealigned_in_smp;
 
 enum ixgbe_ring_f_enum {
@@ -237,6 +273,9 @@ struct ixgbe_q_vector {
         unsigned int v_idx; /* index of q_vector within array, also used for
                              * finding the bit in EICR and friends that
                              * represents the vector for this ring */
+#ifdef CONFIG_IXGBE_DCA
+        int cpu;            /* CPU for DCA */
+#endif
         struct napi_struct napi;
         DECLARE_BITMAP(rxr_idx, MAX_RX_QUEUES); /* Rx ring indices */
         DECLARE_BITMAP(txr_idx, MAX_TX_QUEUES); /* Tx ring indices */
@@ -246,6 +285,7 @@ struct ixgbe_q_vector {
         u8 rx_itr;
         u32 eitr;
         cpumask_var_t affinity_mask;
+        char name[IFNAMSIZ + 9];
 };
 
 /* Helper macros to switch between ints/sec and what the register uses.
@@ -294,7 +334,6 @@ struct ixgbe_adapter {
         u16 bd_number;
         struct work_struct reset_task;
         struct ixgbe_q_vector *q_vector[MAX_MSIX_Q_VECTORS];
-        char name[MAX_MSIX_COUNT][IFNAMSIZ + 9];
         struct ixgbe_dcb_config dcb_cfg;
         struct ixgbe_dcb_config temp_dcb_cfg;
         u8 dcb_set_bitmap;
@@ -417,6 +456,7 @@ struct ixgbe_adapter {
         int node;
         struct work_struct check_overtemp_task;
         u32 interrupt_event;
+        char lsc_int_name[IFNAMSIZ + 9];
 
         /* SR-IOV */
         DECLARE_BITMAP(active_vfs, IXGBE_MAX_VF_FUNCTIONS);
@@ -428,17 +468,25 @@ enum ixbge_state_t {
         __IXGBE_TESTING,
         __IXGBE_RESETTING,
         __IXGBE_DOWN,
-        __IXGBE_FDIR_INIT_DONE,
         __IXGBE_SFP_MODULE_NOT_FOUND
 };
 
+struct ixgbe_rsc_cb {
+        dma_addr_t dma;
+        u16 skb_cnt;
+        bool delay_unmap;
+};
+#define IXGBE_RSC_CB(skb) ((struct ixgbe_rsc_cb *)(skb)->cb)
+
 enum ixgbe_boards {
         board_82598,
         board_82599,
+        board_X540,
 };
 
 extern struct ixgbe_info ixgbe_82598_info;
 extern struct ixgbe_info ixgbe_82599_info;
+extern struct ixgbe_info ixgbe_X540_info;
 #ifdef CONFIG_IXGBE_DCB
 extern const struct dcbnl_rtnl_ops dcbnl_ops;
 extern int ixgbe_copy_dcb_cfg(struct ixgbe_dcb_config *src_dcb_cfg,
@@ -454,26 +502,24 @@ extern void ixgbe_down(struct ixgbe_adapter *adapter);
 extern void ixgbe_reinit_locked(struct ixgbe_adapter *adapter);
 extern void ixgbe_reset(struct ixgbe_adapter *adapter);
 extern void ixgbe_set_ethtool_ops(struct net_device *netdev);
-extern int ixgbe_setup_rx_resources(struct ixgbe_adapter *, struct ixgbe_ring *);
-extern int ixgbe_setup_tx_resources(struct ixgbe_adapter *, struct ixgbe_ring *);
-extern void ixgbe_free_rx_resources(struct ixgbe_adapter *, struct ixgbe_ring *);
-extern void ixgbe_free_tx_resources(struct ixgbe_adapter *, struct ixgbe_ring *);
+extern int ixgbe_setup_rx_resources(struct ixgbe_ring *);
+extern int ixgbe_setup_tx_resources(struct ixgbe_ring *);
+extern void ixgbe_free_rx_resources(struct ixgbe_ring *);
+extern void ixgbe_free_tx_resources(struct ixgbe_ring *);
 extern void ixgbe_configure_rx_ring(struct ixgbe_adapter *,struct ixgbe_ring *);
 extern void ixgbe_configure_tx_ring(struct ixgbe_adapter *,struct ixgbe_ring *);
 extern void ixgbe_update_stats(struct ixgbe_adapter *adapter);
 extern int ixgbe_init_interrupt_scheme(struct ixgbe_adapter *adapter);
 extern void ixgbe_clear_interrupt_scheme(struct ixgbe_adapter *adapter);
 extern netdev_tx_t ixgbe_xmit_frame_ring(struct sk_buff *,
-                                         struct net_device *,
                                          struct ixgbe_adapter *,
                                          struct ixgbe_ring *);
-extern void ixgbe_unmap_and_free_tx_resource(struct ixgbe_adapter *,
+extern void ixgbe_unmap_and_free_tx_resource(struct ixgbe_ring *,
                                              struct ixgbe_tx_buffer *);
-extern void ixgbe_alloc_rx_buffers(struct ixgbe_adapter *adapter,
-                                   struct ixgbe_ring *rx_ring,
-                                   int cleaned_count);
+extern void ixgbe_alloc_rx_buffers(struct ixgbe_ring *, u16);
 extern void ixgbe_write_eitr(struct ixgbe_q_vector *);
 extern int ethtool_ioctl(struct ifreq *ifr);
+extern u8 ixgbe_dcb_txq_to_tc(struct ixgbe_adapter *adapter, u8 index);
 extern s32 ixgbe_reinit_fdir_tables_82599(struct ixgbe_hw *hw);
 extern s32 ixgbe_init_fdir_signature_82599(struct ixgbe_hw *hw, u32 pballoc);
 extern s32 ixgbe_init_fdir_perfect_82599(struct ixgbe_hw *hw, u32 pballoc);
@@ -498,6 +544,10 @@ extern s32 ixgbe_atr_set_flex_byte_82599(struct ixgbe_atr_input *input,
                                          u16 flex_byte);
 extern s32 ixgbe_atr_set_l4type_82599(struct ixgbe_atr_input *input,
                                       u8 l4type);
+extern void ixgbe_configure_rscctl(struct ixgbe_adapter *adapter,
+                                   struct ixgbe_ring *ring);
+extern void ixgbe_clear_rscctl(struct ixgbe_adapter *adapter,
+                               struct ixgbe_ring *ring);
 extern void ixgbe_set_rx_mode(struct net_device *netdev);
 #ifdef IXGBE_FCOE
 extern void ixgbe_configure_fcoe(struct ixgbe_adapter *adapter);
diff --git a/drivers/net/ixgbe/ixgbe_82598.c b/drivers/net/ixgbe/ixgbe_82598.c
index 9c02d6014cc..d0f1d9d2c41 100644
--- a/drivers/net/ixgbe/ixgbe_82598.c
+++ b/drivers/net/ixgbe/ixgbe_82598.c
@@ -38,9 +38,6 @@
 #define IXGBE_82598_MC_TBL_SIZE  128
 #define IXGBE_82598_VFT_TBL_SIZE 128
 
-static s32 ixgbe_get_copper_link_capabilities_82598(struct ixgbe_hw *hw,
-                                             ixgbe_link_speed *speed,
-                                             bool *autoneg);
 static s32 ixgbe_setup_copper_link_82598(struct ixgbe_hw *hw,
                                          ixgbe_link_speed speed,
                                          bool autoneg,
@@ -156,7 +153,7 @@ static s32 ixgbe_init_phy_ops_82598(struct ixgbe_hw *hw)
         if (mac->ops.get_media_type(hw) == ixgbe_media_type_copper) {
                 mac->ops.setup_link = &ixgbe_setup_copper_link_82598;
                 mac->ops.get_link_capabilities =
-                                  &ixgbe_get_copper_link_capabilities_82598;
+                        &ixgbe_get_copper_link_capabilities_generic;
         }
 
         switch (hw->phy.type) {
@@ -274,37 +271,6 @@ static s32 ixgbe_get_link_capabilities_82598(struct ixgbe_hw *hw,
 }
 
 /**
- *  ixgbe_get_copper_link_capabilities_82598 - Determines link capabilities
- *  @hw: pointer to hardware structure
- *  @speed: pointer to link speed
- *  @autoneg: boolean auto-negotiation value
- *
- *  Determines the link capabilities by reading the AUTOC register.
- **/
-static s32 ixgbe_get_copper_link_capabilities_82598(struct ixgbe_hw *hw,
-                                                    ixgbe_link_speed *speed,
-                                                    bool *autoneg)
-{
-        s32 status = IXGBE_ERR_LINK_SETUP;
-        u16 speed_ability;
-
-        *speed = 0;
-        *autoneg = true;
-
-        status = hw->phy.ops.read_reg(hw, MDIO_SPEED, MDIO_MMD_PMAPMD,
-                                      &speed_ability);
-
-        if (status == 0) {
-                if (speed_ability & MDIO_SPEED_10G)
-                    *speed |= IXGBE_LINK_SPEED_10GB_FULL;
-                if (speed_ability & MDIO_PMA_SPEED_1000)
-                    *speed |= IXGBE_LINK_SPEED_1GB_FULL;
-        }
-
-        return status;
-}
-
-/**
  *  ixgbe_get_media_type_82598 - Determines media type
  *  @hw: pointer to hardware structure
  *
@@ -357,6 +323,7 @@ static s32 ixgbe_fc_enable_82598(struct ixgbe_hw *hw, s32 packetbuf_num)
         u32 fctrl_reg;
         u32 rmcs_reg;
         u32 reg;
+        u32 rx_pba_size;
         u32 link_speed = 0;
         bool link_up;
 
@@ -459,16 +426,18 @@ static s32 ixgbe_fc_enable_82598(struct ixgbe_hw *hw, s32 packetbuf_num)
 
         /* Set up and enable Rx high/low water mark thresholds, enable XON. */
         if (hw->fc.current_mode & ixgbe_fc_tx_pause) {
-                if (hw->fc.send_xon) {
-                        IXGBE_WRITE_REG(hw, IXGBE_FCRTL(packetbuf_num),
-                                        (hw->fc.low_water | IXGBE_FCRTL_XONE));
-                } else {
-                        IXGBE_WRITE_REG(hw, IXGBE_FCRTL(packetbuf_num),
-                                        hw->fc.low_water);
-                }
+                rx_pba_size = IXGBE_READ_REG(hw, IXGBE_RXPBSIZE(packetbuf_num));
+                rx_pba_size >>= IXGBE_RXPBSIZE_SHIFT;
+
+                reg = (rx_pba_size - hw->fc.low_water) << 6;
+                if (hw->fc.send_xon)
+                        reg |= IXGBE_FCRTL_XONE;
+                IXGBE_WRITE_REG(hw, IXGBE_FCRTL(packetbuf_num), reg);
+
+                reg = (rx_pba_size - hw->fc.high_water) << 10;
+                reg |= IXGBE_FCRTH_FCEN;
 
-                IXGBE_WRITE_REG(hw, IXGBE_FCRTH(packetbuf_num),
-                                (hw->fc.high_water | IXGBE_FCRTH_FCEN));
+                IXGBE_WRITE_REG(hw, IXGBE_FCRTH(packetbuf_num), reg);
         }
 
         /* Configure pause time (2 TCs per register) */
@@ -1222,6 +1191,7 @@ static struct ixgbe_mac_operations mac_ops_82598 = {
 static struct ixgbe_eeprom_operations eeprom_ops_82598 = {
         .init_params            = &ixgbe_init_eeprom_params_generic,
         .read                   = &ixgbe_read_eerd_generic,
+        .calc_checksum          = &ixgbe_calc_eeprom_checksum_generic,
         .validate_checksum      = &ixgbe_validate_eeprom_checksum_generic,
         .update_checksum        = &ixgbe_update_eeprom_checksum_generic,
 };
diff --git a/drivers/net/ixgbe/ixgbe_82599.c b/drivers/net/ixgbe/ixgbe_82599.c
index 0bd8fbb5bfd..6827dddc383 100644
--- a/drivers/net/ixgbe/ixgbe_82599.c
+++ b/drivers/net/ixgbe/ixgbe_82599.c
@@ -56,9 +56,6 @@ static s32 ixgbe_setup_mac_link_82599(struct ixgbe_hw *hw,
                                ixgbe_link_speed speed,
                                bool autoneg,
                                bool autoneg_wait_to_complete);
-static s32 ixgbe_get_copper_link_capabilities_82599(struct ixgbe_hw *hw,
-                                             ixgbe_link_speed *speed,
-                                             bool *autoneg);
 static s32 ixgbe_setup_copper_link_82599(struct ixgbe_hw *hw,
                                          ixgbe_link_speed speed,
                                          bool autoneg,
@@ -68,9 +65,9 @@ static s32 ixgbe_verify_fw_version_82599(struct ixgbe_hw *hw);
 static void ixgbe_init_mac_link_ops_82599(struct ixgbe_hw *hw)
 {
         struct ixgbe_mac_info *mac = &hw->mac;
-        if (hw->phy.multispeed_fiber) {
-                /* Set up dual speed SFP+ support */
-                mac->ops.setup_link = &ixgbe_setup_mac_link_multispeed_fiber;
+
+        /* enable the laser control functions for SFP+ fiber */
+        if (mac->ops.get_media_type(hw) == ixgbe_media_type_fiber) {
                 mac->ops.disable_tx_laser =
                                        &ixgbe_disable_tx_laser_multispeed_fiber;
                 mac->ops.enable_tx_laser =
@@ -80,6 +77,12 @@ static void ixgbe_init_mac_link_ops_82599(struct ixgbe_hw *hw)
                 mac->ops.disable_tx_laser = NULL;
                 mac->ops.enable_tx_laser = NULL;
                 mac->ops.flap_tx_laser = NULL;
+        }
+
+        if (hw->phy.multispeed_fiber) {
+                /* Set up dual speed SFP+ support */
+                mac->ops.setup_link = &ixgbe_setup_mac_link_multispeed_fiber;
+        } else {
                 if ((mac->ops.get_media_type(hw) ==
                      ixgbe_media_type_backplane) &&
                     (hw->phy.smart_speed == ixgbe_smart_speed_auto ||
@@ -93,6 +96,8 @@ static void ixgbe_init_mac_link_ops_82599(struct ixgbe_hw *hw)
 static s32 ixgbe_setup_sfp_modules_82599(struct ixgbe_hw *hw)
 {
         s32 ret_val = 0;
+        u32 reg_anlp1 = 0;
+        u32 i = 0;
         u16 list_offset, data_offset, data_value;
 
         if (hw->phy.sfp_type != ixgbe_sfp_type_unknown) {
@@ -119,14 +124,34 @@ static s32 ixgbe_setup_sfp_modules_82599(struct ixgbe_hw *hw)
                         IXGBE_WRITE_FLUSH(hw);
                         hw->eeprom.ops.read(hw, ++data_offset, &data_value);
                 }
-                /* Now restart DSP by setting Restart_AN */
-                IXGBE_WRITE_REG(hw, IXGBE_AUTOC,
-                    (IXGBE_READ_REG(hw, IXGBE_AUTOC) | IXGBE_AUTOC_AN_RESTART));
 
                 /* Release the semaphore */
                 ixgbe_release_swfw_sync(hw, IXGBE_GSSR_MAC_CSR_SM);
                 /* Delay obtaining semaphore again to allow FW access */
                 msleep(hw->eeprom.semaphore_delay);
+
+                /* Now restart DSP by setting Restart_AN and clearing LMS */
+                IXGBE_WRITE_REG(hw, IXGBE_AUTOC, ((IXGBE_READ_REG(hw,
+                                IXGBE_AUTOC) & ~IXGBE_AUTOC_LMS_MASK) |
+                                IXGBE_AUTOC_AN_RESTART));
+
+                /* Wait for AN to leave state 0 */
+                for (i = 0; i < 10; i++) {
+                        msleep(4);
+                        reg_anlp1 = IXGBE_READ_REG(hw, IXGBE_ANLP1);
+                        if (reg_anlp1 & IXGBE_ANLP1_AN_STATE_MASK)
+                                break;
+                }
+                if (!(reg_anlp1 & IXGBE_ANLP1_AN_STATE_MASK)) {
+                        hw_dbg(hw, "sfp module setup not complete\n");
+                        ret_val = IXGBE_ERR_SFP_SETUP_NOT_COMPLETE;
+                        goto setup_sfp_out;
+                }
+
+                /* Restart DSP by setting Restart_AN and return to SFI mode */
+                IXGBE_WRITE_REG(hw, IXGBE_AUTOC, (IXGBE_READ_REG(hw,
+                                IXGBE_AUTOC) | IXGBE_AUTOC_LMS_10G_SERIAL |
+                                IXGBE_AUTOC_AN_RESTART));
         }
 
 setup_sfp_out:
@@ -174,7 +199,7 @@ static s32 ixgbe_init_phy_ops_82599(struct ixgbe_hw *hw)
         if (mac->ops.get_media_type(hw) == ixgbe_media_type_copper) {
                 mac->ops.setup_link = &ixgbe_setup_copper_link_82599;
                 mac->ops.get_link_capabilities =
-                                  &ixgbe_get_copper_link_capabilities_82599;
+                        &ixgbe_get_copper_link_capabilities_generic;
         }
 
         /* Set necessary function pointers based on phy type */
@@ -184,6 +209,10 @@ static s32 ixgbe_init_phy_ops_82599(struct ixgbe_hw *hw)
                 phy->ops.get_firmware_version =
                              &ixgbe_get_phy_firmware_version_tnx;
                 break;
+        case ixgbe_phy_aq:
+                phy->ops.get_firmware_version =
+                        &ixgbe_get_phy_firmware_version_generic;
+                break;
         default:
                 break;
         }
@@ -290,37 +319,6 @@ out:
 }
 
 /**
- *  ixgbe_get_copper_link_capabilities_82599 - Determines link capabilities
- *  @hw: pointer to hardware structure
- *  @speed: pointer to link speed
- *  @autoneg: boolean auto-negotiation value
- *
- *  Determines the link capabilities by reading the AUTOC register.
- **/
-static s32 ixgbe_get_copper_link_capabilities_82599(struct ixgbe_hw *hw,
-                                                    ixgbe_link_speed *speed,
-                                                    bool *autoneg)
-{
-        s32 status = IXGBE_ERR_LINK_SETUP;
-        u16 speed_ability;
-
-        *speed = 0;
-        *autoneg = true;
-
-        status = hw->phy.ops.read_reg(hw, MDIO_SPEED, MDIO_MMD_PMAPMD,
-                                      &speed_ability);
-
-        if (status == 0) {
-                if (speed_ability & MDIO_SPEED_10G)
-                    *speed |= IXGBE_LINK_SPEED_10GB_FULL;
-                if (speed_ability & MDIO_PMA_SPEED_1000)
-                    *speed |= IXGBE_LINK_SPEED_1GB_FULL;
-        }
-
-        return status;
-}
-
-/**
  *  ixgbe_get_media_type_82599 - Get media type
  *  @hw: pointer to hardware structure
  *
@@ -332,7 +330,8 @@ static enum ixgbe_media_type ixgbe_get_media_type_82599(struct ixgbe_hw *hw)
 
         /* Detect if there is a copper PHY attached. */
         if (hw->phy.type == ixgbe_phy_cu_unknown ||
-            hw->phy.type == ixgbe_phy_tn) {
+            hw->phy.type == ixgbe_phy_tn ||
+            hw->phy.type == ixgbe_phy_aq) {
                 media_type = ixgbe_media_type_copper;
                 goto out;
         }
@@ -342,11 +341,13 @@ static enum ixgbe_media_type ixgbe_get_media_type_82599(struct ixgbe_hw *hw)
         case IXGBE_DEV_ID_82599_KX4_MEZZ:
         case IXGBE_DEV_ID_82599_COMBO_BACKPLANE:
         case IXGBE_DEV_ID_82599_KR:
+        case IXGBE_DEV_ID_82599_BACKPLANE_FCOE:
         case IXGBE_DEV_ID_82599_XAUI_LOM:
                 /* Default device ID is mezzanine card KX/KX4 */
                 media_type = ixgbe_media_type_backplane;
                 break;
         case IXGBE_DEV_ID_82599_SFP:
+        case IXGBE_DEV_ID_82599_SFP_FCOE:
         case IXGBE_DEV_ID_82599_SFP_EM:
                 media_type = ixgbe_media_type_fiber;
                 break;
@@ -1924,6 +1925,7 @@ static u32 ixgbe_get_supported_physical_layer_82599(struct ixgbe_hw *hw)
         hw->phy.ops.identify(hw);
 
         if (hw->phy.type == ixgbe_phy_tn ||
+            hw->phy.type == ixgbe_phy_aq ||
             hw->phy.type == ixgbe_phy_cu_unknown) {
                 hw->phy.ops.read_reg(hw, MDIO_PMA_EXTABLE, MDIO_MMD_PMAPMD,
                                      &ext_ability);
@@ -2125,51 +2127,6 @@ fw_version_out:
         return status;
 }
 
-/**
- *  ixgbe_get_wwn_prefix_82599 - Get alternative WWNN/WWPN prefix from
- *  the EEPROM
- *  @hw: pointer to hardware structure
- *  @wwnn_prefix: the alternative WWNN prefix
- *  @wwpn_prefix: the alternative WWPN prefix
- *
- *  This function will read the EEPROM from the alternative SAN MAC address
- *  block to check the support for the alternative WWNN/WWPN prefix support.
- **/
-static s32 ixgbe_get_wwn_prefix_82599(struct ixgbe_hw *hw, u16 *wwnn_prefix,
-                                      u16 *wwpn_prefix)
-{
-        u16 offset, caps;
-        u16 alt_san_mac_blk_offset;
-
-        /* clear output first */
-        *wwnn_prefix = 0xFFFF;
-        *wwpn_prefix = 0xFFFF;
-
-        /* check if alternative SAN MAC is supported */
-        hw->eeprom.ops.read(hw, IXGBE_ALT_SAN_MAC_ADDR_BLK_PTR,
-                            &alt_san_mac_blk_offset);
-
-        if ((alt_san_mac_blk_offset == 0) ||
-            (alt_san_mac_blk_offset == 0xFFFF))
-                goto wwn_prefix_out;
-
-        /* check capability in alternative san mac address block */
-        offset = alt_san_mac_blk_offset + IXGBE_ALT_SAN_MAC_ADDR_CAPS_OFFSET;
-        hw->eeprom.ops.read(hw, offset, &caps);
-        if (!(caps & IXGBE_ALT_SAN_MAC_ADDR_CAPS_ALTWWN))
-                goto wwn_prefix_out;
-
-        /* get the corresponding prefix for WWNN/WWPN */
-        offset = alt_san_mac_blk_offset + IXGBE_ALT_SAN_MAC_ADDR_WWNN_OFFSET;
-        hw->eeprom.ops.read(hw, offset, wwnn_prefix);
-
-        offset = alt_san_mac_blk_offset + IXGBE_ALT_SAN_MAC_ADDR_WWPN_OFFSET;
-        hw->eeprom.ops.read(hw, offset, wwpn_prefix);
-
-wwn_prefix_out:
-        return 0;
-}
-
 static struct ixgbe_mac_operations mac_ops_82599 = {
         .init_hw                = &ixgbe_init_hw_generic,
         .reset_hw               = &ixgbe_reset_hw_82599,
@@ -2181,7 +2138,7 @@ static struct ixgbe_mac_operations mac_ops_82599 = {
         .get_mac_addr           = &ixgbe_get_mac_addr_generic,
         .get_san_mac_addr       = &ixgbe_get_san_mac_addr_generic,
         .get_device_caps        = &ixgbe_get_device_caps_82599,
-        .get_wwn_prefix         = &ixgbe_get_wwn_prefix_82599,
+        .get_wwn_prefix         = &ixgbe_get_wwn_prefix_generic,
         .stop_adapter           = &ixgbe_stop_adapter_generic,
         .get_bus_info           = &ixgbe_get_bus_info_generic,
         .set_lan_id             = &ixgbe_set_lan_id_multi_port_pcie,
@@ -2214,6 +2171,7 @@ static struct ixgbe_eeprom_operations eeprom_ops_82599 = {
         .init_params            = &ixgbe_init_eeprom_params_generic,
         .read                   = &ixgbe_read_eerd_generic,
         .write                  = &ixgbe_write_eeprom_generic,
+        .calc_checksum          = &ixgbe_calc_eeprom_checksum_generic,
         .validate_checksum      = &ixgbe_validate_eeprom_checksum_generic,
         .update_checksum        = &ixgbe_update_eeprom_checksum_generic,
 };
@@ -2240,5 +2198,5 @@ struct ixgbe_info ixgbe_82599_info = {
         .mac_ops                = &mac_ops_82599,
         .eeprom_ops             = &eeprom_ops_82599,
         .phy_ops                = &phy_ops_82599,
-        .mbx_ops                = &mbx_ops_82599,
+        .mbx_ops                = &mbx_ops_generic,
 };
diff --git a/drivers/net/ixgbe/ixgbe_common.c b/drivers/net/ixgbe/ixgbe_common.c
index e3eca131638..cc11e422ce9 100644
--- a/drivers/net/ixgbe/ixgbe_common.c
+++ b/drivers/net/ixgbe/ixgbe_common.c
@@ -45,14 +45,12 @@ static u16 ixgbe_shift_in_eeprom_bits(struct ixgbe_hw *hw, u16 count);
 static void ixgbe_raise_eeprom_clk(struct ixgbe_hw *hw, u32 *eec);
 static void ixgbe_lower_eeprom_clk(struct ixgbe_hw *hw, u32 *eec);
 static void ixgbe_release_eeprom(struct ixgbe_hw *hw);
-static u16 ixgbe_calc_eeprom_checksum(struct ixgbe_hw *hw);
 
 static void ixgbe_enable_rar(struct ixgbe_hw *hw, u32 index);
 static void ixgbe_disable_rar(struct ixgbe_hw *hw, u32 index);
 static s32 ixgbe_mta_vector(struct ixgbe_hw *hw, u8 *mc_addr);
 static void ixgbe_add_uc_addr(struct ixgbe_hw *hw, u8 *addr, u32 vmdq);
 static s32 ixgbe_setup_fc(struct ixgbe_hw *hw, s32 packetbuf_num);
-static s32 ixgbe_poll_eerd_eewr_done(struct ixgbe_hw *hw, u32 ee_reg);
 
 /**
  *  ixgbe_start_hw_generic - Prepare hardware for Tx/Rx
@@ -198,30 +196,110 @@ s32 ixgbe_clear_hw_cntrs_generic(struct ixgbe_hw *hw)
 }
 
 /**
- *  ixgbe_read_pba_num_generic - Reads part number from EEPROM
+ *  ixgbe_read_pba_string_generic - Reads part number string from EEPROM
  *  @hw: pointer to hardware structure
- *  @pba_num: stores the part number from the EEPROM
+ *  @pba_num: stores the part number string from the EEPROM
+ *  @pba_num_size: part number string buffer length
  *
- *  Reads the part number from the EEPROM.
+ *  Reads the part number string from the EEPROM.
  **/
-s32 ixgbe_read_pba_num_generic(struct ixgbe_hw *hw, u32 *pba_num)
+s32 ixgbe_read_pba_string_generic(struct ixgbe_hw *hw, u8 *pba_num,
+                                  u32 pba_num_size)
 {
         s32 ret_val;
         u16 data;
+        u16 pba_ptr;
+        u16 offset;
+        u16 length;
+
+        if (pba_num == NULL) {
+                hw_dbg(hw, "PBA string buffer was null\n");
+                return IXGBE_ERR_INVALID_ARGUMENT;
+        }
 
         ret_val = hw->eeprom.ops.read(hw, IXGBE_PBANUM0_PTR, &data);
         if (ret_val) {
                 hw_dbg(hw, "NVM Read Error\n");
                 return ret_val;
         }
-        *pba_num = (u32)(data << 16);
 
-        ret_val = hw->eeprom.ops.read(hw, IXGBE_PBANUM1_PTR, &data);
+        ret_val = hw->eeprom.ops.read(hw, IXGBE_PBANUM1_PTR, &pba_ptr);
         if (ret_val) {
                 hw_dbg(hw, "NVM Read Error\n");
                 return ret_val;
         }
-        *pba_num |= data;
+
+        /*
+         * if data is not ptr guard the PBA must be in legacy format which
+         * means pba_ptr is actually our second data word for the PBA number
+         * and we can decode it into an ascii string
+         */
+        if (data != IXGBE_PBANUM_PTR_GUARD) {
+                hw_dbg(hw, "NVM PBA number is not stored as string\n");
+
+                /* we will need 11 characters to store the PBA */
+                if (pba_num_size < 11) {
+                        hw_dbg(hw, "PBA string buffer too small\n");
+                        return IXGBE_ERR_NO_SPACE;
+                }
+
+                /* extract hex string from data and pba_ptr */
+                pba_num[0] = (data >> 12) & 0xF;
+                pba_num[1] = (data >> 8) & 0xF;
+                pba_num[2] = (data >> 4) & 0xF;
+                pba_num[3] = data & 0xF;
+                pba_num[4] = (pba_ptr >> 12) & 0xF;
+                pba_num[5] = (pba_ptr >> 8) & 0xF;
+                pba_num[6] = '-';
+                pba_num[7] = 0;
+                pba_num[8] = (pba_ptr >> 4) & 0xF;
+                pba_num[9] = pba_ptr & 0xF;
+
+                /* put a null character on the end of our string */
+                pba_num[10] = '\0';
+
+                /* switch all the data but the '-' to hex char */
+                for (offset = 0; offset < 10; offset++) {
+                        if (pba_num[offset] < 0xA)
+                                pba_num[offset] += '0';
+                        else if (pba_num[offset] < 0x10)
+                                pba_num[offset] += 'A' - 0xA;
+                }
+
+                return 0;
+        }
+
+        ret_val = hw->eeprom.ops.read(hw, pba_ptr, &length);
+        if (ret_val) {
+                hw_dbg(hw, "NVM Read Error\n");
+                return ret_val;
+        }
+
+        if (length == 0xFFFF || length == 0) {
+                hw_dbg(hw, "NVM PBA number section invalid length\n");
+                return IXGBE_ERR_PBA_SECTION;
+        }
+
+        /* check if pba_num buffer is big enough */
+        if (pba_num_size  < (((u32)length * 2) - 1)) {
+                hw_dbg(hw, "PBA string buffer too small\n");
+                return IXGBE_ERR_NO_SPACE;
+        }
+
+        /* trim pba length from start of string */
+        pba_ptr++;
+        length--;
+
+        for (offset = 0; offset < length; offset++) {
+                ret_val = hw->eeprom.ops.read(hw, pba_ptr + offset, &data);
+                if (ret_val) {
+                        hw_dbg(hw, "NVM Read Error\n");
+                        return ret_val;
+                }
+                pba_num[offset * 2] = (u8)(data >> 8);
+                pba_num[(offset * 2) + 1] = (u8)(data & 0xFF);
+        }
+        pba_num[offset * 2] = '\0';
 
         return 0;
 }
@@ -638,7 +716,7 @@ out:
  *  Polls the status bit (bit 1) of the EERD or EEWR to determine when the
  *  read or write is done respectively.
  **/
-static s32 ixgbe_poll_eerd_eewr_done(struct ixgbe_hw *hw, u32 ee_reg)
+s32 ixgbe_poll_eerd_eewr_done(struct ixgbe_hw *hw, u32 ee_reg)
 {
         u32 i;
         u32 reg;
@@ -1009,7 +1087,7 @@ static void ixgbe_release_eeprom(struct ixgbe_hw *hw)
  *  ixgbe_calc_eeprom_checksum - Calculates and returns the checksum
  *  @hw: pointer to hardware structure
  **/
-static u16 ixgbe_calc_eeprom_checksum(struct ixgbe_hw *hw)
+u16 ixgbe_calc_eeprom_checksum_generic(struct ixgbe_hw *hw)
 {
         u16 i;
         u16 j;
@@ -1072,7 +1150,7 @@ s32 ixgbe_validate_eeprom_checksum_generic(struct ixgbe_hw *hw,
         status = hw->eeprom.ops.read(hw, 0, &checksum);
 
         if (status == 0) {
-                checksum = ixgbe_calc_eeprom_checksum(hw);
+                checksum = hw->eeprom.ops.calc_checksum(hw);
 
                 hw->eeprom.ops.read(hw, IXGBE_EEPROM_CHECKSUM, &read_checksum);
 
@@ -1110,7 +1188,7 @@ s32 ixgbe_update_eeprom_checksum_generic(struct ixgbe_hw *hw)
         status = hw->eeprom.ops.read(hw, 0, &checksum);
 
         if (status == 0) {
-                checksum = ixgbe_calc_eeprom_checksum(hw);
+                checksum = hw->eeprom.ops.calc_checksum(hw);
                 status = hw->eeprom.ops.write(hw, IXGBE_EEPROM_CHECKSUM,
                                             checksum);
         } else {
@@ -1595,6 +1673,7 @@ s32 ixgbe_fc_enable_generic(struct ixgbe_hw *hw, s32 packetbuf_num)
         u32 mflcn_reg, fccfg_reg;
         u32 reg;
         u32 rx_pba_size;
+        u32 fcrtl, fcrth;
 
 #ifdef CONFIG_DCB
         if (hw->fc.requested_mode == ixgbe_fc_pfc)
@@ -1671,41 +1750,21 @@ s32 ixgbe_fc_enable_generic(struct ixgbe_hw *hw, s32 packetbuf_num)
         IXGBE_WRITE_REG(hw, IXGBE_MFLCN, mflcn_reg);
         IXGBE_WRITE_REG(hw, IXGBE_FCCFG, fccfg_reg);
 
-        reg = IXGBE_READ_REG(hw, IXGBE_MTQC);
-        /* Thresholds are different for link flow control when in DCB mode */
-        if (reg & IXGBE_MTQC_RT_ENA) {
-                rx_pba_size = IXGBE_READ_REG(hw, IXGBE_RXPBSIZE(packetbuf_num));
+        rx_pba_size = IXGBE_READ_REG(hw, IXGBE_RXPBSIZE(packetbuf_num));
+        rx_pba_size >>= IXGBE_RXPBSIZE_SHIFT;
 
-                /* Always disable XON for LFC when in DCB mode */
-                reg = (rx_pba_size >> 5) & 0xFFE0;
-                IXGBE_WRITE_REG(hw, IXGBE_FCRTL_82599(packetbuf_num), reg);
+        fcrth = (rx_pba_size - hw->fc.high_water) << 10;
+        fcrtl = (rx_pba_size - hw->fc.low_water) << 10;
 
-                reg = (rx_pba_size >> 2) & 0xFFE0;
-                if (hw->fc.current_mode & ixgbe_fc_tx_pause)
-                        reg |= IXGBE_FCRTH_FCEN;
-                IXGBE_WRITE_REG(hw, IXGBE_FCRTH_82599(packetbuf_num), reg);
-        } else {
-                /*
-                 * Set up and enable Rx high/low water mark thresholds,
-                 * enable XON.
-                 */
-                if (hw->fc.current_mode & ixgbe_fc_tx_pause) {
-                        if (hw->fc.send_xon) {
-                                IXGBE_WRITE_REG(hw,
-                                              IXGBE_FCRTL_82599(packetbuf_num),
-                                              (hw->fc.low_water |
-                                              IXGBE_FCRTL_XONE));
-                        } else {
-                                IXGBE_WRITE_REG(hw,
-                                              IXGBE_FCRTL_82599(packetbuf_num),
-                                              hw->fc.low_water);
-                        }
-
-                        IXGBE_WRITE_REG(hw, IXGBE_FCRTH_82599(packetbuf_num),
-                                       (hw->fc.high_water | IXGBE_FCRTH_FCEN));
-                }
+        if (hw->fc.current_mode & ixgbe_fc_tx_pause) {
+                fcrth |= IXGBE_FCRTH_FCEN;
+                if (hw->fc.send_xon)
+                        fcrtl |= IXGBE_FCRTL_XONE;
         }
 
+        IXGBE_WRITE_REG(hw, IXGBE_FCRTH_82599(packetbuf_num), fcrth);
+        IXGBE_WRITE_REG(hw, IXGBE_FCRTL_82599(packetbuf_num), fcrtl);
+
         /* Configure pause time (2 TCs per register) */
         reg = IXGBE_READ_REG(hw, IXGBE_FCTTV(packetbuf_num / 2));
         if ((packetbuf_num & 1) == 0)
@@ -2705,3 +2764,48 @@ s32 ixgbe_check_mac_link_generic(struct ixgbe_hw *hw, ixgbe_link_speed *speed,
 
         return 0;
 }
+
+/**
+ *  ixgbe_get_wwn_prefix_generic Get alternative WWNN/WWPN prefix from
+ *  the EEPROM
+ *  @hw: pointer to hardware structure
+ *  @wwnn_prefix: the alternative WWNN prefix
+ *  @wwpn_prefix: the alternative WWPN prefix
+ *
+ *  This function will read the EEPROM from the alternative SAN MAC address
+ *  block to check the support for the alternative WWNN/WWPN prefix support.
+ **/
+s32 ixgbe_get_wwn_prefix_generic(struct ixgbe_hw *hw, u16 *wwnn_prefix,
+                                        u16 *wwpn_prefix)
+{
+        u16 offset, caps;
+        u16 alt_san_mac_blk_offset;
+
+        /* clear output first */
+        *wwnn_prefix = 0xFFFF;
+        *wwpn_prefix = 0xFFFF;
+
+        /* check if alternative SAN MAC is supported */
+        hw->eeprom.ops.read(hw, IXGBE_ALT_SAN_MAC_ADDR_BLK_PTR,
+                            &alt_san_mac_blk_offset);
+
+        if ((alt_san_mac_blk_offset == 0) ||
+            (alt_san_mac_blk_offset == 0xFFFF))
+                goto wwn_prefix_out;
+
+        /* check capability in alternative san mac address block */
+        offset = alt_san_mac_blk_offset + IXGBE_ALT_SAN_MAC_ADDR_CAPS_OFFSET;
+        hw->eeprom.ops.read(hw, offset, &caps);
+        if (!(caps & IXGBE_ALT_SAN_MAC_ADDR_CAPS_ALTWWN))
+                goto wwn_prefix_out;
+
+        /* get the corresponding prefix for WWNN/WWPN */
+        offset = alt_san_mac_blk_offset + IXGBE_ALT_SAN_MAC_ADDR_WWNN_OFFSET;
+        hw->eeprom.ops.read(hw, offset, wwnn_prefix);
+
+        offset = alt_san_mac_blk_offset + IXGBE_ALT_SAN_MAC_ADDR_WWPN_OFFSET;
+        hw->eeprom.ops.read(hw, offset, wwpn_prefix);
+
+wwn_prefix_out:
+        return 0;
+}
diff --git a/drivers/net/ixgbe/ixgbe_common.h b/drivers/net/ixgbe/ixgbe_common.h
index 424c223437d..e1f980a8a09 100644
--- a/drivers/net/ixgbe/ixgbe_common.h
+++ b/drivers/net/ixgbe/ixgbe_common.h
@@ -35,7 +35,8 @@ s32 ixgbe_init_ops_generic(struct ixgbe_hw *hw);
 s32 ixgbe_init_hw_generic(struct ixgbe_hw *hw);
 s32 ixgbe_start_hw_generic(struct ixgbe_hw *hw);
 s32 ixgbe_clear_hw_cntrs_generic(struct ixgbe_hw *hw);
-s32 ixgbe_read_pba_num_generic(struct ixgbe_hw *hw, u32 *pba_num);
+s32 ixgbe_read_pba_string_generic(struct ixgbe_hw *hw, u8 *pba_num,
+                                  u32 pba_num_size);
 s32 ixgbe_get_mac_addr_generic(struct ixgbe_hw *hw, u8 *mac_addr);
 s32 ixgbe_get_bus_info_generic(struct ixgbe_hw *hw);
 void ixgbe_set_lan_id_multi_port_pcie(struct ixgbe_hw *hw);
@@ -49,9 +50,11 @@ s32 ixgbe_write_eeprom_generic(struct ixgbe_hw *hw, u16 offset, u16 data);
 s32 ixgbe_read_eerd_generic(struct ixgbe_hw *hw, u16 offset, u16 *data);
 s32 ixgbe_read_eeprom_bit_bang_generic(struct ixgbe_hw *hw, u16 offset,
                                        u16 *data);
+u16 ixgbe_calc_eeprom_checksum_generic(struct ixgbe_hw *hw);
 s32 ixgbe_validate_eeprom_checksum_generic(struct ixgbe_hw *hw,
                                            u16 *checksum_val);
 s32 ixgbe_update_eeprom_checksum_generic(struct ixgbe_hw *hw);
+s32 ixgbe_poll_eerd_eewr_done(struct ixgbe_hw *hw, u32 ee_reg);
 
 s32 ixgbe_set_rar_generic(struct ixgbe_hw *hw, u32 index, u8 *addr, u32 vmdq,
                           u32 enable_addr);
@@ -81,7 +84,8 @@ s32 ixgbe_clear_vfta_generic(struct ixgbe_hw *hw);
 s32 ixgbe_check_mac_link_generic(struct ixgbe_hw *hw,
                                  ixgbe_link_speed *speed,
                                  bool *link_up, bool link_up_wait_to_complete);
-
+s32 ixgbe_get_wwn_prefix_generic(struct ixgbe_hw *hw, u16 *wwnn_prefix,
+                                 u16 *wwpn_prefix);
 s32 ixgbe_blink_led_start_generic(struct ixgbe_hw *hw, u32 index);
 s32 ixgbe_blink_led_stop_generic(struct ixgbe_hw *hw, u32 index);
 
diff --git a/drivers/net/ixgbe/ixgbe_dcb.c b/drivers/net/ixgbe/ixgbe_dcb.c
index 0d44c6470ca..d16c260c1f5 100644
--- a/drivers/net/ixgbe/ixgbe_dcb.c
+++ b/drivers/net/ixgbe/ixgbe_dcb.c
@@ -42,7 +42,8 @@
  * It should be called only after the rules are checked by
  * ixgbe_dcb_check_config().
  */
-s32 ixgbe_dcb_calculate_tc_credits(struct ixgbe_dcb_config *dcb_config,
+s32 ixgbe_dcb_calculate_tc_credits(struct ixgbe_hw *hw,
+                                   struct ixgbe_dcb_config *dcb_config,
                                    int max_frame, u8 direction)
 {
         struct tc_bw_alloc *p;
@@ -124,7 +125,8 @@ s32 ixgbe_dcb_calculate_tc_credits(struct ixgbe_dcb_config *dcb_config,
                          * credit may not be enough to send out a TSO
                          * packet in descriptor plane arbitration.
                          */
-                        if (credit_max &&
+                        if ((hw->mac.type == ixgbe_mac_82598EB) &&
+                            credit_max &&
                             (credit_max < MINIMUM_CREDIT_FOR_TSO))
                                 credit_max = MINIMUM_CREDIT_FOR_TSO;
 
@@ -150,10 +152,17 @@ s32 ixgbe_dcb_hw_config(struct ixgbe_hw *hw,
                         struct ixgbe_dcb_config *dcb_config)
 {
         s32 ret = 0;
-        if (hw->mac.type == ixgbe_mac_82598EB)
+        switch (hw->mac.type) {
+        case ixgbe_mac_82598EB:
                 ret = ixgbe_dcb_hw_config_82598(hw, dcb_config);
-        else if (hw->mac.type == ixgbe_mac_82599EB)
+                break;
+        case ixgbe_mac_82599EB:
+        case ixgbe_mac_X540:
                 ret = ixgbe_dcb_hw_config_82599(hw, dcb_config);
+                break;
+        default:
+                break;
+        }
         return ret;
 }
 
diff --git a/drivers/net/ixgbe/ixgbe_dcb.h b/drivers/net/ixgbe/ixgbe_dcb.h
index 0208a87b129..1cfe38ee164 100644
--- a/drivers/net/ixgbe/ixgbe_dcb.h
+++ b/drivers/net/ixgbe/ixgbe_dcb.h
@@ -150,7 +150,8 @@ struct ixgbe_dcb_config {
 /* DCB driver APIs */
 
 /* DCB credits calculation */
-s32 ixgbe_dcb_calculate_tc_credits(struct ixgbe_dcb_config *, int, u8);
+s32 ixgbe_dcb_calculate_tc_credits(struct ixgbe_hw *,
+                                   struct ixgbe_dcb_config *, int, u8);
 
 /* DCB hw initialization */
 s32 ixgbe_dcb_hw_config(struct ixgbe_hw *, struct ixgbe_dcb_config *);
diff --git a/drivers/net/ixgbe/ixgbe_dcb_82598.c b/drivers/net/ixgbe/ixgbe_dcb_82598.c
index 50288bcadc5..9a5e89c12e0 100644
--- a/drivers/net/ixgbe/ixgbe_dcb_82598.c
+++ b/drivers/net/ixgbe/ixgbe_dcb_82598.c
@@ -256,21 +256,17 @@ s32 ixgbe_dcb_config_pfc_82598(struct ixgbe_hw *hw,
          * for each traffic class.
          */
         for (i = 0; i < MAX_TRAFFIC_CLASS; i++) {
-                if (dcb_config->rx_pba_cfg == pba_equal) {
-                        rx_pba_size = IXGBE_RXPBSIZE_64KB;
-                } else {
-                        rx_pba_size = (i < 4) ? IXGBE_RXPBSIZE_80KB
-                                              : IXGBE_RXPBSIZE_48KB;
-                }
+                rx_pba_size = IXGBE_READ_REG(hw, IXGBE_RXPBSIZE(i));
+                rx_pba_size >>= IXGBE_RXPBSIZE_SHIFT;
+                reg = (rx_pba_size - hw->fc.low_water) << 10;
 
-                reg = ((rx_pba_size >> 5) &  0xFFF0);
                 if (dcb_config->tc_config[i].dcb_pfc == pfc_enabled_tx ||
                     dcb_config->tc_config[i].dcb_pfc == pfc_enabled_full)
                         reg |= IXGBE_FCRTL_XONE;
 
                 IXGBE_WRITE_REG(hw, IXGBE_FCRTL(i), reg);
 
-                reg = ((rx_pba_size >> 2) & 0xFFF0);
+                reg = (rx_pba_size - hw->fc.high_water) << 10;
                 if (dcb_config->tc_config[i].dcb_pfc == pfc_enabled_tx ||
                     dcb_config->tc_config[i].dcb_pfc == pfc_enabled_full)
                         reg |= IXGBE_FCRTH_FCEN;
diff --git a/drivers/net/ixgbe/ixgbe_dcb_82599.c b/drivers/net/ixgbe/ixgbe_dcb_82599.c
index 05f22471507..374e1f74d0f 100644
--- a/drivers/net/ixgbe/ixgbe_dcb_82599.c
+++ b/drivers/net/ixgbe/ixgbe_dcb_82599.c
@@ -251,19 +251,17 @@ s32 ixgbe_dcb_config_pfc_82599(struct ixgbe_hw *hw,
 
         /* Configure PFC Tx thresholds per TC */
         for (i = 0; i < MAX_TRAFFIC_CLASS; i++) {
-                if (dcb_config->rx_pba_cfg == pba_equal)
-                        rx_pba_size = IXGBE_RXPBSIZE_64KB;
-                else
-                        rx_pba_size = (i < 4) ? IXGBE_RXPBSIZE_80KB
-                                              : IXGBE_RXPBSIZE_48KB;
+                rx_pba_size = IXGBE_READ_REG(hw, IXGBE_RXPBSIZE(i));
+                rx_pba_size >>= IXGBE_RXPBSIZE_SHIFT;
+
+                reg = (rx_pba_size - hw->fc.low_water) << 10;
 
-                reg = ((rx_pba_size >> 5) & 0xFFE0);
                 if (dcb_config->tc_config[i].dcb_pfc == pfc_enabled_full ||
                     dcb_config->tc_config[i].dcb_pfc == pfc_enabled_tx)
                         reg |= IXGBE_FCRTL_XONE;
                 IXGBE_WRITE_REG(hw, IXGBE_FCRTL_82599(i), reg);
 
-                reg = ((rx_pba_size >> 2) & 0xFFE0);
+                reg = (rx_pba_size - hw->fc.high_water) << 10;
                 if (dcb_config->tc_config[i].dcb_pfc == pfc_enabled_full ||
                     dcb_config->tc_config[i].dcb_pfc == pfc_enabled_tx)
                         reg |= IXGBE_FCRTH_FCEN;
diff --git a/drivers/net/ixgbe/ixgbe_dcb_nl.c b/drivers/net/ixgbe/ixgbe_dcb_nl.c
index b53b465e24a..bf566e8a455 100644
--- a/drivers/net/ixgbe/ixgbe_dcb_nl.c
+++ b/drivers/net/ixgbe/ixgbe_dcb_nl.c
@@ -130,15 +130,21 @@ static u8 ixgbe_dcbnl_set_state(struct net_device *netdev, u8 state)
                         netdev->netdev_ops->ndo_stop(netdev);
                 ixgbe_clear_interrupt_scheme(adapter);
 
-                if (adapter->hw.mac.type == ixgbe_mac_82598EB) {
+                adapter->flags &= ~IXGBE_FLAG_RSS_ENABLED;
+                switch (adapter->hw.mac.type) {
+                case ixgbe_mac_82598EB:
                         adapter->last_lfc_mode = adapter->hw.fc.current_mode;
                         adapter->hw.fc.requested_mode = ixgbe_fc_none;
-                }
-                adapter->flags &= ~IXGBE_FLAG_RSS_ENABLED;
-                if (adapter->hw.mac.type == ixgbe_mac_82599EB) {
+                        break;
+                case ixgbe_mac_82599EB:
+                case ixgbe_mac_X540:
                         adapter->flags &= ~IXGBE_FLAG_FDIR_HASH_CAPABLE;
                         adapter->flags &= ~IXGBE_FLAG_FDIR_PERFECT_CAPABLE;
+                        break;
+                default:
+                        break;
                 }
+
                 adapter->flags |= IXGBE_FLAG_DCB_ENABLED;
                 ixgbe_init_interrupt_scheme(adapter);
                 if (netif_running(netdev))
@@ -155,8 +161,14 @@ static u8 ixgbe_dcbnl_set_state(struct net_device *netdev, u8 state)
                         adapter->dcb_cfg.pfc_mode_enable = false;
                         adapter->flags &= ~IXGBE_FLAG_DCB_ENABLED;
                         adapter->flags |= IXGBE_FLAG_RSS_ENABLED;
-                        if (adapter->hw.mac.type == ixgbe_mac_82599EB)
+                        switch (adapter->hw.mac.type) {
+                        case ixgbe_mac_82599EB:
+                        case ixgbe_mac_X540:
                                 adapter->flags |= IXGBE_FLAG_FDIR_HASH_CAPABLE;
+                                break;
+                        default:
+                                break;
+                        }
 
                         ixgbe_init_interrupt_scheme(adapter);
                         if (netif_running(netdev))
@@ -178,9 +190,14 @@ static void ixgbe_dcbnl_get_perm_hw_addr(struct net_device *netdev,
         for (i = 0; i < netdev->addr_len; i++)
                 perm_addr[i] = adapter->hw.mac.perm_addr[i];
 
-        if (adapter->hw.mac.type == ixgbe_mac_82599EB) {
+        switch (adapter->hw.mac.type) {
+        case ixgbe_mac_82599EB:
+        case ixgbe_mac_X540:
                 for (j = 0; j < netdev->addr_len; j++, i++)
                         perm_addr[i] = adapter->hw.mac.san_addr[j];
+                break;
+        default:
+                break;
         }
 }
 
@@ -366,15 +383,29 @@ static u8 ixgbe_dcbnl_set_all(struct net_device *netdev)
         }
 
         if (adapter->dcb_cfg.pfc_mode_enable) {
-                if ((adapter->hw.mac.type != ixgbe_mac_82598EB) &&
-                        (adapter->hw.fc.current_mode != ixgbe_fc_pfc))
-                        adapter->last_lfc_mode = adapter->hw.fc.current_mode;
+                switch (adapter->hw.mac.type) {
+                case ixgbe_mac_82599EB:
+                case ixgbe_mac_X540:
+                        if (adapter->hw.fc.current_mode != ixgbe_fc_pfc)
+                                adapter->last_lfc_mode =
+                                                  adapter->hw.fc.current_mode;
+                        break;
+                default:
+                        break;
+                }
                 adapter->hw.fc.requested_mode = ixgbe_fc_pfc;
         } else {
-                if (adapter->hw.mac.type != ixgbe_mac_82598EB)
-                        adapter->hw.fc.requested_mode = adapter->last_lfc_mode;
-                else
+                switch (adapter->hw.mac.type) {
+                case ixgbe_mac_82598EB:
                         adapter->hw.fc.requested_mode = ixgbe_fc_none;
+                        break;
+                case ixgbe_mac_82599EB:
+                case ixgbe_mac_X540:
+                        adapter->hw.fc.requested_mode = adapter->last_lfc_mode;
+                        break;
+                default:
+                        break;
+                }
         }
 
         if (adapter->dcb_set_bitmap & BIT_RESETLINK) {
diff --git a/drivers/net/ixgbe/ixgbe_ethtool.c b/drivers/net/ixgbe/ixgbe_ethtool.c
index 3dc731c22ff..ef3f9105a05 100644
--- a/drivers/net/ixgbe/ixgbe_ethtool.c
+++ b/drivers/net/ixgbe/ixgbe_ethtool.c
@@ -185,6 +185,16 @@ static int ixgbe_get_settings(struct net_device *netdev,
                                              ADVERTISED_FIBRE);
                         ecmd->port = PORT_FIBRE;
                         ecmd->autoneg = AUTONEG_DISABLE;
+                } else if ((hw->device_id == IXGBE_DEV_ID_82599_COMBO_BACKPLANE) ||
+                           (hw->device_id == IXGBE_DEV_ID_82599_KX4_MEZZ)) {
+                        ecmd->supported |= (SUPPORTED_1000baseT_Full |
+                                            SUPPORTED_Autoneg |
+                                            SUPPORTED_FIBRE);
+                        ecmd->advertising = (ADVERTISED_10000baseT_Full |
+                                             ADVERTISED_1000baseT_Full |
+                                             ADVERTISED_Autoneg |
+                                             ADVERTISED_FIBRE);
+                        ecmd->port = PORT_FIBRE;
                 } else {
                         ecmd->supported |= (SUPPORTED_1000baseT_Full |
                                             SUPPORTED_FIBRE);
@@ -204,6 +214,7 @@ static int ixgbe_get_settings(struct net_device *netdev,
         /* Get PHY type */
         switch (adapter->hw.phy.type) {
         case ixgbe_phy_tn:
+        case ixgbe_phy_aq:
         case ixgbe_phy_cu_unknown:
                 /* Copper 10G-BASET */
                 ecmd->port = PORT_TP;
@@ -332,13 +343,6 @@ static void ixgbe_get_pauseparam(struct net_device *netdev,
         else
                 pause->autoneg = 1;
 
-#ifdef CONFIG_DCB
-        if (hw->fc.current_mode == ixgbe_fc_pfc) {
-                pause->rx_pause = 0;
-                pause->tx_pause = 0;
-        }
-
-#endif
         if (hw->fc.current_mode == ixgbe_fc_rx_pause) {
                 pause->rx_pause = 1;
         } else if (hw->fc.current_mode == ixgbe_fc_tx_pause) {
@@ -346,6 +350,11 @@ static void ixgbe_get_pauseparam(struct net_device *netdev,
         } else if (hw->fc.current_mode == ixgbe_fc_full) {
                 pause->rx_pause = 1;
                 pause->tx_pause = 1;
+#ifdef CONFIG_DCB
+        } else if (hw->fc.current_mode == ixgbe_fc_pfc) {
+                pause->rx_pause = 0;
+                pause->tx_pause = 0;
+#endif
         }
 }
 
@@ -363,7 +372,6 @@ static int ixgbe_set_pauseparam(struct net_device *netdev,
                 return -EINVAL;
 
 #endif
-
         fc = hw->fc;
 
         if (pause->autoneg != AUTONEG_ENABLE)
@@ -412,11 +420,6 @@ static int ixgbe_set_rx_csum(struct net_device *netdev, u32 data)
         else
                 adapter->flags &= ~IXGBE_FLAG_RX_CSUM_ENABLED;
 
-        if (netif_running(netdev))
-                ixgbe_reinit_locked(adapter);
-        else
-                ixgbe_reset(adapter);
-
         return 0;
 }
 
@@ -428,16 +431,21 @@ static u32 ixgbe_get_tx_csum(struct net_device *netdev)
 static int ixgbe_set_tx_csum(struct net_device *netdev, u32 data)
 {
         struct ixgbe_adapter *adapter = netdev_priv(netdev);
+        u32 feature_list;
 
-        if (data) {
-                netdev->features |= (NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM);
-                if (adapter->hw.mac.type == ixgbe_mac_82599EB)
-                        netdev->features |= NETIF_F_SCTP_CSUM;
-        } else {
-                netdev->features &= ~(NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM);
-                if (adapter->hw.mac.type == ixgbe_mac_82599EB)
-                        netdev->features &= ~NETIF_F_SCTP_CSUM;
+        feature_list = (NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM);
+        switch (adapter->hw.mac.type) {
+        case ixgbe_mac_82599EB:
+        case ixgbe_mac_X540:
+                feature_list |= NETIF_F_SCTP_CSUM;
+                break;
+        default:
+                break;
         }
+        if (data)
+                netdev->features |= feature_list;
+        else
+                netdev->features &= ~feature_list;
 
         return 0;
 }
@@ -530,10 +538,20 @@ static void ixgbe_get_regs(struct net_device *netdev,
         regs_buff[32] = IXGBE_READ_REG(hw, IXGBE_FCTTV(1));
         regs_buff[33] = IXGBE_READ_REG(hw, IXGBE_FCTTV(2));
         regs_buff[34] = IXGBE_READ_REG(hw, IXGBE_FCTTV(3));
-        for (i = 0; i < 8; i++)
-                regs_buff[35 + i] = IXGBE_READ_REG(hw, IXGBE_FCRTL(i));
-        for (i = 0; i < 8; i++)
-                regs_buff[43 + i] = IXGBE_READ_REG(hw, IXGBE_FCRTH(i));
+        for (i = 0; i < 8; i++) {
+                switch (hw->mac.type) {
+                case ixgbe_mac_82598EB:
+                        regs_buff[35 + i] = IXGBE_READ_REG(hw, IXGBE_FCRTL(i));
+                        regs_buff[43 + i] = IXGBE_READ_REG(hw, IXGBE_FCRTH(i));
+                        break;
+                case ixgbe_mac_82599EB:
+                        regs_buff[35 + i] = IXGBE_READ_REG(hw, IXGBE_FCRTL_82599(i));
+                        regs_buff[43 + i] = IXGBE_READ_REG(hw, IXGBE_FCRTH_82599(i));
+                        break;
+                default:
+                        break;
+                }
+        }
         regs_buff[51] = IXGBE_READ_REG(hw, IXGBE_FCRTV);
         regs_buff[52] = IXGBE_READ_REG(hw, IXGBE_TFCS);
 
@@ -615,6 +633,7 @@ static void ixgbe_get_regs(struct net_device *netdev,
         regs_buff[827] = IXGBE_READ_REG(hw, IXGBE_WUPM);
         regs_buff[828] = IXGBE_READ_REG(hw, IXGBE_FHFT(0));
 
+        /* DCB */
         regs_buff[829] = IXGBE_READ_REG(hw, IXGBE_RMCS);
         regs_buff[830] = IXGBE_READ_REG(hw, IXGBE_DPMCS);
         regs_buff[831] = IXGBE_READ_REG(hw, IXGBE_PDPMCS);
@@ -905,13 +924,11 @@ static int ixgbe_set_ringparam(struct net_device *netdev,
                         memcpy(&temp_tx_ring[i], adapter->tx_ring[i],
                                sizeof(struct ixgbe_ring));
                         temp_tx_ring[i].count = new_tx_count;
-                        err = ixgbe_setup_tx_resources(adapter,
-                                                       &temp_tx_ring[i]);
+                        err = ixgbe_setup_tx_resources(&temp_tx_ring[i]);
                         if (err) {
                                 while (i) {
                                         i--;
-                                        ixgbe_free_tx_resources(adapter,
-                                                              &temp_tx_ring[i]);
+                                        ixgbe_free_tx_resources(&temp_tx_ring[i]);
                                 }
                                 goto clear_reset;
                         }
@@ -930,13 +947,11 @@ static int ixgbe_set_ringparam(struct net_device *netdev,
                         memcpy(&temp_rx_ring[i], adapter->rx_ring[i],
                                sizeof(struct ixgbe_ring));
                         temp_rx_ring[i].count = new_rx_count;
-                        err = ixgbe_setup_rx_resources(adapter,
-                                                       &temp_rx_ring[i]);
+                        err = ixgbe_setup_rx_resources(&temp_rx_ring[i]);
                         if (err) {
                                 while (i) {
                                         i--;
-                                        ixgbe_free_rx_resources(adapter,
-                                                              &temp_rx_ring[i]);
+                                        ixgbe_free_rx_resources(&temp_rx_ring[i]);
                                 }
                                 goto err_setup;
                         }
@@ -951,8 +966,7 @@ static int ixgbe_set_ringparam(struct net_device *netdev,
                 /* tx */
                 if (new_tx_count != adapter->tx_ring_count) {
                         for (i = 0; i < adapter->num_tx_queues; i++) {
-                                ixgbe_free_tx_resources(adapter,
-                                                        adapter->tx_ring[i]);
+                                ixgbe_free_tx_resources(adapter->tx_ring[i]);
                                 memcpy(adapter->tx_ring[i], &temp_tx_ring[i],
                                        sizeof(struct ixgbe_ring));
                         }
@@ -962,8 +976,7 @@ static int ixgbe_set_ringparam(struct net_device *netdev,
                 /* rx */
                 if (new_rx_count != adapter->rx_ring_count) {
                         for (i = 0; i < adapter->num_rx_queues; i++) {
-                                ixgbe_free_rx_resources(adapter,
-                                                        adapter->rx_ring[i]);
+                                ixgbe_free_rx_resources(adapter->rx_ring[i]);
                                 memcpy(adapter->rx_ring[i], &temp_rx_ring[i],
                                        sizeof(struct ixgbe_ring));
                         }
@@ -1237,12 +1250,20 @@ static int ixgbe_reg_test(struct ixgbe_adapter *adapter, u64 *data)
         u32 value, before, after;
         u32 i, toggle;
 
-        if (adapter->hw.mac.type == ixgbe_mac_82599EB) {
-                toggle = 0x7FFFF30F;
-                test = reg_test_82599;
-        } else {
+        switch (adapter->hw.mac.type) {
+        case ixgbe_mac_82598EB:
                 toggle = 0x7FFFF3FF;
                 test = reg_test_82598;
+                break;
+        case ixgbe_mac_82599EB:
+        case ixgbe_mac_X540:
+                toggle = 0x7FFFF30F;
+                test = reg_test_82599;
+                break;
+        default:
+                *data = 1;
+                return 1;
+                break;
         }
 
         /*
@@ -1460,16 +1481,21 @@ static void ixgbe_free_desc_rings(struct ixgbe_adapter *adapter)
         reg_ctl &= ~IXGBE_TXDCTL_ENABLE;
         IXGBE_WRITE_REG(hw, IXGBE_TXDCTL(tx_ring->reg_idx), reg_ctl);
 
-        if (hw->mac.type == ixgbe_mac_82599EB) {
+        switch (hw->mac.type) {
+        case ixgbe_mac_82599EB:
+        case ixgbe_mac_X540:
                 reg_ctl = IXGBE_READ_REG(hw, IXGBE_DMATXCTL);
                 reg_ctl &= ~IXGBE_DMATXCTL_TE;
                 IXGBE_WRITE_REG(hw, IXGBE_DMATXCTL, reg_ctl);
+                break;
+        default:
+                break;
         }
 
         ixgbe_reset(adapter);
 
-        ixgbe_free_tx_resources(adapter, &adapter->test_tx_ring);
-        ixgbe_free_rx_resources(adapter, &adapter->test_rx_ring);
+        ixgbe_free_tx_resources(&adapter->test_tx_ring);
+        ixgbe_free_rx_resources(&adapter->test_rx_ring);
 }
 
 static int ixgbe_setup_desc_rings(struct ixgbe_adapter *adapter)
@@ -1483,17 +1509,24 @@ static int ixgbe_setup_desc_rings(struct ixgbe_adapter *adapter)
         /* Setup Tx descriptor ring and Tx buffers */
         tx_ring->count = IXGBE_DEFAULT_TXD;
         tx_ring->queue_index = 0;
+        tx_ring->dev = &adapter->pdev->dev;
+        tx_ring->netdev = adapter->netdev;
         tx_ring->reg_idx = adapter->tx_ring[0]->reg_idx;
         tx_ring->numa_node = adapter->node;
 
-        err = ixgbe_setup_tx_resources(adapter, tx_ring);
+        err = ixgbe_setup_tx_resources(tx_ring);
         if (err)
                 return 1;
 
-        if (adapter->hw.mac.type == ixgbe_mac_82599EB) {
+        switch (adapter->hw.mac.type) {
+        case ixgbe_mac_82599EB:
+        case ixgbe_mac_X540:
                 reg_data = IXGBE_READ_REG(&adapter->hw, IXGBE_DMATXCTL);
                 reg_data |= IXGBE_DMATXCTL_TE;
                 IXGBE_WRITE_REG(&adapter->hw, IXGBE_DMATXCTL, reg_data);
+                break;
+        default:
+                break;
         }
 
         ixgbe_configure_tx_ring(adapter, tx_ring);
@@ -1501,11 +1534,13 @@ static int ixgbe_setup_desc_rings(struct ixgbe_adapter *adapter)
         /* Setup Rx Descriptor ring and Rx buffers */
         rx_ring->count = IXGBE_DEFAULT_RXD;
         rx_ring->queue_index = 0;
+        rx_ring->dev = &adapter->pdev->dev;
+        rx_ring->netdev = adapter->netdev;
         rx_ring->reg_idx = adapter->rx_ring[0]->reg_idx;
         rx_ring->rx_buf_len = IXGBE_RXBUFFER_2048;
         rx_ring->numa_node = adapter->node;
 
-        err = ixgbe_setup_rx_resources(adapter, rx_ring);
+        err = ixgbe_setup_rx_resources(rx_ring);
         if (err) {
                 ret_val = 4;
                 goto err_nomem;
@@ -1604,8 +1639,7 @@ static int ixgbe_check_lbtest_frame(struct sk_buff *skb,
         return 13;
 }
 
-static u16 ixgbe_clean_test_rings(struct ixgbe_adapter *adapter,
-                                  struct ixgbe_ring *rx_ring,
+static u16 ixgbe_clean_test_rings(struct ixgbe_ring *rx_ring,
                                   struct ixgbe_ring *tx_ring,
                                   unsigned int size)
 {
@@ -1627,7 +1661,7 @@ static u16 ixgbe_clean_test_rings(struct ixgbe_adapter *adapter,
                 rx_buffer_info = &rx_ring->rx_buffer_info[rx_ntc];
 
                 /* unmap Rx buffer, will be remapped by alloc_rx_buffers */
-                dma_unmap_single(&adapter->pdev->dev,
+                dma_unmap_single(rx_ring->dev,
                                  rx_buffer_info->dma,
                                  bufsz,
                                  DMA_FROM_DEVICE);
@@ -1639,7 +1673,7 @@ static u16 ixgbe_clean_test_rings(struct ixgbe_adapter *adapter,
 
                 /* unmap buffer on Tx side */
                 tx_buffer_info = &tx_ring->tx_buffer_info[tx_ntc];
-                ixgbe_unmap_and_free_tx_resource(adapter, tx_buffer_info);
+                ixgbe_unmap_and_free_tx_resource(tx_ring, tx_buffer_info);
 
                 /* increment Rx/Tx next to clean counters */
                 rx_ntc++;
@@ -1655,7 +1689,7 @@ static u16 ixgbe_clean_test_rings(struct ixgbe_adapter *adapter,
         }
 
         /* re-map buffers to ring, store next to clean values */
-        ixgbe_alloc_rx_buffers(adapter, rx_ring, count);
+        ixgbe_alloc_rx_buffers(rx_ring, count);
         rx_ring->next_to_clean = rx_ntc;
         tx_ring->next_to_clean = tx_ntc;
 
@@ -1699,7 +1733,6 @@ static int ixgbe_run_loopback_test(struct ixgbe_adapter *adapter)
                 for (i = 0; i < 64; i++) {
                         skb_get(skb);
                         tx_ret_val = ixgbe_xmit_frame_ring(skb,
-                                                           adapter->netdev,
                                                            adapter,
                                                            tx_ring);
                         if (tx_ret_val == NETDEV_TX_OK)
@@ -1714,8 +1747,7 @@ static int ixgbe_run_loopback_test(struct ixgbe_adapter *adapter)
                 /* allow 200 milliseconds for packets to go from Tx to Rx */
                 msleep(200);
 
-                good_cnt = ixgbe_clean_test_rings(adapter, rx_ring,
-                                                  tx_ring, size);
+                good_cnt = ixgbe_clean_test_rings(rx_ring, tx_ring, size);
                 if (good_cnt != 64) {
                         ret_val = 13;
                         break;
@@ -1847,7 +1879,25 @@ static int ixgbe_wol_exclusion(struct ixgbe_adapter *adapter,
         struct ixgbe_hw *hw = &adapter->hw;
         int retval = 1;
 
+        /* WOL not supported except for the following */
         switch(hw->device_id) {
+        case IXGBE_DEV_ID_82599_SFP:
+                /* Only this subdevice supports WOL */
+                if (hw->subsystem_device_id != IXGBE_SUBDEV_ID_82599_SFP) {
+                        wol->supported = 0;
+                        break;
+                }
+                retval = 0;
+                break;
+        case IXGBE_DEV_ID_82599_COMBO_BACKPLANE:
+                /* All except this subdevice support WOL */
+                if (hw->subsystem_device_id ==
+                    IXGBE_SUBDEV_ID_82599_KX4_KR_MEZZ) {
+                        wol->supported = 0;
+                        break;
+                }
+                retval = 0;
+                break;
         case IXGBE_DEV_ID_82599_KX4:
                 retval = 0;
                 break;
@@ -1985,6 +2035,41 @@ static int ixgbe_get_coalesce(struct net_device *netdev,
         return 0;
 }
 
+/*
+ * this function must be called before setting the new value of
+ * rx_itr_setting
+ */
+static bool ixgbe_update_rsc(struct ixgbe_adapter *adapter,
+                             struct ethtool_coalesce *ec)
+{
+        struct net_device *netdev = adapter->netdev;
+
+        if (!(adapter->flags2 & IXGBE_FLAG2_RSC_CAPABLE))
+                return false;
+
+        /* if interrupt rate is too high then disable RSC */
+        if (ec->rx_coalesce_usecs != 1 &&
+            ec->rx_coalesce_usecs <= 1000000/IXGBE_MAX_RSC_INT_RATE) {
+                if (adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED) {
+                        e_info(probe, "rx-usecs set too low, "
+                                      "disabling RSC\n");
+                        adapter->flags2 &= ~IXGBE_FLAG2_RSC_ENABLED;
+                        return true;
+                }
+        } else {
+                /* check the feature flag value and enable RSC if necessary */
+                if ((netdev->features & NETIF_F_LRO) &&
+                    !(adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED)) {
+                        e_info(probe, "rx-usecs set to %d, "
+                                      "re-enabling RSC\n",
+                               ec->rx_coalesce_usecs);
+                        adapter->flags2 |= IXGBE_FLAG2_RSC_ENABLED;
+                        return true;
+                }
+        }
+        return false;
+}
+
 static int ixgbe_set_coalesce(struct net_device *netdev,
                               struct ethtool_coalesce *ec)
 {
@@ -2002,17 +2087,14 @@ static int ixgbe_set_coalesce(struct net_device *netdev,
                 adapter->tx_ring[0]->work_limit = ec->tx_max_coalesced_frames_irq;
 
         if (ec->rx_coalesce_usecs > 1) {
-                u32 max_int;
-                if (adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED)
-                        max_int = IXGBE_MAX_RSC_INT_RATE;
-                else
-                        max_int = IXGBE_MAX_INT_RATE;
-
                 /* check the limits */
-                if ((1000000/ec->rx_coalesce_usecs > max_int) ||
+                if ((1000000/ec->rx_coalesce_usecs > IXGBE_MAX_INT_RATE) ||
                     (1000000/ec->rx_coalesce_usecs < IXGBE_MIN_INT_RATE))
                         return -EINVAL;
 
+                /* check the old value and enable RSC if necessary */
+                need_reset = ixgbe_update_rsc(adapter, ec);
+
                 /* store the value in ints/second */
                 adapter->rx_eitr_param = 1000000/ec->rx_coalesce_usecs;
 
@@ -2021,32 +2103,21 @@ static int ixgbe_set_coalesce(struct net_device *netdev,
                 /* clear the lower bit as its used for dynamic state */
                 adapter->rx_itr_setting &= ~1;
         } else if (ec->rx_coalesce_usecs == 1) {
+                /* check the old value and enable RSC if necessary */
+                need_reset = ixgbe_update_rsc(adapter, ec);
+
                 /* 1 means dynamic mode */
                 adapter->rx_eitr_param = 20000;
                 adapter->rx_itr_setting = 1;
         } else {
+                /* check the old value and enable RSC if necessary */
+                need_reset = ixgbe_update_rsc(adapter, ec);
                 /*
                  * any other value means disable eitr, which is best
                  * served by setting the interrupt rate very high
                  */
                 adapter->rx_eitr_param = IXGBE_MAX_INT_RATE;
                 adapter->rx_itr_setting = 0;
-
-                /*
-                 * if hardware RSC is enabled, disable it when
-                 * setting low latency mode, to avoid errata, assuming
-                 * that when the user set low latency mode they want
-                 * it at the cost of anything else
-                 */
-                if (adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED) {
-                        adapter->flags2 &= ~IXGBE_FLAG2_RSC_ENABLED;
-                        if (netdev->features & NETIF_F_LRO) {
-                                netdev->features &= ~NETIF_F_LRO;
-                                e_info(probe, "rx-usecs set to 0, "
-                                       "disabling RSC\n");
-                        }
-                        need_reset = true;
-                }
         }
 
         if (ec->tx_coalesce_usecs > 1) {
@@ -2133,28 +2204,39 @@ static int ixgbe_set_flags(struct net_device *netdev, u32 data)
                 return rc;
 
         /* if state changes we need to update adapter->flags and reset */
-        if (adapter->flags2 & IXGBE_FLAG2_RSC_CAPABLE) {
-                /*
-                 * cast both to bool and verify if they are set the same
-                 * but only enable RSC if itr is non-zero, as
-                 * itr=0 and RSC are mutually exclusive
-                 */
-                if (((!!(data & ETH_FLAG_LRO)) !=
-                     (!!(adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED))) &&
-                    adapter->rx_itr_setting) {
+        if ((adapter->flags2 & IXGBE_FLAG2_RSC_CAPABLE) &&
+            (!!(data & ETH_FLAG_LRO) !=
+             !!(adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED))) {
+                if ((data & ETH_FLAG_LRO) &&
+                    (!adapter->rx_itr_setting ||
+                     (adapter->rx_itr_setting > IXGBE_MAX_RSC_INT_RATE))) {
+                        e_info(probe, "rx-usecs set too low, "
+                                      "not enabling RSC.\n");
+                } else {
                         adapter->flags2 ^= IXGBE_FLAG2_RSC_ENABLED;
                         switch (adapter->hw.mac.type) {
                         case ixgbe_mac_82599EB:
                                 need_reset = true;
                                 break;
+                        case ixgbe_mac_X540: {
+                                int i;
+                                for (i = 0; i < adapter->num_rx_queues; i++) {
+                                        struct ixgbe_ring *ring =
+                                                          adapter->rx_ring[i];
+                                        if (adapter->flags2 &
+                                            IXGBE_FLAG2_RSC_ENABLED) {
+                                                ixgbe_configure_rscctl(adapter,
+                                                                       ring);
+                                        } else {
+                                                ixgbe_clear_rscctl(adapter,
+                                                                   ring);
+                                        }
+                                }
+                        }
+                                break;
                         default:
                                 break;
                         }
-                } else if (!adapter->rx_itr_setting) {
-                        netdev->features &= ~NETIF_F_LRO;
-                        if (data & ETH_FLAG_LRO)
-                                e_info(probe, "rx-usecs set to 0, "
-                                       "LRO/RSC cannot be enabled.\n");
                 }
         }
 
diff --git a/drivers/net/ixgbe/ixgbe_fcoe.c b/drivers/net/ixgbe/ixgbe_fcoe.c
index 05efa6a8ce8..6342d485979 100644
--- a/drivers/net/ixgbe/ixgbe_fcoe.c
+++ b/drivers/net/ixgbe/ixgbe_fcoe.c
@@ -68,7 +68,7 @@ static inline bool ixgbe_rx_is_fcoe(union ixgbe_adv_rx_desc *rx_desc)
 static inline void ixgbe_fcoe_clear_ddp(struct ixgbe_fcoe_ddp *ddp)
 {
         ddp->len = 0;
-        ddp->err = 0;
+        ddp->err = 1;
         ddp->udl = NULL;
         ddp->udp = 0UL;
         ddp->sgl = NULL;
@@ -92,6 +92,7 @@ int ixgbe_fcoe_ddp_put(struct net_device *netdev, u16 xid)
         struct ixgbe_fcoe *fcoe;
         struct ixgbe_adapter *adapter;
         struct ixgbe_fcoe_ddp *ddp;
+        u32 fcbuff;
 
         if (!netdev)
                 goto out_ddp_put;
@@ -115,7 +116,14 @@ int ixgbe_fcoe_ddp_put(struct net_device *netdev, u16 xid)
                 IXGBE_WRITE_REG(&adapter->hw, IXGBE_FCBUFF, 0);
                 IXGBE_WRITE_REG(&adapter->hw, IXGBE_FCDMARW,
                                 (xid | IXGBE_FCDMARW_WE));
+
+                /* guaranteed to be invalidated after 100us */
+                IXGBE_WRITE_REG(&adapter->hw, IXGBE_FCDMARW,
+                                (xid | IXGBE_FCDMARW_RE));
+                fcbuff = IXGBE_READ_REG(&adapter->hw, IXGBE_FCBUFF);
                 spin_unlock_bh(&fcoe->lock);
+                if (fcbuff & IXGBE_FCBUFF_VALID)
+                        udelay(100);
         }
         if (ddp->sgl)
                 pci_unmap_sg(adapter->pdev, ddp->sgl, ddp->sgc,
@@ -168,6 +176,11 @@ int ixgbe_fcoe_ddp_get(struct net_device *netdev, u16 xid,
                 return 0;
         }
 
+        /* no DDP if we are already down or resetting */
+        if (test_bit(__IXGBE_DOWN, &adapter->state) ||
+            test_bit(__IXGBE_RESETTING, &adapter->state))
+                return 0;
+
         fcoe = &adapter->fcoe;
         if (!fcoe->pool) {
                 e_warn(drv, "xid=0x%x no ddp pool for fcoe\n", xid);
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index eee0b298bd3..fdb35d040d2 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -52,13 +52,14 @@ char ixgbe_driver_name[] = "ixgbe";
 static const char ixgbe_driver_string[] =
                               "Intel(R) 10 Gigabit PCI Express Network Driver";
 
-#define DRV_VERSION "2.0.84-k2"
+#define DRV_VERSION "3.0.12-k2"
 const char ixgbe_driver_version[] = DRV_VERSION;
 static char ixgbe_copyright[] = "Copyright (c) 1999-2010 Intel Corporation.";
 
 static const struct ixgbe_info *ixgbe_info_tbl[] = {
         [board_82598] = &ixgbe_82598_info,
         [board_82599] = &ixgbe_82599_info,
+        [board_X540] = &ixgbe_X540_info,
 };
 
 /* ixgbe_pci_tbl - PCI Device ID Table
@@ -108,10 +109,16 @@ static DEFINE_PCI_DEVICE_TABLE(ixgbe_pci_tbl) = {
          board_82599 },
         {PCI_VDEVICE(INTEL, IXGBE_DEV_ID_82599_CX4),
          board_82599 },
+        {PCI_VDEVICE(INTEL, IXGBE_DEV_ID_82599_BACKPLANE_FCOE),
+         board_82599 },
+        {PCI_VDEVICE(INTEL, IXGBE_DEV_ID_82599_SFP_FCOE),
+         board_82599 },
         {PCI_VDEVICE(INTEL, IXGBE_DEV_ID_82599_T3_LOM),
          board_82599 },
         {PCI_VDEVICE(INTEL, IXGBE_DEV_ID_82599_COMBO_BACKPLANE),
          board_82599 },
+        {PCI_VDEVICE(INTEL, IXGBE_DEV_ID_X540T),
+         board_82599 },
 
         /* required last entry */
         {0, }
@@ -560,6 +567,7 @@ static void ixgbe_set_ivar(struct ixgbe_adapter *adapter, s8 direction,
                 IXGBE_WRITE_REG(hw, IXGBE_IVAR(index), ivar);
                 break;
         case ixgbe_mac_82599EB:
+        case ixgbe_mac_X540:
                 if (direction == -1) {
                         /* other causes */
                         msix_vector |= IXGBE_IVAR_ALLOC_VAL;
@@ -589,29 +597,34 @@ static inline void ixgbe_irq_rearm_queues(struct ixgbe_adapter *adapter,
 {
         u32 mask;
 
-        if (adapter->hw.mac.type == ixgbe_mac_82598EB) {
+        switch (adapter->hw.mac.type) {
+        case ixgbe_mac_82598EB:
                 mask = (IXGBE_EIMS_RTX_QUEUE & qmask);
                 IXGBE_WRITE_REG(&adapter->hw, IXGBE_EICS, mask);
-        } else {
+                break;
+        case ixgbe_mac_82599EB:
+        case ixgbe_mac_X540:
                 mask = (qmask & 0xFFFFFFFF);
                 IXGBE_WRITE_REG(&adapter->hw, IXGBE_EICS_EX(0), mask);
                 mask = (qmask >> 32);
                 IXGBE_WRITE_REG(&adapter->hw, IXGBE_EICS_EX(1), mask);
+                break;
+        default:
+                break;
         }
 }
 
-void ixgbe_unmap_and_free_tx_resource(struct ixgbe_adapter *adapter,
-                                      struct ixgbe_tx_buffer
-                                      *tx_buffer_info)
+void ixgbe_unmap_and_free_tx_resource(struct ixgbe_ring *tx_ring,
+                                      struct ixgbe_tx_buffer *tx_buffer_info)
 {
         if (tx_buffer_info->dma) {
                 if (tx_buffer_info->mapped_as_page)
-                        dma_unmap_page(&adapter->pdev->dev,
+                        dma_unmap_page(tx_ring->dev,
                                        tx_buffer_info->dma,
                                        tx_buffer_info->length,
                                        DMA_TO_DEVICE);
                 else
-                        dma_unmap_single(&adapter->pdev->dev,
+                        dma_unmap_single(tx_ring->dev,
                                          tx_buffer_info->dma,
                                          tx_buffer_info->length,
                                          DMA_TO_DEVICE);
@@ -626,92 +639,166 @@ void ixgbe_unmap_and_free_tx_resource(struct ixgbe_adapter *adapter,
 }
 
 /**
- * ixgbe_tx_xon_state - check the tx ring xon state
- * @adapter: the ixgbe adapter
- * @tx_ring: the corresponding tx_ring
+ * ixgbe_dcb_txq_to_tc - convert a reg index to a traffic class
+ * @adapter: driver private struct
+ * @index: reg idx of queue to query (0-127)
  *
- * If not in DCB mode, checks TFCS.TXOFF, otherwise, find out the
- * corresponding TC of this tx_ring when checking TFCS.
+ * Helper function to determine the traffic index for a paticular
+ * register index.
  *
- * Returns : true if in xon state (currently not paused)
+ * Returns : a tc index for use in range 0-7, or 0-3
  */
-static inline bool ixgbe_tx_xon_state(struct ixgbe_adapter *adapter,
-                                      struct ixgbe_ring *tx_ring)
+u8 ixgbe_dcb_txq_to_tc(struct ixgbe_adapter *adapter, u8 reg_idx)
 {
-        u32 txoff = IXGBE_TFCS_TXOFF;
+        int tc = -1;
+        int dcb_i = adapter->ring_feature[RING_F_DCB].indices;
 
-#ifdef CONFIG_IXGBE_DCB
-        if (adapter->dcb_cfg.pfc_mode_enable) {
-                int tc;
-                int reg_idx = tx_ring->reg_idx;
-                int dcb_i = adapter->ring_feature[RING_F_DCB].indices;
+        /* if DCB is not enabled the queues have no TC */
+        if (!(adapter->flags & IXGBE_FLAG_DCB_ENABLED))
+                return tc;
+
+        /* check valid range */
+        if (reg_idx >= adapter->hw.mac.max_tx_queues)
+                return tc;
 
-                switch (adapter->hw.mac.type) {
+        switch (adapter->hw.mac.type) {
+        case ixgbe_mac_82598EB:
+                tc = reg_idx >> 2;
+                break;
+        default:
+                if (dcb_i != 4 && dcb_i != 8)
+                        break;
+
+                /* if VMDq is enabled the lowest order bits determine TC */
+                if (adapter->flags & (IXGBE_FLAG_SRIOV_ENABLED |
+                                      IXGBE_FLAG_VMDQ_ENABLED)) {
+                        tc = reg_idx & (dcb_i - 1);
+                        break;
+                }
+
+                /*
+                 * Convert the reg_idx into the correct TC. This bitmask
+                 * targets the last full 32 ring traffic class and assigns
+                 * it a value of 1. From there the rest of the rings are
+                 * based on shifting the mask further up to include the
+                 * reg_idx / 16 and then reg_idx / 8. It assumes dcB_i
+                 * will only ever be 8 or 4 and that reg_idx will never
+                 * be greater then 128. The code without the power of 2
+                 * optimizations would be:
+                 * (((reg_idx % 32) + 32) * dcb_i) >> (9 - reg_idx / 32)
+                 */
+                tc = ((reg_idx & 0X1F) + 0x20) * dcb_i;
+                tc >>= 9 - (reg_idx >> 5);
+        }
+
+        return tc;
+}
+
+static void ixgbe_update_xoff_received(struct ixgbe_adapter *adapter)
+{
+        struct ixgbe_hw *hw = &adapter->hw;
+        struct ixgbe_hw_stats *hwstats = &adapter->stats;
+        u32 data = 0;
+        u32 xoff[8] = {0};
+        int i;
+
+        if ((hw->fc.current_mode == ixgbe_fc_full) ||
+            (hw->fc.current_mode == ixgbe_fc_rx_pause)) {
+                switch (hw->mac.type) {
                 case ixgbe_mac_82598EB:
-                        tc = reg_idx >> 2;
-                        txoff = IXGBE_TFCS_TXOFF0;
+                        data = IXGBE_READ_REG(hw, IXGBE_LXOFFRXC);
                         break;
-                case ixgbe_mac_82599EB:
-                        tc = 0;
-                        txoff = IXGBE_TFCS_TXOFF;
-                        if (dcb_i == 8) {
-                                /* TC0, TC1 */
-                                tc = reg_idx >> 5;
-                                if (tc == 2) /* TC2, TC3 */
-                                        tc += (reg_idx - 64) >> 4;
-                                else if (tc == 3) /* TC4, TC5, TC6, TC7 */
-                                        tc += 1 + ((reg_idx - 96) >> 3);
-                        } else if (dcb_i == 4) {
-                                /* TC0, TC1 */
-                                tc = reg_idx >> 6;
-                                if (tc == 1) {
-                                        tc += (reg_idx - 64) >> 5;
-                                        if (tc == 2) /* TC2, TC3 */
-                                                tc += (reg_idx - 96) >> 4;
-                                }
-                        }
+                default:
+                        data = IXGBE_READ_REG(hw, IXGBE_LXOFFRXCNT);
+                }
+                hwstats->lxoffrxc += data;
+
+                /* refill credits (no tx hang) if we received xoff */
+                if (!data)
+                        return;
+
+                for (i = 0; i < adapter->num_tx_queues; i++)
+                        clear_bit(__IXGBE_HANG_CHECK_ARMED,
+                                  &adapter->tx_ring[i]->state);
+                return;
+        } else if (!(adapter->dcb_cfg.pfc_mode_enable))
+                return;
+
+        /* update stats for each tc, only valid with PFC enabled */
+        for (i = 0; i < MAX_TX_PACKET_BUFFERS; i++) {
+                switch (hw->mac.type) {
+                case ixgbe_mac_82598EB:
+                        xoff[i] = IXGBE_READ_REG(hw, IXGBE_PXOFFRXC(i));
                         break;
                 default:
-                        tc = 0;
+                        xoff[i] = IXGBE_READ_REG(hw, IXGBE_PXOFFRXCNT(i));
                 }
-                txoff <<= tc;
+                hwstats->pxoffrxc[i] += xoff[i];
         }
-#endif
-        return IXGBE_READ_REG(&adapter->hw, IXGBE_TFCS) & txoff;
+
+        /* disarm tx queues that have received xoff frames */
+        for (i = 0; i < adapter->num_tx_queues; i++) {
+                struct ixgbe_ring *tx_ring = adapter->tx_ring[i];
+                u32 tc = ixgbe_dcb_txq_to_tc(adapter, tx_ring->reg_idx);
+
+                if (xoff[tc])
+                        clear_bit(__IXGBE_HANG_CHECK_ARMED, &tx_ring->state);
+        }
+}
+
+static u64 ixgbe_get_tx_completed(struct ixgbe_ring *ring)
+{
+        return ring->tx_stats.completed;
 }
 
-static inline bool ixgbe_check_tx_hang(struct ixgbe_adapter *adapter,
-                                       struct ixgbe_ring *tx_ring,
-                                       unsigned int eop)
+static u64 ixgbe_get_tx_pending(struct ixgbe_ring *ring)
 {
+        struct ixgbe_adapter *adapter = netdev_priv(ring->netdev);
         struct ixgbe_hw *hw = &adapter->hw;
 
-        /* Detect a transmit hang in hardware, this serializes the
-         * check with the clearing of time_stamp and movement of eop */
-        adapter->detect_tx_hung = false;
-        if (tx_ring->tx_buffer_info[eop].time_stamp &&
-            time_after(jiffies, tx_ring->tx_buffer_info[eop].time_stamp + HZ) &&
-            ixgbe_tx_xon_state(adapter, tx_ring)) {
-                /* detected Tx unit hang */
-                union ixgbe_adv_tx_desc *tx_desc;
-                tx_desc = IXGBE_TX_DESC_ADV(tx_ring, eop);
-                e_err(drv, "Detected Tx Unit Hang\n"
-                      "  Tx Queue             <%d>\n"
-                      "  TDH, TDT             <%x>, <%x>\n"
-                      "  next_to_use          <%x>\n"
-                      "  next_to_clean        <%x>\n"
-                      "tx_buffer_info[next_to_clean]\n"
-                      "  time_stamp           <%lx>\n"
-                      "  jiffies              <%lx>\n",
-                      tx_ring->queue_index,
-                      IXGBE_READ_REG(hw, tx_ring->head),
-                      IXGBE_READ_REG(hw, tx_ring->tail),
-                      tx_ring->next_to_use, eop,
-                      tx_ring->tx_buffer_info[eop].time_stamp, jiffies);
-                return true;
+        u32 head = IXGBE_READ_REG(hw, IXGBE_TDH(ring->reg_idx));
+        u32 tail = IXGBE_READ_REG(hw, IXGBE_TDT(ring->reg_idx));
+
+        if (head != tail)
+                return (head < tail) ?
+                        tail - head : (tail + ring->count - head);
+
+        return 0;
+}
+
+static inline bool ixgbe_check_tx_hang(struct ixgbe_ring *tx_ring)
+{
+        u32 tx_done = ixgbe_get_tx_completed(tx_ring);
+        u32 tx_done_old = tx_ring->tx_stats.tx_done_old;
+        u32 tx_pending = ixgbe_get_tx_pending(tx_ring);
+        bool ret = false;
+
+        clear_check_for_tx_hang(tx_ring);
+
+        /*
+         * Check for a hung queue, but be thorough. This verifies
+         * that a transmit has been completed since the previous
+         * check AND there is at least one packet pending. The
+         * ARMED bit is set to indicate a potential hang. The
+         * bit is cleared if a pause frame is received to remove
+         * false hang detection due to PFC or 802.3x frames. By
+         * requiring this to fail twice we avoid races with
+         * pfc clearing the ARMED bit and conditions where we
+         * run the check_tx_hang logic with a transmit completion
+         * pending but without time to complete it yet.
+         */
+        if ((tx_done_old == tx_done) && tx_pending) {
+                /* make sure it is true for two checks in a row */
+                ret = test_and_set_bit(__IXGBE_HANG_CHECK_ARMED,
+                                       &tx_ring->state);
+        } else {
+                /* update completed stats and continue */
+                tx_ring->tx_stats.tx_done_old = tx_done;
+                /* reset the countdown */
+                clear_bit(__IXGBE_HANG_CHECK_ARMED, &tx_ring->state);
         }
 
-        return false;
+        return ret;
 }
 
 #define IXGBE_MAX_TXD_PWR       14
@@ -734,11 +821,10 @@ static bool ixgbe_clean_tx_irq(struct ixgbe_q_vector *q_vector,
                                struct ixgbe_ring *tx_ring)
 {
         struct ixgbe_adapter *adapter = q_vector->adapter;
-        struct net_device *netdev = adapter->netdev;
         union ixgbe_adv_tx_desc *tx_desc, *eop_desc;
         struct ixgbe_tx_buffer *tx_buffer_info;
-        unsigned int i, eop, count = 0;
         unsigned int total_bytes = 0, total_packets = 0;
+        u16 i, eop, count = 0;
 
         i = tx_ring->next_to_clean;
         eop = tx_ring->tx_buffer_info[i].next_to_watch;
@@ -749,148 +835,182 @@ static bool ixgbe_clean_tx_irq(struct ixgbe_q_vector *q_vector,
                 bool cleaned = false;
                 rmb(); /* read buffer_info after eop_desc */
                 for ( ; !cleaned; count++) {
-                        struct sk_buff *skb;
                         tx_desc = IXGBE_TX_DESC_ADV(tx_ring, i);
                         tx_buffer_info = &tx_ring->tx_buffer_info[i];
-                        cleaned = (i == eop);
-                        skb = tx_buffer_info->skb;
-
-                        if (cleaned && skb) {
-                                unsigned int segs, bytecount;
-                                unsigned int hlen = skb_headlen(skb);
-
-                                /* gso_segs is currently only valid for tcp */
-                                segs = skb_shinfo(skb)->gso_segs ?: 1;
-#ifdef IXGBE_FCOE
-                                /* adjust for FCoE Sequence Offload */
-                                if ((adapter->flags & IXGBE_FLAG_FCOE_ENABLED)
-                                    && skb_is_gso(skb)
-                                    && vlan_get_protocol(skb) ==
-                                    htons(ETH_P_FCOE)) {
-                                        hlen = skb_transport_offset(skb) +
-                                                sizeof(struct fc_frame_header) +
-                                                sizeof(struct fcoe_crc_eof);
-                                        segs = DIV_ROUND_UP(skb->len - hlen,
-                                                skb_shinfo(skb)->gso_size);
-                                }
-#endif /* IXGBE_FCOE */
-                                /* multiply data chunks by size of headers */
-                                bytecount = ((segs - 1) * hlen) + skb->len;
-                                total_packets += segs;
-                                total_bytes += bytecount;
-                        }
-
-                        ixgbe_unmap_and_free_tx_resource(adapter,
-                                                         tx_buffer_info);
 
                         tx_desc->wb.status = 0;
+                        cleaned = (i == eop);
 
                         i++;
                         if (i == tx_ring->count)
                                 i = 0;
+
+                        if (cleaned && tx_buffer_info->skb) {
+                                total_bytes += tx_buffer_info->bytecount;
+                                total_packets += tx_buffer_info->gso_segs;
+                        }
+
+                        ixgbe_unmap_and_free_tx_resource(tx_ring,
+                                                         tx_buffer_info);
                 }
 
+                tx_ring->tx_stats.completed++;
                 eop = tx_ring->tx_buffer_info[i].next_to_watch;
                 eop_desc = IXGBE_TX_DESC_ADV(tx_ring, eop);
         }
 
         tx_ring->next_to_clean = i;
+        tx_ring->total_bytes += total_bytes;
+        tx_ring->total_packets += total_packets;
+        u64_stats_update_begin(&tx_ring->syncp);
+        tx_ring->stats.packets += total_packets;
+        tx_ring->stats.bytes += total_bytes;
+        u64_stats_update_end(&tx_ring->syncp);
+
+        if (check_for_tx_hang(tx_ring) && ixgbe_check_tx_hang(tx_ring)) {
+                /* schedule immediate reset if we believe we hung */
+                struct ixgbe_hw *hw = &adapter->hw;
+                tx_desc = IXGBE_TX_DESC_ADV(tx_ring, eop);
+                e_err(drv, "Detected Tx Unit Hang\n"
+                        "  Tx Queue             <%d>\n"
+                        "  TDH, TDT             <%x>, <%x>\n"
+                        "  next_to_use          <%x>\n"
+                        "  next_to_clean        <%x>\n"
+                        "tx_buffer_info[next_to_clean]\n"
+                        "  time_stamp           <%lx>\n"
+                        "  jiffies              <%lx>\n",
+                        tx_ring->queue_index,
+                        IXGBE_READ_REG(hw, IXGBE_TDH(tx_ring->reg_idx)),
+                        IXGBE_READ_REG(hw, IXGBE_TDT(tx_ring->reg_idx)),
+                        tx_ring->next_to_use, eop,
+                        tx_ring->tx_buffer_info[eop].time_stamp, jiffies);
+
+                netif_stop_subqueue(tx_ring->netdev, tx_ring->queue_index);
+
+                e_info(probe,
+                       "tx hang %d detected on queue %d, resetting adapter\n",
+                        adapter->tx_timeout_count + 1, tx_ring->queue_index);
+
+                /* schedule immediate reset if we believe we hung */
+                ixgbe_tx_timeout(adapter->netdev);
+
+                /* the adapter is about to reset, no point in enabling stuff */
+                return true;
+        }
 
 #define TX_WAKE_THRESHOLD (DESC_NEEDED * 2)
-        if (unlikely(count && netif_carrier_ok(netdev) &&
+        if (unlikely(count && netif_carrier_ok(tx_ring->netdev) &&
                      (IXGBE_DESC_UNUSED(tx_ring) >= TX_WAKE_THRESHOLD))) {
                 /* Make sure that anybody stopping the queue after this
                  * sees the new next_to_clean.
                  */
                 smp_mb();
-                if (__netif_subqueue_stopped(netdev, tx_ring->queue_index) &&
+                if (__netif_subqueue_stopped(tx_ring->netdev, tx_ring->queue_index) &&
                     !test_bit(__IXGBE_DOWN, &adapter->state)) {
-                        netif_wake_subqueue(netdev, tx_ring->queue_index);
-                        ++tx_ring->restart_queue;
-                }
-        }
-
-        if (adapter->detect_tx_hung) {
-                if (ixgbe_check_tx_hang(adapter, tx_ring, i)) {
-                        /* schedule immediate reset if we believe we hung */
-                        e_info(probe, "tx hang %d detected, resetting "
-                               "adapter\n", adapter->tx_timeout_count + 1);
-                        ixgbe_tx_timeout(adapter->netdev);
+                        netif_wake_subqueue(tx_ring->netdev, tx_ring->queue_index);
+                        ++tx_ring->tx_stats.restart_queue;
                 }
         }
 
-        /* re-arm the interrupt */
-        if (count >= tx_ring->work_limit)
-                ixgbe_irq_rearm_queues(adapter, ((u64)1 << q_vector->v_idx));
-
-        tx_ring->total_bytes += total_bytes;
-        tx_ring->total_packets += total_packets;
-        u64_stats_update_begin(&tx_ring->syncp);
-        tx_ring->stats.packets += total_packets;
-        tx_ring->stats.bytes += total_bytes;
-        u64_stats_update_end(&tx_ring->syncp);
         return count < tx_ring->work_limit;
 }
 
 #ifdef CONFIG_IXGBE_DCA
 static void ixgbe_update_rx_dca(struct ixgbe_adapter *adapter,
-                                struct ixgbe_ring *rx_ring)
+                                struct ixgbe_ring *rx_ring,
+                                int cpu)
 {
+        struct ixgbe_hw *hw = &adapter->hw;
         u32 rxctrl;
-        int cpu = get_cpu();
-        int q = rx_ring->reg_idx;
-
-        if (rx_ring->cpu != cpu) {
-                rxctrl = IXGBE_READ_REG(&adapter->hw, IXGBE_DCA_RXCTRL(q));
-                if (adapter->hw.mac.type == ixgbe_mac_82598EB) {
-                        rxctrl &= ~IXGBE_DCA_RXCTRL_CPUID_MASK;
-                        rxctrl |= dca3_get_tag(&adapter->pdev->dev, cpu);
-                } else if (adapter->hw.mac.type == ixgbe_mac_82599EB) {
-                        rxctrl &= ~IXGBE_DCA_RXCTRL_CPUID_MASK_82599;
-                        rxctrl |= (dca3_get_tag(&adapter->pdev->dev, cpu) <<
-                                   IXGBE_DCA_RXCTRL_CPUID_SHIFT_82599);
-                }
-                rxctrl |= IXGBE_DCA_RXCTRL_DESC_DCA_EN;
-                rxctrl |= IXGBE_DCA_RXCTRL_HEAD_DCA_EN;
-                rxctrl &= ~(IXGBE_DCA_RXCTRL_DESC_RRO_EN);
-                rxctrl &= ~(IXGBE_DCA_RXCTRL_DESC_WRO_EN |
-                            IXGBE_DCA_RXCTRL_DESC_HSRO_EN);
-                IXGBE_WRITE_REG(&adapter->hw, IXGBE_DCA_RXCTRL(q), rxctrl);
-                rx_ring->cpu = cpu;
+        u8 reg_idx = rx_ring->reg_idx;
+
+        rxctrl = IXGBE_READ_REG(hw, IXGBE_DCA_RXCTRL(reg_idx));
+        switch (hw->mac.type) {
+        case ixgbe_mac_82598EB:
+                rxctrl &= ~IXGBE_DCA_RXCTRL_CPUID_MASK;
+                rxctrl |= dca3_get_tag(&adapter->pdev->dev, cpu);
+                break;
+        case ixgbe_mac_82599EB:
+        case ixgbe_mac_X540:
+                rxctrl &= ~IXGBE_DCA_RXCTRL_CPUID_MASK_82599;
+                rxctrl |= (dca3_get_tag(&adapter->pdev->dev, cpu) <<
+                           IXGBE_DCA_RXCTRL_CPUID_SHIFT_82599);
+                break;
+        default:
+                break;
         }
-        put_cpu();
+        rxctrl |= IXGBE_DCA_RXCTRL_DESC_DCA_EN;
+        rxctrl |= IXGBE_DCA_RXCTRL_HEAD_DCA_EN;
+        rxctrl &= ~(IXGBE_DCA_RXCTRL_DESC_RRO_EN);
+        rxctrl &= ~(IXGBE_DCA_RXCTRL_DESC_WRO_EN |
+                    IXGBE_DCA_RXCTRL_DESC_HSRO_EN);
+        IXGBE_WRITE_REG(hw, IXGBE_DCA_RXCTRL(reg_idx), rxctrl);
 }
 
 static void ixgbe_update_tx_dca(struct ixgbe_adapter *adapter,
-                                struct ixgbe_ring *tx_ring)
+                                struct ixgbe_ring *tx_ring,
+                                int cpu)
 {
+        struct ixgbe_hw *hw = &adapter->hw;
         u32 txctrl;
+        u8 reg_idx = tx_ring->reg_idx;
+
+        switch (hw->mac.type) {
+        case ixgbe_mac_82598EB:
+                txctrl = IXGBE_READ_REG(hw, IXGBE_DCA_TXCTRL(reg_idx));
+                txctrl &= ~IXGBE_DCA_TXCTRL_CPUID_MASK;
+                txctrl |= dca3_get_tag(&adapter->pdev->dev, cpu);
+                txctrl |= IXGBE_DCA_TXCTRL_DESC_DCA_EN;
+                txctrl &= ~IXGBE_DCA_TXCTRL_TX_WB_RO_EN;
+                IXGBE_WRITE_REG(hw, IXGBE_DCA_TXCTRL(reg_idx), txctrl);
+                break;
+        case ixgbe_mac_82599EB:
+        case ixgbe_mac_X540:
+                txctrl = IXGBE_READ_REG(hw, IXGBE_DCA_TXCTRL_82599(reg_idx));
+                txctrl &= ~IXGBE_DCA_TXCTRL_CPUID_MASK_82599;
+                txctrl |= (dca3_get_tag(&adapter->pdev->dev, cpu) <<
+                           IXGBE_DCA_TXCTRL_CPUID_SHIFT_82599);
+                txctrl |= IXGBE_DCA_TXCTRL_DESC_DCA_EN;
+                txctrl &= ~IXGBE_DCA_TXCTRL_TX_WB_RO_EN;
+                IXGBE_WRITE_REG(hw, IXGBE_DCA_TXCTRL_82599(reg_idx), txctrl);
+                break;
+        default:
+                break;
+        }
+}
+
+static void ixgbe_update_dca(struct ixgbe_q_vector *q_vector)
+{
+        struct ixgbe_adapter *adapter = q_vector->adapter;
         int cpu = get_cpu();
-        int q = tx_ring->reg_idx;
-        struct ixgbe_hw *hw = &adapter->hw;
+        long r_idx;
+        int i;
 
-        if (tx_ring->cpu != cpu) {
-                if (adapter->hw.mac.type == ixgbe_mac_82598EB) {
-                        txctrl = IXGBE_READ_REG(hw, IXGBE_DCA_TXCTRL(q));
-                        txctrl &= ~IXGBE_DCA_TXCTRL_CPUID_MASK;
-                        txctrl |= dca3_get_tag(&adapter->pdev->dev, cpu);
-                        txctrl |= IXGBE_DCA_TXCTRL_DESC_DCA_EN;
-                        IXGBE_WRITE_REG(hw, IXGBE_DCA_TXCTRL(q), txctrl);
-                } else if (adapter->hw.mac.type == ixgbe_mac_82599EB) {
-                        txctrl = IXGBE_READ_REG(hw, IXGBE_DCA_TXCTRL_82599(q));
-                        txctrl &= ~IXGBE_DCA_TXCTRL_CPUID_MASK_82599;
-                        txctrl |= (dca3_get_tag(&adapter->pdev->dev, cpu) <<
-                                  IXGBE_DCA_TXCTRL_CPUID_SHIFT_82599);
-                        txctrl |= IXGBE_DCA_TXCTRL_DESC_DCA_EN;
-                        IXGBE_WRITE_REG(hw, IXGBE_DCA_TXCTRL_82599(q), txctrl);
-                }
-                tx_ring->cpu = cpu;
+        if (q_vector->cpu == cpu)
+                goto out_no_update;
+
+        r_idx = find_first_bit(q_vector->txr_idx, adapter->num_tx_queues);
+        for (i = 0; i < q_vector->txr_count; i++) {
+                ixgbe_update_tx_dca(adapter, adapter->tx_ring[r_idx], cpu);
+                r_idx = find_next_bit(q_vector->txr_idx, adapter->num_tx_queues,
+                                      r_idx + 1);
+        }
+
+        r_idx = find_first_bit(q_vector->rxr_idx, adapter->num_rx_queues);
+        for (i = 0; i < q_vector->rxr_count; i++) {
+                ixgbe_update_rx_dca(adapter, adapter->rx_ring[r_idx], cpu);
+                r_idx = find_next_bit(q_vector->rxr_idx, adapter->num_rx_queues,
+                                      r_idx + 1);
         }
+
+        q_vector->cpu = cpu;
+out_no_update:
         put_cpu();
 }
 
 static void ixgbe_setup_dca(struct ixgbe_adapter *adapter)
 {
+        int num_q_vectors;
         int i;
 
         if (!(adapter->flags & IXGBE_FLAG_DCA_ENABLED))
@@ -899,22 +1019,25 @@ static void ixgbe_setup_dca(struct ixgbe_adapter *adapter)
         /* always use CB2 mode, difference is masked in the CB driver */
         IXGBE_WRITE_REG(&adapter->hw, IXGBE_DCA_CTRL, 2);
 
-        for (i = 0; i < adapter->num_tx_queues; i++) {
-                adapter->tx_ring[i]->cpu = -1;
-                ixgbe_update_tx_dca(adapter, adapter->tx_ring[i]);
-        }
-        for (i = 0; i < adapter->num_rx_queues; i++) {
-                adapter->rx_ring[i]->cpu = -1;
-                ixgbe_update_rx_dca(adapter, adapter->rx_ring[i]);
+        if (adapter->flags & IXGBE_FLAG_MSIX_ENABLED)
+                num_q_vectors = adapter->num_msix_vectors - NON_Q_VECTORS;
+        else
+                num_q_vectors = 1;
+
+        for (i = 0; i < num_q_vectors; i++) {
+                adapter->q_vector[i]->cpu = -1;
+                ixgbe_update_dca(adapter->q_vector[i]);
         }
 }
 
 static int __ixgbe_notify_dca(struct device *dev, void *data)
 {
-        struct net_device *netdev = dev_get_drvdata(dev);
-        struct ixgbe_adapter *adapter = netdev_priv(netdev);
+        struct ixgbe_adapter *adapter = dev_get_drvdata(dev);
         unsigned long event = *(unsigned long *)data;
 
+        if (!(adapter->flags & IXGBE_FLAG_DCA_ENABLED))
+                return 0;
+
         switch (event) {
         case DCA_PROVIDER_ADD:
                 /* if we're already enabled, don't do it again */
@@ -1013,8 +1136,7 @@ static inline void ixgbe_rx_checksum(struct ixgbe_adapter *adapter,
         skb->ip_summed = CHECKSUM_UNNECESSARY;
 }
 
-static inline void ixgbe_release_rx_desc(struct ixgbe_hw *hw,
-                                         struct ixgbe_ring *rx_ring, u32 val)
+static inline void ixgbe_release_rx_desc(struct ixgbe_ring *rx_ring, u32 val)
 {
         /*
          * Force memory writes to complete before letting h/w
@@ -1023,72 +1145,81 @@ static inline void ixgbe_release_rx_desc(struct ixgbe_hw *hw,
          * such as IA-64).
          */
         wmb();
-        IXGBE_WRITE_REG(hw, IXGBE_RDT(rx_ring->reg_idx), val);
+        writel(val, rx_ring->tail);
 }
 
 /**
  * ixgbe_alloc_rx_buffers - Replace used receive buffers; packet split
- * @adapter: address of board private structure
+ * @rx_ring: ring to place buffers on
+ * @cleaned_count: number of buffers to replace
  **/
-void ixgbe_alloc_rx_buffers(struct ixgbe_adapter *adapter,
-                            struct ixgbe_ring *rx_ring,
-                            int cleaned_count)
+void ixgbe_alloc_rx_buffers(struct ixgbe_ring *rx_ring, u16 cleaned_count)
 {
-        struct net_device *netdev = adapter->netdev;
-        struct pci_dev *pdev = adapter->pdev;
         union ixgbe_adv_rx_desc *rx_desc;
         struct ixgbe_rx_buffer *bi;
-        unsigned int i;
-        unsigned int bufsz = rx_ring->rx_buf_len;
+        struct sk_buff *skb;
+        u16 i = rx_ring->next_to_use;
 
-        i = rx_ring->next_to_use;
-        bi = &rx_ring->rx_buffer_info[i];
+        /* do nothing if no valid netdev defined */
+        if (!rx_ring->netdev)
+                return;
 
         while (cleaned_count--) {
                 rx_desc = IXGBE_RX_DESC_ADV(rx_ring, i);
+                bi = &rx_ring->rx_buffer_info[i];
+                skb = bi->skb;
 
-                if (!bi->page_dma &&
-                    (rx_ring->flags & IXGBE_RING_RX_PS_ENABLED)) {
-                        if (!bi->page) {
-                                bi->page = netdev_alloc_page(netdev);
-                                if (!bi->page) {
-                                        adapter->alloc_rx_page_failed++;
-                                        goto no_buffers;
-                                }
-                                bi->page_offset = 0;
-                        } else {
-                                /* use a half page if we're re-using */
-                                bi->page_offset ^= (PAGE_SIZE / 2);
-                        }
-
-                        bi->page_dma = dma_map_page(&pdev->dev, bi->page,
-                                                    bi->page_offset,
-                                                    (PAGE_SIZE / 2),
-                                                    DMA_FROM_DEVICE);
-                }
-
-                if (!bi->skb) {
-                        struct sk_buff *skb = netdev_alloc_skb_ip_align(netdev,
-                                                                        bufsz);
-                        bi->skb = skb;
-
+                if (!skb) {
+                        skb = netdev_alloc_skb_ip_align(rx_ring->netdev,
+                                                        rx_ring->rx_buf_len);
                         if (!skb) {
-                                adapter->alloc_rx_buff_failed++;
+                                rx_ring->rx_stats.alloc_rx_buff_failed++;
                                 goto no_buffers;
                         }
                         /* initialize queue mapping */
                         skb_record_rx_queue(skb, rx_ring->queue_index);
+                        bi->skb = skb;
                 }
 
                 if (!bi->dma) {
-                        bi->dma = dma_map_single(&pdev->dev,
-                                                 bi->skb->data,
+                        bi->dma = dma_map_single(rx_ring->dev,
+                                                 skb->data,
                                                  rx_ring->rx_buf_len,
                                                  DMA_FROM_DEVICE);
+                        if (dma_mapping_error(rx_ring->dev, bi->dma)) {
+                                rx_ring->rx_stats.alloc_rx_buff_failed++;
+                                bi->dma = 0;
+                                goto no_buffers;
+                        }
                 }
-                /* Refresh the desc even if buffer_addrs didn't change because
-                 * each write-back erases this info. */
-                if (rx_ring->flags & IXGBE_RING_RX_PS_ENABLED) {
+
+                if (ring_is_ps_enabled(rx_ring)) {
+                        if (!bi->page) {
+                                bi->page = netdev_alloc_page(rx_ring->netdev);
+                                if (!bi->page) {
+                                        rx_ring->rx_stats.alloc_rx_page_failed++;
+                                        goto no_buffers;
+                                }
+                        }
+
+                        if (!bi->page_dma) {
+                                /* use a half page if we're re-using */
+                                bi->page_offset ^= PAGE_SIZE / 2;
+                                bi->page_dma = dma_map_page(rx_ring->dev,
+                                                            bi->page,
+                                                            bi->page_offset,
+                                                            PAGE_SIZE / 2,
+                                                            DMA_FROM_DEVICE);
+                                if (dma_mapping_error(rx_ring->dev,
+                                                      bi->page_dma)) {
+                                        rx_ring->rx_stats.alloc_rx_page_failed++;
+                                        bi->page_dma = 0;
+                                        goto no_buffers;
+                                }
+                        }
+
+                        /* Refresh the desc even if buffer_addrs didn't change
+                         * because each write-back erases this info. */
                         rx_desc->read.pkt_addr = cpu_to_le64(bi->page_dma);
                         rx_desc->read.hdr_addr = cpu_to_le64(bi->dma);
                 } else {
@@ -1099,56 +1230,48 @@ void ixgbe_alloc_rx_buffers(struct ixgbe_adapter *adapter,
                 i++;
                 if (i == rx_ring->count)
                         i = 0;
-                bi = &rx_ring->rx_buffer_info[i];
         }
 
 no_buffers:
         if (rx_ring->next_to_use != i) {
                 rx_ring->next_to_use = i;
-                if (i-- == 0)
-                        i = (rx_ring->count - 1);
-
-                ixgbe_release_rx_desc(&adapter->hw, rx_ring, i);
+                ixgbe_release_rx_desc(rx_ring, i);
         }
 }
 
-static inline u16 ixgbe_get_hdr_info(union ixgbe_adv_rx_desc *rx_desc)
+static inline u16 ixgbe_get_hlen(union ixgbe_adv_rx_desc *rx_desc)
 {
-        return rx_desc->wb.lower.lo_dword.hs_rss.hdr_info;
-}
-
-static inline u16 ixgbe_get_pkt_info(union ixgbe_adv_rx_desc *rx_desc)
-{
-        return rx_desc->wb.lower.lo_dword.hs_rss.pkt_info;
-}
-
-static inline u32 ixgbe_get_rsc_count(union ixgbe_adv_rx_desc *rx_desc)
-{
-        return (le32_to_cpu(rx_desc->wb.lower.lo_dword.data) &
-                IXGBE_RXDADV_RSCCNT_MASK) >>
-                IXGBE_RXDADV_RSCCNT_SHIFT;
+        /* HW will not DMA in data larger than the given buffer, even if it
+         * parses the (NFS, of course) header to be larger.  In that case, it
+         * fills the header buffer and spills the rest into the page.
+         */
+        u16 hdr_info = le16_to_cpu(rx_desc->wb.lower.lo_dword.hs_rss.hdr_info);
+        u16 hlen = (hdr_info &  IXGBE_RXDADV_HDRBUFLEN_MASK) >>
+                    IXGBE_RXDADV_HDRBUFLEN_SHIFT;
+        if (hlen > IXGBE_RX_HDR_SIZE)
+                hlen = IXGBE_RX_HDR_SIZE;
+        return hlen;
 }
 
 /**
  * ixgbe_transform_rsc_queue - change rsc queue into a full packet
  * @skb: pointer to the last skb in the rsc queue
- * @count: pointer to number of packets coalesced in this context
  *
  * This function changes a queue full of hw rsc buffers into a completed
  * packet.  It uses the ->prev pointers to find the first packet and then
  * turns it into the frag list owner.
  **/
-static inline struct sk_buff *ixgbe_transform_rsc_queue(struct sk_buff *skb,
-                                                        u64 *count)
+static inline struct sk_buff *ixgbe_transform_rsc_queue(struct sk_buff *skb)
 {
         unsigned int frag_list_size = 0;
+        unsigned int skb_cnt = 1;
 
         while (skb->prev) {
                 struct sk_buff *prev = skb->prev;
                 frag_list_size += skb->len;
                 skb->prev = NULL;
                 skb = prev;
-                *count += 1;
+                skb_cnt++;
         }
 
         skb_shinfo(skb)->frag_list = skb->next;
@@ -1156,68 +1279,59 @@ static inline struct sk_buff *ixgbe_transform_rsc_queue(struct sk_buff *skb,
         skb->len += frag_list_size;
         skb->data_len += frag_list_size;
         skb->truesize += frag_list_size;
+        IXGBE_RSC_CB(skb)->skb_cnt = skb_cnt;
+
         return skb;
 }
 
-struct ixgbe_rsc_cb {
-        dma_addr_t dma;
-        bool delay_unmap;
-};
-
-#define IXGBE_RSC_CB(skb) ((struct ixgbe_rsc_cb *)(skb)->cb)
+static inline bool ixgbe_get_rsc_state(union ixgbe_adv_rx_desc *rx_desc)
+{
+        return !!(le32_to_cpu(rx_desc->wb.lower.lo_dword.data) &
+                IXGBE_RXDADV_RSCCNT_MASK);
+}
 
-static bool ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
+static void ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                                struct ixgbe_ring *rx_ring,
                                int *work_done, int work_to_do)
 {
         struct ixgbe_adapter *adapter = q_vector->adapter;
-        struct pci_dev *pdev = adapter->pdev;
         union ixgbe_adv_rx_desc *rx_desc, *next_rxd;
         struct ixgbe_rx_buffer *rx_buffer_info, *next_buffer;
         struct sk_buff *skb;
-        unsigned int i, rsc_count = 0;
-        u32 len, staterr;
-        u16 hdr_info;
-        bool cleaned = false;
-        int cleaned_count = 0;
         unsigned int total_rx_bytes = 0, total_rx_packets = 0;
+        const int current_node = numa_node_id();
 #ifdef IXGBE_FCOE
         int ddp_bytes = 0;
 #endif /* IXGBE_FCOE */
+        u32 staterr;
+        u16 i;
+        u16 cleaned_count = 0;
+        bool pkt_is_rsc = false;
 
         i = rx_ring->next_to_clean;
         rx_desc = IXGBE_RX_DESC_ADV(rx_ring, i);
         staterr = le32_to_cpu(rx_desc->wb.upper.status_error);
-        rx_buffer_info = &rx_ring->rx_buffer_info[i];
 
         while (staterr & IXGBE_RXD_STAT_DD) {
                 u32 upper_len = 0;
-                if (*work_done >= work_to_do)
-                        break;
-                (*work_done)++;
 
                 rmb(); /* read descriptor and rx_buffer_info after status DD */
-                if (rx_ring->flags & IXGBE_RING_RX_PS_ENABLED) {
-                        hdr_info = le16_to_cpu(ixgbe_get_hdr_info(rx_desc));
-                        len = (hdr_info & IXGBE_RXDADV_HDRBUFLEN_MASK) >>
-                               IXGBE_RXDADV_HDRBUFLEN_SHIFT;
-                        upper_len = le16_to_cpu(rx_desc->wb.upper.length);
-                        if ((len > IXGBE_RX_HDR_SIZE) ||
-                            (upper_len && !(hdr_info & IXGBE_RXDADV_SPH)))
-                                len = IXGBE_RX_HDR_SIZE;
-                } else {
-                        len = le16_to_cpu(rx_desc->wb.upper.length);
-                }
 
-                cleaned = true;
+                rx_buffer_info = &rx_ring->rx_buffer_info[i];
+
                 skb = rx_buffer_info->skb;
-                prefetch(skb->data);
                 rx_buffer_info->skb = NULL;
+                prefetch(skb->data);
 
+                if (ring_is_rsc_enabled(rx_ring))
+                        pkt_is_rsc = ixgbe_get_rsc_state(rx_desc);
+
+                /* if this is a skb from previous receive DMA will be 0 */
                 if (rx_buffer_info->dma) {
-                        if ((adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED) &&
-                            (!(staterr & IXGBE_RXD_STAT_EOP)) &&
-                                 (!(skb->prev))) {
+                        u16 hlen;
+                        if (pkt_is_rsc &&
+                            !(staterr & IXGBE_RXD_STAT_EOP) &&
+                            !skb->prev) {
                                 /*
                                  * When HWRSC is enabled, delay unmapping
                                  * of the first packet. It carries the
@@ -1228,29 +1342,42 @@ static bool ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                                 IXGBE_RSC_CB(skb)->delay_unmap = true;
                                 IXGBE_RSC_CB(skb)->dma = rx_buffer_info->dma;
                         } else {
-                                dma_unmap_single(&pdev->dev,
+                                dma_unmap_single(rx_ring->dev,
                                                  rx_buffer_info->dma,
                                                  rx_ring->rx_buf_len,
                                                  DMA_FROM_DEVICE);
                         }
                         rx_buffer_info->dma = 0;
-                        skb_put(skb, len);
+
+                        if (ring_is_ps_enabled(rx_ring)) {
+                                hlen = ixgbe_get_hlen(rx_desc);
+                                upper_len = le16_to_cpu(rx_desc->wb.upper.length);
+                        } else {
+                                hlen = le16_to_cpu(rx_desc->wb.upper.length);
+                        }
+
+                        skb_put(skb, hlen);
+                } else {
+                        /* assume packet split since header is unmapped */
+                        upper_len = le16_to_cpu(rx_desc->wb.upper.length);
                 }
 
                 if (upper_len) {
-                        dma_unmap_page(&pdev->dev, rx_buffer_info->page_dma,
-                                       PAGE_SIZE / 2, DMA_FROM_DEVICE);
+                        dma_unmap_page(rx_ring->dev,
+                                       rx_buffer_info->page_dma,
+                                       PAGE_SIZE / 2,
+                                       DMA_FROM_DEVICE);
                         rx_buffer_info->page_dma = 0;
                         skb_fill_page_desc(skb, skb_shinfo(skb)->nr_frags,
                                            rx_buffer_info->page,
                                            rx_buffer_info->page_offset,
                                            upper_len);
 
-                        if ((rx_ring->rx_buf_len > (PAGE_SIZE / 2)) ||
-                            (page_count(rx_buffer_info->page) != 1))
-                                rx_buffer_info->page = NULL;
-                        else
+                        if ((page_count(rx_buffer_info->page) == 1) &&
+                            (page_to_nid(rx_buffer_info->page) == current_node))
                                 get_page(rx_buffer_info->page);
+                        else
+                                rx_buffer_info->page = NULL;
 
                         skb->len += upper_len;
                         skb->data_len += upper_len;
@@ -1265,10 +1392,7 @@ static bool ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                 prefetch(next_rxd);
                 cleaned_count++;
 
-                if (adapter->flags2 & IXGBE_FLAG2_RSC_CAPABLE)
-                        rsc_count = ixgbe_get_rsc_count(rx_desc);
-
-                if (rsc_count) {
+                if (pkt_is_rsc) {
                         u32 nextp = (staterr & IXGBE_RXDADV_NEXTP_MASK) >>
                                      IXGBE_RXDADV_NEXTP_SHIFT;
                         next_buffer = &rx_ring->rx_buffer_info[nextp];
@@ -1276,32 +1400,8 @@ static bool ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                         next_buffer = &rx_ring->rx_buffer_info[i];
                 }
 
-                if (staterr & IXGBE_RXD_STAT_EOP) {
-                        if (skb->prev)
-                                skb = ixgbe_transform_rsc_queue(skb,
-                                                                &(rx_ring->rsc_count));
-                        if (adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED) {
-                                if (IXGBE_RSC_CB(skb)->delay_unmap) {
-                                        dma_unmap_single(&pdev->dev,
-                                                         IXGBE_RSC_CB(skb)->dma,
-                                                         rx_ring->rx_buf_len,
-                                                         DMA_FROM_DEVICE);
-                                        IXGBE_RSC_CB(skb)->dma = 0;
-                                        IXGBE_RSC_CB(skb)->delay_unmap = false;
-                                }
-                                if (rx_ring->flags & IXGBE_RING_RX_PS_ENABLED)
-                                        rx_ring->rsc_count +=
-                                                skb_shinfo(skb)->nr_frags;
-                                else
-                                        rx_ring->rsc_count++;
-                                rx_ring->rsc_flush++;
-                        }
-                        u64_stats_update_begin(&rx_ring->syncp);
-                        rx_ring->stats.packets++;
-                        rx_ring->stats.bytes += skb->len;
-                        u64_stats_update_end(&rx_ring->syncp);
-                } else {
-                        if (rx_ring->flags & IXGBE_RING_RX_PS_ENABLED) {
+                if (!(staterr & IXGBE_RXD_STAT_EOP)) {
+                        if (ring_is_ps_enabled(rx_ring)) {
                                 rx_buffer_info->skb = next_buffer->skb;
                                 rx_buffer_info->dma = next_buffer->dma;
                                 next_buffer->skb = skb;
@@ -1310,12 +1410,45 @@ static bool ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                                 skb->next = next_buffer->skb;
                                 skb->next->prev = skb;
                         }
-                        rx_ring->non_eop_descs++;
+                        rx_ring->rx_stats.non_eop_descs++;
                         goto next_desc;
                 }
 
+                if (skb->prev) {
+                        skb = ixgbe_transform_rsc_queue(skb);
+                        /* if we got here without RSC the packet is invalid */
+                        if (!pkt_is_rsc) {
+                                __pskb_trim(skb, 0);
+                                rx_buffer_info->skb = skb;
+                                goto next_desc;
+                        }
+                }
+
+                if (ring_is_rsc_enabled(rx_ring)) {
+                        if (IXGBE_RSC_CB(skb)->delay_unmap) {
+                                dma_unmap_single(rx_ring->dev,
+                                                 IXGBE_RSC_CB(skb)->dma,
+                                                 rx_ring->rx_buf_len,
+                                                 DMA_FROM_DEVICE);
+                                IXGBE_RSC_CB(skb)->dma = 0;
+                                IXGBE_RSC_CB(skb)->delay_unmap = false;
+                        }
+                }
+                if (pkt_is_rsc) {
+                        if (ring_is_ps_enabled(rx_ring))
+                                rx_ring->rx_stats.rsc_count +=
+                                        skb_shinfo(skb)->nr_frags;
+                        else
+                                rx_ring->rx_stats.rsc_count +=
+                                        IXGBE_RSC_CB(skb)->skb_cnt;
+                        rx_ring->rx_stats.rsc_flush++;
+                }
+
+                /* ERR_MASK will only have valid bits if EOP set */
                 if (staterr & IXGBE_RXDADV_ERR_FRAME_ERR_MASK) {
-                        dev_kfree_skb_irq(skb);
+                        /* trim packet back to size 0 and recycle it */
+                        __pskb_trim(skb, 0);
+                        rx_buffer_info->skb = skb;
                         goto next_desc;
                 }
 
@@ -1325,7 +1458,7 @@ static bool ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                 total_rx_bytes += skb->len;
                 total_rx_packets++;
 
-                skb->protocol = eth_type_trans(skb, adapter->netdev);
+                skb->protocol = eth_type_trans(skb, rx_ring->netdev);
 #ifdef IXGBE_FCOE
                 /* if ddp, not passing to ULD unless for FCP_RSP or error */
                 if (adapter->flags & IXGBE_FLAG_FCOE_ENABLED) {
@@ -1339,16 +1472,18 @@ static bool ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
 next_desc:
                 rx_desc->wb.upper.status_error = 0;
 
+                (*work_done)++;
+                if (*work_done >= work_to_do)
+                        break;
+
                 /* return some buffers to hardware, one at a time is too slow */
                 if (cleaned_count >= IXGBE_RX_BUFFER_WRITE) {
-                        ixgbe_alloc_rx_buffers(adapter, rx_ring, cleaned_count);
+                        ixgbe_alloc_rx_buffers(rx_ring, cleaned_count);
                         cleaned_count = 0;
                 }
 
                 /* use prefetched values */
                 rx_desc = next_rxd;
-                rx_buffer_info = &rx_ring->rx_buffer_info[i];
-
                 staterr = le32_to_cpu(rx_desc->wb.upper.status_error);
         }
 
@@ -1356,14 +1491,14 @@ next_desc:
         cleaned_count = IXGBE_DESC_UNUSED(rx_ring);
 
         if (cleaned_count)
-                ixgbe_alloc_rx_buffers(adapter, rx_ring, cleaned_count);
+                ixgbe_alloc_rx_buffers(rx_ring, cleaned_count);
 
 #ifdef IXGBE_FCOE
         /* include DDPed FCoE data */
         if (ddp_bytes > 0) {
                 unsigned int mss;
 
-                mss = adapter->netdev->mtu - sizeof(struct fcoe_hdr) -
+                mss = rx_ring->netdev->mtu - sizeof(struct fcoe_hdr) -
                         sizeof(struct fc_frame_header) -
                         sizeof(struct fcoe_crc_eof);
                 if (mss > 512)
@@ -1375,8 +1510,10 @@ next_desc:
 
         rx_ring->total_packets += total_rx_packets;
         rx_ring->total_bytes += total_rx_bytes;
-
-        return cleaned;
+        u64_stats_update_begin(&rx_ring->syncp);
+        rx_ring->stats.packets += total_rx_packets;
+        rx_ring->stats.bytes += total_rx_bytes;
+        u64_stats_update_end(&rx_ring->syncp);
 }
 
 static int ixgbe_clean_rxonly(struct napi_struct *, int);
@@ -1390,7 +1527,7 @@ static int ixgbe_clean_rxonly(struct napi_struct *, int);
 static void ixgbe_configure_msix(struct ixgbe_adapter *adapter)
 {
         struct ixgbe_q_vector *q_vector;
-        int i, j, q_vectors, v_idx, r_idx;
+        int i, q_vectors, v_idx, r_idx;
         u32 mask;
 
         q_vectors = adapter->num_msix_vectors - NON_Q_VECTORS;
@@ -1406,8 +1543,8 @@ static void ixgbe_configure_msix(struct ixgbe_adapter *adapter)
                                        adapter->num_rx_queues);
 
                 for (i = 0; i < q_vector->rxr_count; i++) {
-                        j = adapter->rx_ring[r_idx]->reg_idx;
-                        ixgbe_set_ivar(adapter, 0, j, v_idx);
+                        u8 reg_idx = adapter->rx_ring[r_idx]->reg_idx;
+                        ixgbe_set_ivar(adapter, 0, reg_idx, v_idx);
                         r_idx = find_next_bit(q_vector->rxr_idx,
                                               adapter->num_rx_queues,
                                               r_idx + 1);
@@ -1416,8 +1553,8 @@ static void ixgbe_configure_msix(struct ixgbe_adapter *adapter)
                                        adapter->num_tx_queues);
 
                 for (i = 0; i < q_vector->txr_count; i++) {
-                        j = adapter->tx_ring[r_idx]->reg_idx;
-                        ixgbe_set_ivar(adapter, 1, j, v_idx);
+                        u8 reg_idx = adapter->tx_ring[r_idx]->reg_idx;
+                        ixgbe_set_ivar(adapter, 1, reg_idx, v_idx);
                         r_idx = find_next_bit(q_vector->txr_idx,
                                               adapter->num_tx_queues,
                                               r_idx + 1);
@@ -1448,11 +1585,19 @@ static void ixgbe_configure_msix(struct ixgbe_adapter *adapter)
                 }
         }
 
-        if (adapter->hw.mac.type == ixgbe_mac_82598EB)
+        switch (adapter->hw.mac.type) {
+        case ixgbe_mac_82598EB:
                 ixgbe_set_ivar(adapter, -1, IXGBE_IVAR_OTHER_CAUSES_INDEX,
                                v_idx);
-        else if (adapter->hw.mac.type == ixgbe_mac_82599EB)
+                break;
+        case ixgbe_mac_82599EB:
+        case ixgbe_mac_X540:
                 ixgbe_set_ivar(adapter, -1, 1, v_idx);
+                break;
+
+        default:
+                break;
+        }
         IXGBE_WRITE_REG(&adapter->hw, IXGBE_EITR(v_idx), 1950);
 
         /* set up to autoclear timer, and the vectors */
@@ -1548,12 +1693,15 @@ void ixgbe_write_eitr(struct ixgbe_q_vector *q_vector)
         int v_idx = q_vector->v_idx;
         u32 itr_reg = EITR_INTS_PER_SEC_TO_REG(q_vector->eitr);
 
-        if (adapter->hw.mac.type == ixgbe_mac_82598EB) {
+        switch (adapter->hw.mac.type) {
+        case ixgbe_mac_82598EB:
                 /* must write high and low 16 bits to reset counter */
                 itr_reg |= (itr_reg << 16);
-        } else if (adapter->hw.mac.type == ixgbe_mac_82599EB) {
+                break;
+        case ixgbe_mac_82599EB:
+        case ixgbe_mac_X540:
                 /*
-                 * 82599 can support a value of zero, so allow it for
+                 * 82599 and X540 can support a value of zero, so allow it for
                  * max interrupt rate, but there is an errata where it can
                  * not be zero with RSC
                  */
@@ -1566,6 +1714,9 @@ void ixgbe_write_eitr(struct ixgbe_q_vector *q_vector)
                  * immediate assertion of the interrupt
                  */
                 itr_reg |= IXGBE_EITR_CNT_WDIS;
+                break;
+        default:
+                break;
         }
         IXGBE_WRITE_REG(hw, IXGBE_EITR(v_idx), itr_reg);
 }
@@ -1573,14 +1724,13 @@ void ixgbe_write_eitr(struct ixgbe_q_vector *q_vector)
 static void ixgbe_set_itr_msix(struct ixgbe_q_vector *q_vector)
 {
         struct ixgbe_adapter *adapter = q_vector->adapter;
+        int i, r_idx;
         u32 new_itr;
         u8 current_itr, ret_itr;
-        int i, r_idx;
-        struct ixgbe_ring *rx_ring, *tx_ring;
 
         r_idx = find_first_bit(q_vector->txr_idx, adapter->num_tx_queues);
         for (i = 0; i < q_vector->txr_count; i++) {
-                tx_ring = adapter->tx_ring[r_idx];
+                struct ixgbe_ring *tx_ring = adapter->tx_ring[r_idx];
                 ret_itr = ixgbe_update_itr(adapter, q_vector->eitr,
                                            q_vector->tx_itr,
                                            tx_ring->total_packets,
@@ -1595,7 +1745,7 @@ static void ixgbe_set_itr_msix(struct ixgbe_q_vector *q_vector)
 
         r_idx = find_first_bit(q_vector->rxr_idx, adapter->num_rx_queues);
         for (i = 0; i < q_vector->rxr_count; i++) {
-                rx_ring = adapter->rx_ring[r_idx];
+                struct ixgbe_ring *rx_ring = adapter->rx_ring[r_idx];
                 ret_itr = ixgbe_update_itr(adapter, q_vector->eitr,
                                            q_vector->rx_itr,
                                            rx_ring->total_packets,
@@ -1626,7 +1776,7 @@ static void ixgbe_set_itr_msix(struct ixgbe_q_vector *q_vector)
 
         if (new_itr != q_vector->eitr) {
                 /* do an exponential smoothing */
-                new_itr = ((q_vector->eitr * 90)/100) + ((new_itr * 10)/100);
+                new_itr = ((q_vector->eitr * 9) + new_itr)/10;
 
                 /* save the algorithm value here, not the smoothed one */
                 q_vector->eitr = new_itr;
@@ -1694,17 +1844,18 @@ static void ixgbe_check_sfp_event(struct ixgbe_adapter *adapter, u32 eicr)
 {
         struct ixgbe_hw *hw = &adapter->hw;
 
+        if (eicr & IXGBE_EICR_GPI_SDP2) {
+                /* Clear the interrupt */
+                IXGBE_WRITE_REG(hw, IXGBE_EICR, IXGBE_EICR_GPI_SDP2);
+                if (!test_bit(__IXGBE_DOWN, &adapter->state))
+                        schedule_work(&adapter->sfp_config_module_task);
+        }
+
         if (eicr & IXGBE_EICR_GPI_SDP1) {
                 /* Clear the interrupt */
                 IXGBE_WRITE_REG(hw, IXGBE_EICR, IXGBE_EICR_GPI_SDP1);
-                schedule_work(&adapter->multispeed_fiber_task);
-        } else if (eicr & IXGBE_EICR_GPI_SDP2) {
-                /* Clear the interrupt */
-                IXGBE_WRITE_REG(hw, IXGBE_EICR, IXGBE_EICR_GPI_SDP2);
-                schedule_work(&adapter->sfp_config_module_task);
-        } else {
-                /* Interrupt isn't for us... */
-                return;
+                if (!test_bit(__IXGBE_DOWN, &adapter->state))
+                        schedule_work(&adapter->multispeed_fiber_task);
         }
 }
 
@@ -1744,16 +1895,9 @@ static irqreturn_t ixgbe_msix_lsc(int irq, void *data)
         if (eicr & IXGBE_EICR_MAILBOX)
                 ixgbe_msg_task(adapter);
 
-        if (hw->mac.type == ixgbe_mac_82598EB)
-                ixgbe_check_fan_failure(adapter, eicr);
-
-        if (hw->mac.type == ixgbe_mac_82599EB) {
-                ixgbe_check_sfp_event(adapter, eicr);
-                adapter->interrupt_event = eicr;
-                if ((adapter->flags2 & IXGBE_FLAG2_TEMP_SENSOR_CAPABLE) &&
-                    ((eicr & IXGBE_EICR_GPI_SDP0) || (eicr & IXGBE_EICR_LSC)))
-                        schedule_work(&adapter->check_overtemp_task);
-
+        switch (hw->mac.type) {
+        case ixgbe_mac_82599EB:
+        case ixgbe_mac_X540:
                 /* Handle Flow Director Full threshold interrupt */
                 if (eicr & IXGBE_EICR_FLOW_DIR) {
                         int i;
@@ -1763,12 +1907,24 @@ static irqreturn_t ixgbe_msix_lsc(int irq, void *data)
                         for (i = 0; i < adapter->num_tx_queues; i++) {
                                 struct ixgbe_ring *tx_ring =
                                                             adapter->tx_ring[i];
-                                if (test_and_clear_bit(__IXGBE_FDIR_INIT_DONE,
-                                                       &tx_ring->reinit_state))
+                                if (test_and_clear_bit(__IXGBE_TX_FDIR_INIT_DONE,
+                                                       &tx_ring->state))
                                         schedule_work(&adapter->fdir_reinit_task);
                         }
                 }
+                ixgbe_check_sfp_event(adapter, eicr);
+                if ((adapter->flags2 & IXGBE_FLAG2_TEMP_SENSOR_CAPABLE) &&
+                    ((eicr & IXGBE_EICR_GPI_SDP0) || (eicr & IXGBE_EICR_LSC))) {
+                        adapter->interrupt_event = eicr;
+                        schedule_work(&adapter->check_overtemp_task);
+                }
+                break;
+        default:
+                break;
         }
+
+        ixgbe_check_fan_failure(adapter, eicr);
+
         if (!test_bit(__IXGBE_DOWN, &adapter->state))
                 IXGBE_WRITE_REG(hw, IXGBE_EIMS, IXGBE_EIMS_OTHER);
 
@@ -1779,15 +1935,24 @@ static inline void ixgbe_irq_enable_queues(struct ixgbe_adapter *adapter,
                                            u64 qmask)
 {
         u32 mask;
+        struct ixgbe_hw *hw = &adapter->hw;
 
-        if (adapter->hw.mac.type == ixgbe_mac_82598EB) {
+        switch (hw->mac.type) {
+        case ixgbe_mac_82598EB:
                 mask = (IXGBE_EIMS_RTX_QUEUE & qmask);
-                IXGBE_WRITE_REG(&adapter->hw, IXGBE_EIMS, mask);
-        } else {
+                IXGBE_WRITE_REG(hw, IXGBE_EIMS, mask);
+                break;
+        case ixgbe_mac_82599EB:
+        case ixgbe_mac_X540:
                 mask = (qmask & 0xFFFFFFFF);
-                IXGBE_WRITE_REG(&adapter->hw, IXGBE_EIMS_EX(0), mask);
+                if (mask)
+                        IXGBE_WRITE_REG(hw, IXGBE_EIMS_EX(0), mask);
                 mask = (qmask >> 32);
-                IXGBE_WRITE_REG(&adapter->hw, IXGBE_EIMS_EX(1), mask);
+                if (mask)
+                        IXGBE_WRITE_REG(hw, IXGBE_EIMS_EX(1), mask);
+                break;
+        default:
+                break;
         }
         /* skip the flush */
 }
@@ -1796,15 +1961,24 @@ static inline void ixgbe_irq_disable_queues(struct ixgbe_adapter *adapter,
                                             u64 qmask)
 {
         u32 mask;
+        struct ixgbe_hw *hw = &adapter->hw;
 
-        if (adapter->hw.mac.type == ixgbe_mac_82598EB) {
+        switch (hw->mac.type) {
+        case ixgbe_mac_82598EB:
                 mask = (IXGBE_EIMS_RTX_QUEUE & qmask);
-                IXGBE_WRITE_REG(&adapter->hw, IXGBE_EIMC, mask);
-        } else {
+                IXGBE_WRITE_REG(hw, IXGBE_EIMC, mask);
+                break;
+        case ixgbe_mac_82599EB:
+        case ixgbe_mac_X540:
                 mask = (qmask & 0xFFFFFFFF);
-                IXGBE_WRITE_REG(&adapter->hw, IXGBE_EIMC_EX(0), mask);
+                if (mask)
+                        IXGBE_WRITE_REG(hw, IXGBE_EIMC_EX(0), mask);
                 mask = (qmask >> 32);
-                IXGBE_WRITE_REG(&adapter->hw, IXGBE_EIMC_EX(1), mask);
+                if (mask)
+                        IXGBE_WRITE_REG(hw, IXGBE_EIMC_EX(1), mask);
+                break;
+        default:
+                break;
         }
         /* skip the flush */
 }
@@ -1847,8 +2021,13 @@ static irqreturn_t ixgbe_msix_clean_rx(int irq, void *data)
         int r_idx;
         int i;
 
+#ifdef CONFIG_IXGBE_DCA
+        if (adapter->flags & IXGBE_FLAG_DCA_ENABLED)
+                ixgbe_update_dca(q_vector);
+#endif
+
         r_idx = find_first_bit(q_vector->rxr_idx, adapter->num_rx_queues);
-        for (i = 0;  i < q_vector->rxr_count; i++) {
+        for (i = 0; i < q_vector->rxr_count; i++) {
                 rx_ring = adapter->rx_ring[r_idx];
                 rx_ring->total_bytes = 0;
                 rx_ring->total_packets = 0;
@@ -1859,7 +2038,6 @@ static irqreturn_t ixgbe_msix_clean_rx(int irq, void *data)
         if (!q_vector->rxr_count)
                 return IRQ_HANDLED;
 
-        /* disable interrupts on this vector only */
         /* EIAM disabled interrupts (on this vector) for us */
         napi_schedule(&q_vector->napi);
 
@@ -1918,13 +2096,14 @@ static int ixgbe_clean_rxonly(struct napi_struct *napi, int budget)
         int work_done = 0;
         long r_idx;
 
-        r_idx = find_first_bit(q_vector->rxr_idx, adapter->num_rx_queues);
-        rx_ring = adapter->rx_ring[r_idx];
 #ifdef CONFIG_IXGBE_DCA
         if (adapter->flags & IXGBE_FLAG_DCA_ENABLED)
-                ixgbe_update_rx_dca(adapter, rx_ring);
+                ixgbe_update_dca(q_vector);
 #endif
 
+        r_idx = find_first_bit(q_vector->rxr_idx, adapter->num_rx_queues);
+        rx_ring = adapter->rx_ring[r_idx];
+
         ixgbe_clean_rx_irq(q_vector, rx_ring, &work_done, budget);
 
         /* If all Rx work done, exit the polling mode */
@@ -1958,13 +2137,14 @@ static int ixgbe_clean_rxtx_many(struct napi_struct *napi, int budget)
         long r_idx;
         bool tx_clean_complete = true;
 
+#ifdef CONFIG_IXGBE_DCA
+        if (adapter->flags & IXGBE_FLAG_DCA_ENABLED)
+                ixgbe_update_dca(q_vector);
+#endif
+
         r_idx = find_first_bit(q_vector->txr_idx, adapter->num_tx_queues);
         for (i = 0; i < q_vector->txr_count; i++) {
                 ring = adapter->tx_ring[r_idx];
-#ifdef CONFIG_IXGBE_DCA
-                if (adapter->flags & IXGBE_FLAG_DCA_ENABLED)
-                        ixgbe_update_tx_dca(adapter, ring);
-#endif
                 tx_clean_complete &= ixgbe_clean_tx_irq(q_vector, ring);
                 r_idx = find_next_bit(q_vector->txr_idx, adapter->num_tx_queues,
                                       r_idx + 1);
@@ -1977,10 +2157,6 @@ static int ixgbe_clean_rxtx_many(struct napi_struct *napi, int budget)
         r_idx = find_first_bit(q_vector->rxr_idx, adapter->num_rx_queues);
         for (i = 0; i < q_vector->rxr_count; i++) {
                 ring = adapter->rx_ring[r_idx];
-#ifdef CONFIG_IXGBE_DCA
-                if (adapter->flags & IXGBE_FLAG_DCA_ENABLED)
-                        ixgbe_update_rx_dca(adapter, ring);
-#endif
                 ixgbe_clean_rx_irq(q_vector, ring, &work_done, budget);
                 r_idx = find_next_bit(q_vector->rxr_idx, adapter->num_rx_queues,
                                       r_idx + 1);
@@ -2019,13 +2195,14 @@ static int ixgbe_clean_txonly(struct napi_struct *napi, int budget)
         int work_done = 0;
         long r_idx;
 
-        r_idx = find_first_bit(q_vector->txr_idx, adapter->num_tx_queues);
-        tx_ring = adapter->tx_ring[r_idx];
 #ifdef CONFIG_IXGBE_DCA
         if (adapter->flags & IXGBE_FLAG_DCA_ENABLED)
-                ixgbe_update_tx_dca(adapter, tx_ring);
+                ixgbe_update_dca(q_vector);
 #endif
 
+        r_idx = find_first_bit(q_vector->txr_idx, adapter->num_tx_queues);
+        tx_ring = adapter->tx_ring[r_idx];
+
         if (!ixgbe_clean_tx_irq(q_vector, tx_ring))
                 work_done = budget;
 
@@ -2046,24 +2223,27 @@ static inline void map_vector_to_rxq(struct ixgbe_adapter *a, int v_idx,
                                      int r_idx)
 {
         struct ixgbe_q_vector *q_vector = a->q_vector[v_idx];
+        struct ixgbe_ring *rx_ring = a->rx_ring[r_idx];
 
         set_bit(r_idx, q_vector->rxr_idx);
         q_vector->rxr_count++;
+        rx_ring->q_vector = q_vector;
 }
 
 static inline void map_vector_to_txq(struct ixgbe_adapter *a, int v_idx,
                                      int t_idx)
 {
         struct ixgbe_q_vector *q_vector = a->q_vector[v_idx];
+        struct ixgbe_ring *tx_ring = a->tx_ring[t_idx];
 
         set_bit(t_idx, q_vector->txr_idx);
         q_vector->txr_count++;
+        tx_ring->q_vector = q_vector;
 }
 
 /**
  * ixgbe_map_rings_to_vectors - Maps descriptor rings to vectors
  * @adapter: board private structure to initialize
- * @vectors: allotted vector count for descriptor rings
  *
  * This function maps descriptor rings to the queue-specific vectors
  * we were allotted through the MSI-X enabling code.  Ideally, we'd have
@@ -2071,9 +2251,9 @@ static inline void map_vector_to_txq(struct ixgbe_adapter *a, int v_idx,
  * group the rings as "efficiently" as possible.  You would add new
  * mapping configurations in here.
  **/
-static int ixgbe_map_rings_to_vectors(struct ixgbe_adapter *adapter,
-                                      int vectors)
+static int ixgbe_map_rings_to_vectors(struct ixgbe_adapter *adapter)
 {
+        int q_vectors;
         int v_start = 0;
         int rxr_idx = 0, txr_idx = 0;
         int rxr_remaining = adapter->num_rx_queues;
@@ -2086,11 +2266,13 @@ static int ixgbe_map_rings_to_vectors(struct ixgbe_adapter *adapter,
         if (!(adapter->flags & IXGBE_FLAG_MSIX_ENABLED))
                 goto out;
 
+        q_vectors = adapter->num_msix_vectors - NON_Q_VECTORS;
+
         /*
          * The ideal configuration...
          * We have enough vectors to map one per queue.
          */
-        if (vectors == adapter->num_rx_queues + adapter->num_tx_queues) {
+        if (q_vectors == adapter->num_rx_queues + adapter->num_tx_queues) {
                 for (; rxr_idx < rxr_remaining; v_start++, rxr_idx++)
                         map_vector_to_rxq(adapter, v_start, rxr_idx);
 
@@ -2106,23 +2288,20 @@ static int ixgbe_map_rings_to_vectors(struct ixgbe_adapter *adapter,
          * multiple queues per vector.
          */
         /* Re-adjusting *qpv takes care of the remainder. */
-        for (i = v_start; i < vectors; i++) {
-                rqpv = DIV_ROUND_UP(rxr_remaining, vectors - i);
+        for (i = v_start; i < q_vectors; i++) {
+                rqpv = DIV_ROUND_UP(rxr_remaining, q_vectors - i);
                 for (j = 0; j < rqpv; j++) {
                         map_vector_to_rxq(adapter, i, rxr_idx);
                         rxr_idx++;
                         rxr_remaining--;
                 }
-        }
-        for (i = v_start; i < vectors; i++) {
-                tqpv = DIV_ROUND_UP(txr_remaining, vectors - i);
+                tqpv = DIV_ROUND_UP(txr_remaining, q_vectors - i);
                 for (j = 0; j < tqpv; j++) {
                         map_vector_to_txq(adapter, i, txr_idx);
                         txr_idx++;
                         txr_remaining--;
                 }
         }
-
 out:
         return err;
 }
@@ -2144,30 +2323,36 @@ static int ixgbe_request_msix_irqs(struct ixgbe_adapter *adapter)
         /* Decrement for Other and TCP Timer vectors */
         q_vectors = adapter->num_msix_vectors - NON_Q_VECTORS;
 
-        /* Map the Tx/Rx rings to the vectors we were allotted. */
-        err = ixgbe_map_rings_to_vectors(adapter, q_vectors);
+        err = ixgbe_map_rings_to_vectors(adapter);
         if (err)
-                goto out;
+                return err;
 
-#define SET_HANDLER(_v) ((!(_v)->rxr_count) ? &ixgbe_msix_clean_tx : \
-                         (!(_v)->txr_count) ? &ixgbe_msix_clean_rx : \
-                         &ixgbe_msix_clean_many)
+#define SET_HANDLER(_v) (((_v)->rxr_count && (_v)->txr_count)        \
+                                          ? &ixgbe_msix_clean_many : \
+                          (_v)->rxr_count ? &ixgbe_msix_clean_rx   : \
+                          (_v)->txr_count ? &ixgbe_msix_clean_tx   : \
+                          NULL)
         for (vector = 0; vector < q_vectors; vector++) {
-                handler = SET_HANDLER(adapter->q_vector[vector]);
+                struct ixgbe_q_vector *q_vector = adapter->q_vector[vector];
+                handler = SET_HANDLER(q_vector);
 
                 if (handler == &ixgbe_msix_clean_rx) {
-                        sprintf(adapter->name[vector], "%s-%s-%d",
+                        sprintf(q_vector->name, "%s-%s-%d",
                                 netdev->name, "rx", ri++);
                 } else if (handler == &ixgbe_msix_clean_tx) {
-                        sprintf(adapter->name[vector], "%s-%s-%d",
+                        sprintf(q_vector->name, "%s-%s-%d",
                                 netdev->name, "tx", ti++);
-                } else
-                        sprintf(adapter->name[vector], "%s-%s-%d",
-                                netdev->name, "TxRx", vector);
-
+                } else if (handler == &ixgbe_msix_clean_many) {
+                        sprintf(q_vector->name, "%s-%s-%d",
+                                netdev->name, "TxRx", ri++);
+                        ti++;
+                } else {
+                        /* skip this unused q_vector */
+                        continue;
+                }
                 err = request_irq(adapter->msix_entries[vector].vector,
-                                  handler, 0, adapter->name[vector],
-                                  adapter->q_vector[vector]);
+                                  handler, 0, q_vector->name,
+                                  q_vector);
                 if (err) {
                         e_err(probe, "request_irq failed for MSIX interrupt "
                               "Error: %d\n", err);
@@ -2175,9 +2360,9 @@ static int ixgbe_request_msix_irqs(struct ixgbe_adapter *adapter)
                 }
         }
 
-        sprintf(adapter->name[vector], "%s:lsc", netdev->name);
+        sprintf(adapter->lsc_int_name, "%s:lsc", netdev->name);
         err = request_irq(adapter->msix_entries[vector].vector,
-                          ixgbe_msix_lsc, 0, adapter->name[vector], netdev);
+                          ixgbe_msix_lsc, 0, adapter->lsc_int_name, netdev);
         if (err) {
                 e_err(probe, "request_irq for msix_lsc failed: %d\n", err);
                 goto free_queue_irqs;
@@ -2193,17 +2378,16 @@ free_queue_irqs:
         pci_disable_msix(adapter->pdev);
         kfree(adapter->msix_entries);
         adapter->msix_entries = NULL;
-out:
         return err;
 }
 
 static void ixgbe_set_itr(struct ixgbe_adapter *adapter)
 {
         struct ixgbe_q_vector *q_vector = adapter->q_vector[0];
-        u8 current_itr;
-        u32 new_itr = q_vector->eitr;
         struct ixgbe_ring *rx_ring = adapter->rx_ring[0];
         struct ixgbe_ring *tx_ring = adapter->tx_ring[0];
+        u32 new_itr = q_vector->eitr;
+        u8 current_itr;
 
         q_vector->tx_itr = ixgbe_update_itr(adapter, new_itr,
                                             q_vector->tx_itr,
@@ -2233,9 +2417,9 @@ static void ixgbe_set_itr(struct ixgbe_adapter *adapter)
 
         if (new_itr != q_vector->eitr) {
                 /* do an exponential smoothing */
-                new_itr = ((q_vector->eitr * 90)/100) + ((new_itr * 10)/100);
+                new_itr = ((q_vector->eitr * 9) + new_itr)/10;
 
-                /* save the algorithm value here, not the smoothed one */
+                /* save the algorithm value here */
                 q_vector->eitr = new_itr;
 
                 ixgbe_write_eitr(q_vector);
@@ -2256,12 +2440,17 @@ static inline void ixgbe_irq_enable(struct ixgbe_adapter *adapter, bool queues,
                 mask |= IXGBE_EIMS_GPI_SDP0;
         if (adapter->flags & IXGBE_FLAG_FAN_FAIL_CAPABLE)
                 mask |= IXGBE_EIMS_GPI_SDP1;
-        if (adapter->hw.mac.type == ixgbe_mac_82599EB) {
+        switch (adapter->hw.mac.type) {
+        case ixgbe_mac_82599EB:
+        case ixgbe_mac_X540:
                 mask |= IXGBE_EIMS_ECC;
                 mask |= IXGBE_EIMS_GPI_SDP1;
                 mask |= IXGBE_EIMS_GPI_SDP2;
                 if (adapter->num_vfs)
                         mask |= IXGBE_EIMS_MAILBOX;
+                break;
+        default:
+                break;
         }
         if (adapter->flags & IXGBE_FLAG_FDIR_HASH_CAPABLE ||
             adapter->flags & IXGBE_FLAG_FDIR_PERFECT_CAPABLE)
@@ -2317,13 +2506,21 @@ static irqreturn_t ixgbe_intr(int irq, void *data)
         if (eicr & IXGBE_EICR_LSC)
                 ixgbe_check_lsc(adapter);
 
-        if (hw->mac.type == ixgbe_mac_82599EB)
+        switch (hw->mac.type) {
+        case ixgbe_mac_82599EB:
+        case ixgbe_mac_X540:
                 ixgbe_check_sfp_event(adapter, eicr);
+                if ((adapter->flags2 & IXGBE_FLAG2_TEMP_SENSOR_CAPABLE) &&
+                    ((eicr & IXGBE_EICR_GPI_SDP0) || (eicr & IXGBE_EICR_LSC))) {
+                        adapter->interrupt_event = eicr;
+                        schedule_work(&adapter->check_overtemp_task);
+                }
+                break;
+        default:
+                break;
+        }
 
         ixgbe_check_fan_failure(adapter, eicr);
-        if ((adapter->flags2 & IXGBE_FLAG2_TEMP_SENSOR_CAPABLE) &&
-            ((eicr & IXGBE_EICR_GPI_SDP0) || (eicr & IXGBE_EICR_LSC)))
-                schedule_work(&adapter->check_overtemp_task);
 
         if (napi_schedule_prep(&(q_vector->napi))) {
                 adapter->tx_ring[0]->total_packets = 0;
@@ -2416,14 +2613,20 @@ static void ixgbe_free_irq(struct ixgbe_adapter *adapter)
  **/
 static inline void ixgbe_irq_disable(struct ixgbe_adapter *adapter)
 {
-        if (adapter->hw.mac.type == ixgbe_mac_82598EB) {
+        switch (adapter->hw.mac.type) {
+        case ixgbe_mac_82598EB:
                 IXGBE_WRITE_REG(&adapter->hw, IXGBE_EIMC, ~0);
-        } else {
+                break;
+        case ixgbe_mac_82599EB:
+        case ixgbe_mac_X540:
                 IXGBE_WRITE_REG(&adapter->hw, IXGBE_EIMC, 0xFFFF0000);
                 IXGBE_WRITE_REG(&adapter->hw, IXGBE_EIMC_EX(0), ~0);
                 IXGBE_WRITE_REG(&adapter->hw, IXGBE_EIMC_EX(1), ~0);
                 if (adapter->num_vfs > 32)
                         IXGBE_WRITE_REG(&adapter->hw, IXGBE_EITRSEL, 0);
+                break;
+        default:
+                break;
         }
         IXGBE_WRITE_FLUSH(&adapter->hw);
         if (adapter->flags & IXGBE_FLAG_MSIX_ENABLED) {
@@ -2469,7 +2672,7 @@ void ixgbe_configure_tx_ring(struct ixgbe_adapter *adapter,
         u64 tdba = ring->dma;
         int wait_loop = 10;
         u32 txdctl;
-        u16 reg_idx = ring->reg_idx;
+        u8 reg_idx = ring->reg_idx;
 
         /* disable queue to avoid issues while updating state */
         txdctl = IXGBE_READ_REG(hw, IXGBE_TXDCTL(reg_idx));
@@ -2484,8 +2687,7 @@ void ixgbe_configure_tx_ring(struct ixgbe_adapter *adapter,
                         ring->count * sizeof(union ixgbe_adv_tx_desc));
         IXGBE_WRITE_REG(hw, IXGBE_TDH(reg_idx), 0);
         IXGBE_WRITE_REG(hw, IXGBE_TDT(reg_idx), 0);
-        ring->head = IXGBE_TDH(reg_idx);
-        ring->tail = IXGBE_TDT(reg_idx);
+        ring->tail = hw->hw_addr + IXGBE_TDT(reg_idx);
 
         /* configure fetching thresholds */
         if (adapter->rx_itr_setting == 0) {
@@ -2501,7 +2703,16 @@ void ixgbe_configure_tx_ring(struct ixgbe_adapter *adapter,
         }
 
         /* reinitialize flowdirector state */
-        set_bit(__IXGBE_FDIR_INIT_DONE, &ring->reinit_state);
+        if ((adapter->flags & IXGBE_FLAG_FDIR_HASH_CAPABLE) &&
+            adapter->atr_sample_rate) {
+                ring->atr_sample_rate = adapter->atr_sample_rate;
+                ring->atr_count = 0;
+                set_bit(__IXGBE_TX_FDIR_INIT_DONE, &ring->state);
+        } else {
+                ring->atr_sample_rate = 0;
+        }
+
+        clear_bit(__IXGBE_HANG_CHECK_ARMED, &ring->state);
 
         /* enable queue */
         txdctl |= IXGBE_TXDCTL_ENABLE;
@@ -2592,16 +2803,22 @@ static void ixgbe_configure_srrctl(struct ixgbe_adapter *adapter,
                                    struct ixgbe_ring *rx_ring)
 {
         u32 srrctl;
-        int index;
-        struct ixgbe_ring_feature *feature = adapter->ring_feature;
+        u8 reg_idx = rx_ring->reg_idx;
 
-        index = rx_ring->reg_idx;
-        if (adapter->hw.mac.type == ixgbe_mac_82598EB) {
-                unsigned long mask;
-                mask = (unsigned long) feature[RING_F_RSS].mask;
-                index = index & mask;
+        switch (adapter->hw.mac.type) {
+        case ixgbe_mac_82598EB: {
+                struct ixgbe_ring_feature *feature = adapter->ring_feature;
+                const int mask = feature[RING_F_RSS].mask;
+                reg_idx = reg_idx & mask;
         }
-        srrctl = IXGBE_READ_REG(&adapter->hw, IXGBE_SRRCTL(index));
+                break;
+        case ixgbe_mac_82599EB:
+        case ixgbe_mac_X540:
+        default:
+                break;
+        }
+
+        srrctl = IXGBE_READ_REG(&adapter->hw, IXGBE_SRRCTL(reg_idx));
 
         srrctl &= ~IXGBE_SRRCTL_BSIZEHDR_MASK;
         srrctl &= ~IXGBE_SRRCTL_BSIZEPKT_MASK;
@@ -2611,7 +2828,7 @@ static void ixgbe_configure_srrctl(struct ixgbe_adapter *adapter,
         srrctl |= (IXGBE_RX_HDR_SIZE << IXGBE_SRRCTL_BSIZEHDRSIZE_SHIFT) &
                   IXGBE_SRRCTL_BSIZEHDR_MASK;
 
-        if (rx_ring->flags & IXGBE_RING_RX_PS_ENABLED) {
+        if (ring_is_ps_enabled(rx_ring)) {
 #if (PAGE_SIZE / 2) > IXGBE_MAX_RXBUFFER
                 srrctl |= IXGBE_MAX_RXBUFFER >> IXGBE_SRRCTL_BSIZEPKT_SHIFT;
 #else
@@ -2624,7 +2841,7 @@ static void ixgbe_configure_srrctl(struct ixgbe_adapter *adapter,
                 srrctl |= IXGBE_SRRCTL_DESCTYPE_ADV_ONEBUF;
         }
 
-        IXGBE_WRITE_REG(&adapter->hw, IXGBE_SRRCTL(index), srrctl);
+        IXGBE_WRITE_REG(&adapter->hw, IXGBE_SRRCTL(reg_idx), srrctl);
 }
 
 static void ixgbe_setup_mrqc(struct ixgbe_adapter *adapter)
@@ -2694,19 +2911,36 @@ static void ixgbe_setup_mrqc(struct ixgbe_adapter *adapter)
 }
 
 /**
+ * ixgbe_clear_rscctl - disable RSC for the indicated ring
+ * @adapter: address of board private structure
+ * @ring: structure containing ring specific data
+ **/
+void ixgbe_clear_rscctl(struct ixgbe_adapter *adapter,
+                        struct ixgbe_ring *ring)
+{
+        struct ixgbe_hw *hw = &adapter->hw;
+        u32 rscctrl;
+        u8 reg_idx = ring->reg_idx;
+
+        rscctrl = IXGBE_READ_REG(hw, IXGBE_RSCCTL(reg_idx));
+        rscctrl &= ~IXGBE_RSCCTL_RSCEN;
+        IXGBE_WRITE_REG(hw, IXGBE_RSCCTL(reg_idx), rscctrl);
+}
+
+/**
  * ixgbe_configure_rscctl - enable RSC for the indicated ring
  * @adapter:    address of board private structure
  * @index:      index of ring to set
  **/
-static void ixgbe_configure_rscctl(struct ixgbe_adapter *adapter,
+void ixgbe_configure_rscctl(struct ixgbe_adapter *adapter,
                                    struct ixgbe_ring *ring)
 {
         struct ixgbe_hw *hw = &adapter->hw;
         u32 rscctrl;
         int rx_buf_len;
-        u16 reg_idx = ring->reg_idx;
+        u8 reg_idx = ring->reg_idx;
 
-        if (!(adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED))
+        if (!ring_is_rsc_enabled(ring))
                 return;
 
         rx_buf_len = ring->rx_buf_len;
@@ -2717,7 +2951,7 @@ static void ixgbe_configure_rscctl(struct ixgbe_adapter *adapter,
          * total size of max desc * buf_len is not greater
          * than 65535
          */
-        if (ring->flags & IXGBE_RING_RX_PS_ENABLED) {
+        if (ring_is_ps_enabled(ring)) {
 #if (MAX_SKB_FRAGS > 16)
                 rscctrl |= IXGBE_RSCCTL_MAXDESC_16;
 #elif (MAX_SKB_FRAGS > 8)
@@ -2770,9 +3004,9 @@ static void ixgbe_rx_desc_queue_enable(struct ixgbe_adapter *adapter,
                                        struct ixgbe_ring *ring)
 {
         struct ixgbe_hw *hw = &adapter->hw;
-        int reg_idx = ring->reg_idx;
         int wait_loop = IXGBE_MAX_RX_DESC_POLL;
         u32 rxdctl;
+        u8 reg_idx = ring->reg_idx;
 
         /* RXDCTL.EN will return 0 on 82598 if link is down, so skip it */
         if (hw->mac.type == ixgbe_mac_82598EB &&
@@ -2796,7 +3030,7 @@ void ixgbe_configure_rx_ring(struct ixgbe_adapter *adapter,
         struct ixgbe_hw *hw = &adapter->hw;
         u64 rdba = ring->dma;
         u32 rxdctl;
-        u16 reg_idx = ring->reg_idx;
+        u8 reg_idx = ring->reg_idx;
 
         /* disable queue to avoid issues while updating state */
         rxdctl = IXGBE_READ_REG(hw, IXGBE_RXDCTL(reg_idx));
@@ -2810,8 +3044,7 @@ void ixgbe_configure_rx_ring(struct ixgbe_adapter *adapter,
                         ring->count * sizeof(union ixgbe_adv_rx_desc));
         IXGBE_WRITE_REG(hw, IXGBE_RDH(reg_idx), 0);
         IXGBE_WRITE_REG(hw, IXGBE_RDT(reg_idx), 0);
-        ring->head = IXGBE_RDH(reg_idx);
-        ring->tail = IXGBE_RDT(reg_idx);
+        ring->tail = hw->hw_addr + IXGBE_RDT(reg_idx);
 
         ixgbe_configure_srrctl(adapter, ring);
         ixgbe_configure_rscctl(adapter, ring);
@@ -2833,7 +3066,7 @@ void ixgbe_configure_rx_ring(struct ixgbe_adapter *adapter,
         IXGBE_WRITE_REG(hw, IXGBE_RXDCTL(reg_idx), rxdctl);
 
         ixgbe_rx_desc_queue_enable(adapter, ring);
-        ixgbe_alloc_rx_buffers(adapter, ring, IXGBE_DESC_UNUSED(ring));
+        ixgbe_alloc_rx_buffers(ring, IXGBE_DESC_UNUSED(ring));
 }
 
 static void ixgbe_setup_psrtype(struct ixgbe_adapter *adapter)
@@ -2956,24 +3189,32 @@ static void ixgbe_set_rx_buffer_len(struct ixgbe_adapter *adapter)
                 rx_ring->rx_buf_len = rx_buf_len;
 
                 if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED)
-                        rx_ring->flags |= IXGBE_RING_RX_PS_ENABLED;
+                        set_ring_ps_enabled(rx_ring);
+                else
+                        clear_ring_ps_enabled(rx_ring);
+
+                if (adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED)
+                        set_ring_rsc_enabled(rx_ring);
                 else
-                        rx_ring->flags &= ~IXGBE_RING_RX_PS_ENABLED;
+                        clear_ring_rsc_enabled(rx_ring);
 
 #ifdef IXGBE_FCOE
                 if (netdev->features & NETIF_F_FCOE_MTU) {
                         struct ixgbe_ring_feature *f;
                         f = &adapter->ring_feature[RING_F_FCOE];
                         if ((i >= f->mask) && (i < f->mask + f->indices)) {
-                                rx_ring->flags &= ~IXGBE_RING_RX_PS_ENABLED;
+                                clear_ring_ps_enabled(rx_ring);
                                 if (rx_buf_len < IXGBE_FCOE_JUMBO_FRAME_SIZE)
                                         rx_ring->rx_buf_len =
                                                 IXGBE_FCOE_JUMBO_FRAME_SIZE;
+                        } else if (!ring_is_rsc_enabled(rx_ring) &&
+                                   !ring_is_ps_enabled(rx_ring)) {
+                                rx_ring->rx_buf_len =
+                                                IXGBE_FCOE_JUMBO_FRAME_SIZE;
                         }
                 }
 #endif /* IXGBE_FCOE */
         }
-
 }
 
 static void ixgbe_setup_rdrxctl(struct ixgbe_adapter *adapter)
@@ -2996,6 +3237,7 @@ static void ixgbe_setup_rdrxctl(struct ixgbe_adapter *adapter)
                 rdrxctl |= IXGBE_RDRXCTL_MVMEN;
                 break;
         case ixgbe_mac_82599EB:
+        case ixgbe_mac_X540:
                 /* Disable RSC for ACK packets */
                 IXGBE_WRITE_REG(hw, IXGBE_RSCDBU,
                    (IXGBE_RSCDBU_RSCACKDIS | IXGBE_READ_REG(hw, IXGBE_RSCDBU)));
@@ -3123,6 +3365,7 @@ static void ixgbe_vlan_strip_disable(struct ixgbe_adapter *adapter)
                 IXGBE_WRITE_REG(hw, IXGBE_VLNCTRL, vlnctrl);
                 break;
         case ixgbe_mac_82599EB:
+        case ixgbe_mac_X540:
                 for (i = 0; i < adapter->num_rx_queues; i++) {
                         j = adapter->rx_ring[i]->reg_idx;
                         vlnctrl = IXGBE_READ_REG(hw, IXGBE_RXDCTL(j));
@@ -3152,6 +3395,7 @@ static void ixgbe_vlan_strip_enable(struct ixgbe_adapter *adapter)
                 IXGBE_WRITE_REG(hw, IXGBE_VLNCTRL, vlnctrl);
                 break;
         case ixgbe_mac_82599EB:
+        case ixgbe_mac_X540:
                 for (i = 0; i < adapter->num_rx_queues; i++) {
                         j = adapter->rx_ring[i]->reg_idx;
                         vlnctrl = IXGBE_READ_REG(hw, IXGBE_RXDCTL(j));
@@ -3349,8 +3593,6 @@ static void ixgbe_configure_dcb(struct ixgbe_adapter *adapter)
 {
         struct ixgbe_hw *hw = &adapter->hw;
         int max_frame = adapter->netdev->mtu + ETH_HLEN + ETH_FCS_LEN;
-        u32 txdctl;
-        int i, j;
 
         if (!(adapter->flags & IXGBE_FLAG_DCB_ENABLED)) {
                 if (hw->mac.type == ixgbe_mac_82598EB)
@@ -3366,25 +3608,18 @@ static void ixgbe_configure_dcb(struct ixgbe_adapter *adapter)
                 max_frame = max(max_frame, IXGBE_FCOE_JUMBO_FRAME_SIZE);
 #endif
 
-        ixgbe_dcb_calculate_tc_credits(&adapter->dcb_cfg, max_frame,
+        ixgbe_dcb_calculate_tc_credits(hw, &adapter->dcb_cfg, max_frame,
                                         DCB_TX_CONFIG);
-        ixgbe_dcb_calculate_tc_credits(&adapter->dcb_cfg, max_frame,
+        ixgbe_dcb_calculate_tc_credits(hw, &adapter->dcb_cfg, max_frame,
                                         DCB_RX_CONFIG);
 
-        /* reconfigure the hardware */
-        ixgbe_dcb_hw_config(&adapter->hw, &adapter->dcb_cfg);
-
-        for (i = 0; i < adapter->num_tx_queues; i++) {
-                j = adapter->tx_ring[i]->reg_idx;
-                txdctl = IXGBE_READ_REG(hw, IXGBE_TXDCTL(j));
-                /* PThresh workaround for Tx hang with DFP enabled. */
-                txdctl |= 32;
-                IXGBE_WRITE_REG(hw, IXGBE_TXDCTL(j), txdctl);
-        }
         /* Enable VLAN tag insert/strip */
         adapter->netdev->features |= NETIF_F_HW_VLAN_RX;
 
         hw->mac.ops.set_vfta(&adapter->hw, 0, 0, true);
+
+        /* reconfigure the hardware */
+        ixgbe_dcb_hw_config(hw, &adapter->dcb_cfg);
 }
 
 #endif
@@ -3516,8 +3751,9 @@ static void ixgbe_setup_gpie(struct ixgbe_adapter *adapter)
                 case ixgbe_mac_82598EB:
                         IXGBE_WRITE_REG(hw, IXGBE_EIAM, IXGBE_EICS_RTX_QUEUE);
                         break;
-                default:
                 case ixgbe_mac_82599EB:
+                case ixgbe_mac_X540:
+                default:
                         IXGBE_WRITE_REG(hw, IXGBE_EIAM_EX(0), 0xFFFFFFFF);
                         IXGBE_WRITE_REG(hw, IXGBE_EIAM_EX(1), 0xFFFFFFFF);
                         break;
@@ -3561,13 +3797,24 @@ static int ixgbe_up_complete(struct ixgbe_adapter *adapter)
         else
                 ixgbe_configure_msi_and_legacy(adapter);
 
-        /* enable the optics */
-        if (hw->phy.multispeed_fiber)
+        /* enable the optics for both mult-speed fiber and 82599 SFP+ fiber */
+        if (hw->mac.ops.enable_tx_laser &&
+            ((hw->phy.multispeed_fiber) ||
+             ((hw->mac.ops.get_media_type(hw) == ixgbe_media_type_fiber) &&
+              (hw->mac.type == ixgbe_mac_82599EB))))
                 hw->mac.ops.enable_tx_laser(hw);
 
         clear_bit(__IXGBE_DOWN, &adapter->state);
         ixgbe_napi_enable_all(adapter);
 
+        if (ixgbe_is_sfp(hw)) {
+                ixgbe_sfp_link_config(adapter);
+        } else {
+                err = ixgbe_non_sfp_link_config(hw);
+                if (err)
+                        e_err(probe, "link_config FAILED %d\n", err);
+        }
+
         /* clear any pending interrupts, may auto mask */
         IXGBE_READ_REG(hw, IXGBE_EICR);
         ixgbe_irq_enable(adapter, true, true);
@@ -3590,26 +3837,8 @@ static int ixgbe_up_complete(struct ixgbe_adapter *adapter)
          * If we're not hot-pluggable SFP+, we just need to configure link
          * and bring it up.
          */
-        if (hw->phy.type == ixgbe_phy_unknown) {
-                err = hw->phy.ops.identify(hw);
-                if (err == IXGBE_ERR_SFP_NOT_SUPPORTED) {
-                        /*
-                         * Take the device down and schedule the sfp tasklet
-                         * which will unregister_netdev and log it.
-                         */
-                        ixgbe_down(adapter);
-                        schedule_work(&adapter->sfp_config_module_task);
-                        return err;
-                }
-        }
-
-        if (ixgbe_is_sfp(hw)) {
-                ixgbe_sfp_link_config(adapter);
-        } else {
-                err = ixgbe_non_sfp_link_config(hw);
-                if (err)
-                        e_err(probe, "link_config FAILED %d\n", err);
-        }
+        if (hw->phy.type == ixgbe_phy_unknown)
+                schedule_work(&adapter->sfp_config_module_task);
 
         /* enable transmits */
         netif_tx_start_all_queues(adapter->netdev);
@@ -3687,15 +3916,13 @@ void ixgbe_reset(struct ixgbe_adapter *adapter)
 
 /**
  * ixgbe_clean_rx_ring - Free Rx Buffers per Queue
- * @adapter: board private structure
  * @rx_ring: ring to free buffers from
  **/
-static void ixgbe_clean_rx_ring(struct ixgbe_adapter *adapter,
-                                struct ixgbe_ring *rx_ring)
+static void ixgbe_clean_rx_ring(struct ixgbe_ring *rx_ring)
 {
-        struct pci_dev *pdev = adapter->pdev;
+        struct device *dev = rx_ring->dev;
         unsigned long size;
-        unsigned int i;
+        u16 i;
 
         /* ring already cleared, nothing to do */
         if (!rx_ring->rx_buffer_info)
@@ -3707,7 +3934,7 @@ static void ixgbe_clean_rx_ring(struct ixgbe_adapter *adapter,
 
                 rx_buffer_info = &rx_ring->rx_buffer_info[i];
                 if (rx_buffer_info->dma) {
-                        dma_unmap_single(&pdev->dev, rx_buffer_info->dma,
+                        dma_unmap_single(rx_ring->dev, rx_buffer_info->dma,
                                          rx_ring->rx_buf_len,
                                          DMA_FROM_DEVICE);
                         rx_buffer_info->dma = 0;
@@ -3718,7 +3945,7 @@ static void ixgbe_clean_rx_ring(struct ixgbe_adapter *adapter,
                         do {
                                 struct sk_buff *this = skb;
                                 if (IXGBE_RSC_CB(this)->delay_unmap) {
-                                        dma_unmap_single(&pdev->dev,
+                                        dma_unmap_single(dev,
                                                          IXGBE_RSC_CB(this)->dma,
                                                          rx_ring->rx_buf_len,
                                                          DMA_FROM_DEVICE);
@@ -3732,7 +3959,7 @@ static void ixgbe_clean_rx_ring(struct ixgbe_adapter *adapter,
                 if (!rx_buffer_info->page)
                         continue;
                 if (rx_buffer_info->page_dma) {
-                        dma_unmap_page(&pdev->dev, rx_buffer_info->page_dma,
+                        dma_unmap_page(dev, rx_buffer_info->page_dma,
                                        PAGE_SIZE / 2, DMA_FROM_DEVICE);
                         rx_buffer_info->page_dma = 0;
                 }
@@ -3749,24 +3976,17 @@ static void ixgbe_clean_rx_ring(struct ixgbe_adapter *adapter,
 
         rx_ring->next_to_clean = 0;
         rx_ring->next_to_use = 0;
-
-        if (rx_ring->head)
-                writel(0, adapter->hw.hw_addr + rx_ring->head);
-        if (rx_ring->tail)
-                writel(0, adapter->hw.hw_addr + rx_ring->tail);
 }
 
 /**
  * ixgbe_clean_tx_ring - Free Tx Buffers
- * @adapter: board private structure
  * @tx_ring: ring to be cleaned
  **/
-static void ixgbe_clean_tx_ring(struct ixgbe_adapter *adapter,
-                                struct ixgbe_ring *tx_ring)
+static void ixgbe_clean_tx_ring(struct ixgbe_ring *tx_ring)
 {
         struct ixgbe_tx_buffer *tx_buffer_info;
         unsigned long size;
-        unsigned int i;
+        u16 i;
 
         /* ring already cleared, nothing to do */
         if (!tx_ring->tx_buffer_info)
@@ -3775,7 +3995,7 @@ static void ixgbe_clean_tx_ring(struct ixgbe_adapter *adapter,
         /* Free all the Tx ring sk_buffs */
         for (i = 0; i < tx_ring->count; i++) {
                 tx_buffer_info = &tx_ring->tx_buffer_info[i];
-                ixgbe_unmap_and_free_tx_resource(adapter, tx_buffer_info);
+                ixgbe_unmap_and_free_tx_resource(tx_ring, tx_buffer_info);
         }
 
         size = sizeof(struct ixgbe_tx_buffer) * tx_ring->count;
@@ -3786,11 +4006,6 @@ static void ixgbe_clean_tx_ring(struct ixgbe_adapter *adapter,
 
         tx_ring->next_to_use = 0;
         tx_ring->next_to_clean = 0;
-
-        if (tx_ring->head)
-                writel(0, adapter->hw.hw_addr + tx_ring->head);
-        if (tx_ring->tail)
-                writel(0, adapter->hw.hw_addr + tx_ring->tail);
 }
 
 /**
@@ -3802,7 +4017,7 @@ static void ixgbe_clean_all_rx_rings(struct ixgbe_adapter *adapter)
         int i;
 
         for (i = 0; i < adapter->num_rx_queues; i++)
-                ixgbe_clean_rx_ring(adapter, adapter->rx_ring[i]);
+                ixgbe_clean_rx_ring(adapter->rx_ring[i]);
 }
 
 /**
@@ -3814,7 +4029,7 @@ static void ixgbe_clean_all_tx_rings(struct ixgbe_adapter *adapter)
         int i;
 
         for (i = 0; i < adapter->num_tx_queues; i++)
-                ixgbe_clean_tx_ring(adapter, adapter->tx_ring[i]);
+                ixgbe_clean_tx_ring(adapter->tx_ring[i]);
 }
 
 void ixgbe_down(struct ixgbe_adapter *adapter)
@@ -3823,7 +4038,7 @@ void ixgbe_down(struct ixgbe_adapter *adapter)
         struct ixgbe_hw *hw = &adapter->hw;
         u32 rxctrl;
         u32 txdctl;
-        int i, j;
+        int i;
         int num_q_vectors = adapter->num_msix_vectors - NON_Q_VECTORS;
 
         /* signal that we are down to the interrupt handler */
@@ -3881,26 +4096,36 @@ void ixgbe_down(struct ixgbe_adapter *adapter)
 
         /* disable transmits in the hardware now that interrupts are off */
         for (i = 0; i < adapter->num_tx_queues; i++) {
-                j = adapter->tx_ring[i]->reg_idx;
-                txdctl = IXGBE_READ_REG(hw, IXGBE_TXDCTL(j));
-                IXGBE_WRITE_REG(hw, IXGBE_TXDCTL(j),
+                u8 reg_idx = adapter->tx_ring[i]->reg_idx;
+                txdctl = IXGBE_READ_REG(hw, IXGBE_TXDCTL(reg_idx));
+                IXGBE_WRITE_REG(hw, IXGBE_TXDCTL(reg_idx),
                                 (txdctl & ~IXGBE_TXDCTL_ENABLE));
         }
         /* Disable the Tx DMA engine on 82599 */
-        if (hw->mac.type == ixgbe_mac_82599EB)
+        switch (hw->mac.type) {
+        case ixgbe_mac_82599EB:
+        case ixgbe_mac_X540:
                 IXGBE_WRITE_REG(hw, IXGBE_DMATXCTL,
                                 (IXGBE_READ_REG(hw, IXGBE_DMATXCTL) &
                                  ~IXGBE_DMATXCTL_TE));
-
-        /* power down the optics */
-        if (hw->phy.multispeed_fiber)
-                hw->mac.ops.disable_tx_laser(hw);
+                break;
+        default:
+                break;
+        }
 
         /* clear n-tuple filters that are cached */
         ethtool_ntuple_flush(netdev);
 
         if (!pci_channel_offline(adapter->pdev))
                 ixgbe_reset(adapter);
+
+        /* power down the optics for multispeed fiber and 82599 SFP+ fiber */
+        if (hw->mac.ops.disable_tx_laser &&
+            ((hw->phy.multispeed_fiber) ||
+             ((hw->mac.ops.get_media_type(hw) == ixgbe_media_type_fiber) &&
+              (hw->mac.type == ixgbe_mac_82599EB))))
+                hw->mac.ops.disable_tx_laser(hw);
+
         ixgbe_clean_all_tx_rings(adapter);
         ixgbe_clean_all_rx_rings(adapter);
 
@@ -3925,10 +4150,8 @@ static int ixgbe_poll(struct napi_struct *napi, int budget)
         int tx_clean_complete, work_done = 0;
 
 #ifdef CONFIG_IXGBE_DCA
-        if (adapter->flags & IXGBE_FLAG_DCA_ENABLED) {
-                ixgbe_update_tx_dca(adapter, adapter->tx_ring[0]);
-                ixgbe_update_rx_dca(adapter, adapter->rx_ring[0]);
-        }
+        if (adapter->flags & IXGBE_FLAG_DCA_ENABLED)
+                ixgbe_update_dca(q_vector);
 #endif
 
         tx_clean_complete = ixgbe_clean_tx_irq(q_vector, adapter->tx_ring[0]);
@@ -3956,6 +4179,8 @@ static void ixgbe_tx_timeout(struct net_device *netdev)
 {
         struct ixgbe_adapter *adapter = netdev_priv(netdev);
 
+        adapter->tx_timeout_count++;
+
         /* Do the reset outside of interrupt context */
         schedule_work(&adapter->reset_task);
 }
@@ -3970,8 +4195,6 @@ static void ixgbe_reset_task(struct work_struct *work)
             test_bit(__IXGBE_RESETTING, &adapter->state))
                 return;
 
-        adapter->tx_timeout_count++;
-
         ixgbe_dump(adapter);
         netdev_err(adapter->netdev, "Reset adapter\n");
         ixgbe_reinit_locked(adapter);
@@ -4221,19 +4444,16 @@ static void ixgbe_acquire_msix_vectors(struct ixgbe_adapter *adapter,
 static inline bool ixgbe_cache_ring_rss(struct ixgbe_adapter *adapter)
 {
         int i;
-        bool ret = false;
 
-        if (adapter->flags & IXGBE_FLAG_RSS_ENABLED) {
-                for (i = 0; i < adapter->num_rx_queues; i++)
-                        adapter->rx_ring[i]->reg_idx = i;
-                for (i = 0; i < adapter->num_tx_queues; i++)
-                        adapter->tx_ring[i]->reg_idx = i;
-                ret = true;
-        } else {
-                ret = false;
-        }
+        if (!(adapter->flags & IXGBE_FLAG_RSS_ENABLED))
+                return false;
 
-        return ret;
+        for (i = 0; i < adapter->num_rx_queues; i++)
+                adapter->rx_ring[i]->reg_idx = i;
+        for (i = 0; i < adapter->num_tx_queues; i++)
+                adapter->tx_ring[i]->reg_idx = i;
+
+        return true;
 }
 
 #ifdef CONFIG_IXGBE_DCB
@@ -4250,71 +4470,67 @@ static inline bool ixgbe_cache_ring_dcb(struct ixgbe_adapter *adapter)
         bool ret = false;
         int dcb_i = adapter->ring_feature[RING_F_DCB].indices;
 
-        if (adapter->flags & IXGBE_FLAG_DCB_ENABLED) {
-                if (adapter->hw.mac.type == ixgbe_mac_82598EB) {
-                        /* the number of queues is assumed to be symmetric */
-                        for (i = 0; i < dcb_i; i++) {
-                                adapter->rx_ring[i]->reg_idx = i << 3;
-                                adapter->tx_ring[i]->reg_idx = i << 2;
-                        }
-                        ret = true;
-                } else if (adapter->hw.mac.type == ixgbe_mac_82599EB) {
-                        if (dcb_i == 8) {
-                                /*
-                                 * Tx TC0 starts at: descriptor queue 0
-                                 * Tx TC1 starts at: descriptor queue 32
-                                 * Tx TC2 starts at: descriptor queue 64
-                                 * Tx TC3 starts at: descriptor queue 80
-                                 * Tx TC4 starts at: descriptor queue 96
-                                 * Tx TC5 starts at: descriptor queue 104
-                                 * Tx TC6 starts at: descriptor queue 112
-                                 * Tx TC7 starts at: descriptor queue 120
-                                 *
-                                 * Rx TC0-TC7 are offset by 16 queues each
-                                 */
-                                for (i = 0; i < 3; i++) {
-                                        adapter->tx_ring[i]->reg_idx = i << 5;
-                                        adapter->rx_ring[i]->reg_idx = i << 4;
-                                }
-                                for ( ; i < 5; i++) {
-                                        adapter->tx_ring[i]->reg_idx =
-                                                                 ((i + 2) << 4);
-                                        adapter->rx_ring[i]->reg_idx = i << 4;
-                                }
-                                for ( ; i < dcb_i; i++) {
-                                        adapter->tx_ring[i]->reg_idx =
-                                                                 ((i + 8) << 3);
-                                        adapter->rx_ring[i]->reg_idx = i << 4;
-                                }
+        if (!(adapter->flags & IXGBE_FLAG_DCB_ENABLED))
+                return false;
 
-                                ret = true;
-                        } else if (dcb_i == 4) {
-                                /*
-                                 * Tx TC0 starts at: descriptor queue 0
-                                 * Tx TC1 starts at: descriptor queue 64
-                                 * Tx TC2 starts at: descriptor queue 96
-                                 * Tx TC3 starts at: descriptor queue 112
-                                 *
-                                 * Rx TC0-TC3 are offset by 32 queues each
-                                 */
-                                adapter->tx_ring[0]->reg_idx = 0;
-                                adapter->tx_ring[1]->reg_idx = 64;
-                                adapter->tx_ring[2]->reg_idx = 96;
-                                adapter->tx_ring[3]->reg_idx = 112;
-                                for (i = 0 ; i < dcb_i; i++)
-                                        adapter->rx_ring[i]->reg_idx = i << 5;
-
-                                ret = true;
-                        } else {
-                                ret = false;
+        /* the number of queues is assumed to be symmetric */
+        switch (adapter->hw.mac.type) {
+        case ixgbe_mac_82598EB:
+                for (i = 0; i < dcb_i; i++) {
+                        adapter->rx_ring[i]->reg_idx = i << 3;
+                        adapter->tx_ring[i]->reg_idx = i << 2;
+                }
+                ret = true;
+                break;
+        case ixgbe_mac_82599EB:
+        case ixgbe_mac_X540:
+                if (dcb_i == 8) {
+                        /*
+                         * Tx TC0 starts at: descriptor queue 0
+                         * Tx TC1 starts at: descriptor queue 32
+                         * Tx TC2 starts at: descriptor queue 64
+                         * Tx TC3 starts at: descriptor queue 80
+                         * Tx TC4 starts at: descriptor queue 96
+                         * Tx TC5 starts at: descriptor queue 104
+                         * Tx TC6 starts at: descriptor queue 112
+                         * Tx TC7 starts at: descriptor queue 120
+                         *
+                         * Rx TC0-TC7 are offset by 16 queues each
+                         */
+                        for (i = 0; i < 3; i++) {
+                                adapter->tx_ring[i]->reg_idx = i << 5;
+                                adapter->rx_ring[i]->reg_idx = i << 4;
                         }
-                } else {
-                        ret = false;
+                        for ( ; i < 5; i++) {
+                                adapter->tx_ring[i]->reg_idx = ((i + 2) << 4);
+                                adapter->rx_ring[i]->reg_idx = i << 4;
+                        }
+                        for ( ; i < dcb_i; i++) {
+                                adapter->tx_ring[i]->reg_idx = ((i + 8) << 3);
+                                adapter->rx_ring[i]->reg_idx = i << 4;
+                        }
+                        ret = true;
+                } else if (dcb_i == 4) {
+                        /*
+                         * Tx TC0 starts at: descriptor queue 0
+                         * Tx TC1 starts at: descriptor queue 64
+                         * Tx TC2 starts at: descriptor queue 96
+                         * Tx TC3 starts at: descriptor queue 112
+                         *
+                         * Rx TC0-TC3 are offset by 32 queues each
+                         */
+                        adapter->tx_ring[0]->reg_idx = 0;
+                        adapter->tx_ring[1]->reg_idx = 64;
+                        adapter->tx_ring[2]->reg_idx = 96;
+                        adapter->tx_ring[3]->reg_idx = 112;
+                        for (i = 0 ; i < dcb_i; i++)
+                                adapter->rx_ring[i]->reg_idx = i << 5;
+                        ret = true;
                 }
-        } else {
-                ret = false;
+                break;
+        default:
+                break;
         }
-
         return ret;
 }
 #endif
@@ -4354,55 +4570,55 @@ static inline bool ixgbe_cache_ring_fdir(struct ixgbe_adapter *adapter)
  */
 static inline bool ixgbe_cache_ring_fcoe(struct ixgbe_adapter *adapter)
 {
-        int i, fcoe_rx_i = 0, fcoe_tx_i = 0;
-        bool ret = false;
         struct ixgbe_ring_feature *f = &adapter->ring_feature[RING_F_FCOE];
+        int i;
+        u8 fcoe_rx_i = 0, fcoe_tx_i = 0;
+
+        if (!(adapter->flags & IXGBE_FLAG_FCOE_ENABLED))
+                return false;
 
-        if (adapter->flags & IXGBE_FLAG_FCOE_ENABLED) {
 #ifdef CONFIG_IXGBE_DCB
-                if (adapter->flags & IXGBE_FLAG_DCB_ENABLED) {
-                        struct ixgbe_fcoe *fcoe = &adapter->fcoe;
+        if (adapter->flags & IXGBE_FLAG_DCB_ENABLED) {
+                struct ixgbe_fcoe *fcoe = &adapter->fcoe;
 
-                        ixgbe_cache_ring_dcb(adapter);
-                        /* find out queues in TC for FCoE */
-                        fcoe_rx_i = adapter->rx_ring[fcoe->tc]->reg_idx + 1;
-                        fcoe_tx_i = adapter->tx_ring[fcoe->tc]->reg_idx + 1;
-                        /*
-                         * In 82599, the number of Tx queues for each traffic
-                         * class for both 8-TC and 4-TC modes are:
-                         * TCs  : TC0 TC1 TC2 TC3 TC4 TC5 TC6 TC7
-                         * 8 TCs:  32  32  16  16   8   8   8   8
-                         * 4 TCs:  64  64  32  32
-                         * We have max 8 queues for FCoE, where 8 the is
-                         * FCoE redirection table size. If TC for FCoE is
-                         * less than or equal to TC3, we have enough queues
-                         * to add max of 8 queues for FCoE, so we start FCoE
-                         * tx descriptor from the next one, i.e., reg_idx + 1.
-                         * If TC for FCoE is above TC3, implying 8 TC mode,
-                         * and we need 8 for FCoE, we have to take all queues
-                         * in that traffic class for FCoE.
-                         */
-                        if ((f->indices == IXGBE_FCRETA_SIZE) && (fcoe->tc > 3))
-                                fcoe_tx_i--;
-                }
+                ixgbe_cache_ring_dcb(adapter);
+                /* find out queues in TC for FCoE */
+                fcoe_rx_i = adapter->rx_ring[fcoe->tc]->reg_idx + 1;
+                fcoe_tx_i = adapter->tx_ring[fcoe->tc]->reg_idx + 1;
+                /*
+                 * In 82599, the number of Tx queues for each traffic
+                 * class for both 8-TC and 4-TC modes are:
+                 * TCs  : TC0 TC1 TC2 TC3 TC4 TC5 TC6 TC7
+                 * 8 TCs:  32  32  16  16   8   8   8   8
+                 * 4 TCs:  64  64  32  32
+                 * We have max 8 queues for FCoE, where 8 the is
+                 * FCoE redirection table size. If TC for FCoE is
+                 * less than or equal to TC3, we have enough queues
+                 * to add max of 8 queues for FCoE, so we start FCoE
+                 * Tx queue from the next one, i.e., reg_idx + 1.
+                 * If TC for FCoE is above TC3, implying 8 TC mode,
+                 * and we need 8 for FCoE, we have to take all queues
+                 * in that traffic class for FCoE.
+                 */
+                if ((f->indices == IXGBE_FCRETA_SIZE) && (fcoe->tc > 3))
+                        fcoe_tx_i--;
+        }
 #endif /* CONFIG_IXGBE_DCB */
-                if (adapter->flags & IXGBE_FLAG_RSS_ENABLED) {
-                        if ((adapter->flags & IXGBE_FLAG_FDIR_HASH_CAPABLE) ||
-                            (adapter->flags & IXGBE_FLAG_FDIR_PERFECT_CAPABLE))
-                                ixgbe_cache_ring_fdir(adapter);
-                        else
-                                ixgbe_cache_ring_rss(adapter);
+        if (adapter->flags & IXGBE_FLAG_RSS_ENABLED) {
+                if ((adapter->flags & IXGBE_FLAG_FDIR_HASH_CAPABLE) ||
+                    (adapter->flags & IXGBE_FLAG_FDIR_PERFECT_CAPABLE))
+                        ixgbe_cache_ring_fdir(adapter);
+                else
+                        ixgbe_cache_ring_rss(adapter);
 
-                        fcoe_rx_i = f->mask;
-                        fcoe_tx_i = f->mask;
-                }
-                for (i = 0; i < f->indices; i++, fcoe_rx_i++, fcoe_tx_i++) {
-                        adapter->rx_ring[f->mask + i]->reg_idx = fcoe_rx_i;
-                        adapter->tx_ring[f->mask + i]->reg_idx = fcoe_tx_i;
-                }
-                ret = true;
+                fcoe_rx_i = f->mask;
+                fcoe_tx_i = f->mask;
         }
-        return ret;
+        for (i = 0; i < f->indices; i++, fcoe_rx_i++, fcoe_tx_i++) {
+                adapter->rx_ring[f->mask + i]->reg_idx = fcoe_rx_i;
+                adapter->tx_ring[f->mask + i]->reg_idx = fcoe_tx_i;
+        }
+        return true;
 }
 
 #endif /* IXGBE_FCOE */
@@ -4471,65 +4687,55 @@ static void ixgbe_cache_ring_register(struct ixgbe_adapter *adapter)
  **/
 static int ixgbe_alloc_queues(struct ixgbe_adapter *adapter)
 {
-        int i;
-        int orig_node = adapter->node;
+        int rx = 0, tx = 0, nid = adapter->node;
 
-        for (i = 0; i < adapter->num_tx_queues; i++) {
-                struct ixgbe_ring *ring = adapter->tx_ring[i];
-                if (orig_node == -1) {
-                        int cur_node = next_online_node(adapter->node);
-                        if (cur_node == MAX_NUMNODES)
-                                cur_node = first_online_node;
-                        adapter->node = cur_node;
-                }
-                ring = kzalloc_node(sizeof(struct ixgbe_ring), GFP_KERNEL,
-                                    adapter->node);
+        if (nid < 0 || !node_online(nid))
+                nid = first_online_node;
+
+        for (; tx < adapter->num_tx_queues; tx++) {
+                struct ixgbe_ring *ring;
+
+                ring = kzalloc_node(sizeof(*ring), GFP_KERNEL, nid);
                 if (!ring)
-                        ring = kzalloc(sizeof(struct ixgbe_ring), GFP_KERNEL);
+                        ring = kzalloc(sizeof(*ring), GFP_KERNEL);
                 if (!ring)
-                        goto err_tx_ring_allocation;
+                        goto err_allocation;
                 ring->count = adapter->tx_ring_count;
-                ring->queue_index = i;
-                ring->numa_node = adapter->node;
+                ring->queue_index = tx;
+                ring->numa_node = nid;
+                ring->dev = &adapter->pdev->dev;
+                ring->netdev = adapter->netdev;
 
-                adapter->tx_ring[i] = ring;
+                adapter->tx_ring[tx] = ring;
         }
 
-        /* Restore the adapter's original node */
-        adapter->node = orig_node;
+        for (; rx < adapter->num_rx_queues; rx++) {
+                struct ixgbe_ring *ring;
 
-        for (i = 0; i < adapter->num_rx_queues; i++) {
-                struct ixgbe_ring *ring = adapter->rx_ring[i];
-                if (orig_node == -1) {
-                        int cur_node = next_online_node(adapter->node);
-                        if (cur_node == MAX_NUMNODES)
-                                cur_node = first_online_node;
-                        adapter->node = cur_node;
-                }
-                ring = kzalloc_node(sizeof(struct ixgbe_ring), GFP_KERNEL,
-                                    adapter->node);
+                ring = kzalloc_node(sizeof(*ring), GFP_KERNEL, nid);
                 if (!ring)
-                        ring = kzalloc(sizeof(struct ixgbe_ring), GFP_KERNEL);
+                        ring = kzalloc(sizeof(*ring), GFP_KERNEL);
                 if (!ring)
-                        goto err_rx_ring_allocation;
+                        goto err_allocation;
                 ring->count = adapter->rx_ring_count;
-                ring->queue_index = i;
-                ring->numa_node = adapter->node;
+                ring->queue_index = rx;
+                ring->numa_node = nid;
+                ring->dev = &adapter->pdev->dev;
+                ring->netdev = adapter->netdev;
 
-                adapter->rx_ring[i] = ring;
+                adapter->rx_ring[rx] = ring;
         }
 
-        /* Restore the adapter's original node */
-        adapter->node = orig_node;
-
         ixgbe_cache_ring_register(adapter);
 
         return 0;
 
-err_rx_ring_allocation:
-        for (i = 0; i < adapter->num_tx_queues; i++)
-                kfree(adapter->tx_ring[i]);
-err_tx_ring_allocation:
+err_allocation:
+        while (tx)
+                kfree(adapter->tx_ring[--tx]);
+
+        while (rx)
+                kfree(adapter->rx_ring[--rx]);
         return -ENOMEM;
 }
 
@@ -4751,6 +4957,11 @@ err_set_interrupt:
         return err;
 }
 
+static void ring_free_rcu(struct rcu_head *head)
+{
+        kfree(container_of(head, struct ixgbe_ring, rcu));
+}
+
 /**
  * ixgbe_clear_interrupt_scheme - Clear the current interrupt scheme settings
  * @adapter: board private structure to clear interrupt scheme on
@@ -4767,7 +4978,12 @@ void ixgbe_clear_interrupt_scheme(struct ixgbe_adapter *adapter)
                 adapter->tx_ring[i] = NULL;
         }
         for (i = 0; i < adapter->num_rx_queues; i++) {
-                kfree(adapter->rx_ring[i]);
+                struct ixgbe_ring *ring = adapter->rx_ring[i];
+
+                /* ixgbe_get_stats64() might access this ring, we must wait
+                 * a grace period before freeing it.
+                 */
+                call_rcu(&ring->rcu, ring_free_rcu);
                 adapter->rx_ring[i] = NULL;
         }
 
@@ -4847,6 +5063,7 @@ static int __devinit ixgbe_sw_init(struct ixgbe_adapter *adapter)
         int j;
         struct tc_configuration *tc;
 #endif
+        int max_frame = dev->mtu + ETH_HLEN + ETH_FCS_LEN;
 
         /* PCI config space info */
 
@@ -4861,11 +5078,14 @@ static int __devinit ixgbe_sw_init(struct ixgbe_adapter *adapter)
         adapter->ring_feature[RING_F_RSS].indices = rss;
         adapter->flags |= IXGBE_FLAG_RSS_ENABLED;
         adapter->ring_feature[RING_F_DCB].indices = IXGBE_MAX_DCB_INDICES;
-        if (hw->mac.type == ixgbe_mac_82598EB) {
+        switch (hw->mac.type) {
+        case ixgbe_mac_82598EB:
                 if (hw->device_id == IXGBE_DEV_ID_82598AT)
                         adapter->flags |= IXGBE_FLAG_FAN_FAIL_CAPABLE;
                 adapter->max_msix_q_vectors = MAX_MSIX_Q_VECTORS_82598;
-        } else if (hw->mac.type == ixgbe_mac_82599EB) {
+                break;
+        case ixgbe_mac_82599EB:
+        case ixgbe_mac_X540:
                 adapter->max_msix_q_vectors = MAX_MSIX_Q_VECTORS_82599;
                 adapter->flags2 |= IXGBE_FLAG2_RSC_CAPABLE;
                 adapter->flags2 |= IXGBE_FLAG2_RSC_ENABLED;
@@ -4894,6 +5114,9 @@ static int __devinit ixgbe_sw_init(struct ixgbe_adapter *adapter)
                 adapter->fcoe.up = IXGBE_FCOE_DEFTC;
 #endif
 #endif /* IXGBE_FCOE */
+                break;
+        default:
+                break;
         }
 
 #ifdef CONFIG_IXGBE_DCB
@@ -4923,8 +5146,8 @@ static int __devinit ixgbe_sw_init(struct ixgbe_adapter *adapter)
 #ifdef CONFIG_DCB
         adapter->last_lfc_mode = hw->fc.current_mode;
 #endif
-        hw->fc.high_water = IXGBE_DEFAULT_FCRTH;
-        hw->fc.low_water = IXGBE_DEFAULT_FCRTL;
+        hw->fc.high_water = FC_HIGH_WATER(max_frame);
+        hw->fc.low_water = FC_LOW_WATER(max_frame);
         hw->fc.pause_time = IXGBE_DEFAULT_FCPAUSE;
         hw->fc.send_xon = true;
         hw->fc.disable_fc_autoneg = false;
@@ -4962,30 +5185,27 @@ static int __devinit ixgbe_sw_init(struct ixgbe_adapter *adapter)
 
 /**
  * ixgbe_setup_tx_resources - allocate Tx resources (Descriptors)
- * @adapter: board private structure
  * @tx_ring:    tx descriptor ring (for a specific queue) to setup
  *
  * Return 0 on success, negative on failure
  **/
-int ixgbe_setup_tx_resources(struct ixgbe_adapter *adapter,
-                             struct ixgbe_ring *tx_ring)
+int ixgbe_setup_tx_resources(struct ixgbe_ring *tx_ring)
 {
-        struct pci_dev *pdev = adapter->pdev;
+        struct device *dev = tx_ring->dev;
         int size;
 
         size = sizeof(struct ixgbe_tx_buffer) * tx_ring->count;
-        tx_ring->tx_buffer_info = vmalloc_node(size, tx_ring->numa_node);
+        tx_ring->tx_buffer_info = vzalloc_node(size, tx_ring->numa_node);
         if (!tx_ring->tx_buffer_info)
-                tx_ring->tx_buffer_info = vmalloc(size);
+                tx_ring->tx_buffer_info = vzalloc(size);
         if (!tx_ring->tx_buffer_info)
                 goto err;
-        memset(tx_ring->tx_buffer_info, 0, size);
 
         /* round up to nearest 4K */
         tx_ring->size = tx_ring->count * sizeof(union ixgbe_adv_tx_desc);
         tx_ring->size = ALIGN(tx_ring->size, 4096);
 
-        tx_ring->desc = dma_alloc_coherent(&pdev->dev, tx_ring->size,
+        tx_ring->desc = dma_alloc_coherent(dev, tx_ring->size,
                                            &tx_ring->dma, GFP_KERNEL);
         if (!tx_ring->desc)
                 goto err;
@@ -4998,7 +5218,7 @@ int ixgbe_setup_tx_resources(struct ixgbe_adapter *adapter,
 err:
         vfree(tx_ring->tx_buffer_info);
         tx_ring->tx_buffer_info = NULL;
-        e_err(probe, "Unable to allocate memory for the Tx descriptor ring\n");
+        dev_err(dev, "Unable to allocate memory for the Tx descriptor ring\n");
         return -ENOMEM;
 }
 
@@ -5017,7 +5237,7 @@ static int ixgbe_setup_all_tx_resources(struct ixgbe_adapter *adapter)
         int i, err = 0;
 
         for (i = 0; i < adapter->num_tx_queues; i++) {
-                err = ixgbe_setup_tx_resources(adapter, adapter->tx_ring[i]);
+                err = ixgbe_setup_tx_resources(adapter->tx_ring[i]);
                 if (!err)
                         continue;
                 e_err(probe, "Allocation for Tx Queue %u failed\n", i);
@@ -5029,48 +5249,40 @@ static int ixgbe_setup_all_tx_resources(struct ixgbe_adapter *adapter)
 
 /**
  * ixgbe_setup_rx_resources - allocate Rx resources (Descriptors)
- * @adapter: board private structure
  * @rx_ring:    rx descriptor ring (for a specific queue) to setup
  *
  * Returns 0 on success, negative on failure
  **/
-int ixgbe_setup_rx_resources(struct ixgbe_adapter *adapter,
-                             struct ixgbe_ring *rx_ring)
+int ixgbe_setup_rx_resources(struct ixgbe_ring *rx_ring)
 {
-        struct pci_dev *pdev = adapter->pdev;
+        struct device *dev = rx_ring->dev;
         int size;
 
         size = sizeof(struct ixgbe_rx_buffer) * rx_ring->count;
-        rx_ring->rx_buffer_info = vmalloc_node(size, adapter->node);
+        rx_ring->rx_buffer_info = vzalloc_node(size, rx_ring->numa_node);
         if (!rx_ring->rx_buffer_info)
-                rx_ring->rx_buffer_info = vmalloc(size);
-        if (!rx_ring->rx_buffer_info) {
-                e_err(probe, "vmalloc allocation failed for the Rx "
-                      "descriptor ring\n");
-                goto alloc_failed;
-        }
-        memset(rx_ring->rx_buffer_info, 0, size);
+                rx_ring->rx_buffer_info = vzalloc(size);
+        if (!rx_ring->rx_buffer_info)
+                goto err;
 
         /* Round up to nearest 4K */
         rx_ring->size = rx_ring->count * sizeof(union ixgbe_adv_rx_desc);
         rx_ring->size = ALIGN(rx_ring->size, 4096);
 
-        rx_ring->desc = dma_alloc_coherent(&pdev->dev, rx_ring->size,
+        rx_ring->desc = dma_alloc_coherent(dev, rx_ring->size,
                                            &rx_ring->dma, GFP_KERNEL);
 
-        if (!rx_ring->desc) {
-                e_err(probe, "Memory allocation failed for the Rx "
-                      "descriptor ring\n");
-                vfree(rx_ring->rx_buffer_info);
-                goto alloc_failed;
-        }
+        if (!rx_ring->desc)
+                goto err;
 
         rx_ring->next_to_clean = 0;
         rx_ring->next_to_use = 0;
 
         return 0;
-
-alloc_failed:
+err:
+        vfree(rx_ring->rx_buffer_info);
+        rx_ring->rx_buffer_info = NULL;
+        dev_err(dev, "Unable to allocate memory for the Rx descriptor ring\n");
         return -ENOMEM;
 }
 
@@ -5084,13 +5296,12 @@ alloc_failed:
  *
  * Return 0 on success, negative on failure
  **/
-
 static int ixgbe_setup_all_rx_resources(struct ixgbe_adapter *adapter)
 {
         int i, err = 0;
 
         for (i = 0; i < adapter->num_rx_queues; i++) {
-                err = ixgbe_setup_rx_resources(adapter, adapter->rx_ring[i]);
+                err = ixgbe_setup_rx_resources(adapter->rx_ring[i]);
                 if (!err)
                         continue;
                 e_err(probe, "Allocation for Rx Queue %u failed\n", i);
@@ -5102,23 +5313,23 @@ static int ixgbe_setup_all_rx_resources(struct ixgbe_adapter *adapter)
 
 /**
  * ixgbe_free_tx_resources - Free Tx Resources per Queue
- * @adapter: board private structure
  * @tx_ring: Tx descriptor ring for a specific queue
  *
  * Free all transmit software resources
  **/
-void ixgbe_free_tx_resources(struct ixgbe_adapter *adapter,
-                             struct ixgbe_ring *tx_ring)
+void ixgbe_free_tx_resources(struct ixgbe_ring *tx_ring)
 {
-        struct pci_dev *pdev = adapter->pdev;
-
-        ixgbe_clean_tx_ring(adapter, tx_ring);
+        ixgbe_clean_tx_ring(tx_ring);
 
         vfree(tx_ring->tx_buffer_info);
         tx_ring->tx_buffer_info = NULL;
 
-        dma_free_coherent(&pdev->dev, tx_ring->size, tx_ring->desc,
-                          tx_ring->dma);
+        /* if not set, then don't free */
+        if (!tx_ring->desc)
+                return;
+
+        dma_free_coherent(tx_ring->dev, tx_ring->size,
+                          tx_ring->desc, tx_ring->dma);
 
         tx_ring->desc = NULL;
 }
@@ -5135,28 +5346,28 @@ static void ixgbe_free_all_tx_resources(struct ixgbe_adapter *adapter)
 
         for (i = 0; i < adapter->num_tx_queues; i++)
                 if (adapter->tx_ring[i]->desc)
-                        ixgbe_free_tx_resources(adapter, adapter->tx_ring[i]);
+                        ixgbe_free_tx_resources(adapter->tx_ring[i]);
 }
 
 /**
  * ixgbe_free_rx_resources - Free Rx Resources
- * @adapter: board private structure
  * @rx_ring: ring to clean the resources from
  *
  * Free all receive software resources
  **/
-void ixgbe_free_rx_resources(struct ixgbe_adapter *adapter,
-                             struct ixgbe_ring *rx_ring)
+void ixgbe_free_rx_resources(struct ixgbe_ring *rx_ring)
 {
-        struct pci_dev *pdev = adapter->pdev;
-
-        ixgbe_clean_rx_ring(adapter, rx_ring);
+        ixgbe_clean_rx_ring(rx_ring);
 
         vfree(rx_ring->rx_buffer_info);
         rx_ring->rx_buffer_info = NULL;
 
-        dma_free_coherent(&pdev->dev, rx_ring->size, rx_ring->desc,
-                          rx_ring->dma);
+        /* if not set, then don't free */
+        if (!rx_ring->desc)
+                return;
+
+        dma_free_coherent(rx_ring->dev, rx_ring->size,
+                          rx_ring->desc, rx_ring->dma);
 
         rx_ring->desc = NULL;
 }
@@ -5173,7 +5384,7 @@ static void ixgbe_free_all_rx_resources(struct ixgbe_adapter *adapter)
 
         for (i = 0; i < adapter->num_rx_queues; i++)
                 if (adapter->rx_ring[i]->desc)
-                        ixgbe_free_rx_resources(adapter, adapter->rx_ring[i]);
+                        ixgbe_free_rx_resources(adapter->rx_ring[i]);
 }
 
 /**
@@ -5186,6 +5397,7 @@ static void ixgbe_free_all_rx_resources(struct ixgbe_adapter *adapter)
 static int ixgbe_change_mtu(struct net_device *netdev, int new_mtu)
 {
         struct ixgbe_adapter *adapter = netdev_priv(netdev);
+        struct ixgbe_hw *hw = &adapter->hw;
         int max_frame = new_mtu + ETH_HLEN + ETH_FCS_LEN;
 
         /* MTU < 68 is an error and causes problems on some kernels */
@@ -5196,6 +5408,9 @@ static int ixgbe_change_mtu(struct net_device *netdev, int new_mtu)
         /* must set new MTU before calling down or up */
         netdev->mtu = new_mtu;
 
+        hw->fc.high_water = FC_HIGH_WATER(max_frame);
+        hw->fc.low_water = FC_LOW_WATER(max_frame);
+
         if (netif_running(netdev))
                 ixgbe_reinit_locked(adapter);
 
@@ -5291,8 +5506,8 @@ static int ixgbe_close(struct net_device *netdev)
 #ifdef CONFIG_PM
 static int ixgbe_resume(struct pci_dev *pdev)
 {
-        struct net_device *netdev = pci_get_drvdata(pdev);
-        struct ixgbe_adapter *adapter = netdev_priv(netdev);
+        struct ixgbe_adapter *adapter = pci_get_drvdata(pdev);
+        struct net_device *netdev = adapter->netdev;
         u32 err;
 
         pci_set_power_state(pdev, PCI_D0);
@@ -5323,7 +5538,7 @@ static int ixgbe_resume(struct pci_dev *pdev)
         IXGBE_WRITE_REG(&adapter->hw, IXGBE_WUS, ~0);
 
         if (netif_running(netdev)) {
-                err = ixgbe_open(adapter->netdev);
+                err = ixgbe_open(netdev);
                 if (err)
                         return err;
         }
@@ -5336,8 +5551,8 @@ static int ixgbe_resume(struct pci_dev *pdev)
 
 static int __ixgbe_shutdown(struct pci_dev *pdev, bool *enable_wake)
 {
-        struct net_device *netdev = pci_get_drvdata(pdev);
-        struct ixgbe_adapter *adapter = netdev_priv(netdev);
+        struct ixgbe_adapter *adapter = pci_get_drvdata(pdev);
+        struct net_device *netdev = adapter->netdev;
         struct ixgbe_hw *hw = &adapter->hw;
         u32 ctrl, fctrl;
         u32 wufc = adapter->wol;
@@ -5354,6 +5569,8 @@ static int __ixgbe_shutdown(struct pci_dev *pdev, bool *enable_wake)
                 ixgbe_free_all_rx_resources(adapter);
         }
 
+        ixgbe_clear_interrupt_scheme(adapter);
+
 #ifdef CONFIG_PM
         retval = pci_save_state(pdev);
         if (retval)
@@ -5380,15 +5597,20 @@ static int __ixgbe_shutdown(struct pci_dev *pdev, bool *enable_wake)
                 IXGBE_WRITE_REG(hw, IXGBE_WUFC, 0);
         }
 
-        if (wufc && hw->mac.type == ixgbe_mac_82599EB)
-                pci_wake_from_d3(pdev, true);
-        else
+        switch (hw->mac.type) {
+        case ixgbe_mac_82598EB:
                 pci_wake_from_d3(pdev, false);
+                break;
+        case ixgbe_mac_82599EB:
+        case ixgbe_mac_X540:
+                pci_wake_from_d3(pdev, !!wufc);
+                break;
+        default:
+                break;
+        }
 
         *enable_wake = !!wufc;
 
-        ixgbe_clear_interrupt_scheme(adapter);
-
         ixgbe_release_hw_control(adapter);
 
         pci_disable_device(pdev);
@@ -5437,10 +5659,12 @@ void ixgbe_update_stats(struct ixgbe_adapter *adapter)
 {
         struct net_device *netdev = adapter->netdev;
         struct ixgbe_hw *hw = &adapter->hw;
+        struct ixgbe_hw_stats *hwstats = &adapter->stats;
         u64 total_mpc = 0;
         u32 i, missed_rx = 0, mpc, bprc, lxon, lxoff, xon_off_tot;
-        u64 non_eop_descs = 0, restart_queue = 0;
-        struct ixgbe_hw_stats *hwstats = &adapter->stats;
+        u64 non_eop_descs = 0, restart_queue = 0, tx_busy = 0;
+        u64 alloc_rx_page_failed = 0, alloc_rx_buff_failed = 0;
+        u64 bytes = 0, packets = 0;
 
         if (test_bit(__IXGBE_DOWN, &adapter->state) ||
             test_bit(__IXGBE_RESETTING, &adapter->state))
@@ -5453,21 +5677,41 @@ void ixgbe_update_stats(struct ixgbe_adapter *adapter)
                         adapter->hw_rx_no_dma_resources +=
                                 IXGBE_READ_REG(hw, IXGBE_QPRDC(i));
                 for (i = 0; i < adapter->num_rx_queues; i++) {
-                        rsc_count += adapter->rx_ring[i]->rsc_count;
-                        rsc_flush += adapter->rx_ring[i]->rsc_flush;
+                        rsc_count += adapter->rx_ring[i]->rx_stats.rsc_count;
+                        rsc_flush += adapter->rx_ring[i]->rx_stats.rsc_flush;
                 }
                 adapter->rsc_total_count = rsc_count;
                 adapter->rsc_total_flush = rsc_flush;
         }
 
+        for (i = 0; i < adapter->num_rx_queues; i++) {
+                struct ixgbe_ring *rx_ring = adapter->rx_ring[i];
+                non_eop_descs += rx_ring->rx_stats.non_eop_descs;
+                alloc_rx_page_failed += rx_ring->rx_stats.alloc_rx_page_failed;
+                alloc_rx_buff_failed += rx_ring->rx_stats.alloc_rx_buff_failed;
+                bytes += rx_ring->stats.bytes;
+                packets += rx_ring->stats.packets;
+        }
+        adapter->non_eop_descs = non_eop_descs;
+        adapter->alloc_rx_page_failed = alloc_rx_page_failed;
+        adapter->alloc_rx_buff_failed = alloc_rx_buff_failed;
+        netdev->stats.rx_bytes = bytes;
+        netdev->stats.rx_packets = packets;
+
+        bytes = 0;
+        packets = 0;
         /* gather some stats to the adapter struct that are per queue */
-        for (i = 0; i < adapter->num_tx_queues; i++)
-                restart_queue += adapter->tx_ring[i]->restart_queue;
+        for (i = 0; i < adapter->num_tx_queues; i++) {
+                struct ixgbe_ring *tx_ring = adapter->tx_ring[i];
+                restart_queue += tx_ring->tx_stats.restart_queue;
+                tx_busy += tx_ring->tx_stats.tx_busy;
+                bytes += tx_ring->stats.bytes;
+                packets += tx_ring->stats.packets;
+        }
         adapter->restart_queue = restart_queue;
-
-        for (i = 0; i < adapter->num_rx_queues; i++)
-                non_eop_descs += adapter->rx_ring[i]->non_eop_descs;
-        adapter->non_eop_descs = non_eop_descs;
+        adapter->tx_busy = tx_busy;
+        netdev->stats.tx_bytes = bytes;
+        netdev->stats.tx_packets = packets;
 
         hwstats->crcerrs += IXGBE_READ_REG(hw, IXGBE_CRCERRS);
         for (i = 0; i < 8; i++) {
@@ -5482,17 +5726,18 @@ void ixgbe_update_stats(struct ixgbe_adapter *adapter)
                 hwstats->qbtc[i] += IXGBE_READ_REG(hw, IXGBE_QBTC(i));
                 hwstats->qprc[i] += IXGBE_READ_REG(hw, IXGBE_QPRC(i));
                 hwstats->qbrc[i] += IXGBE_READ_REG(hw, IXGBE_QBRC(i));
-                if (hw->mac.type == ixgbe_mac_82599EB) {
-                        hwstats->pxonrxc[i] +=
-                                IXGBE_READ_REG(hw, IXGBE_PXONRXCNT(i));
-                        hwstats->pxoffrxc[i] +=
-                                IXGBE_READ_REG(hw, IXGBE_PXOFFRXCNT(i));
-                        hwstats->qprdc[i] += IXGBE_READ_REG(hw, IXGBE_QPRDC(i));
-                } else {
+                switch (hw->mac.type) {
+                case ixgbe_mac_82598EB:
                         hwstats->pxonrxc[i] +=
                                 IXGBE_READ_REG(hw, IXGBE_PXONRXC(i));
-                        hwstats->pxoffrxc[i] +=
-                                IXGBE_READ_REG(hw, IXGBE_PXOFFRXC(i));
+                        break;
+                case ixgbe_mac_82599EB:
+                case ixgbe_mac_X540:
+                        hwstats->pxonrxc[i] +=
+                                IXGBE_READ_REG(hw, IXGBE_PXONRXCNT(i));
+                        break;
+                default:
+                        break;
                 }
                 hwstats->pxontxc[i] += IXGBE_READ_REG(hw, IXGBE_PXONTXC(i));
                 hwstats->pxofftxc[i] += IXGBE_READ_REG(hw, IXGBE_PXOFFTXC(i));
@@ -5501,21 +5746,25 @@ void ixgbe_update_stats(struct ixgbe_adapter *adapter)
         /* work around hardware counting issue */
         hwstats->gprc -= missed_rx;
 
+        ixgbe_update_xoff_received(adapter);
+
         /* 82598 hardware only has a 32 bit counter in the high register */
-        if (hw->mac.type == ixgbe_mac_82599EB) {
-                u64 tmp;
+        switch (hw->mac.type) {
+        case ixgbe_mac_82598EB:
+                hwstats->lxonrxc += IXGBE_READ_REG(hw, IXGBE_LXONRXC);
+                hwstats->gorc += IXGBE_READ_REG(hw, IXGBE_GORCH);
+                hwstats->gotc += IXGBE_READ_REG(hw, IXGBE_GOTCH);
+                hwstats->tor += IXGBE_READ_REG(hw, IXGBE_TORH);
+                break;
+        case ixgbe_mac_82599EB:
+        case ixgbe_mac_X540:
                 hwstats->gorc += IXGBE_READ_REG(hw, IXGBE_GORCL);
-                tmp = IXGBE_READ_REG(hw, IXGBE_GORCH) & 0xF;
-                                                /* 4 high bits of GORC */
-                hwstats->gorc += (tmp << 32);
+                IXGBE_READ_REG(hw, IXGBE_GORCH); /* to clear */
                 hwstats->gotc += IXGBE_READ_REG(hw, IXGBE_GOTCL);
-                tmp = IXGBE_READ_REG(hw, IXGBE_GOTCH) & 0xF;
-                                                /* 4 high bits of GOTC */
-                hwstats->gotc += (tmp << 32);
+                IXGBE_READ_REG(hw, IXGBE_GOTCH); /* to clear */
                 hwstats->tor += IXGBE_READ_REG(hw, IXGBE_TORL);
-                IXGBE_READ_REG(hw, IXGBE_TORH); /* to clear */
+                IXGBE_READ_REG(hw, IXGBE_TORH); /* to clear */
                 hwstats->lxonrxc += IXGBE_READ_REG(hw, IXGBE_LXONRXCNT);
-                hwstats->lxoffrxc += IXGBE_READ_REG(hw, IXGBE_LXOFFRXCNT);
                 hwstats->fdirmatch += IXGBE_READ_REG(hw, IXGBE_FDIRMATCH);
                 hwstats->fdirmiss += IXGBE_READ_REG(hw, IXGBE_FDIRMISS);
 #ifdef IXGBE_FCOE
@@ -5526,12 +5775,9 @@ void ixgbe_update_stats(struct ixgbe_adapter *adapter)
                 hwstats->fcoedwrc += IXGBE_READ_REG(hw, IXGBE_FCOEDWRC);
                 hwstats->fcoedwtc += IXGBE_READ_REG(hw, IXGBE_FCOEDWTC);
 #endif /* IXGBE_FCOE */
-        } else {
-                hwstats->lxonrxc += IXGBE_READ_REG(hw, IXGBE_LXONRXC);
-                hwstats->lxoffrxc += IXGBE_READ_REG(hw, IXGBE_LXOFFRXC);
-                hwstats->gorc += IXGBE_READ_REG(hw, IXGBE_GORCH);
-                hwstats->gotc += IXGBE_READ_REG(hw, IXGBE_GOTCH);
-                hwstats->tor += IXGBE_READ_REG(hw, IXGBE_TORH);
+                break;
+        default:
+                break;
         }
         bprc = IXGBE_READ_REG(hw, IXGBE_BPRC);
         hwstats->bprc += bprc;
@@ -5704,8 +5950,8 @@ static void ixgbe_fdir_reinit_task(struct work_struct *work)
 
         if (ixgbe_reinit_fdir_tables_82599(hw) == 0) {
                 for (i = 0; i < adapter->num_tx_queues; i++)
-                        set_bit(__IXGBE_FDIR_INIT_DONE,
-                                &(adapter->tx_ring[i]->reinit_state));
+                        set_bit(__IXGBE_TX_FDIR_INIT_DONE,
+                                &(adapter->tx_ring[i]->state));
         } else {
                 e_err(probe, "failed to finish FDIR re-initialization, "
                       "ignored adding FDIR ATR filters\n");
@@ -5767,17 +6013,27 @@ static void ixgbe_watchdog_task(struct work_struct *work)
                 if (!netif_carrier_ok(netdev)) {
                         bool flow_rx, flow_tx;
 
-                        if (hw->mac.type == ixgbe_mac_82599EB) {
-                                u32 mflcn = IXGBE_READ_REG(hw, IXGBE_MFLCN);
-                                u32 fccfg = IXGBE_READ_REG(hw, IXGBE_FCCFG);
-                                flow_rx = !!(mflcn & IXGBE_MFLCN_RFCE);
-                                flow_tx = !!(fccfg & IXGBE_FCCFG_TFCE_802_3X);
-                        } else {
+                        switch (hw->mac.type) {
+                        case ixgbe_mac_82598EB: {
                                 u32 frctl = IXGBE_READ_REG(hw, IXGBE_FCTRL);
                                 u32 rmcs = IXGBE_READ_REG(hw, IXGBE_RMCS);
                                 flow_rx = !!(frctl & IXGBE_FCTRL_RFCE);
                                 flow_tx = !!(rmcs & IXGBE_RMCS_TFCE_802_3X);
                         }
+                                break;
+                        case ixgbe_mac_82599EB:
+                        case ixgbe_mac_X540: {
+                                u32 mflcn = IXGBE_READ_REG(hw, IXGBE_MFLCN);
+                                u32 fccfg = IXGBE_READ_REG(hw, IXGBE_FCCFG);
+                                flow_rx = !!(mflcn & IXGBE_MFLCN_RFCE);
+                                flow_tx = !!(fccfg & IXGBE_FCCFG_TFCE_802_3X);
+                        }
+                                break;
+                        default:
+                                flow_tx = false;
+                                flow_rx = false;
+                                break;
+                        }
 
                         e_info(drv, "NIC Link is Up %s, Flow Control: %s\n",
                                (link_speed == IXGBE_LINK_SPEED_10GB_FULL ?
@@ -5791,7 +6047,10 @@ static void ixgbe_watchdog_task(struct work_struct *work)
                         netif_carrier_on(netdev);
                 } else {
                         /* Force detection of hung controller */
-                        adapter->detect_tx_hung = true;
+                        for (i = 0; i < adapter->num_tx_queues; i++) {
+                                tx_ring = adapter->tx_ring[i];
+                                set_check_for_tx_hang(tx_ring);
+                        }
                 }
         } else {
                 adapter->link_up = false;
@@ -6003,15 +6262,17 @@ static bool ixgbe_tx_csum(struct ixgbe_adapter *adapter,
 static int ixgbe_tx_map(struct ixgbe_adapter *adapter,
                         struct ixgbe_ring *tx_ring,
                         struct sk_buff *skb, u32 tx_flags,
-                        unsigned int first)
+                        unsigned int first, const u8 hdr_len)
 {
-        struct pci_dev *pdev = adapter->pdev;
+        struct device *dev = tx_ring->dev;
         struct ixgbe_tx_buffer *tx_buffer_info;
         unsigned int len;
         unsigned int total = skb->len;
         unsigned int offset = 0, size, count = 0, i;
         unsigned int nr_frags = skb_shinfo(skb)->nr_frags;
         unsigned int f;
+        unsigned int bytecount = skb->len;
+        u16 gso_segs = 1;
 
         i = tx_ring->next_to_use;
 
@@ -6026,10 +6287,10 @@ static int ixgbe_tx_map(struct ixgbe_adapter *adapter,
 
                 tx_buffer_info->length = size;
                 tx_buffer_info->mapped_as_page = false;
-                tx_buffer_info->dma = dma_map_single(&pdev->dev,
+                tx_buffer_info->dma = dma_map_single(dev,
                                                      skb->data + offset,
                                                      size, DMA_TO_DEVICE);
-                if (dma_mapping_error(&pdev->dev, tx_buffer_info->dma))
+                if (dma_mapping_error(dev, tx_buffer_info->dma))
                         goto dma_error;
                 tx_buffer_info->time_stamp = jiffies;
                 tx_buffer_info->next_to_watch = i;
@@ -6062,12 +6323,12 @@ static int ixgbe_tx_map(struct ixgbe_adapter *adapter,
                         size = min(len, (uint)IXGBE_MAX_DATA_PER_TXD);
 
                         tx_buffer_info->length = size;
-                        tx_buffer_info->dma = dma_map_page(&adapter->pdev->dev,
+                        tx_buffer_info->dma = dma_map_page(dev,
                                                            frag->page,
                                                            offset, size,
                                                            DMA_TO_DEVICE);
                         tx_buffer_info->mapped_as_page = true;
-                        if (dma_mapping_error(&pdev->dev, tx_buffer_info->dma))
+                        if (dma_mapping_error(dev, tx_buffer_info->dma))
                                 goto dma_error;
                         tx_buffer_info->time_stamp = jiffies;
                         tx_buffer_info->next_to_watch = i;
@@ -6081,6 +6342,19 @@ static int ixgbe_tx_map(struct ixgbe_adapter *adapter,
                         break;
         }
 
+        if (tx_flags & IXGBE_TX_FLAGS_TSO)
+                gso_segs = skb_shinfo(skb)->gso_segs;
+#ifdef IXGBE_FCOE
+        /* adjust for FCoE Sequence Offload */
+        else if (tx_flags & IXGBE_TX_FLAGS_FSO)
+                gso_segs = DIV_ROUND_UP(skb->len - hdr_len,
+                                        skb_shinfo(skb)->gso_size);
+#endif /* IXGBE_FCOE */
+        bytecount += (gso_segs - 1) * hdr_len;
+
+        /* multiply data chunks by size of headers */
+        tx_ring->tx_buffer_info[i].bytecount = bytecount;
+        tx_ring->tx_buffer_info[i].gso_segs = gso_segs;
         tx_ring->tx_buffer_info[i].skb = skb;
         tx_ring->tx_buffer_info[first].next_to_watch = i;
 
@@ -6102,14 +6376,13 @@ dma_error:
                         i += tx_ring->count;
                 i--;
                 tx_buffer_info = &tx_ring->tx_buffer_info[i];
-                ixgbe_unmap_and_free_tx_resource(adapter, tx_buffer_info);
+                ixgbe_unmap_and_free_tx_resource(tx_ring, tx_buffer_info);
         }
 
         return 0;
 }
 
-static void ixgbe_tx_queue(struct ixgbe_adapter *adapter,
-                           struct ixgbe_ring *tx_ring,
+static void ixgbe_tx_queue(struct ixgbe_ring *tx_ring,
                            int tx_flags, int count, u32 paylen, u8 hdr_len)
 {
         union ixgbe_adv_tx_desc *tx_desc = NULL;
@@ -6174,60 +6447,46 @@ static void ixgbe_tx_queue(struct ixgbe_adapter *adapter,
         wmb();
 
         tx_ring->next_to_use = i;
-        writel(i, adapter->hw.hw_addr + tx_ring->tail);
+        writel(i, tx_ring->tail);
 }
 
 static void ixgbe_atr(struct ixgbe_adapter *adapter, struct sk_buff *skb,
-                      int queue, u32 tx_flags, __be16 protocol)
+                      u8 queue, u32 tx_flags, __be16 protocol)
 {
         struct ixgbe_atr_input atr_input;
-        struct tcphdr *th;
         struct iphdr *iph = ip_hdr(skb);
         struct ethhdr *eth = (struct ethhdr *)skb->data;
-        u16 vlan_id, src_port, dst_port, flex_bytes;
-        u32 src_ipv4_addr, dst_ipv4_addr;
-        u8 l4type = 0;
+        struct tcphdr *th;
+        u16 vlan_id;
 
-        /* Right now, we support IPv4 only */
-        if (protocol != htons(ETH_P_IP))
+        /* Right now, we support IPv4 w/ TCP only */
+        if (protocol != htons(ETH_P_IP) ||
+            iph->protocol != IPPROTO_TCP)
                 return;
-        /* check if we're UDP or TCP */
-        if (iph->protocol == IPPROTO_TCP) {
-                th = tcp_hdr(skb);
-                src_port = th->source;
-                dst_port = th->dest;
-                l4type |= IXGBE_ATR_L4TYPE_TCP;
-                /* l4type IPv4 type is 0, no need to assign */
-        } else {
-                /* Unsupported L4 header, just bail here */
-                return;
-        }
 
         memset(&atr_input, 0, sizeof(struct ixgbe_atr_input));
 
         vlan_id = (tx_flags & IXGBE_TX_FLAGS_VLAN_MASK) >>
                    IXGBE_TX_FLAGS_VLAN_SHIFT;
-        src_ipv4_addr = iph->saddr;
-        dst_ipv4_addr = iph->daddr;
-        flex_bytes = eth->h_proto;
+
+        th = tcp_hdr(skb);
 
         ixgbe_atr_set_vlan_id_82599(&atr_input, vlan_id);
-        ixgbe_atr_set_src_port_82599(&atr_input, dst_port);
-        ixgbe_atr_set_dst_port_82599(&atr_input, src_port);
-        ixgbe_atr_set_flex_byte_82599(&atr_input, flex_bytes);
-        ixgbe_atr_set_l4type_82599(&atr_input, l4type);
+        ixgbe_atr_set_src_port_82599(&atr_input, th->dest);
+        ixgbe_atr_set_dst_port_82599(&atr_input, th->source);
+        ixgbe_atr_set_flex_byte_82599(&atr_input, eth->h_proto);
+        ixgbe_atr_set_l4type_82599(&atr_input, IXGBE_ATR_L4TYPE_TCP);
         /* src and dst are inverted, think how the receiver sees them */
-        ixgbe_atr_set_src_ipv4_82599(&atr_input, dst_ipv4_addr);
-        ixgbe_atr_set_dst_ipv4_82599(&atr_input, src_ipv4_addr);
+        ixgbe_atr_set_src_ipv4_82599(&atr_input, iph->daddr);
+        ixgbe_atr_set_dst_ipv4_82599(&atr_input, iph->saddr);
 
         /* This assumes the Rx queue and Tx queue are bound to the same CPU */
         ixgbe_fdir_add_signature_filter_82599(&adapter->hw, &atr_input, queue);
 }
 
-static int __ixgbe_maybe_stop_tx(struct net_device *netdev,
-                                 struct ixgbe_ring *tx_ring, int size)
+static int __ixgbe_maybe_stop_tx(struct ixgbe_ring *tx_ring, int size)
 {
-        netif_stop_subqueue(netdev, tx_ring->queue_index);
+        netif_stop_subqueue(tx_ring->netdev, tx_ring->queue_index);
         /* Herbert's original patch had:
          *  smp_mb__after_netif_stop_queue();
          * but since that doesn't exist yet, just open code it. */
@@ -6239,17 +6498,16 @@ static int __ixgbe_maybe_stop_tx(struct net_device *netdev,
                 return -EBUSY;
 
         /* A reprieve! - use start_queue because it doesn't call schedule */
-        netif_start_subqueue(netdev, tx_ring->queue_index);
-        ++tx_ring->restart_queue;
+        netif_start_subqueue(tx_ring->netdev, tx_ring->queue_index);
+        ++tx_ring->tx_stats.restart_queue;
         return 0;
 }
 
-static int ixgbe_maybe_stop_tx(struct net_device *netdev,
-                              struct ixgbe_ring *tx_ring, int size)
+static int ixgbe_maybe_stop_tx(struct ixgbe_ring *tx_ring, int size)
 {
         if (likely(IXGBE_DESC_UNUSED(tx_ring) >= size))
                 return 0;
-        return __ixgbe_maybe_stop_tx(netdev, tx_ring, size);
+        return __ixgbe_maybe_stop_tx(tx_ring, size);
 }
 
 static u16 ixgbe_select_queue(struct net_device *dev, struct sk_buff *skb)
@@ -6294,10 +6552,11 @@ static u16 ixgbe_select_queue(struct net_device *dev, struct sk_buff *skb)
         return skb_tx_hash(dev, skb);
 }
 
-netdev_tx_t ixgbe_xmit_frame_ring(struct sk_buff *skb, struct net_device *netdev,
+netdev_tx_t ixgbe_xmit_frame_ring(struct sk_buff *skb,
                           struct ixgbe_adapter *adapter,
                           struct ixgbe_ring *tx_ring)
 {
+        struct net_device *netdev = tx_ring->netdev;
         struct netdev_queue *txq;
         unsigned int first;
         unsigned int tx_flags = 0;
@@ -6355,8 +6614,8 @@ netdev_tx_t ixgbe_xmit_frame_ring(struct sk_buff *skb, struct net_device *netdev
         for (f = 0; f < skb_shinfo(skb)->nr_frags; f++)
                 count += TXD_USE_COUNT(skb_shinfo(skb)->frags[f].size);
 
-        if (ixgbe_maybe_stop_tx(netdev, tx_ring, count)) {
-                adapter->tx_busy++;
+        if (ixgbe_maybe_stop_tx(tx_ring, count)) {
+                tx_ring->tx_stats.tx_busy++;
                 return NETDEV_TX_BUSY;
         }
 
@@ -6390,14 +6649,14 @@ netdev_tx_t ixgbe_xmit_frame_ring(struct sk_buff *skb, struct net_device *netdev
                         tx_flags |= IXGBE_TX_FLAGS_CSUM;
         }
 
-        count = ixgbe_tx_map(adapter, tx_ring, skb, tx_flags, first);
+        count = ixgbe_tx_map(adapter, tx_ring, skb, tx_flags, first, hdr_len);
         if (count) {
                 /* add the ATR filter if ATR is on */
                 if (tx_ring->atr_sample_rate) {
                         ++tx_ring->atr_count;
                         if ((tx_ring->atr_count >= tx_ring->atr_sample_rate) &&
-                             test_bit(__IXGBE_FDIR_INIT_DONE,
-                                      &tx_ring->reinit_state)) {
+                             test_bit(__IXGBE_TX_FDIR_INIT_DONE,
+                                      &tx_ring->state)) {
                                 ixgbe_atr(adapter, skb, tx_ring->queue_index,
                                           tx_flags, protocol);
                                 tx_ring->atr_count = 0;
@@ -6406,9 +6665,8 @@ netdev_tx_t ixgbe_xmit_frame_ring(struct sk_buff *skb, struct net_device *netdev
                 txq = netdev_get_tx_queue(netdev, tx_ring->queue_index);
                 txq->tx_bytes += skb->len;
                 txq->tx_packets++;
-                ixgbe_tx_queue(adapter, tx_ring, tx_flags, count, skb->len,
-                               hdr_len);
-                ixgbe_maybe_stop_tx(netdev, tx_ring, DESC_NEEDED);
+                ixgbe_tx_queue(tx_ring, tx_flags, count, skb->len, hdr_len);
+                ixgbe_maybe_stop_tx(tx_ring, DESC_NEEDED);
 
         } else {
                 dev_kfree_skb_any(skb);
@@ -6425,7 +6683,7 @@ static netdev_tx_t ixgbe_xmit_frame(struct sk_buff *skb, struct net_device *netd
         struct ixgbe_ring *tx_ring;
 
         tx_ring = adapter->tx_ring[skb->queue_mapping];
-        return ixgbe_xmit_frame_ring(skb, netdev, adapter, tx_ring);
+        return ixgbe_xmit_frame_ring(skb, adapter, tx_ring);
 }
 
 /**
@@ -6566,20 +6824,23 @@ static struct rtnl_link_stats64 *ixgbe_get_stats64(struct net_device *netdev,
 
         /* accurate rx/tx bytes/packets stats */
         dev_txq_stats_fold(netdev, stats);
+        rcu_read_lock();
         for (i = 0; i < adapter->num_rx_queues; i++) {
-                struct ixgbe_ring *ring = adapter->rx_ring[i];
+                struct ixgbe_ring *ring = ACCESS_ONCE(adapter->rx_ring[i]);
                 u64 bytes, packets;
                 unsigned int start;
 
-                do {
-                        start = u64_stats_fetch_begin_bh(&ring->syncp);
-                        packets = ring->stats.packets;
-                        bytes   = ring->stats.bytes;
-                } while (u64_stats_fetch_retry_bh(&ring->syncp, start));
-                stats->rx_packets += packets;
-                stats->rx_bytes   += bytes;
+                if (ring) {
+                        do {
+                                start = u64_stats_fetch_begin_bh(&ring->syncp);
+                                packets = ring->stats.packets;
+                                bytes   = ring->stats.bytes;
+                        } while (u64_stats_fetch_retry_bh(&ring->syncp, start));
+                        stats->rx_packets += packets;
+                        stats->rx_bytes   += bytes;
+                }
         }
-
+        rcu_read_unlock();
         /* following stats updated by ixgbe_watchdog_task() */
         stats->multicast        = netdev->stats.multicast;
         stats->rx_errors        = netdev->stats.rx_errors;
@@ -6694,11 +6955,12 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
         const struct ixgbe_info *ii = ixgbe_info_tbl[ent->driver_data];
         static int cards_found;
         int i, err, pci_using_dac;
+        u8 part_str[IXGBE_PBANUM_LENGTH];
         unsigned int indices = num_possible_cpus();
 #ifdef IXGBE_FCOE
         u16 device_caps;
 #endif
-        u32 part_num, eec;
+        u32 eec;
 
         /* Catch broken hardware that put the wrong VF device ID in
          * the PCIe SR-IOV capability.
@@ -6761,8 +7023,8 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
 
         SET_NETDEV_DEV(netdev, &pdev->dev);
 
-        pci_set_drvdata(pdev, netdev);
         adapter = netdev_priv(netdev);
+        pci_set_drvdata(pdev, adapter);
 
         adapter->netdev = netdev;
         adapter->pdev = pdev;
@@ -6835,8 +7097,14 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
                 goto err_sw_init;
 
         /* Make it possible the adapter to be woken up via WOL */
-        if (adapter->hw.mac.type == ixgbe_mac_82599EB)
+        switch (adapter->hw.mac.type) {
+        case ixgbe_mac_82599EB:
+        case ixgbe_mac_X540:
                 IXGBE_WRITE_REG(&adapter->hw, IXGBE_WUS, ~0);
+                break;
+        default:
+                break;
+        }
 
         /*
          * If there is a fan on this device and it has failed log the
@@ -6944,8 +7212,11 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
                 goto err_eeprom;
         }
 
-        /* power down the optics */
-        if (hw->phy.multispeed_fiber)
+        /* power down the optics for multispeed fiber and 82599 SFP+ fiber */
+        if (hw->mac.ops.disable_tx_laser &&
+            ((hw->phy.multispeed_fiber) ||
+             ((hw->mac.ops.get_media_type(hw) == ixgbe_media_type_fiber) &&
+              (hw->mac.type == ixgbe_mac_82599EB))))
                 hw->mac.ops.disable_tx_laser(hw);
 
         init_timer(&adapter->watchdog_timer);
@@ -6960,6 +7231,18 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
                 goto err_sw_init;
 
         switch (pdev->device) {
+        case IXGBE_DEV_ID_82599_SFP:
+                /* Only this subdevice supports WOL */
+                if (pdev->subsystem_device == IXGBE_SUBDEV_ID_82599_SFP)
+                        adapter->wol = (IXGBE_WUFC_MAG | IXGBE_WUFC_EX |
+                                        IXGBE_WUFC_MC | IXGBE_WUFC_BC);
+                break;
+        case IXGBE_DEV_ID_82599_COMBO_BACKPLANE:
+                /* All except this subdevice support WOL */
+                if (pdev->subsystem_device != IXGBE_SUBDEV_ID_82599_KX4_KR_MEZZ)
+                        adapter->wol = (IXGBE_WUFC_MAG | IXGBE_WUFC_EX |
+                                        IXGBE_WUFC_MC | IXGBE_WUFC_BC);
+                break;
         case IXGBE_DEV_ID_82599_KX4:
                 adapter->wol = (IXGBE_WUFC_MAG | IXGBE_WUFC_EX |
                                 IXGBE_WUFC_MC | IXGBE_WUFC_BC);
@@ -6983,16 +7266,17 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
                     hw->bus.width == ixgbe_bus_width_pcie_x1 ? "Width x1" :
                     "Unknown"),
                    netdev->dev_addr);
-        ixgbe_read_pba_num_generic(hw, &part_num);
+
+        err = ixgbe_read_pba_string_generic(hw, part_str, IXGBE_PBANUM_LENGTH);
+        if (err)
+                strcpy(part_str, "Unknown");
         if (ixgbe_is_sfp(hw) && hw->phy.sfp_type != ixgbe_sfp_type_not_present)
-                e_dev_info("MAC: %d, PHY: %d, SFP+: %d, "
-                           "PBA No: %06x-%03x\n",
+                e_dev_info("MAC: %d, PHY: %d, SFP+: %d, PBA No: %s\n",
                            hw->mac.type, hw->phy.type, hw->phy.sfp_type,
-                           (part_num >> 8), (part_num & 0xff));
+                           part_str);
         else
-                e_dev_info("MAC: %d, PHY: %d, PBA No: %06x-%03x\n",
-                           hw->mac.type, hw->phy.type,
-                           (part_num >> 8), (part_num & 0xff));
+                e_dev_info("MAC: %d, PHY: %d, PBA No: %s\n",
+                           hw->mac.type, hw->phy.type, part_str);
 
         if (hw->bus.width <= ixgbe_bus_width_pcie_x4) {
                 e_dev_warn("PCI-Express bandwidth available for this card is "
@@ -7085,8 +7369,8 @@ err_dma:
  **/
 static void __devexit ixgbe_remove(struct pci_dev *pdev)
 {
-        struct net_device *netdev = pci_get_drvdata(pdev);
-        struct ixgbe_adapter *adapter = netdev_priv(netdev);
+        struct ixgbe_adapter *adapter = pci_get_drvdata(pdev);
+        struct net_device *netdev = adapter->netdev;
 
         set_bit(__IXGBE_DOWN, &adapter->state);
         /* clear the module not found bit to make sure the worker won't
@@ -7156,8 +7440,8 @@ static void __devexit ixgbe_remove(struct pci_dev *pdev)
 static pci_ers_result_t ixgbe_io_error_detected(struct pci_dev *pdev,
                                                 pci_channel_state_t state)
 {
-        struct net_device *netdev = pci_get_drvdata(pdev);
-        struct ixgbe_adapter *adapter = netdev_priv(netdev);
+        struct ixgbe_adapter *adapter = pci_get_drvdata(pdev);
+        struct net_device *netdev = adapter->netdev;
 
         netif_device_detach(netdev);
 
@@ -7180,8 +7464,7 @@ static pci_ers_result_t ixgbe_io_error_detected(struct pci_dev *pdev,
  */
 static pci_ers_result_t ixgbe_io_slot_reset(struct pci_dev *pdev)
 {
-        struct net_device *netdev = pci_get_drvdata(pdev);
-        struct ixgbe_adapter *adapter = netdev_priv(netdev);
+        struct ixgbe_adapter *adapter = pci_get_drvdata(pdev);
         pci_ers_result_t result;
         int err;
 
@@ -7219,8 +7502,8 @@ static pci_ers_result_t ixgbe_io_slot_reset(struct pci_dev *pdev)
  */
 static void ixgbe_io_resume(struct pci_dev *pdev)
 {
-        struct net_device *netdev = pci_get_drvdata(pdev);
-        struct ixgbe_adapter *adapter = netdev_priv(netdev);
+        struct ixgbe_adapter *adapter = pci_get_drvdata(pdev);
+        struct net_device *netdev = adapter->netdev;
 
         if (netif_running(netdev)) {
                 if (ixgbe_up(adapter)) {
@@ -7285,6 +7568,7 @@ static void __exit ixgbe_exit_module(void)
         dca_unregister_notify(&dca_notifier);
 #endif
         pci_unregister_driver(&ixgbe_driver);
+        rcu_barrier(); /* Wait for completion of call_rcu()'s */
 }
 
 #ifdef CONFIG_IXGBE_DCA
diff --git a/drivers/net/ixgbe/ixgbe_mbx.c b/drivers/net/ixgbe/ixgbe_mbx.c
index 471f0f2cdb9..027c628c3aa 100644
--- a/drivers/net/ixgbe/ixgbe_mbx.c
+++ b/drivers/net/ixgbe/ixgbe_mbx.c
@@ -319,8 +319,14 @@ static s32 ixgbe_check_for_rst_pf(struct ixgbe_hw *hw, u16 vf_number)
         u32 vflre = 0;
         s32 ret_val = IXGBE_ERR_MBX;
 
-        if (hw->mac.type == ixgbe_mac_82599EB)
+        switch (hw->mac.type) {
+        case ixgbe_mac_82599EB:
+        case ixgbe_mac_X540:
                 vflre = IXGBE_READ_REG(hw, IXGBE_VFLRE(reg_offset));
+                break;
+        default:
+                break;
+        }
 
         if (vflre & (1 << vf_shift)) {
                 ret_val = 0;
@@ -439,22 +445,26 @@ void ixgbe_init_mbx_params_pf(struct ixgbe_hw *hw)
 {
         struct ixgbe_mbx_info *mbx = &hw->mbx;
 
-        if (hw->mac.type != ixgbe_mac_82599EB)
-                return;
-
-        mbx->timeout = 0;
-        mbx->usec_delay = 0;
-
-        mbx->size = IXGBE_VFMAILBOX_SIZE;
-
-        mbx->stats.msgs_tx = 0;
-        mbx->stats.msgs_rx = 0;
-        mbx->stats.reqs = 0;
-        mbx->stats.acks = 0;
-        mbx->stats.rsts = 0;
+        switch (hw->mac.type) {
+        case ixgbe_mac_82599EB:
+        case ixgbe_mac_X540:
+                mbx->timeout = 0;
+                mbx->usec_delay = 0;
+
+                mbx->size = IXGBE_VFMAILBOX_SIZE;
+
+                mbx->stats.msgs_tx = 0;
+                mbx->stats.msgs_rx = 0;
+                mbx->stats.reqs = 0;
+                mbx->stats.acks = 0;
+                mbx->stats.rsts = 0;
+                break;
+        default:
+                break;
+        }
 }
 
-struct ixgbe_mbx_operations mbx_ops_82599 = {
+struct ixgbe_mbx_operations mbx_ops_generic = {
         .read                   = ixgbe_read_mbx_pf,
         .write                  = ixgbe_write_mbx_pf,
         .read_posted            = ixgbe_read_posted_mbx,
diff --git a/drivers/net/ixgbe/ixgbe_mbx.h b/drivers/net/ixgbe/ixgbe_mbx.h
index 7e0d08ff5b5..3df9b159021 100644
--- a/drivers/net/ixgbe/ixgbe_mbx.h
+++ b/drivers/net/ixgbe/ixgbe_mbx.h
@@ -88,6 +88,6 @@ s32 ixgbe_check_for_ack(struct ixgbe_hw *, u16);
 s32 ixgbe_check_for_rst(struct ixgbe_hw *, u16);
 void ixgbe_init_mbx_params_pf(struct ixgbe_hw *);
 
-extern struct ixgbe_mbx_operations mbx_ops_82599;
+extern struct ixgbe_mbx_operations mbx_ops_generic;
 
 #endif /* _IXGBE_MBX_H_ */
diff --git a/drivers/net/ixgbe/ixgbe_phy.c b/drivers/net/ixgbe/ixgbe_phy.c
index 6c0d42e33f2..c445fbce56e 100644
--- a/drivers/net/ixgbe/ixgbe_phy.c
+++ b/drivers/net/ixgbe/ixgbe_phy.c
@@ -115,6 +115,9 @@ static enum ixgbe_phy_type ixgbe_get_phy_type_from_id(u32 phy_id)
         case TN1010_PHY_ID:
                 phy_type = ixgbe_phy_tn;
                 break;
+        case AQ1202_PHY_ID:
+                phy_type = ixgbe_phy_aq;
+                break;
         case QT2022_PHY_ID:
                 phy_type = ixgbe_phy_qt;
                 break;
@@ -425,6 +428,39 @@ s32 ixgbe_setup_phy_link_speed_generic(struct ixgbe_hw *hw,
 }
 
 /**
+ * ixgbe_get_copper_link_capabilities_generic - Determines link capabilities
+ * @hw: pointer to hardware structure
+ * @speed: pointer to link speed
+ * @autoneg: boolean auto-negotiation value
+ *
+ * Determines the link capabilities by reading the AUTOC register.
+ */
+s32 ixgbe_get_copper_link_capabilities_generic(struct ixgbe_hw *hw,
+                                               ixgbe_link_speed *speed,
+                                               bool *autoneg)
+{
+        s32 status = IXGBE_ERR_LINK_SETUP;
+        u16 speed_ability;
+
+        *speed = 0;
+        *autoneg = true;
+
+        status = hw->phy.ops.read_reg(hw, MDIO_SPEED, MDIO_MMD_PMAPMD,
+                                      &speed_ability);
+
+        if (status == 0) {
+                if (speed_ability & MDIO_SPEED_10G)
+                        *speed |= IXGBE_LINK_SPEED_10GB_FULL;
+                if (speed_ability & MDIO_PMA_SPEED_1000)
+                        *speed |= IXGBE_LINK_SPEED_1GB_FULL;
+                if (speed_ability & MDIO_PMA_SPEED_100)
+                        *speed |= IXGBE_LINK_SPEED_100_FULL;
+        }
+
+        return status;
+}
+
+/**
  *  ixgbe_reset_phy_nl - Performs a PHY reset
  *  @hw: pointer to hardware structure
  **/
@@ -1378,6 +1414,22 @@ s32 ixgbe_get_phy_firmware_version_tnx(struct ixgbe_hw *hw,
 }
 
 /**
+ *  ixgbe_get_phy_firmware_version_generic - Gets the PHY Firmware Version
+ *  @hw: pointer to hardware structure
+ *  @firmware_version: pointer to the PHY Firmware Version
+**/
+s32 ixgbe_get_phy_firmware_version_generic(struct ixgbe_hw *hw,
+                                           u16 *firmware_version)
+{
+        s32 status = 0;
+
+        status = hw->phy.ops.read_reg(hw, AQ_FW_REV, MDIO_MMD_VEND1,
+                                      firmware_version);
+
+        return status;
+}
+
+/**
  *  ixgbe_tn_check_overtemp - Checks if an overtemp occured.
  *  @hw: pointer to hardware structure
  *
diff --git a/drivers/net/ixgbe/ixgbe_phy.h b/drivers/net/ixgbe/ixgbe_phy.h
index fb3898f12fc..e2c6b7eac64 100644
--- a/drivers/net/ixgbe/ixgbe_phy.h
+++ b/drivers/net/ixgbe/ixgbe_phy.h
@@ -96,6 +96,9 @@ s32 ixgbe_setup_phy_link_speed_generic(struct ixgbe_hw *hw,
                                        ixgbe_link_speed speed,
                                        bool autoneg,
                                        bool autoneg_wait_to_complete);
+s32 ixgbe_get_copper_link_capabilities_generic(struct ixgbe_hw *hw,
+                                               ixgbe_link_speed *speed,
+                                               bool *autoneg);
 
 /* PHY specific */
 s32 ixgbe_check_phy_link_tnx(struct ixgbe_hw *hw,
@@ -103,6 +106,8 @@ s32 ixgbe_check_phy_link_tnx(struct ixgbe_hw *hw,
                              bool *link_up);
 s32 ixgbe_get_phy_firmware_version_tnx(struct ixgbe_hw *hw,
                                        u16 *firmware_version);
+s32 ixgbe_get_phy_firmware_version_generic(struct ixgbe_hw *hw,
+                                           u16 *firmware_version);
 
 s32 ixgbe_reset_phy_nl(struct ixgbe_hw *hw);
 s32 ixgbe_identify_sfp_module_generic(struct ixgbe_hw *hw);
diff --git a/drivers/net/ixgbe/ixgbe_sriov.c b/drivers/net/ixgbe/ixgbe_sriov.c
index 5428153af8f..6e3e94b5a5f 100644
--- a/drivers/net/ixgbe/ixgbe_sriov.c
+++ b/drivers/net/ixgbe/ixgbe_sriov.c
@@ -68,7 +68,7 @@ static int ixgbe_set_vf_multicasts(struct ixgbe_adapter *adapter,
          * addresses
          */
         for (i = 0; i < entries; i++) {
-                vfinfo->vf_mc_hashes[i] = hash_list[i];;
+                vfinfo->vf_mc_hashes[i] = hash_list[i];
         }
 
         for (i = 0; i < vfinfo->num_vf_mc_hashes; i++) {
@@ -178,8 +178,7 @@ static int ixgbe_set_vf_mac(struct ixgbe_adapter *adapter,
 int ixgbe_vf_configuration(struct pci_dev *pdev, unsigned int event_mask)
 {
         unsigned char vf_mac_addr[6];
-        struct net_device *netdev = pci_get_drvdata(pdev);
-        struct ixgbe_adapter *adapter = netdev_priv(netdev);
+        struct ixgbe_adapter *adapter = pci_get_drvdata(pdev);
         unsigned int vfn = (event_mask & 0x3f);
 
         bool enable = ((event_mask & 0x10000000U) != 0);
diff --git a/drivers/net/ixgbe/ixgbe_type.h b/drivers/net/ixgbe/ixgbe_type.h
index d3cc6ce7c97..0f80893edab 100644
--- a/drivers/net/ixgbe/ixgbe_type.h
+++ b/drivers/net/ixgbe/ixgbe_type.h
@@ -54,9 +54,14 @@
 #define IXGBE_DEV_ID_82599_T3_LOM        0x151C
 #define IXGBE_DEV_ID_82599_CX4           0x10F9
 #define IXGBE_DEV_ID_82599_SFP           0x10FB
+#define IXGBE_DEV_ID_82599_BACKPLANE_FCOE       0x152a
+#define IXGBE_DEV_ID_82599_SFP_FCOE      0x1529
+#define IXGBE_SUBDEV_ID_82599_SFP        0x11A9
 #define IXGBE_DEV_ID_82599_SFP_EM        0x1507
 #define IXGBE_DEV_ID_82599_XAUI_LOM      0x10FC
 #define IXGBE_DEV_ID_82599_COMBO_BACKPLANE 0x10F8
+#define IXGBE_SUBDEV_ID_82599_KX4_KR_MEZZ  0x000C
+#define IXGBE_DEV_ID_X540T               0x1528
 
 /* General Registers */
 #define IXGBE_CTRL      0x00000
@@ -994,8 +999,10 @@
 /* PHY IDs*/
 #define TN1010_PHY_ID    0x00A19410
 #define TNX_FW_REV       0xB
+#define AQ1202_PHY_ID    0x03A1B440
 #define QT2022_PHY_ID    0x0043A400
 #define ATH_PHY_ID       0x03429050
+#define AQ_FW_REV        0x20
 
 /* PHY Types */
 #define IXGBE_M88E1145_E_PHY_ID  0x01410CD0
@@ -1463,6 +1470,8 @@
 #define IXGBE_ANLP1_PAUSE               0x0C00
 #define IXGBE_ANLP1_SYM_PAUSE           0x0400
 #define IXGBE_ANLP1_ASM_PAUSE           0x0800
+#define IXGBE_ANLP1_AN_STATE_MASK       0x000f0000
+
 
 /* SW Semaphore Register bitmasks */
 #define IXGBE_SWSM_SMBI 0x00000001 /* Driver Semaphore bit */
@@ -1491,6 +1500,7 @@
 #define IXGBE_EEC_PRES      0x00000100 /* EEPROM Present */
 #define IXGBE_EEC_ARD       0x00000200 /* EEPROM Auto Read Done */
 #define IXGBE_EEC_FLUP      0x00800000 /* Flash update command */
+#define IXGBE_EEC_SEC1VAL   0x02000000 /* Sector 1 Valid */
 #define IXGBE_EEC_FLUDONE   0x04000000 /* Flash update done */
 /* EEPROM Addressing bits based on type (0-small, 1-large) */
 #define IXGBE_EEC_ADDR_SIZE 0x00000400
@@ -1500,12 +1510,18 @@
 #define IXGBE_EEPROM_WORD_SIZE_SHIFT  6
 #define IXGBE_EEPROM_OPCODE_BITS      8
 
+/* Part Number String Length */
+#define IXGBE_PBANUM_LENGTH 11
+
 /* Checksum and EEPROM pointers */
+#define IXGBE_PBANUM_PTR_GUARD  0xFAFA
 #define IXGBE_EEPROM_CHECKSUM   0x3F
 #define IXGBE_EEPROM_SUM        0xBABA
 #define IXGBE_PCIE_ANALOG_PTR   0x03
 #define IXGBE_ATLAS0_CONFIG_PTR 0x04
+#define IXGBE_PHY_PTR           0x04
 #define IXGBE_ATLAS1_CONFIG_PTR 0x05
+#define IXGBE_OPTION_ROM_PTR    0x05
 #define IXGBE_PCIE_GENERAL_PTR  0x06
 #define IXGBE_PCIE_CONFIG0_PTR  0x07
 #define IXGBE_PCIE_CONFIG1_PTR  0x08
@@ -2113,6 +2129,14 @@ typedef u32 ixgbe_physical_layer;
 #define IXGBE_PHYSICAL_LAYER_10GBASE_XAUI 0x1000
 #define IXGBE_PHYSICAL_LAYER_SFP_ACTIVE_DA 0x2000
 
+/* Flow Control Macros */
+#define PAUSE_RTT       8
+#define PAUSE_MTU(MTU)  ((MTU + 1024 - 1) / 1024)
+
+#define FC_HIGH_WATER(MTU) ((((PAUSE_RTT + PAUSE_MTU(MTU)) * 144) + 99) / 100 +\
+                                PAUSE_MTU(MTU))
+#define FC_LOW_WATER(MTU)  (2 * (2 * PAUSE_MTU(MTU) + PAUSE_RTT))
+
 /* Software ATR hash keys */
 #define IXGBE_ATR_BUCKET_HASH_KEY    0xE214AD3D
 #define IXGBE_ATR_SIGNATURE_HASH_KEY 0x14364D17
@@ -2164,6 +2188,7 @@ struct ixgbe_atr_input_masks {
 enum ixgbe_eeprom_type {
         ixgbe_eeprom_uninitialized = 0,
         ixgbe_eeprom_spi,
+        ixgbe_flash,
         ixgbe_eeprom_none /* No NVM support */
 };
 
@@ -2171,12 +2196,14 @@ enum ixgbe_mac_type {
         ixgbe_mac_unknown = 0,
         ixgbe_mac_82598EB,
         ixgbe_mac_82599EB,
+        ixgbe_mac_X540,
         ixgbe_num_macs
 };
 
 enum ixgbe_phy_type {
         ixgbe_phy_unknown = 0,
         ixgbe_phy_tn,
+        ixgbe_phy_aq,
         ixgbe_phy_cu_unknown,
         ixgbe_phy_qt,
         ixgbe_phy_xaui,
@@ -2405,6 +2432,7 @@ struct ixgbe_eeprom_operations {
         s32 (*write)(struct ixgbe_hw *, u16, u16);
         s32 (*validate_checksum)(struct ixgbe_hw *, u16 *);
         s32 (*update_checksum)(struct ixgbe_hw *);
+        u16 (*calc_checksum)(struct ixgbe_hw *);
 };
 
 struct ixgbe_mac_operations {
@@ -2574,6 +2602,7 @@ struct ixgbe_hw {
         u16                             subsystem_vendor_id;
         u8                              revision_id;
         bool                            adapter_stopped;
+        bool                            force_full_reset;
 };
 
 struct ixgbe_info {
@@ -2614,6 +2643,9 @@ struct ixgbe_info {
 #define IXGBE_ERR_NO_SPACE                      -25
 #define IXGBE_ERR_OVERTEMP                      -26
 #define IXGBE_ERR_RAR_INDEX                     -27
+#define IXGBE_ERR_SFP_SETUP_NOT_COMPLETE        -30
+#define IXGBE_ERR_PBA_SECTION                   -31
+#define IXGBE_ERR_INVALID_ARGUMENT              -32
 #define IXGBE_NOT_IMPLEMENTED                   0x7FFFFFFF
 
 #endif /* _IXGBE_TYPE_H_ */
diff --git a/drivers/net/ixgbe/ixgbe_x540.c b/drivers/net/ixgbe/ixgbe_x540.c
new file mode 100644
index 00000000000..9649fa727e3
--- /dev/null
+++ b/drivers/net/ixgbe/ixgbe_x540.c
@@ -0,0 +1,722 @@
+/*******************************************************************************
+
+  Intel 10 Gigabit PCI Express Linux driver
+  Copyright(c) 1999 - 2010 Intel Corporation.
+
+  This program is free software; you can redistribute it and/or modify it
+  under the terms and conditions of the GNU General Public License,
+  version 2, as published by the Free Software Foundation.
+
+  This program is distributed in the hope it will be useful, but WITHOUT
+  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+  more details.
+
+  You should have received a copy of the GNU General Public License along with
+  this program; if not, write to the Free Software Foundation, Inc.,
+  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+
+  The full GNU General Public License is included in this distribution in
+  the file called "COPYING".
+
+  Contact Information:
+  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
+  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+
+*******************************************************************************/
+
+#include <linux/pci.h>
+#include <linux/delay.h>
+#include <linux/sched.h>
+
+#include "ixgbe.h"
+#include "ixgbe_phy.h"
+//#include "ixgbe_mbx.h"
+
+#define IXGBE_X540_MAX_TX_QUEUES 128
+#define IXGBE_X540_MAX_RX_QUEUES 128
+#define IXGBE_X540_RAR_ENTRIES   128
+#define IXGBE_X540_MC_TBL_SIZE   128
+#define IXGBE_X540_VFT_TBL_SIZE  128
+
+static s32 ixgbe_update_flash_X540(struct ixgbe_hw *hw);
+static s32 ixgbe_poll_flash_update_done_X540(struct ixgbe_hw *hw);
+static s32 ixgbe_acquire_swfw_sync_X540(struct ixgbe_hw *hw, u16 mask);
+static void ixgbe_release_swfw_sync_X540(struct ixgbe_hw *hw, u16 mask);
+static s32 ixgbe_get_swfw_sync_semaphore(struct ixgbe_hw *hw);
+static void ixgbe_release_swfw_sync_semaphore(struct ixgbe_hw *hw);
+
+static enum ixgbe_media_type ixgbe_get_media_type_X540(struct ixgbe_hw *hw)
+{
+        return ixgbe_media_type_copper;
+}
+
+static s32 ixgbe_get_invariants_X540(struct ixgbe_hw *hw)
+{
+        struct ixgbe_mac_info *mac = &hw->mac;
+
+        /* Call PHY identify routine to get the phy type */
+        ixgbe_identify_phy_generic(hw);
+
+        mac->mcft_size = IXGBE_X540_MC_TBL_SIZE;
+        mac->vft_size = IXGBE_X540_VFT_TBL_SIZE;
+        mac->num_rar_entries = IXGBE_X540_RAR_ENTRIES;
+        mac->max_rx_queues = IXGBE_X540_MAX_RX_QUEUES;
+        mac->max_tx_queues = IXGBE_X540_MAX_TX_QUEUES;
+        mac->max_msix_vectors = ixgbe_get_pcie_msix_count_generic(hw);
+
+        return 0;
+}
+
+/**
+ *  ixgbe_setup_mac_link_X540 - Set the auto advertised capabilitires
+ *  @hw: pointer to hardware structure
+ *  @speed: new link speed
+ *  @autoneg: true if autonegotiation enabled
+ *  @autoneg_wait_to_complete: true when waiting for completion is needed
+ **/
+static s32 ixgbe_setup_mac_link_X540(struct ixgbe_hw *hw,
+                                     ixgbe_link_speed speed, bool autoneg,
+                                     bool autoneg_wait_to_complete)
+{
+        return hw->phy.ops.setup_link_speed(hw, speed, autoneg,
+                                            autoneg_wait_to_complete);
+}
+
+/**
+ *  ixgbe_reset_hw_X540 - Perform hardware reset
+ *  @hw: pointer to hardware structure
+ *
+ *  Resets the hardware by resetting the transmit and receive units, masks
+ *  and clears all interrupts, perform a PHY reset, and perform a link (MAC)
+ *  reset.
+ **/
+static s32 ixgbe_reset_hw_X540(struct ixgbe_hw *hw)
+{
+        ixgbe_link_speed link_speed;
+        s32 status = 0;
+        u32 ctrl;
+        u32 ctrl_ext;
+        u32 reset_bit;
+        u32 i;
+        u32 autoc;
+        u32 autoc2;
+        bool link_up = false;
+
+        /* Call adapter stop to disable tx/rx and clear interrupts */
+        hw->mac.ops.stop_adapter(hw);
+
+        /*
+         * Prevent the PCI-E bus from from hanging by disabling PCI-E master
+         * access and verify no pending requests before reset
+         */
+        status = ixgbe_disable_pcie_master(hw);
+        if (status != 0) {
+                status = IXGBE_ERR_MASTER_REQUESTS_PENDING;
+                hw_dbg(hw, "PCI-E Master disable polling has failed.\n");
+        }
+
+        /*
+         * Issue global reset to the MAC.  Needs to be SW reset if link is up.
+         * If link reset is used when link is up, it might reset the PHY when
+         * mng is using it.  If link is down or the flag to force full link
+         * reset is set, then perform link reset.
+         */
+        if (hw->force_full_reset) {
+                reset_bit = IXGBE_CTRL_LNK_RST;
+        } else {
+                hw->mac.ops.check_link(hw, &link_speed, &link_up, false);
+                if (!link_up)
+                        reset_bit = IXGBE_CTRL_LNK_RST;
+                else
+                        reset_bit = IXGBE_CTRL_RST;
+        }
+
+        ctrl = IXGBE_READ_REG(hw, IXGBE_CTRL);
+        IXGBE_WRITE_REG(hw, IXGBE_CTRL, (ctrl | IXGBE_CTRL_RST));
+        IXGBE_WRITE_FLUSH(hw);
+
+        /* Poll for reset bit to self-clear indicating reset is complete */
+        for (i = 0; i < 10; i++) {
+                udelay(1);
+                ctrl = IXGBE_READ_REG(hw, IXGBE_CTRL);
+                if (!(ctrl & IXGBE_CTRL_RST))
+                        break;
+        }
+        if (ctrl & IXGBE_CTRL_RST) {
+                status = IXGBE_ERR_RESET_FAILED;
+                hw_dbg(hw, "Reset polling failed to complete.\n");
+        }
+
+        /* Clear PF Reset Done bit so PF/VF Mail Ops can work */
+        ctrl_ext = IXGBE_READ_REG(hw, IXGBE_CTRL_EXT);
+        ctrl_ext |= IXGBE_CTRL_EXT_PFRSTD;
+        IXGBE_WRITE_REG(hw, IXGBE_CTRL_EXT, ctrl_ext);
+
+        msleep(50);
+
+        /* Set the Rx packet buffer size. */
+        IXGBE_WRITE_REG(hw, IXGBE_RXPBSIZE(0), 384 << IXGBE_RXPBSIZE_SHIFT);
+
+        /* Store the permanent mac address */
+        hw->mac.ops.get_mac_addr(hw, hw->mac.perm_addr);
+
+        /*
+         * Store the original AUTOC/AUTOC2 values if they have not been
+         * stored off yet.  Otherwise restore the stored original
+         * values since the reset operation sets back to defaults.
+         */
+        autoc = IXGBE_READ_REG(hw, IXGBE_AUTOC);
+        autoc2 = IXGBE_READ_REG(hw, IXGBE_AUTOC2);
+        if (hw->mac.orig_link_settings_stored == false) {
+                hw->mac.orig_autoc = autoc;
+                hw->mac.orig_autoc2 = autoc2;
+                hw->mac.orig_link_settings_stored = true;
+        } else {
+                if (autoc != hw->mac.orig_autoc)
+                        IXGBE_WRITE_REG(hw, IXGBE_AUTOC, (hw->mac.orig_autoc |
+                                        IXGBE_AUTOC_AN_RESTART));
+
+                if ((autoc2 & IXGBE_AUTOC2_UPPER_MASK) !=
+                    (hw->mac.orig_autoc2 & IXGBE_AUTOC2_UPPER_MASK)) {
+                        autoc2 &= ~IXGBE_AUTOC2_UPPER_MASK;
+                        autoc2 |= (hw->mac.orig_autoc2 &
+                                   IXGBE_AUTOC2_UPPER_MASK);
+                        IXGBE_WRITE_REG(hw, IXGBE_AUTOC2, autoc2);
+                }
+        }
+
+        /*
+         * Store MAC address from RAR0, clear receive address registers, and
+         * clear the multicast table.  Also reset num_rar_entries to 128,
+         * since we modify this value when programming the SAN MAC address.
+         */
+        hw->mac.num_rar_entries = 128;
+        hw->mac.ops.init_rx_addrs(hw);
+
+        /* Store the permanent mac address */
+        hw->mac.ops.get_mac_addr(hw, hw->mac.perm_addr);
+
+        /* Store the permanent SAN mac address */
+        hw->mac.ops.get_san_mac_addr(hw, hw->mac.san_addr);
+
+        /* Add the SAN MAC address to the RAR only if it's a valid address */
+        if (ixgbe_validate_mac_addr(hw->mac.san_addr) == 0) {
+                hw->mac.ops.set_rar(hw, hw->mac.num_rar_entries - 1,
+                                    hw->mac.san_addr, 0, IXGBE_RAH_AV);
+
+                /* Reserve the last RAR for the SAN MAC address */
+                hw->mac.num_rar_entries--;
+        }
+
+        /* Store the alternative WWNN/WWPN prefix */
+        hw->mac.ops.get_wwn_prefix(hw, &hw->mac.wwnn_prefix,
+                                   &hw->mac.wwpn_prefix);
+
+        return status;
+}
+
+/**
+ *  ixgbe_get_supported_physical_layer_X540 - Returns physical layer type
+ *  @hw: pointer to hardware structure
+ *
+ *  Determines physical layer capabilities of the current configuration.
+ **/
+static u32 ixgbe_get_supported_physical_layer_X540(struct ixgbe_hw *hw)
+{
+        u32 physical_layer = IXGBE_PHYSICAL_LAYER_UNKNOWN;
+        u16 ext_ability = 0;
+
+        hw->phy.ops.identify(hw);
+
+        hw->phy.ops.read_reg(hw, MDIO_PMA_EXTABLE, MDIO_MMD_PMAPMD,
+                             &ext_ability);
+        if (ext_ability & MDIO_PMA_EXTABLE_10GBT)
+                physical_layer |= IXGBE_PHYSICAL_LAYER_10GBASE_T;
+        if (ext_ability & MDIO_PMA_EXTABLE_1000BT)
+                physical_layer |= IXGBE_PHYSICAL_LAYER_1000BASE_T;
+        if (ext_ability & MDIO_PMA_EXTABLE_100BTX)
+                physical_layer |= IXGBE_PHYSICAL_LAYER_100BASE_TX;
+
+        return physical_layer;
+}
+
+/**
+ * ixgbe_init_eeprom_params_X540 - Initialize EEPROM params
+ * @hw: pointer to hardware structure
+ **/
+static s32 ixgbe_init_eeprom_params_X540(struct ixgbe_hw *hw)
+{
+        struct ixgbe_eeprom_info *eeprom = &hw->eeprom;
+        u32 eec;
+        u16 eeprom_size;
+
+        if (eeprom->type == ixgbe_eeprom_uninitialized) {
+                eeprom->semaphore_delay = 10;
+                eeprom->type = ixgbe_flash;
+
+                eec = IXGBE_READ_REG(hw, IXGBE_EEC);
+                eeprom_size = (u16)((eec & IXGBE_EEC_SIZE) >>
+                                    IXGBE_EEC_SIZE_SHIFT);
+                eeprom->word_size = 1 << (eeprom_size +
+                                          IXGBE_EEPROM_WORD_SIZE_SHIFT);
+
+                hw_dbg(hw, "Eeprom params: type = %d, size = %d\n",
+                        eeprom->type, eeprom->word_size);
+        }
+
+        return 0;
+}
+
+/**
+ * ixgbe_read_eerd_X540 - Read EEPROM word using EERD
+ * @hw: pointer to hardware structure
+ * @offset: offset of word in the EEPROM to read
+ * @data: word read from the EERPOM
+ **/
+static s32 ixgbe_read_eerd_X540(struct ixgbe_hw *hw, u16 offset, u16 *data)
+{
+        s32 status;
+
+        if (ixgbe_acquire_swfw_sync_X540(hw, IXGBE_GSSR_EEP_SM))
+                status = ixgbe_read_eerd_generic(hw, offset, data);
+        else
+                status = IXGBE_ERR_SWFW_SYNC;
+
+        ixgbe_release_swfw_sync_X540(hw, IXGBE_GSSR_EEP_SM);
+        return status;
+}
+
+/**
+ * ixgbe_write_eewr_X540 - Write EEPROM word using EEWR
+ * @hw: pointer to hardware structure
+ * @offset: offset of  word in the EEPROM to write
+ * @data: word write to the EEPROM
+ *
+ * Write a 16 bit word to the EEPROM using the EEWR register.
+ **/
+static s32 ixgbe_write_eewr_X540(struct ixgbe_hw *hw, u16 offset, u16 data)
+{
+        u32 eewr;
+        s32 status;
+
+        hw->eeprom.ops.init_params(hw);
+
+        if (offset >= hw->eeprom.word_size) {
+                status = IXGBE_ERR_EEPROM;
+                goto out;
+        }
+
+        eewr = (offset << IXGBE_EEPROM_RW_ADDR_SHIFT) |
+               (data << IXGBE_EEPROM_RW_REG_DATA) |
+               IXGBE_EEPROM_RW_REG_START;
+
+        if (ixgbe_acquire_swfw_sync_X540(hw, IXGBE_GSSR_EEP_SM)) {
+                status = ixgbe_poll_eerd_eewr_done(hw, IXGBE_NVM_POLL_WRITE);
+                if (status != 0) {
+                        hw_dbg(hw, "Eeprom write EEWR timed out\n");
+                        goto out;
+                }
+
+                IXGBE_WRITE_REG(hw, IXGBE_EEWR, eewr);
+
+                status = ixgbe_poll_eerd_eewr_done(hw, IXGBE_NVM_POLL_WRITE);
+                if (status != 0) {
+                        hw_dbg(hw, "Eeprom write EEWR timed out\n");
+                        goto out;
+                }
+        } else {
+                status = IXGBE_ERR_SWFW_SYNC;
+        }
+
+out:
+        ixgbe_release_swfw_sync_X540(hw, IXGBE_GSSR_EEP_SM);
+        return status;
+}
+
+/**
+ * ixgbe_calc_eeprom_checksum_X540 - Calculates and returns the checksum
+ * @hw: pointer to hardware structure
+ **/
+static u16 ixgbe_calc_eeprom_checksum_X540(struct ixgbe_hw *hw)
+{
+        u16 i;
+        u16 j;
+        u16 checksum = 0;
+        u16 length = 0;
+        u16 pointer = 0;
+        u16 word = 0;
+
+        /* Include 0x0-0x3F in the checksum */
+        for (i = 0; i < IXGBE_EEPROM_CHECKSUM; i++) {
+                if (hw->eeprom.ops.read(hw, i, &word) != 0) {
+                        hw_dbg(hw, "EEPROM read failed\n");
+                        break;
+                }
+                checksum += word;
+        }
+
+        /*
+         * Include all data from pointers 0x3, 0x6-0xE.  This excludes the
+         * FW, PHY module, and PCIe Expansion/Option ROM pointers.
+         */
+        for (i = IXGBE_PCIE_ANALOG_PTR; i < IXGBE_FW_PTR; i++) {
+                if (i == IXGBE_PHY_PTR || i == IXGBE_OPTION_ROM_PTR)
+                        continue;
+
+                if (hw->eeprom.ops.read(hw, i, &pointer) != 0) {
+                        hw_dbg(hw, "EEPROM read failed\n");
+                        break;
+                }
+
+                /* Skip pointer section if the pointer is invalid. */
+                if (pointer == 0xFFFF || pointer == 0 ||
+                    pointer >= hw->eeprom.word_size)
+                        continue;
+
+                if (hw->eeprom.ops.read(hw, pointer, &length) != 0) {
+                        hw_dbg(hw, "EEPROM read failed\n");
+                        break;
+                }
+
+                /* Skip pointer section if length is invalid. */
+                if (length == 0xFFFF || length == 0 ||
+                    (pointer + length) >= hw->eeprom.word_size)
+                        continue;
+
+                for (j = pointer+1; j <= pointer+length; j++) {
+                        if (hw->eeprom.ops.read(hw, j, &word) != 0) {
+                                hw_dbg(hw, "EEPROM read failed\n");
+                                break;
+                        }
+                        checksum += word;
+                }
+        }
+
+        checksum = (u16)IXGBE_EEPROM_SUM - checksum;
+
+        return checksum;
+}
+
+/**
+ * ixgbe_update_eeprom_checksum_X540 - Updates the EEPROM checksum and flash
+ * @hw: pointer to hardware structure
+ *
+ * After writing EEPROM to shadow RAM using EEWR register, software calculates
+ * checksum and updates the EEPROM and instructs the hardware to update
+ * the flash.
+ **/
+static s32 ixgbe_update_eeprom_checksum_X540(struct ixgbe_hw *hw)
+{
+        s32 status;
+
+        status = ixgbe_update_eeprom_checksum_generic(hw);
+
+        if (status)
+                status = ixgbe_update_flash_X540(hw);
+
+        return status;
+}
+
+/**
+ * ixgbe_update_flash_X540 - Instruct HW to copy EEPROM to Flash device
+ * @hw: pointer to hardware structure
+ *
+ * Set FLUP (bit 23) of the EEC register to instruct Hardware to copy
+ * EEPROM from shadow RAM to the flash device.
+ **/
+static s32 ixgbe_update_flash_X540(struct ixgbe_hw *hw)
+{
+        u32 flup;
+        s32 status = IXGBE_ERR_EEPROM;
+
+        status = ixgbe_poll_flash_update_done_X540(hw);
+        if (status == IXGBE_ERR_EEPROM) {
+                hw_dbg(hw, "Flash update time out\n");
+                goto out;
+        }
+
+        flup = IXGBE_READ_REG(hw, IXGBE_EEC) | IXGBE_EEC_FLUP;
+        IXGBE_WRITE_REG(hw, IXGBE_EEC, flup);
+
+        status = ixgbe_poll_flash_update_done_X540(hw);
+        if (status)
+                hw_dbg(hw, "Flash update complete\n");
+        else
+                hw_dbg(hw, "Flash update time out\n");
+
+        if (hw->revision_id == 0) {
+                flup = IXGBE_READ_REG(hw, IXGBE_EEC);
+
+                if (flup & IXGBE_EEC_SEC1VAL) {
+                        flup |= IXGBE_EEC_FLUP;
+                        IXGBE_WRITE_REG(hw, IXGBE_EEC, flup);
+                }
+
+                status = ixgbe_poll_flash_update_done_X540(hw);
+                if (status)
+                        hw_dbg(hw, "Flash update complete\n");
+                else
+                        hw_dbg(hw, "Flash update time out\n");
+
+        }
+out:
+        return status;
+}
+
+/**
+ * ixgbe_poll_flash_update_done_X540 - Poll flash update status
+ * @hw: pointer to hardware structure
+ *
+ * Polls the FLUDONE (bit 26) of the EEC Register to determine when the
+ * flash update is done.
+ **/
+static s32 ixgbe_poll_flash_update_done_X540(struct ixgbe_hw *hw)
+{
+        u32 i;
+        u32 reg;
+        s32 status = IXGBE_ERR_EEPROM;
+
+        for (i = 0; i < IXGBE_FLUDONE_ATTEMPTS; i++) {
+                reg = IXGBE_READ_REG(hw, IXGBE_EEC);
+                if (reg & IXGBE_EEC_FLUDONE) {
+                        status = 0;
+                        break;
+                }
+                udelay(5);
+        }
+        return status;
+}
+
+/**
+ * ixgbe_acquire_swfw_sync_X540 - Acquire SWFW semaphore
+ * @hw: pointer to hardware structure
+ * @mask: Mask to specify which semaphore to acquire
+ *
+ * Acquires the SWFW semaphore thought the SW_FW_SYNC register for
+ * the specified function (CSR, PHY0, PHY1, NVM, Flash)
+ **/
+static s32 ixgbe_acquire_swfw_sync_X540(struct ixgbe_hw *hw, u16 mask)
+{
+        u32 swfw_sync;
+        u32 swmask = mask;
+        u32 fwmask = mask << 5;
+        u32 hwmask = 0;
+        u32 timeout = 200;
+        u32 i;
+
+        if (swmask == IXGBE_GSSR_EEP_SM)
+                hwmask = IXGBE_GSSR_FLASH_SM;
+
+        for (i = 0; i < timeout; i++) {
+                /*
+                 * SW NVM semaphore bit is used for access to all
+                 * SW_FW_SYNC bits (not just NVM)
+                 */
+                if (ixgbe_get_swfw_sync_semaphore(hw))
+                        return IXGBE_ERR_SWFW_SYNC;
+
+                swfw_sync = IXGBE_READ_REG(hw, IXGBE_SWFW_SYNC);
+                if (!(swfw_sync & (fwmask | swmask | hwmask))) {
+                        swfw_sync |= swmask;
+                        IXGBE_WRITE_REG(hw, IXGBE_SWFW_SYNC, swfw_sync);
+                        ixgbe_release_swfw_sync_semaphore(hw);
+                        break;
+                } else {
+                        /*
+                         * Firmware currently using resource (fwmask),
+                         * hardware currently using resource (hwmask),
+                         * or other software thread currently using
+                         * resource (swmask)
+                         */
+                        ixgbe_release_swfw_sync_semaphore(hw);
+                        msleep(5);
+                }
+        }
+
+        /*
+         * If the resource is not released by the FW/HW the SW can assume that
+         * the FW/HW malfunctions. In that case the SW should sets the
+         * SW bit(s) of the requested resource(s) while ignoring the
+         * corresponding FW/HW bits in the SW_FW_SYNC register.
+         */
+        if (i >= timeout) {
+                swfw_sync = IXGBE_READ_REG(hw, IXGBE_SWFW_SYNC);
+                if (swfw_sync & (fwmask | hwmask)) {
+                        if (ixgbe_get_swfw_sync_semaphore(hw))
+                                return IXGBE_ERR_SWFW_SYNC;
+
+                        swfw_sync |= swmask;
+                        IXGBE_WRITE_REG(hw, IXGBE_SWFW_SYNC, swfw_sync);
+                        ixgbe_release_swfw_sync_semaphore(hw);
+                }
+        }
+
+        msleep(5);
+        return 0;
+}
+
+/**
+ * ixgbe_release_swfw_sync_X540 - Release SWFW semaphore
+ * @hw: pointer to hardware structure
+ * @mask: Mask to specify which semaphore to release
+ *
+ * Releases the SWFW semaphore throught the SW_FW_SYNC register
+ * for the specified function (CSR, PHY0, PHY1, EVM, Flash)
+ **/
+static void ixgbe_release_swfw_sync_X540(struct ixgbe_hw *hw, u16 mask)
+{
+        u32 swfw_sync;
+        u32 swmask = mask;
+
+        ixgbe_get_swfw_sync_semaphore(hw);
+
+        swfw_sync = IXGBE_READ_REG(hw, IXGBE_SWFW_SYNC);
+        swfw_sync &= ~swmask;
+        IXGBE_WRITE_REG(hw, IXGBE_SWFW_SYNC, swfw_sync);
+
+        ixgbe_release_swfw_sync_semaphore(hw);
+        msleep(5);
+}
+
+/**
+ * ixgbe_get_nvm_semaphore - Get hardware semaphore
+ * @hw: pointer to hardware structure
+ *
+ * Sets the hardware semaphores so SW/FW can gain control of shared resources
+ **/
+static s32 ixgbe_get_swfw_sync_semaphore(struct ixgbe_hw *hw)
+{
+        s32 status = IXGBE_ERR_EEPROM;
+        u32 timeout = 2000;
+        u32 i;
+        u32 swsm;
+
+        /* Get SMBI software semaphore between device drivers first */
+        for (i = 0; i < timeout; i++) {
+                /*
+                 * If the SMBI bit is 0 when we read it, then the bit will be
+                 * set and we have the semaphore
+                 */
+                swsm = IXGBE_READ_REG(hw, IXGBE_SWSM);
+                if (!(swsm & IXGBE_SWSM_SMBI)) {
+                        status = 0;
+                        break;
+                }
+                udelay(50);
+        }
+
+        /* Now get the semaphore between SW/FW through the REGSMP bit */
+        if (status) {
+                for (i = 0; i < timeout; i++) {
+                        swsm = IXGBE_READ_REG(hw, IXGBE_SWFW_SYNC);
+                        if (!(swsm & IXGBE_SWFW_REGSMP))
+                                break;
+
+                        udelay(50);
+                }
+        } else {
+                hw_dbg(hw, "Software semaphore SMBI between device drivers "
+                           "not granted.\n");
+        }
+
+        return status;
+}
+
+/**
+ * ixgbe_release_nvm_semaphore - Release hardware semaphore
+ * @hw: pointer to hardware structure
+ *
+ * This function clears hardware semaphore bits.
+ **/
+static void ixgbe_release_swfw_sync_semaphore(struct ixgbe_hw *hw)
+{
+         u32 swsm;
+
+        /* Release both semaphores by writing 0 to the bits REGSMP and SMBI */
+
+        swsm = IXGBE_READ_REG(hw, IXGBE_SWSM);
+        swsm &= ~IXGBE_SWSM_SMBI;
+        IXGBE_WRITE_REG(hw, IXGBE_SWSM, swsm);
+
+        swsm = IXGBE_READ_REG(hw, IXGBE_SWFW_SYNC);
+        swsm &= ~IXGBE_SWFW_REGSMP;
+        IXGBE_WRITE_REG(hw, IXGBE_SWFW_SYNC, swsm);
+
+        IXGBE_WRITE_FLUSH(hw);
+}
+
+static struct ixgbe_mac_operations mac_ops_X540 = {
+        .init_hw                = &ixgbe_init_hw_generic,
+        .reset_hw               = &ixgbe_reset_hw_X540,
+        .start_hw               = &ixgbe_start_hw_generic,
+        .clear_hw_cntrs         = &ixgbe_clear_hw_cntrs_generic,
+        .get_media_type         = &ixgbe_get_media_type_X540,
+        .get_supported_physical_layer =
+                                  &ixgbe_get_supported_physical_layer_X540,
+        .enable_rx_dma          = &ixgbe_enable_rx_dma_generic,
+        .get_mac_addr           = &ixgbe_get_mac_addr_generic,
+        .get_san_mac_addr       = &ixgbe_get_san_mac_addr_generic,
+        .get_device_caps        = NULL,
+        .get_wwn_prefix         = &ixgbe_get_wwn_prefix_generic,
+        .stop_adapter           = &ixgbe_stop_adapter_generic,
+        .get_bus_info           = &ixgbe_get_bus_info_generic,
+        .set_lan_id             = &ixgbe_set_lan_id_multi_port_pcie,
+        .read_analog_reg8       = NULL,
+        .write_analog_reg8      = NULL,
+        .setup_link             = &ixgbe_setup_mac_link_X540,
+        .check_link             = &ixgbe_check_mac_link_generic,
+        .get_link_capabilities  = &ixgbe_get_copper_link_capabilities_generic,
+        .led_on                 = &ixgbe_led_on_generic,
+        .led_off                = &ixgbe_led_off_generic,
+        .blink_led_start        = &ixgbe_blink_led_start_generic,
+        .blink_led_stop         = &ixgbe_blink_led_stop_generic,
+        .set_rar                = &ixgbe_set_rar_generic,
+        .clear_rar              = &ixgbe_clear_rar_generic,
+        .set_vmdq               = &ixgbe_set_vmdq_generic,
+        .clear_vmdq             = &ixgbe_clear_vmdq_generic,
+        .init_rx_addrs          = &ixgbe_init_rx_addrs_generic,
+        .update_uc_addr_list    = &ixgbe_update_uc_addr_list_generic,
+        .update_mc_addr_list    = &ixgbe_update_mc_addr_list_generic,
+        .enable_mc              = &ixgbe_enable_mc_generic,
+        .disable_mc             = &ixgbe_disable_mc_generic,
+        .clear_vfta             = &ixgbe_clear_vfta_generic,
+        .set_vfta               = &ixgbe_set_vfta_generic,
+        .fc_enable              = &ixgbe_fc_enable_generic,
+        .init_uta_tables        = &ixgbe_init_uta_tables_generic,
+        .setup_sfp              = NULL,
+};
+
+static struct ixgbe_eeprom_operations eeprom_ops_X540 = {
+        .init_params            = &ixgbe_init_eeprom_params_X540,
+        .read                   = &ixgbe_read_eerd_X540,
+        .write                  = &ixgbe_write_eewr_X540,
+        .calc_checksum          = &ixgbe_calc_eeprom_checksum_X540,
+        .validate_checksum      = &ixgbe_validate_eeprom_checksum_generic,
+        .update_checksum        = &ixgbe_update_eeprom_checksum_X540,
+};
+
+static struct ixgbe_phy_operations phy_ops_X540 = {
+        .identify               = &ixgbe_identify_phy_generic,
+        .identify_sfp           = &ixgbe_identify_sfp_module_generic,
+        .init                   = NULL,
+        .reset                  = &ixgbe_reset_phy_generic,
+        .read_reg               = &ixgbe_read_phy_reg_generic,
+        .write_reg              = &ixgbe_write_phy_reg_generic,
+        .setup_link             = &ixgbe_setup_phy_link_generic,
+        .setup_link_speed       = &ixgbe_setup_phy_link_speed_generic,
+        .read_i2c_byte          = &ixgbe_read_i2c_byte_generic,
+        .write_i2c_byte         = &ixgbe_write_i2c_byte_generic,
+        .read_i2c_eeprom        = &ixgbe_read_i2c_eeprom_generic,
+        .write_i2c_eeprom       = &ixgbe_write_i2c_eeprom_generic,
+        .check_overtemp         = &ixgbe_tn_check_overtemp,
+};
+
+struct ixgbe_info ixgbe_X540_info = {
+        .mac                    = ixgbe_mac_X540,
+        .get_invariants         = &ixgbe_get_invariants_X540,
+        .mac_ops                = &mac_ops_X540,
+        .eeprom_ops             = &eeprom_ops_X540,
+        .phy_ops                = &phy_ops_X540,
+        .mbx_ops                = &mbx_ops_generic,
+};
diff --git a/drivers/net/ixgbevf/Makefile b/drivers/net/ixgbevf/Makefile
index dd4e0d27e8c..1f35d229e71 100644
--- a/drivers/net/ixgbevf/Makefile
+++ b/drivers/net/ixgbevf/Makefile
@@ -1,7 +1,7 @@
 ################################################################################
 #
 # Intel 82599 Virtual Function driver
-# Copyright(c) 1999 - 2009 Intel Corporation.
+# Copyright(c) 1999 - 2010 Intel Corporation.
 #
 # This program is free software; you can redistribute it and/or modify it
 # under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbevf/defines.h b/drivers/net/ixgbevf/defines.h
index ca2c81f49a0..f8a807d606c 100644
--- a/drivers/net/ixgbevf/defines.h
+++ b/drivers/net/ixgbevf/defines.h
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 82599 Virtual Function driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbevf/ixgbevf.h b/drivers/net/ixgbevf/ixgbevf.h
index da4033c6efa..0cd6abcf930 100644
--- a/drivers/net/ixgbevf/ixgbevf.h
+++ b/drivers/net/ixgbevf/ixgbevf.h
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 82599 Virtual Function driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbevf/ixgbevf_main.c b/drivers/net/ixgbevf/ixgbevf_main.c
index dc03c965238..2216a3c8b12 100644
--- a/drivers/net/ixgbevf/ixgbevf_main.c
+++ b/drivers/net/ixgbevf/ixgbevf_main.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 82599 Virtual Function driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
@@ -51,9 +51,10 @@ char ixgbevf_driver_name[] = "ixgbevf";
 static const char ixgbevf_driver_string[] =
         "Intel(R) 82599 Virtual Function";
 
-#define DRV_VERSION "1.0.0-k0"
+#define DRV_VERSION "1.0.12-k0"
 const char ixgbevf_driver_version[] = DRV_VERSION;
-static char ixgbevf_copyright[] = "Copyright (c) 2009 Intel Corporation.";
+static char ixgbevf_copyright[] =
+        "Copyright (c) 2009 - 2010 Intel Corporation.";
 
 static const struct ixgbevf_info *ixgbevf_info_tbl[] = {
         [board_82599_vf] = &ixgbevf_vf_info,
@@ -2488,10 +2489,9 @@ int ixgbevf_setup_tx_resources(struct ixgbevf_adapter *adapter,
         int size;
 
         size = sizeof(struct ixgbevf_tx_buffer) * tx_ring->count;
-        tx_ring->tx_buffer_info = vmalloc(size);
+        tx_ring->tx_buffer_info = vzalloc(size);
         if (!tx_ring->tx_buffer_info)
                 goto err;
-        memset(tx_ring->tx_buffer_info, 0, size);
 
         /* round up to nearest 4K */
         tx_ring->size = tx_ring->count * sizeof(union ixgbe_adv_tx_desc);
@@ -2555,14 +2555,13 @@ int ixgbevf_setup_rx_resources(struct ixgbevf_adapter *adapter,
         int size;
 
         size = sizeof(struct ixgbevf_rx_buffer) * rx_ring->count;
-        rx_ring->rx_buffer_info = vmalloc(size);
+        rx_ring->rx_buffer_info = vzalloc(size);
         if (!rx_ring->rx_buffer_info) {
                 hw_dbg(&adapter->hw,
                        "Unable to vmalloc buffer memory for "
                        "the receive descriptor ring\n");
                 goto alloc_failed;
         }
-        memset(rx_ring->rx_buffer_info, 0, size);
 
         /* Round up to nearest 4K */
         rx_ring->size = rx_ring->count * sizeof(union ixgbe_adv_rx_desc);
@@ -3424,10 +3423,6 @@ static int __devinit ixgbevf_probe(struct pci_dev *pdev,
         if (hw->mac.ops.get_bus_info)
                 hw->mac.ops.get_bus_info(hw);
 
-
-        netif_carrier_off(netdev);
-        netif_tx_stop_all_queues(netdev);
-
         strcpy(netdev->name, "eth%d");
 
         err = register_netdev(netdev);
@@ -3436,6 +3431,8 @@ static int __devinit ixgbevf_probe(struct pci_dev *pdev,
 
         adapter->netdev_registered = true;
 
+        netif_carrier_off(netdev);
+
         ixgbevf_init_last_counter_stats(adapter);
 
         /* print the MAC address */
diff --git a/drivers/net/ixgbevf/mbx.c b/drivers/net/ixgbevf/mbx.c
index 84ac486f4a6..7a883312577 100644
--- a/drivers/net/ixgbevf/mbx.c
+++ b/drivers/net/ixgbevf/mbx.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 82599 Virtual Function driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbevf/mbx.h b/drivers/net/ixgbevf/mbx.h
index 8c063bebee7..b2b5bf5daa3 100644
--- a/drivers/net/ixgbevf/mbx.h
+++ b/drivers/net/ixgbevf/mbx.h
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 82599 Virtual Function driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbevf/regs.h b/drivers/net/ixgbevf/regs.h
index 12f75960aec..fb80ca1bcc9 100644
--- a/drivers/net/ixgbevf/regs.h
+++ b/drivers/net/ixgbevf/regs.h
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 82599 Virtual Function driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbevf/vf.c b/drivers/net/ixgbevf/vf.c
index bfe42c1fcfa..971019d819b 100644
--- a/drivers/net/ixgbevf/vf.c
+++ b/drivers/net/ixgbevf/vf.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 82599 Virtual Function driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbevf/vf.h b/drivers/net/ixgbevf/vf.h
index 61f9dc83142..144c99d5363 100644
--- a/drivers/net/ixgbevf/vf.h
+++ b/drivers/net/ixgbevf/vf.h
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 82599 Virtual Function driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/jme.c b/drivers/net/jme.c
index c57d9a43cec..2411e72ba57 100644
--- a/drivers/net/jme.c
+++ b/drivers/net/jme.c
@@ -2076,12 +2076,11 @@ jme_change_mtu(struct net_device *netdev, int new_mtu)
         }
 
         if (new_mtu > 1900) {
-                netdev->features &= ~(NETIF_F_HW_CSUM |
-                                NETIF_F_TSO |
-                                NETIF_F_TSO6);
+                netdev->features &= ~(NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+                                NETIF_F_TSO | NETIF_F_TSO6);
         } else {
                 if (test_bit(JME_FLAG_TXCSUM, &jme->flags))
-                        netdev->features |= NETIF_F_HW_CSUM;
+                        netdev->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
                 if (test_bit(JME_FLAG_TSO, &jme->flags))
                         netdev->features |= NETIF_F_TSO | NETIF_F_TSO6;
         }
@@ -2514,10 +2513,12 @@ jme_set_tx_csum(struct net_device *netdev, u32 on)
         if (on) {
                 set_bit(JME_FLAG_TXCSUM, &jme->flags);
                 if (netdev->mtu <= 1900)
-                        netdev->features |= NETIF_F_HW_CSUM;
+                        netdev->features |=
+                                NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
         } else {
                 clear_bit(JME_FLAG_TXCSUM, &jme->flags);
-                netdev->features &= ~NETIF_F_HW_CSUM;
+                netdev->features &=
+                                ~(NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM);
         }
 
         return 0;
@@ -2797,7 +2798,8 @@ jme_init_one(struct pci_dev *pdev,
         netdev->netdev_ops = &jme_netdev_ops;
         netdev->ethtool_ops             = &jme_ethtool_ops;
         netdev->watchdog_timeo          = TX_TIMEOUT;
-        netdev->features                =       NETIF_F_HW_CSUM |
+        netdev->features                =       NETIF_F_IP_CSUM |
+                                                NETIF_F_IPV6_CSUM |
                                                 NETIF_F_SG |
                                                 NETIF_F_TSO |
                                                 NETIF_F_TSO6 |
diff --git a/drivers/net/ks8851.c b/drivers/net/ks8851.c
index 51919fcd50c..0fa4a9887ba 100644
--- a/drivers/net/ks8851.c
+++ b/drivers/net/ks8851.c
@@ -1545,6 +1545,37 @@ static int ks8851_read_selftest(struct ks8851_net *ks)
 
 /* driver bus management functions */
 
+#ifdef CONFIG_PM
+static int ks8851_suspend(struct spi_device *spi, pm_message_t state)
+{
+        struct ks8851_net *ks = dev_get_drvdata(&spi->dev);
+        struct net_device *dev = ks->netdev;
+
+        if (netif_running(dev)) {
+                netif_device_detach(dev);
+                ks8851_net_stop(dev);
+        }
+
+        return 0;
+}
+
+static int ks8851_resume(struct spi_device *spi)
+{
+        struct ks8851_net *ks = dev_get_drvdata(&spi->dev);
+        struct net_device *dev = ks->netdev;
+
+        if (netif_running(dev)) {
+                ks8851_net_open(dev);
+                netif_device_attach(dev);
+        }
+
+        return 0;
+}
+#else
+#define ks8851_suspend NULL
+#define ks8851_resume NULL
+#endif
+
 static int __devinit ks8851_probe(struct spi_device *spi)
 {
         struct net_device *ndev;
@@ -1679,6 +1710,8 @@ static struct spi_driver ks8851_driver = {
         },
         .probe = ks8851_probe,
         .remove = __devexit_p(ks8851_remove),
+        .suspend = ks8851_suspend,
+        .resume = ks8851_resume,
 };
 
 static int __init ks8851_init(void)
diff --git a/drivers/net/lance.c b/drivers/net/lance.c
index f06296bfe29..02336edce74 100644
--- a/drivers/net/lance.c
+++ b/drivers/net/lance.c
@@ -207,7 +207,7 @@ tx_full and tbusy flags.
 #define LANCE_BUS_IF 0x16
 #define LANCE_TOTAL_SIZE 0x18
 
-#define TX_TIMEOUT      20
+#define TX_TIMEOUT      (HZ/5)
 
 /* The LANCE Rx and Tx ring descriptors. */
 struct lance_rx_head {
diff --git a/drivers/net/lib82596.c b/drivers/net/lib82596.c
index c27f4291b35..9e042894479 100644
--- a/drivers/net/lib82596.c
+++ b/drivers/net/lib82596.c
@@ -161,7 +161,7 @@ enum commands {
 #define  RX_SUSPEND     0x0030
 #define  RX_ABORT       0x0040
 
-#define TX_TIMEOUT      5
+#define TX_TIMEOUT      (HZ/20)
 
 
 struct i596_reg {
diff --git a/drivers/net/lib8390.c b/drivers/net/lib8390.c
index e7030ceb178..da74db4a03d 100644
--- a/drivers/net/lib8390.c
+++ b/drivers/net/lib8390.c
@@ -203,7 +203,7 @@ static void __NS8390_init(struct net_device *dev, int startp);
 static int __ei_open(struct net_device *dev)
 {
         unsigned long flags;
-        struct ei_device *ei_local = (struct ei_device *) netdev_priv(dev);
+        struct ei_device *ei_local = netdev_priv(dev);
 
         if (dev->watchdog_timeo <= 0)
                  dev->watchdog_timeo = TX_TIMEOUT;
@@ -231,7 +231,7 @@ static int __ei_open(struct net_device *dev)
  */
 static int __ei_close(struct net_device *dev)
 {
-        struct ei_device *ei_local = (struct ei_device *) netdev_priv(dev);
+        struct ei_device *ei_local = netdev_priv(dev);
         unsigned long flags;
 
         /*
@@ -256,7 +256,7 @@ static int __ei_close(struct net_device *dev)
 static void __ei_tx_timeout(struct net_device *dev)
 {
         unsigned long e8390_base = dev->base_addr;
-        struct ei_device *ei_local = (struct ei_device *) netdev_priv(dev);
+        struct ei_device *ei_local = netdev_priv(dev);
         int txsr, isr, tickssofar = jiffies - dev_trans_start(dev);
         unsigned long flags;
 
@@ -303,7 +303,7 @@ static netdev_tx_t __ei_start_xmit(struct sk_buff *skb,
                                    struct net_device *dev)
 {
         unsigned long e8390_base = dev->base_addr;
-        struct ei_device *ei_local = (struct ei_device *) netdev_priv(dev);
+        struct ei_device *ei_local = netdev_priv(dev);
         int send_length = skb->len, output_page;
         unsigned long flags;
         char buf[ETH_ZLEN];
@@ -592,7 +592,7 @@ static void ei_tx_err(struct net_device *dev)
 static void ei_tx_intr(struct net_device *dev)
 {
         unsigned long e8390_base = dev->base_addr;
-        struct ei_device *ei_local = (struct ei_device *) netdev_priv(dev);
+        struct ei_device *ei_local = netdev_priv(dev);
         int status = ei_inb(e8390_base + EN0_TSR);
 
         ei_outb_p(ENISR_TX, e8390_base + EN0_ISR); /* Ack intr. */
@@ -675,7 +675,7 @@ static void ei_tx_intr(struct net_device *dev)
 static void ei_receive(struct net_device *dev)
 {
         unsigned long e8390_base = dev->base_addr;
-        struct ei_device *ei_local = (struct ei_device *) netdev_priv(dev);
+        struct ei_device *ei_local = netdev_priv(dev);
         unsigned char rxing_page, this_frame, next_frame;
         unsigned short current_offset;
         int rx_pkt_count = 0;
@@ -879,7 +879,7 @@ static void ei_rx_overrun(struct net_device *dev)
 static struct net_device_stats *__ei_get_stats(struct net_device *dev)
 {
         unsigned long ioaddr = dev->base_addr;
-        struct ei_device *ei_local = (struct ei_device *) netdev_priv(dev);
+        struct ei_device *ei_local = netdev_priv(dev);
         unsigned long flags;
 
         /* If the card is stopped, just return the present stats. */
@@ -927,7 +927,7 @@ static void do_set_multicast_list(struct net_device *dev)
 {
         unsigned long e8390_base = dev->base_addr;
         int i;
-        struct ei_device *ei_local = (struct ei_device*)netdev_priv(dev);
+        struct ei_device *ei_local = netdev_priv(dev);
 
         if (!(dev->flags&(IFF_PROMISC|IFF_ALLMULTI)))
         {
@@ -981,7 +981,7 @@ static void do_set_multicast_list(struct net_device *dev)
 static void __ei_set_multicast_list(struct net_device *dev)
 {
         unsigned long flags;
-        struct ei_device *ei_local = (struct ei_device*)netdev_priv(dev);
+        struct ei_device *ei_local = netdev_priv(dev);
 
         spin_lock_irqsave(&ei_local->page_lock, flags);
         do_set_multicast_list(dev);
@@ -998,7 +998,7 @@ static void __ei_set_multicast_list(struct net_device *dev)
 
 static void ethdev_setup(struct net_device *dev)
 {
-        struct ei_device *ei_local = (struct ei_device *) netdev_priv(dev);
+        struct ei_device *ei_local = netdev_priv(dev);
         if (ei_debug > 1)
                 printk(version);
 
@@ -1036,7 +1036,7 @@ static struct net_device *____alloc_ei_netdev(int size)
 static void __NS8390_init(struct net_device *dev, int startp)
 {
         unsigned long e8390_base = dev->base_addr;
-        struct ei_device *ei_local = (struct ei_device *) netdev_priv(dev);
+        struct ei_device *ei_local = netdev_priv(dev);
         int i;
         int endcfg = ei_local->word16
             ? (0x48 | ENDCFG_WTS | (ei_local->bigendian ? ENDCFG_BOS : 0))
@@ -1099,7 +1099,7 @@ static void NS8390_trigger_send(struct net_device *dev, unsigned int length,
                                                                 int start_page)
 {
         unsigned long e8390_base = dev->base_addr;
-        struct ei_device *ei_local __attribute((unused)) = (struct ei_device *) netdev_priv(dev);
+        struct ei_device *ei_local __attribute((unused)) = netdev_priv(dev);
 
         ei_outb_p(E8390_NODMA+E8390_PAGE0, e8390_base+E8390_CMD);
 
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 0fc9dc7f20d..6ed577b065d 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -38,6 +38,7 @@ struct macvlan_port {
         struct hlist_head       vlan_hash[MACVLAN_HASH_SIZE];
         struct list_head        vlans;
         struct rcu_head         rcu;
+        bool                    passthru;
 };
 
 #define macvlan_port_get_rcu(dev) \
@@ -169,6 +170,7 @@ static struct sk_buff *macvlan_handle_frame(struct sk_buff *skb)
                         macvlan_broadcast(skb, port, NULL,
                                           MACVLAN_MODE_PRIVATE |
                                           MACVLAN_MODE_VEPA    |
+                                          MACVLAN_MODE_PASSTHRU|
                                           MACVLAN_MODE_BRIDGE);
                 else if (src->mode == MACVLAN_MODE_VEPA)
                         /* flood to everyone except source */
@@ -185,7 +187,10 @@ static struct sk_buff *macvlan_handle_frame(struct sk_buff *skb)
                 return skb;
         }
 
-        vlan = macvlan_hash_lookup(port, eth->h_dest);
+        if (port->passthru)
+                vlan = list_first_entry(&port->vlans, struct macvlan_dev, list);
+        else
+                vlan = macvlan_hash_lookup(port, eth->h_dest);
         if (vlan == NULL)
                 return skb;
 
@@ -243,18 +248,22 @@ xmit_world:
 netdev_tx_t macvlan_start_xmit(struct sk_buff *skb,
                                struct net_device *dev)
 {
-        int i = skb_get_queue_mapping(skb);
-        struct netdev_queue *txq = netdev_get_tx_queue(dev, i);
         unsigned int len = skb->len;
         int ret;
+        const struct macvlan_dev *vlan = netdev_priv(dev);
 
         ret = macvlan_queue_xmit(skb, dev);
         if (likely(ret == NET_XMIT_SUCCESS || ret == NET_XMIT_CN)) {
-                txq->tx_packets++;
-                txq->tx_bytes += len;
-        } else
-                txq->tx_dropped++;
+                struct macvlan_pcpu_stats *pcpu_stats;
 
+                pcpu_stats = this_cpu_ptr(vlan->pcpu_stats);
+                u64_stats_update_begin(&pcpu_stats->syncp);
+                pcpu_stats->tx_packets++;
+                pcpu_stats->tx_bytes += len;
+                u64_stats_update_end(&pcpu_stats->syncp);
+        } else {
+                this_cpu_inc(vlan->pcpu_stats->tx_dropped);
+        }
         return ret;
 }
 EXPORT_SYMBOL_GPL(macvlan_start_xmit);
@@ -284,6 +293,11 @@ static int macvlan_open(struct net_device *dev)
         struct net_device *lowerdev = vlan->lowerdev;
         int err;
 
+        if (vlan->port->passthru) {
+                dev_set_promiscuity(lowerdev, 1);
+                goto hash_add;
+        }
+
         err = -EBUSY;
         if (macvlan_addr_busy(vlan->port, dev->dev_addr))
                 goto out;
@@ -296,6 +310,8 @@ static int macvlan_open(struct net_device *dev)
                 if (err < 0)
                         goto del_unicast;
         }
+
+hash_add:
         macvlan_hash_add(vlan);
         return 0;
 
@@ -310,12 +326,18 @@ static int macvlan_stop(struct net_device *dev)
         struct macvlan_dev *vlan = netdev_priv(dev);
         struct net_device *lowerdev = vlan->lowerdev;
 
+        if (vlan->port->passthru) {
+                dev_set_promiscuity(lowerdev, -1);
+                goto hash_del;
+        }
+
         dev_mc_unsync(lowerdev, dev);
         if (dev->flags & IFF_ALLMULTI)
                 dev_set_allmulti(lowerdev, -1);
 
         dev_uc_del(lowerdev, dev->dev_addr);
 
+hash_del:
         macvlan_hash_del(vlan);
         return 0;
 }
@@ -414,14 +436,15 @@ static int macvlan_init(struct net_device *dev)
         dev->state              = (dev->state & ~MACVLAN_STATE_MASK) |
                                   (lowerdev->state & MACVLAN_STATE_MASK);
         dev->features           = lowerdev->features & MACVLAN_FEATURES;
+        dev->features           |= NETIF_F_LLTX;
         dev->gso_max_size       = lowerdev->gso_max_size;
         dev->iflink             = lowerdev->ifindex;
         dev->hard_header_len    = lowerdev->hard_header_len;
 
         macvlan_set_lockdep_class(dev);
 
-        vlan->rx_stats = alloc_percpu(struct macvlan_rx_stats);
-        if (!vlan->rx_stats)
+        vlan->pcpu_stats = alloc_percpu(struct macvlan_pcpu_stats);
+        if (!vlan->pcpu_stats)
                 return -ENOMEM;
 
         return 0;
@@ -431,7 +454,7 @@ static void macvlan_uninit(struct net_device *dev)
 {
         struct macvlan_dev *vlan = netdev_priv(dev);
 
-        free_percpu(vlan->rx_stats);
+        free_percpu(vlan->pcpu_stats);
 }
 
 static struct rtnl_link_stats64 *macvlan_dev_get_stats64(struct net_device *dev,
@@ -439,33 +462,38 @@ static struct rtnl_link_stats64 *macvlan_dev_get_stats64(struct net_device *dev,
 {
         struct macvlan_dev *vlan = netdev_priv(dev);
 
-        dev_txq_stats_fold(dev, stats);
-
-        if (vlan->rx_stats) {
-                struct macvlan_rx_stats *p, accum = {0};
-                u64 rx_packets, rx_bytes, rx_multicast;
+        if (vlan->pcpu_stats) {
+                struct macvlan_pcpu_stats *p;
+                u64 rx_packets, rx_bytes, rx_multicast, tx_packets, tx_bytes;
+                u32 rx_errors = 0, tx_dropped = 0;
                 unsigned int start;
                 int i;
 
                 for_each_possible_cpu(i) {
-                        p = per_cpu_ptr(vlan->rx_stats, i);
+                        p = per_cpu_ptr(vlan->pcpu_stats, i);
                         do {
                                 start = u64_stats_fetch_begin_bh(&p->syncp);
                                 rx_packets      = p->rx_packets;
                                 rx_bytes        = p->rx_bytes;
                                 rx_multicast    = p->rx_multicast;
+                                tx_packets      = p->tx_packets;
+                                tx_bytes        = p->tx_bytes;
                         } while (u64_stats_fetch_retry_bh(&p->syncp, start));
-                        accum.rx_packets        += rx_packets;
-                        accum.rx_bytes          += rx_bytes;
-                        accum.rx_multicast      += rx_multicast;
-                        /* rx_errors is an ulong, updated without syncp protection */
-                        accum.rx_errors         += p->rx_errors;
+
+                        stats->rx_packets       += rx_packets;
+                        stats->rx_bytes         += rx_bytes;
+                        stats->multicast        += rx_multicast;
+                        stats->tx_packets       += tx_packets;
+                        stats->tx_bytes         += tx_bytes;
+                        /* rx_errors & tx_dropped are u32, updated
+                         * without syncp protection.
+                         */
+                        rx_errors       += p->rx_errors;
+                        tx_dropped      += p->tx_dropped;
                 }
-                stats->rx_packets = accum.rx_packets;
-                stats->rx_bytes   = accum.rx_bytes;
-                stats->rx_errors  = accum.rx_errors;
-                stats->rx_dropped = accum.rx_errors;
-                stats->multicast  = accum.rx_multicast;
+                stats->rx_errors        = rx_errors;
+                stats->rx_dropped       = rx_errors;
+                stats->tx_dropped       = tx_dropped;
         }
         return stats;
 }
@@ -549,6 +577,7 @@ static int macvlan_port_create(struct net_device *dev)
         if (port == NULL)
                 return -ENOMEM;
 
+        port->passthru = false;
         port->dev = dev;
         INIT_LIST_HEAD(&port->vlans);
         for (i = 0; i < MACVLAN_HASH_SIZE; i++)
@@ -593,6 +622,7 @@ static int macvlan_validate(struct nlattr *tb[], struct nlattr *data[])
                 case MACVLAN_MODE_PRIVATE:
                 case MACVLAN_MODE_VEPA:
                 case MACVLAN_MODE_BRIDGE:
+                case MACVLAN_MODE_PASSTHRU:
                         break;
                 default:
                         return -EINVAL;
@@ -601,25 +631,6 @@ static int macvlan_validate(struct nlattr *tb[], struct nlattr *data[])
         return 0;
 }
 
-static int macvlan_get_tx_queues(struct net *net,
-                                 struct nlattr *tb[],
-                                 unsigned int *num_tx_queues,
-                                 unsigned int *real_num_tx_queues)
-{
-        struct net_device *real_dev;
-
-        if (!tb[IFLA_LINK])
-                return -EINVAL;
-
-        real_dev = __dev_get_by_index(net, nla_get_u32(tb[IFLA_LINK]));
-        if (!real_dev)
-                return -ENODEV;
-
-        *num_tx_queues      = real_dev->num_tx_queues;
-        *real_num_tx_queues = real_dev->real_num_tx_queues;
-        return 0;
-}
-
 int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
                            struct nlattr *tb[], struct nlattr *data[],
                            int (*receive)(struct sk_buff *skb),
@@ -661,6 +672,10 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
         }
         port = macvlan_port_get(lowerdev);
 
+        /* Only 1 macvlan device can be created in passthru mode */
+        if (port->passthru)
+                return -EINVAL;
+
         vlan->lowerdev = lowerdev;
         vlan->dev      = dev;
         vlan->port     = port;
@@ -671,6 +686,13 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
         if (data && data[IFLA_MACVLAN_MODE])
                 vlan->mode = nla_get_u32(data[IFLA_MACVLAN_MODE]);
 
+        if (vlan->mode == MACVLAN_MODE_PASSTHRU) {
+                if (!list_empty(&port->vlans))
+                        return -EINVAL;
+                port->passthru = true;
+                memcpy(dev->dev_addr, lowerdev->dev_addr, ETH_ALEN);
+        }
+
         err = register_netdevice(dev);
         if (err < 0)
                 goto destroy_port;
@@ -743,7 +765,6 @@ int macvlan_link_register(struct rtnl_link_ops *ops)
 {
         /* common fields */
         ops->priv_size          = sizeof(struct macvlan_dev);
-        ops->get_tx_queues      = macvlan_get_tx_queues;
         ops->validate           = macvlan_validate;
         ops->maxtype            = IFLA_MACVLAN_MAX;
         ops->policy             = macvlan_policy;
diff --git a/drivers/net/ne-h8300.c b/drivers/net/ne-h8300.c
index e0b0ef11f11..30be8c634eb 100644
--- a/drivers/net/ne-h8300.c
+++ b/drivers/net/ne-h8300.c
@@ -86,7 +86,7 @@ static u32 reg_offset[16];
 
 static int __init init_reg_offset(struct net_device *dev,unsigned long base_addr)
 {
-        struct ei_device *ei_local = (struct ei_device *) netdev_priv(dev);
+        struct ei_device *ei_local = netdev_priv(dev);
         int i;
         unsigned char bus_width;
 
@@ -218,7 +218,7 @@ static int __init ne_probe1(struct net_device *dev, int ioaddr)
         int start_page, stop_page;
         int reg0, ret;
         static unsigned version_printed;
-        struct ei_device *ei_local = (struct ei_device *) netdev_priv(dev);
+        struct ei_device *ei_local = netdev_priv(dev);
         unsigned char bus_width;
 
         if (!request_region(ioaddr, NE_IO_EXTENT, DRV_NAME))
@@ -371,7 +371,7 @@ static int ne_close(struct net_device *dev)
 static void ne_reset_8390(struct net_device *dev)
 {
         unsigned long reset_start_time = jiffies;
-        struct ei_device *ei_local = (struct ei_device *) netdev_priv(dev);
+        struct ei_device *ei_local = netdev_priv(dev);
 
         if (ei_debug > 1)
                 printk(KERN_DEBUG "resetting the 8390 t=%ld...", jiffies);
@@ -397,7 +397,7 @@ static void ne_reset_8390(struct net_device *dev)
 
 static void ne_get_8390_hdr(struct net_device *dev, struct e8390_pkt_hdr *hdr, int ring_page)
 {
-        struct ei_device *ei_local = (struct ei_device *) netdev_priv(dev);
+        struct ei_device *ei_local = netdev_priv(dev);
         /* This *shouldn't* happen. If it does, it's the last thing you'll see */
 
         if (ei_status.dmaing)
@@ -437,7 +437,7 @@ static void ne_get_8390_hdr(struct net_device *dev, struct e8390_pkt_hdr *hdr, i
 
 static void ne_block_input(struct net_device *dev, int count, struct sk_buff *skb, int ring_offset)
 {
-        struct ei_device *ei_local = (struct ei_device *) netdev_priv(dev);
+        struct ei_device *ei_local = netdev_priv(dev);
 #ifdef NE_SANITY_CHECK
         int xfer_count = count;
 #endif
@@ -507,7 +507,7 @@ static void ne_block_input(struct net_device *dev, int count, struct sk_buff *sk
 static void ne_block_output(struct net_device *dev, int count,
                 const unsigned char *buf, const int start_page)
 {
-        struct ei_device *ei_local = (struct ei_device *) netdev_priv(dev);
+        struct ei_device *ei_local = netdev_priv(dev);
         unsigned long dma_start;
 #ifdef NE_SANITY_CHECK
         int retries = 0;
diff --git a/drivers/net/netxen/netxen_nic_init.c b/drivers/net/netxen/netxen_nic_init.c
index 95fe552aa27..731077d8d96 100644
--- a/drivers/net/netxen/netxen_nic_init.c
+++ b/drivers/net/netxen/netxen_nic_init.c
@@ -214,13 +214,12 @@ int netxen_alloc_sw_resources(struct netxen_adapter *adapter)
         tx_ring->num_desc = adapter->num_txd;
         tx_ring->txq = netdev_get_tx_queue(netdev, 0);
 
-        cmd_buf_arr = vmalloc(TX_BUFF_RINGSIZE(tx_ring));
+        cmd_buf_arr = vzalloc(TX_BUFF_RINGSIZE(tx_ring));
         if (cmd_buf_arr == NULL) {
                 dev_err(&pdev->dev, "%s: failed to allocate cmd buffer ring\n",
                        netdev->name);
                 goto err_out;
         }
-        memset(cmd_buf_arr, 0, TX_BUFF_RINGSIZE(tx_ring));
         tx_ring->cmd_buf_arr = cmd_buf_arr;
 
         recv_ctx = &adapter->recv_ctx;
@@ -279,8 +278,7 @@ int netxen_alloc_sw_resources(struct netxen_adapter *adapter)
                         break;
 
                 }
-                rds_ring->rx_buf_arr = (struct netxen_rx_buffer *)
-                        vmalloc(RCV_BUFF_RINGSIZE(rds_ring));
+                rds_ring->rx_buf_arr = vzalloc(RCV_BUFF_RINGSIZE(rds_ring));
                 if (rds_ring->rx_buf_arr == NULL) {
                         printk(KERN_ERR "%s: Failed to allocate "
                                 "rx buffer ring %d\n",
@@ -288,7 +286,6 @@ int netxen_alloc_sw_resources(struct netxen_adapter *adapter)
                         /* free whatever was already allocated */
                         goto err_out;
                 }
-                memset(rds_ring->rx_buf_arr, 0, RCV_BUFF_RINGSIZE(rds_ring));
                 INIT_LIST_HEAD(&rds_ring->free_list);
                 /*
                  * Now go through all of them, set reference handles
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index e1d30d7f207..ceeaac989df 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -1277,6 +1277,7 @@ netxen_nic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         int i = 0, err;
         int pci_func_id = PCI_FUNC(pdev->devfn);
         uint8_t revision_id;
+        u32 val;
 
         if (pdev->revision >= NX_P3_A0 && pdev->revision <= NX_P3_B1) {
                 pr_warning("%s: chip revisions between 0x%x-0x%x "
@@ -1352,8 +1353,9 @@ netxen_nic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 break;
         }
 
-        if (reset_devices) {
-                if (adapter->portnum == 0) {
+        if (adapter->portnum == 0) {
+                val = NXRD32(adapter, NX_CRB_DEV_REF_COUNT);
+                if (val != 0xffffffff && val != 0) {
                         NXWR32(adapter, NX_CRB_DEV_REF_COUNT, 0);
                         adapter->need_fw_reset = 1;
                 }
diff --git a/drivers/net/pch_gbe/pch_gbe_ethtool.c b/drivers/net/pch_gbe/pch_gbe_ethtool.c
index c8cc32c0edc..c8c873b31a8 100644
--- a/drivers/net/pch_gbe/pch_gbe_ethtool.c
+++ b/drivers/net/pch_gbe/pch_gbe_ethtool.c
@@ -469,18 +469,6 @@ static int pch_gbe_set_rx_csum(struct net_device *netdev, u32 data)
 }
 
 /**
- * pch_gbe_get_tx_csum - Report whether transmit checksums are turned on or off
- * @netdev:  Network interface device structure
- * Returns
- *      true(1):  Checksum On
- *      false(0): Checksum Off
- */
-static u32 pch_gbe_get_tx_csum(struct net_device *netdev)
-{
-        return (netdev->features & NETIF_F_HW_CSUM) != 0;
-}
-
-/**
  * pch_gbe_set_tx_csum - Turn transmit checksums on or off
  * @netdev: Network interface device structure
  * @data:   Checksum on[true] or off[false]
@@ -493,11 +481,7 @@ static int pch_gbe_set_tx_csum(struct net_device *netdev, u32 data)
         struct pch_gbe_adapter *adapter = netdev_priv(netdev);
 
         adapter->tx_csum = data;
-        if (data)
-                netdev->features |= NETIF_F_HW_CSUM;
-        else
-                netdev->features &= ~NETIF_F_HW_CSUM;
-        return 0;
+        return ethtool_op_set_tx_ipv6_csum(netdev, data);
 }
 
 /**
@@ -572,7 +556,6 @@ static const struct ethtool_ops pch_gbe_ethtool_ops = {
         .set_pauseparam = pch_gbe_set_pauseparam,
         .get_rx_csum = pch_gbe_get_rx_csum,
         .set_rx_csum = pch_gbe_set_rx_csum,
-        .get_tx_csum = pch_gbe_get_tx_csum,
         .set_tx_csum = pch_gbe_set_tx_csum,
         .get_strings = pch_gbe_get_strings,
         .get_ethtool_stats = pch_gbe_get_ethtool_stats,
diff --git a/drivers/net/pch_gbe/pch_gbe_main.c b/drivers/net/pch_gbe/pch_gbe_main.c
index 03a1d280105..d7355306a73 100644
--- a/drivers/net/pch_gbe/pch_gbe_main.c
+++ b/drivers/net/pch_gbe/pch_gbe_main.c
@@ -1523,12 +1523,11 @@ int pch_gbe_setup_tx_resources(struct pch_gbe_adapter *adapter,
         int desNo;
 
         size = (int)sizeof(struct pch_gbe_buffer) * tx_ring->count;
-        tx_ring->buffer_info = vmalloc(size);
+        tx_ring->buffer_info = vzalloc(size);
         if (!tx_ring->buffer_info) {
                 pr_err("Unable to allocate memory for the buffer infomation\n");
                 return -ENOMEM;
         }
-        memset(tx_ring->buffer_info, 0, size);
 
         tx_ring->size = tx_ring->count * (int)sizeof(struct pch_gbe_tx_desc);
 
@@ -1573,12 +1572,11 @@ int pch_gbe_setup_rx_resources(struct pch_gbe_adapter *adapter,
         int desNo;
 
         size = (int)sizeof(struct pch_gbe_buffer) * rx_ring->count;
-        rx_ring->buffer_info = vmalloc(size);
+        rx_ring->buffer_info = vzalloc(size);
         if (!rx_ring->buffer_info) {
                 pr_err("Unable to allocate memory for the receive descriptor ring\n");
                 return -ENOMEM;
         }
-        memset(rx_ring->buffer_info, 0, size);
         rx_ring->size = rx_ring->count * (int)sizeof(struct pch_gbe_rx_desc);
         rx_ring->desc = dma_alloc_coherent(&pdev->dev, rx_ring->size,
                                            &rx_ring->dma, GFP_KERNEL);
@@ -2321,7 +2319,7 @@ static int pch_gbe_probe(struct pci_dev *pdev,
         netdev->watchdog_timeo = PCH_GBE_WATCHDOG_PERIOD;
         netif_napi_add(netdev, &adapter->napi,
                        pch_gbe_napi_poll, PCH_GBE_RX_WEIGHT);
-        netdev->features = NETIF_F_HW_CSUM | NETIF_F_GRO;
+        netdev->features = NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM | NETIF_F_GRO;
         pch_gbe_set_ethtool_ops(netdev);
 
         pch_gbe_mac_reset_hw(&adapter->hw);
@@ -2360,9 +2358,9 @@ static int pch_gbe_probe(struct pci_dev *pdev,
         pch_gbe_check_options(adapter);
 
         if (adapter->tx_csum)
-                netdev->features |= NETIF_F_HW_CSUM;
+                netdev->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
         else
-                netdev->features &= ~NETIF_F_HW_CSUM;
+                netdev->features &= ~(NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM);
 
         /* initialize the wol settings based on the eeprom settings */
         adapter->wake_up_evt = PCH_GBE_WL_INIT_SETTING;
diff --git a/drivers/net/pcmcia/axnet_cs.c b/drivers/net/pcmcia/axnet_cs.c
index 8a4d19e5de0..1a0eb128e60 100644
--- a/drivers/net/pcmcia/axnet_cs.c
+++ b/drivers/net/pcmcia/axnet_cs.c
@@ -875,7 +875,7 @@ static void do_set_multicast_list(struct net_device *dev);
 static int ax_open(struct net_device *dev)
 {
         unsigned long flags;
-        struct ei_device *ei_local = (struct ei_device *) netdev_priv(dev);
+        struct ei_device *ei_local = netdev_priv(dev);
 
         /*
          *      Grab the page lock so we own the register set, then call
@@ -926,7 +926,7 @@ static int ax_close(struct net_device *dev)
 static void axnet_tx_timeout(struct net_device *dev)
 {
         long e8390_base = dev->base_addr;
-        struct ei_device *ei_local = (struct ei_device *) netdev_priv(dev);
+        struct ei_device *ei_local = netdev_priv(dev);
         int txsr, isr, tickssofar = jiffies - dev_trans_start(dev);
         unsigned long flags;
 
@@ -973,7 +973,7 @@ static netdev_tx_t axnet_start_xmit(struct sk_buff *skb,
                                           struct net_device *dev)
 {
         long e8390_base = dev->base_addr;
-        struct ei_device *ei_local = (struct ei_device *) netdev_priv(dev);
+        struct ei_device *ei_local = netdev_priv(dev);
         int length, send_length, output_page;
         unsigned long flags;
         u8 packet[ETH_ZLEN];
@@ -1270,7 +1270,7 @@ static void ei_tx_err(struct net_device *dev)
 static void ei_tx_intr(struct net_device *dev)
 {
         long e8390_base = dev->base_addr;
-        struct ei_device *ei_local = (struct ei_device *) netdev_priv(dev);
+        struct ei_device *ei_local = netdev_priv(dev);
         int status = inb(e8390_base + EN0_TSR);
     
         /*
@@ -1354,7 +1354,7 @@ static void ei_tx_intr(struct net_device *dev)
 static void ei_receive(struct net_device *dev)
 {
         long e8390_base = dev->base_addr;
-        struct ei_device *ei_local = (struct ei_device *) netdev_priv(dev);
+        struct ei_device *ei_local = netdev_priv(dev);
         unsigned char rxing_page, this_frame, next_frame;
         unsigned short current_offset;
         int rx_pkt_count = 0;
@@ -1539,7 +1539,7 @@ static void ei_rx_overrun(struct net_device *dev)
 static struct net_device_stats *get_stats(struct net_device *dev)
 {
         long ioaddr = dev->base_addr;
-        struct ei_device *ei_local = (struct ei_device *) netdev_priv(dev);
+        struct ei_device *ei_local = netdev_priv(dev);
         unsigned long flags;
     
         /* If the card is stopped, just return the present stats. */
@@ -1588,7 +1588,7 @@ static void do_set_multicast_list(struct net_device *dev)
 {
         long e8390_base = dev->base_addr;
         int i;
-        struct ei_device *ei_local = (struct ei_device*)netdev_priv(dev);
+        struct ei_device *ei_local = netdev_priv(dev);
 
         if (!(dev->flags&(IFF_PROMISC|IFF_ALLMULTI))) {
                 memset(ei_local->mcfilter, 0, 8);
@@ -1646,7 +1646,7 @@ static void AX88190_init(struct net_device *dev, int startp)
 {
         axnet_dev_t *info = PRIV(dev);
         long e8390_base = dev->base_addr;
-        struct ei_device *ei_local = (struct ei_device *) netdev_priv(dev);
+        struct ei_device *ei_local = netdev_priv(dev);
         int i;
         int endcfg = ei_local->word16 ? (0x48 | ENDCFG_WTS) : 0x48;
     
@@ -1712,7 +1712,7 @@ static void NS8390_trigger_send(struct net_device *dev, unsigned int length,
                                                                 int start_page)
 {
         long e8390_base = dev->base_addr;
-        struct ei_device *ei_local __attribute((unused)) = (struct ei_device *) netdev_priv(dev);
+        struct ei_device *ei_local __attribute((unused)) = netdev_priv(dev);
     
         if (inb_p(e8390_base) & E8390_TRANS) 
         {
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 7670aac0e93..a8445c72fc1 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -47,11 +47,11 @@ void phy_print_status(struct phy_device *phydev)
         pr_info("PHY: %s - Link is %s", dev_name(&phydev->dev),
                         phydev->link ? "Up" : "Down");
         if (phydev->link)
-                printk(" - %d/%s", phydev->speed,
+                printk(KERN_CONT " - %d/%s", phydev->speed,
                                 DUPLEX_FULL == phydev->duplex ?
                                 "Full" : "Half");
 
-        printk("\n");
+        printk(KERN_CONT "\n");
 }
 EXPORT_SYMBOL(phy_print_status);
 
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index 39659976a1a..b708f68471a 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -1136,8 +1136,7 @@ ppp_send_frame(struct ppp *ppp, struct sk_buff *skb)
                    a four-byte PPP header on each packet */
                 *skb_push(skb, 2) = 1;
                 if (ppp->pass_filter &&
-                    sk_run_filter(skb, ppp->pass_filter,
-                                  ppp->pass_len) == 0) {
+                    sk_run_filter(skb, ppp->pass_filter) == 0) {
                         if (ppp->debug & 1)
                                 printk(KERN_DEBUG "PPP: outbound frame not passed\n");
                         kfree_skb(skb);
@@ -1145,8 +1144,7 @@ ppp_send_frame(struct ppp *ppp, struct sk_buff *skb)
                 }
                 /* if this packet passes the active filter, record the time */
                 if (!(ppp->active_filter &&
-                      sk_run_filter(skb, ppp->active_filter,
-                                    ppp->active_len) == 0))
+                      sk_run_filter(skb, ppp->active_filter) == 0))
                         ppp->last_xmit = jiffies;
                 skb_pull(skb, 2);
 #else
@@ -1758,8 +1756,7 @@ ppp_receive_nonmp_frame(struct ppp *ppp, struct sk_buff *skb)
 
                         *skb_push(skb, 2) = 0;
                         if (ppp->pass_filter &&
-                            sk_run_filter(skb, ppp->pass_filter,
-                                          ppp->pass_len) == 0) {
+                            sk_run_filter(skb, ppp->pass_filter) == 0) {
                                 if (ppp->debug & 1)
                                         printk(KERN_DEBUG "PPP: inbound frame "
                                                "not passed\n");
@@ -1767,8 +1764,7 @@ ppp_receive_nonmp_frame(struct ppp *ppp, struct sk_buff *skb)
                                 return;
                         }
                         if (!(ppp->active_filter &&
-                              sk_run_filter(skb, ppp->active_filter,
-                                            ppp->active_len) == 0))
+                              sk_run_filter(skb, ppp->active_filter) == 0))
                                 ppp->last_recv = jiffies;
                         __skb_pull(skb, 2);
                 } else
diff --git a/drivers/net/pptp.c b/drivers/net/pptp.c
index ccbc91326bf..7556a9224f7 100644
--- a/drivers/net/pptp.c
+++ b/drivers/net/pptp.c
@@ -673,8 +673,7 @@ static int __init pptp_init_module(void)
         int err = 0;
         pr_info("PPTP driver version " PPTP_DRIVER_VERSION "\n");
 
-        callid_sock = __vmalloc((MAX_CALLID + 1) * sizeof(void *),
-                GFP_KERNEL | __GFP_ZERO, PAGE_KERNEL);
+        callid_sock = vzalloc((MAX_CALLID + 1) * sizeof(void *));
         if (!callid_sock) {
                 pr_err("PPTP: cann't allocate memory\n");
                 return -ENOMEM;
diff --git a/drivers/net/qla3xxx.c b/drivers/net/qla3xxx.c
index 7496ed2c34a..1a3584edd79 100644
--- a/drivers/net/qla3xxx.c
+++ b/drivers/net/qla3xxx.c
@@ -2467,7 +2467,7 @@ map_error:
 static netdev_tx_t ql3xxx_send(struct sk_buff *skb,
                                struct net_device *ndev)
 {
-        struct ql3_adapter *qdev = (struct ql3_adapter *)netdev_priv(ndev);
+        struct ql3_adapter *qdev = netdev_priv(ndev);
         struct ql3xxx_port_registers __iomem *port_regs =
                         qdev->mem_map_registers;
         struct ql_tx_buf_cb *tx_cb;
@@ -3390,7 +3390,7 @@ static void ql_set_mac_info(struct ql3_adapter *qdev)
 
 static void ql_display_dev_info(struct net_device *ndev)
 {
-        struct ql3_adapter *qdev = (struct ql3_adapter *)netdev_priv(ndev);
+        struct ql3_adapter *qdev = netdev_priv(ndev);
         struct pci_dev *pdev = qdev->pdev;
 
         netdev_info(ndev,
@@ -3573,7 +3573,7 @@ static int ql3xxx_open(struct net_device *ndev)
 
 static int ql3xxx_set_mac_address(struct net_device *ndev, void *p)
 {
-        struct ql3_adapter *qdev = (struct ql3_adapter *)netdev_priv(ndev);
+        struct ql3_adapter *qdev = netdev_priv(ndev);
         struct ql3xxx_port_registers __iomem *port_regs =
                         qdev->mem_map_registers;
         struct sockaddr *addr = p;
@@ -3608,7 +3608,7 @@ static int ql3xxx_set_mac_address(struct net_device *ndev, void *p)
 
 static void ql3xxx_tx_timeout(struct net_device *ndev)
 {
-        struct ql3_adapter *qdev = (struct ql3_adapter *)netdev_priv(ndev);
+        struct ql3_adapter *qdev = netdev_priv(ndev);
 
         netdev_err(ndev, "Resetting...\n");
         /*
diff --git a/drivers/net/qlcnic/qlcnic.h b/drivers/net/qlcnic/qlcnic.h
index 8ecc170c9b7..f267da42f24 100644
--- a/drivers/net/qlcnic/qlcnic.h
+++ b/drivers/net/qlcnic/qlcnic.h
@@ -1,25 +1,8 @@
 /*
- * Copyright (C) 2009 - QLogic Corporation.
- * All rights reserved.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version 2
- * of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place - Suite 330, Boston,
- * MA  02111-1307, USA.
- *
- * The full GNU General Public License is included in this distribution
- * in the file called "COPYING".
+ * QLogic qlcnic NIC Driver
+ * Copyright (c)  2009-2010 QLogic Corporation
  *
+ * See LICENSE.qlcnic for copyright and licensing details.
  */
 
 #ifndef _QLCNIC_H_
@@ -51,8 +34,8 @@
 
 #define _QLCNIC_LINUX_MAJOR 5
 #define _QLCNIC_LINUX_MINOR 0
-#define _QLCNIC_LINUX_SUBVERSION 11
-#define QLCNIC_LINUX_VERSIONID  "5.0.11"
+#define _QLCNIC_LINUX_SUBVERSION 13
+#define QLCNIC_LINUX_VERSIONID  "5.0.13"
 #define QLCNIC_DRV_IDC_VER  0x01
 #define QLCNIC_DRIVER_VERSION  ((_QLCNIC_LINUX_MAJOR << 16) |\
                  (_QLCNIC_LINUX_MINOR << 8) | (_QLCNIC_LINUX_SUBVERSION))
@@ -798,7 +781,6 @@ struct qlcnic_nic_intr_coalesce {
 #define QLCNIC_H2C_OPCODE_GET_NET_STATS                 16
 #define QLCNIC_H2C_OPCODE_PROXY_UPDATE_P2V              17
 #define QLCNIC_H2C_OPCODE_CONFIG_IPADDR                 18
-#define QLCNIC_H2C_OPCODE_CONFIG_LOOPBACK               19
 #define QLCNIC_H2C_OPCODE_PROXY_STOP_DONE               20
 #define QLCNIC_H2C_OPCODE_GET_LINKEVENT                 21
 #define QLCNIC_C2C_OPCODE                               22
@@ -923,6 +905,7 @@ struct qlcnic_ipaddr {
 #define QLCNIC_MACSPOOF                 0x200
 #define QLCNIC_MAC_OVERRIDE_DISABLED    0x400
 #define QLCNIC_PROMISC_DISABLED         0x800
+#define QLCNIC_NEED_FLR                 0x1000
 #define QLCNIC_IS_MSI_FAMILY(adapter) \
         ((adapter)->flags & (QLCNIC_MSI_ENABLED | QLCNIC_MSIX_ENABLED))
 
@@ -1126,8 +1109,7 @@ struct qlcnic_eswitch {
 /* Return codes for Error handling */
 #define QL_STATUS_INVALID_PARAM -1
 
-#define MAX_BW                  100
-#define MIN_BW                  1
+#define MAX_BW                  100     /* % of link speed */
 #define MAX_VLAN_ID             4095
 #define MIN_VLAN_ID             2
 #define MAX_TX_QUEUES           1
@@ -1135,7 +1117,7 @@ struct qlcnic_eswitch {
 #define DEFAULT_MAC_LEARN       1
 
 #define IS_VALID_VLAN(vlan)     (vlan >= MIN_VLAN_ID && vlan < MAX_VLAN_ID)
-#define IS_VALID_BW(bw)         (bw >= MIN_BW && bw <= MAX_BW)
+#define IS_VALID_BW(bw)         (bw <= MAX_BW)
 #define IS_VALID_TX_QUEUES(que) (que > 0 && que <= MAX_TX_QUEUES)
 #define IS_VALID_RX_QUEUES(que) (que > 0 && que <= MAX_RX_QUEUES)
 
@@ -1314,21 +1296,15 @@ int qlcnic_config_bridged_mode(struct qlcnic_adapter *adapter, u32 enable);
 int qlcnic_send_lro_cleanup(struct qlcnic_adapter *adapter);
 void qlcnic_update_cmd_producer(struct qlcnic_adapter *adapter,
                 struct qlcnic_host_tx_ring *tx_ring);
-void qlcnic_clear_ilb_mode(struct qlcnic_adapter *adapter);
-int qlcnic_set_ilb_mode(struct qlcnic_adapter *adapter);
 void qlcnic_fetch_mac(struct qlcnic_adapter *, u32, u32, u8, u8 *);
 
 /* Functions from qlcnic_main.c */
-int qlcnic_request_quiscent_mode(struct qlcnic_adapter *adapter);
-void qlcnic_clear_quiscent_mode(struct qlcnic_adapter *adapter);
 int qlcnic_reset_context(struct qlcnic_adapter *);
 u32 qlcnic_issue_cmd(struct qlcnic_adapter *adapter,
         u32 pci_fn, u32 version, u32 arg1, u32 arg2, u32 arg3, u32 cmd);
 void qlcnic_diag_free_res(struct net_device *netdev, int max_sds_rings);
 int qlcnic_diag_alloc_res(struct net_device *netdev, int test);
-int qlcnic_check_loopback_buff(unsigned char *data);
 netdev_tx_t qlcnic_xmit_frame(struct sk_buff *skb, struct net_device *netdev);
-void qlcnic_process_rcv_ring_diag(struct qlcnic_host_sds_ring *sds_ring);
 
 /* Management functions */
 int qlcnic_get_mac_address(struct qlcnic_adapter *, u8*);
@@ -1377,6 +1353,8 @@ static const struct qlcnic_brdinfo qlcnic_boards[] = {
                 "3200 Series Single Port 10Gb Intelligent Ethernet Adapter"},
         {0x1077, 0x8020, 0x103c, 0x3733,
                 "NC523SFP 10Gb 2-port Server Adapter"},
+        {0x1077, 0x8020, 0x103c, 0x3346,
+                "CN1000Q Dual Port Converged Network Adapter"},
         {0x1077, 0x8020, 0x0, 0x0, "cLOM8214 1/10GbE Controller"},
 };
 
diff --git a/drivers/net/qlcnic/qlcnic_ctx.c b/drivers/net/qlcnic/qlcnic_ctx.c
index 1cdc05dade6..27631f23b3f 100644
--- a/drivers/net/qlcnic/qlcnic_ctx.c
+++ b/drivers/net/qlcnic/qlcnic_ctx.c
@@ -1,25 +1,8 @@
 /*
- * Copyright (C) 2009 - QLogic Corporation.
- * All rights reserved.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version 2
- * of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place - Suite 330, Boston,
- * MA  02111-1307, USA.
- *
- * The full GNU General Public License is included in this distribution
- * in the file called "COPYING".
+ * QLogic qlcnic NIC Driver
+ * Copyright (c)  2009-2010 QLogic Corporation
  *
+ * See LICENSE.qlcnic for copyright and licensing details.
  */
 
 #include "qlcnic.h"
@@ -480,6 +463,11 @@ int qlcnic_fw_create_ctx(struct qlcnic_adapter *adapter)
 {
         int err;
 
+        if (adapter->flags & QLCNIC_NEED_FLR) {
+                pci_reset_function(adapter->pdev);
+                adapter->flags &= ~QLCNIC_NEED_FLR;
+        }
+
         err = qlcnic_fw_cmd_create_rx_ctx(adapter);
         if (err)
                 return err;
diff --git a/drivers/net/qlcnic/qlcnic_ethtool.c b/drivers/net/qlcnic/qlcnic_ethtool.c
index ec21d24015c..0eaf31bf8a0 100644
--- a/drivers/net/qlcnic/qlcnic_ethtool.c
+++ b/drivers/net/qlcnic/qlcnic_ethtool.c
@@ -1,25 +1,8 @@
 /*
- * Copyright (C) 2009 - QLogic Corporation.
- * All rights reserved.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version 2
- * of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place - Suite 330, Boston,
- * MA  02111-1307, USA.
- *
- * The full GNU General Public License is included in this distribution
- * in the file called "COPYING".
+ * QLogic qlcnic NIC Driver
+ * Copyright (c)  2009-2010 QLogic Corporation
  *
+ * See LICENSE.qlcnic for copyright and licensing details.
  */
 
 #include <linux/types.h>
@@ -101,8 +84,7 @@ static const char qlcnic_device_gstrings_stats[][ETH_GSTRING_LEN] = {
 static const char qlcnic_gstrings_test[][ETH_GSTRING_LEN] = {
         "Register_Test_on_offline",
         "Link_Test_on_offline",
-        "Interrupt_Test_offline",
-        "Loopback_Test_offline"
+        "Interrupt_Test_offline"
 };
 
 #define QLCNIC_TEST_LEN ARRAY_SIZE(qlcnic_gstrings_test)
@@ -643,104 +625,6 @@ static int qlcnic_get_sset_count(struct net_device *dev, int sset)
         }
 }
 
-#define QLC_ILB_PKT_SIZE 64
-#define QLC_NUM_ILB_PKT 16
-#define QLC_ILB_MAX_RCV_LOOP 10
-
-static void qlcnic_create_loopback_buff(unsigned char *data)
-{
-        unsigned char random_data[] = {0xa8, 0x06, 0x45, 0x00};
-        memset(data, 0x4e, QLC_ILB_PKT_SIZE);
-        memset(data, 0xff, 12);
-        memcpy(data + 12, random_data, sizeof(random_data));
-}
-
-int qlcnic_check_loopback_buff(unsigned char *data)
-{
-        unsigned char buff[QLC_ILB_PKT_SIZE];
-        qlcnic_create_loopback_buff(buff);
-        return memcmp(data, buff, QLC_ILB_PKT_SIZE);
-}
-
-static int qlcnic_do_ilb_test(struct qlcnic_adapter *adapter)
-{
-        struct qlcnic_recv_context *recv_ctx = &adapter->recv_ctx;
-        struct qlcnic_host_sds_ring *sds_ring = &recv_ctx->sds_rings[0];
-        struct sk_buff *skb;
-        int i, loop, cnt = 0;
-
-        for (i = 0; i < QLC_NUM_ILB_PKT; i++) {
-                skb = dev_alloc_skb(QLC_ILB_PKT_SIZE);
-                qlcnic_create_loopback_buff(skb->data);
-                skb_put(skb, QLC_ILB_PKT_SIZE);
-
-                adapter->diag_cnt = 0;
-                qlcnic_xmit_frame(skb, adapter->netdev);
-
-                loop = 0;
-                do {
-                        msleep(1);
-                        qlcnic_process_rcv_ring_diag(sds_ring);
-                } while (loop++ < QLC_ILB_MAX_RCV_LOOP &&
-                         !adapter->diag_cnt);
-
-                dev_kfree_skb_any(skb);
-
-                if (!adapter->diag_cnt)
-                        dev_warn(&adapter->pdev->dev, "ILB Test: %dth packet"
-                                " not recevied\n", i + 1);
-                else
-                        cnt++;
-        }
-        if (cnt != i) {
-                dev_warn(&adapter->pdev->dev, "ILB Test failed\n");
-                return -1;
-        }
-        return 0;
-}
-
-static int qlcnic_loopback_test(struct net_device *netdev)
-{
-        struct qlcnic_adapter *adapter = netdev_priv(netdev);
-        int max_sds_rings = adapter->max_sds_rings;
-        int ret;
-
-        if (adapter->op_mode == QLCNIC_NON_PRIV_FUNC) {
-                dev_warn(&adapter->pdev->dev, "Loopback test not supported"
-                                "for non privilege function\n");
-                return 0;
-        }
-
-        if (test_and_set_bit(__QLCNIC_RESETTING, &adapter->state))
-                return -EIO;
-
-        if (qlcnic_request_quiscent_mode(adapter)) {
-                clear_bit(__QLCNIC_RESETTING, &adapter->state);
-                return -EIO;
-        }
-
-        ret = qlcnic_diag_alloc_res(netdev, QLCNIC_LOOPBACK_TEST);
-        if (ret)
-                goto clear_it;
-
-        ret = qlcnic_set_ilb_mode(adapter);
-        if (ret)
-                goto done;
-
-        ret = qlcnic_do_ilb_test(adapter);
-
-        qlcnic_clear_ilb_mode(adapter);
-
-done:
-        qlcnic_diag_free_res(netdev, max_sds_rings);
-
-clear_it:
-        qlcnic_clear_quiscent_mode(adapter);
-        adapter->max_sds_rings = max_sds_rings;
-        clear_bit(__QLCNIC_RESETTING, &adapter->state);
-        return ret;
-}
-
 static int qlcnic_irq_test(struct net_device *netdev)
 {
         struct qlcnic_adapter *adapter = netdev_priv(netdev);
@@ -793,9 +677,6 @@ qlcnic_diag_test(struct net_device *dev, struct ethtool_test *eth_test,
                 if (data[2])
                         eth_test->flags |= ETH_TEST_FL_FAILED;
 
-                data[3] = qlcnic_loopback_test(dev);
-                if (data[3])
-                        eth_test->flags |= ETH_TEST_FL_FAILED;
 
         }
 }
@@ -925,9 +806,10 @@ static int qlcnic_set_rx_csum(struct net_device *dev, u32 data)
 
                 dev->features &= ~NETIF_F_LRO;
                 qlcnic_send_lro_cleanup(adapter);
+                dev_info(&adapter->pdev->dev,
+                                        "disabling LRO as rx_csum is off\n");
         }
         adapter->rx_csum = !!data;
-        dev_info(&adapter->pdev->dev, "disabling LRO as rx_csum is off\n");
         return 0;
 }
 
diff --git a/drivers/net/qlcnic/qlcnic_hdr.h b/drivers/net/qlcnic/qlcnic_hdr.h
index 4290b80cde1..19328e05b75 100644
--- a/drivers/net/qlcnic/qlcnic_hdr.h
+++ b/drivers/net/qlcnic/qlcnic_hdr.h
@@ -1,25 +1,8 @@
 /*
- * Copyright (C) 2009 - QLogic Corporation.
- * All rights reserved.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version 2
- * of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place - Suite 330, Boston,
- * MA  02111-1307, USA.
- *
- * The full GNU General Public License is included in this distribution
- * in the file called "COPYING".
+ * QLogic qlcnic NIC Driver
+ * Copyright (c)  2009-2010 QLogic Corporation
  *
+ * See LICENSE.qlcnic for copyright and licensing details.
  */
 
 #ifndef __QLCNIC_HDR_H_
@@ -722,7 +705,7 @@ enum {
 #define QLCNIC_DEV_NPAR_OPER            1 /* NPAR Operational */
 #define QLCNIC_DEV_NPAR_OPER_TIMEO      30 /* Operational time out */
 
-#define QLC_DEV_CHECK_ACTIVE(VAL, FN)           ((VAL) &= (1 << (FN * 4)))
+#define QLC_DEV_CHECK_ACTIVE(VAL, FN)           ((VAL) & (1 << (FN * 4)))
 #define QLC_DEV_SET_REF_CNT(VAL, FN)            ((VAL) |= (1 << (FN * 4)))
 #define QLC_DEV_CLR_REF_CNT(VAL, FN)            ((VAL) &= ~(1 << (FN * 4)))
 #define QLC_DEV_SET_RST_RDY(VAL, FN)            ((VAL) |= (1 << (FN * 4)))
diff --git a/drivers/net/qlcnic/qlcnic_hw.c b/drivers/net/qlcnic/qlcnic_hw.c
index 7a47a2a7ee2..c9c4bf1458a 100644
--- a/drivers/net/qlcnic/qlcnic_hw.c
+++ b/drivers/net/qlcnic/qlcnic_hw.c
@@ -1,25 +1,8 @@
 /*
- * Copyright (C) 2009 - QLogic Corporation.
- * All rights reserved.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version 2
- * of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place - Suite 330, Boston,
- * MA  02111-1307, USA.
- *
- * The full GNU General Public License is included in this distribution
- * in the file called "COPYING".
+ * QLogic qlcnic NIC Driver
+ * Copyright (c)  2009-2010 QLogic Corporation
  *
+ * See LICENSE.qlcnic for copyright and licensing details.
  */
 
 #include "qlcnic.h"
@@ -1234,56 +1217,3 @@ int qlcnic_config_led(struct qlcnic_adapter *adapter, u32 state, u32 rate)
 
         return rv;
 }
-
-static int qlcnic_set_fw_loopback(struct qlcnic_adapter *adapter, u32 flag)
-{
-        struct qlcnic_nic_req   req;
-        int                     rv;
-        u64                     word;
-
-        memset(&req, 0, sizeof(struct qlcnic_nic_req));
-        req.qhdr = cpu_to_le64(QLCNIC_HOST_REQUEST << 23);
-
-        word = QLCNIC_H2C_OPCODE_CONFIG_LOOPBACK |
-                        ((u64)adapter->portnum << 16);
-        req.req_hdr = cpu_to_le64(word);
-        req.words[0] = cpu_to_le64(flag);
-
-        rv = qlcnic_send_cmd_descs(adapter, (struct cmd_desc_type0 *)&req, 1);
-        if (rv)
-                dev_err(&adapter->pdev->dev,
-                        "%sting loopback mode failed.\n",
-                                        flag ? "Set" : "Reset");
-        return rv;
-}
-
-int qlcnic_set_ilb_mode(struct qlcnic_adapter *adapter)
-{
-        if (qlcnic_set_fw_loopback(adapter, 1))
-                return -EIO;
-
-        if (qlcnic_nic_set_promisc(adapter,
-                                VPORT_MISS_MODE_ACCEPT_ALL)) {
-                qlcnic_set_fw_loopback(adapter, 0);
-                return -EIO;
-        }
-
-        msleep(1000);
-        return 0;
-}
-
-void qlcnic_clear_ilb_mode(struct qlcnic_adapter *adapter)
-{
-        int mode = VPORT_MISS_MODE_DROP;
-        struct net_device *netdev = adapter->netdev;
-
-        qlcnic_set_fw_loopback(adapter, 0);
-
-        if (netdev->flags & IFF_PROMISC)
-                mode = VPORT_MISS_MODE_ACCEPT_ALL;
-        else if (netdev->flags & IFF_ALLMULTI)
-                mode = VPORT_MISS_MODE_ACCEPT_MULTI;
-
-        qlcnic_nic_set_promisc(adapter, mode);
-        msleep(1000);
-}
diff --git a/drivers/net/qlcnic/qlcnic_init.c b/drivers/net/qlcnic/qlcnic_init.c
index 0d180c6e41f..9b9c7c39d3e 100644
--- a/drivers/net/qlcnic/qlcnic_init.c
+++ b/drivers/net/qlcnic/qlcnic_init.c
@@ -1,25 +1,8 @@
 /*
- * Copyright (C) 2009 - QLogic Corporation.
- * All rights reserved.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version 2
- * of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place - Suite 330, Boston,
- * MA  02111-1307, USA.
- *
- * The full GNU General Public License is included in this distribution
- * in the file called "COPYING".
+ * QLogic qlcnic NIC Driver
+ * Copyright (c)  2009-2010 QLogic Corporation
  *
+ * See LICENSE.qlcnic for copyright and licensing details.
  */
 
 #include <linux/netdevice.h>
@@ -236,12 +219,11 @@ int qlcnic_alloc_sw_resources(struct qlcnic_adapter *adapter)
         tx_ring->num_desc = adapter->num_txd;
         tx_ring->txq = netdev_get_tx_queue(netdev, 0);
 
-        cmd_buf_arr = vmalloc(TX_BUFF_RINGSIZE(tx_ring));
+        cmd_buf_arr = vzalloc(TX_BUFF_RINGSIZE(tx_ring));
         if (cmd_buf_arr == NULL) {
                 dev_err(&netdev->dev, "failed to allocate cmd buffer ring\n");
                 goto err_out;
         }
-        memset(cmd_buf_arr, 0, TX_BUFF_RINGSIZE(tx_ring));
         tx_ring->cmd_buf_arr = cmd_buf_arr;
 
         recv_ctx = &adapter->recv_ctx;
@@ -275,14 +257,12 @@ int qlcnic_alloc_sw_resources(struct qlcnic_adapter *adapter)
                                 rds_ring->dma_size + NET_IP_ALIGN;
                         break;
                 }
-                rds_ring->rx_buf_arr = (struct qlcnic_rx_buffer *)
-                        vmalloc(RCV_BUFF_RINGSIZE(rds_ring));
+                rds_ring->rx_buf_arr = vzalloc(RCV_BUFF_RINGSIZE(rds_ring));
                 if (rds_ring->rx_buf_arr == NULL) {
                         dev_err(&netdev->dev, "Failed to allocate "
                                 "rx buffer ring %d\n", ring);
                         goto err_out;
                 }
-                memset(rds_ring->rx_buf_arr, 0, RCV_BUFF_RINGSIZE(rds_ring));
                 INIT_LIST_HEAD(&rds_ring->free_list);
                 /*
                  * Now go through all of them, set reference handles
@@ -1693,99 +1673,6 @@ qlcnic_post_rx_buffers_nodb(struct qlcnic_adapter *adapter,
         spin_unlock(&rds_ring->lock);
 }
 
-static void dump_skb(struct sk_buff *skb)
-{
-        int i;
-        unsigned char *data = skb->data;
-
-        for (i = 0; i < skb->len; i++) {
-                printk("%02x ", data[i]);
-                if ((i & 0x0f) == 8)
-                        printk("\n");
-        }
-}
-
-static struct qlcnic_rx_buffer *
-qlcnic_process_rcv_diag(struct qlcnic_adapter *adapter,
-                struct qlcnic_host_sds_ring *sds_ring,
-                int ring, u64 sts_data0)
-{
-        struct qlcnic_recv_context *recv_ctx = &adapter->recv_ctx;
-        struct qlcnic_rx_buffer *buffer;
-        struct sk_buff *skb;
-        struct qlcnic_host_rds_ring *rds_ring;
-        int index, length, cksum, pkt_offset;
-
-        if (unlikely(ring >= adapter->max_rds_rings))
-                return NULL;
-
-        rds_ring = &recv_ctx->rds_rings[ring];
-
-        index = qlcnic_get_sts_refhandle(sts_data0);
-        if (unlikely(index >= rds_ring->num_desc))
-                return NULL;
-
-        buffer = &rds_ring->rx_buf_arr[index];
-
-        length = qlcnic_get_sts_totallength(sts_data0);
-        cksum  = qlcnic_get_sts_status(sts_data0);
-        pkt_offset = qlcnic_get_sts_pkt_offset(sts_data0);
-
-        skb = qlcnic_process_rxbuf(adapter, rds_ring, index, cksum);
-        if (!skb)
-                return buffer;
-
-        if (length > rds_ring->skb_size)
-                skb_put(skb, rds_ring->skb_size);
-        else
-                skb_put(skb, length);
-
-        if (pkt_offset)
-                skb_pull(skb, pkt_offset);
-
-        if (!qlcnic_check_loopback_buff(skb->data))
-                adapter->diag_cnt++;
-        else
-                dump_skb(skb);
-
-        dev_kfree_skb_any(skb);
-        adapter->stats.rx_pkts++;
-        adapter->stats.rxbytes += length;
-
-        return buffer;
-}
-
-void
-qlcnic_process_rcv_ring_diag(struct qlcnic_host_sds_ring *sds_ring)
-{
-        struct qlcnic_adapter *adapter = sds_ring->adapter;
-        struct status_desc *desc;
-        struct qlcnic_rx_buffer *rxbuf;
-        u64 sts_data0;
-
-        int opcode, ring, desc_cnt;
-        u32 consumer = sds_ring->consumer;
-
-        desc = &sds_ring->desc_head[consumer];
-        sts_data0 = le64_to_cpu(desc->status_desc_data[0]);
-
-        if (!(sts_data0 & STATUS_OWNER_HOST))
-                return;
-
-        desc_cnt = qlcnic_get_sts_desc_cnt(sts_data0);
-        opcode = qlcnic_get_sts_opcode(sts_data0);
-
-        ring = qlcnic_get_sts_type(sts_data0);
-        rxbuf = qlcnic_process_rcv_diag(adapter, sds_ring,
-                                        ring, sts_data0);
-
-        desc->status_desc_data[0] = cpu_to_le64(STATUS_OWNER_PHANTOM);
-        consumer = get_next_index(consumer, sds_ring->num_desc);
-
-        sds_ring->consumer = consumer;
-        writel(consumer, sds_ring->crb_sts_consumer);
-}
-
 void
 qlcnic_fetch_mac(struct qlcnic_adapter *adapter, u32 off1, u32 off2,
                         u8 alt_mac, u8 *mac)
diff --git a/drivers/net/qlcnic/qlcnic_main.c b/drivers/net/qlcnic/qlcnic_main.c
index a3dcd04be22..788850e2ba4 100644
--- a/drivers/net/qlcnic/qlcnic_main.c
+++ b/drivers/net/qlcnic/qlcnic_main.c
@@ -1,25 +1,8 @@
 /*
- * Copyright (C) 2009 - QLogic Corporation.
- * All rights reserved.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version 2
- * of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place - Suite 330, Boston,
- * MA  02111-1307, USA.
- *
- * The full GNU General Public License is included in this distribution
- * in the file called "COPYING".
+ * QLogic qlcnic NIC Driver
+ * Copyright (c)  2009-2010 QLogic Corporation
  *
+ * See LICENSE.qlcnic for copyright and licensing details.
  */
 
 #include <linux/slab.h>
@@ -1485,6 +1468,7 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         uint8_t revision_id;
         uint8_t pci_using_dac;
         char brd_name[QLCNIC_MAX_BOARD_NAME_LEN];
+        u32 val;
 
         err = pci_enable_device(pdev);
         if (err)
@@ -1546,6 +1530,10 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (err)
                 goto err_out_iounmap;
 
+        val = QLCRD32(adapter, QLCNIC_CRB_DRV_ACTIVE);
+        if (QLC_DEV_CHECK_ACTIVE(val, adapter->portnum))
+                adapter->flags |= QLCNIC_NEED_FLR;
+
         err = adapter->nic_ops->start_firmware(adapter);
         if (err) {
                 dev_err(&pdev->dev, "Loading fw failed.Please Reboot\n");
@@ -2854,61 +2842,6 @@ qlcnic_set_npar_non_operational(struct qlcnic_adapter *adapter)
         qlcnic_api_unlock(adapter);
 }
 
-/* Caller should held RESETTING bit.
- * This should be call in sync with qlcnic_request_quiscent_mode.
- */
-void qlcnic_clear_quiscent_mode(struct qlcnic_adapter *adapter)
-{
-        qlcnic_clr_drv_state(adapter);
-        qlcnic_api_lock(adapter);
-        QLCWR32(adapter, QLCNIC_CRB_DEV_STATE, QLCNIC_DEV_READY);
-        qlcnic_api_unlock(adapter);
-}
-
-/* Caller should held RESETTING bit.
- */
-int qlcnic_request_quiscent_mode(struct qlcnic_adapter *adapter)
-{
-        u8 timeo = adapter->dev_init_timeo / 2;
-        u32 state;
-
-        if (qlcnic_api_lock(adapter))
-                return -EIO;
-
-        state = QLCRD32(adapter, QLCNIC_CRB_DEV_STATE);
-        if (state != QLCNIC_DEV_READY)
-                return -EIO;
-
-        QLCWR32(adapter, QLCNIC_CRB_DEV_STATE, QLCNIC_DEV_NEED_QUISCENT);
-        qlcnic_api_unlock(adapter);
-        QLCDB(adapter, DRV, "NEED QUISCENT state set\n");
-        qlcnic_idc_debug_info(adapter, 0);
-
-        qlcnic_set_drv_state(adapter, QLCNIC_DEV_NEED_QUISCENT);
-
-        do {
-                msleep(2000);
-                state = QLCRD32(adapter, QLCNIC_CRB_DEV_STATE);
-                if (state == QLCNIC_DEV_QUISCENT)
-                        return 0;
-                if (!qlcnic_check_drv_state(adapter)) {
-                        if (qlcnic_api_lock(adapter))
-                                return -EIO;
-                        QLCWR32(adapter, QLCNIC_CRB_DEV_STATE,
-                                                        QLCNIC_DEV_QUISCENT);
-                        qlcnic_api_unlock(adapter);
-                        QLCDB(adapter, DRV, "QUISCENT mode set\n");
-                        return 0;
-                }
-        } while (--timeo);
-
-        dev_err(&adapter->pdev->dev, "Failed to quiesce device, DRV_STATE=%08x"
-                " DRV_ACTIVE=%08x\n", QLCRD32(adapter, QLCNIC_CRB_DRV_STATE),
-                QLCRD32(adapter, QLCNIC_CRB_DRV_ACTIVE));
-        qlcnic_clear_quiscent_mode(adapter);
-        return -EIO;
-}
-
 /*Transit to RESET state from READY state only */
 static void
 qlcnic_dev_request_reset(struct qlcnic_adapter *adapter)
@@ -3587,9 +3520,12 @@ validate_esw_config(struct qlcnic_adapter *adapter,
                 case QLCNIC_PORT_DEFAULTS:
                         if (QLC_DEV_GET_DRV(op_mode, pci_func) !=
                                                 QLCNIC_NON_PRIV_FUNC) {
-                                esw_cfg[i].mac_anti_spoof = 0;
-                                esw_cfg[i].mac_override = 1;
-                                esw_cfg[i].promisc_mode = 1;
+                                if (esw_cfg[i].mac_anti_spoof != 0)
+                                        return QL_STATUS_INVALID_PARAM;
+                                if (esw_cfg[i].mac_override != 1)
+                                        return QL_STATUS_INVALID_PARAM;
+                                if (esw_cfg[i].promisc_mode != 1)
+                                        return QL_STATUS_INVALID_PARAM;
                         }
                         break;
                 case QLCNIC_ADD_VLAN:
diff --git a/drivers/net/qlge/qlge.h b/drivers/net/qlge/qlge.h
index 22821398fc6..bdb8fe86853 100644
--- a/drivers/net/qlge/qlge.h
+++ b/drivers/net/qlge/qlge.h
@@ -16,7 +16,7 @@
  */
 #define DRV_NAME        "qlge"
 #define DRV_STRING      "QLogic 10 Gigabit PCI-E Ethernet Driver "
-#define DRV_VERSION     "v1.00.00.25.00.00-01"
+#define DRV_VERSION     "v1.00.00.27.00.00-01"
 
 #define WQ_ADDR_ALIGN   0x3     /* 4 byte alignment */
 
@@ -2221,6 +2221,7 @@ int ql_write_mpi_reg(struct ql_adapter *qdev, u32 reg, u32 data);
 int ql_unpause_mpi_risc(struct ql_adapter *qdev);
 int ql_pause_mpi_risc(struct ql_adapter *qdev);
 int ql_hard_reset_mpi_risc(struct ql_adapter *qdev);
+int ql_soft_reset_mpi_risc(struct ql_adapter *qdev);
 int ql_dump_risc_ram_area(struct ql_adapter *qdev, void *buf,
                 u32 ram_addr, int word_count);
 int ql_core_dump(struct ql_adapter *qdev,
@@ -2236,6 +2237,7 @@ int ql_mb_set_mgmnt_traffic_ctl(struct ql_adapter *qdev, u32 control);
 int ql_mb_get_port_cfg(struct ql_adapter *qdev);
 int ql_mb_set_port_cfg(struct ql_adapter *qdev);
 int ql_wait_fifo_empty(struct ql_adapter *qdev);
+void ql_get_dump(struct ql_adapter *qdev, void *buff);
 void ql_gen_reg_dump(struct ql_adapter *qdev,
                         struct ql_reg_dump *mpi_coredump);
 netdev_tx_t ql_lb_send(struct sk_buff *skb, struct net_device *ndev);
diff --git a/drivers/net/qlge/qlge_dbg.c b/drivers/net/qlge/qlge_dbg.c
index 4747492935e..fca804f36d6 100644
--- a/drivers/net/qlge/qlge_dbg.c
+++ b/drivers/net/qlge/qlge_dbg.c
@@ -1317,9 +1317,28 @@ void ql_gen_reg_dump(struct ql_adapter *qdev,
         status = ql_get_ets_regs(qdev, &mpi_coredump->ets[0]);
         if (status)
                 return;
+}
+
+void ql_get_dump(struct ql_adapter *qdev, void *buff)
+{
+        /*
+         * If the dump has already been taken and is stored
+         * in our internal buffer and if force dump is set then
+         * just start the spool to dump it to the log file
+         * and also, take a snapshot of the general regs to
+         * to the user's buffer or else take complete dump
+         * to the user's buffer if force is not set.
+         */
 
-        if (test_bit(QL_FRC_COREDUMP, &qdev->flags))
+        if (!test_bit(QL_FRC_COREDUMP, &qdev->flags)) {
+                if (!ql_core_dump(qdev, buff))
+                        ql_soft_reset_mpi_risc(qdev);
+                else
+                        netif_err(qdev, drv, qdev->ndev, "coredump failed!\n");
+        } else {
+                ql_gen_reg_dump(qdev, buff);
                 ql_get_core_dump(qdev);
+        }
 }
 
 /* Coredump to messages log file using separate worker thread */
diff --git a/drivers/net/qlge/qlge_ethtool.c b/drivers/net/qlge/qlge_ethtool.c
index 4892d64f4e0..8149cc9de4c 100644
--- a/drivers/net/qlge/qlge_ethtool.c
+++ b/drivers/net/qlge/qlge_ethtool.c
@@ -375,7 +375,10 @@ static void ql_get_drvinfo(struct net_device *ndev,
         strncpy(drvinfo->bus_info, pci_name(qdev->pdev), 32);
         drvinfo->n_stats = 0;
         drvinfo->testinfo_len = 0;
-        drvinfo->regdump_len = 0;
+        if (!test_bit(QL_FRC_COREDUMP, &qdev->flags))
+                drvinfo->regdump_len = sizeof(struct ql_mpi_coredump);
+        else
+                drvinfo->regdump_len = sizeof(struct ql_reg_dump);
         drvinfo->eedump_len = 0;
 }
 
@@ -547,7 +550,12 @@ static void ql_self_test(struct net_device *ndev,
 
 static int ql_get_regs_len(struct net_device *ndev)
 {
-        return sizeof(struct ql_reg_dump);
+        struct ql_adapter *qdev = netdev_priv(ndev);
+
+        if (!test_bit(QL_FRC_COREDUMP, &qdev->flags))
+                return sizeof(struct ql_mpi_coredump);
+        else
+                return sizeof(struct ql_reg_dump);
 }
 
 static void ql_get_regs(struct net_device *ndev,
@@ -555,7 +563,12 @@ static void ql_get_regs(struct net_device *ndev,
 {
         struct ql_adapter *qdev = netdev_priv(ndev);
 
-        ql_gen_reg_dump(qdev, p);
+        ql_get_dump(qdev, p);
+        qdev->core_is_dumped = 0;
+        if (!test_bit(QL_FRC_COREDUMP, &qdev->flags))
+                regs->len = sizeof(struct ql_mpi_coredump);
+        else
+                regs->len = sizeof(struct ql_reg_dump);
 }
 
 static int ql_get_coalesce(struct net_device *dev, struct ethtool_coalesce *c)
diff --git a/drivers/net/qlge/qlge_main.c b/drivers/net/qlge/qlge_main.c
index 528eaef5308..e4dbbbfec72 100644
--- a/drivers/net/qlge/qlge_main.c
+++ b/drivers/net/qlge/qlge_main.c
@@ -3844,7 +3844,7 @@ static int ql_adapter_reset(struct ql_adapter *qdev)
 
 static void ql_display_dev_info(struct net_device *ndev)
 {
-        struct ql_adapter *qdev = (struct ql_adapter *)netdev_priv(ndev);
+        struct ql_adapter *qdev = netdev_priv(ndev);
 
         netif_info(qdev, probe, qdev->ndev,
                    "Function #%d, Port %d, NIC Roll %d, NIC Rev = %d, "
@@ -4264,7 +4264,7 @@ static struct net_device_stats *qlge_get_stats(struct net_device
 
 static void qlge_set_multicast_list(struct net_device *ndev)
 {
-        struct ql_adapter *qdev = (struct ql_adapter *)netdev_priv(ndev);
+        struct ql_adapter *qdev = netdev_priv(ndev);
         struct netdev_hw_addr *ha;
         int i, status;
 
@@ -4354,7 +4354,7 @@ exit:
 
 static int qlge_set_mac_address(struct net_device *ndev, void *p)
 {
-        struct ql_adapter *qdev = (struct ql_adapter *)netdev_priv(ndev);
+        struct ql_adapter *qdev = netdev_priv(ndev);
         struct sockaddr *addr = p;
         int status;
 
@@ -4377,7 +4377,7 @@ static int qlge_set_mac_address(struct net_device *ndev, void *p)
 
 static void qlge_tx_timeout(struct net_device *ndev)
 {
-        struct ql_adapter *qdev = (struct ql_adapter *)netdev_priv(ndev);
+        struct ql_adapter *qdev = netdev_priv(ndev);
         ql_queue_asic_error(qdev);
 }
 
diff --git a/drivers/net/qlge/qlge_mpi.c b/drivers/net/qlge/qlge_mpi.c
index 0e7c7c7ee16..100a462cc91 100644
--- a/drivers/net/qlge/qlge_mpi.c
+++ b/drivers/net/qlge/qlge_mpi.c
@@ -87,7 +87,7 @@ exit:
         return status;
 }
 
-static int ql_soft_reset_mpi_risc(struct ql_adapter *qdev)
+int ql_soft_reset_mpi_risc(struct ql_adapter *qdev)
 {
         int status;
         status = ql_write_mpi_reg(qdev, 0x00001010, 1);
diff --git a/drivers/net/s2io.c b/drivers/net/s2io.c
index ecc25aab896..0f4219cb0be 100644
--- a/drivers/net/s2io.c
+++ b/drivers/net/s2io.c
@@ -8321,8 +8321,7 @@ mem_alloc_failed:
 
 static void __devexit s2io_rem_nic(struct pci_dev *pdev)
 {
-        struct net_device *dev =
-                (struct net_device *)pci_get_drvdata(pdev);
+        struct net_device *dev = pci_get_drvdata(pdev);
         struct s2io_nic *sp;
 
         if (dev == NULL) {
diff --git a/drivers/net/sc92031.c b/drivers/net/sc92031.c
index 417adf37282..76290a8c3c1 100644
--- a/drivers/net/sc92031.c
+++ b/drivers/net/sc92031.c
@@ -1449,7 +1449,8 @@ static int __devinit sc92031_probe(struct pci_dev *pdev,
         dev->irq = pdev->irq;
 
         /* faked with skb_copy_and_csum_dev */
-        dev->features = NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_HIGHDMA;
+        dev->features = NETIF_F_SG | NETIF_F_HIGHDMA |
+                NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
 
         dev->netdev_ops         = &sc92031_netdev_ops;
         dev->watchdog_timeo     = TX_TIMEOUT;
diff --git a/drivers/net/sfc/efx.c b/drivers/net/sfc/efx.c
index fb83cdd9464..2166c1d0a53 100644
--- a/drivers/net/sfc/efx.c
+++ b/drivers/net/sfc/efx.c
@@ -23,7 +23,6 @@
 #include <linux/gfp.h>
 #include "net_driver.h"
 #include "efx.h"
-#include "mdio_10g.h"
 #include "nic.h"
 
 #include "mcdi.h"
@@ -921,6 +920,7 @@ static void efx_mac_work(struct work_struct *data)
 
 static int efx_probe_port(struct efx_nic *efx)
 {
+        unsigned char *perm_addr;
         int rc;
 
         netif_dbg(efx, probe, efx->net_dev, "create port\n");
@@ -934,11 +934,12 @@ static int efx_probe_port(struct efx_nic *efx)
                 return rc;
 
         /* Sanity check MAC address */
-        if (is_valid_ether_addr(efx->mac_address)) {
-                memcpy(efx->net_dev->dev_addr, efx->mac_address, ETH_ALEN);
+        perm_addr = efx->net_dev->perm_addr;
+        if (is_valid_ether_addr(perm_addr)) {
+                memcpy(efx->net_dev->dev_addr, perm_addr, ETH_ALEN);
         } else {
                 netif_err(efx, probe, efx->net_dev, "invalid MAC address %pM\n",
-                          efx->mac_address);
+                          perm_addr);
                 if (!allow_bad_hwaddr) {
                         rc = -EINVAL;
                         goto err;
@@ -1980,7 +1981,6 @@ void efx_reset_down(struct efx_nic *efx, enum reset_type method)
 
         efx_stop_all(efx);
         mutex_lock(&efx->mac_lock);
-        mutex_lock(&efx->spi_lock);
 
         efx_fini_channels(efx);
         if (efx->port_initialized && method != RESET_TYPE_INVISIBLE)
@@ -2022,7 +2022,6 @@ int efx_reset_up(struct efx_nic *efx, enum reset_type method, bool ok)
         efx_init_channels(efx);
         efx_restore_filters(efx);
 
-        mutex_unlock(&efx->spi_lock);
         mutex_unlock(&efx->mac_lock);
 
         efx_start_all(efx);
@@ -2032,7 +2031,6 @@ int efx_reset_up(struct efx_nic *efx, enum reset_type method, bool ok)
 fail:
         efx->port_initialized = false;
 
-        mutex_unlock(&efx->spi_lock);
         mutex_unlock(&efx->mac_lock);
 
         return rc;
@@ -2220,8 +2218,6 @@ static int efx_init_struct(struct efx_nic *efx, struct efx_nic_type *type,
         /* Initialise common structures */
         memset(efx, 0, sizeof(*efx));
         spin_lock_init(&efx->biu_lock);
-        mutex_init(&efx->mdio_lock);
-        mutex_init(&efx->spi_lock);
 #ifdef CONFIG_SFC_MTD
         INIT_LIST_HEAD(&efx->mtd_list);
 #endif
diff --git a/drivers/net/sfc/ethtool.c b/drivers/net/sfc/ethtool.c
index edb9d16b8b4..aae756bf47e 100644
--- a/drivers/net/sfc/ethtool.c
+++ b/drivers/net/sfc/ethtool.c
@@ -17,8 +17,6 @@
 #include "efx.h"
 #include "filter.h"
 #include "nic.h"
-#include "spi.h"
-#include "mdio_10g.h"
 
 struct ethtool_string {
         char name[ETH_GSTRING_LEN];
@@ -629,61 +627,6 @@ static u32 efx_ethtool_get_link(struct net_device *net_dev)
         return efx->link_state.up;
 }
 
-static int efx_ethtool_get_eeprom_len(struct net_device *net_dev)
-{
-        struct efx_nic *efx = netdev_priv(net_dev);
-        struct efx_spi_device *spi = efx->spi_eeprom;
-
-        if (!spi)
-                return 0;
-        return min(spi->size, EFX_EEPROM_BOOTCONFIG_END) -
-                min(spi->size, EFX_EEPROM_BOOTCONFIG_START);
-}
-
-static int efx_ethtool_get_eeprom(struct net_device *net_dev,
-                                  struct ethtool_eeprom *eeprom, u8 *buf)
-{
-        struct efx_nic *efx = netdev_priv(net_dev);
-        struct efx_spi_device *spi = efx->spi_eeprom;
-        size_t len;
-        int rc;
-
-        rc = mutex_lock_interruptible(&efx->spi_lock);
-        if (rc)
-                return rc;
-        rc = falcon_spi_read(efx, spi,
-                             eeprom->offset + EFX_EEPROM_BOOTCONFIG_START,
-                             eeprom->len, &len, buf);
-        mutex_unlock(&efx->spi_lock);
-
-        eeprom->magic = EFX_ETHTOOL_EEPROM_MAGIC;
-        eeprom->len = len;
-        return rc;
-}
-
-static int efx_ethtool_set_eeprom(struct net_device *net_dev,
-                                  struct ethtool_eeprom *eeprom, u8 *buf)
-{
-        struct efx_nic *efx = netdev_priv(net_dev);
-        struct efx_spi_device *spi = efx->spi_eeprom;
-        size_t len;
-        int rc;
-
-        if (eeprom->magic != EFX_ETHTOOL_EEPROM_MAGIC)
-                return -EINVAL;
-
-        rc = mutex_lock_interruptible(&efx->spi_lock);
-        if (rc)
-                return rc;
-        rc = falcon_spi_write(efx, spi,
-                              eeprom->offset + EFX_EEPROM_BOOTCONFIG_START,
-                              eeprom->len, &len, buf);
-        mutex_unlock(&efx->spi_lock);
-
-        eeprom->len = len;
-        return rc;
-}
-
 static int efx_ethtool_get_coalesce(struct net_device *net_dev,
                                     struct ethtool_coalesce *coalesce)
 {
@@ -1116,9 +1059,6 @@ const struct ethtool_ops efx_ethtool_ops = {
         .set_msglevel           = efx_ethtool_set_msglevel,
         .nway_reset             = efx_ethtool_nway_reset,
         .get_link               = efx_ethtool_get_link,
-        .get_eeprom_len         = efx_ethtool_get_eeprom_len,
-        .get_eeprom             = efx_ethtool_get_eeprom,
-        .set_eeprom             = efx_ethtool_set_eeprom,
         .get_coalesce           = efx_ethtool_get_coalesce,
         .set_coalesce           = efx_ethtool_set_coalesce,
         .get_ringparam          = efx_ethtool_get_ringparam,
diff --git a/drivers/net/sfc/falcon.c b/drivers/net/sfc/falcon.c
index 267019bb2b1..70e4f7dcce8 100644
--- a/drivers/net/sfc/falcon.c
+++ b/drivers/net/sfc/falcon.c
@@ -24,7 +24,6 @@
 #include "nic.h"
 #include "regs.h"
 #include "io.h"
-#include "mdio_10g.h"
 #include "phy.h"
 #include "workarounds.h"
 
@@ -255,7 +254,6 @@ int falcon_spi_cmd(struct efx_nic *efx, const struct efx_spi_device *spi,
         /* Input validation */
         if (len > FALCON_SPI_MAX_LEN)
                 return -EINVAL;
-        BUG_ON(!mutex_is_locked(&efx->spi_lock));
 
         /* Check that previous command is not still running */
         rc = falcon_spi_poll(efx);
@@ -719,6 +717,7 @@ static int falcon_mdio_write(struct net_device *net_dev,
                              int prtad, int devad, u16 addr, u16 value)
 {
         struct efx_nic *efx = netdev_priv(net_dev);
+        struct falcon_nic_data *nic_data = efx->nic_data;
         efx_oword_t reg;
         int rc;
 
@@ -726,7 +725,7 @@ static int falcon_mdio_write(struct net_device *net_dev,
                    "writing MDIO %d register %d.%d with 0x%04x\n",
                     prtad, devad, addr, value);
 
-        mutex_lock(&efx->mdio_lock);
+        mutex_lock(&nic_data->mdio_lock);
 
         /* Check MDIO not currently being accessed */
         rc = falcon_gmii_wait(efx);
@@ -762,7 +761,7 @@ static int falcon_mdio_write(struct net_device *net_dev,
         }
 
 out:
-        mutex_unlock(&efx->mdio_lock);
+        mutex_unlock(&nic_data->mdio_lock);
         return rc;
 }
 
@@ -771,10 +770,11 @@ static int falcon_mdio_read(struct net_device *net_dev,
                             int prtad, int devad, u16 addr)
 {
         struct efx_nic *efx = netdev_priv(net_dev);
+        struct falcon_nic_data *nic_data = efx->nic_data;
         efx_oword_t reg;
         int rc;
 
-        mutex_lock(&efx->mdio_lock);
+        mutex_lock(&nic_data->mdio_lock);
 
         /* Check MDIO not currently being accessed */
         rc = falcon_gmii_wait(efx);
@@ -813,7 +813,7 @@ static int falcon_mdio_read(struct net_device *net_dev,
         }
 
 out:
-        mutex_unlock(&efx->mdio_lock);
+        mutex_unlock(&nic_data->mdio_lock);
         return rc;
 }
 
@@ -841,6 +841,7 @@ static int falcon_probe_port(struct efx_nic *efx)
         }
 
         /* Fill out MDIO structure and loopback modes */
+        mutex_init(&nic_data->mdio_lock);
         efx->mdio.mdio_read = falcon_mdio_read;
         efx->mdio.mdio_write = falcon_mdio_write;
         rc = efx->phy_op->probe(efx);
@@ -880,6 +881,41 @@ static void falcon_remove_port(struct efx_nic *efx)
         efx_nic_free_buffer(efx, &efx->stats_buffer);
 }
 
+/* Global events are basically PHY events */
+static bool
+falcon_handle_global_event(struct efx_channel *channel, efx_qword_t *event)
+{
+        struct efx_nic *efx = channel->efx;
+        struct falcon_nic_data *nic_data = efx->nic_data;
+
+        if (EFX_QWORD_FIELD(*event, FSF_AB_GLB_EV_G_PHY0_INTR) ||
+            EFX_QWORD_FIELD(*event, FSF_AB_GLB_EV_XG_PHY0_INTR) ||
+            EFX_QWORD_FIELD(*event, FSF_AB_GLB_EV_XFP_PHY0_INTR))
+                /* Ignored */
+                return true;
+
+        if ((efx_nic_rev(efx) == EFX_REV_FALCON_B0) &&
+            EFX_QWORD_FIELD(*event, FSF_BB_GLB_EV_XG_MGT_INTR)) {
+                nic_data->xmac_poll_required = true;
+                return true;
+        }
+
+        if (efx_nic_rev(efx) <= EFX_REV_FALCON_A1 ?
+            EFX_QWORD_FIELD(*event, FSF_AA_GLB_EV_RX_RECOVERY) :
+            EFX_QWORD_FIELD(*event, FSF_BB_GLB_EV_RX_RECOVERY)) {
+                netif_err(efx, rx_err, efx->net_dev,
+                          "channel %d seen global RX_RESET event. Resetting.\n",
+                          channel->channel);
+
+                atomic_inc(&efx->rx_reset);
+                efx_schedule_reset(efx, EFX_WORKAROUND_6555(efx) ?
+                                   RESET_TYPE_RX_RECOVERY : RESET_TYPE_DISABLE);
+                return true;
+        }
+
+        return false;
+}
+
 /**************************************************************************
  *
  * Falcon test code
@@ -889,6 +925,7 @@ static void falcon_remove_port(struct efx_nic *efx)
 static int
 falcon_read_nvram(struct efx_nic *efx, struct falcon_nvconfig *nvconfig_out)
 {
+        struct falcon_nic_data *nic_data = efx->nic_data;
         struct falcon_nvconfig *nvconfig;
         struct efx_spi_device *spi;
         void *region;
@@ -896,8 +933,11 @@ falcon_read_nvram(struct efx_nic *efx, struct falcon_nvconfig *nvconfig_out)
         __le16 *word, *limit;
         u32 csum;
 
-        spi = efx->spi_flash ? efx->spi_flash : efx->spi_eeprom;
-        if (!spi)
+        if (efx_spi_present(&nic_data->spi_flash))
+                spi = &nic_data->spi_flash;
+        else if (efx_spi_present(&nic_data->spi_eeprom))
+                spi = &nic_data->spi_eeprom;
+        else
                 return -EINVAL;
 
         region = kmalloc(FALCON_NVCONFIG_END, GFP_KERNEL);
@@ -905,12 +945,13 @@ falcon_read_nvram(struct efx_nic *efx, struct falcon_nvconfig *nvconfig_out)
                 return -ENOMEM;
         nvconfig = region + FALCON_NVCONFIG_OFFSET;
 
-        mutex_lock(&efx->spi_lock);
+        mutex_lock(&nic_data->spi_lock);
         rc = falcon_spi_read(efx, spi, 0, FALCON_NVCONFIG_END, NULL, region);
-        mutex_unlock(&efx->spi_lock);
+        mutex_unlock(&nic_data->spi_lock);
         if (rc) {
                 netif_err(efx, hw, efx->net_dev, "Failed to read %s\n",
-                          efx->spi_flash ? "flash" : "EEPROM");
+                          efx_spi_present(&nic_data->spi_flash) ?
+                          "flash" : "EEPROM");
                 rc = -EIO;
                 goto out;
         }
@@ -1012,7 +1053,7 @@ static int falcon_b0_test_registers(struct efx_nic *efx)
 
 /* Resets NIC to known state.  This routine must be called in process
  * context and is allowed to sleep. */
-static int falcon_reset_hw(struct efx_nic *efx, enum reset_type method)
+static int __falcon_reset_hw(struct efx_nic *efx, enum reset_type method)
 {
         struct falcon_nic_data *nic_data = efx->nic_data;
         efx_oword_t glb_ctl_reg_ker;
@@ -1108,6 +1149,18 @@ fail5:
         return rc;
 }
 
+static int falcon_reset_hw(struct efx_nic *efx, enum reset_type method)
+{
+        struct falcon_nic_data *nic_data = efx->nic_data;
+        int rc;
+
+        mutex_lock(&nic_data->spi_lock);
+        rc = __falcon_reset_hw(efx, method);
+        mutex_unlock(&nic_data->spi_lock);
+
+        return rc;
+}
+
 static void falcon_monitor(struct efx_nic *efx)
 {
         bool link_changed;
@@ -1189,16 +1242,11 @@ static int falcon_reset_sram(struct efx_nic *efx)
         return -ETIMEDOUT;
 }
 
-static int falcon_spi_device_init(struct efx_nic *efx,
-                                  struct efx_spi_device **spi_device_ret,
+static void falcon_spi_device_init(struct efx_nic *efx,
+                                  struct efx_spi_device *spi_device,
                                   unsigned int device_id, u32 device_type)
 {
-        struct efx_spi_device *spi_device;
-
         if (device_type != 0) {
-                spi_device = kzalloc(sizeof(*spi_device), GFP_KERNEL);
-                if (!spi_device)
-                        return -ENOMEM;
                 spi_device->device_id = device_id;
                 spi_device->size =
                         1 << SPI_DEV_TYPE_FIELD(device_type, SPI_DEV_TYPE_SIZE);
@@ -1215,27 +1263,15 @@ static int falcon_spi_device_init(struct efx_nic *efx,
                         1 << SPI_DEV_TYPE_FIELD(device_type,
                                                 SPI_DEV_TYPE_BLOCK_SIZE);
         } else {
-                spi_device = NULL;
+                spi_device->size = 0;
         }
-
-        kfree(*spi_device_ret);
-        *spi_device_ret = spi_device;
-        return 0;
-}
-
-static void falcon_remove_spi_devices(struct efx_nic *efx)
-{
-        kfree(efx->spi_eeprom);
-        efx->spi_eeprom = NULL;
-        kfree(efx->spi_flash);
-        efx->spi_flash = NULL;
 }
 
 /* Extract non-volatile configuration */
 static int falcon_probe_nvconfig(struct efx_nic *efx)
 {
+        struct falcon_nic_data *nic_data = efx->nic_data;
         struct falcon_nvconfig *nvconfig;
-        int board_rev;
         int rc;
 
         nvconfig = kmalloc(sizeof(*nvconfig), GFP_KERNEL);
@@ -1243,55 +1279,32 @@ static int falcon_probe_nvconfig(struct efx_nic *efx)
                 return -ENOMEM;
 
         rc = falcon_read_nvram(efx, nvconfig);
-        if (rc == -EINVAL) {
-                netif_err(efx, probe, efx->net_dev,
-                          "NVRAM is invalid therefore using defaults\n");
-                efx->phy_type = PHY_TYPE_NONE;
-                efx->mdio.prtad = MDIO_PRTAD_NONE;
-                board_rev = 0;
-                rc = 0;
-        } else if (rc) {
-                goto fail1;
-        } else {
-                struct falcon_nvconfig_board_v2 *v2 = &nvconfig->board_v2;
-                struct falcon_nvconfig_board_v3 *v3 = &nvconfig->board_v3;
-
-                efx->phy_type = v2->port0_phy_type;
-                efx->mdio.prtad = v2->port0_phy_addr;
-                board_rev = le16_to_cpu(v2->board_revision);
-
-                if (le16_to_cpu(nvconfig->board_struct_ver) >= 3) {
-                        rc = falcon_spi_device_init(
-                                efx, &efx->spi_flash, FFE_AB_SPI_DEVICE_FLASH,
-                                le32_to_cpu(v3->spi_device_type
-                                            [FFE_AB_SPI_DEVICE_FLASH]));
-                        if (rc)
-                                goto fail2;
-                        rc = falcon_spi_device_init(
-                                efx, &efx->spi_eeprom, FFE_AB_SPI_DEVICE_EEPROM,
-                                le32_to_cpu(v3->spi_device_type
-                                            [FFE_AB_SPI_DEVICE_EEPROM]));
-                        if (rc)
-                                goto fail2;
-                }
+        if (rc)
+                goto out;
+
+        efx->phy_type = nvconfig->board_v2.port0_phy_type;
+        efx->mdio.prtad = nvconfig->board_v2.port0_phy_addr;
+
+        if (le16_to_cpu(nvconfig->board_struct_ver) >= 3) {
+                falcon_spi_device_init(
+                        efx, &nic_data->spi_flash, FFE_AB_SPI_DEVICE_FLASH,
+                        le32_to_cpu(nvconfig->board_v3
+                                    .spi_device_type[FFE_AB_SPI_DEVICE_FLASH]));
+                falcon_spi_device_init(
+                        efx, &nic_data->spi_eeprom, FFE_AB_SPI_DEVICE_EEPROM,
+                        le32_to_cpu(nvconfig->board_v3
+                                    .spi_device_type[FFE_AB_SPI_DEVICE_EEPROM]));
         }
 
         /* Read the MAC addresses */
-        memcpy(efx->mac_address, nvconfig->mac_address[0], ETH_ALEN);
+        memcpy(efx->net_dev->perm_addr, nvconfig->mac_address[0], ETH_ALEN);
 
         netif_dbg(efx, probe, efx->net_dev, "PHY is %d phy_id %d\n",
                   efx->phy_type, efx->mdio.prtad);
 
-        rc = falcon_probe_board(efx, board_rev);
-        if (rc)
-                goto fail2;
-
-        kfree(nvconfig);
-        return 0;
-
- fail2:
-        falcon_remove_spi_devices(efx);
- fail1:
+        rc = falcon_probe_board(efx,
+                                le16_to_cpu(nvconfig->board_v2.board_revision));
+out:
         kfree(nvconfig);
         return rc;
 }
@@ -1299,6 +1312,7 @@ static int falcon_probe_nvconfig(struct efx_nic *efx)
 /* Probe all SPI devices on the NIC */
 static void falcon_probe_spi_devices(struct efx_nic *efx)
 {
+        struct falcon_nic_data *nic_data = efx->nic_data;
         efx_oword_t nic_stat, gpio_ctl, ee_vpd_cfg;
         int boot_dev;
 
@@ -1327,12 +1341,14 @@ static void falcon_probe_spi_devices(struct efx_nic *efx)
                 efx_writeo(efx, &ee_vpd_cfg, FR_AB_EE_VPD_CFG0);
         }
 
+        mutex_init(&nic_data->spi_lock);
+
         if (boot_dev == FFE_AB_SPI_DEVICE_FLASH)
-                falcon_spi_device_init(efx, &efx->spi_flash,
+                falcon_spi_device_init(efx, &nic_data->spi_flash,
                                        FFE_AB_SPI_DEVICE_FLASH,
                                        default_flash_type);
         if (boot_dev == FFE_AB_SPI_DEVICE_EEPROM)
-                falcon_spi_device_init(efx, &efx->spi_eeprom,
+                falcon_spi_device_init(efx, &nic_data->spi_eeprom,
                                        FFE_AB_SPI_DEVICE_EEPROM,
                                        large_eeprom_type);
 }
@@ -1397,7 +1413,7 @@ static int falcon_probe_nic(struct efx_nic *efx)
         }
 
         /* Now we can reset the NIC */
-        rc = falcon_reset_hw(efx, RESET_TYPE_ALL);
+        rc = __falcon_reset_hw(efx, RESET_TYPE_ALL);
         if (rc) {
                 netif_err(efx, probe, efx->net_dev, "failed to reset NIC\n");
                 goto fail3;
@@ -1419,8 +1435,11 @@ static int falcon_probe_nic(struct efx_nic *efx)
 
         /* Read in the non-volatile configuration */
         rc = falcon_probe_nvconfig(efx);
-        if (rc)
+        if (rc) {
+                if (rc == -EINVAL)
+                        netif_err(efx, probe, efx->net_dev, "NVRAM is invalid\n");
                 goto fail5;
+        }
 
         /* Initialise I2C adapter */
         board = falcon_board(efx);
@@ -1452,7 +1471,6 @@ static int falcon_probe_nic(struct efx_nic *efx)
         BUG_ON(i2c_del_adapter(&board->i2c_adap));
         memset(&board->i2c_adap, 0, sizeof(board->i2c_adap));
  fail5:
-        falcon_remove_spi_devices(efx);
         efx_nic_free_buffer(efx, &efx->irq_status);
  fail4:
  fail3:
@@ -1606,10 +1624,9 @@ static void falcon_remove_nic(struct efx_nic *efx)
         BUG_ON(rc);
         memset(&board->i2c_adap, 0, sizeof(board->i2c_adap));
 
-        falcon_remove_spi_devices(efx);
         efx_nic_free_buffer(efx, &efx->irq_status);
 
-        falcon_reset_hw(efx, RESET_TYPE_ALL);
+        __falcon_reset_hw(efx, RESET_TYPE_ALL);
 
         /* Release the second function after the reset */
         if (nic_data->pci_dev2) {
@@ -1720,6 +1737,7 @@ struct efx_nic_type falcon_a1_nic_type = {
         .reset = falcon_reset_hw,
         .probe_port = falcon_probe_port,
         .remove_port = falcon_remove_port,
+        .handle_global_event = falcon_handle_global_event,
         .prepare_flush = falcon_prepare_flush,
         .update_stats = falcon_update_nic_stats,
         .start_stats = falcon_start_nic_stats,
@@ -1760,6 +1778,7 @@ struct efx_nic_type falcon_b0_nic_type = {
         .reset = falcon_reset_hw,
         .probe_port = falcon_probe_port,
         .remove_port = falcon_remove_port,
+        .handle_global_event = falcon_handle_global_event,
         .prepare_flush = falcon_prepare_flush,
         .update_stats = falcon_update_nic_stats,
         .start_stats = falcon_start_nic_stats,
diff --git a/drivers/net/sfc/falcon_boards.c b/drivers/net/sfc/falcon_boards.c
index cfc6a5b5a47..2dd16f0b3ce 100644
--- a/drivers/net/sfc/falcon_boards.c
+++ b/drivers/net/sfc/falcon_boards.c
@@ -13,8 +13,6 @@
 #include "phy.h"
 #include "efx.h"
 #include "nic.h"
-#include "regs.h"
-#include "io.h"
 #include "workarounds.h"
 
 /* Macros for unpacking the board revision */
@@ -30,17 +28,28 @@
 #define FALCON_BOARD_SFN4112F 0x52
 
 /* Board temperature is about 15°C above ambient when air flow is
- * limited. */
+ * limited.  The maximum acceptable ambient temperature varies
+ * depending on the PHY specifications but the critical temperature
+ * above which we should shut down to avoid damage is 80°C. */
 #define FALCON_BOARD_TEMP_BIAS  15
+#define FALCON_BOARD_TEMP_CRIT  (80 + FALCON_BOARD_TEMP_BIAS)
 
 /* SFC4000 datasheet says: 'The maximum permitted junction temperature
  * is 125°C; the thermal design of the environment for the SFC4000
  * should aim to keep this well below 100°C.' */
+#define FALCON_JUNC_TEMP_MIN    0
 #define FALCON_JUNC_TEMP_MAX    90
+#define FALCON_JUNC_TEMP_CRIT   125
 
 /*****************************************************************************
  * Support for LM87 sensor chip used on several boards
  */
+#define LM87_REG_TEMP_HW_INT_LOCK       0x13
+#define LM87_REG_TEMP_HW_EXT_LOCK       0x14
+#define LM87_REG_TEMP_HW_INT            0x17
+#define LM87_REG_TEMP_HW_EXT            0x18
+#define LM87_REG_TEMP_EXT1              0x26
+#define LM87_REG_TEMP_INT               0x27
 #define LM87_REG_ALARMS1                0x41
 #define LM87_REG_ALARMS2                0x42
 #define LM87_IN_LIMITS(nr, _min, _max)                  \
@@ -57,6 +66,27 @@
 
 #if defined(CONFIG_SENSORS_LM87) || defined(CONFIG_SENSORS_LM87_MODULE)
 
+static int efx_poke_lm87(struct i2c_client *client, const u8 *reg_values)
+{
+        while (*reg_values) {
+                u8 reg = *reg_values++;
+                u8 value = *reg_values++;
+                int rc = i2c_smbus_write_byte_data(client, reg, value);
+                if (rc)
+                        return rc;
+        }
+        return 0;
+}
+
+static const u8 falcon_lm87_common_regs[] = {
+        LM87_REG_TEMP_HW_INT_LOCK, FALCON_BOARD_TEMP_CRIT,
+        LM87_REG_TEMP_HW_INT, FALCON_BOARD_TEMP_CRIT,
+        LM87_TEMP_EXT1_LIMITS(FALCON_JUNC_TEMP_MIN, FALCON_JUNC_TEMP_MAX),
+        LM87_REG_TEMP_HW_EXT_LOCK, FALCON_JUNC_TEMP_CRIT,
+        LM87_REG_TEMP_HW_EXT, FALCON_JUNC_TEMP_CRIT,
+        0
+};
+
 static int efx_init_lm87(struct efx_nic *efx, struct i2c_board_info *info,
                          const u8 *reg_values)
 {
@@ -67,13 +97,16 @@ static int efx_init_lm87(struct efx_nic *efx, struct i2c_board_info *info,
         if (!client)
                 return -EIO;
 
-        while (*reg_values) {
-                u8 reg = *reg_values++;
-                u8 value = *reg_values++;
-                rc = i2c_smbus_write_byte_data(client, reg, value);
-                if (rc)
-                        goto err;
-        }
+        /* Read-to-clear alarm/interrupt status */
+        i2c_smbus_read_byte_data(client, LM87_REG_ALARMS1);
+        i2c_smbus_read_byte_data(client, LM87_REG_ALARMS2);
+
+        rc = efx_poke_lm87(client, reg_values);
+        if (rc)
+                goto err;
+        rc = efx_poke_lm87(client, falcon_lm87_common_regs);
+        if (rc)
+                goto err;
 
         board->hwmon_client = client;
         return 0;
@@ -91,36 +124,56 @@ static void efx_fini_lm87(struct efx_nic *efx)
 static int efx_check_lm87(struct efx_nic *efx, unsigned mask)
 {
         struct i2c_client *client = falcon_board(efx)->hwmon_client;
-        s32 alarms1, alarms2;
+        bool temp_crit, elec_fault, is_failure;
+        u16 alarms;
+        s32 reg;
 
         /* If link is up then do not monitor temperature */
         if (EFX_WORKAROUND_7884(efx) && efx->link_state.up)
                 return 0;
 
-        alarms1 = i2c_smbus_read_byte_data(client, LM87_REG_ALARMS1);
-        alarms2 = i2c_smbus_read_byte_data(client, LM87_REG_ALARMS2);
-        if (alarms1 < 0)
-                return alarms1;
-        if (alarms2 < 0)
-                return alarms2;
-        alarms1 &= mask;
-        alarms2 &= mask >> 8;
-        if (alarms1 || alarms2) {
+        reg = i2c_smbus_read_byte_data(client, LM87_REG_ALARMS1);
+        if (reg < 0)
+                return reg;
+        alarms = reg;
+        reg = i2c_smbus_read_byte_data(client, LM87_REG_ALARMS2);
+        if (reg < 0)
+                return reg;
+        alarms |= reg << 8;
+        alarms &= mask;
+
+        temp_crit = false;
+        if (alarms & LM87_ALARM_TEMP_INT) {
+                reg = i2c_smbus_read_byte_data(client, LM87_REG_TEMP_INT);
+                if (reg < 0)
+                        return reg;
+                if (reg > FALCON_BOARD_TEMP_CRIT)
+                        temp_crit = true;
+        }
+        if (alarms & LM87_ALARM_TEMP_EXT1) {
+                reg = i2c_smbus_read_byte_data(client, LM87_REG_TEMP_EXT1);
+                if (reg < 0)
+                        return reg;
+                if (reg > FALCON_JUNC_TEMP_CRIT)
+                        temp_crit = true;
+        }
+        elec_fault = alarms & ~(LM87_ALARM_TEMP_INT | LM87_ALARM_TEMP_EXT1);
+        is_failure = temp_crit || elec_fault;
+
+        if (alarms)
                 netif_err(efx, hw, efx->net_dev,
-                          "LM87 detected a hardware failure (status %02x:%02x)"
-                          "%s%s%s\n",
-                          alarms1, alarms2,
-                          (alarms1 & LM87_ALARM_TEMP_INT) ?
+                          "LM87 detected a hardware %s (status %02x:%02x)"
+                          "%s%s%s%s\n",
+                          is_failure ? "failure" : "problem",
+                          alarms & 0xff, alarms >> 8,
+                          (alarms & LM87_ALARM_TEMP_INT) ?
                           "; board is overheating" : "",
-                          (alarms1 & LM87_ALARM_TEMP_EXT1) ?
+                          (alarms & LM87_ALARM_TEMP_EXT1) ?
                           "; controller is overheating" : "",
-                          (alarms1 & ~(LM87_ALARM_TEMP_INT | LM87_ALARM_TEMP_EXT1)
-                           || alarms2) ?
-                          "; electrical fault" : "");
-                return -ERANGE;
-        }
+                          temp_crit ? "; reached critical temperature" : "",
+                          elec_fault ? "; electrical fault" : "");
 
-        return 0;
+        return is_failure ? -ERANGE : 0;
 }
 
 #else /* !CONFIG_SENSORS_LM87 */
@@ -325,7 +378,7 @@ static ssize_t set_phy_flash_cfg(struct device *dev,
                 new_mode = old_mode & ~PHY_MODE_SPECIAL;
         else
                 new_mode = PHY_MODE_SPECIAL;
-        if (old_mode == new_mode) {
+        if (!((old_mode ^ new_mode) & PHY_MODE_SPECIAL)) {
                 err = 0;
         } else if (efx->state != STATE_RUNNING || netif_running(efx->net_dev)) {
                 err = -EBUSY;
@@ -362,10 +415,11 @@ static void sfe4001_fini(struct efx_nic *efx)
 
 static int sfe4001_check_hw(struct efx_nic *efx)
 {
+        struct falcon_nic_data *nic_data = efx->nic_data;
         s32 status;
 
         /* If XAUI link is up then do not monitor */
-        if (EFX_WORKAROUND_7884(efx) && !efx->xmac_poll_required)
+        if (EFX_WORKAROUND_7884(efx) && !nic_data->xmac_poll_required)
                 return 0;
 
         /* Check the powered status of the PHY. Lack of power implies that
diff --git a/drivers/net/sfc/falcon_xmac.c b/drivers/net/sfc/falcon_xmac.c
index b31f595ebb5..b49e8439464 100644
--- a/drivers/net/sfc/falcon_xmac.c
+++ b/drivers/net/sfc/falcon_xmac.c
@@ -16,7 +16,6 @@
 #include "io.h"
 #include "mac.h"
 #include "mdio_10g.h"
-#include "phy.h"
 #include "workarounds.h"
 
 /**************************************************************************
@@ -88,6 +87,7 @@ int falcon_reset_xaui(struct efx_nic *efx)
 
 static void falcon_ack_status_intr(struct efx_nic *efx)
 {
+        struct falcon_nic_data *nic_data = efx->nic_data;
         efx_oword_t reg;
 
         if ((efx_nic_rev(efx) != EFX_REV_FALCON_B0) || LOOPBACK_INTERNAL(efx))
@@ -99,7 +99,7 @@ static void falcon_ack_status_intr(struct efx_nic *efx)
 
         /* We can only use this interrupt to signal the negative edge of
          * xaui_align [we have to poll the positive edge]. */
-        if (efx->xmac_poll_required)
+        if (nic_data->xmac_poll_required)
                 return;
 
         efx_reado(efx, &reg, FR_AB_XM_MGT_INT_MSK);
@@ -277,12 +277,14 @@ static bool falcon_xmac_check_fault(struct efx_nic *efx)
 
 static int falcon_reconfigure_xmac(struct efx_nic *efx)
 {
+        struct falcon_nic_data *nic_data = efx->nic_data;
+
         falcon_reconfigure_xgxs_core(efx);
         falcon_reconfigure_xmac_core(efx);
 
         falcon_reconfigure_mac_wrapper(efx);
 
-        efx->xmac_poll_required = !falcon_xmac_link_ok_retry(efx, 5);
+        nic_data->xmac_poll_required = !falcon_xmac_link_ok_retry(efx, 5);
         falcon_ack_status_intr(efx);
 
         return 0;
@@ -350,11 +352,13 @@ static void falcon_update_stats_xmac(struct efx_nic *efx)
 
 void falcon_poll_xmac(struct efx_nic *efx)
 {
+        struct falcon_nic_data *nic_data = efx->nic_data;
+
         if (!EFX_WORKAROUND_5147(efx) || !efx->link_state.up ||
-            !efx->xmac_poll_required)
+            !nic_data->xmac_poll_required)
                 return;
 
-        efx->xmac_poll_required = !falcon_xmac_link_ok_retry(efx, 1);
+        nic_data->xmac_poll_required = !falcon_xmac_link_ok_retry(efx, 1);
         falcon_ack_status_intr(efx);
 }
 
diff --git a/drivers/net/sfc/filter.c b/drivers/net/sfc/filter.c
index 52cb6082b91..44500b54fd5 100644
--- a/drivers/net/sfc/filter.c
+++ b/drivers/net/sfc/filter.c
@@ -428,10 +428,9 @@ int efx_probe_filters(struct efx_nic *efx)
                                              GFP_KERNEL);
                 if (!table->used_bitmap)
                         goto fail;
-                table->spec = vmalloc(table->size * sizeof(*table->spec));
+                table->spec = vzalloc(table->size * sizeof(*table->spec));
                 if (!table->spec)
                         goto fail;
-                memset(table->spec, 0, table->size * sizeof(*table->spec));
         }
 
         return 0;
diff --git a/drivers/net/sfc/mcdi.c b/drivers/net/sfc/mcdi.c
index 12cf910c2ce..b716e827b29 100644
--- a/drivers/net/sfc/mcdi.c
+++ b/drivers/net/sfc/mcdi.c
@@ -381,7 +381,7 @@ int efx_mcdi_rpc(struct efx_nic *efx, unsigned cmd,
                                   -rc);
                         efx_schedule_reset(efx, RESET_TYPE_MC_FAILURE);
                 } else
-                        netif_err(efx, hw, efx->net_dev,
+                        netif_dbg(efx, hw, efx->net_dev,
                                   "MC command 0x%x inlen %d failed rc=%d\n",
                                   cmd, (int)inlen, -rc);
         }
@@ -463,6 +463,7 @@ static void efx_mcdi_ev_death(struct efx_nic *efx, int rc)
                 if (mcdi->mode == MCDI_MODE_EVENTS) {
                         mcdi->resprc = rc;
                         mcdi->resplen = 0;
+                        ++mcdi->credits;
                 }
         } else
                 /* Nobody was waiting for an MCDI request, so trigger a reset */
diff --git a/drivers/net/sfc/mcdi_phy.c b/drivers/net/sfc/mcdi_phy.c
index c992742446b..0e97eed663c 100644
--- a/drivers/net/sfc/mcdi_phy.c
+++ b/drivers/net/sfc/mcdi_phy.c
@@ -16,7 +16,6 @@
 #include "phy.h"
 #include "mcdi.h"
 #include "mcdi_pcol.h"
-#include "mdio_10g.h"
 #include "nic.h"
 #include "selftest.h"
 
diff --git a/drivers/net/sfc/mdio_10g.c b/drivers/net/sfc/mdio_10g.c
index 98d94602042..56b0266b441 100644
--- a/drivers/net/sfc/mdio_10g.c
+++ b/drivers/net/sfc/mdio_10g.c
@@ -15,7 +15,6 @@
 #include "net_driver.h"
 #include "mdio_10g.h"
 #include "workarounds.h"
-#include "nic.h"
 
 unsigned efx_mdio_id_oui(u32 id)
 {
diff --git a/drivers/net/sfc/mtd.c b/drivers/net/sfc/mtd.c
index 02e54b4f701..d38627448c2 100644
--- a/drivers/net/sfc/mtd.c
+++ b/drivers/net/sfc/mtd.c
@@ -321,14 +321,15 @@ static int falcon_mtd_read(struct mtd_info *mtd, loff_t start,
         struct efx_mtd *efx_mtd = mtd->priv;
         const struct efx_spi_device *spi = efx_mtd->spi;
         struct efx_nic *efx = efx_mtd->efx;
+        struct falcon_nic_data *nic_data = efx->nic_data;
         int rc;
 
-        rc = mutex_lock_interruptible(&efx->spi_lock);
+        rc = mutex_lock_interruptible(&nic_data->spi_lock);
         if (rc)
                 return rc;
         rc = falcon_spi_read(efx, spi, part->offset + start, len,
                              retlen, buffer);
-        mutex_unlock(&efx->spi_lock);
+        mutex_unlock(&nic_data->spi_lock);
         return rc;
 }
 
@@ -337,13 +338,14 @@ static int falcon_mtd_erase(struct mtd_info *mtd, loff_t start, size_t len)
         struct efx_mtd_partition *part = to_efx_mtd_partition(mtd);
         struct efx_mtd *efx_mtd = mtd->priv;
         struct efx_nic *efx = efx_mtd->efx;
+        struct falcon_nic_data *nic_data = efx->nic_data;
         int rc;
 
-        rc = mutex_lock_interruptible(&efx->spi_lock);
+        rc = mutex_lock_interruptible(&nic_data->spi_lock);
         if (rc)
                 return rc;
         rc = efx_spi_erase(part, part->offset + start, len);
-        mutex_unlock(&efx->spi_lock);
+        mutex_unlock(&nic_data->spi_lock);
         return rc;
 }
 
@@ -354,14 +356,15 @@ static int falcon_mtd_write(struct mtd_info *mtd, loff_t start,
         struct efx_mtd *efx_mtd = mtd->priv;
         const struct efx_spi_device *spi = efx_mtd->spi;
         struct efx_nic *efx = efx_mtd->efx;
+        struct falcon_nic_data *nic_data = efx->nic_data;
         int rc;
 
-        rc = mutex_lock_interruptible(&efx->spi_lock);
+        rc = mutex_lock_interruptible(&nic_data->spi_lock);
         if (rc)
                 return rc;
         rc = falcon_spi_write(efx, spi, part->offset + start, len,
                               retlen, buffer);
-        mutex_unlock(&efx->spi_lock);
+        mutex_unlock(&nic_data->spi_lock);
         return rc;
 }
 
@@ -370,11 +373,12 @@ static int falcon_mtd_sync(struct mtd_info *mtd)
         struct efx_mtd_partition *part = to_efx_mtd_partition(mtd);
         struct efx_mtd *efx_mtd = mtd->priv;
         struct efx_nic *efx = efx_mtd->efx;
+        struct falcon_nic_data *nic_data = efx->nic_data;
         int rc;
 
-        mutex_lock(&efx->spi_lock);
+        mutex_lock(&nic_data->spi_lock);
         rc = efx_spi_slow_wait(part, true);
-        mutex_unlock(&efx->spi_lock);
+        mutex_unlock(&nic_data->spi_lock);
         return rc;
 }
 
@@ -387,35 +391,67 @@ static struct efx_mtd_ops falcon_mtd_ops = {
 
 static int falcon_mtd_probe(struct efx_nic *efx)
 {
-        struct efx_spi_device *spi = efx->spi_flash;
+        struct falcon_nic_data *nic_data = efx->nic_data;
+        struct efx_spi_device *spi;
         struct efx_mtd *efx_mtd;
-        int rc;
+        int rc = -ENODEV;
 
         ASSERT_RTNL();
 
-        if (!spi || spi->size <= FALCON_FLASH_BOOTCODE_START)
-                return -ENODEV;
-
-        efx_mtd = kzalloc(sizeof(*efx_mtd) + sizeof(efx_mtd->part[0]),
-                          GFP_KERNEL);
-        if (!efx_mtd)
-                return -ENOMEM;
-
-        efx_mtd->spi = spi;
-        efx_mtd->name = "flash";
-        efx_mtd->ops = &falcon_mtd_ops;
+        spi = &nic_data->spi_flash;
+        if (efx_spi_present(spi) && spi->size > FALCON_FLASH_BOOTCODE_START) {
+                efx_mtd = kzalloc(sizeof(*efx_mtd) + sizeof(efx_mtd->part[0]),
+                                  GFP_KERNEL);
+                if (!efx_mtd)
+                        return -ENOMEM;
+
+                efx_mtd->spi = spi;
+                efx_mtd->name = "flash";
+                efx_mtd->ops = &falcon_mtd_ops;
+
+                efx_mtd->n_parts = 1;
+                efx_mtd->part[0].mtd.type = MTD_NORFLASH;
+                efx_mtd->part[0].mtd.flags = MTD_CAP_NORFLASH;
+                efx_mtd->part[0].mtd.size = spi->size - FALCON_FLASH_BOOTCODE_START;
+                efx_mtd->part[0].mtd.erasesize = spi->erase_size;
+                efx_mtd->part[0].offset = FALCON_FLASH_BOOTCODE_START;
+                efx_mtd->part[0].type_name = "sfc_flash_bootrom";
+
+                rc = efx_mtd_probe_device(efx, efx_mtd);
+                if (rc) {
+                        kfree(efx_mtd);
+                        return rc;
+                }
+        }
 
-        efx_mtd->n_parts = 1;
-        efx_mtd->part[0].mtd.type = MTD_NORFLASH;
-        efx_mtd->part[0].mtd.flags = MTD_CAP_NORFLASH;
-        efx_mtd->part[0].mtd.size = spi->size - FALCON_FLASH_BOOTCODE_START;
-        efx_mtd->part[0].mtd.erasesize = spi->erase_size;
-        efx_mtd->part[0].offset = FALCON_FLASH_BOOTCODE_START;
-        efx_mtd->part[0].type_name = "sfc_flash_bootrom";
+        spi = &nic_data->spi_eeprom;
+        if (efx_spi_present(spi) && spi->size > EFX_EEPROM_BOOTCONFIG_START) {
+                efx_mtd = kzalloc(sizeof(*efx_mtd) + sizeof(efx_mtd->part[0]),
+                                  GFP_KERNEL);
+                if (!efx_mtd)
+                        return -ENOMEM;
+
+                efx_mtd->spi = spi;
+                efx_mtd->name = "EEPROM";
+                efx_mtd->ops = &falcon_mtd_ops;
+
+                efx_mtd->n_parts = 1;
+                efx_mtd->part[0].mtd.type = MTD_RAM;
+                efx_mtd->part[0].mtd.flags = MTD_CAP_RAM;
+                efx_mtd->part[0].mtd.size =
+                        min(spi->size, EFX_EEPROM_BOOTCONFIG_END) -
+                        EFX_EEPROM_BOOTCONFIG_START;
+                efx_mtd->part[0].mtd.erasesize = spi->erase_size;
+                efx_mtd->part[0].offset = EFX_EEPROM_BOOTCONFIG_START;
+                efx_mtd->part[0].type_name = "sfc_bootconfig";
+
+                rc = efx_mtd_probe_device(efx, efx_mtd);
+                if (rc) {
+                        kfree(efx_mtd);
+                        return rc;
+                }
+        }
 
-        rc = efx_mtd_probe_device(efx, efx_mtd);
-        if (rc)
-                kfree(efx_mtd);
         return rc;
 }
 
diff --git a/drivers/net/sfc/net_driver.h b/drivers/net/sfc/net_driver.h
index b137c889152..4c12332434b 100644
--- a/drivers/net/sfc/net_driver.h
+++ b/drivers/net/sfc/net_driver.h
@@ -648,6 +648,7 @@ struct efx_filter_state;
  * @n_tx_channels: Number of channels used for TX
  * @rx_buffer_len: RX buffer length
  * @rx_buffer_order: Order (log2) of number of pages for each RX buffer
+ * @rx_hash_key: Toeplitz hash key for RSS
  * @rx_indir_table: Indirection table for RSS
  * @int_error_count: Number of internal errors seen recently
  * @int_error_expire: Time at which error count will be expired
@@ -658,11 +659,6 @@ struct efx_filter_state;
  *      to verify that an interrupt has occurred.
  * @irq_zero_count: Number of legacy IRQs seen with queue flags == 0
  * @fatal_irq_level: IRQ level (bit number) used for serious errors
- * @spi_flash: SPI flash device
- *      This field will be %NULL if no flash device is present (or for Siena).
- * @spi_eeprom: SPI EEPROM device
- *      This field will be %NULL if no EEPROM device is present (or for Siena).
- * @spi_lock: SPI bus lock
  * @mtd_list: List of MTDs attached to the NIC
  * @n_rx_nodesc_drop_cnt: RX no descriptor drop count
  * @nic_data: Hardware dependant state
@@ -683,15 +679,12 @@ struct efx_filter_state;
  * @stats_buffer: DMA buffer for statistics
  * @stats_lock: Statistics update lock. Serialises statistics fetches
  * @mac_op: MAC interface
- * @mac_address: Permanent MAC address
  * @phy_type: PHY type
- * @mdio_lock: MDIO lock
  * @phy_op: PHY interface
  * @phy_data: PHY private data (including PHY-specific stats)
  * @mdio: PHY MDIO interface
  * @mdio_bus: PHY MDIO bus ID (only used by Siena)
  * @phy_mode: PHY operating mode. Serialised by @mac_lock.
- * @xmac_poll_required: XMAC link state needs polling
  * @link_advertising: Autonegotiation advertising flags
  * @link_state: Current state of the link
  * @n_link_state_changes: Number of times the link has changed state
@@ -748,9 +741,6 @@ struct efx_nic {
         unsigned irq_zero_count;
         unsigned fatal_irq_level;
 
-        struct efx_spi_device *spi_flash;
-        struct efx_spi_device *spi_eeprom;
-        struct mutex spi_lock;
 #ifdef CONFIG_SFC_MTD
         struct list_head mtd_list;
 #endif
@@ -773,17 +763,14 @@ struct efx_nic {
         spinlock_t stats_lock;
 
         struct efx_mac_operations *mac_op;
-        unsigned char mac_address[ETH_ALEN];
 
         unsigned int phy_type;
-        struct mutex mdio_lock;
         struct efx_phy_operations *phy_op;
         void *phy_data;
         struct mdio_if_info mdio;
         unsigned int mdio_bus;
         enum efx_phy_mode phy_mode;
 
-        bool xmac_poll_required;
         u32 link_advertising;
         struct efx_link_state link_state;
         unsigned int n_link_state_changes;
@@ -831,6 +818,7 @@ static inline unsigned int efx_port_num(struct efx_nic *efx)
  *      be called while the controller is uninitialised.
  * @probe_port: Probe the MAC and PHY
  * @remove_port: Free resources allocated by probe_port()
+ * @handle_global_event: Handle a "global" event (may be %NULL)
  * @prepare_flush: Prepare the hardware for flushing the DMA queues
  * @update_stats: Update statistics not provided by event handling
  * @start_stats: Start the regular fetching of statistics
@@ -875,6 +863,7 @@ struct efx_nic_type {
         int (*reset)(struct efx_nic *efx, enum reset_type method);
         int (*probe_port)(struct efx_nic *efx);
         void (*remove_port)(struct efx_nic *efx);
+        bool (*handle_global_event)(struct efx_channel *channel, efx_qword_t *);
         void (*prepare_flush)(struct efx_nic *efx);
         void (*update_stats)(struct efx_nic *efx);
         void (*start_stats)(struct efx_nic *efx);
diff --git a/drivers/net/sfc/nic.c b/drivers/net/sfc/nic.c
index 67cb0c96838..399b12abe2f 100644
--- a/drivers/net/sfc/nic.c
+++ b/drivers/net/sfc/nic.c
@@ -894,46 +894,6 @@ efx_handle_generated_event(struct efx_channel *channel, efx_qword_t *event)
                           channel->channel, EFX_QWORD_VAL(*event));
 }
 
-/* Global events are basically PHY events */
-static void
-efx_handle_global_event(struct efx_channel *channel, efx_qword_t *event)
-{
-        struct efx_nic *efx = channel->efx;
-        bool handled = false;
-
-        if (EFX_QWORD_FIELD(*event, FSF_AB_GLB_EV_G_PHY0_INTR) ||
-            EFX_QWORD_FIELD(*event, FSF_AB_GLB_EV_XG_PHY0_INTR) ||
-            EFX_QWORD_FIELD(*event, FSF_AB_GLB_EV_XFP_PHY0_INTR)) {
-                /* Ignored */
-                handled = true;
-        }
-
-        if ((efx_nic_rev(efx) >= EFX_REV_FALCON_B0) &&
-            EFX_QWORD_FIELD(*event, FSF_BB_GLB_EV_XG_MGT_INTR)) {
-                efx->xmac_poll_required = true;
-                handled = true;
-        }
-
-        if (efx_nic_rev(efx) <= EFX_REV_FALCON_A1 ?
-            EFX_QWORD_FIELD(*event, FSF_AA_GLB_EV_RX_RECOVERY) :
-            EFX_QWORD_FIELD(*event, FSF_BB_GLB_EV_RX_RECOVERY)) {
-                netif_err(efx, rx_err, efx->net_dev,
-                          "channel %d seen global RX_RESET event. Resetting.\n",
-                          channel->channel);
-
-                atomic_inc(&efx->rx_reset);
-                efx_schedule_reset(efx, EFX_WORKAROUND_6555(efx) ?
-                                   RESET_TYPE_RX_RECOVERY : RESET_TYPE_DISABLE);
-                handled = true;
-        }
-
-        if (!handled)
-                netif_err(efx, hw, efx->net_dev,
-                          "channel %d unknown global event "
-                          EFX_QWORD_FMT "\n", channel->channel,
-                          EFX_QWORD_VAL(*event));
-}
-
 static void
 efx_handle_driver_event(struct efx_channel *channel, efx_qword_t *event)
 {
@@ -1050,15 +1010,17 @@ int efx_nic_process_eventq(struct efx_channel *channel, int budget)
                 case FSE_AZ_EV_CODE_DRV_GEN_EV:
                         efx_handle_generated_event(channel, &event);
                         break;
-                case FSE_AZ_EV_CODE_GLOBAL_EV:
-                        efx_handle_global_event(channel, &event);
-                        break;
                 case FSE_AZ_EV_CODE_DRIVER_EV:
                         efx_handle_driver_event(channel, &event);
                         break;
                 case FSE_CZ_EV_CODE_MCDI_EV:
                         efx_mcdi_process_event(channel, &event);
                         break;
+                case FSE_AZ_EV_CODE_GLOBAL_EV:
+                        if (efx->type->handle_global_event &&
+                            efx->type->handle_global_event(channel, &event))
+                                break;
+                        /* else fall through */
                 default:
                         netif_err(channel->efx, hw, channel->efx->net_dev,
                                   "channel %d unknown event type %d (data "
diff --git a/drivers/net/sfc/nic.h b/drivers/net/sfc/nic.h
index 0438dc98722..eb0586925b5 100644
--- a/drivers/net/sfc/nic.h
+++ b/drivers/net/sfc/nic.h
@@ -15,6 +15,7 @@
 #include "net_driver.h"
 #include "efx.h"
 #include "mcdi.h"
+#include "spi.h"
 
 /*
  * Falcon hardware control
@@ -113,6 +114,11 @@ struct falcon_board {
  * @stats_pending: Is there a pending DMA of MAC statistics.
  * @stats_timer: A timer for regularly fetching MAC statistics.
  * @stats_dma_done: Pointer to the flag which indicates DMA completion.
+ * @spi_flash: SPI flash device
+ * @spi_eeprom: SPI EEPROM device
+ * @spi_lock: SPI bus lock
+ * @mdio_lock: MDIO bus lock
+ * @xmac_poll_required: XMAC link state needs polling
  */
 struct falcon_nic_data {
         struct pci_dev *pci_dev2;
@@ -121,6 +127,11 @@ struct falcon_nic_data {
         bool stats_pending;
         struct timer_list stats_timer;
         u32 *stats_dma_done;
+        struct efx_spi_device spi_flash;
+        struct efx_spi_device spi_eeprom;
+        struct mutex spi_lock;
+        struct mutex mdio_lock;
+        bool xmac_poll_required;
 };
 
 static inline struct falcon_board *falcon_board(struct efx_nic *efx)
@@ -135,7 +146,6 @@ static inline struct falcon_board *falcon_board(struct efx_nic *efx)
  * @fw_build: Firmware build number
  * @mcdi: Management-Controller-to-Driver Interface
  * @wol_filter_id: Wake-on-LAN packet filter id
- * @ipv6_rss_key: Toeplitz hash key for IPv6 RSS
  */
 struct siena_nic_data {
         u64 fw_version;
diff --git a/drivers/net/sfc/qt202x_phy.c b/drivers/net/sfc/qt202x_phy.c
index 68813d1d85f..ea3ae008931 100644
--- a/drivers/net/sfc/qt202x_phy.c
+++ b/drivers/net/sfc/qt202x_phy.c
@@ -41,6 +41,8 @@
 #define PCS_UC_STATUS_LBN       0
 #define PCS_UC_STATUS_WIDTH     8
 #define PCS_UC_STATUS_FW_SAVE   0x20
+#define PMA_PMD_MODE_REG        0xc301
+#define PMA_PMD_RXIN_SEL_LBN    6
 #define PMA_PMD_FTX_CTRL2_REG   0xc309
 #define PMA_PMD_FTX_STATIC_LBN  13
 #define PMA_PMD_VEND1_REG       0xc001
@@ -282,6 +284,10 @@ static int qt2025c_select_phy_mode(struct efx_nic *efx)
          * slow) reload of the firmware image (the microcontroller's code
          * memory is not affected by the microcontroller reset). */
         efx_mdio_write(efx, 1, 0xc317, 0x00ff);
+        /* PMA/PMD loopback sets RXIN to inverse polarity and the firmware
+         * restart doesn't reset it. We need to do that ourselves. */
+        efx_mdio_set_flag(efx, 1, PMA_PMD_MODE_REG,
+                          1 << PMA_PMD_RXIN_SEL_LBN, false);
         efx_mdio_write(efx, 1, 0xc300, 0x0002);
         msleep(20);
 
diff --git a/drivers/net/sfc/siena.c b/drivers/net/sfc/siena.c
index 45236f58a25..bf845617644 100644
--- a/drivers/net/sfc/siena.c
+++ b/drivers/net/sfc/siena.c
@@ -194,13 +194,7 @@ static int siena_reset_hw(struct efx_nic *efx, enum reset_type method)
 
 static int siena_probe_nvconfig(struct efx_nic *efx)
 {
-        int rc;
-
-        rc = efx_mcdi_get_board_cfg(efx, efx->mac_address, NULL);
-        if (rc)
-                return rc;
-
-        return 0;
+        return efx_mcdi_get_board_cfg(efx, efx->net_dev->perm_addr, NULL);
 }
 
 static int siena_probe_nic(struct efx_nic *efx)
@@ -562,7 +556,7 @@ static int siena_set_wol(struct efx_nic *efx, u32 type)
                 if (nic_data->wol_filter_id != -1)
                         efx_mcdi_wol_filter_remove(efx,
                                                    nic_data->wol_filter_id);
-                rc = efx_mcdi_wol_filter_set_magic(efx, efx->mac_address,
+                rc = efx_mcdi_wol_filter_set_magic(efx, efx->net_dev->dev_addr,
                                                    &nic_data->wol_filter_id);
                 if (rc)
                         goto fail;
diff --git a/drivers/net/sfc/spi.h b/drivers/net/sfc/spi.h
index 8bf4fce0813..879b7f6bde3 100644
--- a/drivers/net/sfc/spi.h
+++ b/drivers/net/sfc/spi.h
@@ -61,6 +61,11 @@ struct efx_spi_device {
         unsigned int block_size;
 };
 
+static inline bool efx_spi_present(const struct efx_spi_device *spi)
+{
+        return spi->size != 0;
+}
+
 int falcon_spi_cmd(struct efx_nic *efx,
                    const struct efx_spi_device *spi, unsigned int command,
                    int address, const void* in, void *out, size_t len);
diff --git a/drivers/net/sfc/tenxpress.c b/drivers/net/sfc/tenxpress.c
index 1bc6c48c96e..f102912eba9 100644
--- a/drivers/net/sfc/tenxpress.c
+++ b/drivers/net/sfc/tenxpress.c
@@ -15,9 +15,7 @@
 #include "mdio_10g.h"
 #include "nic.h"
 #include "phy.h"
-#include "regs.h"
 #include "workarounds.h"
-#include "selftest.h"
 
 /* We expect these MMDs to be in the package. */
 #define TENXPRESS_REQUIRED_DEVS (MDIO_DEVS_PMAPMD       | \
diff --git a/drivers/net/sfc/tx.c b/drivers/net/sfc/tx.c
index 11726989fe2..03194f7c095 100644
--- a/drivers/net/sfc/tx.c
+++ b/drivers/net/sfc/tx.c
@@ -401,6 +401,7 @@ void efx_xmit_done(struct efx_tx_queue *tx_queue, unsigned int index)
 {
         unsigned fill_level;
         struct efx_nic *efx = tx_queue->efx;
+        struct netdev_queue *queue;
 
         EFX_BUG_ON_PARANOID(index > tx_queue->ptr_mask);
 
@@ -417,12 +418,15 @@ void efx_xmit_done(struct efx_tx_queue *tx_queue, unsigned int index)
 
                         /* Do this under netif_tx_lock(), to avoid racing
                          * with efx_xmit(). */
-                        netif_tx_lock(efx->net_dev);
+                        queue = netdev_get_tx_queue(
+                                efx->net_dev,
+                                tx_queue->queue / EFX_TXQ_TYPES);
+                        __netif_tx_lock(queue, smp_processor_id());
                         if (tx_queue->stopped) {
                                 tx_queue->stopped = 0;
                                 efx_wake_queue(tx_queue->channel);
                         }
-                        netif_tx_unlock(efx->net_dev);
+                        __netif_tx_unlock(queue);
                 }
         }
 }
diff --git a/drivers/net/sh_eth.c b/drivers/net/sh_eth.c
index 50259dfec58..b12660d7233 100644
--- a/drivers/net/sh_eth.c
+++ b/drivers/net/sh_eth.c
@@ -45,9 +45,9 @@ static void sh_eth_set_duplex(struct net_device *ndev)
         u32 ioaddr = ndev->base_addr;
 
         if (mdp->duplex) /* Full */
-                ctrl_outl(ctrl_inl(ioaddr + ECMR) | ECMR_DM, ioaddr + ECMR);
+                writel(readl(ioaddr + ECMR) | ECMR_DM, ioaddr + ECMR);
         else            /* Half */
-                ctrl_outl(ctrl_inl(ioaddr + ECMR) & ~ECMR_DM, ioaddr + ECMR);
+                writel(readl(ioaddr + ECMR) & ~ECMR_DM, ioaddr + ECMR);
 }
 
 static void sh_eth_set_rate(struct net_device *ndev)
@@ -57,10 +57,10 @@ static void sh_eth_set_rate(struct net_device *ndev)
 
         switch (mdp->speed) {
         case 10: /* 10BASE */
-                ctrl_outl(ctrl_inl(ioaddr + ECMR) & ~ECMR_RTM, ioaddr + ECMR);
+                writel(readl(ioaddr + ECMR) & ~ECMR_RTM, ioaddr + ECMR);
                 break;
         case 100:/* 100BASE */
-                ctrl_outl(ctrl_inl(ioaddr + ECMR) | ECMR_RTM, ioaddr + ECMR);
+                writel(readl(ioaddr + ECMR) | ECMR_RTM, ioaddr + ECMR);
                 break;
         default:
                 break;
@@ -96,9 +96,9 @@ static void sh_eth_set_duplex(struct net_device *ndev)
         u32 ioaddr = ndev->base_addr;
 
         if (mdp->duplex) /* Full */
-                ctrl_outl(ctrl_inl(ioaddr + ECMR) | ECMR_DM, ioaddr + ECMR);
+                writel(readl(ioaddr + ECMR) | ECMR_DM, ioaddr + ECMR);
         else            /* Half */
-                ctrl_outl(ctrl_inl(ioaddr + ECMR) & ~ECMR_DM, ioaddr + ECMR);
+                writel(readl(ioaddr + ECMR) & ~ECMR_DM, ioaddr + ECMR);
 }
 
 static void sh_eth_set_rate(struct net_device *ndev)
@@ -108,10 +108,10 @@ static void sh_eth_set_rate(struct net_device *ndev)
 
         switch (mdp->speed) {
         case 10: /* 10BASE */
-                ctrl_outl(0, ioaddr + RTRATE);
+                writel(0, ioaddr + RTRATE);
                 break;
         case 100:/* 100BASE */
-                ctrl_outl(1, ioaddr + RTRATE);
+                writel(1, ioaddr + RTRATE);
                 break;
         default:
                 break;
@@ -143,7 +143,7 @@ static struct sh_eth_cpu_data sh_eth_my_cpu_data = {
 static void sh_eth_chip_reset(struct net_device *ndev)
 {
         /* reset device */
-        ctrl_outl(ARSTR_ARSTR, ARSTR);
+        writel(ARSTR_ARSTR, ARSTR);
         mdelay(1);
 }
 
@@ -152,10 +152,10 @@ static void sh_eth_reset(struct net_device *ndev)
         u32 ioaddr = ndev->base_addr;
         int cnt = 100;
 
-        ctrl_outl(EDSR_ENALL, ioaddr + EDSR);
-        ctrl_outl(ctrl_inl(ioaddr + EDMR) | EDMR_SRST, ioaddr + EDMR);
+        writel(EDSR_ENALL, ioaddr + EDSR);
+        writel(readl(ioaddr + EDMR) | EDMR_SRST, ioaddr + EDMR);
         while (cnt > 0) {
-                if (!(ctrl_inl(ioaddr + EDMR) & 0x3))
+                if (!(readl(ioaddr + EDMR) & 0x3))
                         break;
                 mdelay(1);
                 cnt--;
@@ -164,14 +164,14 @@ static void sh_eth_reset(struct net_device *ndev)
                 printk(KERN_ERR "Device reset fail\n");
 
         /* Table Init */
-        ctrl_outl(0x0, ioaddr + TDLAR);
-        ctrl_outl(0x0, ioaddr + TDFAR);
-        ctrl_outl(0x0, ioaddr + TDFXR);
-        ctrl_outl(0x0, ioaddr + TDFFR);
-        ctrl_outl(0x0, ioaddr + RDLAR);
-        ctrl_outl(0x0, ioaddr + RDFAR);
-        ctrl_outl(0x0, ioaddr + RDFXR);
-        ctrl_outl(0x0, ioaddr + RDFFR);
+        writel(0x0, ioaddr + TDLAR);
+        writel(0x0, ioaddr + TDFAR);
+        writel(0x0, ioaddr + TDFXR);
+        writel(0x0, ioaddr + TDFFR);
+        writel(0x0, ioaddr + RDLAR);
+        writel(0x0, ioaddr + RDFAR);
+        writel(0x0, ioaddr + RDFXR);
+        writel(0x0, ioaddr + RDFFR);
 }
 
 static void sh_eth_set_duplex(struct net_device *ndev)
@@ -180,9 +180,9 @@ static void sh_eth_set_duplex(struct net_device *ndev)
         u32 ioaddr = ndev->base_addr;
 
         if (mdp->duplex) /* Full */
-                ctrl_outl(ctrl_inl(ioaddr + ECMR) | ECMR_DM, ioaddr + ECMR);
+                writel(readl(ioaddr + ECMR) | ECMR_DM, ioaddr + ECMR);
         else            /* Half */
-                ctrl_outl(ctrl_inl(ioaddr + ECMR) & ~ECMR_DM, ioaddr + ECMR);
+                writel(readl(ioaddr + ECMR) & ~ECMR_DM, ioaddr + ECMR);
 }
 
 static void sh_eth_set_rate(struct net_device *ndev)
@@ -192,13 +192,13 @@ static void sh_eth_set_rate(struct net_device *ndev)
 
         switch (mdp->speed) {
         case 10: /* 10BASE */
-                ctrl_outl(GECMR_10, ioaddr + GECMR);
+                writel(GECMR_10, ioaddr + GECMR);
                 break;
         case 100:/* 100BASE */
-                ctrl_outl(GECMR_100, ioaddr + GECMR);
+                writel(GECMR_100, ioaddr + GECMR);
                 break;
         case 1000: /* 1000BASE */
-                ctrl_outl(GECMR_1000, ioaddr + GECMR);
+                writel(GECMR_1000, ioaddr + GECMR);
                 break;
         default:
                 break;
@@ -283,9 +283,9 @@ static void sh_eth_reset(struct net_device *ndev)
 {
         u32 ioaddr = ndev->base_addr;
 
-        ctrl_outl(ctrl_inl(ioaddr + EDMR) | EDMR_SRST, ioaddr + EDMR);
+        writel(readl(ioaddr + EDMR) | EDMR_SRST, ioaddr + EDMR);
         mdelay(3);
-        ctrl_outl(ctrl_inl(ioaddr + EDMR) & ~EDMR_SRST, ioaddr + EDMR);
+        writel(readl(ioaddr + EDMR) & ~EDMR_SRST, ioaddr + EDMR);
 }
 #endif
 
@@ -336,10 +336,10 @@ static void update_mac_address(struct net_device *ndev)
 {
         u32 ioaddr = ndev->base_addr;
 
-        ctrl_outl((ndev->dev_addr[0] << 24) | (ndev->dev_addr[1] << 16) |
+        writel((ndev->dev_addr[0] << 24) | (ndev->dev_addr[1] << 16) |
                   (ndev->dev_addr[2] << 8) | (ndev->dev_addr[3]),
                   ioaddr + MAHR);
-        ctrl_outl((ndev->dev_addr[4] << 8) | (ndev->dev_addr[5]),
+        writel((ndev->dev_addr[4] << 8) | (ndev->dev_addr[5]),
                   ioaddr + MALR);
 }
 
@@ -358,12 +358,12 @@ static void read_mac_address(struct net_device *ndev, unsigned char *mac)
         if (mac[0] || mac[1] || mac[2] || mac[3] || mac[4] || mac[5]) {
                 memcpy(ndev->dev_addr, mac, 6);
         } else {
-                ndev->dev_addr[0] = (ctrl_inl(ioaddr + MAHR) >> 24);
-                ndev->dev_addr[1] = (ctrl_inl(ioaddr + MAHR) >> 16) & 0xFF;
-                ndev->dev_addr[2] = (ctrl_inl(ioaddr + MAHR) >> 8) & 0xFF;
-                ndev->dev_addr[3] = (ctrl_inl(ioaddr + MAHR) & 0xFF);
-                ndev->dev_addr[4] = (ctrl_inl(ioaddr + MALR) >> 8) & 0xFF;
-                ndev->dev_addr[5] = (ctrl_inl(ioaddr + MALR) & 0xFF);
+                ndev->dev_addr[0] = (readl(ioaddr + MAHR) >> 24);
+                ndev->dev_addr[1] = (readl(ioaddr + MAHR) >> 16) & 0xFF;
+                ndev->dev_addr[2] = (readl(ioaddr + MAHR) >> 8) & 0xFF;
+                ndev->dev_addr[3] = (readl(ioaddr + MAHR) & 0xFF);
+                ndev->dev_addr[4] = (readl(ioaddr + MALR) >> 8) & 0xFF;
+                ndev->dev_addr[5] = (readl(ioaddr + MALR) & 0xFF);
         }
 }
 
@@ -379,19 +379,19 @@ struct bb_info {
 /* PHY bit set */
 static void bb_set(u32 addr, u32 msk)
 {
-        ctrl_outl(ctrl_inl(addr) | msk, addr);
+        writel(readl(addr) | msk, addr);
 }
 
 /* PHY bit clear */
 static void bb_clr(u32 addr, u32 msk)
 {
-        ctrl_outl((ctrl_inl(addr) & ~msk), addr);
+        writel((readl(addr) & ~msk), addr);
 }
 
 /* PHY bit read */
 static int bb_read(u32 addr, u32 msk)
 {
-        return (ctrl_inl(addr) & msk) != 0;
+        return (readl(addr) & msk) != 0;
 }
 
 /* Data I/O pin control */
@@ -506,9 +506,9 @@ static void sh_eth_ring_format(struct net_device *ndev)
                 rxdesc->buffer_length = ALIGN(mdp->rx_buf_sz, 16);
                 /* Rx descriptor address set */
                 if (i == 0) {
-                        ctrl_outl(mdp->rx_desc_dma, ioaddr + RDLAR);
+                        writel(mdp->rx_desc_dma, ioaddr + RDLAR);
 #if defined(CONFIG_CPU_SUBTYPE_SH7763)
-                        ctrl_outl(mdp->rx_desc_dma, ioaddr + RDFAR);
+                        writel(mdp->rx_desc_dma, ioaddr + RDFAR);
 #endif
                 }
         }
@@ -528,9 +528,9 @@ static void sh_eth_ring_format(struct net_device *ndev)
                 txdesc->buffer_length = 0;
                 if (i == 0) {
                         /* Tx descriptor address set */
-                        ctrl_outl(mdp->tx_desc_dma, ioaddr + TDLAR);
+                        writel(mdp->tx_desc_dma, ioaddr + TDLAR);
 #if defined(CONFIG_CPU_SUBTYPE_SH7763)
-                        ctrl_outl(mdp->tx_desc_dma, ioaddr + TDFAR);
+                        writel(mdp->tx_desc_dma, ioaddr + TDFAR);
 #endif
                 }
         }
@@ -623,71 +623,71 @@ static int sh_eth_dev_init(struct net_device *ndev)
         /* Descriptor format */
         sh_eth_ring_format(ndev);
         if (mdp->cd->rpadir)
-                ctrl_outl(mdp->cd->rpadir_value, ioaddr + RPADIR);
+                writel(mdp->cd->rpadir_value, ioaddr + RPADIR);
 
         /* all sh_eth int mask */
-        ctrl_outl(0, ioaddr + EESIPR);
+        writel(0, ioaddr + EESIPR);
 
 #if defined(__LITTLE_ENDIAN__)
         if (mdp->cd->hw_swap)
-                ctrl_outl(EDMR_EL, ioaddr + EDMR);
+                writel(EDMR_EL, ioaddr + EDMR);
         else
 #endif
-                ctrl_outl(0, ioaddr + EDMR);
+                writel(0, ioaddr + EDMR);
 
         /* FIFO size set */
-        ctrl_outl(mdp->cd->fdr_value, ioaddr + FDR);
-        ctrl_outl(0, ioaddr + TFTR);
+        writel(mdp->cd->fdr_value, ioaddr + FDR);
+        writel(0, ioaddr + TFTR);
 
         /* Frame recv control */
-        ctrl_outl(mdp->cd->rmcr_value, ioaddr + RMCR);
+        writel(mdp->cd->rmcr_value, ioaddr + RMCR);
 
         rx_int_var = mdp->rx_int_var = DESC_I_RINT8 | DESC_I_RINT5;
         tx_int_var = mdp->tx_int_var = DESC_I_TINT2;
-        ctrl_outl(rx_int_var | tx_int_var, ioaddr + TRSCER);
+        writel(rx_int_var | tx_int_var, ioaddr + TRSCER);
 
         if (mdp->cd->bculr)
-                ctrl_outl(0x800, ioaddr + BCULR);       /* Burst sycle set */
+                writel(0x800, ioaddr + BCULR);  /* Burst sycle set */
 
-        ctrl_outl(mdp->cd->fcftr_value, ioaddr + FCFTR);
+        writel(mdp->cd->fcftr_value, ioaddr + FCFTR);
 
         if (!mdp->cd->no_trimd)
-                ctrl_outl(0, ioaddr + TRIMD);
+                writel(0, ioaddr + TRIMD);
 
         /* Recv frame limit set register */
-        ctrl_outl(RFLR_VALUE, ioaddr + RFLR);
+        writel(RFLR_VALUE, ioaddr + RFLR);
 
-        ctrl_outl(ctrl_inl(ioaddr + EESR), ioaddr + EESR);
-        ctrl_outl(mdp->cd->eesipr_value, ioaddr + EESIPR);
+        writel(readl(ioaddr + EESR), ioaddr + EESR);
+        writel(mdp->cd->eesipr_value, ioaddr + EESIPR);
 
         /* PAUSE Prohibition */
-        val = (ctrl_inl(ioaddr + ECMR) & ECMR_DM) |
+        val = (readl(ioaddr + ECMR) & ECMR_DM) |
                 ECMR_ZPF | (mdp->duplex ? ECMR_DM : 0) | ECMR_TE | ECMR_RE;
 
-        ctrl_outl(val, ioaddr + ECMR);
+        writel(val, ioaddr + ECMR);
 
         if (mdp->cd->set_rate)
                 mdp->cd->set_rate(ndev);
 
         /* E-MAC Status Register clear */
-        ctrl_outl(mdp->cd->ecsr_value, ioaddr + ECSR);
+        writel(mdp->cd->ecsr_value, ioaddr + ECSR);
 
         /* E-MAC Interrupt Enable register */
-        ctrl_outl(mdp->cd->ecsipr_value, ioaddr + ECSIPR);
+        writel(mdp->cd->ecsipr_value, ioaddr + ECSIPR);
 
         /* Set MAC address */
         update_mac_address(ndev);
 
         /* mask reset */
         if (mdp->cd->apr)
-                ctrl_outl(APR_AP, ioaddr + APR);
+                writel(APR_AP, ioaddr + APR);
         if (mdp->cd->mpr)
-                ctrl_outl(MPR_MP, ioaddr + MPR);
+                writel(MPR_MP, ioaddr + MPR);
         if (mdp->cd->tpauser)
-                ctrl_outl(TPAUSER_UNLIMITED, ioaddr + TPAUSER);
+                writel(TPAUSER_UNLIMITED, ioaddr + TPAUSER);
 
         /* Setting the Rx mode will start the Rx process. */
-        ctrl_outl(EDRRR_R, ioaddr + EDRRR);
+        writel(EDRRR_R, ioaddr + EDRRR);
 
         netif_start_queue(ndev);
 
@@ -811,8 +811,8 @@ static int sh_eth_rx(struct net_device *ndev)
 
         /* Restart Rx engine if stopped. */
         /* If we don't need to check status, don't. -KDU */
-        if (!(ctrl_inl(ndev->base_addr + EDRRR) & EDRRR_R))
-                ctrl_outl(EDRRR_R, ndev->base_addr + EDRRR);
+        if (!(readl(ndev->base_addr + EDRRR) & EDRRR_R))
+                writel(EDRRR_R, ndev->base_addr + EDRRR);
 
         return 0;
 }
@@ -827,8 +827,8 @@ static void sh_eth_error(struct net_device *ndev, int intr_status)
         u32 mask;
 
         if (intr_status & EESR_ECI) {
-                felic_stat = ctrl_inl(ioaddr + ECSR);
-                ctrl_outl(felic_stat, ioaddr + ECSR);   /* clear int */
+                felic_stat = readl(ioaddr + ECSR);
+                writel(felic_stat, ioaddr + ECSR);      /* clear int */
                 if (felic_stat & ECSR_ICD)
                         mdp->stats.tx_carrier_errors++;
                 if (felic_stat & ECSR_LCHNG) {
@@ -839,25 +839,25 @@ static void sh_eth_error(struct net_device *ndev, int intr_status)
                                 else
                                         link_stat = PHY_ST_LINK;
                         } else {
-                                link_stat = (ctrl_inl(ioaddr + PSR));
+                                link_stat = (readl(ioaddr + PSR));
                                 if (mdp->ether_link_active_low)
                                         link_stat = ~link_stat;
                         }
                         if (!(link_stat & PHY_ST_LINK)) {
                                 /* Link Down : disable tx and rx */
-                                ctrl_outl(ctrl_inl(ioaddr + ECMR) &
+                                writel(readl(ioaddr + ECMR) &
                                           ~(ECMR_RE | ECMR_TE), ioaddr + ECMR);
                         } else {
                                 /* Link Up */
-                                ctrl_outl(ctrl_inl(ioaddr + EESIPR) &
+                                writel(readl(ioaddr + EESIPR) &
                                           ~DMAC_M_ECI, ioaddr + EESIPR);
                                 /*clear int */
-                                ctrl_outl(ctrl_inl(ioaddr + ECSR),
+                                writel(readl(ioaddr + ECSR),
                                           ioaddr + ECSR);
-                                ctrl_outl(ctrl_inl(ioaddr + EESIPR) |
+                                writel(readl(ioaddr + EESIPR) |
                                           DMAC_M_ECI, ioaddr + EESIPR);
                                 /* enable tx and rx */
-                                ctrl_outl(ctrl_inl(ioaddr + ECMR) |
+                                writel(readl(ioaddr + ECMR) |
                                           (ECMR_RE | ECMR_TE), ioaddr + ECMR);
                         }
                 }
@@ -888,8 +888,8 @@ static void sh_eth_error(struct net_device *ndev, int intr_status)
                 /* Receive Descriptor Empty int */
                 mdp->stats.rx_over_errors++;
 
-                if (ctrl_inl(ioaddr + EDRRR) ^ EDRRR_R)
-                        ctrl_outl(EDRRR_R, ioaddr + EDRRR);
+                if (readl(ioaddr + EDRRR) ^ EDRRR_R)
+                        writel(EDRRR_R, ioaddr + EDRRR);
                 dev_err(&ndev->dev, "Receive Descriptor Empty\n");
         }
         if (intr_status & EESR_RFE) {
@@ -903,7 +903,7 @@ static void sh_eth_error(struct net_device *ndev, int intr_status)
                 mask &= ~EESR_ADE;
         if (intr_status & mask) {
                 /* Tx error */
-                u32 edtrr = ctrl_inl(ndev->base_addr + EDTRR);
+                u32 edtrr = readl(ndev->base_addr + EDTRR);
                 /* dmesg */
                 dev_err(&ndev->dev, "TX error. status=%8.8x cur_tx=%8.8x ",
                                 intr_status, mdp->cur_tx);
@@ -915,7 +915,7 @@ static void sh_eth_error(struct net_device *ndev, int intr_status)
                 /* SH7712 BUG */
                 if (edtrr ^ EDTRR_TRNS) {
                         /* tx dma start */
-                        ctrl_outl(EDTRR_TRNS, ndev->base_addr + EDTRR);
+                        writel(EDTRR_TRNS, ndev->base_addr + EDTRR);
                 }
                 /* wakeup */
                 netif_wake_queue(ndev);
@@ -934,12 +934,12 @@ static irqreturn_t sh_eth_interrupt(int irq, void *netdev)
         spin_lock(&mdp->lock);
 
         /* Get interrpt stat */
-        intr_status = ctrl_inl(ioaddr + EESR);
+        intr_status = readl(ioaddr + EESR);
         /* Clear interrupt */
         if (intr_status & (EESR_FRC | EESR_RMAF | EESR_RRF |
                         EESR_RTLF | EESR_RTSF | EESR_PRE | EESR_CERF |
                         cd->tx_check | cd->eesr_err_check)) {
-                ctrl_outl(intr_status, ioaddr + EESR);
+                writel(intr_status, ioaddr + EESR);
                 ret = IRQ_HANDLED;
         } else
                 goto other_irq;
@@ -1000,7 +1000,7 @@ static void sh_eth_adjust_link(struct net_device *ndev)
                                 mdp->cd->set_rate(ndev);
                 }
                 if (mdp->link == PHY_DOWN) {
-                        ctrl_outl((ctrl_inl(ioaddr + ECMR) & ~ECMR_TXF)
+                        writel((readl(ioaddr + ECMR) & ~ECMR_TXF)
                                         | ECMR_DM, ioaddr + ECMR);
                         new_state = 1;
                         mdp->link = phydev->link;
@@ -1125,7 +1125,7 @@ static void sh_eth_tx_timeout(struct net_device *ndev)
 
         /* worning message out. */
         printk(KERN_WARNING "%s: transmit timed out, status %8.8x,"
-               " resetting...\n", ndev->name, (int)ctrl_inl(ioaddr + EESR));
+               " resetting...\n", ndev->name, (int)readl(ioaddr + EESR));
 
         /* tx_errors count up */
         mdp->stats.tx_errors++;
@@ -1196,8 +1196,8 @@ static int sh_eth_start_xmit(struct sk_buff *skb, struct net_device *ndev)
 
         mdp->cur_tx++;
 
-        if (!(ctrl_inl(ndev->base_addr + EDTRR) & EDTRR_TRNS))
-                ctrl_outl(EDTRR_TRNS, ndev->base_addr + EDTRR);
+        if (!(readl(ndev->base_addr + EDTRR) & EDTRR_TRNS))
+                writel(EDTRR_TRNS, ndev->base_addr + EDTRR);
 
         return NETDEV_TX_OK;
 }
@@ -1212,11 +1212,11 @@ static int sh_eth_close(struct net_device *ndev)
         netif_stop_queue(ndev);
 
         /* Disable interrupts by clearing the interrupt mask. */
-        ctrl_outl(0x0000, ioaddr + EESIPR);
+        writel(0x0000, ioaddr + EESIPR);
 
         /* Stop the chip's Tx and Rx processes. */
-        ctrl_outl(0, ioaddr + EDTRR);
-        ctrl_outl(0, ioaddr + EDRRR);
+        writel(0, ioaddr + EDTRR);
+        writel(0, ioaddr + EDRRR);
 
         /* PHY Disconnect */
         if (mdp->phydev) {
@@ -1251,20 +1251,20 @@ static struct net_device_stats *sh_eth_get_stats(struct net_device *ndev)
 
         pm_runtime_get_sync(&mdp->pdev->dev);
 
-        mdp->stats.tx_dropped += ctrl_inl(ioaddr + TROCR);
-        ctrl_outl(0, ioaddr + TROCR);   /* (write clear) */
-        mdp->stats.collisions += ctrl_inl(ioaddr + CDCR);
-        ctrl_outl(0, ioaddr + CDCR);    /* (write clear) */
-        mdp->stats.tx_carrier_errors += ctrl_inl(ioaddr + LCCR);
-        ctrl_outl(0, ioaddr + LCCR);    /* (write clear) */
+        mdp->stats.tx_dropped += readl(ioaddr + TROCR);
+        writel(0, ioaddr + TROCR);      /* (write clear) */
+        mdp->stats.collisions += readl(ioaddr + CDCR);
+        writel(0, ioaddr + CDCR);       /* (write clear) */
+        mdp->stats.tx_carrier_errors += readl(ioaddr + LCCR);
+        writel(0, ioaddr + LCCR);       /* (write clear) */
 #if defined(CONFIG_CPU_SUBTYPE_SH7763)
-        mdp->stats.tx_carrier_errors += ctrl_inl(ioaddr + CERCR);/* CERCR */
-        ctrl_outl(0, ioaddr + CERCR);   /* (write clear) */
-        mdp->stats.tx_carrier_errors += ctrl_inl(ioaddr + CEECR);/* CEECR */
-        ctrl_outl(0, ioaddr + CEECR);   /* (write clear) */
+        mdp->stats.tx_carrier_errors += readl(ioaddr + CERCR);/* CERCR */
+        writel(0, ioaddr + CERCR);      /* (write clear) */
+        mdp->stats.tx_carrier_errors += readl(ioaddr + CEECR);/* CEECR */
+        writel(0, ioaddr + CEECR);      /* (write clear) */
 #else
-        mdp->stats.tx_carrier_errors += ctrl_inl(ioaddr + CNDCR);
-        ctrl_outl(0, ioaddr + CNDCR);   /* (write clear) */
+        mdp->stats.tx_carrier_errors += readl(ioaddr + CNDCR);
+        writel(0, ioaddr + CNDCR);      /* (write clear) */
 #endif
         pm_runtime_put_sync(&mdp->pdev->dev);
 
@@ -1295,11 +1295,11 @@ static void sh_eth_set_multicast_list(struct net_device *ndev)
 
         if (ndev->flags & IFF_PROMISC) {
                 /* Set promiscuous. */
-                ctrl_outl((ctrl_inl(ioaddr + ECMR) & ~ECMR_MCT) | ECMR_PRM,
+                writel((readl(ioaddr + ECMR) & ~ECMR_MCT) | ECMR_PRM,
                           ioaddr + ECMR);
         } else {
                 /* Normal, unicast/broadcast-only mode. */
-                ctrl_outl((ctrl_inl(ioaddr + ECMR) & ~ECMR_PRM) | ECMR_MCT,
+                writel((readl(ioaddr + ECMR) & ~ECMR_PRM) | ECMR_MCT,
                           ioaddr + ECMR);
         }
 }
@@ -1307,30 +1307,30 @@ static void sh_eth_set_multicast_list(struct net_device *ndev)
 /* SuperH's TSU register init function */
 static void sh_eth_tsu_init(u32 ioaddr)
 {
-        ctrl_outl(0, ioaddr + TSU_FWEN0);       /* Disable forward(0->1) */
-        ctrl_outl(0, ioaddr + TSU_FWEN1);       /* Disable forward(1->0) */
-        ctrl_outl(0, ioaddr + TSU_FCM); /* forward fifo 3k-3k */
-        ctrl_outl(0xc, ioaddr + TSU_BSYSL0);
-        ctrl_outl(0xc, ioaddr + TSU_BSYSL1);
-        ctrl_outl(0, ioaddr + TSU_PRISL0);
-        ctrl_outl(0, ioaddr + TSU_PRISL1);
-        ctrl_outl(0, ioaddr + TSU_FWSL0);
-        ctrl_outl(0, ioaddr + TSU_FWSL1);
-        ctrl_outl(TSU_FWSLC_POSTENU | TSU_FWSLC_POSTENL, ioaddr + TSU_FWSLC);
+        writel(0, ioaddr + TSU_FWEN0);  /* Disable forward(0->1) */
+        writel(0, ioaddr + TSU_FWEN1);  /* Disable forward(1->0) */
+        writel(0, ioaddr + TSU_FCM);    /* forward fifo 3k-3k */
+        writel(0xc, ioaddr + TSU_BSYSL0);
+        writel(0xc, ioaddr + TSU_BSYSL1);
+        writel(0, ioaddr + TSU_PRISL0);
+        writel(0, ioaddr + TSU_PRISL1);
+        writel(0, ioaddr + TSU_FWSL0);
+        writel(0, ioaddr + TSU_FWSL1);
+        writel(TSU_FWSLC_POSTENU | TSU_FWSLC_POSTENL, ioaddr + TSU_FWSLC);
 #if defined(CONFIG_CPU_SUBTYPE_SH7763)
-        ctrl_outl(0, ioaddr + TSU_QTAG0);       /* Disable QTAG(0->1) */
-        ctrl_outl(0, ioaddr + TSU_QTAG1);       /* Disable QTAG(1->0) */
+        writel(0, ioaddr + TSU_QTAG0);  /* Disable QTAG(0->1) */
+        writel(0, ioaddr + TSU_QTAG1);  /* Disable QTAG(1->0) */
 #else
-        ctrl_outl(0, ioaddr + TSU_QTAGM0);      /* Disable QTAG(0->1) */
-        ctrl_outl(0, ioaddr + TSU_QTAGM1);      /* Disable QTAG(1->0) */
+        writel(0, ioaddr + TSU_QTAGM0); /* Disable QTAG(0->1) */
+        writel(0, ioaddr + TSU_QTAGM1); /* Disable QTAG(1->0) */
 #endif
-        ctrl_outl(0, ioaddr + TSU_FWSR);        /* all interrupt status clear */
-        ctrl_outl(0, ioaddr + TSU_FWINMK);      /* Disable all interrupt */
-        ctrl_outl(0, ioaddr + TSU_TEN); /* Disable all CAM entry */
-        ctrl_outl(0, ioaddr + TSU_POST1);       /* Disable CAM entry [ 0- 7] */
-        ctrl_outl(0, ioaddr + TSU_POST2);       /* Disable CAM entry [ 8-15] */
-        ctrl_outl(0, ioaddr + TSU_POST3);       /* Disable CAM entry [16-23] */
-        ctrl_outl(0, ioaddr + TSU_POST4);       /* Disable CAM entry [24-31] */
+        writel(0, ioaddr + TSU_FWSR);   /* all interrupt status clear */
+        writel(0, ioaddr + TSU_FWINMK); /* Disable all interrupt */
+        writel(0, ioaddr + TSU_TEN);    /* Disable all CAM entry */
+        writel(0, ioaddr + TSU_POST1);  /* Disable CAM entry [ 0- 7] */
+        writel(0, ioaddr + TSU_POST2);  /* Disable CAM entry [ 8-15] */
+        writel(0, ioaddr + TSU_POST3);  /* Disable CAM entry [16-23] */
+        writel(0, ioaddr + TSU_POST4);  /* Disable CAM entry [24-31] */
 }
 #endif /* SH_ETH_HAS_TSU */
 
diff --git a/drivers/net/stmmac/stmmac.h b/drivers/net/stmmac/stmmac.h
index 79bdc2e1322..5f06c4706ab 100644
--- a/drivers/net/stmmac/stmmac.h
+++ b/drivers/net/stmmac/stmmac.h
@@ -20,7 +20,7 @@
   Author: Giuseppe Cavallaro <peppe.cavallaro@st.com>
 *******************************************************************************/
 
-#define DRV_MODULE_VERSION      "Apr_2010"
+#define DRV_MODULE_VERSION      "Nov_2010"
 #include <linux/platform_device.h>
 #include <linux/stmmac.h>
 
@@ -37,7 +37,6 @@ struct stmmac_priv {
         unsigned int cur_tx;
         unsigned int dirty_tx;
         unsigned int dma_tx_size;
-        int tx_coe;
         int tx_coalesce;
 
         struct dma_desc *dma_rx ;
@@ -48,7 +47,6 @@ struct stmmac_priv {
         struct sk_buff_head rx_recycle;
 
         struct net_device *dev;
-        int is_gmac;
         dma_addr_t dma_rx_phy;
         unsigned int dma_rx_size;
         unsigned int dma_buf_sz;
@@ -60,14 +58,11 @@ struct stmmac_priv {
         struct napi_struct napi;
 
         phy_interface_t phy_interface;
-        int pbl;
-        int bus_id;
         int phy_addr;
         int phy_mask;
         int (*phy_reset) (void *priv);
-        void (*fix_mac_speed) (void *priv, unsigned int speed);
-        void (*bus_setup)(void __iomem *ioaddr);
-        void *bsp_priv;
+        int rx_coe;
+        int no_csum_insertion;
 
         int phy_irq;
         struct phy_device *phydev;
@@ -77,47 +72,20 @@ struct stmmac_priv {
         unsigned int flow_ctrl;
         unsigned int pause;
         struct mii_bus *mii;
-        int mii_clk_csr;
 
         u32 msg_enable;
         spinlock_t lock;
         int wolopts;
         int wolenabled;
-        int shutdown;
 #ifdef CONFIG_STMMAC_TIMER
         struct stmmac_timer *tm;
 #endif
 #ifdef STMMAC_VLAN_TAG_USED
         struct vlan_group *vlgrp;
 #endif
-        int enh_desc;
-        int rx_coe;
-        int bugged_jumbo;
-        int no_csum_insertion;
+        struct plat_stmmacenet_data *plat;
 };
 
-#ifdef CONFIG_STM_DRIVERS
-#include <linux/stm/pad.h>
-static inline int stmmac_claim_resource(struct platform_device *pdev)
-{
-        int ret = 0;
-        struct plat_stmmacenet_data *plat_dat = pdev->dev.platform_data;
-
-        /* Pad routing setup */
-        if (IS_ERR(devm_stm_pad_claim(&pdev->dev, plat_dat->pad_config,
-                        dev_name(&pdev->dev)))) {
-                printk(KERN_ERR "%s: Failed to request pads!\n", __func__);
-                ret = -ENODEV;
-        }
-        return ret;
-}
-#else
-static inline int stmmac_claim_resource(struct platform_device *pdev)
-{
-        return 0;
-}
-#endif
-
 extern int stmmac_mdio_unregister(struct net_device *ndev);
 extern int stmmac_mdio_register(struct net_device *ndev);
 extern void stmmac_set_ethtool_ops(struct net_device *netdev);
diff --git a/drivers/net/stmmac/stmmac_ethtool.c b/drivers/net/stmmac/stmmac_ethtool.c
index 6d65482e789..fd719edc7f7 100644
--- a/drivers/net/stmmac/stmmac_ethtool.c
+++ b/drivers/net/stmmac/stmmac_ethtool.c
@@ -94,7 +94,7 @@ static void stmmac_ethtool_getdrvinfo(struct net_device *dev,
 {
         struct stmmac_priv *priv = netdev_priv(dev);
 
-        if (!priv->is_gmac)
+        if (!priv->plat->has_gmac)
                 strcpy(info->driver, MAC100_ETHTOOL_NAME);
         else
                 strcpy(info->driver, GMAC_ETHTOOL_NAME);
@@ -176,7 +176,7 @@ static void stmmac_ethtool_gregs(struct net_device *dev,
 
         memset(reg_space, 0x0, REG_SPACE_SIZE);
 
-        if (!priv->is_gmac) {
+        if (!priv->plat->has_gmac) {
                 /* MAC registers */
                 for (i = 0; i < 12; i++)
                         reg_space[i] = readl(priv->ioaddr + (i * 4));
@@ -197,16 +197,6 @@ static void stmmac_ethtool_gregs(struct net_device *dev,
         }
 }
 
-static int stmmac_ethtool_set_tx_csum(struct net_device *netdev, u32 data)
-{
-        if (data)
-                netdev->features |= NETIF_F_HW_CSUM;
-        else
-                netdev->features &= ~NETIF_F_HW_CSUM;
-
-        return 0;
-}
-
 static u32 stmmac_ethtool_get_rx_csum(struct net_device *dev)
 {
         struct stmmac_priv *priv = netdev_priv(dev);
@@ -370,7 +360,7 @@ static struct ethtool_ops stmmac_ethtool_ops = {
         .get_link = ethtool_op_get_link,
         .get_rx_csum = stmmac_ethtool_get_rx_csum,
         .get_tx_csum = ethtool_op_get_tx_csum,
-        .set_tx_csum = stmmac_ethtool_set_tx_csum,
+        .set_tx_csum = ethtool_op_set_tx_ipv6_csum,
         .get_sg = ethtool_op_get_sg,
         .set_sg = ethtool_op_set_sg,
         .get_pauseparam = stmmac_get_pauseparam,
diff --git a/drivers/net/stmmac/stmmac_main.c b/drivers/net/stmmac/stmmac_main.c
index 2114837809e..c0dc78571c6 100644
--- a/drivers/net/stmmac/stmmac_main.c
+++ b/drivers/net/stmmac/stmmac_main.c
@@ -186,6 +186,18 @@ static inline u32 stmmac_tx_avail(struct stmmac_priv *priv)
         return priv->dirty_tx + priv->dma_tx_size - priv->cur_tx - 1;
 }
 
+/* On some ST platforms, some HW system configuraton registers have to be
+ * set according to the link speed negotiated.
+ */
+static inline void stmmac_hw_fix_mac_speed(struct stmmac_priv *priv)
+{
+        struct phy_device *phydev = priv->phydev;
+
+        if (likely(priv->plat->fix_mac_speed))
+                priv->plat->fix_mac_speed(priv->plat->bsp_priv,
+                                          phydev->speed);
+}
+
 /**
  * stmmac_adjust_link
  * @dev: net device structure
@@ -228,15 +240,13 @@ static void stmmac_adjust_link(struct net_device *dev)
                         new_state = 1;
                         switch (phydev->speed) {
                         case 1000:
-                                if (likely(priv->is_gmac))
+                                if (likely(priv->plat->has_gmac))
                                         ctrl &= ~priv->hw->link.port;
-                                if (likely(priv->fix_mac_speed))
-                                        priv->fix_mac_speed(priv->bsp_priv,
-                                                            phydev->speed);
+                                stmmac_hw_fix_mac_speed(priv);
                                 break;
                         case 100:
                         case 10:
-                                if (priv->is_gmac) {
+                                if (priv->plat->has_gmac) {
                                         ctrl |= priv->hw->link.port;
                                         if (phydev->speed == SPEED_100) {
                                                 ctrl |= priv->hw->link.speed;
@@ -246,9 +256,7 @@ static void stmmac_adjust_link(struct net_device *dev)
                                 } else {
                                         ctrl &= ~priv->hw->link.port;
                                 }
-                                if (likely(priv->fix_mac_speed))
-                                        priv->fix_mac_speed(priv->bsp_priv,
-                                                            phydev->speed);
+                                stmmac_hw_fix_mac_speed(priv);
                                 break;
                         default:
                                 if (netif_msg_link(priv))
@@ -305,7 +313,7 @@ static int stmmac_init_phy(struct net_device *dev)
                 return 0;
         }
 
-        snprintf(bus_id, MII_BUS_ID_SIZE, "%x", priv->bus_id);
+        snprintf(bus_id, MII_BUS_ID_SIZE, "%x", priv->plat->bus_id);
         snprintf(phy_id, MII_BUS_ID_SIZE + 3, PHY_ID_FMT, bus_id,
                  priv->phy_addr);
         pr_debug("stmmac_init_phy:  trying to attach to %s\n", phy_id);
@@ -552,7 +560,7 @@ static void free_dma_desc_resources(struct stmmac_priv *priv)
  */
 static void stmmac_dma_operation_mode(struct stmmac_priv *priv)
 {
-        if (likely((priv->tx_coe) && (!priv->no_csum_insertion))) {
+        if (likely((priv->plat->tx_coe) && (!priv->no_csum_insertion))) {
                 /* In case of GMAC, SF mode has to be enabled
                  * to perform the TX COE. This depends on:
                  * 1) TX COE if actually supported
@@ -814,7 +822,7 @@ static int stmmac_open(struct net_device *dev)
         init_dma_desc_rings(dev);
 
         /* DMA initialization and SW reset */
-        if (unlikely(priv->hw->dma->init(priv->ioaddr, priv->pbl,
+        if (unlikely(priv->hw->dma->init(priv->ioaddr, priv->plat->pbl,
                                          priv->dma_tx_phy,
                                          priv->dma_rx_phy) < 0)) {
 
@@ -825,19 +833,17 @@ static int stmmac_open(struct net_device *dev)
         /* Copy the MAC addr into the HW  */
         priv->hw->mac->set_umac_addr(priv->ioaddr, dev->dev_addr, 0);
         /* If required, perform hw setup of the bus. */
-        if (priv->bus_setup)
-                priv->bus_setup(priv->ioaddr);
+        if (priv->plat->bus_setup)
+                priv->plat->bus_setup(priv->ioaddr);
         /* Initialize the MAC Core */
         priv->hw->mac->core_init(priv->ioaddr);
 
         priv->rx_coe = priv->hw->mac->rx_coe(priv->ioaddr);
         if (priv->rx_coe)
                 pr_info("stmmac: Rx Checksum Offload Engine supported\n");
-        if (priv->tx_coe)
+        if (priv->plat->tx_coe)
                 pr_info("\tTX Checksum insertion supported\n");
 
-        priv->shutdown = 0;
-
         /* Initialise the MMC (if present) to disable all interrupts. */
         writel(0xffffffff, priv->ioaddr + MMC_HIGH_INTR_MASK);
         writel(0xffffffff, priv->ioaddr + MMC_LOW_INTR_MASK);
@@ -1042,7 +1048,8 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
                 return stmmac_sw_tso(priv, skb);
 
         if (likely((skb->ip_summed == CHECKSUM_PARTIAL))) {
-                if (unlikely((!priv->tx_coe) || (priv->no_csum_insertion)))
+                if (unlikely((!priv->plat->tx_coe) ||
+                             (priv->no_csum_insertion)))
                         skb_checksum_help(skb);
                 else
                         csum_insertion = 1;
@@ -1146,7 +1153,7 @@ static inline void stmmac_rx_refill(struct stmmac_priv *priv)
                                            DMA_FROM_DEVICE);
 
                         (p + entry)->des2 = priv->rx_skbuff_dma[entry];
-                        if (unlikely(priv->is_gmac)) {
+                        if (unlikely(priv->plat->has_gmac)) {
                                 if (bfsize >= BUF_SIZE_8KiB)
                                         (p + entry)->des3 =
                                             (p + entry)->des2 + BUF_SIZE_8KiB;
@@ -1356,7 +1363,7 @@ static int stmmac_change_mtu(struct net_device *dev, int new_mtu)
                 return -EBUSY;
         }
 
-        if (priv->is_gmac)
+        if (priv->plat->has_gmac)
                 max_mtu = JUMBO_LEN;
         else
                 max_mtu = ETH_DATA_LEN;
@@ -1370,7 +1377,7 @@ static int stmmac_change_mtu(struct net_device *dev, int new_mtu)
          * needs to have the Tx COE disabled for oversized frames
          * (due to limited buffer sizes). In this case we disable
          * the TX csum insertionin the TDES and not use SF. */
-        if ((priv->bugged_jumbo) && (priv->dev->mtu > ETH_DATA_LEN))
+        if ((priv->plat->bugged_jumbo) && (priv->dev->mtu > ETH_DATA_LEN))
                 priv->no_csum_insertion = 1;
         else
                 priv->no_csum_insertion = 0;
@@ -1390,7 +1397,7 @@ static irqreturn_t stmmac_interrupt(int irq, void *dev_id)
                 return IRQ_NONE;
         }
 
-        if (priv->is_gmac)
+        if (priv->plat->has_gmac)
                 /* To handle GMAC own interrupts */
                 priv->hw->mac->host_irq_status((void __iomem *) dev->base_addr);
 
@@ -1487,7 +1494,8 @@ static int stmmac_probe(struct net_device *dev)
         dev->netdev_ops = &stmmac_netdev_ops;
         stmmac_set_ethtool_ops(dev);
 
-        dev->features |= (NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_HIGHDMA);
+        dev->features |= NETIF_F_SG | NETIF_F_HIGHDMA |
+                NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
         dev->watchdog_timeo = msecs_to_jiffies(watchdog);
 #ifdef STMMAC_VLAN_TAG_USED
         /* Both mac100 and gmac support receive VLAN tag detection */
@@ -1520,7 +1528,7 @@ static int stmmac_probe(struct net_device *dev)
 
         DBG(probe, DEBUG, "%s: Scatter/Gather: %s - HW checksums: %s\n",
             dev->name, (dev->features & NETIF_F_SG) ? "on" : "off",
-            (dev->features & NETIF_F_HW_CSUM) ? "on" : "off");
+            (dev->features & NETIF_F_IP_CSUM) ? "on" : "off");
 
         return ret;
 }
@@ -1536,7 +1544,7 @@ static int stmmac_mac_device_setup(struct net_device *dev)
 
         struct mac_device_info *device;
 
-        if (priv->is_gmac)
+        if (priv->plat->has_gmac)
                 device = dwmac1000_setup(priv->ioaddr);
         else
                 device = dwmac100_setup(priv->ioaddr);
@@ -1544,7 +1552,7 @@ static int stmmac_mac_device_setup(struct net_device *dev)
         if (!device)
                 return -ENOMEM;
 
-        if (priv->enh_desc) {
+        if (priv->plat->enh_desc) {
                 device->desc = &enh_desc_ops;
                 pr_info("\tEnhanced descriptor structure\n");
         } else
@@ -1598,7 +1606,7 @@ static int stmmac_associate_phy(struct device *dev, void *data)
                 plat_dat->bus_id);
 
         /* Check that this phy is for the MAC being initialised */
-        if (priv->bus_id != plat_dat->bus_id)
+        if (priv->plat->bus_id != plat_dat->bus_id)
                 return 0;
 
         /* OK, this PHY is connected to the MAC.
@@ -1634,7 +1642,7 @@ static int stmmac_dvr_probe(struct platform_device *pdev)
         struct resource *res;
         void __iomem *addr = NULL;
         struct net_device *ndev = NULL;
-        struct stmmac_priv *priv;
+        struct stmmac_priv *priv = NULL;
         struct plat_stmmacenet_data *plat_dat;
 
         pr_info("STMMAC driver:\n\tplatform registration... ");
@@ -1683,13 +1691,9 @@ static int stmmac_dvr_probe(struct platform_device *pdev)
         priv->device = &(pdev->dev);
         priv->dev = ndev;
         plat_dat = pdev->dev.platform_data;
-        priv->bus_id = plat_dat->bus_id;
-        priv->pbl = plat_dat->pbl;      /* TLI */
-        priv->mii_clk_csr = plat_dat->clk_csr;
-        priv->tx_coe = plat_dat->tx_coe;
-        priv->bugged_jumbo = plat_dat->bugged_jumbo;
-        priv->is_gmac = plat_dat->has_gmac;     /* GMAC is on board */
-        priv->enh_desc = plat_dat->enh_desc;
+
+        priv->plat = plat_dat;
+
         priv->ioaddr = addr;
 
         /* PMT module is not integrated in all the MAC devices. */
@@ -1703,10 +1707,12 @@ static int stmmac_dvr_probe(struct platform_device *pdev)
         /* Set the I/O base addr */
         ndev->base_addr = (unsigned long)addr;
 
-        /* Verify embedded resource for the platform */
-        ret = stmmac_claim_resource(pdev);
-        if (ret < 0)
-                goto out;
+        /* Custom initialisation */
+        if (priv->plat->init) {
+                ret = priv->plat->init(pdev);
+                if (unlikely(ret))
+                        goto out;
+        }
 
         /* MAC HW revice detection */
         ret = stmmac_mac_device_setup(ndev);
@@ -1727,16 +1733,12 @@ static int stmmac_dvr_probe(struct platform_device *pdev)
                 goto out;
         }
 
-        priv->fix_mac_speed = plat_dat->fix_mac_speed;
-        priv->bus_setup = plat_dat->bus_setup;
-        priv->bsp_priv = plat_dat->bsp_priv;
-
         pr_info("\t%s - (dev. name: %s - id: %d, IRQ #%d\n"
                "\tIO base addr: 0x%p)\n", ndev->name, pdev->name,
                pdev->id, ndev->irq, addr);
 
         /* MDIO bus Registration */
-        pr_debug("\tMDIO bus (id: %d)...", priv->bus_id);
+        pr_debug("\tMDIO bus (id: %d)...", priv->plat->bus_id);
         ret = stmmac_mdio_register(ndev);
         if (ret < 0)
                 goto out;
@@ -1744,6 +1746,9 @@ static int stmmac_dvr_probe(struct platform_device *pdev)
 
 out:
         if (ret < 0) {
+                if (priv->plat->exit)
+                        priv->plat->exit(pdev);
+
                 platform_set_drvdata(pdev, NULL);
                 release_mem_region(res->start, resource_size(res));
                 if (addr != NULL)
@@ -1777,6 +1782,9 @@ static int stmmac_dvr_remove(struct platform_device *pdev)
 
         stmmac_mdio_unregister(ndev);
 
+        if (priv->plat->exit)
+                priv->plat->exit(pdev);
+
         platform_set_drvdata(pdev, NULL);
         unregister_netdev(ndev);
 
@@ -1790,69 +1798,54 @@ static int stmmac_dvr_remove(struct platform_device *pdev)
 }
 
 #ifdef CONFIG_PM
-static int stmmac_suspend(struct platform_device *pdev, pm_message_t state)
+static int stmmac_suspend(struct device *dev)
 {
-        struct net_device *dev = platform_get_drvdata(pdev);
-        struct stmmac_priv *priv = netdev_priv(dev);
+        struct net_device *ndev = dev_get_drvdata(dev);
+        struct stmmac_priv *priv = netdev_priv(ndev);
         int dis_ic = 0;
 
-        if (!dev || !netif_running(dev))
+        if (!ndev || !netif_running(ndev))
                 return 0;
 
         spin_lock(&priv->lock);
 
-        if (state.event == PM_EVENT_SUSPEND) {
-                netif_device_detach(dev);
-                netif_stop_queue(dev);
-                if (priv->phydev)
-                        phy_stop(priv->phydev);
+        netif_device_detach(ndev);
+        netif_stop_queue(ndev);
+        if (priv->phydev)
+                phy_stop(priv->phydev);
 
 #ifdef CONFIG_STMMAC_TIMER
-                priv->tm->timer_stop();
-                if (likely(priv->tm->enable))
-                        dis_ic = 1;
+        priv->tm->timer_stop();
+        if (likely(priv->tm->enable))
+                dis_ic = 1;
 #endif
-                napi_disable(&priv->napi);
-
-                /* Stop TX/RX DMA */
-                priv->hw->dma->stop_tx(priv->ioaddr);
-                priv->hw->dma->stop_rx(priv->ioaddr);
-                /* Clear the Rx/Tx descriptors */
-                priv->hw->desc->init_rx_desc(priv->dma_rx, priv->dma_rx_size,
-                                             dis_ic);
-                priv->hw->desc->init_tx_desc(priv->dma_tx, priv->dma_tx_size);
-
-                /* Enable Power down mode by programming the PMT regs */
-                if (device_can_wakeup(priv->device))
-                        priv->hw->mac->pmt(priv->ioaddr, priv->wolopts);
-                else
-                        stmmac_disable_mac(priv->ioaddr);
-        } else {
-                priv->shutdown = 1;
-                /* Although this can appear slightly redundant it actually
-                 * makes fast the standby operation and guarantees the driver
-                 * working if hibernation is on media. */
-                stmmac_release(dev);
-        }
+        napi_disable(&priv->napi);
+
+        /* Stop TX/RX DMA */
+        priv->hw->dma->stop_tx(priv->ioaddr);
+        priv->hw->dma->stop_rx(priv->ioaddr);
+        /* Clear the Rx/Tx descriptors */
+        priv->hw->desc->init_rx_desc(priv->dma_rx, priv->dma_rx_size,
+                                     dis_ic);
+        priv->hw->desc->init_tx_desc(priv->dma_tx, priv->dma_tx_size);
+
+        /* Enable Power down mode by programming the PMT regs */
+        if (device_may_wakeup(priv->device))
+                priv->hw->mac->pmt(priv->ioaddr, priv->wolopts);
+        else
+                stmmac_disable_mac(priv->ioaddr);
 
         spin_unlock(&priv->lock);
         return 0;
 }
 
-static int stmmac_resume(struct platform_device *pdev)
+static int stmmac_resume(struct device *dev)
 {
-        struct net_device *dev = platform_get_drvdata(pdev);
-        struct stmmac_priv *priv = netdev_priv(dev);
-
-        if (!netif_running(dev))
-                return 0;
+        struct net_device *ndev = dev_get_drvdata(dev);
+        struct stmmac_priv *priv = netdev_priv(ndev);
 
-        if (priv->shutdown) {
-                /* Re-open the interface and re-init the MAC/DMA
-                   and the rings (i.e. on hibernation stage) */
-                stmmac_open(dev);
+        if (!netif_running(ndev))
                 return 0;
-        }
 
         spin_lock(&priv->lock);
 
@@ -1861,10 +1854,10 @@ static int stmmac_resume(struct platform_device *pdev)
          * is received. Anyway, it's better to manually clear
          * this bit because it can generate problems while resuming
          * from another devices (e.g. serial console). */
-        if (device_can_wakeup(priv->device))
+        if (device_may_wakeup(priv->device))
                 priv->hw->mac->pmt(priv->ioaddr, 0);
 
-        netif_device_attach(dev);
+        netif_device_attach(ndev);
 
         /* Enable the MAC and DMA */
         stmmac_enable_mac(priv->ioaddr);
@@ -1872,31 +1865,59 @@ static int stmmac_resume(struct platform_device *pdev)
         priv->hw->dma->start_rx(priv->ioaddr);
 
 #ifdef CONFIG_STMMAC_TIMER
-        priv->tm->timer_start(tmrate);
+        if (likely(priv->tm->enable))
+                priv->tm->timer_start(tmrate);
 #endif
         napi_enable(&priv->napi);
 
         if (priv->phydev)
                 phy_start(priv->phydev);
 
-        netif_start_queue(dev);
+        netif_start_queue(ndev);
 
         spin_unlock(&priv->lock);
         return 0;
 }
-#endif
 
-static struct platform_driver stmmac_driver = {
-        .driver = {
-                   .name = STMMAC_RESOURCE_NAME,
-                   },
-        .probe = stmmac_dvr_probe,
-        .remove = stmmac_dvr_remove,
-#ifdef CONFIG_PM
+static int stmmac_freeze(struct device *dev)
+{
+        struct net_device *ndev = dev_get_drvdata(dev);
+
+        if (!ndev || !netif_running(ndev))
+                return 0;
+
+        return stmmac_release(ndev);
+}
+
+static int stmmac_restore(struct device *dev)
+{
+        struct net_device *ndev = dev_get_drvdata(dev);
+
+        if (!ndev || !netif_running(ndev))
+                return 0;
+
+        return stmmac_open(ndev);
+}
+
+static const struct dev_pm_ops stmmac_pm_ops = {
         .suspend = stmmac_suspend,
         .resume = stmmac_resume,
-#endif
+        .freeze = stmmac_freeze,
+        .thaw = stmmac_restore,
+        .restore = stmmac_restore,
+};
+#else
+static const struct dev_pm_ops stmmac_pm_ops;
+#endif /* CONFIG_PM */
 
+static struct platform_driver stmmac_driver = {
+        .probe = stmmac_dvr_probe,
+        .remove = stmmac_dvr_remove,
+        .driver = {
+                .name = STMMAC_RESOURCE_NAME,
+                .owner = THIS_MODULE,
+                .pm = &stmmac_pm_ops,
+        },
 };
 
 /**
diff --git a/drivers/net/stmmac/stmmac_mdio.c b/drivers/net/stmmac/stmmac_mdio.c
index d7441616357..234b4068a1f 100644
--- a/drivers/net/stmmac/stmmac_mdio.c
+++ b/drivers/net/stmmac/stmmac_mdio.c
@@ -53,7 +53,7 @@ static int stmmac_mdio_read(struct mii_bus *bus, int phyaddr, int phyreg)
         int data;
         u16 regValue = (((phyaddr << 11) & (0x0000F800)) |
                         ((phyreg << 6) & (0x000007C0)));
-        regValue |= MII_BUSY | ((priv->mii_clk_csr & 7) << 2);
+        regValue |= MII_BUSY | ((priv->plat->clk_csr & 7) << 2);
 
         do {} while (((readl(priv->ioaddr + mii_address)) & MII_BUSY) == 1);
         writel(regValue, priv->ioaddr + mii_address);
@@ -85,7 +85,7 @@ static int stmmac_mdio_write(struct mii_bus *bus, int phyaddr, int phyreg,
             (((phyaddr << 11) & (0x0000F800)) | ((phyreg << 6) & (0x000007C0)))
             | MII_WRITE;
 
-        value |= MII_BUSY | ((priv->mii_clk_csr & 7) << 2);
+        value |= MII_BUSY | ((priv->plat->clk_csr & 7) << 2);
 
 
         /* Wait until any existing MII operation is complete */
@@ -114,7 +114,7 @@ static int stmmac_mdio_reset(struct mii_bus *bus)
 
         if (priv->phy_reset) {
                 pr_debug("stmmac_mdio_reset: calling phy_reset\n");
-                priv->phy_reset(priv->bsp_priv);
+                priv->phy_reset(priv->plat->bsp_priv);
         }
 
         /* This is a workaround for problems with the STE101P PHY.
@@ -157,7 +157,7 @@ int stmmac_mdio_register(struct net_device *ndev)
         new_bus->read = &stmmac_mdio_read;
         new_bus->write = &stmmac_mdio_write;
         new_bus->reset = &stmmac_mdio_reset;
-        snprintf(new_bus->id, MII_BUS_ID_SIZE, "%x", priv->bus_id);
+        snprintf(new_bus->id, MII_BUS_ID_SIZE, "%x", priv->plat->bus_id);
         new_bus->priv = ndev;
         new_bus->irq = irqlist;
         new_bus->phy_mask = priv->phy_mask;
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 30ccbb6d097..5faa87d86c6 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -32,6 +32,7 @@
 #include <linux/etherdevice.h>
 #include <linux/skbuff.h>
 #include <linux/ethtool.h>
+#include <linux/mdio.h>
 #include <linux/mii.h>
 #include <linux/phy.h>
 #include <linux/brcmphy.h>
@@ -69,10 +70,10 @@
 
 #define DRV_MODULE_NAME         "tg3"
 #define TG3_MAJ_NUM                     3
-#define TG3_MIN_NUM                     115
+#define TG3_MIN_NUM                     116
 #define DRV_MODULE_VERSION      \
         __stringify(TG3_MAJ_NUM) "." __stringify(TG3_MIN_NUM)
-#define DRV_MODULE_RELDATE      "October 14, 2010"
+#define DRV_MODULE_RELDATE      "December 3, 2010"
 
 #define TG3_DEF_MAC_MODE        0
 #define TG3_DEF_RX_MODE         0
@@ -1769,9 +1770,9 @@ static void tg3_phy_eee_adjust(struct tg3 *tp, u32 current_link_up)
 
         if (tp->link_config.autoneg == AUTONEG_ENABLE &&
             current_link_up == 1 &&
-            (tp->link_config.active_speed == SPEED_1000 ||
-             (tp->link_config.active_speed == SPEED_100 &&
-              tp->link_config.active_duplex == DUPLEX_FULL))) {
+            tp->link_config.active_duplex == DUPLEX_FULL &&
+            (tp->link_config.active_speed == SPEED_100 ||
+             tp->link_config.active_speed == SPEED_1000)) {
                 u32 eeectl;
 
                 if (tp->link_config.active_speed == SPEED_1000)
@@ -1781,7 +1782,8 @@ static void tg3_phy_eee_adjust(struct tg3 *tp, u32 current_link_up)
 
                 tw32(TG3_CPMU_EEE_CTRL, eeectl);
 
-                tg3_phy_cl45_read(tp, 0x7, TG3_CL45_D7_EEERES_STAT, &val);
+                tg3_phy_cl45_read(tp, MDIO_MMD_AN,
+                                  TG3_CL45_D7_EEERES_STAT, &val);
 
                 if (val == TG3_CL45_D7_EEERES_STAT_LP_1000T ||
                     val == TG3_CL45_D7_EEERES_STAT_LP_100TX)
@@ -2728,12 +2730,10 @@ static int tg3_set_power_state(struct tg3 *tp, pci_power_t state)
                      (tp->tg3_flags3 & TG3_FLG3_ENABLE_APE)))
                         mac_mode |= MAC_MODE_KEEP_FRAME_IN_WOL;
 
-                if (tp->tg3_flags3 & TG3_FLG3_ENABLE_APE) {
-                        mac_mode |= tp->mac_mode &
-                                    (MAC_MODE_APE_TX_EN | MAC_MODE_APE_RX_EN);
-                        if (mac_mode & MAC_MODE_APE_TX_EN)
-                                mac_mode |= MAC_MODE_TDE_ENABLE;
-                }
+                if (tp->tg3_flags3 & TG3_FLG3_ENABLE_APE)
+                        mac_mode |= MAC_MODE_APE_TX_EN |
+                                    MAC_MODE_APE_RX_EN |
+                                    MAC_MODE_TDE_ENABLE;
 
                 tw32_f(MAC_MODE, mac_mode);
                 udelay(100);
@@ -2969,7 +2969,7 @@ static void tg3_phy_copper_begin(struct tg3 *tp)
         }
 
         if (tp->phy_flags & TG3_PHYFLG_EEE_CAP) {
-                u32 val = 0;
+                u32 val;
 
                 tw32(TG3_CPMU_EEE_MODE,
                      tr32(TG3_CPMU_EEE_MODE) & ~TG3_CPMU_EEEMD_LPI_ENABLE);
@@ -2986,19 +2986,18 @@ static void tg3_phy_copper_begin(struct tg3 *tp)
                         tg3_phydsp_write(tp, MII_TG3_DSP_CH34TP2,
                                          val | MII_TG3_DSP_CH34TP2_HIBW01);
 
+                val = 0;
                 if (tp->link_config.autoneg == AUTONEG_ENABLE) {
                         /* Advertise 100-BaseTX EEE ability */
                         if (tp->link_config.advertising &
-                            (ADVERTISED_100baseT_Half |
-                             ADVERTISED_100baseT_Full))
-                                val |= TG3_CL45_D7_EEEADV_CAP_100TX;
+                            ADVERTISED_100baseT_Full)
+                                val |= MDIO_AN_EEE_ADV_100TX;
                         /* Advertise 1000-BaseT EEE ability */
                         if (tp->link_config.advertising &
-                            (ADVERTISED_1000baseT_Half |
-                             ADVERTISED_1000baseT_Full))
-                                val |= TG3_CL45_D7_EEEADV_CAP_1000T;
+                            ADVERTISED_1000baseT_Full)
+                                val |= MDIO_AN_EEE_ADV_1000T;
                 }
-                tg3_phy_cl45_write(tp, 0x7, TG3_CL45_D7_EEEADV_CAP, val);
+                tg3_phy_cl45_write(tp, MDIO_MMD_AN, MDIO_AN_EEE_ADV, val);
 
                 /* Turn off SM_DSP clock. */
                 val = MII_TG3_AUXCTL_SHDWSEL_AUXCTL |
@@ -5763,7 +5762,7 @@ static netdev_tx_t tg3_start_xmit(struct sk_buff *skb,
         dma_unmap_addr_set(&tnapi->tx_buffers[entry], mapping, mapping);
 
         if ((tp->tg3_flags3 & TG3_FLG3_USE_JUMBO_BDFLAG) &&
-            !mss && skb->len > ETH_DATA_LEN)
+            !mss && skb->len > VLAN_ETH_FRAME_LEN)
                 base_flags |= TXD_FLAG_JMB_PKT;
 
         tg3_set_txd(tnapi, entry, mapping, len, base_flags,
@@ -5997,7 +5996,7 @@ static netdev_tx_t tg3_start_xmit_dma_bug(struct sk_buff *skb,
 #endif
 
         if ((tp->tg3_flags3 & TG3_FLG3_USE_JUMBO_BDFLAG) &&
-            !mss && skb->len > ETH_DATA_LEN)
+            !mss && skb->len > VLAN_ETH_FRAME_LEN)
                 base_flags |= TXD_FLAG_JMB_PKT;
 
         len = skb_headlen(skb);
@@ -6339,13 +6338,13 @@ static void tg3_rx_prodring_fini(struct tg3 *tp,
         kfree(tpr->rx_jmb_buffers);
         tpr->rx_jmb_buffers = NULL;
         if (tpr->rx_std) {
-                pci_free_consistent(tp->pdev, TG3_RX_STD_RING_BYTES(tp),
-                                    tpr->rx_std, tpr->rx_std_mapping);
+                dma_free_coherent(&tp->pdev->dev, TG3_RX_STD_RING_BYTES(tp),
+                                  tpr->rx_std, tpr->rx_std_mapping);
                 tpr->rx_std = NULL;
         }
         if (tpr->rx_jmb) {
-                pci_free_consistent(tp->pdev, TG3_RX_JMB_RING_BYTES(tp),
-                                    tpr->rx_jmb, tpr->rx_jmb_mapping);
+                dma_free_coherent(&tp->pdev->dev, TG3_RX_JMB_RING_BYTES(tp),
+                                  tpr->rx_jmb, tpr->rx_jmb_mapping);
                 tpr->rx_jmb = NULL;
         }
 }
@@ -6358,8 +6357,10 @@ static int tg3_rx_prodring_init(struct tg3 *tp,
         if (!tpr->rx_std_buffers)
                 return -ENOMEM;
 
-        tpr->rx_std = pci_alloc_consistent(tp->pdev, TG3_RX_STD_RING_BYTES(tp),
-                                           &tpr->rx_std_mapping);
+        tpr->rx_std = dma_alloc_coherent(&tp->pdev->dev,
+                                         TG3_RX_STD_RING_BYTES(tp),
+                                         &tpr->rx_std_mapping,
+                                         GFP_KERNEL);
         if (!tpr->rx_std)
                 goto err_out;
 
@@ -6370,9 +6371,10 @@ static int tg3_rx_prodring_init(struct tg3 *tp,
                 if (!tpr->rx_jmb_buffers)
                         goto err_out;
 
-                tpr->rx_jmb = pci_alloc_consistent(tp->pdev,
-                                                   TG3_RX_JMB_RING_BYTES(tp),
-                                                   &tpr->rx_jmb_mapping);
+                tpr->rx_jmb = dma_alloc_coherent(&tp->pdev->dev,
+                                                 TG3_RX_JMB_RING_BYTES(tp),
+                                                 &tpr->rx_jmb_mapping,
+                                                 GFP_KERNEL);
                 if (!tpr->rx_jmb)
                         goto err_out;
         }
@@ -6491,7 +6493,7 @@ static void tg3_free_consistent(struct tg3 *tp)
                 struct tg3_napi *tnapi = &tp->napi[i];
 
                 if (tnapi->tx_ring) {
-                        pci_free_consistent(tp->pdev, TG3_TX_RING_BYTES,
+                        dma_free_coherent(&tp->pdev->dev, TG3_TX_RING_BYTES,
                                 tnapi->tx_ring, tnapi->tx_desc_mapping);
                         tnapi->tx_ring = NULL;
                 }
@@ -6500,25 +6502,26 @@ static void tg3_free_consistent(struct tg3 *tp)
                 tnapi->tx_buffers = NULL;
 
                 if (tnapi->rx_rcb) {
-                        pci_free_consistent(tp->pdev, TG3_RX_RCB_RING_BYTES(tp),
-                                            tnapi->rx_rcb,
-                                            tnapi->rx_rcb_mapping);
+                        dma_free_coherent(&tp->pdev->dev,
+                                          TG3_RX_RCB_RING_BYTES(tp),
+                                          tnapi->rx_rcb,
+                                          tnapi->rx_rcb_mapping);
                         tnapi->rx_rcb = NULL;
                 }
 
                 tg3_rx_prodring_fini(tp, &tnapi->prodring);
 
                 if (tnapi->hw_status) {
-                        pci_free_consistent(tp->pdev, TG3_HW_STATUS_SIZE,
-                                            tnapi->hw_status,
-                                            tnapi->status_mapping);
+                        dma_free_coherent(&tp->pdev->dev, TG3_HW_STATUS_SIZE,
+                                          tnapi->hw_status,
+                                          tnapi->status_mapping);
                         tnapi->hw_status = NULL;
                 }
         }
 
         if (tp->hw_stats) {
-                pci_free_consistent(tp->pdev, sizeof(struct tg3_hw_stats),
-                                    tp->hw_stats, tp->stats_mapping);
+                dma_free_coherent(&tp->pdev->dev, sizeof(struct tg3_hw_stats),
+                                  tp->hw_stats, tp->stats_mapping);
                 tp->hw_stats = NULL;
         }
 }
@@ -6531,9 +6534,10 @@ static int tg3_alloc_consistent(struct tg3 *tp)
 {
         int i;
 
-        tp->hw_stats = pci_alloc_consistent(tp->pdev,
-                                            sizeof(struct tg3_hw_stats),
-                                            &tp->stats_mapping);
+        tp->hw_stats = dma_alloc_coherent(&tp->pdev->dev,
+                                          sizeof(struct tg3_hw_stats),
+                                          &tp->stats_mapping,
+                                          GFP_KERNEL);
         if (!tp->hw_stats)
                 goto err_out;
 
@@ -6543,9 +6547,10 @@ static int tg3_alloc_consistent(struct tg3 *tp)
                 struct tg3_napi *tnapi = &tp->napi[i];
                 struct tg3_hw_status *sblk;
 
-                tnapi->hw_status = pci_alloc_consistent(tp->pdev,
-                                                        TG3_HW_STATUS_SIZE,
-                                                        &tnapi->status_mapping);
+                tnapi->hw_status = dma_alloc_coherent(&tp->pdev->dev,
+                                                      TG3_HW_STATUS_SIZE,
+                                                      &tnapi->status_mapping,
+                                                      GFP_KERNEL);
                 if (!tnapi->hw_status)
                         goto err_out;
 
@@ -6566,9 +6571,10 @@ static int tg3_alloc_consistent(struct tg3 *tp)
                         if (!tnapi->tx_buffers)
                                 goto err_out;
 
-                        tnapi->tx_ring = pci_alloc_consistent(tp->pdev,
-                                                              TG3_TX_RING_BYTES,
-                                                       &tnapi->tx_desc_mapping);
+                        tnapi->tx_ring = dma_alloc_coherent(&tp->pdev->dev,
+                                                            TG3_TX_RING_BYTES,
+                                                        &tnapi->tx_desc_mapping,
+                                                            GFP_KERNEL);
                         if (!tnapi->tx_ring)
                                 goto err_out;
                 }
@@ -6601,9 +6607,10 @@ static int tg3_alloc_consistent(struct tg3 *tp)
                 if (!i && (tp->tg3_flags3 & TG3_FLG3_ENABLE_RSS))
                         continue;
 
-                tnapi->rx_rcb = pci_alloc_consistent(tp->pdev,
-                                                     TG3_RX_RCB_RING_BYTES(tp),
-                                                     &tnapi->rx_rcb_mapping);
+                tnapi->rx_rcb = dma_alloc_coherent(&tp->pdev->dev,
+                                                   TG3_RX_RCB_RING_BYTES(tp),
+                                                   &tnapi->rx_rcb_mapping,
+                                                   GFP_KERNEL);
                 if (!tnapi->rx_rcb)
                         goto err_out;
 
@@ -6987,7 +6994,7 @@ static void tg3_restore_pci_state(struct tg3 *tp)
 
         if (GET_ASIC_REV(tp->pci_chip_rev_id) != ASIC_REV_5785) {
                 if (tp->tg3_flags2 & TG3_FLG2_PCI_EXPRESS)
-                        pcie_set_readrq(tp->pdev, 4096);
+                        pcie_set_readrq(tp->pdev, tp->pcie_readrq);
                 else {
                         pci_write_config_byte(tp->pdev, PCI_CACHE_LINE_SIZE,
                                               tp->pci_cacheline_sz);
@@ -7181,7 +7188,7 @@ static int tg3_chip_reset(struct tg3 *tp)
                                       tp->pcie_cap + PCI_EXP_DEVCTL,
                                       val16);
 
-                pcie_set_readrq(tp->pdev, 4096);
+                pcie_set_readrq(tp->pdev, tp->pcie_readrq);
 
                 /* Clear error status */
                 pci_write_config_word(tp->pdev,
@@ -7222,19 +7229,21 @@ static int tg3_chip_reset(struct tg3 *tp)
                 tw32(TG3PCI_CLOCK_CTRL, tp->pci_clock_ctrl);
         }
 
+        if (tp->tg3_flags3 & TG3_FLG3_ENABLE_APE)
+                tp->mac_mode = MAC_MODE_APE_TX_EN |
+                               MAC_MODE_APE_RX_EN |
+                               MAC_MODE_TDE_ENABLE;
+
         if (tp->phy_flags & TG3_PHYFLG_PHY_SERDES) {
-                tp->mac_mode = MAC_MODE_PORT_MODE_TBI;
-                tw32_f(MAC_MODE, tp->mac_mode);
+                tp->mac_mode |= MAC_MODE_PORT_MODE_TBI;
+                val = tp->mac_mode;
         } else if (tp->phy_flags & TG3_PHYFLG_MII_SERDES) {
-                tp->mac_mode = MAC_MODE_PORT_MODE_GMII;
-                tw32_f(MAC_MODE, tp->mac_mode);
-        } else if (tp->tg3_flags3 & TG3_FLG3_ENABLE_APE) {
-                tp->mac_mode &= (MAC_MODE_APE_TX_EN | MAC_MODE_APE_RX_EN);
-                if (tp->mac_mode & MAC_MODE_APE_TX_EN)
-                        tp->mac_mode |= MAC_MODE_TDE_ENABLE;
-                tw32_f(MAC_MODE, tp->mac_mode);
+                tp->mac_mode |= MAC_MODE_PORT_MODE_GMII;
+                val = tp->mac_mode;
         } else
-                tw32_f(MAC_MODE, 0);
+                val = 0;
+
+        tw32_f(MAC_MODE, val);
         udelay(40);
 
         tg3_ape_unlock(tp, TG3_APE_LOCK_GRC);
@@ -7801,6 +7810,37 @@ static int tg3_reset_hw(struct tg3 *tp, int reset_phy)
         if (tp->tg3_flags & TG3_FLAG_INIT_COMPLETE)
                 tg3_abort_hw(tp, 1);
 
+        /* Enable MAC control of LPI */
+        if (tp->phy_flags & TG3_PHYFLG_EEE_CAP) {
+                tw32_f(TG3_CPMU_EEE_LNKIDL_CTRL,
+                       TG3_CPMU_EEE_LNKIDL_PCIE_NL0 |
+                       TG3_CPMU_EEE_LNKIDL_UART_IDL);
+
+                tw32_f(TG3_CPMU_EEE_CTRL,
+                       TG3_CPMU_EEE_CTRL_EXIT_20_1_US);
+
+                val = TG3_CPMU_EEEMD_ERLY_L1_XIT_DET |
+                      TG3_CPMU_EEEMD_LPI_IN_TX |
+                      TG3_CPMU_EEEMD_LPI_IN_RX |
+                      TG3_CPMU_EEEMD_EEE_ENABLE;
+
+                if (GET_ASIC_REV(tp->pci_chip_rev_id) != ASIC_REV_5717)
+                        val |= TG3_CPMU_EEEMD_SND_IDX_DET_EN;
+
+                if (tp->tg3_flags3 & TG3_FLG3_ENABLE_APE)
+                        val |= TG3_CPMU_EEEMD_APE_TX_DET_EN;
+
+                tw32_f(TG3_CPMU_EEE_MODE, val);
+
+                tw32_f(TG3_CPMU_EEE_DBTMR1,
+                       TG3_CPMU_DBTMR1_PCIEXIT_2047US |
+                       TG3_CPMU_DBTMR1_LNKIDLE_2047US);
+
+                tw32_f(TG3_CPMU_EEE_DBTMR2,
+                       TG3_CPMU_DBTMR1_APE_TX_2047US |
+                       TG3_CPMU_DBTMR2_TXIDXEQ_2047US);
+        }
+
         if (reset_phy)
                 tg3_phy_reset(tp);
 
@@ -7860,18 +7900,21 @@ static int tg3_reset_hw(struct tg3 *tp, int reset_phy)
                 tw32(GRC_MODE, grc_mode);
         }
 
-        if (tp->pci_chip_rev_id == CHIPREV_ID_57765_A0) {
-                u32 grc_mode = tr32(GRC_MODE);
+        if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_57765) {
+                if (tp->pci_chip_rev_id == CHIPREV_ID_57765_A0) {
+                        u32 grc_mode = tr32(GRC_MODE);
 
-                /* Access the lower 1K of PL PCIE block registers. */
-                val = grc_mode & ~GRC_MODE_PCIE_PORT_MASK;
-                tw32(GRC_MODE, val | GRC_MODE_PCIE_PL_SEL);
+                        /* Access the lower 1K of PL PCIE block registers. */
+                        val = grc_mode & ~GRC_MODE_PCIE_PORT_MASK;
+                        tw32(GRC_MODE, val | GRC_MODE_PCIE_PL_SEL);
 
-                val = tr32(TG3_PCIE_TLDLPL_PORT + TG3_PCIE_PL_LO_PHYCTL5);
-                tw32(TG3_PCIE_TLDLPL_PORT + TG3_PCIE_PL_LO_PHYCTL5,
-                     val | TG3_PCIE_PL_LO_PHYCTL5_DIS_L2CLKREQ);
+                        val = tr32(TG3_PCIE_TLDLPL_PORT +
+                                   TG3_PCIE_PL_LO_PHYCTL5);
+                        tw32(TG3_PCIE_TLDLPL_PORT + TG3_PCIE_PL_LO_PHYCTL5,
+                             val | TG3_PCIE_PL_LO_PHYCTL5_DIS_L2CLKREQ);
 
-                tw32(GRC_MODE, grc_mode);
+                        tw32(GRC_MODE, grc_mode);
+                }
 
                 val = tr32(TG3_CPMU_LSPD_10MB_CLK);
                 val &= ~CPMU_LSPD_10MB_MACCLK_MASK;
@@ -7879,22 +7922,6 @@ static int tg3_reset_hw(struct tg3 *tp, int reset_phy)
                 tw32(TG3_CPMU_LSPD_10MB_CLK, val);
         }
 
-        /* Enable MAC control of LPI */
-        if (tp->phy_flags & TG3_PHYFLG_EEE_CAP) {
-                tw32_f(TG3_CPMU_EEE_LNKIDL_CTRL,
-                       TG3_CPMU_EEE_LNKIDL_PCIE_NL0 |
-                       TG3_CPMU_EEE_LNKIDL_UART_IDL);
-
-                tw32_f(TG3_CPMU_EEE_CTRL,
-                       TG3_CPMU_EEE_CTRL_EXIT_20_1_US);
-
-                tw32_f(TG3_CPMU_EEE_MODE,
-                       TG3_CPMU_EEEMD_ERLY_L1_XIT_DET |
-                       TG3_CPMU_EEEMD_LPI_IN_TX |
-                       TG3_CPMU_EEEMD_LPI_IN_RX |
-                       TG3_CPMU_EEEMD_EEE_ENABLE);
-        }
-
         /* This works around an issue with Athlon chipsets on
          * B3 tigon3 silicon.  This bit has no effect on any
          * other revision.  But do not set this on PCI Express
@@ -8162,8 +8189,7 @@ static int tg3_reset_hw(struct tg3 *tp, int reset_phy)
                       RDMAC_MODE_FIFOURUN_ENAB | RDMAC_MODE_FIFOOREAD_ENAB |
                       RDMAC_MODE_LNGREAD_ENAB);
 
-        if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5717 ||
-            GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5719)
+        if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5717)
                 rdmac_mode |= RDMAC_MODE_MULT_DMA_RD_DIS;
 
         if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5784 ||
@@ -8203,6 +8229,10 @@ static int tg3_reset_hw(struct tg3 *tp, int reset_phy)
             GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_57780 ||
             (tp->tg3_flags3 & TG3_FLG3_5717_PLUS)) {
                 val = tr32(TG3_RDMA_RSRVCTRL_REG);
+                if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5719) {
+                        val &= ~TG3_RDMA_RSRVCTRL_TXMRGN_MASK;
+                        val |= TG3_RDMA_RSRVCTRL_TXMRGN_320B;
+                }
                 tw32(TG3_RDMA_RSRVCTRL_REG,
                      val | TG3_RDMA_RSRVCTRL_FIFO_OFLW_FIX);
         }
@@ -8280,7 +8310,7 @@ static int tg3_reset_hw(struct tg3 *tp, int reset_phy)
         }
 
         if (tp->tg3_flags3 & TG3_FLG3_ENABLE_APE)
-                tp->mac_mode &= MAC_MODE_APE_TX_EN | MAC_MODE_APE_RX_EN;
+                tp->mac_mode = MAC_MODE_APE_TX_EN | MAC_MODE_APE_RX_EN;
         else
                 tp->mac_mode = 0;
         tp->mac_mode |= MAC_MODE_TXSTAT_ENABLE | MAC_MODE_RXSTAT_ENABLE |
@@ -9031,8 +9061,14 @@ static bool tg3_enable_msix(struct tg3 *tp)
                 pci_disable_msix(tp->pdev);
                 return false;
         }
-        if (tp->irq_cnt > 1)
+
+        if (tp->irq_cnt > 1) {
                 tp->tg3_flags3 |= TG3_FLG3_ENABLE_RSS;
+                if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5719) {
+                        tp->tg3_flags3 |= TG3_FLG3_ENABLE_TSS;
+                        netif_set_real_num_tx_queues(tp->dev, tp->irq_cnt - 1);
+                }
+        }
 
         return true;
 }
@@ -12411,8 +12447,9 @@ static void __devinit tg3_get_eeprom_hw_cfg(struct tg3 *tp)
                 if (cfg2 & (1 << 18))
                         tp->phy_flags |= TG3_PHYFLG_SERDES_PREEMPHASIS;
 
-                if (((GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5784 &&
-                      GET_CHIP_REV(tp->pci_chip_rev_id) != CHIPREV_5784_AX)) &&
+                if (((tp->tg3_flags3 & TG3_FLG3_5717_PLUS) ||
+                    ((GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5784 &&
+                      GET_CHIP_REV(tp->pci_chip_rev_id) != CHIPREV_5784_AX))) &&
                     (cfg2 & NIC_SRAM_DATA_CFG_2_APD_EN))
                         tp->phy_flags |= TG3_PHYFLG_ENABLE_APD;
 
@@ -12548,9 +12585,11 @@ static int __devinit tg3_phy_probe(struct tg3 *tp)
                 }
         }
 
-        if (tp->pdev->device == TG3PCI_DEVICE_TIGON3_5718 ||
-            (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_57765 &&
-             tp->pci_chip_rev_id != CHIPREV_ID_57765_A0))
+        if (!(tp->phy_flags & TG3_PHYFLG_ANY_SERDES) &&
+            ((tp->pdev->device == TG3PCI_DEVICE_TIGON3_5718 &&
+              tp->pci_chip_rev_id != CHIPREV_ID_5717_A0) ||
+             (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_57765 &&
+              tp->pci_chip_rev_id != CHIPREV_ID_57765_A0)))
                 tp->phy_flags |= TG3_PHYFLG_EEE_CAP;
 
         if (!(tp->phy_flags & TG3_PHYFLG_ANY_SERDES) &&
@@ -13359,7 +13398,45 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
 
                 tp->tg3_flags2 |= TG3_FLG2_PCI_EXPRESS;
 
-                pcie_set_readrq(tp->pdev, 4096);
+                tp->pcie_readrq = 4096;
+                if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5719) {
+                        u16 word;
+
+                        pci_read_config_word(tp->pdev,
+                                             tp->pcie_cap + PCI_EXP_LNKSTA,
+                                             &word);
+                        switch (word & PCI_EXP_LNKSTA_CLS) {
+                        case PCI_EXP_LNKSTA_CLS_2_5GB:
+                                word &= PCI_EXP_LNKSTA_NLW;
+                                word >>= PCI_EXP_LNKSTA_NLW_SHIFT;
+                                switch (word) {
+                                case 2:
+                                        tp->pcie_readrq = 2048;
+                                        break;
+                                case 4:
+                                        tp->pcie_readrq = 1024;
+                                        break;
+                                }
+                                break;
+
+                        case PCI_EXP_LNKSTA_CLS_5_0GB:
+                                word &= PCI_EXP_LNKSTA_NLW;
+                                word >>= PCI_EXP_LNKSTA_NLW_SHIFT;
+                                switch (word) {
+                                case 1:
+                                        tp->pcie_readrq = 2048;
+                                        break;
+                                case 2:
+                                        tp->pcie_readrq = 1024;
+                                        break;
+                                case 4:
+                                        tp->pcie_readrq = 512;
+                                        break;
+                                }
+                        }
+                }
+
+                pcie_set_readrq(tp->pdev, tp->pcie_readrq);
 
                 pci_read_config_word(tp->pdev,
                                      tp->pcie_cap + PCI_EXP_LNKCTL,
@@ -13722,8 +13799,7 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
 
         /* Preserve the APE MAC_MODE bits */
         if (tp->tg3_flags3 & TG3_FLG3_ENABLE_APE)
-                tp->mac_mode = tr32(MAC_MODE) |
-                               MAC_MODE_APE_TX_EN | MAC_MODE_APE_RX_EN;
+                tp->mac_mode = MAC_MODE_APE_TX_EN | MAC_MODE_APE_RX_EN;
         else
                 tp->mac_mode = TG3_DEF_MAC_MODE;
 
@@ -14159,7 +14235,8 @@ static int __devinit tg3_test_dma(struct tg3 *tp)
         u32 *buf, saved_dma_rwctrl;
         int ret = 0;
 
-        buf = pci_alloc_consistent(tp->pdev, TEST_BUFFER_SIZE, &buf_dma);
+        buf = dma_alloc_coherent(&tp->pdev->dev, TEST_BUFFER_SIZE,
+                                 &buf_dma, GFP_KERNEL);
         if (!buf) {
                 ret = -ENOMEM;
                 goto out_nofree;
@@ -14343,7 +14420,7 @@ static int __devinit tg3_test_dma(struct tg3 *tp)
         }
 
 out:
-        pci_free_consistent(tp->pdev, TEST_BUFFER_SIZE, buf, buf_dma);
+        dma_free_coherent(&tp->pdev->dev, TEST_BUFFER_SIZE, buf, buf_dma);
 out_nofree:
         return ret;
 }
diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
index 4a1974804b9..d62c8d937c8 100644
--- a/drivers/net/tg3.h
+++ b/drivers/net/tg3.h
@@ -1094,13 +1094,19 @@
 /* 0x3664 --> 0x36b0 unused */
 
 #define TG3_CPMU_EEE_MODE               0x000036b0
-#define TG3_CPMU_EEEMD_ERLY_L1_XIT_DET   0x00000008
-#define TG3_CPMU_EEEMD_LPI_ENABLE        0x00000080
-#define TG3_CPMU_EEEMD_LPI_IN_TX         0x00000100
-#define TG3_CPMU_EEEMD_LPI_IN_RX         0x00000200
-#define TG3_CPMU_EEEMD_EEE_ENABLE        0x00100000
-/* 0x36b4 --> 0x36b8 unused */
-
+#define  TG3_CPMU_EEEMD_APE_TX_DET_EN    0x00000004
+#define  TG3_CPMU_EEEMD_ERLY_L1_XIT_DET  0x00000008
+#define  TG3_CPMU_EEEMD_SND_IDX_DET_EN   0x00000040
+#define  TG3_CPMU_EEEMD_LPI_ENABLE       0x00000080
+#define  TG3_CPMU_EEEMD_LPI_IN_TX        0x00000100
+#define  TG3_CPMU_EEEMD_LPI_IN_RX        0x00000200
+#define  TG3_CPMU_EEEMD_EEE_ENABLE       0x00100000
+#define TG3_CPMU_EEE_DBTMR1             0x000036b4
+#define  TG3_CPMU_DBTMR1_PCIEXIT_2047US  0x07ff0000
+#define  TG3_CPMU_DBTMR1_LNKIDLE_2047US  0x000070ff
+#define TG3_CPMU_EEE_DBTMR2             0x000036b8
+#define  TG3_CPMU_DBTMR1_APE_TX_2047US   0x07ff0000
+#define  TG3_CPMU_DBTMR2_TXIDXEQ_2047US  0x000070ff
 #define TG3_CPMU_EEE_LNKIDL_CTRL        0x000036bc
 #define  TG3_CPMU_EEE_LNKIDL_PCIE_NL0    0x01000000
 #define  TG3_CPMU_EEE_LNKIDL_UART_IDL    0x00000004
@@ -1327,6 +1333,8 @@
 
 #define TG3_RDMA_RSRVCTRL_REG           0x00004900
 #define TG3_RDMA_RSRVCTRL_FIFO_OFLW_FIX  0x00000004
+#define TG3_RDMA_RSRVCTRL_TXMRGN_320B    0x28000000
+#define TG3_RDMA_RSRVCTRL_TXMRGN_MASK    0xffe00000
 /* 0x4904 --> 0x4910 unused */
 
 #define TG3_LSO_RD_DMA_CRPTEN_CTRL      0x00004910
@@ -2170,9 +2178,6 @@
 #define MII_TG3_TEST1_CRC_EN            0x8000
 
 /* Clause 45 expansion registers */
-#define TG3_CL45_D7_EEEADV_CAP          0x003c
-#define TG3_CL45_D7_EEEADV_CAP_100TX    0x0002
-#define TG3_CL45_D7_EEEADV_CAP_1000T    0x0004
 #define TG3_CL45_D7_EEERES_STAT         0x803e
 #define TG3_CL45_D7_EEERES_STAT_LP_100TX        0x0002
 #define TG3_CL45_D7_EEERES_STAT_LP_1000T        0x0004
@@ -2562,10 +2567,6 @@ struct ring_info {
         DEFINE_DMA_UNMAP_ADDR(mapping);
 };
 
-struct tg3_config_info {
-        u32                             flags;
-};
-
 struct tg3_link_config {
         /* Describes what we're trying to get. */
         u32                             advertising;
@@ -2713,17 +2714,17 @@ struct tg3_napi {
         u32                             last_irq_tag;
         u32                             int_mbox;
         u32                             coal_now;
-        u32                             tx_prod;
-        u32                             tx_cons;
-        u32                             tx_pending;
-        u32                             prodmbox;
 
-        u32                             consmbox;
+        u32                             consmbox ____cacheline_aligned;
         u32                             rx_rcb_ptr;
         u16                             *rx_rcb_prod_idx;
         struct tg3_rx_prodring_set      prodring;
-
         struct tg3_rx_buffer_desc       *rx_rcb;
+
+        u32                             tx_prod ____cacheline_aligned;
+        u32                             tx_cons;
+        u32                             tx_pending;
+        u32                             prodmbox;
         struct tg3_tx_buffer_desc       *tx_ring;
         struct ring_info                *tx_buffers;
 
@@ -2946,6 +2947,7 @@ struct tg3 {
         int                             pcix_cap;
         int                             pcie_cap;
         };
+        int                             pcie_readrq;
 
         struct mii_bus                  *mdio_bus;
         int                             mdio_irq[PHY_MAX_ADDR];
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index 52ffabe6db0..6f600cced6e 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -196,6 +196,25 @@ config USB_NET_CDC_EEM
           IEEE 802 "local assignment" bit is set in the address, a "usbX"
           name is used instead.
 
+config USB_NET_CDC_NCM
+        tristate "CDC NCM support"
+        depends on USB_USBNET
+        default y
+        help
+          This driver provides support for CDC NCM (Network Control Model
+          Device USB Class Specification). The CDC NCM specification is
+          available from <http://www.usb.org/>.
+
+          Say "y" to link the driver statically, or "m" to build a
+          dynamically linked module.
+
+          This driver should work with at least the following devices:
+            * ST-Ericsson M700 LTE FDD/TDD Mobile Broadband Modem (ref. design)
+            * ST-Ericsson M5730 HSPA+ Mobile Broadband Modem (reference design)
+            * ST-Ericsson M570 HSPA+ Mobile Broadband Modem (reference design)
+            * ST-Ericsson M343 HSPA Mobile Broadband Modem (reference design)
+            * Ericsson F5521gw Mobile Broadband Module
+
 config USB_NET_DM9601
         tristate "Davicom DM9601 based USB 1.1 10/100 ethernet devices"
         depends on USB_USBNET
diff --git a/drivers/net/usb/Makefile b/drivers/net/usb/Makefile
index a19b0259ae1..cac17030118 100644
--- a/drivers/net/usb/Makefile
+++ b/drivers/net/usb/Makefile
@@ -26,4 +26,5 @@ obj-$(CONFIG_USB_CDC_PHONET)	+= cdc-phonet.o
 obj-$(CONFIG_USB_IPHETH)        += ipheth.o
 obj-$(CONFIG_USB_SIERRA_NET)    += sierra_net.o
 obj-$(CONFIG_USB_NET_CX82310_ETH)       += cx82310_eth.o
+obj-$(CONFIG_USB_NET_CDC_NCM)   += cdc_ncm.o
 
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
new file mode 100644
index 00000000000..593c104ab19
--- /dev/null
+++ b/drivers/net/usb/cdc_ncm.c
@@ -0,0 +1,1213 @@
+/*
+ * cdc_ncm.c
+ *
+ * Copyright (C) ST-Ericsson 2010
+ * Contact: Alexey Orishko <alexey.orishko@stericsson.com>
+ * Original author: Hans Petter Selasky <hans.petter.selasky@stericsson.com>
+ *
+ * USB Host Driver for Network Control Model (NCM)
+ * http://www.usb.org/developers/devclass_docs/NCM10.zip
+ *
+ * The NCM encoding, decoding and initialization logic
+ * derives from FreeBSD 8.x. if_cdce.c and if_cdcereg.h
+ *
+ * This software is available to you under a choice of one of two
+ * licenses. You may choose this file to be licensed under the terms
+ * of the GNU General Public License (GPL) Version 2 or the 2-clause
+ * BSD license listed below:
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/netdevice.h>
+#include <linux/ctype.h>
+#include <linux/ethtool.h>
+#include <linux/workqueue.h>
+#include <linux/mii.h>
+#include <linux/crc32.h>
+#include <linux/usb.h>
+#include <linux/version.h>
+#include <linux/timer.h>
+#include <linux/spinlock.h>
+#include <linux/atomic.h>
+#include <linux/usb/usbnet.h>
+#include <linux/usb/cdc.h>
+
+#define DRIVER_VERSION                          "30-Nov-2010"
+
+/* CDC NCM subclass 3.2.1 */
+#define USB_CDC_NCM_NDP16_LENGTH_MIN            0x10
+
+/* Maximum NTB length */
+#define CDC_NCM_NTB_MAX_SIZE_TX                 16384   /* bytes */
+#define CDC_NCM_NTB_MAX_SIZE_RX                 16384   /* bytes */
+
+/* Minimum value for MaxDatagramSize, ch. 6.2.9 */
+#define CDC_NCM_MIN_DATAGRAM_SIZE               1514    /* bytes */
+
+#define CDC_NCM_MIN_TX_PKT                      512     /* bytes */
+
+/* Default value for MaxDatagramSize */
+#define CDC_NCM_MAX_DATAGRAM_SIZE               2048    /* bytes */
+
+/*
+ * Maximum amount of datagrams in NCM Datagram Pointer Table, not counting
+ * the last NULL entry. Any additional datagrams in NTB would be discarded.
+ */
+#define CDC_NCM_DPT_DATAGRAMS_MAX               32
+
+/* Restart the timer, if amount of datagrams is less than given value */
+#define CDC_NCM_RESTART_TIMER_DATAGRAM_CNT      3
+
+/* The following macro defines the minimum header space */
+#define CDC_NCM_MIN_HDR_SIZE \
+        (sizeof(struct usb_cdc_ncm_nth16) + sizeof(struct usb_cdc_ncm_ndp16) + \
+        (CDC_NCM_DPT_DATAGRAMS_MAX + 1) * sizeof(struct usb_cdc_ncm_dpe16))
+
+struct connection_speed_change {
+        __le32  USBitRate; /* holds 3GPP downlink value, bits per second */
+        __le32  DSBitRate; /* holds 3GPP uplink value, bits per second */
+} __attribute__ ((packed));
+
+struct cdc_ncm_data {
+        struct usb_cdc_ncm_nth16 nth16;
+        struct usb_cdc_ncm_ndp16 ndp16;
+        struct usb_cdc_ncm_dpe16 dpe16[CDC_NCM_DPT_DATAGRAMS_MAX + 1];
+};
+
+struct cdc_ncm_ctx {
+        struct cdc_ncm_data rx_ncm;
+        struct cdc_ncm_data tx_ncm;
+        struct usb_cdc_ncm_ntb_parameters ncm_parm;
+        struct timer_list tx_timer;
+
+        const struct usb_cdc_ncm_desc *func_desc;
+        const struct usb_cdc_header_desc *header_desc;
+        const struct usb_cdc_union_desc *union_desc;
+        const struct usb_cdc_ether_desc *ether_desc;
+
+        struct net_device *netdev;
+        struct usb_device *udev;
+        struct usb_host_endpoint *in_ep;
+        struct usb_host_endpoint *out_ep;
+        struct usb_host_endpoint *status_ep;
+        struct usb_interface *intf;
+        struct usb_interface *control;
+        struct usb_interface *data;
+
+        struct sk_buff *tx_curr_skb;
+        struct sk_buff *tx_rem_skb;
+
+        spinlock_t mtx;
+
+        u32 tx_timer_pending;
+        u32 tx_curr_offset;
+        u32 tx_curr_last_offset;
+        u32 tx_curr_frame_num;
+        u32 rx_speed;
+        u32 tx_speed;
+        u32 rx_max;
+        u32 tx_max;
+        u32 max_datagram_size;
+        u16 tx_max_datagrams;
+        u16 tx_remainder;
+        u16 tx_modulus;
+        u16 tx_ndp_modulus;
+        u16 tx_seq;
+        u16 connected;
+        u8 data_claimed;
+        u8 control_claimed;
+};
+
+static void cdc_ncm_tx_timeout(unsigned long arg);
+static const struct driver_info cdc_ncm_info;
+static struct usb_driver cdc_ncm_driver;
+static struct ethtool_ops cdc_ncm_ethtool_ops;
+
+static const struct usb_device_id cdc_devs[] = {
+        { USB_INTERFACE_INFO(USB_CLASS_COMM,
+                USB_CDC_SUBCLASS_NCM, USB_CDC_PROTO_NONE),
+                .driver_info = (unsigned long)&cdc_ncm_info,
+        },
+        {
+        },
+};
+
+MODULE_DEVICE_TABLE(usb, cdc_devs);
+
+static void
+cdc_ncm_get_drvinfo(struct net_device *net, struct ethtool_drvinfo *info)
+{
+        struct usbnet *dev = netdev_priv(net);
+
+        strncpy(info->driver, dev->driver_name, sizeof(info->driver));
+        strncpy(info->version, DRIVER_VERSION, sizeof(info->version));
+        strncpy(info->fw_version, dev->driver_info->description,
+                sizeof(info->fw_version));
+        usb_make_path(dev->udev, info->bus_info, sizeof(info->bus_info));
+}
+
+static int
+cdc_ncm_do_request(struct cdc_ncm_ctx *ctx, struct usb_cdc_notification *req,
+                   void *data, u16 flags, u16 *actlen, u16 timeout)
+{
+        int err;
+
+        err = usb_control_msg(ctx->udev, (req->bmRequestType & USB_DIR_IN) ?
+                                usb_rcvctrlpipe(ctx->udev, 0) :
+                                usb_sndctrlpipe(ctx->udev, 0),
+                                req->bNotificationType, req->bmRequestType,
+                                req->wValue,
+                                req->wIndex, data,
+                                req->wLength, timeout);
+
+        if (err < 0) {
+                if (actlen)
+                        *actlen = 0;
+                return err;
+        }
+
+        if (actlen)
+                *actlen = err;
+
+        return 0;
+}
+
+static u8 cdc_ncm_setup(struct cdc_ncm_ctx *ctx)
+{
+        struct usb_cdc_notification req;
+        u32 val;
+        __le16 max_datagram_size;
+        u8 flags;
+        u8 iface_no;
+        int err;
+
+        iface_no = ctx->control->cur_altsetting->desc.bInterfaceNumber;
+
+        req.bmRequestType = USB_TYPE_CLASS | USB_DIR_IN | USB_RECIP_INTERFACE;
+        req.bNotificationType = USB_CDC_GET_NTB_PARAMETERS;
+        req.wValue = 0;
+        req.wIndex = cpu_to_le16(iface_no);
+        req.wLength = cpu_to_le16(sizeof(ctx->ncm_parm));
+
+        err = cdc_ncm_do_request(ctx, &req, &ctx->ncm_parm, 0, NULL, 1000);
+        if (err) {
+                pr_debug("failed GET_NTB_PARAMETERS\n");
+                return 1;
+        }
+
+        /* read correct set of parameters according to device mode */
+        ctx->rx_max = le32_to_cpu(ctx->ncm_parm.dwNtbInMaxSize);
+        ctx->tx_max = le32_to_cpu(ctx->ncm_parm.dwNtbOutMaxSize);
+        ctx->tx_remainder = le16_to_cpu(ctx->ncm_parm.wNdpOutPayloadRemainder);
+        ctx->tx_modulus = le16_to_cpu(ctx->ncm_parm.wNdpOutDivisor);
+        ctx->tx_ndp_modulus = le16_to_cpu(ctx->ncm_parm.wNdpOutAlignment);
+
+        if (ctx->func_desc != NULL)
+                flags = ctx->func_desc->bmNetworkCapabilities;
+        else
+                flags = 0;
+
+        pr_debug("dwNtbInMaxSize=%u dwNtbOutMaxSize=%u "
+                 "wNdpOutPayloadRemainder=%u wNdpOutDivisor=%u "
+                 "wNdpOutAlignment=%u flags=0x%x\n",
+                 ctx->rx_max, ctx->tx_max, ctx->tx_remainder, ctx->tx_modulus,
+                 ctx->tx_ndp_modulus, flags);
+
+        /* max count of tx datagrams without terminating NULL entry */
+        ctx->tx_max_datagrams = CDC_NCM_DPT_DATAGRAMS_MAX;
+
+        /* verify maximum size of received NTB in bytes */
+        if ((ctx->rx_max <
+            (CDC_NCM_MIN_HDR_SIZE + CDC_NCM_MIN_DATAGRAM_SIZE)) ||
+            (ctx->rx_max > CDC_NCM_NTB_MAX_SIZE_RX)) {
+                pr_debug("Using default maximum receive length=%d\n",
+                                                CDC_NCM_NTB_MAX_SIZE_RX);
+                ctx->rx_max = CDC_NCM_NTB_MAX_SIZE_RX;
+        }
+
+        /* verify maximum size of transmitted NTB in bytes */
+        if ((ctx->tx_max <
+            (CDC_NCM_MIN_HDR_SIZE + CDC_NCM_MIN_DATAGRAM_SIZE)) ||
+            (ctx->tx_max > CDC_NCM_NTB_MAX_SIZE_TX)) {
+                pr_debug("Using default maximum transmit length=%d\n",
+                                                CDC_NCM_NTB_MAX_SIZE_TX);
+                ctx->tx_max = CDC_NCM_NTB_MAX_SIZE_TX;
+        }
+
+        /*
+         * verify that the structure alignment is:
+         * - power of two
+         * - not greater than the maximum transmit length
+         * - not less than four bytes
+         */
+        val = ctx->tx_ndp_modulus;
+
+        if ((val < USB_CDC_NCM_NDP_ALIGN_MIN_SIZE) ||
+            (val != ((-val) & val)) || (val >= ctx->tx_max)) {
+                pr_debug("Using default alignment: 4 bytes\n");
+                ctx->tx_ndp_modulus = USB_CDC_NCM_NDP_ALIGN_MIN_SIZE;
+        }
+
+        /*
+         * verify that the payload alignment is:
+         * - power of two
+         * - not greater than the maximum transmit length
+         * - not less than four bytes
+         */
+        val = ctx->tx_modulus;
+
+        if ((val < USB_CDC_NCM_NDP_ALIGN_MIN_SIZE) ||
+            (val != ((-val) & val)) || (val >= ctx->tx_max)) {
+                pr_debug("Using default transmit modulus: 4 bytes\n");
+                ctx->tx_modulus = USB_CDC_NCM_NDP_ALIGN_MIN_SIZE;
+        }
+
+        /* verify the payload remainder */
+        if (ctx->tx_remainder >= ctx->tx_modulus) {
+                pr_debug("Using default transmit remainder: 0 bytes\n");
+                ctx->tx_remainder = 0;
+        }
+
+        /* adjust TX-remainder according to NCM specification. */
+        ctx->tx_remainder = ((ctx->tx_remainder - ETH_HLEN) &
+                                                (ctx->tx_modulus - 1));
+
+        /* additional configuration */
+
+        /* set CRC Mode */
+        req.bmRequestType = USB_TYPE_CLASS | USB_DIR_OUT | USB_RECIP_INTERFACE;
+        req.bNotificationType = USB_CDC_SET_CRC_MODE;
+        req.wValue = cpu_to_le16(USB_CDC_NCM_CRC_NOT_APPENDED);
+        req.wIndex = cpu_to_le16(iface_no);
+        req.wLength = 0;
+
+        err = cdc_ncm_do_request(ctx, &req, NULL, 0, NULL, 1000);
+        if (err)
+                pr_debug("Setting CRC mode off failed\n");
+
+        /* set NTB format */
+        req.bmRequestType = USB_TYPE_CLASS | USB_DIR_OUT | USB_RECIP_INTERFACE;
+        req.bNotificationType = USB_CDC_SET_NTB_FORMAT;
+        req.wValue = cpu_to_le16(USB_CDC_NCM_NTB16_FORMAT);
+        req.wIndex = cpu_to_le16(iface_no);
+        req.wLength = 0;
+
+        err = cdc_ncm_do_request(ctx, &req, NULL, 0, NULL, 1000);
+        if (err)
+                pr_debug("Setting NTB format to 16-bit failed\n");
+
+        /* set Max Datagram Size (MTU) */
+        req.bmRequestType = USB_TYPE_CLASS | USB_DIR_IN | USB_RECIP_INTERFACE;
+        req.bNotificationType = USB_CDC_GET_MAX_DATAGRAM_SIZE;
+        req.wValue = 0;
+        req.wIndex = cpu_to_le16(iface_no);
+        req.wLength = cpu_to_le16(2);
+
+        err = cdc_ncm_do_request(ctx, &req, &max_datagram_size, 0, NULL, 1000);
+        if (err) {
+                pr_debug(" GET_MAX_DATAGRAM_SIZE failed, using size=%u\n",
+                         CDC_NCM_MIN_DATAGRAM_SIZE);
+                /* use default */
+                ctx->max_datagram_size = CDC_NCM_MIN_DATAGRAM_SIZE;
+        } else {
+                ctx->max_datagram_size = le16_to_cpu(max_datagram_size);
+
+                if (ctx->max_datagram_size < CDC_NCM_MIN_DATAGRAM_SIZE)
+                        ctx->max_datagram_size = CDC_NCM_MIN_DATAGRAM_SIZE;
+                else if (ctx->max_datagram_size > CDC_NCM_MAX_DATAGRAM_SIZE)
+                        ctx->max_datagram_size = CDC_NCM_MAX_DATAGRAM_SIZE;
+        }
+
+        if (ctx->netdev->mtu != (ctx->max_datagram_size - ETH_HLEN))
+                ctx->netdev->mtu = ctx->max_datagram_size - ETH_HLEN;
+
+        return 0;
+}
+
+static void
+cdc_ncm_find_endpoints(struct cdc_ncm_ctx *ctx, struct usb_interface *intf)
+{
+        struct usb_host_endpoint *e;
+        u8 ep;
+
+        for (ep = 0; ep < intf->cur_altsetting->desc.bNumEndpoints; ep++) {
+
+                e = intf->cur_altsetting->endpoint + ep;
+                switch (e->desc.bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) {
+                case USB_ENDPOINT_XFER_INT:
+                        if (usb_endpoint_dir_in(&e->desc)) {
+                                if (ctx->status_ep == NULL)
+                                        ctx->status_ep = e;
+                        }
+                        break;
+
+                case USB_ENDPOINT_XFER_BULK:
+                        if (usb_endpoint_dir_in(&e->desc)) {
+                                if (ctx->in_ep == NULL)
+                                        ctx->in_ep = e;
+                        } else {
+                                if (ctx->out_ep == NULL)
+                                        ctx->out_ep = e;
+                        }
+                        break;
+
+                default:
+                        break;
+                }
+        }
+}
+
+static void cdc_ncm_free(struct cdc_ncm_ctx *ctx)
+{
+        if (ctx == NULL)
+                return;
+
+        del_timer_sync(&ctx->tx_timer);
+
+        if (ctx->data_claimed) {
+                usb_set_intfdata(ctx->data, NULL);
+                usb_driver_release_interface(driver_of(ctx->intf), ctx->data);
+        }
+
+        if (ctx->control_claimed) {
+                usb_set_intfdata(ctx->control, NULL);
+                usb_driver_release_interface(driver_of(ctx->intf),
+                                                                ctx->control);
+        }
+
+        if (ctx->tx_rem_skb != NULL) {
+                dev_kfree_skb_any(ctx->tx_rem_skb);
+                ctx->tx_rem_skb = NULL;
+        }
+
+        if (ctx->tx_curr_skb != NULL) {
+                dev_kfree_skb_any(ctx->tx_curr_skb);
+                ctx->tx_curr_skb = NULL;
+        }
+
+        kfree(ctx);
+}
+
+static int cdc_ncm_bind(struct usbnet *dev, struct usb_interface *intf)
+{
+        struct cdc_ncm_ctx *ctx;
+        struct usb_driver *driver;
+        u8 *buf;
+        int len;
+        int temp;
+        u8 iface_no;
+
+        ctx = kmalloc(sizeof(*ctx), GFP_KERNEL);
+        if (ctx == NULL)
+                goto error;
+
+        memset(ctx, 0, sizeof(*ctx));
+
+        init_timer(&ctx->tx_timer);
+        spin_lock_init(&ctx->mtx);
+        ctx->netdev = dev->net;
+
+        /* store ctx pointer in device data field */
+        dev->data[0] = (unsigned long)ctx;
+
+        /* get some pointers */
+        driver = driver_of(intf);
+        buf = intf->cur_altsetting->extra;
+        len = intf->cur_altsetting->extralen;
+
+        ctx->udev = dev->udev;
+        ctx->intf = intf;
+
+        /* parse through descriptors associated with control interface */
+        while ((len > 0) && (buf[0] > 2) && (buf[0] <= len)) {
+
+                if (buf[1] != USB_DT_CS_INTERFACE)
+                        goto advance;
+
+                switch (buf[2]) {
+                case USB_CDC_UNION_TYPE:
+                        if (buf[0] < sizeof(*(ctx->union_desc)))
+                                break;
+
+                        ctx->union_desc =
+                                        (const struct usb_cdc_union_desc *)buf;
+
+                        ctx->control = usb_ifnum_to_if(dev->udev,
+                                        ctx->union_desc->bMasterInterface0);
+                        ctx->data = usb_ifnum_to_if(dev->udev,
+                                        ctx->union_desc->bSlaveInterface0);
+                        break;
+
+                case USB_CDC_ETHERNET_TYPE:
+                        if (buf[0] < sizeof(*(ctx->ether_desc)))
+                                break;
+
+                        ctx->ether_desc =
+                                        (const struct usb_cdc_ether_desc *)buf;
+
+                        dev->hard_mtu =
+                                le16_to_cpu(ctx->ether_desc->wMaxSegmentSize);
+
+                        if (dev->hard_mtu <
+                            (CDC_NCM_MIN_DATAGRAM_SIZE - ETH_HLEN))
+                                dev->hard_mtu =
+                                        CDC_NCM_MIN_DATAGRAM_SIZE - ETH_HLEN;
+
+                        else if (dev->hard_mtu >
+                                 (CDC_NCM_MAX_DATAGRAM_SIZE - ETH_HLEN))
+                                dev->hard_mtu =
+                                        CDC_NCM_MAX_DATAGRAM_SIZE - ETH_HLEN;
+                        break;
+
+                case USB_CDC_NCM_TYPE:
+                        if (buf[0] < sizeof(*(ctx->func_desc)))
+                                break;
+
+                        ctx->func_desc = (const struct usb_cdc_ncm_desc *)buf;
+                        break;
+
+                default:
+                        break;
+                }
+advance:
+                /* advance to next descriptor */
+                temp = buf[0];
+                buf += temp;
+                len -= temp;
+        }
+
+        /* check if we got everything */
+        if ((ctx->control == NULL) || (ctx->data == NULL) ||
+            (ctx->ether_desc == NULL))
+                goto error;
+
+        /* claim interfaces, if any */
+        if (ctx->data != intf) {
+                temp = usb_driver_claim_interface(driver, ctx->data, dev);
+                if (temp)
+                        goto error;
+                ctx->data_claimed = 1;
+        }
+
+        if (ctx->control != intf) {
+                temp = usb_driver_claim_interface(driver, ctx->control, dev);
+                if (temp)
+                        goto error;
+                ctx->control_claimed = 1;
+        }
+
+        iface_no = ctx->data->cur_altsetting->desc.bInterfaceNumber;
+
+        /* reset data interface */
+        temp = usb_set_interface(dev->udev, iface_no, 0);
+        if (temp)
+                goto error;
+
+        /* initialize data interface */
+        if (cdc_ncm_setup(ctx))
+                goto error;
+
+        /* configure data interface */
+        temp = usb_set_interface(dev->udev, iface_no, 1);
+        if (temp)
+                goto error;
+
+        cdc_ncm_find_endpoints(ctx, ctx->data);
+        cdc_ncm_find_endpoints(ctx, ctx->control);
+
+        if ((ctx->in_ep == NULL) || (ctx->out_ep == NULL) ||
+            (ctx->status_ep == NULL))
+                goto error;
+
+        dev->net->ethtool_ops = &cdc_ncm_ethtool_ops;
+
+        usb_set_intfdata(ctx->data, dev);
+        usb_set_intfdata(ctx->control, dev);
+        usb_set_intfdata(ctx->intf, dev);
+
+        temp = usbnet_get_ethernet_addr(dev, ctx->ether_desc->iMACAddress);
+        if (temp)
+                goto error;
+
+        dev_info(&dev->udev->dev, "MAC-Address: "
+                                "0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x\n",
+                                dev->net->dev_addr[0], dev->net->dev_addr[1],
+                                dev->net->dev_addr[2], dev->net->dev_addr[3],
+                                dev->net->dev_addr[4], dev->net->dev_addr[5]);
+
+        dev->in = usb_rcvbulkpipe(dev->udev,
+                ctx->in_ep->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
+        dev->out = usb_sndbulkpipe(dev->udev,
+                ctx->out_ep->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
+        dev->status = ctx->status_ep;
+        dev->rx_urb_size = ctx->rx_max;
+
+        /*
+         * We should get an event when network connection is "connected" or
+         * "disconnected". Set network connection in "disconnected" state
+         * (carrier is OFF) during attach, so the IP network stack does not
+         * start IPv6 negotiation and more.
+         */
+        netif_carrier_off(dev->net);
+        ctx->tx_speed = ctx->rx_speed = 0;
+        return 0;
+
+error:
+        cdc_ncm_free((struct cdc_ncm_ctx *)dev->data[0]);
+        dev->data[0] = 0;
+        dev_info(&dev->udev->dev, "Descriptor failure\n");
+        return -ENODEV;
+}
+
+static void cdc_ncm_unbind(struct usbnet *dev, struct usb_interface *intf)
+{
+        struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
+        struct usb_driver *driver;
+
+        if (ctx == NULL)
+                return;         /* no setup */
+
+        driver = driver_of(intf);
+
+        usb_set_intfdata(ctx->data, NULL);
+        usb_set_intfdata(ctx->control, NULL);
+        usb_set_intfdata(ctx->intf, NULL);
+
+        /* release interfaces, if any */
+        if (ctx->data_claimed) {
+                usb_driver_release_interface(driver, ctx->data);
+                ctx->data_claimed = 0;
+        }
+
+        if (ctx->control_claimed) {
+                usb_driver_release_interface(driver, ctx->control);
+                ctx->control_claimed = 0;
+        }
+
+        cdc_ncm_free(ctx);
+}
+
+static void cdc_ncm_zero_fill(u8 *ptr, u32 first, u32 end, u32 max)
+{
+        if (first >= max)
+                return;
+        if (first >= end)
+                return;
+        if (end > max)
+                end = max;
+        memset(ptr + first, 0, end - first);
+}
+
+static struct sk_buff *
+cdc_ncm_fill_tx_frame(struct cdc_ncm_ctx *ctx, struct sk_buff *skb)
+{
+        struct sk_buff *skb_out;
+        u32 rem;
+        u32 offset;
+        u32 last_offset;
+        u16 n = 0;
+        u8 timeout = 0;
+
+        /* if there is a remaining skb, it gets priority */
+        if (skb != NULL)
+                swap(skb, ctx->tx_rem_skb);
+        else
+                timeout = 1;
+
+        /*
+         * +----------------+
+         * | skb_out        |
+         * +----------------+
+         *           ^ offset
+         *        ^ last_offset
+         */
+
+        /* check if we are resuming an OUT skb */
+        if (ctx->tx_curr_skb != NULL) {
+                /* pop variables */
+                skb_out = ctx->tx_curr_skb;
+                offset = ctx->tx_curr_offset;
+                last_offset = ctx->tx_curr_last_offset;
+                n = ctx->tx_curr_frame_num;
+
+        } else {
+                /* reset variables */
+                skb_out = alloc_skb(ctx->tx_max, GFP_ATOMIC);
+                if (skb_out == NULL) {
+                        if (skb != NULL) {
+                                dev_kfree_skb_any(skb);
+                                ctx->netdev->stats.tx_dropped++;
+                        }
+                        goto exit_no_skb;
+                }
+
+                /* make room for NTH and NDP */
+                offset = ALIGN(sizeof(struct usb_cdc_ncm_nth16),
+                                        ctx->tx_ndp_modulus) +
+                                        sizeof(struct usb_cdc_ncm_ndp16) +
+                                        (ctx->tx_max_datagrams + 1) *
+                                        sizeof(struct usb_cdc_ncm_dpe16);
+
+                /* store last valid offset before alignment */
+                last_offset = offset;
+                /* align first Datagram offset correctly */
+                offset = ALIGN(offset, ctx->tx_modulus) + ctx->tx_remainder;
+                /* zero buffer till the first IP datagram */
+                cdc_ncm_zero_fill(skb_out->data, 0, offset, offset);
+                n = 0;
+                ctx->tx_curr_frame_num = 0;
+        }
+
+        for (; n < ctx->tx_max_datagrams; n++) {
+                /* check if end of transmit buffer is reached */
+                if (offset >= ctx->tx_max)
+                        break;
+
+                /* compute maximum buffer size */
+                rem = ctx->tx_max - offset;
+
+                if (skb == NULL) {
+                        skb = ctx->tx_rem_skb;
+                        ctx->tx_rem_skb = NULL;
+
+                        /* check for end of skb */
+                        if (skb == NULL)
+                                break;
+                }
+
+                if (skb->len > rem) {
+                        if (n == 0) {
+                                /* won't fit, MTU problem? */
+                                dev_kfree_skb_any(skb);
+                                skb = NULL;
+                                ctx->netdev->stats.tx_dropped++;
+                        } else {
+                                /* no room for skb - store for later */
+                                if (ctx->tx_rem_skb != NULL) {
+                                        dev_kfree_skb_any(ctx->tx_rem_skb);
+                                        ctx->netdev->stats.tx_dropped++;
+                                }
+                                ctx->tx_rem_skb = skb;
+                                skb = NULL;
+
+                                /* loop one more time */
+                                timeout = 1;
+                        }
+                        break;
+                }
+
+                memcpy(((u8 *)skb_out->data) + offset, skb->data, skb->len);
+
+                ctx->tx_ncm.dpe16[n].wDatagramLength = cpu_to_le16(skb->len);
+                ctx->tx_ncm.dpe16[n].wDatagramIndex = cpu_to_le16(offset);
+
+                /* update offset */
+                offset += skb->len;
+
+                /* store last valid offset before alignment */
+                last_offset = offset;
+
+                /* align offset correctly */
+                offset = ALIGN(offset, ctx->tx_modulus) + ctx->tx_remainder;
+
+                /* zero padding */
+                cdc_ncm_zero_fill(skb_out->data, last_offset, offset,
+                                                                ctx->tx_max);
+                dev_kfree_skb_any(skb);
+                skb = NULL;
+        }
+
+        /* free up any dangling skb */
+        if (skb != NULL) {
+                dev_kfree_skb_any(skb);
+                skb = NULL;
+                ctx->netdev->stats.tx_dropped++;
+        }
+
+        ctx->tx_curr_frame_num = n;
+
+        if (n == 0) {
+                /* wait for more frames */
+                /* push variables */
+                ctx->tx_curr_skb = skb_out;
+                ctx->tx_curr_offset = offset;
+                ctx->tx_curr_last_offset = last_offset;
+                goto exit_no_skb;
+
+        } else if ((n < ctx->tx_max_datagrams) && (timeout == 0)) {
+                /* wait for more frames */
+                /* push variables */
+                ctx->tx_curr_skb = skb_out;
+                ctx->tx_curr_offset = offset;
+                ctx->tx_curr_last_offset = last_offset;
+                /* set the pending count */
+                if (n < CDC_NCM_RESTART_TIMER_DATAGRAM_CNT)
+                        ctx->tx_timer_pending = 2;
+                goto exit_no_skb;
+
+        } else {
+                /* frame goes out */
+                /* variables will be reset at next call */
+        }
+
+        /* check for overflow */
+        if (last_offset > ctx->tx_max)
+                last_offset = ctx->tx_max;
+
+        /* revert offset */
+        offset = last_offset;
+
+        /*
+         * If collected data size is less or equal CDC_NCM_MIN_TX_PKT bytes,
+         * we send buffers as it is. If we get more data, it would be more
+         * efficient for USB HS mobile device with DMA engine to receive a full
+         * size NTB, than canceling DMA transfer and receiving a short packet.
+         */
+        if (offset > CDC_NCM_MIN_TX_PKT)
+                offset = ctx->tx_max;
+
+        /* final zero padding */
+        cdc_ncm_zero_fill(skb_out->data, last_offset, offset, ctx->tx_max);
+
+        /* store last offset */
+        last_offset = offset;
+
+        if ((last_offset < ctx->tx_max) && ((last_offset %
+                        le16_to_cpu(ctx->out_ep->desc.wMaxPacketSize)) == 0)) {
+                /* force short packet */
+                *(((u8 *)skb_out->data) + last_offset) = 0;
+                last_offset++;
+        }
+
+        /* zero the rest of the DPEs plus the last NULL entry */
+        for (; n <= CDC_NCM_DPT_DATAGRAMS_MAX; n++) {
+                ctx->tx_ncm.dpe16[n].wDatagramLength = 0;
+                ctx->tx_ncm.dpe16[n].wDatagramIndex = 0;
+        }
+
+        /* fill out 16-bit NTB header */
+        ctx->tx_ncm.nth16.dwSignature = cpu_to_le32(USB_CDC_NCM_NTH16_SIGN);
+        ctx->tx_ncm.nth16.wHeaderLength =
+                                        cpu_to_le16(sizeof(ctx->tx_ncm.nth16));
+        ctx->tx_ncm.nth16.wSequence = cpu_to_le16(ctx->tx_seq);
+        ctx->tx_ncm.nth16.wBlockLength = cpu_to_le16(last_offset);
+        ctx->tx_ncm.nth16.wFpIndex = ALIGN(sizeof(struct usb_cdc_ncm_nth16),
+                                                        ctx->tx_ndp_modulus);
+
+        memcpy(skb_out->data, &(ctx->tx_ncm.nth16), sizeof(ctx->tx_ncm.nth16));
+        ctx->tx_seq++;
+
+        /* fill out 16-bit NDP table */
+        ctx->tx_ncm.ndp16.dwSignature =
+                                cpu_to_le32(USB_CDC_NCM_NDP16_NOCRC_SIGN);
+        rem = sizeof(ctx->tx_ncm.ndp16) + ((ctx->tx_curr_frame_num + 1) *
+                                        sizeof(struct usb_cdc_ncm_dpe16));
+        ctx->tx_ncm.ndp16.wLength = cpu_to_le16(rem);
+        ctx->tx_ncm.ndp16.wNextFpIndex = 0; /* reserved */
+
+        memcpy(((u8 *)skb_out->data) + ctx->tx_ncm.nth16.wFpIndex,
+                                                &(ctx->tx_ncm.ndp16),
+                                                sizeof(ctx->tx_ncm.ndp16));
+
+        memcpy(((u8 *)skb_out->data) + ctx->tx_ncm.nth16.wFpIndex +
+                                        sizeof(ctx->tx_ncm.ndp16),
+                                        &(ctx->tx_ncm.dpe16),
+                                        (ctx->tx_curr_frame_num + 1) *
+                                        sizeof(struct usb_cdc_ncm_dpe16));
+
+        /* set frame length */
+        skb_put(skb_out, last_offset);
+
+        /* return skb */
+        ctx->tx_curr_skb = NULL;
+        return skb_out;
+
+exit_no_skb:
+        return NULL;
+}
+
+static void cdc_ncm_tx_timeout_start(struct cdc_ncm_ctx *ctx)
+{
+        /* start timer, if not already started */
+        if (timer_pending(&ctx->tx_timer) == 0) {
+                ctx->tx_timer.function = &cdc_ncm_tx_timeout;
+                ctx->tx_timer.data = (unsigned long)ctx;
+                ctx->tx_timer.expires = jiffies + ((HZ + 999) / 1000);
+                add_timer(&ctx->tx_timer);
+        }
+}
+
+static void cdc_ncm_tx_timeout(unsigned long arg)
+{
+        struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)arg;
+        u8 restart;
+
+        spin_lock(&ctx->mtx);
+        if (ctx->tx_timer_pending != 0) {
+                ctx->tx_timer_pending--;
+                restart = 1;
+        } else
+                restart = 0;
+
+        spin_unlock(&ctx->mtx);
+
+        if (restart)
+                cdc_ncm_tx_timeout_start(ctx);
+        else if (ctx->netdev != NULL)
+                usbnet_start_xmit(NULL, ctx->netdev);
+}
+
+static struct sk_buff *
+cdc_ncm_tx_fixup(struct usbnet *dev, struct sk_buff *skb, gfp_t flags)
+{
+        struct sk_buff *skb_out;
+        struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
+        u8 need_timer = 0;
+
+        /*
+         * The Ethernet API we are using does not support transmitting
+         * multiple Ethernet frames in a single call. This driver will
+         * accumulate multiple Ethernet frames and send out a larger
+         * USB frame when the USB buffer is full or when a single jiffies
+         * timeout happens.
+         */
+        if (ctx == NULL)
+                goto error;
+
+        spin_lock(&ctx->mtx);
+        skb_out = cdc_ncm_fill_tx_frame(ctx, skb);
+        if (ctx->tx_curr_skb != NULL)
+                need_timer = 1;
+        spin_unlock(&ctx->mtx);
+
+        /* Start timer, if there is a remaining skb */
+        if (need_timer)
+                cdc_ncm_tx_timeout_start(ctx);
+
+        if (skb_out)
+                dev->net->stats.tx_packets += ctx->tx_curr_frame_num;
+        return skb_out;
+
+error:
+        if (skb != NULL)
+                dev_kfree_skb_any(skb);
+
+        return NULL;
+}
+
+static int cdc_ncm_rx_fixup(struct usbnet *dev, struct sk_buff *skb_in)
+{
+        struct sk_buff *skb;
+        struct cdc_ncm_ctx *ctx;
+        int sumlen;
+        int actlen;
+        int temp;
+        int nframes;
+        int x;
+        int offset;
+
+        ctx = (struct cdc_ncm_ctx *)dev->data[0];
+        if (ctx == NULL)
+                goto error;
+
+        actlen = skb_in->len;
+        sumlen = CDC_NCM_NTB_MAX_SIZE_RX;
+
+        if (actlen < (sizeof(ctx->rx_ncm.nth16) + sizeof(ctx->rx_ncm.ndp16))) {
+                pr_debug("frame too short\n");
+                goto error;
+        }
+
+        memcpy(&(ctx->rx_ncm.nth16), ((u8 *)skb_in->data),
+                                                sizeof(ctx->rx_ncm.nth16));
+
+        if (le32_to_cpu(ctx->rx_ncm.nth16.dwSignature) !=
+            USB_CDC_NCM_NTH16_SIGN) {
+                pr_debug("invalid NTH16 signature <%u>\n",
+                         le32_to_cpu(ctx->rx_ncm.nth16.dwSignature));
+                goto error;
+        }
+
+        temp = le16_to_cpu(ctx->rx_ncm.nth16.wBlockLength);
+        if (temp > sumlen) {
+                pr_debug("unsupported NTB block length %u/%u\n", temp, sumlen);
+                goto error;
+        }
+
+        temp = le16_to_cpu(ctx->rx_ncm.nth16.wFpIndex);
+        if ((temp + sizeof(ctx->rx_ncm.ndp16)) > actlen) {
+                pr_debug("invalid DPT16 index\n");
+                goto error;
+        }
+
+        memcpy(&(ctx->rx_ncm.ndp16), ((u8 *)skb_in->data) + temp,
+                                                sizeof(ctx->rx_ncm.ndp16));
+
+        if (le32_to_cpu(ctx->rx_ncm.ndp16.dwSignature) !=
+            USB_CDC_NCM_NDP16_NOCRC_SIGN) {
+                pr_debug("invalid DPT16 signature <%u>\n",
+                         le32_to_cpu(ctx->rx_ncm.ndp16.dwSignature));
+                goto error;
+        }
+
+        if (le16_to_cpu(ctx->rx_ncm.ndp16.wLength) <
+            USB_CDC_NCM_NDP16_LENGTH_MIN) {
+                pr_debug("invalid DPT16 length <%u>\n",
+                         le32_to_cpu(ctx->rx_ncm.ndp16.dwSignature));
+                goto error;
+        }
+
+        nframes = ((le16_to_cpu(ctx->rx_ncm.ndp16.wLength) -
+                                        sizeof(struct usb_cdc_ncm_ndp16)) /
+                                        sizeof(struct usb_cdc_ncm_dpe16));
+        nframes--; /* we process NDP entries except for the last one */
+
+        pr_debug("nframes = %u\n", nframes);
+
+        temp += sizeof(ctx->rx_ncm.ndp16);
+
+        if ((temp + nframes * (sizeof(struct usb_cdc_ncm_dpe16))) > actlen) {
+                pr_debug("Invalid nframes = %d\n", nframes);
+                goto error;
+        }
+
+        if (nframes > CDC_NCM_DPT_DATAGRAMS_MAX) {
+                pr_debug("Truncating number of frames from %u to %u\n",
+                                        nframes, CDC_NCM_DPT_DATAGRAMS_MAX);
+                nframes = CDC_NCM_DPT_DATAGRAMS_MAX;
+        }
+
+        memcpy(&(ctx->rx_ncm.dpe16), ((u8 *)skb_in->data) + temp,
+                                nframes * (sizeof(struct usb_cdc_ncm_dpe16)));
+
+        for (x = 0; x < nframes; x++) {
+                offset = le16_to_cpu(ctx->rx_ncm.dpe16[x].wDatagramIndex);
+                temp = le16_to_cpu(ctx->rx_ncm.dpe16[x].wDatagramLength);
+
+                /*
+                 * CDC NCM ch. 3.7
+                 * All entries after first NULL entry are to be ignored
+                 */
+                if ((offset == 0) || (temp == 0)) {
+                        if (!x)
+                                goto error; /* empty NTB */
+                        break;
+                }
+
+                /* sanity checking */
+                if (((offset + temp) > actlen) ||
+                    (temp > CDC_NCM_MAX_DATAGRAM_SIZE) || (temp < ETH_HLEN)) {
+                        pr_debug("invalid frame detected (ignored)"
+                                "offset[%u]=%u, length=%u, skb=%p\n",
+                                                        x, offset, temp, skb);
+                        if (!x)
+                                goto error;
+                        break;
+
+                } else {
+                        skb = skb_clone(skb_in, GFP_ATOMIC);
+                        skb->len = temp;
+                        skb->data = ((u8 *)skb_in->data) + offset;
+                        skb_set_tail_pointer(skb, temp);
+                        usbnet_skb_return(dev, skb);
+                }
+        }
+        return 1;
+error:
+        return 0;
+}
+
+static void
+cdc_ncm_speed_change(struct cdc_ncm_ctx *ctx,
+                     struct connection_speed_change *data)
+{
+        uint32_t rx_speed = le32_to_cpu(data->USBitRate);
+        uint32_t tx_speed = le32_to_cpu(data->DSBitRate);
+
+        /*
+         * Currently the USB-NET API does not support reporting the actual
+         * device speed. Do print it instead.
+         */
+        if ((tx_speed != ctx->tx_speed) || (rx_speed != ctx->rx_speed)) {
+                ctx->tx_speed = tx_speed;
+                ctx->rx_speed = rx_speed;
+
+                if ((tx_speed > 1000000) && (rx_speed > 1000000)) {
+                        printk(KERN_INFO KBUILD_MODNAME
+                                ": %s: %u mbit/s downlink "
+                                "%u mbit/s uplink\n",
+                                ctx->netdev->name,
+                                (unsigned int)(rx_speed / 1000000U),
+                                (unsigned int)(tx_speed / 1000000U));
+                } else {
+                        printk(KERN_INFO KBUILD_MODNAME
+                                ": %s: %u kbit/s downlink "
+                                "%u kbit/s uplink\n",
+                                ctx->netdev->name,
+                                (unsigned int)(rx_speed / 1000U),
+                                (unsigned int)(tx_speed / 1000U));
+                }
+        }
+}
+
+static void cdc_ncm_status(struct usbnet *dev, struct urb *urb)
+{
+        struct cdc_ncm_ctx *ctx;
+        struct usb_cdc_notification *event;
+
+        ctx = (struct cdc_ncm_ctx *)dev->data[0];
+
+        if (urb->actual_length < sizeof(*event))
+                return;
+
+        /* test for split data in 8-byte chunks */
+        if (test_and_clear_bit(EVENT_STS_SPLIT, &dev->flags)) {
+                cdc_ncm_speed_change(ctx,
+                      (struct connection_speed_change *)urb->transfer_buffer);
+                return;
+        }
+
+        event = urb->transfer_buffer;
+
+        switch (event->bNotificationType) {
+        case USB_CDC_NOTIFY_NETWORK_CONNECTION:
+                /*
+                 * According to the CDC NCM specification ch.7.1
+                 * USB_CDC_NOTIFY_NETWORK_CONNECTION notification shall be
+                 * sent by device after USB_CDC_NOTIFY_SPEED_CHANGE.
+                 */
+                ctx->connected = event->wValue;
+
+                printk(KERN_INFO KBUILD_MODNAME ": %s: network connection:"
+                        " %sconnected\n",
+                        ctx->netdev->name, ctx->connected ? "" : "dis");
+
+                if (ctx->connected)
+                        netif_carrier_on(dev->net);
+                else {
+                        netif_carrier_off(dev->net);
+                        ctx->tx_speed = ctx->rx_speed = 0;
+                }
+                break;
+
+        case USB_CDC_NOTIFY_SPEED_CHANGE:
+                if (urb->actual_length <
+                    (sizeof(*event) + sizeof(struct connection_speed_change)))
+                        set_bit(EVENT_STS_SPLIT, &dev->flags);
+                else
+                        cdc_ncm_speed_change(ctx,
+                                (struct connection_speed_change *) &event[1]);
+                break;
+
+        default:
+                dev_err(&dev->udev->dev, "NCM: unexpected "
+                        "notification 0x%02x!\n", event->bNotificationType);
+                break;
+        }
+}
+
+static int cdc_ncm_check_connect(struct usbnet *dev)
+{
+        struct cdc_ncm_ctx *ctx;
+
+        ctx = (struct cdc_ncm_ctx *)dev->data[0];
+        if (ctx == NULL)
+                return 1;       /* disconnected */
+
+        return !ctx->connected;
+}
+
+static int
+cdc_ncm_probe(struct usb_interface *udev, const struct usb_device_id *prod)
+{
+        return usbnet_probe(udev, prod);
+}
+
+static void cdc_ncm_disconnect(struct usb_interface *intf)
+{
+        struct usbnet *dev = usb_get_intfdata(intf);
+
+        if (dev == NULL)
+                return;         /* already disconnected */
+
+        usbnet_disconnect(intf);
+}
+
+static int cdc_ncm_manage_power(struct usbnet *dev, int status)
+{
+        dev->intf->needs_remote_wakeup = status;
+        return 0;
+}
+
+static const struct driver_info cdc_ncm_info = {
+        .description = "CDC NCM",
+        .flags = FLAG_NO_SETINT | FLAG_MULTI_PACKET,
+        .bind = cdc_ncm_bind,
+        .unbind = cdc_ncm_unbind,
+        .check_connect = cdc_ncm_check_connect,
+        .manage_power = cdc_ncm_manage_power,
+        .status = cdc_ncm_status,
+        .rx_fixup = cdc_ncm_rx_fixup,
+        .tx_fixup = cdc_ncm_tx_fixup,
+};
+
+static struct usb_driver cdc_ncm_driver = {
+        .name = "cdc_ncm",
+        .id_table = cdc_devs,
+        .probe = cdc_ncm_probe,
+        .disconnect = cdc_ncm_disconnect,
+        .suspend = usbnet_suspend,
+        .resume = usbnet_resume,
+        .supports_autosuspend = 1,
+};
+
+static struct ethtool_ops cdc_ncm_ethtool_ops = {
+        .get_drvinfo = cdc_ncm_get_drvinfo,
+        .get_link = usbnet_get_link,
+        .get_msglevel = usbnet_get_msglevel,
+        .set_msglevel = usbnet_set_msglevel,
+        .get_settings = usbnet_get_settings,
+        .set_settings = usbnet_set_settings,
+        .nway_reset = usbnet_nway_reset,
+};
+
+static int __init cdc_ncm_init(void)
+{
+        printk(KERN_INFO KBUILD_MODNAME ": " DRIVER_VERSION "\n");
+        return usb_register(&cdc_ncm_driver);
+}
+
+module_init(cdc_ncm_init);
+
+static void __exit cdc_ncm_exit(void)
+{
+        usb_deregister(&cdc_ncm_driver);
+}
+
+module_exit(cdc_ncm_exit);
+
+MODULE_AUTHOR("Hans Petter Selasky");
+MODULE_DESCRIPTION("USB CDC NCM host driver");
+MODULE_LICENSE("Dual BSD/GPL");
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index 62e9e8dc819..93c6b5f62ac 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -1745,7 +1745,6 @@ static int hso_serial_ioctl(struct tty_struct *tty, struct file *file,
                             unsigned int cmd, unsigned long arg)
 {
         struct hso_serial *serial =  get_serial_by_tty(tty);
-        void __user *uarg = (void __user *)arg;
         int ret = 0;
         D4("IOCTL cmd: %d, arg: %ld", cmd, arg);
 
diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
index b2bcf99e6f0..7d42f9a2c06 100644
--- a/drivers/net/usb/ipheth.c
+++ b/drivers/net/usb/ipheth.c
@@ -363,7 +363,7 @@ static int ipheth_tx(struct sk_buff *skb, struct net_device *net)
 
         /* Paranoid */
         if (skb->len > IPHETH_BUF_SIZE) {
-                WARN(1, "%s: skb too large: %d bytes", __func__, skb->len);
+                WARN(1, "%s: skb too large: %d bytes\n", __func__, skb->len);
                 dev->net->stats.tx_dropped++;
                 dev_kfree_skb_irq(skb);
                 return NETDEV_TX_OK;
diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c
index 6710f09346d..ef3667690b1 100644
--- a/drivers/net/usb/pegasus.c
+++ b/drivers/net/usb/pegasus.c
@@ -359,7 +359,7 @@ fail:
 
 static int mdio_read(struct net_device *dev, int phy_id, int loc)
 {
-        pegasus_t *pegasus = (pegasus_t *) netdev_priv(dev);
+        pegasus_t *pegasus = netdev_priv(dev);
         u16 res;
 
         read_mii_word(pegasus, phy_id, loc, &res);
@@ -397,7 +397,7 @@ fail:
 
 static void mdio_write(struct net_device *dev, int phy_id, int loc, int val)
 {
-        pegasus_t *pegasus = (pegasus_t *) netdev_priv(dev);
+        pegasus_t *pegasus = netdev_priv(dev);
 
         write_mii_word(pegasus, phy_id, loc, val);
 }
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index c04d49e31f8..cff74b81a7d 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -391,14 +391,19 @@ static inline void rx_process (struct usbnet *dev, struct sk_buff *skb)
                 goto error;
         // else network stack removes extra byte if we forced a short packet
 
-        if (skb->len)
-                usbnet_skb_return (dev, skb);
-        else {
-                netif_dbg(dev, rx_err, dev->net, "drop\n");
-error:
-                dev->net->stats.rx_errors++;
-                skb_queue_tail (&dev->done, skb);
+        if (skb->len) {
+                /* all data was already cloned from skb inside the driver */
+                if (dev->driver_info->flags & FLAG_MULTI_PACKET)
+                        dev_kfree_skb_any(skb);
+                else
+                        usbnet_skb_return(dev, skb);
+                return;
         }
+
+        netif_dbg(dev, rx_err, dev->net, "drop\n");
+error:
+        dev->net->stats.rx_errors++;
+        skb_queue_tail(&dev->done, skb);
 }
 
 /*-------------------------------------------------------------------------*/
@@ -971,7 +976,8 @@ static void tx_complete (struct urb *urb)
         struct usbnet           *dev = entry->dev;
 
         if (urb->status == 0) {
-                dev->net->stats.tx_packets++;
+                if (!(dev->driver_info->flags & FLAG_MULTI_PACKET))
+                        dev->net->stats.tx_packets++;
                 dev->net->stats.tx_bytes += entry->length;
         } else {
                 dev->net->stats.tx_errors++;
@@ -1044,8 +1050,13 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb,
         if (info->tx_fixup) {
                 skb = info->tx_fixup (dev, skb, GFP_ATOMIC);
                 if (!skb) {
-                        netif_dbg(dev, tx_err, dev->net, "can't tx_fixup skb\n");
-                        goto drop;
+                        if (netif_msg_tx_err(dev)) {
+                                netif_dbg(dev, tx_err, dev->net, "can't tx_fixup skb\n");
+                                goto drop;
+                        } else {
+                                /* cdc_ncm collected packet; waits for more */
+                                goto not_drop;
+                        }
                 }
         }
         length = skb->len;
@@ -1067,13 +1078,18 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb,
         /* don't assume the hardware handles USB_ZERO_PACKET
          * NOTE:  strictly conforming cdc-ether devices should expect
          * the ZLP here, but ignore the one-byte packet.
+         * NOTE2: CDC NCM specification is different from CDC ECM when
+         * handling ZLP/short packets, so cdc_ncm driver will make short
+         * packet itself if needed.
          */
         if (length % dev->maxpacket == 0) {
                 if (!(info->flags & FLAG_SEND_ZLP)) {
-                        urb->transfer_buffer_length++;
-                        if (skb_tailroom(skb)) {
-                                skb->data[skb->len] = 0;
-                                __skb_put(skb, 1);
+                        if (!(info->flags & FLAG_MULTI_PACKET)) {
+                                urb->transfer_buffer_length++;
+                                if (skb_tailroom(skb)) {
+                                        skb->data[skb->len] = 0;
+                                        __skb_put(skb, 1);
+                                }
                         }
                 } else
                         urb->transfer_flags |= URB_ZERO_PACKET;
@@ -1122,6 +1138,7 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb,
                 netif_dbg(dev, tx_err, dev->net, "drop, code %d\n", retval);
 drop:
                 dev->net->stats.tx_dropped++;
+not_drop:
                 if (skb)
                         dev_kfree_skb_any (skb);
                 usb_free_urb (urb);
diff --git a/drivers/net/via-rhine.c b/drivers/net/via-rhine.c
index 4930f9dbc49..5e7f069eab5 100644
--- a/drivers/net/via-rhine.c
+++ b/drivers/net/via-rhine.c
@@ -30,8 +30,8 @@
 */
 
 #define DRV_NAME        "via-rhine"
-#define DRV_VERSION     "1.4.3"
-#define DRV_RELDATE     "2007-03-06"
+#define DRV_VERSION     "1.5.0"
+#define DRV_RELDATE     "2010-10-09"
 
 
 /* A few user-configurable values.
@@ -100,6 +100,7 @@ static const int multicast_filter_limit = 32;
 #include <linux/mii.h>
 #include <linux/ethtool.h>
 #include <linux/crc32.h>
+#include <linux/if_vlan.h>
 #include <linux/bitops.h>
 #include <linux/workqueue.h>
 #include <asm/processor.h>      /* Processor type for cache alignment. */
@@ -133,6 +134,9 @@ MODULE_PARM_DESC(debug, "VIA Rhine debug level (0-7)");
 MODULE_PARM_DESC(rx_copybreak, "VIA Rhine copy breakpoint for copy-only-tiny-frames");
 MODULE_PARM_DESC(avoid_D3, "Avoid power state D3 (work-around for broken BIOSes)");
 
+#define MCAM_SIZE       32
+#define VCAM_SIZE       32
+
 /*
                 Theory of Operation
 
@@ -279,15 +283,16 @@ MODULE_DEVICE_TABLE(pci, rhine_pci_tbl);
 /* Offsets to the device registers. */
 enum register_offsets {
         StationAddr=0x00, RxConfig=0x06, TxConfig=0x07, ChipCmd=0x08,
-        ChipCmd1=0x09,
+        ChipCmd1=0x09, TQWake=0x0A,
         IntrStatus=0x0C, IntrEnable=0x0E,
         MulticastFilter0=0x10, MulticastFilter1=0x14,
         RxRingPtr=0x18, TxRingPtr=0x1C, GFIFOTest=0x54,
-        MIIPhyAddr=0x6C, MIIStatus=0x6D, PCIBusConfig=0x6E,
+        MIIPhyAddr=0x6C, MIIStatus=0x6D, PCIBusConfig=0x6E, PCIBusConfig1=0x6F,
         MIICmd=0x70, MIIRegAddr=0x71, MIIData=0x72, MACRegEEcsr=0x74,
         ConfigA=0x78, ConfigB=0x79, ConfigC=0x7A, ConfigD=0x7B,
         RxMissed=0x7C, RxCRCErrs=0x7E, MiscCmd=0x81,
         StickyHW=0x83, IntrStatus2=0x84,
+        CamMask=0x88, CamCon=0x92, CamAddr=0x93,
         WOLcrSet=0xA0, PwcfgSet=0xA1, WOLcgSet=0xA3, WOLcrClr=0xA4,
         WOLcrClr1=0xA6, WOLcgClr=0xA7,
         PwrcsrSet=0xA8, PwrcsrSet1=0xA9, PwrcsrClr=0xAC, PwrcsrClr1=0xAD,
@@ -299,6 +304,40 @@ enum backoff_bits {
         BackCaptureEffect=0x04, BackRandom=0x08
 };
 
+/* Bits in the TxConfig (TCR) register */
+enum tcr_bits {
+        TCR_PQEN=0x01,
+        TCR_LB0=0x02,           /* loopback[0] */
+        TCR_LB1=0x04,           /* loopback[1] */
+        TCR_OFSET=0x08,
+        TCR_RTGOPT=0x10,
+        TCR_RTFT0=0x20,
+        TCR_RTFT1=0x40,
+        TCR_RTSF=0x80,
+};
+
+/* Bits in the CamCon (CAMC) register */
+enum camcon_bits {
+        CAMC_CAMEN=0x01,
+        CAMC_VCAMSL=0x02,
+        CAMC_CAMWR=0x04,
+        CAMC_CAMRD=0x08,
+};
+
+/* Bits in the PCIBusConfig1 (BCR1) register */
+enum bcr1_bits {
+        BCR1_POT0=0x01,
+        BCR1_POT1=0x02,
+        BCR1_POT2=0x04,
+        BCR1_CTFT0=0x08,
+        BCR1_CTFT1=0x10,
+        BCR1_CTSF=0x20,
+        BCR1_TXQNOBK=0x40,      /* for VT6105 */
+        BCR1_VIDFR=0x80,        /* for VT6105 */
+        BCR1_MED0=0x40,         /* for VT6102 */
+        BCR1_MED1=0x80,         /* for VT6102 */
+};
+
 #ifdef USE_MMIO
 /* Registers we check that mmio and reg are the same. */
 static const int mmio_verify_registers[] = {
@@ -356,6 +395,11 @@ enum desc_status_bits {
         DescOwn=0x80000000
 };
 
+/* Bits in *_desc.*_length */
+enum desc_length_bits {
+        DescTag=0x00010000
+};
+
 /* Bits in ChipCmd. */
 enum chip_cmd_bits {
         CmdInit=0x01, CmdStart=0x02, CmdStop=0x04, CmdRxOn=0x08,
@@ -365,6 +409,9 @@ enum chip_cmd_bits {
 };
 
 struct rhine_private {
+        /* Bit mask for configured VLAN ids */
+        unsigned long active_vlans[BITS_TO_LONGS(VLAN_N_VID)];
+
         /* Descriptor rings */
         struct rx_desc *rx_ring;
         struct tx_desc *tx_ring;
@@ -405,6 +452,23 @@ struct rhine_private {
         void __iomem *base;
 };
 
+#define BYTE_REG_BITS_ON(x, p)      do { iowrite8((ioread8((p))|(x)), (p)); } while (0)
+#define WORD_REG_BITS_ON(x, p)      do { iowrite16((ioread16((p))|(x)), (p)); } while (0)
+#define DWORD_REG_BITS_ON(x, p)     do { iowrite32((ioread32((p))|(x)), (p)); } while (0)
+
+#define BYTE_REG_BITS_IS_ON(x, p)   (ioread8((p)) & (x))
+#define WORD_REG_BITS_IS_ON(x, p)   (ioread16((p)) & (x))
+#define DWORD_REG_BITS_IS_ON(x, p)  (ioread32((p)) & (x))
+
+#define BYTE_REG_BITS_OFF(x, p)     do { iowrite8(ioread8((p)) & (~(x)), (p)); } while (0)
+#define WORD_REG_BITS_OFF(x, p)     do { iowrite16(ioread16((p)) & (~(x)), (p)); } while (0)
+#define DWORD_REG_BITS_OFF(x, p)    do { iowrite32(ioread32((p)) & (~(x)), (p)); } while (0)
+
+#define BYTE_REG_BITS_SET(x, m, p)   do { iowrite8((ioread8((p)) & (~(m)))|(x), (p)); } while (0)
+#define WORD_REG_BITS_SET(x, m, p)   do { iowrite16((ioread16((p)) & (~(m)))|(x), (p)); } while (0)
+#define DWORD_REG_BITS_SET(x, m, p)  do { iowrite32((ioread32((p)) & (~(m)))|(x), (p)); } while (0)
+
+
 static int  mdio_read(struct net_device *dev, int phy_id, int location);
 static void mdio_write(struct net_device *dev, int phy_id, int location, int value);
 static int  rhine_open(struct net_device *dev);
@@ -422,6 +486,14 @@ static int netdev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
 static const struct ethtool_ops netdev_ethtool_ops;
 static int  rhine_close(struct net_device *dev);
 static void rhine_shutdown (struct pci_dev *pdev);
+static void rhine_vlan_rx_add_vid(struct net_device *dev, unsigned short vid);
+static void rhine_vlan_rx_kill_vid(struct net_device *dev, unsigned short vid);
+static void rhine_set_cam(void __iomem *ioaddr, int idx, u8 *addr);
+static void rhine_set_vlan_cam(void __iomem *ioaddr, int idx, u8 *addr);
+static void rhine_set_cam_mask(void __iomem *ioaddr, u32 mask);
+static void rhine_set_vlan_cam_mask(void __iomem *ioaddr, u32 mask);
+static void rhine_init_cam_filter(struct net_device *dev);
+static void rhine_update_vcam(struct net_device *dev);
 
 #define RHINE_WAIT_FOR(condition) do {                                  \
         int i=1024;                                                     \
@@ -629,6 +701,8 @@ static const struct net_device_ops rhine_netdev_ops = {
         .ndo_set_mac_address     = eth_mac_addr,
         .ndo_do_ioctl            = netdev_ioctl,
         .ndo_tx_timeout          = rhine_tx_timeout,
+        .ndo_vlan_rx_add_vid     = rhine_vlan_rx_add_vid,
+        .ndo_vlan_rx_kill_vid    = rhine_vlan_rx_kill_vid,
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_poll_controller     = rhine_poll,
 #endif
@@ -795,6 +869,10 @@ static int __devinit rhine_init_one(struct pci_dev *pdev,
         if (rp->quirks & rqRhineI)
                 dev->features |= NETIF_F_SG|NETIF_F_HW_CSUM;
 
+        if (pdev->revision >= VT6105M)
+                dev->features |= NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX |
+                NETIF_F_HW_VLAN_FILTER;
+
         /* dev->name not defined before register_netdev()! */
         rc = register_netdev(dev);
         if (rc)
@@ -1040,6 +1118,167 @@ static void rhine_set_carrier(struct mii_if_info *mii)
                        netif_carrier_ok(mii->dev));
 }
 
+/**
+ * rhine_set_cam - set CAM multicast filters
+ * @ioaddr: register block of this Rhine
+ * @idx: multicast CAM index [0..MCAM_SIZE-1]
+ * @addr: multicast address (6 bytes)
+ *
+ * Load addresses into multicast filters.
+ */
+static void rhine_set_cam(void __iomem *ioaddr, int idx, u8 *addr)
+{
+        int i;
+
+        iowrite8(CAMC_CAMEN, ioaddr + CamCon);
+        wmb();
+
+        /* Paranoid -- idx out of range should never happen */
+        idx &= (MCAM_SIZE - 1);
+
+        iowrite8((u8) idx, ioaddr + CamAddr);
+
+        for (i = 0; i < 6; i++, addr++)
+                iowrite8(*addr, ioaddr + MulticastFilter0 + i);
+        udelay(10);
+        wmb();
+
+        iowrite8(CAMC_CAMWR | CAMC_CAMEN, ioaddr + CamCon);
+        udelay(10);
+
+        iowrite8(0, ioaddr + CamCon);
+}
+
+/**
+ * rhine_set_vlan_cam - set CAM VLAN filters
+ * @ioaddr: register block of this Rhine
+ * @idx: VLAN CAM index [0..VCAM_SIZE-1]
+ * @addr: VLAN ID (2 bytes)
+ *
+ * Load addresses into VLAN filters.
+ */
+static void rhine_set_vlan_cam(void __iomem *ioaddr, int idx, u8 *addr)
+{
+        iowrite8(CAMC_CAMEN | CAMC_VCAMSL, ioaddr + CamCon);
+        wmb();
+
+        /* Paranoid -- idx out of range should never happen */
+        idx &= (VCAM_SIZE - 1);
+
+        iowrite8((u8) idx, ioaddr + CamAddr);
+
+        iowrite16(*((u16 *) addr), ioaddr + MulticastFilter0 + 6);
+        udelay(10);
+        wmb();
+
+        iowrite8(CAMC_CAMWR | CAMC_CAMEN, ioaddr + CamCon);
+        udelay(10);
+
+        iowrite8(0, ioaddr + CamCon);
+}
+
+/**
+ * rhine_set_cam_mask - set multicast CAM mask
+ * @ioaddr: register block of this Rhine
+ * @mask: multicast CAM mask
+ *
+ * Mask sets multicast filters active/inactive.
+ */
+static void rhine_set_cam_mask(void __iomem *ioaddr, u32 mask)
+{
+        iowrite8(CAMC_CAMEN, ioaddr + CamCon);
+        wmb();
+
+        /* write mask */
+        iowrite32(mask, ioaddr + CamMask);
+
+        /* disable CAMEN */
+        iowrite8(0, ioaddr + CamCon);
+}
+
+/**
+ * rhine_set_vlan_cam_mask - set VLAN CAM mask
+ * @ioaddr: register block of this Rhine
+ * @mask: VLAN CAM mask
+ *
+ * Mask sets VLAN filters active/inactive.
+ */
+static void rhine_set_vlan_cam_mask(void __iomem *ioaddr, u32 mask)
+{
+        iowrite8(CAMC_CAMEN | CAMC_VCAMSL, ioaddr + CamCon);
+        wmb();
+
+        /* write mask */
+        iowrite32(mask, ioaddr + CamMask);
+
+        /* disable CAMEN */
+        iowrite8(0, ioaddr + CamCon);
+}
+
+/**
+ * rhine_init_cam_filter - initialize CAM filters
+ * @dev: network device
+ *
+ * Initialize (disable) hardware VLAN and multicast support on this
+ * Rhine.
+ */
+static void rhine_init_cam_filter(struct net_device *dev)
+{
+        struct rhine_private *rp = netdev_priv(dev);
+        void __iomem *ioaddr = rp->base;
+
+        /* Disable all CAMs */
+        rhine_set_vlan_cam_mask(ioaddr, 0);
+        rhine_set_cam_mask(ioaddr, 0);
+
+        /* disable hardware VLAN support */
+        BYTE_REG_BITS_ON(TCR_PQEN, ioaddr + TxConfig);
+        BYTE_REG_BITS_OFF(BCR1_VIDFR, ioaddr + PCIBusConfig1);
+}
+
+/**
+ * rhine_update_vcam - update VLAN CAM filters
+ * @rp: rhine_private data of this Rhine
+ *
+ * Update VLAN CAM filters to match configuration change.
+ */
+static void rhine_update_vcam(struct net_device *dev)
+{
+        struct rhine_private *rp = netdev_priv(dev);
+        void __iomem *ioaddr = rp->base;
+        u16 vid;
+        u32 vCAMmask = 0;       /* 32 vCAMs (6105M and better) */
+        unsigned int i = 0;
+
+        for_each_set_bit(vid, rp->active_vlans, VLAN_N_VID) {
+                rhine_set_vlan_cam(ioaddr, i, (u8 *)&vid);
+                vCAMmask |= 1 << i;
+                if (++i >= VCAM_SIZE)
+                        break;
+        }
+        rhine_set_vlan_cam_mask(ioaddr, vCAMmask);
+}
+
+static void rhine_vlan_rx_add_vid(struct net_device *dev, unsigned short vid)
+{
+        struct rhine_private *rp = netdev_priv(dev);
+
+        spin_lock_irq(&rp->lock);
+        set_bit(vid, rp->active_vlans);
+        rhine_update_vcam(dev);
+        spin_unlock_irq(&rp->lock);
+}
+
+static void rhine_vlan_rx_kill_vid(struct net_device *dev, unsigned short vid)
+{
+        struct rhine_private *rp = netdev_priv(dev);
+
+        spin_lock_irq(&rp->lock);
+        clear_bit(vid, rp->active_vlans);
+        rhine_update_vcam(dev);
+        spin_unlock_irq(&rp->lock);
+}
+
 static void init_registers(struct net_device *dev)
 {
         struct rhine_private *rp = netdev_priv(dev);
@@ -1061,6 +1300,9 @@ static void init_registers(struct net_device *dev)
 
         rhine_set_rx_mode(dev);
 
+        if (rp->pdev->revision >= VT6105M)
+                rhine_init_cam_filter(dev);
+
         napi_enable(&rp->napi);
 
         /* Enable interrupts by setting the interrupt mask. */
@@ -1276,16 +1518,28 @@ static netdev_tx_t rhine_start_tx(struct sk_buff *skb,
         rp->tx_ring[entry].desc_length =
                 cpu_to_le32(TXDESC | (skb->len >= ETH_ZLEN ? skb->len : ETH_ZLEN));
 
+        if (unlikely(vlan_tx_tag_present(skb))) {
+                rp->tx_ring[entry].tx_status = cpu_to_le32((vlan_tx_tag_get(skb)) << 16);
+                /* request tagging */
+                rp->tx_ring[entry].desc_length |= cpu_to_le32(0x020000);
+        }
+        else
+                rp->tx_ring[entry].tx_status = 0;
+
         /* lock eth irq */
         spin_lock_irqsave(&rp->lock, flags);
         wmb();
-        rp->tx_ring[entry].tx_status = cpu_to_le32(DescOwn);
+        rp->tx_ring[entry].tx_status |= cpu_to_le32(DescOwn);
         wmb();
 
         rp->cur_tx++;
 
         /* Non-x86 Todo: explicitly flush cache lines here. */
 
+        if (vlan_tx_tag_present(skb))
+                /* Tx queues are bits 7-0 (first Tx queue: bit 7) */
+                BYTE_REG_BITS_ON(1 << 7, ioaddr + TQWake);
+
         /* Wake the potentially-idle transmit channel */
         iowrite8(ioread8(ioaddr + ChipCmd1) | Cmd1TxDemand,
                ioaddr + ChipCmd1);
@@ -1437,6 +1691,21 @@ static void rhine_tx(struct net_device *dev)
         spin_unlock(&rp->lock);
 }
 
+/**
+ * rhine_get_vlan_tci - extract TCI from Rx data buffer
+ * @skb: pointer to sk_buff
+ * @data_size: used data area of the buffer including CRC
+ *
+ * If hardware VLAN tag extraction is enabled and the chip indicates a 802.1Q
+ * packet, the extracted 802.1Q header (2 bytes TPID + 2 bytes TCI) is 4-byte
+ * aligned following the CRC.
+ */
+static inline u16 rhine_get_vlan_tci(struct sk_buff *skb, int data_size)
+{
+        u8 *trailer = (u8 *)skb->data + ((data_size + 3) & ~3) + 2;
+        return ntohs(*(u16 *)trailer);
+}
+
 /* Process up to limit frames from receive ring */
 static int rhine_rx(struct net_device *dev, int limit)
 {
@@ -1454,6 +1723,7 @@ static int rhine_rx(struct net_device *dev, int limit)
         for (count = 0; count < limit; ++count) {
                 struct rx_desc *desc = rp->rx_head_desc;
                 u32 desc_status = le32_to_cpu(desc->rx_status);
+                u32 desc_length = le32_to_cpu(desc->desc_length);
                 int data_size = desc_status >> 16;
 
                 if (desc_status & DescOwn)
@@ -1498,6 +1768,7 @@ static int rhine_rx(struct net_device *dev, int limit)
                         struct sk_buff *skb = NULL;
                         /* Length should omit the CRC */
                         int pkt_len = data_size - 4;
+                        u16 vlan_tci = 0;
 
                         /* Check if the packet is long enough to accept without
                            copying to a minimally-sized skbuff. */
@@ -1532,7 +1803,14 @@ static int rhine_rx(struct net_device *dev, int limit)
                                                  rp->rx_buf_sz,
                                                  PCI_DMA_FROMDEVICE);
                         }
+
+                        if (unlikely(desc_length & DescTag))
+                                vlan_tci = rhine_get_vlan_tci(skb, data_size);
+
                         skb->protocol = eth_type_trans(skb, dev);
+
+                        if (unlikely(desc_length & DescTag))
+                                __vlan_hwaccel_put_tag(skb, vlan_tci);
                         netif_receive_skb(skb);
                         dev->stats.rx_bytes += pkt_len;
                         dev->stats.rx_packets++;
@@ -1596,6 +1874,11 @@ static void rhine_restart_tx(struct net_device *dev) {
 
                 iowrite8(ioread8(ioaddr + ChipCmd) | CmdTxOn,
                        ioaddr + ChipCmd);
+
+                if (rp->tx_ring[entry].desc_length & cpu_to_le32(0x020000))
+                        /* Tx queues are bits 7-0 (first Tx queue: bit 7) */
+                        BYTE_REG_BITS_ON(1 << 7, ioaddr + TQWake);
+
                 iowrite8(ioread8(ioaddr + ChipCmd1) | Cmd1TxDemand,
                        ioaddr + ChipCmd1);
                 IOSYNC;
@@ -1631,7 +1914,7 @@ static void rhine_error(struct net_device *dev, int intr_status)
         }
         if (intr_status & IntrTxUnderrun) {
                 if (rp->tx_thresh < 0xE0)
-                        iowrite8(rp->tx_thresh += 0x20, ioaddr + TxConfig);
+                        BYTE_REG_BITS_SET((rp->tx_thresh += 0x20), 0x80, ioaddr + TxConfig);
                 if (debug > 1)
                         printk(KERN_INFO "%s: Transmitter underrun, Tx "
                                "threshold now %2.2x.\n",
@@ -1646,7 +1929,7 @@ static void rhine_error(struct net_device *dev, int intr_status)
             (intr_status & (IntrTxAborted |
              IntrTxUnderrun | IntrTxDescRace)) == 0) {
                 if (rp->tx_thresh < 0xE0) {
-                        iowrite8(rp->tx_thresh += 0x20, ioaddr + TxConfig);
+                        BYTE_REG_BITS_SET((rp->tx_thresh += 0x20), 0x80, ioaddr + TxConfig);
                 }
                 if (debug > 1)
                         printk(KERN_INFO "%s: Unspecified error. Tx "
@@ -1688,7 +1971,8 @@ static void rhine_set_rx_mode(struct net_device *dev)
         struct rhine_private *rp = netdev_priv(dev);
         void __iomem *ioaddr = rp->base;
         u32 mc_filter[2];       /* Multicast hash filter */
-        u8 rx_mode;             /* Note: 0x02=accept runt, 0x01=accept errs */
+        u8 rx_mode = 0x0C;      /* Note: 0x02=accept runt, 0x01=accept errs */
+        struct netdev_hw_addr *ha;
 
         if (dev->flags & IFF_PROMISC) {         /* Set promiscuous. */
                 rx_mode = 0x1C;
@@ -1699,10 +1983,18 @@ static void rhine_set_rx_mode(struct net_device *dev)
                 /* Too many to match, or accept all multicasts. */
                 iowrite32(0xffffffff, ioaddr + MulticastFilter0);
                 iowrite32(0xffffffff, ioaddr + MulticastFilter1);
-                rx_mode = 0x0C;
+        } else if (rp->pdev->revision >= VT6105M) {
+                int i = 0;
+                u32 mCAMmask = 0;       /* 32 mCAMs (6105M and better) */
+                netdev_for_each_mc_addr(ha, dev) {
+                        if (i == MCAM_SIZE)
+                                break;
+                        rhine_set_cam(ioaddr, i, ha->addr);
+                        mCAMmask |= 1 << i;
+                        i++;
+                }
+                rhine_set_cam_mask(ioaddr, mCAMmask);
         } else {
-                struct netdev_hw_addr *ha;
-
                 memset(mc_filter, 0, sizeof(mc_filter));
                 netdev_for_each_mc_addr(ha, dev) {
                         int bit_nr = ether_crc(ETH_ALEN, ha->addr) >> 26;
@@ -1711,9 +2003,15 @@ static void rhine_set_rx_mode(struct net_device *dev)
                 }
                 iowrite32(mc_filter[0], ioaddr + MulticastFilter0);
                 iowrite32(mc_filter[1], ioaddr + MulticastFilter1);
-                rx_mode = 0x0C;
         }
-        iowrite8(rp->rx_thresh | rx_mode, ioaddr + RxConfig);
+        /* enable/disable VLAN receive filtering */
+        if (rp->pdev->revision >= VT6105M) {
+                if (dev->flags & IFF_PROMISC)
+                        BYTE_REG_BITS_OFF(BCR1_VIDFR, ioaddr + PCIBusConfig1);
+                else
+                        BYTE_REG_BITS_ON(BCR1_VIDFR, ioaddr + PCIBusConfig1);
+        }
+        BYTE_REG_BITS_ON(rx_mode, ioaddr + RxConfig);
 }
 
 static void netdev_get_drvinfo(struct net_device *dev, struct ethtool_drvinfo *info)
@@ -1966,7 +2264,7 @@ static int rhine_resume(struct pci_dev *pdev)
         if (!netif_running(dev))
                 return 0;
 
-        if (request_irq(dev->irq, rhine_interrupt, IRQF_SHARED, dev->name, dev))
+        if (request_irq(dev->irq, rhine_interrupt, IRQF_SHARED, dev->name, dev))
                 printk(KERN_ERR "via-rhine %s: request_irq failed\n", dev->name);
 
         ret = pci_set_power_state(pdev, PCI_D0);
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index 21314e06e6d..65860a99832 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -44,6 +44,9 @@ MODULE_DEVICE_TABLE(pci, vmxnet3_pciid_table);
 
 static atomic_t devices_found;
 
+#define VMXNET3_MAX_DEVICES 10
+static int enable_mq = 1;
+static int irq_share_mode;
 
 /*
  *    Enable/Disable the given intr
@@ -99,7 +102,7 @@ vmxnet3_ack_events(struct vmxnet3_adapter *adapter, u32 events)
 static bool
 vmxnet3_tq_stopped(struct vmxnet3_tx_queue *tq, struct vmxnet3_adapter *adapter)
 {
-        return netif_queue_stopped(adapter->netdev);
+        return tq->stopped;
 }
 
 
@@ -107,7 +110,7 @@ static void
 vmxnet3_tq_start(struct vmxnet3_tx_queue *tq, struct vmxnet3_adapter *adapter)
 {
         tq->stopped = false;
-        netif_start_queue(adapter->netdev);
+        netif_start_subqueue(adapter->netdev, tq - adapter->tx_queue);
 }
 
 
@@ -115,7 +118,7 @@ static void
 vmxnet3_tq_wake(struct vmxnet3_tx_queue *tq, struct vmxnet3_adapter *adapter)
 {
         tq->stopped = false;
-        netif_wake_queue(adapter->netdev);
+        netif_wake_subqueue(adapter->netdev, (tq - adapter->tx_queue));
 }
 
 
@@ -124,7 +127,7 @@ vmxnet3_tq_stop(struct vmxnet3_tx_queue *tq, struct vmxnet3_adapter *adapter)
 {
         tq->stopped = true;
         tq->num_stop++;
-        netif_stop_queue(adapter->netdev);
+        netif_stop_subqueue(adapter->netdev, (tq - adapter->tx_queue));
 }
 
 
@@ -135,6 +138,7 @@ static void
 vmxnet3_check_link(struct vmxnet3_adapter *adapter, bool affectTxQueue)
 {
         u32 ret;
+        int i;
 
         VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD, VMXNET3_CMD_GET_LINK);
         ret = VMXNET3_READ_BAR1_REG(adapter, VMXNET3_REG_CMD);
@@ -145,22 +149,28 @@ vmxnet3_check_link(struct vmxnet3_adapter *adapter, bool affectTxQueue)
                 if (!netif_carrier_ok(adapter->netdev))
                         netif_carrier_on(adapter->netdev);
 
-                if (affectTxQueue)
-                        vmxnet3_tq_start(&adapter->tx_queue, adapter);
+                if (affectTxQueue) {
+                        for (i = 0; i < adapter->num_tx_queues; i++)
+                                vmxnet3_tq_start(&adapter->tx_queue[i],
+                                                 adapter);
+                }
         } else {
                 printk(KERN_INFO "%s: NIC Link is Down\n",
                        adapter->netdev->name);
                 if (netif_carrier_ok(adapter->netdev))
                         netif_carrier_off(adapter->netdev);
 
-                if (affectTxQueue)
-                        vmxnet3_tq_stop(&adapter->tx_queue, adapter);
+                if (affectTxQueue) {
+                        for (i = 0; i < adapter->num_tx_queues; i++)
+                                vmxnet3_tq_stop(&adapter->tx_queue[i], adapter);
+                }
         }
 }
 
 static void
 vmxnet3_process_events(struct vmxnet3_adapter *adapter)
 {
+        int i;
         u32 events = le32_to_cpu(adapter->shared->ecr);
         if (!events)
                 return;
@@ -176,16 +186,18 @@ vmxnet3_process_events(struct vmxnet3_adapter *adapter)
                 VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD,
                                        VMXNET3_CMD_GET_QUEUE_STATUS);
 
-                if (adapter->tqd_start->status.stopped) {
-                        printk(KERN_ERR "%s: tq error 0x%x\n",
-                               adapter->netdev->name,
-                               le32_to_cpu(adapter->tqd_start->status.error));
-                }
-                if (adapter->rqd_start->status.stopped) {
-                        printk(KERN_ERR "%s: rq error 0x%x\n",
-                               adapter->netdev->name,
-                               adapter->rqd_start->status.error);
-                }
+                for (i = 0; i < adapter->num_tx_queues; i++)
+                        if (adapter->tqd_start[i].status.stopped)
+                                dev_err(&adapter->netdev->dev,
+                                        "%s: tq[%d] error 0x%x\n",
+                                        adapter->netdev->name, i, le32_to_cpu(
+                                        adapter->tqd_start[i].status.error));
+                for (i = 0; i < adapter->num_rx_queues; i++)
+                        if (adapter->rqd_start[i].status.stopped)
+                                dev_err(&adapter->netdev->dev,
+                                        "%s: rq[%d] error 0x%x\n",
+                                        adapter->netdev->name, i,
+                                        adapter->rqd_start[i].status.error);
 
                 schedule_work(&adapter->work);
         }
@@ -410,7 +422,7 @@ vmxnet3_tq_cleanup(struct vmxnet3_tx_queue *tq,
 }
 
 
-void
+static void
 vmxnet3_tq_destroy(struct vmxnet3_tx_queue *tq,
                    struct vmxnet3_adapter *adapter)
 {
@@ -437,6 +449,17 @@ vmxnet3_tq_destroy(struct vmxnet3_tx_queue *tq,
 }
 
 
+/* Destroy all tx queues */
+void
+vmxnet3_tq_destroy_all(struct vmxnet3_adapter *adapter)
+{
+        int i;
+
+        for (i = 0; i < adapter->num_tx_queues; i++)
+                vmxnet3_tq_destroy(&adapter->tx_queue[i], adapter);
+}
+
+
 static void
 vmxnet3_tq_init(struct vmxnet3_tx_queue *tq,
                 struct vmxnet3_adapter *adapter)
@@ -518,6 +541,14 @@ err:
         return -ENOMEM;
 }
 
+static void
+vmxnet3_tq_cleanup_all(struct vmxnet3_adapter *adapter)
+{
+        int i;
+
+        for (i = 0; i < adapter->num_tx_queues; i++)
+                vmxnet3_tq_cleanup(&adapter->tx_queue[i], adapter);
+}
 
 /*
  *    starting from ring->next2fill, allocate rx buffers for the given ring
@@ -732,6 +763,17 @@ vmxnet3_map_pkt(struct sk_buff *skb, struct vmxnet3_tx_ctx *ctx,
 }
 
 
+/* Init all tx queues */
+static void
+vmxnet3_tq_init_all(struct vmxnet3_adapter *adapter)
+{
+        int i;
+
+        for (i = 0; i < adapter->num_tx_queues; i++)
+                vmxnet3_tq_init(&adapter->tx_queue[i], adapter);
+}
+
+
 /*
  *    parse and copy relevant protocol headers:
  *      For a tso pkt, relevant headers are L2/3/4 including options
@@ -903,6 +945,21 @@ vmxnet3_tq_xmit(struct sk_buff *skb, struct vmxnet3_tx_queue *tq,
                 }
         }
 
+        spin_lock_irqsave(&tq->tx_lock, flags);
+
+        if (count > vmxnet3_cmd_ring_desc_avail(&tq->tx_ring)) {
+                tq->stats.tx_ring_full++;
+                dev_dbg(&adapter->netdev->dev,
+                        "tx queue stopped on %s, next2comp %u"
+                        " next2fill %u\n", adapter->netdev->name,
+                        tq->tx_ring.next2comp, tq->tx_ring.next2fill);
+
+                vmxnet3_tq_stop(tq, adapter);
+                spin_unlock_irqrestore(&tq->tx_lock, flags);
+                return NETDEV_TX_BUSY;
+        }
+
+
         ret = vmxnet3_parse_and_copy_hdr(skb, tq, &ctx, adapter);
         if (ret >= 0) {
                 BUG_ON(ret <= 0 && ctx.copy_size != 0);
@@ -926,20 +983,6 @@ vmxnet3_tq_xmit(struct sk_buff *skb, struct vmxnet3_tx_queue *tq,
                 goto drop_pkt;
         }
 
-        spin_lock_irqsave(&tq->tx_lock, flags);
-
-        if (count > vmxnet3_cmd_ring_desc_avail(&tq->tx_ring)) {
-                tq->stats.tx_ring_full++;
-                dev_dbg(&adapter->netdev->dev,
-                        "tx queue stopped on %s, next2comp %u"
-                        " next2fill %u\n", adapter->netdev->name,
-                        tq->tx_ring.next2comp, tq->tx_ring.next2fill);
-
-                vmxnet3_tq_stop(tq, adapter);
-                spin_unlock_irqrestore(&tq->tx_lock, flags);
-                return NETDEV_TX_BUSY;
-        }
-
         /* fill tx descs related to addr & len */
         vmxnet3_map_pkt(skb, &ctx, tq, adapter->pdev, adapter);
 
@@ -1000,7 +1043,8 @@ vmxnet3_tq_xmit(struct sk_buff *skb, struct vmxnet3_tx_queue *tq,
         if (le32_to_cpu(tq->shared->txNumDeferred) >=
                                         le32_to_cpu(tq->shared->txThreshold)) {
                 tq->shared->txNumDeferred = 0;
-                VMXNET3_WRITE_BAR0_REG(adapter, VMXNET3_REG_TXPROD,
+                VMXNET3_WRITE_BAR0_REG(adapter,
+                                       VMXNET3_REG_TXPROD + tq->qid * 8,
                                        tq->tx_ring.next2fill);
         }
 
@@ -1020,7 +1064,10 @@ vmxnet3_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
 {
         struct vmxnet3_adapter *adapter = netdev_priv(netdev);
 
-        return vmxnet3_tq_xmit(skb, &adapter->tx_queue, adapter, netdev);
+                BUG_ON(skb->queue_mapping > adapter->num_tx_queues);
+                return vmxnet3_tq_xmit(skb,
+                                       &adapter->tx_queue[skb->queue_mapping],
+                                       adapter, netdev);
 }
 
 
@@ -1106,9 +1153,9 @@ vmxnet3_rq_rx_complete(struct vmxnet3_rx_queue *rq,
                         break;
                 }
                 num_rxd++;
-
+                BUG_ON(rcd->rqID != rq->qid && rcd->rqID != rq->qid2);
                 idx = rcd->rxdIdx;
-                ring_idx = rcd->rqID == rq->qid ? 0 : 1;
+                ring_idx = rcd->rqID < adapter->num_rx_queues ? 0 : 1;
                 vmxnet3_getRxDesc(rxd, &rq->rx_ring[ring_idx].base[idx].rxd,
                                   &rxCmdDesc);
                 rbi = rq->buf_info[ring_idx] + idx;
@@ -1260,6 +1307,16 @@ vmxnet3_rq_cleanup(struct vmxnet3_rx_queue *rq,
 }
 
 
+static void
+vmxnet3_rq_cleanup_all(struct vmxnet3_adapter *adapter)
+{
+        int i;
+
+        for (i = 0; i < adapter->num_rx_queues; i++)
+                vmxnet3_rq_cleanup(&adapter->rx_queue[i], adapter);
+}
+
+
 void vmxnet3_rq_destroy(struct vmxnet3_rx_queue *rq,
                         struct vmxnet3_adapter *adapter)
 {
@@ -1351,6 +1408,25 @@ vmxnet3_rq_init(struct vmxnet3_rx_queue *rq,
 
 
 static int
+vmxnet3_rq_init_all(struct vmxnet3_adapter *adapter)
+{
+        int i, err = 0;
+
+        for (i = 0; i < adapter->num_rx_queues; i++) {
+                err = vmxnet3_rq_init(&adapter->rx_queue[i], adapter);
+                if (unlikely(err)) {
+                        dev_err(&adapter->netdev->dev, "%s: failed to "
+                                "initialize rx queue%i\n",
+                                adapter->netdev->name, i);
+                        break;
+                }
+        }
+        return err;
+
+}
+
+
+static int
 vmxnet3_rq_create(struct vmxnet3_rx_queue *rq, struct vmxnet3_adapter *adapter)
 {
         int i;
@@ -1398,33 +1474,177 @@ err:
 
 
 static int
+vmxnet3_rq_create_all(struct vmxnet3_adapter *adapter)
+{
+        int i, err = 0;
+
+        for (i = 0; i < adapter->num_rx_queues; i++) {
+                err = vmxnet3_rq_create(&adapter->rx_queue[i], adapter);
+                if (unlikely(err)) {
+                        dev_err(&adapter->netdev->dev,
+                                "%s: failed to create rx queue%i\n",
+                                adapter->netdev->name, i);
+                        goto err_out;
+                }
+        }
+        return err;
+err_out:
+        vmxnet3_rq_destroy_all(adapter);
+        return err;
+
+}
+
+/* Multiple queue aware polling function for tx and rx */
+
+static int
 vmxnet3_do_poll(struct vmxnet3_adapter *adapter, int budget)
 {
+        int rcd_done = 0, i;
         if (unlikely(adapter->shared->ecr))
                 vmxnet3_process_events(adapter);
+        for (i = 0; i < adapter->num_tx_queues; i++)
+                vmxnet3_tq_tx_complete(&adapter->tx_queue[i], adapter);
 
-        vmxnet3_tq_tx_complete(&adapter->tx_queue, adapter);
-        return vmxnet3_rq_rx_complete(&adapter->rx_queue, adapter, budget);
+        for (i = 0; i < adapter->num_rx_queues; i++)
+                rcd_done += vmxnet3_rq_rx_complete(&adapter->rx_queue[i],
+                                                   adapter, budget);
+        return rcd_done;
 }
 
 
 static int
 vmxnet3_poll(struct napi_struct *napi, int budget)
 {
-        struct vmxnet3_adapter *adapter = container_of(napi,
-                                          struct vmxnet3_adapter, napi);
+        struct vmxnet3_rx_queue *rx_queue = container_of(napi,
+                                          struct vmxnet3_rx_queue, napi);
+        int rxd_done;
+
+        rxd_done = vmxnet3_do_poll(rx_queue->adapter, budget);
+
+        if (rxd_done < budget) {
+                napi_complete(napi);
+                vmxnet3_enable_all_intrs(rx_queue->adapter);
+        }
+        return rxd_done;
+}
+
+/*
+ * NAPI polling function for MSI-X mode with multiple Rx queues
+ * Returns the # of the NAPI credit consumed (# of rx descriptors processed)
+ */
+
+static int
+vmxnet3_poll_rx_only(struct napi_struct *napi, int budget)
+{
+        struct vmxnet3_rx_queue *rq = container_of(napi,
+                                                struct vmxnet3_rx_queue, napi);
+        struct vmxnet3_adapter *adapter = rq->adapter;
         int rxd_done;
 
-        rxd_done = vmxnet3_do_poll(adapter, budget);
+        /* When sharing interrupt with corresponding tx queue, process
+         * tx completions in that queue as well
+         */
+        if (adapter->share_intr == VMXNET3_INTR_BUDDYSHARE) {
+                struct vmxnet3_tx_queue *tq =
+                                &adapter->tx_queue[rq - adapter->rx_queue];
+                vmxnet3_tq_tx_complete(tq, adapter);
+        }
+
+        rxd_done = vmxnet3_rq_rx_complete(rq, adapter, budget);
 
         if (rxd_done < budget) {
                 napi_complete(napi);
-                vmxnet3_enable_intr(adapter, 0);
+                vmxnet3_enable_intr(adapter, rq->comp_ring.intr_idx);
         }
         return rxd_done;
 }
 
 
+#ifdef CONFIG_PCI_MSI
+
+/*
+ * Handle completion interrupts on tx queues
+ * Returns whether or not the intr is handled
+ */
+
+static irqreturn_t
+vmxnet3_msix_tx(int irq, void *data)
+{
+        struct vmxnet3_tx_queue *tq = data;
+        struct vmxnet3_adapter *adapter = tq->adapter;
+
+        if (adapter->intr.mask_mode == VMXNET3_IMM_ACTIVE)
+                vmxnet3_disable_intr(adapter, tq->comp_ring.intr_idx);
+
+        /* Handle the case where only one irq is allocate for all tx queues */
+        if (adapter->share_intr == VMXNET3_INTR_TXSHARE) {
+                int i;
+                for (i = 0; i < adapter->num_tx_queues; i++) {
+                        struct vmxnet3_tx_queue *txq = &adapter->tx_queue[i];
+                        vmxnet3_tq_tx_complete(txq, adapter);
+                }
+        } else {
+                vmxnet3_tq_tx_complete(tq, adapter);
+        }
+        vmxnet3_enable_intr(adapter, tq->comp_ring.intr_idx);
+
+        return IRQ_HANDLED;
+}
+
+
+/*
+ * Handle completion interrupts on rx queues. Returns whether or not the
+ * intr is handled
+ */
+
+static irqreturn_t
+vmxnet3_msix_rx(int irq, void *data)
+{
+        struct vmxnet3_rx_queue *rq = data;
+        struct vmxnet3_adapter *adapter = rq->adapter;
+
+        /* disable intr if needed */
+        if (adapter->intr.mask_mode == VMXNET3_IMM_ACTIVE)
+                vmxnet3_disable_intr(adapter, rq->comp_ring.intr_idx);
+        napi_schedule(&rq->napi);
+
+        return IRQ_HANDLED;
+}
+
+/*
+ *----------------------------------------------------------------------------
+ *
+ * vmxnet3_msix_event --
+ *
+ *    vmxnet3 msix event intr handler
+ *
+ * Result:
+ *    whether or not the intr is handled
+ *
+ *----------------------------------------------------------------------------
+ */
+
+static irqreturn_t
+vmxnet3_msix_event(int irq, void *data)
+{
+        struct net_device *dev = data;
+        struct vmxnet3_adapter *adapter = netdev_priv(dev);
+
+        /* disable intr if needed */
+        if (adapter->intr.mask_mode == VMXNET3_IMM_ACTIVE)
+                vmxnet3_disable_intr(adapter, adapter->intr.event_intr_idx);
+
+        if (adapter->shared->ecr)
+                vmxnet3_process_events(adapter);
+
+        vmxnet3_enable_intr(adapter, adapter->intr.event_intr_idx);
+
+        return IRQ_HANDLED;
+}
+
+#endif /* CONFIG_PCI_MSI  */
+
+
 /* Interrupt handler for vmxnet3  */
 static irqreturn_t
 vmxnet3_intr(int irq, void *dev_id)
@@ -1432,7 +1652,7 @@ vmxnet3_intr(int irq, void *dev_id)
         struct net_device *dev = dev_id;
         struct vmxnet3_adapter *adapter = netdev_priv(dev);
 
-        if (unlikely(adapter->intr.type == VMXNET3_IT_INTX)) {
+        if (adapter->intr.type == VMXNET3_IT_INTX) {
                 u32 icr = VMXNET3_READ_BAR1_REG(adapter, VMXNET3_REG_ICR);
                 if (unlikely(icr == 0))
                         /* not ours */
@@ -1442,77 +1662,144 @@ vmxnet3_intr(int irq, void *dev_id)
 
         /* disable intr if needed */
         if (adapter->intr.mask_mode == VMXNET3_IMM_ACTIVE)
-                vmxnet3_disable_intr(adapter, 0);
+                vmxnet3_disable_all_intrs(adapter);
 
-        napi_schedule(&adapter->napi);
+        napi_schedule(&adapter->rx_queue[0].napi);
 
         return IRQ_HANDLED;
 }
 
 #ifdef CONFIG_NET_POLL_CONTROLLER
 
-
 /* netpoll callback. */
 static void
 vmxnet3_netpoll(struct net_device *netdev)
 {
         struct vmxnet3_adapter *adapter = netdev_priv(netdev);
-        int irq;
 
-#ifdef CONFIG_PCI_MSI
-        if (adapter->intr.type == VMXNET3_IT_MSIX)
-                irq = adapter->intr.msix_entries[0].vector;
-        else
-#endif
-                irq = adapter->pdev->irq;
+        if (adapter->intr.mask_mode == VMXNET3_IMM_ACTIVE)
+                vmxnet3_disable_all_intrs(adapter);
+
+        vmxnet3_do_poll(adapter, adapter->rx_queue[0].rx_ring[0].size);
+        vmxnet3_enable_all_intrs(adapter);
 
-        disable_irq(irq);
-        vmxnet3_intr(irq, netdev);
-        enable_irq(irq);
 }
-#endif
+#endif  /* CONFIG_NET_POLL_CONTROLLER */
 
 static int
 vmxnet3_request_irqs(struct vmxnet3_adapter *adapter)
 {
-        int err;
+        struct vmxnet3_intr *intr = &adapter->intr;
+        int err = 0, i;
+        int vector = 0;
 
 #ifdef CONFIG_PCI_MSI
         if (adapter->intr.type == VMXNET3_IT_MSIX) {
-                /* we only use 1 MSI-X vector */
-                err = request_irq(adapter->intr.msix_entries[0].vector,
-                                  vmxnet3_intr, 0, adapter->netdev->name,
-                                  adapter->netdev);
-        } else if (adapter->intr.type == VMXNET3_IT_MSI) {
+                for (i = 0; i < adapter->num_tx_queues; i++) {
+                        if (adapter->share_intr != VMXNET3_INTR_BUDDYSHARE) {
+                                sprintf(adapter->tx_queue[i].name, "%s-tx-%d",
+                                        adapter->netdev->name, vector);
+                                err = request_irq(
+                                              intr->msix_entries[vector].vector,
+                                              vmxnet3_msix_tx, 0,
+                                              adapter->tx_queue[i].name,
+                                              &adapter->tx_queue[i]);
+                        } else {
+                                sprintf(adapter->tx_queue[i].name, "%s-rxtx-%d",
+                                        adapter->netdev->name, vector);
+                        }
+                        if (err) {
+                                dev_err(&adapter->netdev->dev,
+                                        "Failed to request irq for MSIX, %s, "
+                                        "error %d\n",
+                                        adapter->tx_queue[i].name, err);
+                                return err;
+                        }
+
+                        /* Handle the case where only 1 MSIx was allocated for
+                         * all tx queues */
+                        if (adapter->share_intr == VMXNET3_INTR_TXSHARE) {
+                                for (; i < adapter->num_tx_queues; i++)
+                                        adapter->tx_queue[i].comp_ring.intr_idx
+                                                                = vector;
+                                vector++;
+                                break;
+                        } else {
+                                adapter->tx_queue[i].comp_ring.intr_idx
+                                                                = vector++;
+                        }
+                }
+                if (adapter->share_intr == VMXNET3_INTR_BUDDYSHARE)
+                        vector = 0;
+
+                for (i = 0; i < adapter->num_rx_queues; i++) {
+                        if (adapter->share_intr != VMXNET3_INTR_BUDDYSHARE)
+                                sprintf(adapter->rx_queue[i].name, "%s-rx-%d",
+                                        adapter->netdev->name, vector);
+                        else
+                                sprintf(adapter->rx_queue[i].name, "%s-rxtx-%d",
+                                        adapter->netdev->name, vector);
+                        err = request_irq(intr->msix_entries[vector].vector,
+                                          vmxnet3_msix_rx, 0,
+                                          adapter->rx_queue[i].name,
+                                          &(adapter->rx_queue[i]));
+                        if (err) {
+                                printk(KERN_ERR "Failed to request irq for MSIX"
+                                       ", %s, error %d\n",
+                                       adapter->rx_queue[i].name, err);
+                                return err;
+                        }
+
+                        adapter->rx_queue[i].comp_ring.intr_idx = vector++;
+                }
+
+                sprintf(intr->event_msi_vector_name, "%s-event-%d",
+                        adapter->netdev->name, vector);
+                err = request_irq(intr->msix_entries[vector].vector,
+                                  vmxnet3_msix_event, 0,
+                                  intr->event_msi_vector_name, adapter->netdev);
+                intr->event_intr_idx = vector;
+
+        } else if (intr->type == VMXNET3_IT_MSI) {
+                adapter->num_rx_queues = 1;
                 err = request_irq(adapter->pdev->irq, vmxnet3_intr, 0,
                                   adapter->netdev->name, adapter->netdev);
-        } else
+        } else {
 #endif
-        {
+                adapter->num_rx_queues = 1;
                 err = request_irq(adapter->pdev->irq, vmxnet3_intr,
                                   IRQF_SHARED, adapter->netdev->name,
                                   adapter->netdev);
+#ifdef CONFIG_PCI_MSI
         }
-
-        if (err)
+#endif
+        intr->num_intrs = vector + 1;
+        if (err) {
                 printk(KERN_ERR "Failed to request irq %s (intr type:%d), error"
-                       ":%d\n", adapter->netdev->name, adapter->intr.type, err);
+                       ":%d\n", adapter->netdev->name, intr->type, err);
+        } else {
+                /* Number of rx queues will not change after this */
+                for (i = 0; i < adapter->num_rx_queues; i++) {
+                        struct vmxnet3_rx_queue *rq = &adapter->rx_queue[i];
+                        rq->qid = i;
+                        rq->qid2 = i + adapter->num_rx_queues;
+                }
 
 
-        if (!err) {
-                int i;
-                /* init our intr settings */
-                for (i = 0; i < adapter->intr.num_intrs; i++)
-                        adapter->intr.mod_levels[i] = UPT1_IML_ADAPTIVE;
 
-                /* next setup intr index for all intr sources */
-                adapter->tx_queue.comp_ring.intr_idx = 0;
-                adapter->rx_queue.comp_ring.intr_idx = 0;
-                adapter->intr.event_intr_idx = 0;
+                /* init our intr settings */
+                for (i = 0; i < intr->num_intrs; i++)
+                        intr->mod_levels[i] = UPT1_IML_ADAPTIVE;
+                if (adapter->intr.type != VMXNET3_IT_MSIX) {
+                        adapter->intr.event_intr_idx = 0;
+                        for (i = 0; i < adapter->num_tx_queues; i++)
+                                adapter->tx_queue[i].comp_ring.intr_idx = 0;
+                        adapter->rx_queue[0].comp_ring.intr_idx = 0;
+                }
 
                 printk(KERN_INFO "%s: intr type %u, mode %u, %u vectors "
-                       "allocated\n", adapter->netdev->name, adapter->intr.type,
-                       adapter->intr.mask_mode, adapter->intr.num_intrs);
+                       "allocated\n", adapter->netdev->name, intr->type,
+                       intr->mask_mode, intr->num_intrs);
         }
 
         return err;
@@ -1522,18 +1809,32 @@ vmxnet3_request_irqs(struct vmxnet3_adapter *adapter)
 static void
 vmxnet3_free_irqs(struct vmxnet3_adapter *adapter)
 {
-        BUG_ON(adapter->intr.type == VMXNET3_IT_AUTO ||
-               adapter->intr.num_intrs <= 0);
+        struct vmxnet3_intr *intr = &adapter->intr;
+        BUG_ON(intr->type == VMXNET3_IT_AUTO || intr->num_intrs <= 0);
 
-        switch (adapter->intr.type) {
+        switch (intr->type) {
 #ifdef CONFIG_PCI_MSI
         case VMXNET3_IT_MSIX:
         {
-                int i;
+                int i, vector = 0;
 
-                for (i = 0; i < adapter->intr.num_intrs; i++)
-                        free_irq(adapter->intr.msix_entries[i].vector,
-                                 adapter->netdev);
+                if (adapter->share_intr != VMXNET3_INTR_BUDDYSHARE) {
+                        for (i = 0; i < adapter->num_tx_queues; i++) {
+                                free_irq(intr->msix_entries[vector++].vector,
+                                         &(adapter->tx_queue[i]));
+                                if (adapter->share_intr == VMXNET3_INTR_TXSHARE)
+                                        break;
+                        }
+                }
+
+                for (i = 0; i < adapter->num_rx_queues; i++) {
+                        free_irq(intr->msix_entries[vector++].vector,
+                                 &(adapter->rx_queue[i]));
+                }
+
+                free_irq(intr->msix_entries[vector].vector,
+                         adapter->netdev);
+                BUG_ON(vector >= intr->num_intrs);
                 break;
         }
 #endif
@@ -1727,6 +2028,15 @@ vmxnet3_set_mc(struct net_device *netdev)
         kfree(new_table);
 }
 
+void
+vmxnet3_rq_destroy_all(struct vmxnet3_adapter *adapter)
+{
+        int i;
+
+        for (i = 0; i < adapter->num_rx_queues; i++)
+                vmxnet3_rq_destroy(&adapter->rx_queue[i], adapter);
+}
+
 
 /*
  *   Set up driver_shared based on settings in adapter.
@@ -1774,40 +2084,72 @@ vmxnet3_setup_driver_shared(struct vmxnet3_adapter *adapter)
         devRead->misc.mtu = cpu_to_le32(adapter->netdev->mtu);
         devRead->misc.queueDescPA = cpu_to_le64(adapter->queue_desc_pa);
         devRead->misc.queueDescLen = cpu_to_le32(
-                                     sizeof(struct Vmxnet3_TxQueueDesc) +
-                                     sizeof(struct Vmxnet3_RxQueueDesc));
+                adapter->num_tx_queues * sizeof(struct Vmxnet3_TxQueueDesc) +
+                adapter->num_rx_queues * sizeof(struct Vmxnet3_RxQueueDesc));
 
         /* tx queue settings */
-        BUG_ON(adapter->tx_queue.tx_ring.base == NULL);
-
-        devRead->misc.numTxQueues = 1;
-        tqc = &adapter->tqd_start->conf;
-        tqc->txRingBasePA   = cpu_to_le64(adapter->tx_queue.tx_ring.basePA);
-        tqc->dataRingBasePA = cpu_to_le64(adapter->tx_queue.data_ring.basePA);
-        tqc->compRingBasePA = cpu_to_le64(adapter->tx_queue.comp_ring.basePA);
-        tqc->ddPA           = cpu_to_le64(virt_to_phys(
-                                                adapter->tx_queue.buf_info));
-        tqc->txRingSize     = cpu_to_le32(adapter->tx_queue.tx_ring.size);
-        tqc->dataRingSize   = cpu_to_le32(adapter->tx_queue.data_ring.size);
-        tqc->compRingSize   = cpu_to_le32(adapter->tx_queue.comp_ring.size);
-        tqc->ddLen          = cpu_to_le32(sizeof(struct vmxnet3_tx_buf_info) *
-                              tqc->txRingSize);
-        tqc->intrIdx        = adapter->tx_queue.comp_ring.intr_idx;
+        devRead->misc.numTxQueues =  adapter->num_tx_queues;
+        for (i = 0; i < adapter->num_tx_queues; i++) {
+                struct vmxnet3_tx_queue *tq = &adapter->tx_queue[i];
+                BUG_ON(adapter->tx_queue[i].tx_ring.base == NULL);
+                tqc = &adapter->tqd_start[i].conf;
+                tqc->txRingBasePA   = cpu_to_le64(tq->tx_ring.basePA);
+                tqc->dataRingBasePA = cpu_to_le64(tq->data_ring.basePA);
+                tqc->compRingBasePA = cpu_to_le64(tq->comp_ring.basePA);
+                tqc->ddPA           = cpu_to_le64(virt_to_phys(tq->buf_info));
+                tqc->txRingSize     = cpu_to_le32(tq->tx_ring.size);
+                tqc->dataRingSize   = cpu_to_le32(tq->data_ring.size);
+                tqc->compRingSize   = cpu_to_le32(tq->comp_ring.size);
+                tqc->ddLen          = cpu_to_le32(
+                                        sizeof(struct vmxnet3_tx_buf_info) *
+                                        tqc->txRingSize);
+                tqc->intrIdx        = tq->comp_ring.intr_idx;
+        }
 
         /* rx queue settings */
-        devRead->misc.numRxQueues = 1;
-        rqc = &adapter->rqd_start->conf;
-        rqc->rxRingBasePA[0] = cpu_to_le64(adapter->rx_queue.rx_ring[0].basePA);
-        rqc->rxRingBasePA[1] = cpu_to_le64(adapter->rx_queue.rx_ring[1].basePA);
-        rqc->compRingBasePA  = cpu_to_le64(adapter->rx_queue.comp_ring.basePA);
-        rqc->ddPA            = cpu_to_le64(virt_to_phys(
-                                                adapter->rx_queue.buf_info));
-        rqc->rxRingSize[0]   = cpu_to_le32(adapter->rx_queue.rx_ring[0].size);
-        rqc->rxRingSize[1]   = cpu_to_le32(adapter->rx_queue.rx_ring[1].size);
-        rqc->compRingSize    = cpu_to_le32(adapter->rx_queue.comp_ring.size);
-        rqc->ddLen           = cpu_to_le32(sizeof(struct vmxnet3_rx_buf_info) *
-                               (rqc->rxRingSize[0] + rqc->rxRingSize[1]));
-        rqc->intrIdx         = adapter->rx_queue.comp_ring.intr_idx;
+        devRead->misc.numRxQueues = adapter->num_rx_queues;
+        for (i = 0; i < adapter->num_rx_queues; i++) {
+                struct vmxnet3_rx_queue *rq = &adapter->rx_queue[i];
+                rqc = &adapter->rqd_start[i].conf;
+                rqc->rxRingBasePA[0] = cpu_to_le64(rq->rx_ring[0].basePA);
+                rqc->rxRingBasePA[1] = cpu_to_le64(rq->rx_ring[1].basePA);
+                rqc->compRingBasePA  = cpu_to_le64(rq->comp_ring.basePA);
+                rqc->ddPA            = cpu_to_le64(virt_to_phys(
+                                                        rq->buf_info));
+                rqc->rxRingSize[0]   = cpu_to_le32(rq->rx_ring[0].size);
+                rqc->rxRingSize[1]   = cpu_to_le32(rq->rx_ring[1].size);
+                rqc->compRingSize    = cpu_to_le32(rq->comp_ring.size);
+                rqc->ddLen           = cpu_to_le32(
+                                        sizeof(struct vmxnet3_rx_buf_info) *
+                                        (rqc->rxRingSize[0] +
+                                         rqc->rxRingSize[1]));
+                rqc->intrIdx         = rq->comp_ring.intr_idx;
+        }
+
+#ifdef VMXNET3_RSS
+        memset(adapter->rss_conf, 0, sizeof(*adapter->rss_conf));
+
+        if (adapter->rss) {
+                struct UPT1_RSSConf *rssConf = adapter->rss_conf;
+                devRead->misc.uptFeatures |= UPT1_F_RSS;
+                devRead->misc.numRxQueues = adapter->num_rx_queues;
+                rssConf->hashType = UPT1_RSS_HASH_TYPE_TCP_IPV4 |
+                                    UPT1_RSS_HASH_TYPE_IPV4 |
+                                    UPT1_RSS_HASH_TYPE_TCP_IPV6 |
+                                    UPT1_RSS_HASH_TYPE_IPV6;
+                rssConf->hashFunc = UPT1_RSS_HASH_FUNC_TOEPLITZ;
+                rssConf->hashKeySize = UPT1_RSS_MAX_KEY_SIZE;
+                rssConf->indTableSize = VMXNET3_RSS_IND_TABLE_SIZE;
+                get_random_bytes(&rssConf->hashKey[0], rssConf->hashKeySize);
+                for (i = 0; i < rssConf->indTableSize; i++)
+                        rssConf->indTable[i] = i % adapter->num_rx_queues;
+
+                devRead->rssConfDesc.confVer = 1;
+                devRead->rssConfDesc.confLen = sizeof(*rssConf);
+                devRead->rssConfDesc.confPA  = virt_to_phys(rssConf);
+        }
+
+#endif /* VMXNET3_RSS */
 
         /* intr settings */
         devRead->intrConf.autoMask = adapter->intr.mask_mode ==
@@ -1829,18 +2171,18 @@ vmxnet3_setup_driver_shared(struct vmxnet3_adapter *adapter)
 int
 vmxnet3_activate_dev(struct vmxnet3_adapter *adapter)
 {
-        int err;
+        int err, i;
         u32 ret;
 
-        dev_dbg(&adapter->netdev->dev,
-                "%s: skb_buf_size %d, rx_buf_per_pkt %d, ring sizes"
-                " %u %u %u\n", adapter->netdev->name, adapter->skb_buf_size,
-                adapter->rx_buf_per_pkt, adapter->tx_queue.tx_ring.size,
-                adapter->rx_queue.rx_ring[0].size,
-                adapter->rx_queue.rx_ring[1].size);
-
-        vmxnet3_tq_init(&adapter->tx_queue, adapter);
-        err = vmxnet3_rq_init(&adapter->rx_queue, adapter);
+        dev_dbg(&adapter->netdev->dev, "%s: skb_buf_size %d, rx_buf_per_pkt %d,"
+                " ring sizes %u %u %u\n", adapter->netdev->name,
+                adapter->skb_buf_size, adapter->rx_buf_per_pkt,
+                adapter->tx_queue[0].tx_ring.size,
+                adapter->rx_queue[0].rx_ring[0].size,
+                adapter->rx_queue[0].rx_ring[1].size);
+
+        vmxnet3_tq_init_all(adapter);
+        err = vmxnet3_rq_init_all(adapter);
         if (err) {
                 printk(KERN_ERR "Failed to init rx queue for %s: error %d\n",
                        adapter->netdev->name, err);
@@ -1870,10 +2212,15 @@ vmxnet3_activate_dev(struct vmxnet3_adapter *adapter)
                 err = -EINVAL;
                 goto activate_err;
         }
-        VMXNET3_WRITE_BAR0_REG(adapter, VMXNET3_REG_RXPROD,
-                               adapter->rx_queue.rx_ring[0].next2fill);
-        VMXNET3_WRITE_BAR0_REG(adapter, VMXNET3_REG_RXPROD2,
-                               adapter->rx_queue.rx_ring[1].next2fill);
+
+        for (i = 0; i < adapter->num_rx_queues; i++) {
+                VMXNET3_WRITE_BAR0_REG(adapter,
+                                VMXNET3_REG_RXPROD + i * VMXNET3_REG_ALIGN,
+                                adapter->rx_queue[i].rx_ring[0].next2fill);
+                VMXNET3_WRITE_BAR0_REG(adapter, (VMXNET3_REG_RXPROD2 +
+                                (i * VMXNET3_REG_ALIGN)),
+                                adapter->rx_queue[i].rx_ring[1].next2fill);
+        }
 
         /* Apply the rx filter settins last. */
         vmxnet3_set_mc(adapter->netdev);
@@ -1883,8 +2230,8 @@ vmxnet3_activate_dev(struct vmxnet3_adapter *adapter)
          * tx queue if the link is up.
          */
         vmxnet3_check_link(adapter, true);
-
-        napi_enable(&adapter->napi);
+        for (i = 0; i < adapter->num_rx_queues; i++)
+                napi_enable(&adapter->rx_queue[i].napi);
         vmxnet3_enable_all_intrs(adapter);
         clear_bit(VMXNET3_STATE_BIT_QUIESCED, &adapter->state);
         return 0;
@@ -1896,7 +2243,7 @@ activate_err:
 irq_err:
 rq_err:
         /* free up buffers we allocated */
-        vmxnet3_rq_cleanup(&adapter->rx_queue, adapter);
+        vmxnet3_rq_cleanup_all(adapter);
         return err;
 }
 
@@ -1911,6 +2258,7 @@ vmxnet3_reset_dev(struct vmxnet3_adapter *adapter)
 int
 vmxnet3_quiesce_dev(struct vmxnet3_adapter *adapter)
 {
+        int i;
         if (test_and_set_bit(VMXNET3_STATE_BIT_QUIESCED, &adapter->state))
                 return 0;
 
@@ -1919,13 +2267,14 @@ vmxnet3_quiesce_dev(struct vmxnet3_adapter *adapter)
                                VMXNET3_CMD_QUIESCE_DEV);
         vmxnet3_disable_all_intrs(adapter);
 
-        napi_disable(&adapter->napi);
+        for (i = 0; i < adapter->num_rx_queues; i++)
+                napi_disable(&adapter->rx_queue[i].napi);
         netif_tx_disable(adapter->netdev);
         adapter->link_speed = 0;
         netif_carrier_off(adapter->netdev);
 
-        vmxnet3_tq_cleanup(&adapter->tx_queue, adapter);
-        vmxnet3_rq_cleanup(&adapter->rx_queue, adapter);
+        vmxnet3_tq_cleanup_all(adapter);
+        vmxnet3_rq_cleanup_all(adapter);
         vmxnet3_free_irqs(adapter);
         return 0;
 }
@@ -2047,7 +2396,9 @@ vmxnet3_free_pci_resources(struct vmxnet3_adapter *adapter)
 static void
 vmxnet3_adjust_rx_ring_size(struct vmxnet3_adapter *adapter)
 {
-        size_t sz;
+        size_t sz, i, ring0_size, ring1_size, comp_size;
+        struct vmxnet3_rx_queue *rq = &adapter->rx_queue[0];
+
 
         if (adapter->netdev->mtu <= VMXNET3_MAX_SKB_BUF_SIZE -
                                     VMXNET3_MAX_ETH_HDR_SIZE) {
@@ -2069,11 +2420,19 @@ vmxnet3_adjust_rx_ring_size(struct vmxnet3_adapter *adapter)
          * rx_buf_per_pkt * VMXNET3_RING_SIZE_ALIGN
          */
         sz = adapter->rx_buf_per_pkt * VMXNET3_RING_SIZE_ALIGN;
-        adapter->rx_queue.rx_ring[0].size = (adapter->rx_queue.rx_ring[0].size +
-                                             sz - 1) / sz * sz;
-        adapter->rx_queue.rx_ring[0].size = min_t(u32,
-                                            adapter->rx_queue.rx_ring[0].size,
-                                            VMXNET3_RX_RING_MAX_SIZE / sz * sz);
+        ring0_size = adapter->rx_queue[0].rx_ring[0].size;
+        ring0_size = (ring0_size + sz - 1) / sz * sz;
+        ring0_size = min_t(u32, rq->rx_ring[0].size, VMXNET3_RX_RING_MAX_SIZE /
+                           sz * sz);
+        ring1_size = adapter->rx_queue[0].rx_ring[1].size;
+        comp_size = ring0_size + ring1_size;
+
+        for (i = 0; i < adapter->num_rx_queues; i++) {
+                rq = &adapter->rx_queue[i];
+                rq->rx_ring[0].size = ring0_size;
+                rq->rx_ring[1].size = ring1_size;
+                rq->comp_ring.size = comp_size;
+        }
 }
 
 
@@ -2081,29 +2440,53 @@ int
 vmxnet3_create_queues(struct vmxnet3_adapter *adapter, u32 tx_ring_size,
                       u32 rx_ring_size, u32 rx_ring2_size)
 {
-        int err;
-
-        adapter->tx_queue.tx_ring.size   = tx_ring_size;
-        adapter->tx_queue.data_ring.size = tx_ring_size;
-        adapter->tx_queue.comp_ring.size = tx_ring_size;
-        adapter->tx_queue.shared = &adapter->tqd_start->ctrl;
-        adapter->tx_queue.stopped = true;
-        err = vmxnet3_tq_create(&adapter->tx_queue, adapter);
-        if (err)
-                return err;
+        int err = 0, i;
+
+        for (i = 0; i < adapter->num_tx_queues; i++) {
+                struct vmxnet3_tx_queue *tq = &adapter->tx_queue[i];
+                tq->tx_ring.size   = tx_ring_size;
+                tq->data_ring.size = tx_ring_size;
+                tq->comp_ring.size = tx_ring_size;
+                tq->shared = &adapter->tqd_start[i].ctrl;
+                tq->stopped = true;
+                tq->adapter = adapter;
+                tq->qid = i;
+                err = vmxnet3_tq_create(tq, adapter);
+                /*
+                 * Too late to change num_tx_queues. We cannot do away with
+                 * lesser number of queues than what we asked for
+                 */
+                if (err)
+                        goto queue_err;
+        }
 
-        adapter->rx_queue.rx_ring[0].size = rx_ring_size;
-        adapter->rx_queue.rx_ring[1].size = rx_ring2_size;
+        adapter->rx_queue[0].rx_ring[0].size = rx_ring_size;
+        adapter->rx_queue[0].rx_ring[1].size = rx_ring2_size;
         vmxnet3_adjust_rx_ring_size(adapter);
-        adapter->rx_queue.comp_ring.size  = adapter->rx_queue.rx_ring[0].size +
-                                            adapter->rx_queue.rx_ring[1].size;
-        adapter->rx_queue.qid  = 0;
-        adapter->rx_queue.qid2 = 1;
-        adapter->rx_queue.shared = &adapter->rqd_start->ctrl;
-        err = vmxnet3_rq_create(&adapter->rx_queue, adapter);
-        if (err)
-                vmxnet3_tq_destroy(&adapter->tx_queue, adapter);
-
+        for (i = 0; i < adapter->num_rx_queues; i++) {
+                struct vmxnet3_rx_queue *rq = &adapter->rx_queue[i];
+                /* qid and qid2 for rx queues will be assigned later when num
+                 * of rx queues is finalized after allocating intrs */
+                rq->shared = &adapter->rqd_start[i].ctrl;
+                rq->adapter = adapter;
+                err = vmxnet3_rq_create(rq, adapter);
+                if (err) {
+                        if (i == 0) {
+                                printk(KERN_ERR "Could not allocate any rx"
+                                       "queues. Aborting.\n");
+                                goto queue_err;
+                        } else {
+                                printk(KERN_INFO "Number of rx queues changed "
+                                       "to : %d.\n", i);
+                                adapter->num_rx_queues = i;
+                                err = 0;
+                                break;
+                        }
+                }
+        }
+        return err;
+queue_err:
+        vmxnet3_tq_destroy_all(adapter);
         return err;
 }
 
@@ -2111,11 +2494,12 @@ static int
 vmxnet3_open(struct net_device *netdev)
 {
         struct vmxnet3_adapter *adapter;
-        int err;
+        int err, i;
 
         adapter = netdev_priv(netdev);
 
-        spin_lock_init(&adapter->tx_queue.tx_lock);
+        for (i = 0; i < adapter->num_tx_queues; i++)
+                spin_lock_init(&adapter->tx_queue[i].tx_lock);
 
         err = vmxnet3_create_queues(adapter, VMXNET3_DEF_TX_RING_SIZE,
                                     VMXNET3_DEF_RX_RING_SIZE,
@@ -2130,8 +2514,8 @@ vmxnet3_open(struct net_device *netdev)
         return 0;
 
 activate_err:
-        vmxnet3_rq_destroy(&adapter->rx_queue, adapter);
-        vmxnet3_tq_destroy(&adapter->tx_queue, adapter);
+        vmxnet3_rq_destroy_all(adapter);
+        vmxnet3_tq_destroy_all(adapter);
 queue_err:
         return err;
 }
@@ -2151,8 +2535,8 @@ vmxnet3_close(struct net_device *netdev)
 
         vmxnet3_quiesce_dev(adapter);
 
-        vmxnet3_rq_destroy(&adapter->rx_queue, adapter);
-        vmxnet3_tq_destroy(&adapter->tx_queue, adapter);
+        vmxnet3_rq_destroy_all(adapter);
+        vmxnet3_tq_destroy_all(adapter);
 
         clear_bit(VMXNET3_STATE_BIT_RESETTING, &adapter->state);
 
@@ -2164,6 +2548,8 @@ vmxnet3_close(struct net_device *netdev)
 void
 vmxnet3_force_close(struct vmxnet3_adapter *adapter)
 {
+        int i;
+
         /*
          * we must clear VMXNET3_STATE_BIT_RESETTING, otherwise
          * vmxnet3_close() will deadlock.
@@ -2171,7 +2557,8 @@ vmxnet3_force_close(struct vmxnet3_adapter *adapter)
         BUG_ON(test_bit(VMXNET3_STATE_BIT_RESETTING, &adapter->state));
 
         /* we need to enable NAPI, otherwise dev_close will deadlock */
-        napi_enable(&adapter->napi);
+        for (i = 0; i < adapter->num_rx_queues; i++)
+                napi_enable(&adapter->rx_queue[i].napi);
         dev_close(adapter->netdev);
 }
 
@@ -2202,14 +2589,11 @@ vmxnet3_change_mtu(struct net_device *netdev, int new_mtu)
                 vmxnet3_reset_dev(adapter);
 
                 /* we need to re-create the rx queue based on the new mtu */
-                vmxnet3_rq_destroy(&adapter->rx_queue, adapter);
+                vmxnet3_rq_destroy_all(adapter);
                 vmxnet3_adjust_rx_ring_size(adapter);
-                adapter->rx_queue.comp_ring.size  =
-                                        adapter->rx_queue.rx_ring[0].size +
-                                        adapter->rx_queue.rx_ring[1].size;
-                err = vmxnet3_rq_create(&adapter->rx_queue, adapter);
+                err = vmxnet3_rq_create_all(adapter);
                 if (err) {
-                        printk(KERN_ERR "%s: failed to re-create rx queue,"
+                        printk(KERN_ERR "%s: failed to re-create rx queues,"
                                 " error %d. Closing it.\n", netdev->name, err);
                         goto out;
                 }
@@ -2274,6 +2658,55 @@ vmxnet3_read_mac_addr(struct vmxnet3_adapter *adapter, u8 *mac)
         mac[5] = (tmp >> 8) & 0xff;
 }
 
+#ifdef CONFIG_PCI_MSI
+
+/*
+ * Enable MSIx vectors.
+ * Returns :
+ *      0 on successful enabling of required vectors,
+ *      VMXNET3_LINUX_MIN_MSIX_VECT when only minumum number of vectors required
+ *       could be enabled.
+ *      number of vectors which can be enabled otherwise (this number is smaller
+ *       than VMXNET3_LINUX_MIN_MSIX_VECT)
+ */
+
+static int
+vmxnet3_acquire_msix_vectors(struct vmxnet3_adapter *adapter,
+                             int vectors)
+{
+        int err = 0, vector_threshold;
+        vector_threshold = VMXNET3_LINUX_MIN_MSIX_VECT;
+
+        while (vectors >= vector_threshold) {
+                err = pci_enable_msix(adapter->pdev, adapter->intr.msix_entries,
+                                      vectors);
+                if (!err) {
+                        adapter->intr.num_intrs = vectors;
+                        return 0;
+                } else if (err < 0) {
+                        printk(KERN_ERR "Failed to enable MSI-X for %s, error"
+                               " %d\n", adapter->netdev->name, err);
+                        vectors = 0;
+                } else if (err < vector_threshold) {
+                        break;
+                } else {
+                        /* If fails to enable required number of MSI-x vectors
+                         * try enabling 3 of them. One each for rx, tx and event
+                         */
+                        vectors = vector_threshold;
+                        printk(KERN_ERR "Failed to enable %d MSI-X for %s, try"
+                               " %d instead\n", vectors, adapter->netdev->name,
+                               vector_threshold);
+                }
+        }
+
+        printk(KERN_INFO "Number of MSI-X interrupts which can be allocatedi"
+               " are lower than min threshold required.\n");
+        return err;
+}
+
+
+#endif /* CONFIG_PCI_MSI */
 
 static void
 vmxnet3_alloc_intr_resources(struct vmxnet3_adapter *adapter)
@@ -2293,16 +2726,47 @@ vmxnet3_alloc_intr_resources(struct vmxnet3_adapter *adapter)
 
 #ifdef CONFIG_PCI_MSI
         if (adapter->intr.type == VMXNET3_IT_MSIX) {
-                int err;
-
-                adapter->intr.msix_entries[0].entry = 0;
-                err = pci_enable_msix(adapter->pdev, adapter->intr.msix_entries,
-                                      VMXNET3_LINUX_MAX_MSIX_VECT);
-                if (!err) {
-                        adapter->intr.num_intrs = 1;
-                        adapter->intr.type = VMXNET3_IT_MSIX;
+                int vector, err = 0;
+
+                adapter->intr.num_intrs = (adapter->share_intr ==
+                                           VMXNET3_INTR_TXSHARE) ? 1 :
+                                           adapter->num_tx_queues;
+                adapter->intr.num_intrs += (adapter->share_intr ==
+                                           VMXNET3_INTR_BUDDYSHARE) ? 0 :
+                                           adapter->num_rx_queues;
+                adapter->intr.num_intrs += 1;           /* for link event */
+
+                adapter->intr.num_intrs = (adapter->intr.num_intrs >
+                                           VMXNET3_LINUX_MIN_MSIX_VECT
+                                           ? adapter->intr.num_intrs :
+                                           VMXNET3_LINUX_MIN_MSIX_VECT);
+
+                for (vector = 0; vector < adapter->intr.num_intrs; vector++)
+                        adapter->intr.msix_entries[vector].entry = vector;
+
+                err = vmxnet3_acquire_msix_vectors(adapter,
+                                                   adapter->intr.num_intrs);
+                /* If we cannot allocate one MSIx vector per queue
+                 * then limit the number of rx queues to 1
+                 */
+                if (err == VMXNET3_LINUX_MIN_MSIX_VECT) {
+                        if (adapter->share_intr != VMXNET3_INTR_BUDDYSHARE
+                            || adapter->num_rx_queues != 2) {
+                                adapter->share_intr = VMXNET3_INTR_TXSHARE;
+                                printk(KERN_ERR "Number of rx queues : 1\n");
+                                adapter->num_rx_queues = 1;
+                                adapter->intr.num_intrs =
+                                                VMXNET3_LINUX_MIN_MSIX_VECT;
+                        }
                         return;
                 }
+                if (!err)
+                        return;
+
+                /* If we cannot allocate MSIx vectors use only one rx queue */
+                printk(KERN_INFO "Failed to enable MSI-X for %s, error %d."
+                       "#rx queues : 1, try MSI\n", adapter->netdev->name, err);
+
                 adapter->intr.type = VMXNET3_IT_MSI;
         }
 
@@ -2310,12 +2774,15 @@ vmxnet3_alloc_intr_resources(struct vmxnet3_adapter *adapter)
                 int err;
                 err = pci_enable_msi(adapter->pdev);
                 if (!err) {
+                        adapter->num_rx_queues = 1;
                         adapter->intr.num_intrs = 1;
                         return;
                 }
         }
 #endif /* CONFIG_PCI_MSI */
 
+        adapter->num_rx_queues = 1;
+        printk(KERN_INFO "Using INTx interrupt, #Rx queues: 1.\n");
         adapter->intr.type = VMXNET3_IT_INTX;
 
         /* INT-X related setting */
@@ -2343,6 +2810,7 @@ vmxnet3_tx_timeout(struct net_device *netdev)
 
         printk(KERN_ERR "%s: tx hang\n", adapter->netdev->name);
         schedule_work(&adapter->work);
+        netif_wake_queue(adapter->netdev);
 }
 
 
@@ -2399,8 +2867,29 @@ vmxnet3_probe_device(struct pci_dev *pdev,
         struct net_device *netdev;
         struct vmxnet3_adapter *adapter;
         u8 mac[ETH_ALEN];
+        int size;
+        int num_tx_queues;
+        int num_rx_queues;
+
+#ifdef VMXNET3_RSS
+        if (enable_mq)
+                num_rx_queues = min(VMXNET3_DEVICE_MAX_RX_QUEUES,
+                                    (int)num_online_cpus());
+        else
+#endif
+                num_rx_queues = 1;
+
+        if (enable_mq)
+                num_tx_queues = min(VMXNET3_DEVICE_MAX_TX_QUEUES,
+                                    (int)num_online_cpus());
+        else
+                num_tx_queues = 1;
+
+        netdev = alloc_etherdev_mq(sizeof(struct vmxnet3_adapter),
+                                   max(num_tx_queues, num_rx_queues));
+        printk(KERN_INFO "# of Tx queues : %d, # of Rx queues : %d\n",
+               num_tx_queues, num_rx_queues);
 
-        netdev = alloc_etherdev(sizeof(struct vmxnet3_adapter));
         if (!netdev) {
                 printk(KERN_ERR "Failed to alloc ethernet device for adapter "
                         "%s\n", pci_name(pdev));
@@ -2422,9 +2911,12 @@ vmxnet3_probe_device(struct pci_dev *pdev,
                 goto err_alloc_shared;
         }
 
-        adapter->tqd_start = pci_alloc_consistent(adapter->pdev,
-                             sizeof(struct Vmxnet3_TxQueueDesc) +
-                             sizeof(struct Vmxnet3_RxQueueDesc),
+        adapter->num_rx_queues = num_rx_queues;
+        adapter->num_tx_queues = num_tx_queues;
+
+        size = sizeof(struct Vmxnet3_TxQueueDesc) * adapter->num_tx_queues;
+        size += sizeof(struct Vmxnet3_RxQueueDesc) * adapter->num_rx_queues;
+        adapter->tqd_start = pci_alloc_consistent(adapter->pdev, size,
                              &adapter->queue_desc_pa);
 
         if (!adapter->tqd_start) {
@@ -2433,8 +2925,8 @@ vmxnet3_probe_device(struct pci_dev *pdev,
                 err = -ENOMEM;
                 goto err_alloc_queue_desc;
         }
-        adapter->rqd_start = (struct Vmxnet3_RxQueueDesc *)(adapter->tqd_start
-                                                            + 1);
+        adapter->rqd_start = (struct Vmxnet3_RxQueueDesc *)(adapter->tqd_start +
+                                                        adapter->num_tx_queues);
 
         adapter->pm_conf = kmalloc(sizeof(struct Vmxnet3_PMConf), GFP_KERNEL);
         if (adapter->pm_conf == NULL) {
@@ -2444,6 +2936,17 @@ vmxnet3_probe_device(struct pci_dev *pdev,
                 goto err_alloc_pm;
         }
 
+#ifdef VMXNET3_RSS
+
+        adapter->rss_conf = kmalloc(sizeof(struct UPT1_RSSConf), GFP_KERNEL);
+        if (adapter->rss_conf == NULL) {
+                printk(KERN_ERR "Failed to allocate memory for %s\n",
+                       pci_name(pdev));
+                err = -ENOMEM;
+                goto err_alloc_rss;
+        }
+#endif /* VMXNET3_RSS */
+
         err = vmxnet3_alloc_pci_resources(adapter, &dma64);
         if (err < 0)
                 goto err_alloc_pci;
@@ -2471,18 +2974,48 @@ vmxnet3_probe_device(struct pci_dev *pdev,
         vmxnet3_declare_features(adapter, dma64);
 
         adapter->dev_number = atomic_read(&devices_found);
+
+         adapter->share_intr = irq_share_mode;
+        if (adapter->share_intr == VMXNET3_INTR_BUDDYSHARE &&
+            adapter->num_tx_queues != adapter->num_rx_queues)
+                adapter->share_intr = VMXNET3_INTR_DONTSHARE;
+
         vmxnet3_alloc_intr_resources(adapter);
 
+#ifdef VMXNET3_RSS
+        if (adapter->num_rx_queues > 1 &&
+            adapter->intr.type == VMXNET3_IT_MSIX) {
+                adapter->rss = true;
+                printk(KERN_INFO "RSS is enabled.\n");
+        } else {
+                adapter->rss = false;
+        }
+#endif
+
         vmxnet3_read_mac_addr(adapter, mac);
         memcpy(netdev->dev_addr,  mac, netdev->addr_len);
 
         netdev->netdev_ops = &vmxnet3_netdev_ops;
-        netdev->watchdog_timeo = 5 * HZ;
         vmxnet3_set_ethtool_ops(netdev);
+        netdev->watchdog_timeo = 5 * HZ;
 
         INIT_WORK(&adapter->work, vmxnet3_reset_work);
 
-        netif_napi_add(netdev, &adapter->napi, vmxnet3_poll, 64);
+        if (adapter->intr.type == VMXNET3_IT_MSIX) {
+                int i;
+                for (i = 0; i < adapter->num_rx_queues; i++) {
+                        netif_napi_add(adapter->netdev,
+                                       &adapter->rx_queue[i].napi,
+                                       vmxnet3_poll_rx_only, 64);
+                }
+        } else {
+                netif_napi_add(adapter->netdev, &adapter->rx_queue[0].napi,
+                               vmxnet3_poll, 64);
+        }
+
+        netif_set_real_num_tx_queues(adapter->netdev, adapter->num_tx_queues);
+        netif_set_real_num_rx_queues(adapter->netdev, adapter->num_rx_queues);
+
         SET_NETDEV_DEV(netdev, &pdev->dev);
         err = register_netdev(netdev);
 
@@ -2502,11 +3035,14 @@ err_register:
 err_ver:
         vmxnet3_free_pci_resources(adapter);
 err_alloc_pci:
+#ifdef VMXNET3_RSS
+        kfree(adapter->rss_conf);
+err_alloc_rss:
+#endif
         kfree(adapter->pm_conf);
 err_alloc_pm:
-        pci_free_consistent(adapter->pdev, sizeof(struct Vmxnet3_TxQueueDesc) +
-                            sizeof(struct Vmxnet3_RxQueueDesc),
-                            adapter->tqd_start, adapter->queue_desc_pa);
+        pci_free_consistent(adapter->pdev, size, adapter->tqd_start,
+                            adapter->queue_desc_pa);
 err_alloc_queue_desc:
         pci_free_consistent(adapter->pdev, sizeof(struct Vmxnet3_DriverShared),
                             adapter->shared, adapter->shared_pa);
@@ -2522,6 +3058,16 @@ vmxnet3_remove_device(struct pci_dev *pdev)
 {
         struct net_device *netdev = pci_get_drvdata(pdev);
         struct vmxnet3_adapter *adapter = netdev_priv(netdev);
+        int size = 0;
+        int num_rx_queues;
+
+#ifdef VMXNET3_RSS
+        if (enable_mq)
+                num_rx_queues = min(VMXNET3_DEVICE_MAX_RX_QUEUES,
+                                    (int)num_online_cpus());
+        else
+#endif
+                num_rx_queues = 1;
 
         flush_scheduled_work();
 
@@ -2529,10 +3075,15 @@ vmxnet3_remove_device(struct pci_dev *pdev)
 
         vmxnet3_free_intr_resources(adapter);
         vmxnet3_free_pci_resources(adapter);
+#ifdef VMXNET3_RSS
+        kfree(adapter->rss_conf);
+#endif
         kfree(adapter->pm_conf);
-        pci_free_consistent(adapter->pdev, sizeof(struct Vmxnet3_TxQueueDesc) +
-                            sizeof(struct Vmxnet3_RxQueueDesc),
-                            adapter->tqd_start, adapter->queue_desc_pa);
+
+        size = sizeof(struct Vmxnet3_TxQueueDesc) * adapter->num_tx_queues;
+        size += sizeof(struct Vmxnet3_RxQueueDesc) * num_rx_queues;
+        pci_free_consistent(adapter->pdev, size, adapter->tqd_start,
+                            adapter->queue_desc_pa);
         pci_free_consistent(adapter->pdev, sizeof(struct Vmxnet3_DriverShared),
                             adapter->shared, adapter->shared_pa);
         free_netdev(netdev);
@@ -2563,7 +3114,7 @@ vmxnet3_suspend(struct device *device)
         vmxnet3_free_intr_resources(adapter);
 
         netif_device_detach(netdev);
-        netif_stop_queue(netdev);
+        netif_tx_stop_all_queues(netdev);
 
         /* Create wake-up filters. */
         pmConf = adapter->pm_conf;
diff --git a/drivers/net/vmxnet3/vmxnet3_ethtool.c b/drivers/net/vmxnet3/vmxnet3_ethtool.c
index b79070bcc92..8e17fc8a7fe 100644
--- a/drivers/net/vmxnet3/vmxnet3_ethtool.c
+++ b/drivers/net/vmxnet3/vmxnet3_ethtool.c
@@ -151,44 +151,42 @@ vmxnet3_get_stats(struct net_device *netdev)
         struct UPT1_TxStats *devTxStats;
         struct UPT1_RxStats *devRxStats;
         struct net_device_stats *net_stats = &netdev->stats;
+        int i;
 
         adapter = netdev_priv(netdev);
 
         /* Collect the dev stats into the shared area */
         VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD, VMXNET3_CMD_GET_STATS);
 
-        /* Assuming that we have a single queue device */
-        devTxStats = &adapter->tqd_start->stats;
-        devRxStats = &adapter->rqd_start->stats;
-
-        /* Get access to the driver stats per queue */
-        drvTxStats = &adapter->tx_queue.stats;
-        drvRxStats = &adapter->rx_queue.stats;
-
         memset(net_stats, 0, sizeof(*net_stats));
+        for (i = 0; i < adapter->num_tx_queues; i++) {
+                devTxStats = &adapter->tqd_start[i].stats;
+                drvTxStats = &adapter->tx_queue[i].stats;
+                net_stats->tx_packets += devTxStats->ucastPktsTxOK +
+                                        devTxStats->mcastPktsTxOK +
+                                        devTxStats->bcastPktsTxOK;
+                net_stats->tx_bytes += devTxStats->ucastBytesTxOK +
+                                      devTxStats->mcastBytesTxOK +
+                                      devTxStats->bcastBytesTxOK;
+                net_stats->tx_errors += devTxStats->pktsTxError;
+                net_stats->tx_dropped += drvTxStats->drop_total;
+        }
 
-        net_stats->rx_packets = devRxStats->ucastPktsRxOK +
-                                devRxStats->mcastPktsRxOK +
-                                devRxStats->bcastPktsRxOK;
-
-        net_stats->tx_packets = devTxStats->ucastPktsTxOK +
-                                devTxStats->mcastPktsTxOK +
-                                devTxStats->bcastPktsTxOK;
-
-        net_stats->rx_bytes = devRxStats->ucastBytesRxOK +
-                              devRxStats->mcastBytesRxOK +
-                              devRxStats->bcastBytesRxOK;
-
-        net_stats->tx_bytes = devTxStats->ucastBytesTxOK +
-                              devTxStats->mcastBytesTxOK +
-                              devTxStats->bcastBytesTxOK;
+        for (i = 0; i < adapter->num_rx_queues; i++) {
+                devRxStats = &adapter->rqd_start[i].stats;
+                drvRxStats = &adapter->rx_queue[i].stats;
+                net_stats->rx_packets += devRxStats->ucastPktsRxOK +
+                                        devRxStats->mcastPktsRxOK +
+                                        devRxStats->bcastPktsRxOK;
 
-        net_stats->rx_errors = devRxStats->pktsRxError;
-        net_stats->tx_errors = devTxStats->pktsTxError;
-        net_stats->rx_dropped = drvRxStats->drop_total;
-        net_stats->tx_dropped = drvTxStats->drop_total;
-        net_stats->multicast =  devRxStats->mcastPktsRxOK;
+                net_stats->rx_bytes += devRxStats->ucastBytesRxOK +
+                                      devRxStats->mcastBytesRxOK +
+                                      devRxStats->bcastBytesRxOK;
 
+                net_stats->rx_errors += devRxStats->pktsRxError;
+                net_stats->rx_dropped += drvRxStats->drop_total;
+                net_stats->multicast +=  devRxStats->mcastPktsRxOK;
+        }
         return net_stats;
 }
 
@@ -307,24 +305,26 @@ vmxnet3_get_ethtool_stats(struct net_device *netdev,
         struct vmxnet3_adapter *adapter = netdev_priv(netdev);
         u8 *base;
         int i;
+        int j = 0;
 
         VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD, VMXNET3_CMD_GET_STATS);
 
         /* this does assume each counter is 64-bit wide */
+/* TODO change this for multiple queues */
 
-        base = (u8 *)&adapter->tqd_start->stats;
+        base = (u8 *)&adapter->tqd_start[j].stats;
         for (i = 0; i < ARRAY_SIZE(vmxnet3_tq_dev_stats); i++)
                 *buf++ = *(u64 *)(base + vmxnet3_tq_dev_stats[i].offset);
 
-        base = (u8 *)&adapter->tx_queue.stats;
+        base = (u8 *)&adapter->tx_queue[j].stats;
         for (i = 0; i < ARRAY_SIZE(vmxnet3_tq_driver_stats); i++)
                 *buf++ = *(u64 *)(base + vmxnet3_tq_driver_stats[i].offset);
 
-        base = (u8 *)&adapter->rqd_start->stats;
+        base = (u8 *)&adapter->rqd_start[j].stats;
         for (i = 0; i < ARRAY_SIZE(vmxnet3_rq_dev_stats); i++)
                 *buf++ = *(u64 *)(base + vmxnet3_rq_dev_stats[i].offset);
 
-        base = (u8 *)&adapter->rx_queue.stats;
+        base = (u8 *)&adapter->rx_queue[j].stats;
         for (i = 0; i < ARRAY_SIZE(vmxnet3_rq_driver_stats); i++)
                 *buf++ = *(u64 *)(base + vmxnet3_rq_driver_stats[i].offset);
 
@@ -339,6 +339,7 @@ vmxnet3_get_regs(struct net_device *netdev, struct ethtool_regs *regs, void *p)
 {
         struct vmxnet3_adapter *adapter = netdev_priv(netdev);
         u32 *buf = p;
+        int i = 0;
 
         memset(p, 0, vmxnet3_get_regs_len(netdev));
 
@@ -347,28 +348,29 @@ vmxnet3_get_regs(struct net_device *netdev, struct ethtool_regs *regs, void *p)
         /* Update vmxnet3_get_regs_len if we want to dump more registers */
 
         /* make each ring use multiple of 16 bytes */
-        buf[0] = adapter->tx_queue.tx_ring.next2fill;
-        buf[1] = adapter->tx_queue.tx_ring.next2comp;
-        buf[2] = adapter->tx_queue.tx_ring.gen;
+/* TODO change this for multiple queues */
+        buf[0] = adapter->tx_queue[i].tx_ring.next2fill;
+        buf[1] = adapter->tx_queue[i].tx_ring.next2comp;
+        buf[2] = adapter->tx_queue[i].tx_ring.gen;
         buf[3] = 0;
 
-        buf[4] = adapter->tx_queue.comp_ring.next2proc;
-        buf[5] = adapter->tx_queue.comp_ring.gen;
-        buf[6] = adapter->tx_queue.stopped;
+        buf[4] = adapter->tx_queue[i].comp_ring.next2proc;
+        buf[5] = adapter->tx_queue[i].comp_ring.gen;
+        buf[6] = adapter->tx_queue[i].stopped;
         buf[7] = 0;
 
-        buf[8] = adapter->rx_queue.rx_ring[0].next2fill;
-        buf[9] = adapter->rx_queue.rx_ring[0].next2comp;
-        buf[10] = adapter->rx_queue.rx_ring[0].gen;
+        buf[8] = adapter->rx_queue[i].rx_ring[0].next2fill;
+        buf[9] = adapter->rx_queue[i].rx_ring[0].next2comp;
+        buf[10] = adapter->rx_queue[i].rx_ring[0].gen;
         buf[11] = 0;
 
-        buf[12] = adapter->rx_queue.rx_ring[1].next2fill;
-        buf[13] = adapter->rx_queue.rx_ring[1].next2comp;
-        buf[14] = adapter->rx_queue.rx_ring[1].gen;
+        buf[12] = adapter->rx_queue[i].rx_ring[1].next2fill;
+        buf[13] = adapter->rx_queue[i].rx_ring[1].next2comp;
+        buf[14] = adapter->rx_queue[i].rx_ring[1].gen;
         buf[15] = 0;
 
-        buf[16] = adapter->rx_queue.comp_ring.next2proc;
-        buf[17] = adapter->rx_queue.comp_ring.gen;
+        buf[16] = adapter->rx_queue[i].comp_ring.next2proc;
+        buf[17] = adapter->rx_queue[i].comp_ring.gen;
         buf[18] = 0;
         buf[19] = 0;
 }
@@ -435,8 +437,10 @@ vmxnet3_get_ringparam(struct net_device *netdev,
         param->rx_mini_max_pending = 0;
         param->rx_jumbo_max_pending = 0;
 
-        param->rx_pending = adapter->rx_queue.rx_ring[0].size;
-        param->tx_pending = adapter->tx_queue.tx_ring.size;
+        param->rx_pending = adapter->rx_queue[0].rx_ring[0].size *
+                            adapter->num_rx_queues;
+        param->tx_pending = adapter->tx_queue[0].tx_ring.size *
+                            adapter->num_tx_queues;
         param->rx_mini_pending = 0;
         param->rx_jumbo_pending = 0;
 }
@@ -480,8 +484,8 @@ vmxnet3_set_ringparam(struct net_device *netdev,
                                                            sz) != 0)
                 return -EINVAL;
 
-        if (new_tx_ring_size == adapter->tx_queue.tx_ring.size &&
-                        new_rx_ring_size == adapter->rx_queue.rx_ring[0].size) {
+        if (new_tx_ring_size == adapter->tx_queue[0].tx_ring.size &&
+            new_rx_ring_size == adapter->rx_queue[0].rx_ring[0].size) {
                 return 0;
         }
 
@@ -498,11 +502,12 @@ vmxnet3_set_ringparam(struct net_device *netdev,
 
                 /* recreate the rx queue and the tx queue based on the
                  * new sizes */
-                vmxnet3_tq_destroy(&adapter->tx_queue, adapter);
-                vmxnet3_rq_destroy(&adapter->rx_queue, adapter);
+                vmxnet3_tq_destroy_all(adapter);
+                vmxnet3_rq_destroy_all(adapter);
 
                 err = vmxnet3_create_queues(adapter, new_tx_ring_size,
                         new_rx_ring_size, VMXNET3_DEF_RX_RING_SIZE);
+
                 if (err) {
                         /* failed, most likely because of OOM, try default
                          * size */
@@ -535,6 +540,66 @@ out:
 }
 
 
+static int
+vmxnet3_get_rxnfc(struct net_device *netdev, struct ethtool_rxnfc *info,
+                  void *rules)
+{
+        struct vmxnet3_adapter *adapter = netdev_priv(netdev);
+        switch (info->cmd) {
+        case ETHTOOL_GRXRINGS:
+                info->data = adapter->num_rx_queues;
+                return 0;
+        }
+        return -EOPNOTSUPP;
+}
+
+#ifdef VMXNET3_RSS
+static int
+vmxnet3_get_rss_indir(struct net_device *netdev,
+                      struct ethtool_rxfh_indir *p)
+{
+        struct vmxnet3_adapter *adapter = netdev_priv(netdev);
+        struct UPT1_RSSConf *rssConf = adapter->rss_conf;
+        unsigned int n = min_t(unsigned int, p->size, rssConf->indTableSize);
+
+        p->size = rssConf->indTableSize;
+        while (n--)
+                p->ring_index[n] = rssConf->indTable[n];
+        return 0;
+
+}
+
+static int
+vmxnet3_set_rss_indir(struct net_device *netdev,
+                      const struct ethtool_rxfh_indir *p)
+{
+        unsigned int i;
+        struct vmxnet3_adapter *adapter = netdev_priv(netdev);
+        struct UPT1_RSSConf *rssConf = adapter->rss_conf;
+
+        if (p->size != rssConf->indTableSize)
+                return -EINVAL;
+        for (i = 0; i < rssConf->indTableSize; i++) {
+                /*
+                 * Return with error code if any of the queue indices
+                 * is out of range
+                 */
+                if (p->ring_index[i] < 0 ||
+                    p->ring_index[i] >= adapter->num_rx_queues)
+                        return -EINVAL;
+        }
+
+        for (i = 0; i < rssConf->indTableSize; i++)
+                rssConf->indTable[i] = p->ring_index[i];
+
+        VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD,
+                               VMXNET3_CMD_UPDATE_RSSIDT);
+
+        return 0;
+
+}
+#endif
+
 static struct ethtool_ops vmxnet3_ethtool_ops = {
         .get_settings      = vmxnet3_get_settings,
         .get_drvinfo       = vmxnet3_get_drvinfo,
@@ -558,6 +623,11 @@ static struct ethtool_ops vmxnet3_ethtool_ops = {
         .get_ethtool_stats = vmxnet3_get_ethtool_stats,
         .get_ringparam     = vmxnet3_get_ringparam,
         .set_ringparam     = vmxnet3_set_ringparam,
+        .get_rxnfc         = vmxnet3_get_rxnfc,
+#ifdef VMXNET3_RSS
+        .get_rxfh_indir    = vmxnet3_get_rss_indir,
+        .set_rxfh_indir    = vmxnet3_set_rss_indir,
+#endif
 };
 
 void vmxnet3_set_ethtool_ops(struct net_device *netdev)
diff --git a/drivers/net/vmxnet3/vmxnet3_int.h b/drivers/net/vmxnet3/vmxnet3_int.h
index edf228843af..7fadeed37f0 100644
--- a/drivers/net/vmxnet3/vmxnet3_int.h
+++ b/drivers/net/vmxnet3/vmxnet3_int.h
@@ -68,11 +68,15 @@
 /*
  * Version numbers
  */
-#define VMXNET3_DRIVER_VERSION_STRING   "1.0.14.0-k"
+#define VMXNET3_DRIVER_VERSION_STRING   "1.0.16.0-k"
 
 /* a 32-bit int, each byte encode a verion number in VMXNET3_DRIVER_VERSION */
-#define VMXNET3_DRIVER_VERSION_NUM      0x01000E00
+#define VMXNET3_DRIVER_VERSION_NUM      0x01001000
 
+#if defined(CONFIG_PCI_MSI)
+        /* RSS only makes sense if MSI-X is supported. */
+        #define VMXNET3_RSS
+#endif
 
 /*
  * Capabilities
@@ -218,16 +222,19 @@ struct vmxnet3_tx_ctx {
 };
 
 struct vmxnet3_tx_queue {
+        char                    name[IFNAMSIZ+8]; /* To identify interrupt */
+        struct vmxnet3_adapter          *adapter;
         spinlock_t                      tx_lock;
         struct vmxnet3_cmd_ring         tx_ring;
-        struct vmxnet3_tx_buf_info     *buf_info;
+        struct vmxnet3_tx_buf_info      *buf_info;
         struct vmxnet3_tx_data_ring     data_ring;
         struct vmxnet3_comp_ring        comp_ring;
-        struct Vmxnet3_TxQueueCtrl            *shared;
+        struct Vmxnet3_TxQueueCtrl      *shared;
         struct vmxnet3_tq_driver_stats  stats;
         bool                            stopped;
         int                             num_stop;  /* # of times the queue is
                                                     * stopped */
+        int                             qid;
 } __attribute__((__aligned__(SMP_CACHE_BYTES)));
 
 enum vmxnet3_rx_buf_type {
@@ -259,6 +266,9 @@ struct vmxnet3_rq_driver_stats {
 };
 
 struct vmxnet3_rx_queue {
+        char                    name[IFNAMSIZ + 8]; /* To identify interrupt */
+        struct vmxnet3_adapter    *adapter;
+        struct napi_struct        napi;
         struct vmxnet3_cmd_ring   rx_ring[2];
         struct vmxnet3_comp_ring  comp_ring;
         struct vmxnet3_rx_ctx     rx_ctx;
@@ -271,7 +281,16 @@ struct vmxnet3_rx_queue {
         struct vmxnet3_rq_driver_stats  stats;
 } __attribute__((__aligned__(SMP_CACHE_BYTES)));
 
-#define VMXNET3_LINUX_MAX_MSIX_VECT     1
+#define VMXNET3_DEVICE_MAX_TX_QUEUES 8
+#define VMXNET3_DEVICE_MAX_RX_QUEUES 8   /* Keep this value as a power of 2 */
+
+/* Should be less than UPT1_RSS_MAX_IND_TABLE_SIZE */
+#define VMXNET3_RSS_IND_TABLE_SIZE (VMXNET3_DEVICE_MAX_RX_QUEUES * 4)
+
+#define VMXNET3_LINUX_MAX_MSIX_VECT     (VMXNET3_DEVICE_MAX_TX_QUEUES + \
+                                         VMXNET3_DEVICE_MAX_RX_QUEUES + 1)
+#define VMXNET3_LINUX_MIN_MSIX_VECT     3    /* 1 for each : tx, rx and event */
+
 
 struct vmxnet3_intr {
         enum vmxnet3_intr_mask_mode  mask_mode;
@@ -279,27 +298,32 @@ struct vmxnet3_intr {
         u8  num_intrs;                  /* # of intr vectors */
         u8  event_intr_idx;             /* idx of the intr vector for event */
         u8  mod_levels[VMXNET3_LINUX_MAX_MSIX_VECT]; /* moderation level */
+        char    event_msi_vector_name[IFNAMSIZ+11];
 #ifdef CONFIG_PCI_MSI
         struct msix_entry msix_entries[VMXNET3_LINUX_MAX_MSIX_VECT];
 #endif
 };
 
+/* Interrupt sharing schemes, share_intr */
+#define VMXNET3_INTR_BUDDYSHARE 0    /* Corresponding tx,rx queues share irq */
+#define VMXNET3_INTR_TXSHARE 1       /* All tx queues share one irq */
+#define VMXNET3_INTR_DONTSHARE 2     /* each queue has its own irq */
+
+
 #define VMXNET3_STATE_BIT_RESETTING   0
 #define VMXNET3_STATE_BIT_QUIESCED    1
 struct vmxnet3_adapter {
-        struct vmxnet3_tx_queue         tx_queue;
-        struct vmxnet3_rx_queue         rx_queue;
-        struct napi_struct              napi;
-        struct vlan_group              *vlan_grp;
-
-        struct vmxnet3_intr             intr;
-
-        struct Vmxnet3_DriverShared    *shared;
-        struct Vmxnet3_PMConf          *pm_conf;
-        struct Vmxnet3_TxQueueDesc     *tqd_start;     /* first tx queue desc */
-        struct Vmxnet3_RxQueueDesc     *rqd_start;     /* first rx queue desc */
-        struct net_device              *netdev;
-        struct pci_dev                 *pdev;
+        struct vmxnet3_tx_queue         tx_queue[VMXNET3_DEVICE_MAX_TX_QUEUES];
+        struct vmxnet3_rx_queue         rx_queue[VMXNET3_DEVICE_MAX_RX_QUEUES];
+        struct vlan_group               *vlan_grp;
+        struct vmxnet3_intr             intr;
+        struct Vmxnet3_DriverShared     *shared;
+        struct Vmxnet3_PMConf           *pm_conf;
+        struct Vmxnet3_TxQueueDesc      *tqd_start;     /* all tx queue desc */
+        struct Vmxnet3_RxQueueDesc      *rqd_start;     /* all rx queue desc */
+        struct net_device               *netdev;
+        struct net_device_stats         net_stats;
+        struct pci_dev                  *pdev;
 
         u8                      __iomem *hw_addr0; /* for BAR 0 */
         u8                      __iomem *hw_addr1; /* for BAR 1 */
@@ -308,6 +332,12 @@ struct vmxnet3_adapter {
         bool                            rxcsum;
         bool                            lro;
         bool                            jumbo_frame;
+#ifdef VMXNET3_RSS
+        struct UPT1_RSSConf             *rss_conf;
+        bool                            rss;
+#endif
+        u32                             num_rx_queues;
+        u32                             num_tx_queues;
 
         /* rx buffer related */
         unsigned                        skb_buf_size;
@@ -327,6 +357,7 @@ struct vmxnet3_adapter {
         unsigned long  state;    /* VMXNET3_STATE_BIT_xxx */
 
         int dev_number;
+        int share_intr;
 };
 
 #define VMXNET3_WRITE_BAR0_REG(adapter, reg, val)  \
@@ -366,12 +397,10 @@ void
 vmxnet3_reset_dev(struct vmxnet3_adapter *adapter);
 
 void
-vmxnet3_tq_destroy(struct vmxnet3_tx_queue *tq,
-                   struct vmxnet3_adapter *adapter);
+vmxnet3_tq_destroy_all(struct vmxnet3_adapter *adapter);
 
 void
-vmxnet3_rq_destroy(struct vmxnet3_rx_queue *rq,
-                   struct vmxnet3_adapter *adapter);
+vmxnet3_rq_destroy_all(struct vmxnet3_adapter *adapter);
 
 int
 vmxnet3_create_queues(struct vmxnet3_adapter *adapter,
diff --git a/drivers/net/vxge/vxge-config.c b/drivers/net/vxge/vxge-config.c
index 906a3ca3676..a0241fe72d8 100644
--- a/drivers/net/vxge/vxge-config.c
+++ b/drivers/net/vxge/vxge-config.c
@@ -19,19 +19,7 @@
 
 #include "vxge-traffic.h"
 #include "vxge-config.h"
-
-static enum vxge_hw_status
-__vxge_hw_fifo_create(
-        struct __vxge_hw_vpath_handle *vpath_handle,
-        struct vxge_hw_fifo_attr *attr);
-
-static enum vxge_hw_status
-__vxge_hw_fifo_abort(
-        struct __vxge_hw_fifo *fifoh);
-
-static enum vxge_hw_status
-__vxge_hw_fifo_reset(
-        struct __vxge_hw_fifo *ringh);
+#include "vxge-main.h"
 
 static enum vxge_hw_status
 __vxge_hw_fifo_delete(
@@ -71,53 +59,15 @@ __vxge_hw_blockpool_free(struct __vxge_hw_device *hldev,
                         u32 size,
                         struct vxge_hw_mempool_dma *dma_object);
 
-
-static struct __vxge_hw_channel*
-__vxge_hw_channel_allocate(struct __vxge_hw_vpath_handle *vph,
-                        enum __vxge_hw_channel_type type, u32 length,
-                        u32 per_dtr_space, void *userdata);
-
 static void
 __vxge_hw_channel_free(
         struct __vxge_hw_channel *channel);
 
-static enum vxge_hw_status
-__vxge_hw_channel_initialize(
-        struct __vxge_hw_channel *channel);
-
-static enum vxge_hw_status
-__vxge_hw_channel_reset(
-        struct __vxge_hw_channel *channel);
-
 static enum vxge_hw_status __vxge_hw_ring_delete(struct __vxge_hw_vpath_handle *vp);
 
 static enum vxge_hw_status
-__vxge_hw_device_fifo_config_check(struct vxge_hw_fifo_config *fifo_config);
-
-static enum vxge_hw_status
 __vxge_hw_device_config_check(struct vxge_hw_device_config *new_config);
 
-static void
-__vxge_hw_device_id_get(struct __vxge_hw_device *hldev);
-
-static void
-__vxge_hw_device_host_info_get(struct __vxge_hw_device *hldev);
-
-static enum vxge_hw_status
-__vxge_hw_vpath_card_info_get(
-        u32 vp_id,
-        struct vxge_hw_vpath_reg __iomem *vpath_reg,
-        struct vxge_hw_device_hw_info *hw_info);
-
-static enum vxge_hw_status
-__vxge_hw_device_initialize(struct __vxge_hw_device *hldev);
-
-static void
-__vxge_hw_device_pci_e_init(struct __vxge_hw_device *hldev);
-
-static enum vxge_hw_status
-__vxge_hw_device_reg_addr_get(struct __vxge_hw_device *hldev);
-
 static enum vxge_hw_status
 __vxge_hw_device_register_poll(
         void __iomem    *reg,
@@ -138,9 +88,10 @@ __vxge_hw_pio_mem_write64(u64 val64, void __iomem *addr,
 
 static struct vxge_hw_mempool*
 __vxge_hw_mempool_create(struct __vxge_hw_device *devh, u32 memblock_size,
-                         u32 item_size, u32 private_size, u32 items_initial,
-                         u32 items_max, struct vxge_hw_mempool_cbs *mp_callback,
-                         void *userdata);
+                        u32 item_size, u32 private_size, u32 items_initial,
+                        u32 items_max, struct vxge_hw_mempool_cbs *mp_callback,
+                        void *userdata);
+
 static void __vxge_hw_mempool_destroy(struct vxge_hw_mempool *mempool);
 
 static enum vxge_hw_status
@@ -153,52 +104,353 @@ vxge_hw_vpath_stats_enable(struct __vxge_hw_vpath_handle *vpath_handle);
 static enum vxge_hw_status
 __vxge_hw_legacy_swapper_set(struct vxge_hw_legacy_reg __iomem *legacy_reg);
 
-static u64
-__vxge_hw_vpath_pci_func_mode_get(u32  vp_id,
-                                  struct vxge_hw_vpath_reg __iomem *vpath_reg);
-
-static u32
-__vxge_hw_vpath_func_id_get(u32 vp_id, struct vxge_hw_vpmgmt_reg __iomem *vpmgmt_reg);
+static void
+__vxge_hw_vp_terminate(struct __vxge_hw_device *devh, u32 vp_id);
 
 static enum vxge_hw_status
-__vxge_hw_vpath_addr_get(u32 vp_id, struct vxge_hw_vpath_reg __iomem *vpath_reg,
-                         u8 (macaddr)[ETH_ALEN], u8 (macaddr_mask)[ETH_ALEN]);
+__vxge_hw_vpath_xmac_tx_stats_get(struct __vxge_hw_virtualpath  *vpath,
+                                  struct vxge_hw_xmac_vpath_tx_stats *vpath_tx_stats);
 
 static enum vxge_hw_status
-__vxge_hw_vpath_reset_check(struct __vxge_hw_virtualpath *vpath);
+__vxge_hw_vpath_xmac_rx_stats_get(struct __vxge_hw_virtualpath  *vpath,
+                                  struct vxge_hw_xmac_vpath_rx_stats *vpath_rx_stats);
 
+static void
+vxge_hw_vpath_set_zero_rx_frm_len(struct vxge_hw_vpath_reg __iomem *vp_reg)
+{
+        u64 val64;
 
-static enum vxge_hw_status
-__vxge_hw_vpath_sw_reset(struct __vxge_hw_device *devh, u32 vp_id);
+        val64 = readq(&vp_reg->rxmac_vcfg0);
+        val64 &= ~VXGE_HW_RXMAC_VCFG0_RTS_MAX_FRM_LEN(0x3fff);
+        writeq(val64, &vp_reg->rxmac_vcfg0);
+        val64 = readq(&vp_reg->rxmac_vcfg0);
 
-static enum vxge_hw_status
-__vxge_hw_vpath_fw_ver_get(u32 vp_id, struct vxge_hw_vpath_reg __iomem *vpath_reg,
-                           struct vxge_hw_device_hw_info *hw_info);
+        return;
+}
 
-static enum vxge_hw_status
-__vxge_hw_vpath_mac_configure(struct __vxge_hw_device *devh, u32 vp_id);
+/*
+ * vxge_hw_vpath_wait_receive_idle - Wait for Rx to become idle
+ */
+int vxge_hw_vpath_wait_receive_idle(struct __vxge_hw_device *hldev, u32 vp_id)
+{
+        struct vxge_hw_vpath_reg __iomem *vp_reg;
+        struct __vxge_hw_virtualpath *vpath;
+        u64 val64, rxd_count, rxd_spat;
+        int count = 0, total_count = 0;
 
-static void
-__vxge_hw_vp_terminate(struct __vxge_hw_device *devh, u32 vp_id);
+        vpath = &hldev->virtual_paths[vp_id];
+        vp_reg = vpath->vp_reg;
 
-static enum vxge_hw_status
-__vxge_hw_vpath_stats_access(struct __vxge_hw_virtualpath *vpath,
-                             u32 operation, u32 offset, u64 *stat);
+        vxge_hw_vpath_set_zero_rx_frm_len(vp_reg);
 
-static enum vxge_hw_status
-__vxge_hw_vpath_xmac_tx_stats_get(struct __vxge_hw_virtualpath  *vpath,
-                                  struct vxge_hw_xmac_vpath_tx_stats *vpath_tx_stats);
+        /* Check that the ring controller for this vpath has enough free RxDs
+         * to send frames to the host.  This is done by reading the
+         * PRC_RXD_DOORBELL_VPn register and comparing the read value to the
+         * RXD_SPAT value for the vpath.
+         */
+        val64 = readq(&vp_reg->prc_cfg6);
+        rxd_spat = VXGE_HW_PRC_CFG6_GET_RXD_SPAT(val64) + 1;
+        /* Use a factor of 2 when comparing rxd_count against rxd_spat for some
+         * leg room.
+         */
+        rxd_spat *= 2;
+
+        do {
+                mdelay(1);
+
+                rxd_count = readq(&vp_reg->prc_rxd_doorbell);
+
+                /* Check that the ring controller for this vpath does
+                 * not have any frame in its pipeline.
+                 */
+                val64 = readq(&vp_reg->frm_in_progress_cnt);
+                if ((rxd_count <= rxd_spat) || (val64 > 0))
+                        count = 0;
+                else
+                        count++;
+                total_count++;
+        } while ((count < VXGE_HW_MIN_SUCCESSIVE_IDLE_COUNT) &&
+                        (total_count < VXGE_HW_MAX_POLLING_COUNT));
+
+        if (total_count >= VXGE_HW_MAX_POLLING_COUNT)
+                printk(KERN_ALERT "%s: Still Receiving traffic. Abort wait\n",
+                        __func__);
+
+        return total_count;
+}
+
+/* vxge_hw_device_wait_receive_idle - This function waits until all frames
+ * stored in the frame buffer for each vpath assigned to the given
+ * function (hldev) have been sent to the host.
+ */
+void vxge_hw_device_wait_receive_idle(struct __vxge_hw_device *hldev)
+{
+        int i, total_count = 0;
+
+        for (i = 0; i < VXGE_HW_MAX_VIRTUAL_PATHS; i++) {
+                if (!(hldev->vpaths_deployed & vxge_mBIT(i)))
+                        continue;
+
+                total_count += vxge_hw_vpath_wait_receive_idle(hldev, i);
+                if (total_count >= VXGE_HW_MAX_POLLING_COUNT)
+                        break;
+        }
+}
 
 static enum vxge_hw_status
-__vxge_hw_vpath_xmac_rx_stats_get(struct __vxge_hw_virtualpath  *vpath,
-                                  struct vxge_hw_xmac_vpath_rx_stats *vpath_rx_stats);
+vxge_hw_vpath_fw_api(struct __vxge_hw_virtualpath *vpath, u32 action,
+                     u32 fw_memo, u32 offset, u64 *data0, u64 *data1,
+                     u64 *steer_ctrl)
+{
+        struct vxge_hw_vpath_reg __iomem *vp_reg;
+        enum vxge_hw_status status;
+        u64 val64;
+        u32 retry = 0, max_retry = 100;
+
+        vp_reg = vpath->vp_reg;
+
+        if (vpath->vp_open) {
+                max_retry = 3;
+                spin_lock(&vpath->lock);
+        }
+
+        writeq(*data0, &vp_reg->rts_access_steer_data0);
+        writeq(*data1, &vp_reg->rts_access_steer_data1);
+        wmb();
+
+        val64 = VXGE_HW_RTS_ACCESS_STEER_CTRL_ACTION(action) |
+                VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL(fw_memo) |
+                VXGE_HW_RTS_ACCESS_STEER_CTRL_OFFSET(offset) |
+                VXGE_HW_RTS_ACCESS_STEER_CTRL_STROBE |
+                *steer_ctrl;
+
+        status = __vxge_hw_pio_mem_write64(val64,
+                                           &vp_reg->rts_access_steer_ctrl,
+                                           VXGE_HW_RTS_ACCESS_STEER_CTRL_STROBE,
+                                           VXGE_HW_DEF_DEVICE_POLL_MILLIS);
+
+        /* The __vxge_hw_device_register_poll can udelay for a significant
+         * amount of time, blocking other proccess from the CPU.  If it delays
+         * for ~5secs, a NMI error can occur.  A way around this is to give up
+         * the processor via msleep, but this is not allowed is under lock.
+         * So, only allow it to sleep for ~4secs if open.  Otherwise, delay for
+         * 1sec and sleep for 10ms until the firmware operation has completed
+         * or timed-out.
+         */
+        while ((status != VXGE_HW_OK) && retry++ < max_retry) {
+                if (!vpath->vp_open)
+                        msleep(20);
+                status = __vxge_hw_device_register_poll(
+                                        &vp_reg->rts_access_steer_ctrl,
+                                        VXGE_HW_RTS_ACCESS_STEER_CTRL_STROBE,
+                                        VXGE_HW_DEF_DEVICE_POLL_MILLIS);
+        }
+
+        if (status != VXGE_HW_OK)
+                goto out;
+
+        val64 = readq(&vp_reg->rts_access_steer_ctrl);
+        if (val64 & VXGE_HW_RTS_ACCESS_STEER_CTRL_RMACJ_STATUS) {
+                *data0 = readq(&vp_reg->rts_access_steer_data0);
+                *data1 = readq(&vp_reg->rts_access_steer_data1);
+                *steer_ctrl = val64;
+        } else
+                status = VXGE_HW_FAIL;
+
+out:
+        if (vpath->vp_open)
+                spin_unlock(&vpath->lock);
+        return status;
+}
+
+enum vxge_hw_status
+vxge_hw_upgrade_read_version(struct __vxge_hw_device *hldev, u32 *major,
+                             u32 *minor, u32 *build)
+{
+        u64 data0 = 0, data1 = 0, steer_ctrl = 0;
+        struct __vxge_hw_virtualpath *vpath;
+        enum vxge_hw_status status;
+
+        vpath = &hldev->virtual_paths[hldev->first_vp_id];
+
+        status = vxge_hw_vpath_fw_api(vpath,
+                                      VXGE_HW_FW_UPGRADE_ACTION,
+                                      VXGE_HW_FW_UPGRADE_MEMO,
+                                      VXGE_HW_FW_UPGRADE_OFFSET_READ,
+                                      &data0, &data1, &steer_ctrl);
+        if (status != VXGE_HW_OK)
+                return status;
+
+        *major = VXGE_HW_RTS_ACCESS_STEER_DATA0_GET_FW_VER_MAJOR(data0);
+        *minor = VXGE_HW_RTS_ACCESS_STEER_DATA0_GET_FW_VER_MINOR(data0);
+        *build = VXGE_HW_RTS_ACCESS_STEER_DATA0_GET_FW_VER_BUILD(data0);
+
+        return status;
+}
+
+enum vxge_hw_status vxge_hw_flash_fw(struct __vxge_hw_device *hldev)
+{
+        u64 data0 = 0, data1 = 0, steer_ctrl = 0;
+        struct __vxge_hw_virtualpath *vpath;
+        enum vxge_hw_status status;
+        u32 ret;
+
+        vpath = &hldev->virtual_paths[hldev->first_vp_id];
+
+        status = vxge_hw_vpath_fw_api(vpath,
+                                      VXGE_HW_FW_UPGRADE_ACTION,
+                                      VXGE_HW_FW_UPGRADE_MEMO,
+                                      VXGE_HW_FW_UPGRADE_OFFSET_COMMIT,
+                                      &data0, &data1, &steer_ctrl);
+        if (status != VXGE_HW_OK) {
+                vxge_debug_init(VXGE_ERR, "%s: FW upgrade failed", __func__);
+                goto exit;
+        }
+
+        ret = VXGE_HW_RTS_ACCESS_STEER_CTRL_GET_ACTION(steer_ctrl) & 0x7F;
+        if (ret != 1) {
+                vxge_debug_init(VXGE_ERR, "%s: FW commit failed with error %d",
+                                __func__, ret);
+                status = VXGE_HW_FAIL;
+        }
+
+exit:
+        return status;
+}
+
+enum vxge_hw_status
+vxge_update_fw_image(struct __vxge_hw_device *hldev, const u8 *fwdata, int size)
+{
+        u64 data0 = 0, data1 = 0, steer_ctrl = 0;
+        struct __vxge_hw_virtualpath *vpath;
+        enum vxge_hw_status status;
+        int ret_code, sec_code;
+
+        vpath = &hldev->virtual_paths[hldev->first_vp_id];
+
+        /* send upgrade start command */
+        status = vxge_hw_vpath_fw_api(vpath,
+                                      VXGE_HW_FW_UPGRADE_ACTION,
+                                      VXGE_HW_FW_UPGRADE_MEMO,
+                                      VXGE_HW_FW_UPGRADE_OFFSET_START,
+                                      &data0, &data1, &steer_ctrl);
+        if (status != VXGE_HW_OK) {
+                vxge_debug_init(VXGE_ERR, " %s: Upgrade start cmd failed",
+                                __func__);
+                return status;
+        }
+
+        /* Transfer fw image to adapter 16 bytes at a time */
+        for (; size > 0; size -= VXGE_HW_FW_UPGRADE_BLK_SIZE) {
+                steer_ctrl = 0;
+
+                /* The next 128bits of fwdata to be loaded onto the adapter */
+                data0 = *((u64 *)fwdata);
+                data1 = *((u64 *)fwdata + 1);
+
+                status = vxge_hw_vpath_fw_api(vpath,
+                                              VXGE_HW_FW_UPGRADE_ACTION,
+                                              VXGE_HW_FW_UPGRADE_MEMO,
+                                              VXGE_HW_FW_UPGRADE_OFFSET_SEND,
+                                              &data0, &data1, &steer_ctrl);
+                if (status != VXGE_HW_OK) {
+                        vxge_debug_init(VXGE_ERR, "%s: Upgrade send failed",
+                                        __func__);
+                        goto out;
+                }
+
+                ret_code = VXGE_HW_UPGRADE_GET_RET_ERR_CODE(data0);
+                switch (ret_code) {
+                case VXGE_HW_FW_UPGRADE_OK:
+                        /* All OK, send next 16 bytes. */
+                        break;
+                case VXGE_FW_UPGRADE_BYTES2SKIP:
+                        /* skip bytes in the stream */
+                        fwdata += (data0 >> 8) & 0xFFFFFFFF;
+                        break;
+                case VXGE_HW_FW_UPGRADE_DONE:
+                        goto out;
+                case VXGE_HW_FW_UPGRADE_ERR:
+                        sec_code = VXGE_HW_UPGRADE_GET_SEC_ERR_CODE(data0);
+                        switch (sec_code) {
+                        case VXGE_HW_FW_UPGRADE_ERR_CORRUPT_DATA_1:
+                        case VXGE_HW_FW_UPGRADE_ERR_CORRUPT_DATA_7:
+                                printk(KERN_ERR
+                                       "corrupted data from .ncf file\n");
+                                break;
+                        case VXGE_HW_FW_UPGRADE_ERR_INV_NCF_FILE_3:
+                        case VXGE_HW_FW_UPGRADE_ERR_INV_NCF_FILE_4:
+                        case VXGE_HW_FW_UPGRADE_ERR_INV_NCF_FILE_5:
+                        case VXGE_HW_FW_UPGRADE_ERR_INV_NCF_FILE_6:
+                        case VXGE_HW_FW_UPGRADE_ERR_INV_NCF_FILE_8:
+                                printk(KERN_ERR "invalid .ncf file\n");
+                                break;
+                        case VXGE_HW_FW_UPGRADE_ERR_BUFFER_OVERFLOW:
+                                printk(KERN_ERR "buffer overflow\n");
+                                break;
+                        case VXGE_HW_FW_UPGRADE_ERR_FAILED_TO_FLASH:
+                                printk(KERN_ERR "failed to flash the image\n");
+                                break;
+                        case VXGE_HW_FW_UPGRADE_ERR_GENERIC_ERROR_UNKNOWN:
+                                printk(KERN_ERR
+                                       "generic error. Unknown error type\n");
+                                break;
+                        default:
+                                printk(KERN_ERR "Unknown error of type %d\n",
+                                       sec_code);
+                                break;
+                        }
+                        status = VXGE_HW_FAIL;
+                        goto out;
+                default:
+                        printk(KERN_ERR "Unknown FW error: %d\n", ret_code);
+                        status = VXGE_HW_FAIL;
+                        goto out;
+                }
+                /* point to next 16 bytes */
+                fwdata += VXGE_HW_FW_UPGRADE_BLK_SIZE;
+        }
+out:
+        return status;
+}
+
+enum vxge_hw_status
+vxge_hw_vpath_eprom_img_ver_get(struct __vxge_hw_device *hldev,
+                                struct eprom_image *img)
+{
+        u64 data0 = 0, data1 = 0, steer_ctrl = 0;
+        struct __vxge_hw_virtualpath *vpath;
+        enum vxge_hw_status status;
+        int i;
+
+        vpath = &hldev->virtual_paths[hldev->first_vp_id];
+
+        for (i = 0; i < VXGE_HW_MAX_ROM_IMAGES; i++) {
+                data0 = VXGE_HW_RTS_ACCESS_STEER_ROM_IMAGE_INDEX(i);
+                data1 = steer_ctrl = 0;
+
+                status = vxge_hw_vpath_fw_api(vpath,
+                        VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL_FW_MEMO,
+                        VXGE_HW_FW_API_GET_EPROM_REV,
+                        0, &data0, &data1, &steer_ctrl);
+                if (status != VXGE_HW_OK)
+                        break;
+
+                img[i].is_valid = VXGE_HW_GET_EPROM_IMAGE_VALID(data0);
+                img[i].index = VXGE_HW_GET_EPROM_IMAGE_INDEX(data0);
+                img[i].type = VXGE_HW_GET_EPROM_IMAGE_TYPE(data0);
+                img[i].version = VXGE_HW_GET_EPROM_IMAGE_REV(data0);
+        }
+
+        return status;
+}
 
 /*
  * __vxge_hw_channel_allocate - Allocate memory for channel
  * This function allocates required memory for the channel and various arrays
  * in the channel
  */
-struct __vxge_hw_channel*
+static struct __vxge_hw_channel *
 __vxge_hw_channel_allocate(struct __vxge_hw_vpath_handle *vph,
                            enum __vxge_hw_channel_type type,
         u32 length, u32 per_dtr_space, void *userdata)
@@ -269,7 +521,7 @@ exit0:
  * This function deallocates memory from the channel and various arrays
  * in the channel
  */
-void __vxge_hw_channel_free(struct __vxge_hw_channel *channel)
+static void __vxge_hw_channel_free(struct __vxge_hw_channel *channel)
 {
         kfree(channel->work_arr);
         kfree(channel->free_arr);
@@ -283,7 +535,7 @@ void __vxge_hw_channel_free(struct __vxge_hw_channel *channel)
  * This function initializes a channel by properly setting the
  * various references
  */
-enum vxge_hw_status
+static enum vxge_hw_status
 __vxge_hw_channel_initialize(struct __vxge_hw_channel *channel)
 {
         u32 i;
@@ -318,7 +570,7 @@ __vxge_hw_channel_initialize(struct __vxge_hw_channel *channel)
  * __vxge_hw_channel_reset - Resets a channel
  * This function resets a channel by properly setting the various references
  */
-enum vxge_hw_status
+static enum vxge_hw_status
 __vxge_hw_channel_reset(struct __vxge_hw_channel *channel)
 {
         u32 i;
@@ -345,8 +597,7 @@ __vxge_hw_channel_reset(struct __vxge_hw_channel *channel)
  * Initialize certain PCI/PCI-X configuration registers
  * with recommended values. Save config space for future hw resets.
  */
-void
-__vxge_hw_device_pci_e_init(struct __vxge_hw_device *hldev)
+static void __vxge_hw_device_pci_e_init(struct __vxge_hw_device *hldev)
 {
         u16 cmd = 0;
 
@@ -390,7 +641,7 @@ __vxge_hw_device_register_poll(void __iomem *reg, u64 mask, u32 max_millis)
         return ret;
 }
 
- /* __vxge_hw_device_vpath_reset_in_prog_check - Check if vpath reset
+/* __vxge_hw_device_vpath_reset_in_prog_check - Check if vpath reset
  * in progress
  * This routine checks the vpath reset in progress register is turned zero
  */
@@ -435,7 +686,7 @@ exit:
  * register location pointers in the device object. It waits until the ric is
  * completed initializing registers.
  */
-enum vxge_hw_status
+static enum vxge_hw_status
 __vxge_hw_device_reg_addr_get(struct __vxge_hw_device *hldev)
 {
         u64 val64;
@@ -496,26 +747,6 @@ exit:
 }
 
 /*
- * __vxge_hw_device_id_get
- * This routine returns sets the device id and revision numbers into the device
- * structure
- */
-void __vxge_hw_device_id_get(struct __vxge_hw_device *hldev)
-{
-        u64 val64;
-
-        val64 = readq(&hldev->common_reg->titan_asic_id);
-        hldev->device_id =
-                (u16)VXGE_HW_TITAN_ASIC_ID_GET_INITIAL_DEVICE_ID(val64);
-
-        hldev->major_revision =
-                (u8)VXGE_HW_TITAN_ASIC_ID_GET_INITIAL_MAJOR_REVISION(val64);
-
-        hldev->minor_revision =
-                (u8)VXGE_HW_TITAN_ASIC_ID_GET_INITIAL_MINOR_REVISION(val64);
-}
-
-/*
  * __vxge_hw_device_access_rights_get: Get Access Rights of the driver
  * This routine returns the Access Rights of the driver
  */
@@ -568,10 +799,25 @@ __vxge_hw_device_is_privilaged(u32 host_type, u32 func_id)
 }
 
 /*
+ * __vxge_hw_vpath_func_id_get - Get the function id of the vpath.
+ * Returns the function number of the vpath.
+ */
+static u32
+__vxge_hw_vpath_func_id_get(struct vxge_hw_vpmgmt_reg __iomem *vpmgmt_reg)
+{
+        u64 val64;
+
+        val64 = readq(&vpmgmt_reg->vpath_to_func_map_cfg1);
+
+        return
+         (u32)VXGE_HW_VPATH_TO_FUNC_MAP_CFG1_GET_VPATH_TO_FUNC_MAP_CFG1(val64);
+}
+
+/*
  * __vxge_hw_device_host_info_get
  * This routine returns the host type assignments
  */
-void __vxge_hw_device_host_info_get(struct __vxge_hw_device *hldev)
+static void __vxge_hw_device_host_info_get(struct __vxge_hw_device *hldev)
 {
         u64 val64;
         u32 i;
@@ -584,16 +830,18 @@ void __vxge_hw_device_host_info_get(struct __vxge_hw_device *hldev)
         hldev->vpath_assignments = readq(&hldev->common_reg->vpath_assignments);
 
         for (i = 0; i < VXGE_HW_MAX_VIRTUAL_PATHS; i++) {
-
                 if (!(hldev->vpath_assignments & vxge_mBIT(i)))
                         continue;
 
                 hldev->func_id =
-                        __vxge_hw_vpath_func_id_get(i, hldev->vpmgmt_reg[i]);
+                        __vxge_hw_vpath_func_id_get(hldev->vpmgmt_reg[i]);
 
                 hldev->access_rights = __vxge_hw_device_access_rights_get(
                         hldev->host_type, hldev->func_id);
 
+                hldev->virtual_paths[i].vp_open = VXGE_HW_VP_NOT_OPEN;
+                hldev->virtual_paths[i].vp_reg = hldev->vpath_reg[i];
+
                 hldev->first_vp_id = i;
                 break;
         }
@@ -634,7 +882,8 @@ __vxge_hw_verify_pci_e_info(struct __vxge_hw_device *hldev)
  * __vxge_hw_device_initialize
  * Initialize Titan-V hardware.
  */
-enum vxge_hw_status __vxge_hw_device_initialize(struct __vxge_hw_device *hldev)
+static enum vxge_hw_status
+__vxge_hw_device_initialize(struct __vxge_hw_device *hldev)
 {
         enum vxge_hw_status status = VXGE_HW_OK;
 
@@ -650,6 +899,196 @@ exit:
         return status;
 }
 
+/*
+ * __vxge_hw_vpath_fw_ver_get - Get the fw version
+ * Returns FW Version
+ */
+static enum vxge_hw_status
+__vxge_hw_vpath_fw_ver_get(struct __vxge_hw_virtualpath *vpath,
+                           struct vxge_hw_device_hw_info *hw_info)
+{
+        struct vxge_hw_device_version *fw_version = &hw_info->fw_version;
+        struct vxge_hw_device_date *fw_date = &hw_info->fw_date;
+        struct vxge_hw_device_version *flash_version = &hw_info->flash_version;
+        struct vxge_hw_device_date *flash_date = &hw_info->flash_date;
+        u64 data0, data1 = 0, steer_ctrl = 0;
+        enum vxge_hw_status status;
+
+        status = vxge_hw_vpath_fw_api(vpath,
+                        VXGE_HW_RTS_ACCESS_STEER_CTRL_ACTION_READ_ENTRY,
+                        VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL_FW_MEMO,
+                        0, &data0, &data1, &steer_ctrl);
+        if (status != VXGE_HW_OK)
+                goto exit;
+
+        fw_date->day =
+            (u32) VXGE_HW_RTS_ACCESS_STEER_DATA0_GET_FW_VER_DAY(data0);
+        fw_date->month =
+            (u32) VXGE_HW_RTS_ACCESS_STEER_DATA0_GET_FW_VER_MONTH(data0);
+        fw_date->year =
+            (u32) VXGE_HW_RTS_ACCESS_STEER_DATA0_GET_FW_VER_YEAR(data0);
+
+        snprintf(fw_date->date, VXGE_HW_FW_STRLEN, "%2.2d/%2.2d/%4.4d",
+                 fw_date->month, fw_date->day, fw_date->year);
+
+        fw_version->major =
+            (u32) VXGE_HW_RTS_ACCESS_STEER_DATA0_GET_FW_VER_MAJOR(data0);
+        fw_version->minor =
+            (u32) VXGE_HW_RTS_ACCESS_STEER_DATA0_GET_FW_VER_MINOR(data0);
+        fw_version->build =
+            (u32) VXGE_HW_RTS_ACCESS_STEER_DATA0_GET_FW_VER_BUILD(data0);
+
+        snprintf(fw_version->version, VXGE_HW_FW_STRLEN, "%d.%d.%d",
+                 fw_version->major, fw_version->minor, fw_version->build);
+
+        flash_date->day =
+            (u32) VXGE_HW_RTS_ACCESS_STEER_DATA1_GET_FLASH_VER_DAY(data1);
+        flash_date->month =
+            (u32) VXGE_HW_RTS_ACCESS_STEER_DATA1_GET_FLASH_VER_MONTH(data1);
+        flash_date->year =
+            (u32) VXGE_HW_RTS_ACCESS_STEER_DATA1_GET_FLASH_VER_YEAR(data1);
+
+        snprintf(flash_date->date, VXGE_HW_FW_STRLEN, "%2.2d/%2.2d/%4.4d",
+                 flash_date->month, flash_date->day, flash_date->year);
+
+        flash_version->major =
+            (u32) VXGE_HW_RTS_ACCESS_STEER_DATA1_GET_FLASH_VER_MAJOR(data1);
+        flash_version->minor =
+            (u32) VXGE_HW_RTS_ACCESS_STEER_DATA1_GET_FLASH_VER_MINOR(data1);
+        flash_version->build =
+            (u32) VXGE_HW_RTS_ACCESS_STEER_DATA1_GET_FLASH_VER_BUILD(data1);
+
+        snprintf(flash_version->version, VXGE_HW_FW_STRLEN, "%d.%d.%d",
+                 flash_version->major, flash_version->minor,
+                 flash_version->build);
+
+exit:
+        return status;
+}
+
+/*
+ * __vxge_hw_vpath_card_info_get - Get the serial numbers,
+ * part number and product description.
+ */
+static enum vxge_hw_status
+__vxge_hw_vpath_card_info_get(struct __vxge_hw_virtualpath *vpath,
+                              struct vxge_hw_device_hw_info *hw_info)
+{
+        enum vxge_hw_status status;
+        u64 data0, data1 = 0, steer_ctrl = 0;
+        u8 *serial_number = hw_info->serial_number;
+        u8 *part_number = hw_info->part_number;
+        u8 *product_desc = hw_info->product_desc;
+        u32 i, j = 0;
+
+        data0 = VXGE_HW_RTS_ACCESS_STEER_DATA0_MEMO_ITEM_SERIAL_NUMBER;
+
+        status = vxge_hw_vpath_fw_api(vpath,
+                        VXGE_HW_RTS_ACCESS_STEER_CTRL_ACTION_READ_MEMO_ENTRY,
+                        VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL_FW_MEMO,
+                        0, &data0, &data1, &steer_ctrl);
+        if (status != VXGE_HW_OK)
+                return status;
+
+        ((u64 *)serial_number)[0] = be64_to_cpu(data0);
+        ((u64 *)serial_number)[1] = be64_to_cpu(data1);
+
+        data0 = VXGE_HW_RTS_ACCESS_STEER_DATA0_MEMO_ITEM_PART_NUMBER;
+        data1 = steer_ctrl = 0;
+
+        status = vxge_hw_vpath_fw_api(vpath,
+                        VXGE_HW_RTS_ACCESS_STEER_CTRL_ACTION_READ_MEMO_ENTRY,
+                        VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL_FW_MEMO,
+                        0, &data0, &data1, &steer_ctrl);
+        if (status != VXGE_HW_OK)
+                return status;
+
+        ((u64 *)part_number)[0] = be64_to_cpu(data0);
+        ((u64 *)part_number)[1] = be64_to_cpu(data1);
+
+        for (i = VXGE_HW_RTS_ACCESS_STEER_DATA0_MEMO_ITEM_DESC_0;
+             i <= VXGE_HW_RTS_ACCESS_STEER_DATA0_MEMO_ITEM_DESC_3; i++) {
+                data0 = i;
+                data1 = steer_ctrl = 0;
+
+                status = vxge_hw_vpath_fw_api(vpath,
+                        VXGE_HW_RTS_ACCESS_STEER_CTRL_ACTION_READ_MEMO_ENTRY,
+                        VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL_FW_MEMO,
+                        0, &data0, &data1, &steer_ctrl);
+                if (status != VXGE_HW_OK)
+                        return status;
+
+                ((u64 *)product_desc)[j++] = be64_to_cpu(data0);
+                ((u64 *)product_desc)[j++] = be64_to_cpu(data1);
+        }
+
+        return status;
+}
+
+/*
+ * __vxge_hw_vpath_pci_func_mode_get - Get the pci mode
+ * Returns pci function mode
+ */
+static enum vxge_hw_status
+__vxge_hw_vpath_pci_func_mode_get(struct __vxge_hw_virtualpath *vpath,
+                                  struct vxge_hw_device_hw_info *hw_info)
+{
+        u64 data0, data1 = 0, steer_ctrl = 0;
+        enum vxge_hw_status status;
+
+        data0 = 0;
+
+        status = vxge_hw_vpath_fw_api(vpath,
+                        VXGE_HW_FW_API_GET_FUNC_MODE,
+                        VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL_FW_MEMO,
+                        0, &data0, &data1, &steer_ctrl);
+        if (status != VXGE_HW_OK)
+                return status;
+
+        hw_info->function_mode = VXGE_HW_GET_FUNC_MODE_VAL(data0);
+        return status;
+}
+
+/*
+ * __vxge_hw_vpath_addr_get - Get the hw address entry for this vpath
+ *               from MAC address table.
+ */
+static enum vxge_hw_status
+__vxge_hw_vpath_addr_get(struct __vxge_hw_virtualpath *vpath,
+                         u8 *macaddr, u8 *macaddr_mask)
+{
+        u64 action = VXGE_HW_RTS_ACCESS_STEER_CTRL_ACTION_LIST_FIRST_ENTRY,
+            data0 = 0, data1 = 0, steer_ctrl = 0;
+        enum vxge_hw_status status;
+        int i;
+
+        do {
+                status = vxge_hw_vpath_fw_api(vpath, action,
+                        VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL_DA,
+                        0, &data0, &data1, &steer_ctrl);
+                if (status != VXGE_HW_OK)
+                        goto exit;
+
+                data0 = VXGE_HW_RTS_ACCESS_STEER_DATA0_GET_DA_MAC_ADDR(data0);
+                data1 = VXGE_HW_RTS_ACCESS_STEER_DATA1_GET_DA_MAC_ADDR_MASK(
+                                                                        data1);
+
+                for (i = ETH_ALEN; i > 0; i--) {
+                        macaddr[i - 1] = (u8) (data0 & 0xFF);
+                        data0 >>= 8;
+
+                        macaddr_mask[i - 1] = (u8) (data1 & 0xFF);
+                        data1 >>= 8;
+                }
+
+                action = VXGE_HW_RTS_ACCESS_STEER_CTRL_ACTION_LIST_NEXT_ENTRY;
+                data0 = 0, data1 = 0, steer_ctrl = 0;
+
+        } while (!is_valid_ether_addr(macaddr));
+exit:
+        return status;
+}
+
 /**
  * vxge_hw_device_hw_info_get - Get the hw information
  * Returns the vpath mask that has the bits set for each vpath allocated
@@ -665,9 +1104,9 @@ vxge_hw_device_hw_info_get(void __iomem *bar0,
         struct vxge_hw_toc_reg __iomem *toc;
         struct vxge_hw_mrpcim_reg __iomem *mrpcim_reg;
         struct vxge_hw_common_reg __iomem *common_reg;
-        struct vxge_hw_vpath_reg __iomem *vpath_reg;
         struct vxge_hw_vpmgmt_reg __iomem *vpmgmt_reg;
         enum vxge_hw_status status;
+        struct __vxge_hw_virtualpath vpath;
 
         memset(hw_info, 0, sizeof(struct vxge_hw_device_hw_info));
 
@@ -702,7 +1141,7 @@ vxge_hw_device_hw_info_get(void __iomem *bar0,
                 vpmgmt_reg = (struct vxge_hw_vpmgmt_reg __iomem *)
                                 (bar0 + val64);
 
-                hw_info->func_id = __vxge_hw_vpath_func_id_get(i, vpmgmt_reg);
+                hw_info->func_id = __vxge_hw_vpath_func_id_get(vpmgmt_reg);
                 if (__vxge_hw_device_access_rights_get(hw_info->host_type,
                         hw_info->func_id) &
                         VXGE_HW_DEVICE_ACCESS_RIGHT_MRPCIM) {
@@ -718,16 +1157,19 @@ vxge_hw_device_hw_info_get(void __iomem *bar0,
 
                 val64 = readq(&toc->toc_vpath_pointer[i]);
 
-                vpath_reg = (struct vxge_hw_vpath_reg __iomem *)(bar0 + val64);
+                vpath.vp_reg = (struct vxge_hw_vpath_reg __iomem *)
+                               (bar0 + val64);
+                vpath.vp_open = 0;
 
-                hw_info->function_mode =
-                        __vxge_hw_vpath_pci_func_mode_get(i, vpath_reg);
+                status = __vxge_hw_vpath_pci_func_mode_get(&vpath, hw_info);
+                if (status != VXGE_HW_OK)
+                        goto exit;
 
-                status = __vxge_hw_vpath_fw_ver_get(i, vpath_reg, hw_info);
+                status = __vxge_hw_vpath_fw_ver_get(&vpath, hw_info);
                 if (status != VXGE_HW_OK)
                         goto exit;
 
-                status = __vxge_hw_vpath_card_info_get(i, vpath_reg, hw_info);
+                status = __vxge_hw_vpath_card_info_get(&vpath, hw_info);
                 if (status != VXGE_HW_OK)
                         goto exit;
 
@@ -735,14 +1177,15 @@ vxge_hw_device_hw_info_get(void __iomem *bar0,
         }
 
         for (i = 0; i < VXGE_HW_MAX_VIRTUAL_PATHS; i++) {
-
                 if (!((hw_info->vpath_mask) & vxge_mBIT(i)))
                         continue;
 
                 val64 = readq(&toc->toc_vpath_pointer[i]);
-                vpath_reg = (struct vxge_hw_vpath_reg __iomem *)(bar0 + val64);
+                vpath.vp_reg = (struct vxge_hw_vpath_reg __iomem *)
+                               (bar0 + val64);
+                vpath.vp_open = 0;
 
-                status =  __vxge_hw_vpath_addr_get(i, vpath_reg,
+                status =  __vxge_hw_vpath_addr_get(&vpath,
                                 hw_info->mac_addrs[i],
                                 hw_info->mac_addr_masks[i]);
                 if (status != VXGE_HW_OK)
@@ -776,14 +1219,12 @@ vxge_hw_device_initialize(
         if (status != VXGE_HW_OK)
                 goto exit;
 
-        hldev = (struct __vxge_hw_device *)
-                        vmalloc(sizeof(struct __vxge_hw_device));
+        hldev = vzalloc(sizeof(struct __vxge_hw_device));
         if (hldev == NULL) {
                 status = VXGE_HW_ERR_OUT_OF_MEMORY;
                 goto exit;
         }
 
-        memset(hldev, 0, sizeof(struct __vxge_hw_device));
         hldev->magic = VXGE_HW_DEVICE_MAGIC;
 
         vxge_hw_device_debug_set(hldev, VXGE_ERR, VXGE_COMPONENT_ALL);
@@ -806,7 +1247,6 @@ vxge_hw_device_initialize(
                 vfree(hldev);
                 goto exit;
         }
-        __vxge_hw_device_id_get(hldev);
 
         __vxge_hw_device_host_info_get(hldev);
 
@@ -814,7 +1254,6 @@ vxge_hw_device_initialize(
         nblocks++;
 
         for (i = 0; i < VXGE_HW_MAX_VIRTUAL_PATHS; i++) {
-
                 if (!(hldev->vpath_assignments & vxge_mBIT(i)))
                         continue;
 
@@ -839,7 +1278,6 @@ vxge_hw_device_initialize(
         }
 
         status = __vxge_hw_device_initialize(hldev);
-
         if (status != VXGE_HW_OK) {
                 vxge_hw_device_terminate(hldev);
                 goto exit;
@@ -876,7 +1314,6 @@ vxge_hw_device_stats_get(struct __vxge_hw_device *hldev,
         enum vxge_hw_status status = VXGE_HW_OK;
 
         for (i = 0; i < VXGE_HW_MAX_VIRTUAL_PATHS; i++) {
-
                 if (!(hldev->vpaths_deployed & vxge_mBIT(i)) ||
                         (hldev->virtual_paths[i].vp_open ==
                                 VXGE_HW_VP_NOT_OPEN))
@@ -1165,7 +1602,6 @@ exit:
  * It can be used to set or reset Pause frame generation or reception
  * support of the NIC.
  */
-
 enum vxge_hw_status vxge_hw_device_setpause_data(struct __vxge_hw_device *hldev,
                                                  u32 port, u32 tx, u32 rx)
 {
@@ -1409,7 +1845,6 @@ exit:
 /*
  * __vxge_hw_ring_create - Create a Ring
  * This function creates Ring and initializes it.
- *
  */
 static enum vxge_hw_status
 __vxge_hw_ring_create(struct __vxge_hw_vpath_handle *vp,
@@ -1627,15 +2062,12 @@ __vxge_hw_mempool_grow(struct vxge_hw_mempool *mempool, u32 num_allocate,
                  * allocate new memblock and its private part at once.
                  * This helps to minimize memory usage a lot. */
                 mempool->memblocks_priv_arr[i] =
-                                vmalloc(mempool->items_priv_size * n_items);
+                                vzalloc(mempool->items_priv_size * n_items);
                 if (mempool->memblocks_priv_arr[i] == NULL) {
                         status = VXGE_HW_ERR_OUT_OF_MEMORY;
                         goto exit;
                 }
 
-                memset(mempool->memblocks_priv_arr[i], 0,
-                             mempool->items_priv_size * n_items);
-
                 /* allocate DMA-capable memblock */
                 mempool->memblocks_arr[i] =
                         __vxge_hw_blockpool_malloc(mempool->devh,
@@ -1707,13 +2139,11 @@ __vxge_hw_mempool_create(
                 goto exit;
         }
 
-        mempool = (struct vxge_hw_mempool *)
-                        vmalloc(sizeof(struct vxge_hw_mempool));
+        mempool = vzalloc(sizeof(struct vxge_hw_mempool));
         if (mempool == NULL) {
                 status = VXGE_HW_ERR_OUT_OF_MEMORY;
                 goto exit;
         }
-        memset(mempool, 0, sizeof(struct vxge_hw_mempool));
 
         mempool->devh                   = devh;
         mempool->memblock_size          = memblock_size;
@@ -1733,31 +2163,27 @@ __vxge_hw_mempool_create(
 
         /* allocate array of memblocks */
         mempool->memblocks_arr =
-                (void **) vmalloc(sizeof(void *) * mempool->memblocks_max);
+                vzalloc(sizeof(void *) * mempool->memblocks_max);
         if (mempool->memblocks_arr == NULL) {
                 __vxge_hw_mempool_destroy(mempool);
                 status = VXGE_HW_ERR_OUT_OF_MEMORY;
                 mempool = NULL;
                 goto exit;
         }
-        memset(mempool->memblocks_arr, 0,
-                sizeof(void *) * mempool->memblocks_max);
 
         /* allocate array of private parts of items per memblocks */
         mempool->memblocks_priv_arr =
-                (void **) vmalloc(sizeof(void *) * mempool->memblocks_max);
+                vzalloc(sizeof(void *) * mempool->memblocks_max);
         if (mempool->memblocks_priv_arr == NULL) {
                 __vxge_hw_mempool_destroy(mempool);
                 status = VXGE_HW_ERR_OUT_OF_MEMORY;
                 mempool = NULL;
                 goto exit;
         }
-        memset(mempool->memblocks_priv_arr, 0,
-                    sizeof(void *) * mempool->memblocks_max);
 
         /* allocate array of memblocks DMA objects */
-        mempool->memblocks_dma_arr = (struct vxge_hw_mempool_dma *)
-                vmalloc(sizeof(struct vxge_hw_mempool_dma) *
+        mempool->memblocks_dma_arr =
+                vzalloc(sizeof(struct vxge_hw_mempool_dma) *
                         mempool->memblocks_max);
 
         if (mempool->memblocks_dma_arr == NULL) {
@@ -1766,20 +2192,15 @@ __vxge_hw_mempool_create(
                 mempool = NULL;
                 goto exit;
         }
-        memset(mempool->memblocks_dma_arr, 0,
-                        sizeof(struct vxge_hw_mempool_dma) *
-                        mempool->memblocks_max);
 
         /* allocate hash array of items */
-        mempool->items_arr =
-                (void **) vmalloc(sizeof(void *) * mempool->items_max);
+        mempool->items_arr = vzalloc(sizeof(void *) * mempool->items_max);
         if (mempool->items_arr == NULL) {
                 __vxge_hw_mempool_destroy(mempool);
                 status = VXGE_HW_ERR_OUT_OF_MEMORY;
                 mempool = NULL;
                 goto exit;
         }
-        memset(mempool->items_arr, 0, sizeof(void *) * mempool->items_max);
 
         /* calculate initial number of memblocks */
         memblocks_to_allocate = (mempool->items_initial +
@@ -1845,7 +2266,7 @@ static void __vxge_hw_mempool_destroy(struct vxge_hw_mempool *mempool)
  * __vxge_hw_device_fifo_config_check - Check fifo configuration.
  * Check the fifo configuration
  */
-enum vxge_hw_status
+static enum vxge_hw_status
 __vxge_hw_device_fifo_config_check(struct vxge_hw_fifo_config *fifo_config)
 {
         if ((fifo_config->fifo_blocks < VXGE_HW_MIN_FIFO_BLOCKS) ||
@@ -1893,7 +2314,7 @@ __vxge_hw_device_vpath_config_check(struct vxge_hw_vp_config *vp_config)
  * __vxge_hw_device_config_check - Check device configuration.
  * Check the device configuration
  */
-enum vxge_hw_status
+static enum vxge_hw_status
 __vxge_hw_device_config_check(struct vxge_hw_device_config *new_config)
 {
         u32 i;
@@ -2453,7 +2874,7 @@ __vxge_hw_fifo_mempool_item_alloc(
  * __vxge_hw_fifo_create - Create a FIFO
  * This function creates FIFO and initializes it.
  */
-enum vxge_hw_status
+static enum vxge_hw_status
 __vxge_hw_fifo_create(struct __vxge_hw_vpath_handle *vp,
                       struct vxge_hw_fifo_attr *attr)
 {
@@ -2617,7 +3038,8 @@ static enum vxge_hw_status __vxge_hw_fifo_reset(struct __vxge_hw_fifo *fifo)
  * __vxge_hw_fifo_delete - Removes the FIFO
  * This function freeup the memory pool and removes the FIFO
  */
-enum vxge_hw_status __vxge_hw_fifo_delete(struct __vxge_hw_vpath_handle *vp)
+static enum vxge_hw_status
+__vxge_hw_fifo_delete(struct __vxge_hw_vpath_handle *vp)
 {
         struct __vxge_hw_fifo *fifo = vp->vpath->fifoh;
 
@@ -2675,297 +3097,6 @@ exit:
         return status;
 }
 
-/*
- * __vxge_hw_vpath_func_id_get - Get the function id of the vpath.
- * Returns the function number of the vpath.
- */
-static u32
-__vxge_hw_vpath_func_id_get(u32 vp_id,
-        struct vxge_hw_vpmgmt_reg __iomem *vpmgmt_reg)
-{
-        u64 val64;
-
-        val64 = readq(&vpmgmt_reg->vpath_to_func_map_cfg1);
-
-        return
-         (u32)VXGE_HW_VPATH_TO_FUNC_MAP_CFG1_GET_VPATH_TO_FUNC_MAP_CFG1(val64);
-}
-
-/*
- * __vxge_hw_read_rts_ds - Program RTS steering critieria
- */
-static inline void
-__vxge_hw_read_rts_ds(struct vxge_hw_vpath_reg __iomem *vpath_reg,
-                      u64 dta_struct_sel)
-{
-        writeq(0, &vpath_reg->rts_access_steer_ctrl);
-        wmb();
-        writeq(dta_struct_sel, &vpath_reg->rts_access_steer_data0);
-        writeq(0, &vpath_reg->rts_access_steer_data1);
-        wmb();
-}
-
-
-/*
- * __vxge_hw_vpath_card_info_get - Get the serial numbers,
- * part number and product description.
- */
-static enum vxge_hw_status
-__vxge_hw_vpath_card_info_get(
-        u32 vp_id,
-        struct vxge_hw_vpath_reg __iomem *vpath_reg,
-        struct vxge_hw_device_hw_info *hw_info)
-{
-        u32 i, j;
-        u64 val64;
-        u64 data1 = 0ULL;
-        u64 data2 = 0ULL;
-        enum vxge_hw_status status = VXGE_HW_OK;
-        u8 *serial_number = hw_info->serial_number;
-        u8 *part_number = hw_info->part_number;
-        u8 *product_desc = hw_info->product_desc;
-
-        __vxge_hw_read_rts_ds(vpath_reg,
-                VXGE_HW_RTS_ACCESS_STEER_DATA0_MEMO_ITEM_SERIAL_NUMBER);
-
-        val64 = VXGE_HW_RTS_ACCESS_STEER_CTRL_ACTION(
-                        VXGE_HW_RTS_ACCESS_STEER_CTRL_ACTION_READ_MEMO_ENTRY) |
-                VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL(
-                        VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL_FW_MEMO) |
-                VXGE_HW_RTS_ACCESS_STEER_CTRL_STROBE |
-                VXGE_HW_RTS_ACCESS_STEER_CTRL_OFFSET(0);
-
-        status = __vxge_hw_pio_mem_write64(val64,
-                                &vpath_reg->rts_access_steer_ctrl,
-                                VXGE_HW_RTS_ACCESS_STEER_CTRL_STROBE,
-                                VXGE_HW_DEF_DEVICE_POLL_MILLIS);
-
-        if (status != VXGE_HW_OK)
-                return status;
-
-        val64 = readq(&vpath_reg->rts_access_steer_ctrl);
-
-        if (val64 & VXGE_HW_RTS_ACCESS_STEER_CTRL_RMACJ_STATUS) {
-                data1 = readq(&vpath_reg->rts_access_steer_data0);
-                ((u64 *)serial_number)[0] = be64_to_cpu(data1);
-
-                data2 = readq(&vpath_reg->rts_access_steer_data1);
-                ((u64 *)serial_number)[1] = be64_to_cpu(data2);
-                status = VXGE_HW_OK;
-        } else
-                *serial_number = 0;
-
-        __vxge_hw_read_rts_ds(vpath_reg,
-                        VXGE_HW_RTS_ACCESS_STEER_DATA0_MEMO_ITEM_PART_NUMBER);
-
-        val64 = VXGE_HW_RTS_ACCESS_STEER_CTRL_ACTION(
-                        VXGE_HW_RTS_ACCESS_STEER_CTRL_ACTION_READ_MEMO_ENTRY) |
-                VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL(
-                        VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL_FW_MEMO) |
-                VXGE_HW_RTS_ACCESS_STEER_CTRL_STROBE |
-                VXGE_HW_RTS_ACCESS_STEER_CTRL_OFFSET(0);
-
-        status = __vxge_hw_pio_mem_write64(val64,
-                                &vpath_reg->rts_access_steer_ctrl,
-                                VXGE_HW_RTS_ACCESS_STEER_CTRL_STROBE,
-                                VXGE_HW_DEF_DEVICE_POLL_MILLIS);
-
-        if (status != VXGE_HW_OK)
-                return status;
-
-        val64 = readq(&vpath_reg->rts_access_steer_ctrl);
-
-        if (val64 & VXGE_HW_RTS_ACCESS_STEER_CTRL_RMACJ_STATUS) {
-
-                data1 = readq(&vpath_reg->rts_access_steer_data0);
-                ((u64 *)part_number)[0] = be64_to_cpu(data1);
-
-                data2 = readq(&vpath_reg->rts_access_steer_data1);
-                ((u64 *)part_number)[1] = be64_to_cpu(data2);
-
-                status = VXGE_HW_OK;
-
-        } else
-                *part_number = 0;
-
-        j = 0;
-
-        for (i = VXGE_HW_RTS_ACCESS_STEER_DATA0_MEMO_ITEM_DESC_0;
-             i <= VXGE_HW_RTS_ACCESS_STEER_DATA0_MEMO_ITEM_DESC_3; i++) {
-
-                __vxge_hw_read_rts_ds(vpath_reg, i);
-
-                val64 = VXGE_HW_RTS_ACCESS_STEER_CTRL_ACTION(
-                        VXGE_HW_RTS_ACCESS_STEER_CTRL_ACTION_READ_MEMO_ENTRY) |
-                        VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL(
-                        VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL_FW_MEMO) |
-                        VXGE_HW_RTS_ACCESS_STEER_CTRL_STROBE |
-                        VXGE_HW_RTS_ACCESS_STEER_CTRL_OFFSET(0);
-
-                status = __vxge_hw_pio_mem_write64(val64,
-                                &vpath_reg->rts_access_steer_ctrl,
-                                VXGE_HW_RTS_ACCESS_STEER_CTRL_STROBE,
-                                VXGE_HW_DEF_DEVICE_POLL_MILLIS);
-
-                if (status != VXGE_HW_OK)
-                        return status;
-
-                val64 = readq(&vpath_reg->rts_access_steer_ctrl);
-
-                if (val64 & VXGE_HW_RTS_ACCESS_STEER_CTRL_RMACJ_STATUS) {
-
-                        data1 = readq(&vpath_reg->rts_access_steer_data0);
-                        ((u64 *)product_desc)[j++] = be64_to_cpu(data1);
-
-                        data2 = readq(&vpath_reg->rts_access_steer_data1);
-                        ((u64 *)product_desc)[j++] = be64_to_cpu(data2);
-
-                        status = VXGE_HW_OK;
-                } else
-                        *product_desc = 0;
-        }
-
-        return status;
-}
-
-/*
- * __vxge_hw_vpath_fw_ver_get - Get the fw version
- * Returns FW Version
- */
-static enum vxge_hw_status
-__vxge_hw_vpath_fw_ver_get(
-        u32 vp_id,
-        struct vxge_hw_vpath_reg __iomem *vpath_reg,
-        struct vxge_hw_device_hw_info *hw_info)
-{
-        u64 val64;
-        u64 data1 = 0ULL;
-        u64 data2 = 0ULL;
-        struct vxge_hw_device_version *fw_version = &hw_info->fw_version;
-        struct vxge_hw_device_date *fw_date = &hw_info->fw_date;
-        struct vxge_hw_device_version *flash_version = &hw_info->flash_version;
-        struct vxge_hw_device_date *flash_date = &hw_info->flash_date;
-        enum vxge_hw_status status = VXGE_HW_OK;
-
-        val64 = VXGE_HW_RTS_ACCESS_STEER_CTRL_ACTION(
-                VXGE_HW_RTS_ACCESS_STEER_CTRL_ACTION_READ_ENTRY) |
-                VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL(
-                VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL_FW_MEMO) |
-                VXGE_HW_RTS_ACCESS_STEER_CTRL_STROBE |
-                VXGE_HW_RTS_ACCESS_STEER_CTRL_OFFSET(0);
-
-        status = __vxge_hw_pio_mem_write64(val64,
-                                &vpath_reg->rts_access_steer_ctrl,
-                                VXGE_HW_RTS_ACCESS_STEER_CTRL_STROBE,
-                                VXGE_HW_DEF_DEVICE_POLL_MILLIS);
-
-        if (status != VXGE_HW_OK)
-                goto exit;
-
-        val64 = readq(&vpath_reg->rts_access_steer_ctrl);
-
-        if (val64 & VXGE_HW_RTS_ACCESS_STEER_CTRL_RMACJ_STATUS) {
-
-                data1 = readq(&vpath_reg->rts_access_steer_data0);
-                data2 = readq(&vpath_reg->rts_access_steer_data1);
-
-                fw_date->day =
-                        (u32)VXGE_HW_RTS_ACCESS_STEER_DATA0_GET_FW_VER_DAY(
-                                                data1);
-                fw_date->month =
-                        (u32)VXGE_HW_RTS_ACCESS_STEER_DATA0_GET_FW_VER_MONTH(
-                                                data1);
-                fw_date->year =
-                        (u32)VXGE_HW_RTS_ACCESS_STEER_DATA0_GET_FW_VER_YEAR(
-                                                data1);
-
-                snprintf(fw_date->date, VXGE_HW_FW_STRLEN, "%2.2d/%2.2d/%4.4d",
-                        fw_date->month, fw_date->day, fw_date->year);
-
-                fw_version->major =
-                    (u32)VXGE_HW_RTS_ACCESS_STEER_DATA0_GET_FW_VER_MAJOR(data1);
-                fw_version->minor =
-                    (u32)VXGE_HW_RTS_ACCESS_STEER_DATA0_GET_FW_VER_MINOR(data1);
-                fw_version->build =
-                    (u32)VXGE_HW_RTS_ACCESS_STEER_DATA0_GET_FW_VER_BUILD(data1);
-
-                snprintf(fw_version->version, VXGE_HW_FW_STRLEN, "%d.%d.%d",
-                    fw_version->major, fw_version->minor, fw_version->build);
-
-                flash_date->day =
-                  (u32)VXGE_HW_RTS_ACCESS_STEER_DATA1_GET_FLASH_VER_DAY(data2);
-                flash_date->month =
-                 (u32)VXGE_HW_RTS_ACCESS_STEER_DATA1_GET_FLASH_VER_MONTH(data2);
-                flash_date->year =
-                 (u32)VXGE_HW_RTS_ACCESS_STEER_DATA1_GET_FLASH_VER_YEAR(data2);
-
-                snprintf(flash_date->date, VXGE_HW_FW_STRLEN,
-                        "%2.2d/%2.2d/%4.4d",
-                        flash_date->month, flash_date->day, flash_date->year);
-
-                flash_version->major =
-                 (u32)VXGE_HW_RTS_ACCESS_STEER_DATA1_GET_FLASH_VER_MAJOR(data2);
-                flash_version->minor =
-                 (u32)VXGE_HW_RTS_ACCESS_STEER_DATA1_GET_FLASH_VER_MINOR(data2);
-                flash_version->build =
-                 (u32)VXGE_HW_RTS_ACCESS_STEER_DATA1_GET_FLASH_VER_BUILD(data2);
-
-                snprintf(flash_version->version, VXGE_HW_FW_STRLEN, "%d.%d.%d",
-                        flash_version->major, flash_version->minor,
-                        flash_version->build);
-
-                status = VXGE_HW_OK;
-
-        } else
-                status = VXGE_HW_FAIL;
-exit:
-        return status;
-}
-
-/*
- * __vxge_hw_vpath_pci_func_mode_get - Get the pci mode
- * Returns pci function mode
- */
-static u64
-__vxge_hw_vpath_pci_func_mode_get(
-        u32  vp_id,
-        struct vxge_hw_vpath_reg __iomem *vpath_reg)
-{
-        u64 val64;
-        u64 data1 = 0ULL;
-        enum vxge_hw_status status = VXGE_HW_OK;
-
-        __vxge_hw_read_rts_ds(vpath_reg,
-                VXGE_HW_RTS_ACCESS_STEER_DATA0_MEMO_ITEM_PCI_MODE);
-
-        val64 = VXGE_HW_RTS_ACCESS_STEER_CTRL_ACTION(
-                        VXGE_HW_RTS_ACCESS_STEER_CTRL_ACTION_READ_MEMO_ENTRY) |
-                VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL(
-                        VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL_FW_MEMO) |
-                VXGE_HW_RTS_ACCESS_STEER_CTRL_STROBE |
-                VXGE_HW_RTS_ACCESS_STEER_CTRL_OFFSET(0);
-
-        status = __vxge_hw_pio_mem_write64(val64,
-                                &vpath_reg->rts_access_steer_ctrl,
-                                VXGE_HW_RTS_ACCESS_STEER_CTRL_STROBE,
-                                VXGE_HW_DEF_DEVICE_POLL_MILLIS);
-
-        if (status != VXGE_HW_OK)
-                goto exit;
-
-        val64 = readq(&vpath_reg->rts_access_steer_ctrl);
-
-        if (val64 & VXGE_HW_RTS_ACCESS_STEER_CTRL_RMACJ_STATUS) {
-                data1 = readq(&vpath_reg->rts_access_steer_data0);
-                status = VXGE_HW_OK;
-        } else {
-                data1 = 0;
-                status = VXGE_HW_FAIL;
-        }
-exit:
-        return data1;
-}
-
 /**
  * vxge_hw_device_flick_link_led - Flick (blink) link LED.
  * @hldev: HW device.
@@ -2974,37 +3105,24 @@ exit:
  * Flicker the link LED.
  */
 enum vxge_hw_status
-vxge_hw_device_flick_link_led(struct __vxge_hw_device *hldev,
-                               u64 on_off)
+vxge_hw_device_flick_link_led(struct __vxge_hw_device *hldev, u64 on_off)
 {
-        u64 val64;
-        enum vxge_hw_status status = VXGE_HW_OK;
-        struct vxge_hw_vpath_reg __iomem *vp_reg;
+        struct __vxge_hw_virtualpath *vpath;
+        u64 data0, data1 = 0, steer_ctrl = 0;
+        enum vxge_hw_status status;
 
         if (hldev == NULL) {
                 status = VXGE_HW_ERR_INVALID_DEVICE;
                 goto exit;
         }
 
-        vp_reg = hldev->vpath_reg[hldev->first_vp_id];
-
-        writeq(0, &vp_reg->rts_access_steer_ctrl);
-        wmb();
-        writeq(on_off, &vp_reg->rts_access_steer_data0);
-        writeq(0, &vp_reg->rts_access_steer_data1);
-        wmb();
-
-        val64 = VXGE_HW_RTS_ACCESS_STEER_CTRL_ACTION(
-                        VXGE_HW_RTS_ACCESS_STEER_CTRL_ACTION_LED_CONTROL) |
-                VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL(
-                        VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL_FW_MEMO) |
-                VXGE_HW_RTS_ACCESS_STEER_CTRL_STROBE |
-                VXGE_HW_RTS_ACCESS_STEER_CTRL_OFFSET(0);
+        vpath = &hldev->virtual_paths[hldev->first_vp_id];
 
-        status = __vxge_hw_pio_mem_write64(val64,
-                                &vp_reg->rts_access_steer_ctrl,
-                                VXGE_HW_RTS_ACCESS_STEER_CTRL_STROBE,
-                                VXGE_HW_DEF_DEVICE_POLL_MILLIS);
+        data0 = on_off;
+        status = vxge_hw_vpath_fw_api(vpath,
+                        VXGE_HW_RTS_ACCESS_STEER_CTRL_ACTION_LED_CONTROL,
+                        VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL_FW_MEMO,
+                        0, &data0, &data1, &steer_ctrl);
 exit:
         return status;
 }
@@ -3013,63 +3131,38 @@ exit:
  * __vxge_hw_vpath_rts_table_get - Get the entries from RTS access tables
  */
 enum vxge_hw_status
-__vxge_hw_vpath_rts_table_get(
-        struct __vxge_hw_vpath_handle *vp,
-        u32 action, u32 rts_table, u32 offset, u64 *data1, u64 *data2)
+__vxge_hw_vpath_rts_table_get(struct __vxge_hw_vpath_handle *vp,
+                              u32 action, u32 rts_table, u32 offset,
+                              u64 *data0, u64 *data1)
 {
-        u64 val64;
-        struct __vxge_hw_virtualpath *vpath;
-        struct vxge_hw_vpath_reg __iomem *vp_reg;
-
-        enum vxge_hw_status status = VXGE_HW_OK;
+        enum vxge_hw_status status;
+        u64 steer_ctrl = 0;
 
         if (vp == NULL) {
                 status = VXGE_HW_ERR_INVALID_HANDLE;
                 goto exit;
         }
 
-        vpath = vp->vpath;
-        vp_reg = vpath->vp_reg;
-
-        val64 = VXGE_HW_RTS_ACCESS_STEER_CTRL_ACTION(action) |
-                VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL(rts_table) |
-                VXGE_HW_RTS_ACCESS_STEER_CTRL_STROBE |
-                VXGE_HW_RTS_ACCESS_STEER_CTRL_OFFSET(offset);
-
         if ((rts_table ==
-                VXGE_HW_RTS_ACS_STEER_CTRL_DATA_STRUCT_SEL_RTH_SOLO_IT) ||
+             VXGE_HW_RTS_ACS_STEER_CTRL_DATA_STRUCT_SEL_RTH_SOLO_IT) ||
             (rts_table ==
-                VXGE_HW_RTS_ACS_STEER_CTRL_DATA_STRUCT_SEL_RTH_MULTI_IT) ||
+             VXGE_HW_RTS_ACS_STEER_CTRL_DATA_STRUCT_SEL_RTH_MULTI_IT) ||
             (rts_table ==
-                VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL_RTH_MASK) ||
+             VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL_RTH_MASK) ||
             (rts_table ==
-                VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL_RTH_KEY)) {
-                val64 = val64 | VXGE_HW_RTS_ACCESS_STEER_CTRL_TABLE_SEL;
+             VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL_RTH_KEY)) {
+                steer_ctrl = VXGE_HW_RTS_ACCESS_STEER_CTRL_TABLE_SEL;
         }
 
-        status = __vxge_hw_pio_mem_write64(val64,
-                                &vp_reg->rts_access_steer_ctrl,
-                                VXGE_HW_RTS_ACCESS_STEER_CTRL_STROBE,
-                                vpath->hldev->config.device_poll_millis);
-
+        status = vxge_hw_vpath_fw_api(vp->vpath, action, rts_table, offset,
+                                      data0, data1, &steer_ctrl);
         if (status != VXGE_HW_OK)
                 goto exit;
 
-        val64 = readq(&vp_reg->rts_access_steer_ctrl);
-
-        if (val64 & VXGE_HW_RTS_ACCESS_STEER_CTRL_RMACJ_STATUS) {
-
-                *data1 = readq(&vp_reg->rts_access_steer_data0);
-
-                if ((rts_table ==
-                VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL_DA) ||
-                (rts_table ==
-                VXGE_HW_RTS_ACS_STEER_CTRL_DATA_STRUCT_SEL_RTH_MULTI_IT)) {
-                        *data2 = readq(&vp_reg->rts_access_steer_data1);
-                }
-                status = VXGE_HW_OK;
-        } else
-                status = VXGE_HW_FAIL;
+        if ((rts_table != VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL_DA) ||
+            (rts_table !=
+             VXGE_HW_RTS_ACS_STEER_CTRL_DATA_STRUCT_SEL_RTH_MULTI_IT))
+                *data1 = 0;
 exit:
         return status;
 }
@@ -3078,107 +3171,27 @@ exit:
  * __vxge_hw_vpath_rts_table_set - Set the entries of RTS access tables
  */
 enum vxge_hw_status
-__vxge_hw_vpath_rts_table_set(
-        struct __vxge_hw_vpath_handle *vp, u32 action, u32 rts_table,
-        u32 offset, u64 data1, u64 data2)
+__vxge_hw_vpath_rts_table_set(struct __vxge_hw_vpath_handle *vp, u32 action,
+                              u32 rts_table, u32 offset, u64 steer_data0,
+                              u64 steer_data1)
 {
-        u64 val64;
-        struct __vxge_hw_virtualpath *vpath;
-        enum vxge_hw_status status = VXGE_HW_OK;
-        struct vxge_hw_vpath_reg __iomem *vp_reg;
+        u64 data0, data1 = 0, steer_ctrl = 0;
+        enum vxge_hw_status status;
 
         if (vp == NULL) {
                 status = VXGE_HW_ERR_INVALID_HANDLE;
                 goto exit;
         }
 
-        vpath = vp->vpath;
-        vp_reg = vpath->vp_reg;
-
-        writeq(data1, &vp_reg->rts_access_steer_data0);
-        wmb();
+        data0 = steer_data0;
 
         if ((rts_table == VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL_DA) ||
             (rts_table ==
-                VXGE_HW_RTS_ACS_STEER_CTRL_DATA_STRUCT_SEL_RTH_MULTI_IT)) {
-                writeq(data2, &vp_reg->rts_access_steer_data1);
-                wmb();
-        }
+             VXGE_HW_RTS_ACS_STEER_CTRL_DATA_STRUCT_SEL_RTH_MULTI_IT))
+                data1 = steer_data1;
 
-        val64 = VXGE_HW_RTS_ACCESS_STEER_CTRL_ACTION(action) |
-                VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL(rts_table) |
-                VXGE_HW_RTS_ACCESS_STEER_CTRL_STROBE |
-                VXGE_HW_RTS_ACCESS_STEER_CTRL_OFFSET(offset);
-
-        status = __vxge_hw_pio_mem_write64(val64,
-                                &vp_reg->rts_access_steer_ctrl,
-                                VXGE_HW_RTS_ACCESS_STEER_CTRL_STROBE,
-                                vpath->hldev->config.device_poll_millis);
-
-        if (status != VXGE_HW_OK)
-                goto exit;
-
-        val64 = readq(&vp_reg->rts_access_steer_ctrl);
-
-        if (val64 & VXGE_HW_RTS_ACCESS_STEER_CTRL_RMACJ_STATUS)
-                status = VXGE_HW_OK;
-        else
-                status = VXGE_HW_FAIL;
-exit:
-        return status;
-}
-
-/*
- * __vxge_hw_vpath_addr_get - Get the hw address entry for this vpath
- *               from MAC address table.
- */
-static enum vxge_hw_status
-__vxge_hw_vpath_addr_get(
-        u32 vp_id, struct vxge_hw_vpath_reg __iomem *vpath_reg,
-        u8 (macaddr)[ETH_ALEN], u8 (macaddr_mask)[ETH_ALEN])
-{
-        u32 i;
-        u64 val64;
-        u64 data1 = 0ULL;
-        u64 data2 = 0ULL;
-        enum vxge_hw_status status = VXGE_HW_OK;
-
-        val64 = VXGE_HW_RTS_ACCESS_STEER_CTRL_ACTION(
-                VXGE_HW_RTS_ACCESS_STEER_CTRL_ACTION_LIST_FIRST_ENTRY) |
-                VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL(
-                VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL_DA) |
-                VXGE_HW_RTS_ACCESS_STEER_CTRL_STROBE |
-                VXGE_HW_RTS_ACCESS_STEER_CTRL_OFFSET(0);
-
-        status = __vxge_hw_pio_mem_write64(val64,
-                                &vpath_reg->rts_access_steer_ctrl,
-                                VXGE_HW_RTS_ACCESS_STEER_CTRL_STROBE,
-                                VXGE_HW_DEF_DEVICE_POLL_MILLIS);
-
-        if (status != VXGE_HW_OK)
-                goto exit;
-
-        val64 = readq(&vpath_reg->rts_access_steer_ctrl);
-
-        if (val64 & VXGE_HW_RTS_ACCESS_STEER_CTRL_RMACJ_STATUS) {
-
-                data1 = readq(&vpath_reg->rts_access_steer_data0);
-                data2 = readq(&vpath_reg->rts_access_steer_data1);
-
-                data1 = VXGE_HW_RTS_ACCESS_STEER_DATA0_GET_DA_MAC_ADDR(data1);
-                data2 = VXGE_HW_RTS_ACCESS_STEER_DATA1_GET_DA_MAC_ADDR_MASK(
-                                                        data2);
-
-                for (i = ETH_ALEN; i > 0; i--) {
-                        macaddr[i-1] = (u8)(data1 & 0xFF);
-                        data1 >>= 8;
-
-                        macaddr_mask[i-1] = (u8)(data2 & 0xFF);
-                        data2 >>= 8;
-                }
-                status = VXGE_HW_OK;
-        } else
-                status = VXGE_HW_FAIL;
+        status = vxge_hw_vpath_fw_api(vp->vpath, action, rts_table, offset,
+                                      &data0, &data1, &steer_ctrl);
 exit:
         return status;
 }
@@ -3204,6 +3217,8 @@ enum vxge_hw_status vxge_hw_vpath_rts_rth_set(
                      VXGE_HW_RTS_ACCESS_STEER_CTRL_ACTION_READ_ENTRY,
                      VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL_RTH_GEN_CFG,
                         0, &data0, &data1);
+        if (status != VXGE_HW_OK)
+                goto exit;
 
         data0 &= ~(VXGE_HW_RTS_ACCESS_STEER_DATA0_RTH_GEN_BUCKET_SIZE(0xf) |
                         VXGE_HW_RTS_ACCESS_STEER_DATA0_RTH_GEN_ALG_SEL(0x3));
@@ -4117,6 +4132,7 @@ __vxge_hw_vp_initialize(struct __vxge_hw_device *hldev, u32 vp_id,
 
         vpath = &hldev->virtual_paths[vp_id];
 
+        spin_lock_init(&hldev->virtual_paths[vp_id].lock);
         vpath->vp_id = vp_id;
         vpath->vp_open = VXGE_HW_VP_OPEN;
         vpath->hldev = hldev;
@@ -4127,14 +4143,12 @@ __vxge_hw_vp_initialize(struct __vxge_hw_device *hldev, u32 vp_id,
         __vxge_hw_vpath_reset(hldev, vp_id);
 
         status = __vxge_hw_vpath_reset_check(vpath);
-
         if (status != VXGE_HW_OK) {
                 memset(vpath, 0, sizeof(struct __vxge_hw_virtualpath));
                 goto exit;
         }
 
         status = __vxge_hw_vpath_mgmt_read(hldev, vpath);
-
         if (status != VXGE_HW_OK) {
                 memset(vpath, 0, sizeof(struct __vxge_hw_virtualpath));
                 goto exit;
@@ -4148,7 +4162,6 @@ __vxge_hw_vp_initialize(struct __vxge_hw_device *hldev, u32 vp_id,
                 hldev->tim_int_mask1, vp_id);
 
         status = __vxge_hw_vpath_initialize(hldev, vp_id);
-
         if (status != VXGE_HW_OK)
                 __vxge_hw_vp_terminate(hldev, vp_id);
 exit:
@@ -4242,15 +4255,12 @@ vxge_hw_vpath_open(struct __vxge_hw_device *hldev,
         if (status != VXGE_HW_OK)
                 goto vpath_open_exit1;
 
-        vp = (struct __vxge_hw_vpath_handle *)
-                vmalloc(sizeof(struct __vxge_hw_vpath_handle));
+        vp = vzalloc(sizeof(struct __vxge_hw_vpath_handle));
         if (vp == NULL) {
                 status = VXGE_HW_ERR_OUT_OF_MEMORY;
                 goto vpath_open_exit2;
         }
 
-        memset(vp, 0, sizeof(struct __vxge_hw_vpath_handle));
-
         vp->vpath = vpath;
 
         if (vpath->vp_config->fifo.enable == VXGE_HW_FIFO_ENABLE) {
@@ -4335,16 +4345,18 @@ vpath_open_exit1:
 void
 vxge_hw_vpath_rx_doorbell_init(struct __vxge_hw_vpath_handle *vp)
 {
-        struct __vxge_hw_virtualpath *vpath = NULL;
+        struct __vxge_hw_virtualpath *vpath = vp->vpath;
+        struct __vxge_hw_ring *ring = vpath->ringh;
+        struct vxgedev *vdev = netdev_priv(vpath->hldev->ndev);
         u64 new_count, val64, val164;
-        struct __vxge_hw_ring *ring;
 
-        vpath = vp->vpath;
-        ring = vpath->ringh;
+        if (vdev->titan1) {
+                new_count = readq(&vpath->vp_reg->rxdmem_size);
+                new_count &= 0x1fff;
+        } else
+                new_count = ring->config->ring_blocks * VXGE_HW_BLOCK_SIZE / 8;
 
-        new_count = readq(&vpath->vp_reg->rxdmem_size);
-        new_count &= 0x1fff;
-        val164 = (VXGE_HW_RXDMEM_SIZE_PRC_RXDMEM_SIZE(new_count));
+        val164 = VXGE_HW_RXDMEM_SIZE_PRC_RXDMEM_SIZE(new_count);
 
         writeq(VXGE_HW_PRC_RXD_DOORBELL_NEW_QW_CNT(val164),
                 &vpath->vp_reg->prc_rxd_doorbell);
@@ -4414,7 +4426,9 @@ enum vxge_hw_status vxge_hw_vpath_close(struct __vxge_hw_vpath_handle *vp)
 
         __vxge_hw_vp_terminate(devh, vp_id);
 
+        spin_lock(&vpath->lock);
         vpath->vp_open = VXGE_HW_VP_NOT_OPEN;
+        spin_unlock(&vpath->lock);
 
 vpath_close_exit:
         return status;
@@ -4810,7 +4824,7 @@ static void vxge_os_dma_free(struct pci_dev *pdev, const void *vaddr,
  * __vxge_hw_blockpool_create - Create block pool
  */
 
-enum vxge_hw_status
+static enum vxge_hw_status
 __vxge_hw_blockpool_create(struct __vxge_hw_device *hldev,
                            struct __vxge_hw_blockpool *blockpool,
                            u32 pool_size,
@@ -4910,7 +4924,7 @@ blockpool_create_exit:
  * __vxge_hw_blockpool_destroy - Deallocates the block pool
  */
 
-void __vxge_hw_blockpool_destroy(struct __vxge_hw_blockpool *blockpool)
+static void __vxge_hw_blockpool_destroy(struct __vxge_hw_blockpool *blockpool)
 {
 
         struct __vxge_hw_device *hldev;
@@ -5047,8 +5061,7 @@ static void vxge_hw_blockpool_block_add(struct __vxge_hw_device *devh,
                                 item);
 
         if (entry == NULL)
-                entry = (struct __vxge_hw_blockpool_entry *)
-                        vmalloc(sizeof(struct __vxge_hw_blockpool_entry));
+                entry = vmalloc(sizeof(struct __vxge_hw_blockpool_entry));
         else
                 list_del(&entry->item);
 
@@ -5076,7 +5089,7 @@ exit:
  * Allocates a block of memory of given size, either from block pool
  * or by calling vxge_os_dma_malloc()
  */
-void *
+static void *
 __vxge_hw_blockpool_malloc(struct __vxge_hw_device *devh, u32 size,
                                 struct vxge_hw_mempool_dma *dma_object)
 {
@@ -5140,7 +5153,7 @@ exit:
  * __vxge_hw_blockpool_free - Frees the memory allcoated with
                                 __vxge_hw_blockpool_malloc
  */
-void
+static void
 __vxge_hw_blockpool_free(struct __vxge_hw_device *devh,
                         void *memblock, u32 size,
                         struct vxge_hw_mempool_dma *dma_object)
@@ -5164,8 +5177,7 @@ __vxge_hw_blockpool_free(struct __vxge_hw_device *devh,
                                         item);
 
                 if (entry == NULL)
-                        entry = (struct __vxge_hw_blockpool_entry *)
-                                vmalloc(sizeof(
+                        entry = vmalloc(sizeof(
                                         struct __vxge_hw_blockpool_entry));
                 else
                         list_del(&entry->item);
@@ -5192,7 +5204,7 @@ __vxge_hw_blockpool_free(struct __vxge_hw_device *devh,
  * __vxge_hw_blockpool_block_allocate - Allocates a block from block pool
  * This function allocates a block from block pool or from the system
  */
-struct __vxge_hw_blockpool_entry *
+static struct __vxge_hw_blockpool_entry *
 __vxge_hw_blockpool_block_allocate(struct __vxge_hw_device *devh, u32 size)
 {
         struct __vxge_hw_blockpool_entry *entry = NULL;
@@ -5227,7 +5239,7 @@ __vxge_hw_blockpool_block_allocate(struct __vxge_hw_device *devh, u32 size)
  *
  * This function frees a block from block pool
  */
-void
+static void
 __vxge_hw_blockpool_block_free(struct __vxge_hw_device *devh,
                         struct __vxge_hw_blockpool_entry *entry)
 {
diff --git a/drivers/net/vxge/vxge-config.h b/drivers/net/vxge/vxge-config.h
index 5c00861b6c2..5b2c8313426 100644
--- a/drivers/net/vxge/vxge-config.h
+++ b/drivers/net/vxge/vxge-config.h
@@ -20,13 +20,6 @@
 #define VXGE_CACHE_LINE_SIZE 128
 #endif
 
-#define vxge_os_vaprintf(level, mask, fmt, ...) { \
-        char buff[255]; \
-                snprintf(buff, 255, fmt, __VA_ARGS__); \
-                printk(buff); \
-                printk("\n"); \
-}
-
 #ifndef VXGE_ALIGN
 #define VXGE_ALIGN(adrs, size) \
         (((size) - (((u64)adrs) & ((size)-1))) & ((size)-1))
@@ -36,8 +29,16 @@
 #define VXGE_HW_MAX_MTU                         9600
 #define VXGE_HW_DEFAULT_MTU                     1500
 
-#ifdef VXGE_DEBUG_ASSERT
+#define VXGE_HW_MAX_ROM_IMAGES                  8
+
+struct eprom_image {
+        u8 is_valid:1;
+        u8 index;
+        u8 type;
+        u16 version;
+};
 
+#ifdef VXGE_DEBUG_ASSERT
 /**
  * vxge_assert
  * @test: C-condition to check
@@ -48,16 +49,13 @@
  * compilation
  * time.
  */
-#define vxge_assert(test) { \
-        if (!(test)) \
-                vxge_os_bug("bad cond: "#test" at %s:%d\n", \
-                                __FILE__, __LINE__); }
+#define vxge_assert(test) BUG_ON(!(test))
 #else
 #define vxge_assert(test)
 #endif /* end of VXGE_DEBUG_ASSERT */
 
 /**
- * enum enum vxge_debug_level
+ * enum vxge_debug_level
  * @VXGE_NONE: debug disabled
  * @VXGE_ERR: all errors going to be logged out
  * @VXGE_TRACE: all errors plus all kind of verbose tracing print outs
@@ -159,6 +157,47 @@ enum vxge_hw_device_link_state {
 };
 
 /**
+ * enum enum vxge_hw_fw_upgrade_code - FW upgrade return codes.
+ * @VXGE_HW_FW_UPGRADE_OK: All OK send next 16 bytes
+ * @VXGE_HW_FW_UPGRADE_DONE:  upload completed
+ * @VXGE_HW_FW_UPGRADE_ERR:  upload error
+ * @VXGE_FW_UPGRADE_BYTES2SKIP:  skip bytes in the stream
+ *
+ */
+enum vxge_hw_fw_upgrade_code {
+        VXGE_HW_FW_UPGRADE_OK           = 0,
+        VXGE_HW_FW_UPGRADE_DONE         = 1,
+        VXGE_HW_FW_UPGRADE_ERR          = 2,
+        VXGE_FW_UPGRADE_BYTES2SKIP      = 3
+};
+
+/**
+ * enum enum vxge_hw_fw_upgrade_err_code - FW upgrade error codes.
+ * @VXGE_HW_FW_UPGRADE_ERR_CORRUPT_DATA_1: corrupt data
+ * @VXGE_HW_FW_UPGRADE_ERR_BUFFER_OVERFLOW: buffer overflow
+ * @VXGE_HW_FW_UPGRADE_ERR_INV_NCF_FILE_3: invalid .ncf file
+ * @VXGE_HW_FW_UPGRADE_ERR_INV_NCF_FILE_4: invalid .ncf file
+ * @VXGE_HW_FW_UPGRADE_ERR_INV_NCF_FILE_5: invalid .ncf file
+ * @VXGE_HW_FW_UPGRADE_ERR_INV_NCF_FILE_6: invalid .ncf file
+ * @VXGE_HW_FW_UPGRADE_ERR_CORRUPT_DATA_7: corrupt data
+ * @VXGE_HW_FW_UPGRADE_ERR_INV_NCF_FILE_8: invalid .ncf file
+ * @VXGE_HW_FW_UPGRADE_ERR_GENERIC_ERROR_UNKNOWN: generic error unknown type
+ * @VXGE_HW_FW_UPGRADE_ERR_FAILED_TO_FLASH: failed to flash image check failed
+ */
+enum vxge_hw_fw_upgrade_err_code {
+        VXGE_HW_FW_UPGRADE_ERR_CORRUPT_DATA_1           = 1,
+        VXGE_HW_FW_UPGRADE_ERR_BUFFER_OVERFLOW          = 2,
+        VXGE_HW_FW_UPGRADE_ERR_INV_NCF_FILE_3           = 3,
+        VXGE_HW_FW_UPGRADE_ERR_INV_NCF_FILE_4           = 4,
+        VXGE_HW_FW_UPGRADE_ERR_INV_NCF_FILE_5           = 5,
+        VXGE_HW_FW_UPGRADE_ERR_INV_NCF_FILE_6           = 6,
+        VXGE_HW_FW_UPGRADE_ERR_CORRUPT_DATA_7           = 7,
+        VXGE_HW_FW_UPGRADE_ERR_INV_NCF_FILE_8           = 8,
+        VXGE_HW_FW_UPGRADE_ERR_GENERIC_ERROR_UNKNOWN    = 9,
+        VXGE_HW_FW_UPGRADE_ERR_FAILED_TO_FLASH          = 10
+};
+
+/**
  * struct vxge_hw_device_date - Date Format
  * @day: Day
  * @month: Month
@@ -465,7 +504,6 @@ struct vxge_hw_device_config {
  * See also: vxge_hw_driver_initialize().
  */
 struct vxge_hw_uld_cbs {
-
         void (*link_up)(struct __vxge_hw_device *devh);
         void (*link_down)(struct __vxge_hw_device *devh);
         void (*crit_err)(struct __vxge_hw_device *devh,
@@ -652,6 +690,7 @@ struct __vxge_hw_virtualpath {
         struct vxge_hw_vpath_stats_hw_info      *hw_stats;
         struct vxge_hw_vpath_stats_hw_info      *hw_stats_sav;
         struct vxge_hw_vpath_stats_sw_info      *sw_stats;
+        spinlock_t lock;
 };
 
 /*
@@ -674,9 +713,6 @@ struct __vxge_hw_vpath_handle{
 /**
  * struct __vxge_hw_device  - Hal device object
  * @magic: Magic Number
- * @device_id: PCI Device Id of the adapter
- * @major_revision: PCI Device major revision
- * @minor_revision: PCI Device minor revision
  * @bar0: BAR0 virtual address.
  * @pdev: Physical device handle
  * @config: Confguration passed by the LL driver at initialization
@@ -688,9 +724,6 @@ struct __vxge_hw_device {
         u32                             magic;
 #define VXGE_HW_DEVICE_MAGIC            0x12345678
 #define VXGE_HW_DEVICE_DEAD             0xDEADDEAD
-        u16                             device_id;
-        u8                              major_revision;
-        u8                              minor_revision;
         void __iomem                    *bar0;
         struct pci_dev                  *pdev;
         struct net_device               *ndev;
@@ -731,6 +764,7 @@ struct __vxge_hw_device {
         u32                             debug_level;
         u32                             level_err;
         u32                             level_trace;
+        u16 eprom_versions[VXGE_HW_MAX_ROM_IMAGES];
 };
 
 #define VXGE_HW_INFO_LEN        64
@@ -1413,12 +1447,12 @@ enum vxge_hw_rth_algoritms {
  * See also: vxge_hw_vpath_rts_rth_set(), vxge_hw_vpath_rts_rth_get().
  */
 struct vxge_hw_rth_hash_types {
-        u8 hash_type_tcpipv4_en;
-        u8 hash_type_ipv4_en;
-        u8 hash_type_tcpipv6_en;
-        u8 hash_type_ipv6_en;
-        u8 hash_type_tcpipv6ex_en;
-        u8 hash_type_ipv6ex_en;
+        u8 hash_type_tcpipv4_en:1,
+           hash_type_ipv4_en:1,
+           hash_type_tcpipv6_en:1,
+           hash_type_ipv6_en:1,
+           hash_type_tcpipv6ex_en:1,
+           hash_type_ipv6ex_en:1;
 };
 
 void vxge_hw_device_debug_set(
@@ -2000,7 +2034,7 @@ enum vxge_hw_status
 vxge_hw_vpath_strip_fcs_check(struct __vxge_hw_device *hldev, u64 vpath_mask);
 
 /**
- * vxge_debug
+ * vxge_debug_ll
  * @level: level of debug verbosity.
  * @mask: mask for the debug
  * @buf: Circular buffer for tracing
@@ -2012,26 +2046,13 @@ vxge_hw_vpath_strip_fcs_check(struct __vxge_hw_device *hldev, u64 vpath_mask);
  * may be compiled out if DEBUG macro was never defined.
  * See also: enum vxge_debug_level{}.
  */
-
-#define vxge_trace_aux(level, mask, fmt, ...) \
-{\
-                vxge_os_vaprintf(level, mask, fmt, __VA_ARGS__);\
-}
-
-#define vxge_debug(module, level, mask, fmt, ...) { \
-if ((level >= VXGE_TRACE && ((module & VXGE_DEBUG_TRACE_MASK) == module)) || \
-        (level >= VXGE_ERR && ((module & VXGE_DEBUG_ERR_MASK) == module))) {\
-        if ((mask & VXGE_DEBUG_MASK) == mask)\
-                vxge_trace_aux(level, mask, fmt, __VA_ARGS__); \
-} \
-}
-
 #if (VXGE_COMPONENT_LL & VXGE_DEBUG_MODULE_MASK)
-#define vxge_debug_ll(level, mask, fmt, ...) \
-{\
-        vxge_debug(VXGE_COMPONENT_LL, level, mask, fmt, __VA_ARGS__);\
-}
-
+#define vxge_debug_ll(level, mask, fmt, ...) do {                              \
+        if ((level >= VXGE_ERR && VXGE_COMPONENT_LL & VXGE_DEBUG_ERR_MASK) ||  \
+            (level >= VXGE_TRACE && VXGE_COMPONENT_LL & VXGE_DEBUG_TRACE_MASK))\
+                if ((mask & VXGE_DEBUG_MASK) == mask)                          \
+                        printk(fmt "\n", __VA_ARGS__);                         \
+} while (0)
 #else
 #define vxge_debug_ll(level, mask, fmt, ...)
 #endif
@@ -2051,4 +2072,26 @@ enum vxge_hw_status vxge_hw_vpath_rts_rth_set(
 
 enum vxge_hw_status
 __vxge_hw_device_is_privilaged(u32 host_type, u32 func_id);
+
+#define VXGE_HW_MIN_SUCCESSIVE_IDLE_COUNT 5
+#define VXGE_HW_MAX_POLLING_COUNT 100
+
+void
+vxge_hw_device_wait_receive_idle(struct __vxge_hw_device *hldev);
+
+enum vxge_hw_status
+vxge_hw_upgrade_read_version(struct __vxge_hw_device *hldev, u32 *major,
+                             u32 *minor, u32 *build);
+
+enum vxge_hw_status vxge_hw_flash_fw(struct __vxge_hw_device *hldev);
+
+enum vxge_hw_status
+vxge_update_fw_image(struct __vxge_hw_device *hldev, const u8 *filebuf,
+                     int size);
+
+enum vxge_hw_status
+vxge_hw_vpath_eprom_img_ver_get(struct __vxge_hw_device *hldev,
+                                struct eprom_image *eprom_image_data);
+
+int vxge_hw_vpath_wait_receive_idle(struct __vxge_hw_device *hldev, u32 vp_id);
 #endif
diff --git a/drivers/net/vxge/vxge-ethtool.c b/drivers/net/vxge/vxge-ethtool.c
index b67746eef92..1dd3a21b3a4 100644
--- a/drivers/net/vxge/vxge-ethtool.c
+++ b/drivers/net/vxge/vxge-ethtool.c
@@ -11,7 +11,7 @@
  *                 Virtualized Server Adapter.
  * Copyright(c) 2002-2010 Exar Corp.
  ******************************************************************************/
-#include<linux/ethtool.h>
+#include <linux/ethtool.h>
 #include <linux/slab.h>
 #include <linux/pci.h>
 #include <linux/etherdevice.h>
@@ -29,7 +29,6 @@
  * Return value:
  * 0 on success.
  */
-
 static int vxge_ethtool_sset(struct net_device *dev, struct ethtool_cmd *info)
 {
         /* We currently only support 10Gb/FULL */
@@ -79,10 +78,9 @@ static int vxge_ethtool_gset(struct net_device *dev, struct ethtool_cmd *info)
  * Returns driver specefic information like name, version etc.. to ethtool.
  */
 static void vxge_ethtool_gdrvinfo(struct net_device *dev,
-                        struct ethtool_drvinfo *info)
+                                  struct ethtool_drvinfo *info)
 {
-        struct vxgedev *vdev;
-        vdev = (struct vxgedev *)netdev_priv(dev);
+        struct vxgedev *vdev = netdev_priv(dev);
         strlcpy(info->driver, VXGE_DRIVER_NAME, sizeof(VXGE_DRIVER_NAME));
         strlcpy(info->version, DRV_VERSION, sizeof(DRV_VERSION));
         strlcpy(info->fw_version, vdev->fw_version, VXGE_HW_FW_STRLEN);
@@ -104,15 +102,14 @@ static void vxge_ethtool_gdrvinfo(struct net_device *dev,
  * buffer area.
  */
 static void vxge_ethtool_gregs(struct net_device *dev,
-                        struct ethtool_regs *regs, void *space)
+                               struct ethtool_regs *regs, void *space)
 {
         int index, offset;
         enum vxge_hw_status status;
         u64 reg;
-        u64 *reg_space = (u64 *) space;
-        struct vxgedev *vdev = (struct vxgedev *)netdev_priv(dev);
-        struct __vxge_hw_device  *hldev = (struct __vxge_hw_device *)
-                                        pci_get_drvdata(vdev->pdev);
+        u64 *reg_space = (u64 *)space;
+        struct vxgedev *vdev = netdev_priv(dev);
+        struct __vxge_hw_device *hldev = vdev->devh;
 
         regs->len = sizeof(struct vxge_hw_vpath_reg) * vdev->no_of_vpath;
         regs->version = vdev->pdev->subsystem_device;
@@ -147,9 +144,8 @@ static void vxge_ethtool_gregs(struct net_device *dev,
  */
 static int vxge_ethtool_idnic(struct net_device *dev, u32 data)
 {
-        struct vxgedev *vdev = (struct vxgedev *)netdev_priv(dev);
-        struct __vxge_hw_device  *hldev = (struct __vxge_hw_device  *)
-                        pci_get_drvdata(vdev->pdev);
+        struct vxgedev *vdev = netdev_priv(dev);
+        struct __vxge_hw_device *hldev = vdev->devh;
 
         vxge_hw_device_flick_link_led(hldev, VXGE_FLICKER_ON);
         msleep_interruptible(data ? (data * HZ) : VXGE_MAX_FLICKER_TIME);
@@ -168,11 +164,10 @@ static int vxge_ethtool_idnic(struct net_device *dev, u32 data)
  *  void
  */
 static void vxge_ethtool_getpause_data(struct net_device *dev,
-                                        struct ethtool_pauseparam *ep)
+                                       struct ethtool_pauseparam *ep)
 {
-        struct vxgedev *vdev = (struct vxgedev *)netdev_priv(dev);
-        struct __vxge_hw_device  *hldev = (struct __vxge_hw_device  *)
-                        pci_get_drvdata(vdev->pdev);
+        struct vxgedev *vdev = netdev_priv(dev);
+        struct __vxge_hw_device *hldev = vdev->devh;
 
         vxge_hw_device_getpause_data(hldev, 0, &ep->tx_pause, &ep->rx_pause);
 }
@@ -188,11 +183,10 @@ static void vxge_ethtool_getpause_data(struct net_device *dev,
  * int, returns 0 on Success
  */
 static int vxge_ethtool_setpause_data(struct net_device *dev,
-                                        struct ethtool_pauseparam *ep)
+                                      struct ethtool_pauseparam *ep)
 {
-        struct vxgedev *vdev = (struct vxgedev *)netdev_priv(dev);
-        struct __vxge_hw_device  *hldev = (struct __vxge_hw_device  *)
-                        pci_get_drvdata(vdev->pdev);
+        struct vxgedev *vdev = netdev_priv(dev);
+        struct __vxge_hw_device *hldev = vdev->devh;
 
         vxge_hw_device_setpause_data(hldev, 0, ep->tx_pause, ep->rx_pause);
 
@@ -209,9 +203,8 @@ static void vxge_get_ethtool_stats(struct net_device *dev,
         enum vxge_hw_status status;
         enum vxge_hw_status swstatus;
         struct vxge_vpath *vpath = NULL;
-
-        struct vxgedev *vdev = (struct vxgedev *)netdev_priv(dev);
-        struct __vxge_hw_device  *hldev = vdev->devh;
+        struct vxgedev *vdev = netdev_priv(dev);
+        struct __vxge_hw_device *hldev = vdev->devh;
         struct vxge_hw_xmac_stats *xmac_stats;
         struct vxge_hw_device_stats_sw_info *sw_stats;
         struct vxge_hw_device_stats_hw_info *hw_stats;
@@ -574,12 +567,12 @@ static void vxge_get_ethtool_stats(struct net_device *dev,
         kfree(hw_stats);
 }
 
-static void vxge_ethtool_get_strings(struct net_device *dev,
-                              u32 stringset, u8 *data)
+static void vxge_ethtool_get_strings(struct net_device *dev, u32 stringset,
+                                     u8 *data)
 {
         int stat_size = 0;
         int i, j;
-        struct vxgedev *vdev = (struct vxgedev *)netdev_priv(dev);
+        struct vxgedev *vdev = netdev_priv(dev);
         switch (stringset) {
         case ETH_SS_STATS:
                 vxge_add_string("VPATH STATISTICS%s\t\t\t",
@@ -1066,21 +1059,21 @@ static void vxge_ethtool_get_strings(struct net_device *dev,
 
 static int vxge_ethtool_get_regs_len(struct net_device *dev)
 {
-        struct vxgedev *vdev = (struct vxgedev *)netdev_priv(dev);
+        struct vxgedev *vdev = netdev_priv(dev);
 
         return sizeof(struct vxge_hw_vpath_reg) * vdev->no_of_vpath;
 }
 
 static u32 vxge_get_rx_csum(struct net_device *dev)
 {
-        struct vxgedev *vdev = (struct vxgedev *)netdev_priv(dev);
+        struct vxgedev *vdev = netdev_priv(dev);
 
         return vdev->rx_csum;
 }
 
 static int vxge_set_rx_csum(struct net_device *dev, u32 data)
 {
-        struct vxgedev *vdev = (struct vxgedev *)netdev_priv(dev);
+        struct vxgedev *vdev = netdev_priv(dev);
 
         if (data)
                 vdev->rx_csum = 1;
@@ -1102,7 +1095,7 @@ static int vxge_ethtool_op_set_tso(struct net_device *dev, u32 data)
 
 static int vxge_ethtool_get_sset_count(struct net_device *dev, int sset)
 {
-        struct vxgedev *vdev = (struct vxgedev *)netdev_priv(dev);
+        struct vxgedev *vdev = netdev_priv(dev);
 
         switch (sset) {
         case ETH_SS_STATS:
@@ -1119,6 +1112,59 @@ static int vxge_ethtool_get_sset_count(struct net_device *dev, int sset)
         }
 }
 
+static int vxge_set_flags(struct net_device *dev, u32 data)
+{
+        struct vxgedev *vdev = netdev_priv(dev);
+        enum vxge_hw_status status;
+
+        if (data & ~ETH_FLAG_RXHASH)
+                return -EOPNOTSUPP;
+
+        if (!!(data & ETH_FLAG_RXHASH) == vdev->devh->config.rth_en)
+                return 0;
+
+        if (netif_running(dev) || (vdev->config.rth_steering == NO_STEERING))
+                return -EINVAL;
+
+        vdev->devh->config.rth_en = !!(data & ETH_FLAG_RXHASH);
+
+        /* Enabling RTH requires some of the logic in vxge_device_register and a
+         * vpath reset.  Due to these restrictions, only allow modification
+         * while the interface is down.
+         */
+        status = vxge_reset_all_vpaths(vdev);
+        if (status != VXGE_HW_OK) {
+                vdev->devh->config.rth_en = !vdev->devh->config.rth_en;
+                return -EFAULT;
+        }
+
+        if (vdev->devh->config.rth_en)
+                dev->features |= NETIF_F_RXHASH;
+        else
+                dev->features &= ~NETIF_F_RXHASH;
+
+        return 0;
+}
+
+static int vxge_fw_flash(struct net_device *dev, struct ethtool_flash *parms)
+{
+        struct vxgedev *vdev = netdev_priv(dev);
+
+        if (vdev->max_vpath_supported != VXGE_HW_MAX_VIRTUAL_PATHS) {
+                printk(KERN_INFO "Single Function Mode is required to flash the"
+                       " firmware\n");
+                return -EINVAL;
+        }
+
+        if (netif_running(dev)) {
+                printk(KERN_INFO "Interface %s must be down to flash the "
+                       "firmware\n", dev->name);
+                return -EBUSY;
+        }
+
+        return vxge_fw_upgrade(vdev, parms->data, 1);
+}
+
 static const struct ethtool_ops vxge_ethtool_ops = {
         .get_settings           = vxge_ethtool_gset,
         .set_settings           = vxge_ethtool_sset,
@@ -1131,7 +1177,7 @@ static const struct ethtool_ops vxge_ethtool_ops = {
         .get_rx_csum            = vxge_get_rx_csum,
         .set_rx_csum            = vxge_set_rx_csum,
         .get_tx_csum            = ethtool_op_get_tx_csum,
-        .set_tx_csum            = ethtool_op_set_tx_hw_csum,
+        .set_tx_csum            = ethtool_op_set_tx_ipv6_csum,
         .get_sg                 = ethtool_op_get_sg,
         .set_sg                 = ethtool_op_set_sg,
         .get_tso                = ethtool_op_get_tso,
@@ -1140,6 +1186,8 @@ static const struct ethtool_ops vxge_ethtool_ops = {
         .phys_id                = vxge_ethtool_idnic,
         .get_sset_count         = vxge_ethtool_get_sset_count,
         .get_ethtool_stats      = vxge_get_ethtool_stats,
+        .set_flags              = vxge_set_flags,
+        .flash_device           = vxge_fw_flash,
 };
 
 void vxge_initialize_ethtool_ops(struct net_device *ndev)
diff --git a/drivers/net/vxge/vxge-main.c b/drivers/net/vxge/vxge-main.c
index 813829f3d02..4877b3b8a29 100644
--- a/drivers/net/vxge/vxge-main.c
+++ b/drivers/net/vxge/vxge-main.c
@@ -50,6 +50,8 @@
 #include <net/ip.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
+#include <linux/firmware.h>
+#include <linux/net_tstamp.h>
 #include "vxge-main.h"
 #include "vxge-reg.h"
 
@@ -90,7 +92,6 @@ static int vxge_mac_list_add(struct vxge_vpath *vpath, struct macInfo *mac);
 static int vxge_mac_list_del(struct vxge_vpath *vpath, struct macInfo *mac);
 static enum vxge_hw_status vxge_restore_vpath_vid_table(struct vxge_vpath *vpath);
 static enum vxge_hw_status vxge_restore_vpath_mac_addr(struct vxge_vpath *vpath);
-static enum vxge_hw_status vxge_reset_all_vpaths(struct vxgedev *vdev);
 
 static inline int is_vxge_card_up(struct vxgedev *vdev)
 {
@@ -152,7 +153,7 @@ static void
 vxge_callback_link_up(struct __vxge_hw_device *hldev)
 {
         struct net_device *dev = hldev->ndev;
-        struct vxgedev *vdev = (struct vxgedev *)netdev_priv(dev);
+        struct vxgedev *vdev = netdev_priv(dev);
 
         vxge_debug_entryexit(VXGE_TRACE, "%s: %s:%d",
                 vdev->ndev->name, __func__, __LINE__);
@@ -176,7 +177,7 @@ static void
 vxge_callback_link_down(struct __vxge_hw_device *hldev)
 {
         struct net_device *dev = hldev->ndev;
-        struct vxgedev *vdev = (struct vxgedev *)netdev_priv(dev);
+        struct vxgedev *vdev = netdev_priv(dev);
 
         vxge_debug_entryexit(VXGE_TRACE,
                 "%s: %s:%d", vdev->ndev->name, __func__, __LINE__);
@@ -369,7 +370,7 @@ vxge_rx_1b_compl(struct __vxge_hw_ring *ringh, void *dtr,
                  u8 t_code, void *userdata)
 {
         struct vxge_ring *ring = (struct vxge_ring *)userdata;
-        struct  net_device *dev = ring->ndev;
+        struct net_device *dev = ring->ndev;
         unsigned int dma_sizes;
         void *first_dtr = NULL;
         int dtr_cnt = 0;
@@ -513,6 +514,23 @@ vxge_rx_1b_compl(struct __vxge_hw_ring *ringh, void *dtr,
                 else
                         skb_checksum_none_assert(skb);
 
+
+                if (ring->rx_hwts) {
+                        struct skb_shared_hwtstamps *skb_hwts;
+                        u32 ns = *(u32 *)(skb->head + pkt_length);
+
+                        skb_hwts = skb_hwtstamps(skb);
+                        skb_hwts->hwtstamp = ns_to_ktime(ns);
+                        skb_hwts->syststamp.tv64 = 0;
+                }
+
+                /* rth_hash_type and rth_it_hit are non-zero regardless of
+                 * whether rss is enabled.  Only the rth_value is zero/non-zero
+                 * if rss is disabled/enabled, so key off of that.
+                 */
+                if (ext_info.rth_value)
+                        skb->rxhash = ext_info.rth_value;
+
                 vxge_rx_complete(ring, skb, ext_info.vlan,
                         pkt_length, &ext_info);
 
@@ -670,7 +688,7 @@ static int vxge_learn_mac(struct vxgedev *vdev, u8 *mac_header)
         struct vxge_vpath *vpath = NULL;
         struct __vxge_hw_device *hldev;
 
-        hldev = (struct __vxge_hw_device *) pci_get_drvdata(vdev->pdev);
+        hldev = pci_get_drvdata(vdev->pdev);
 
         mac_address = (u8 *)&mac_addr;
         memcpy(mac_address, mac_header, ETH_ALEN);
@@ -769,7 +787,7 @@ vxge_xmit(struct sk_buff *skb, struct net_device *dev)
                 return NETDEV_TX_OK;
         }
 
-        vdev = (struct vxgedev *)netdev_priv(dev);
+        vdev = netdev_priv(dev);
 
         if (unlikely(!is_vxge_card_up(vdev))) {
                 vxge_debug_tx(VXGE_ERR,
@@ -1034,7 +1052,7 @@ static void vxge_set_multicast(struct net_device *dev)
         vxge_debug_entryexit(VXGE_TRACE,
                 "%s:%d", __func__, __LINE__);
 
-        vdev = (struct vxgedev *)netdev_priv(dev);
+        vdev = netdev_priv(dev);
         hldev = (struct __vxge_hw_device  *)vdev->devh;
 
         if (unlikely(!is_vxge_card_up(vdev)))
@@ -1094,7 +1112,7 @@ static void vxge_set_multicast(struct net_device *dev)
                 /* Delete previous MC's */
                 for (i = 0; i < mcast_cnt; i++) {
                         list_for_each_safe(entry, next, list_head) {
-                                mac_entry = (struct vxge_mac_addrs *) entry;
+                                mac_entry = (struct vxge_mac_addrs *)entry;
                                 /* Copy the mac address to delete */
                                 mac_address = (u8 *)&mac_entry->macaddr;
                                 memcpy(mac_info.macaddr, mac_address, ETH_ALEN);
@@ -1137,7 +1155,7 @@ _set_all_mcast:
                 /* Delete previous MC's */
                 for (i = 0; i < mcast_cnt; i++) {
                         list_for_each_safe(entry, next, list_head) {
-                                mac_entry = (struct vxge_mac_addrs *) entry;
+                                mac_entry = (struct vxge_mac_addrs *)entry;
                                 /* Copy the mac address to delete */
                                 mac_address = (u8 *)&mac_entry->macaddr;
                                 memcpy(mac_info.macaddr, mac_address, ETH_ALEN);
@@ -1184,14 +1202,14 @@ static int vxge_set_mac_addr(struct net_device *dev, void *p)
 {
         struct sockaddr *addr = p;
         struct vxgedev *vdev;
-        struct __vxge_hw_device  *hldev;
+        struct __vxge_hw_device *hldev;
         enum vxge_hw_status status = VXGE_HW_OK;
         struct macInfo mac_info_new, mac_info_old;
         int vpath_idx = 0;
 
         vxge_debug_entryexit(VXGE_TRACE, "%s:%d", __func__, __LINE__);
 
-        vdev = (struct vxgedev *)netdev_priv(dev);
+        vdev = netdev_priv(dev);
         hldev = vdev->devh;
 
         if (!is_valid_ether_addr(addr->sa_data))
@@ -1292,8 +1310,13 @@ static void vxge_vpath_intr_enable(struct vxgedev *vdev, int vp_id)
 static void vxge_vpath_intr_disable(struct vxgedev *vdev, int vp_id)
 {
         struct vxge_vpath *vpath = &vdev->vpaths[vp_id];
+        struct __vxge_hw_device *hldev;
         int msix_id;
 
+        hldev = pci_get_drvdata(vdev->pdev);
+
+        vxge_hw_vpath_wait_receive_idle(hldev, vpath->device_id);
+
         vxge_hw_vpath_intr_disable(vpath->handle);
 
         if (vdev->config.intr_type == INTA)
@@ -1423,6 +1446,7 @@ static int do_vxge_reset(struct vxgedev *vdev, int event)
         }
 
         if (event == VXGE_LL_FULL_RESET) {
+                vxge_hw_device_wait_receive_idle(vdev->devh);
                 vxge_hw_device_intr_disable(vdev->devh);
 
                 switch (vdev->cric_err_event) {
@@ -1608,8 +1632,7 @@ static int vxge_poll_inta(struct napi_struct *napi, int budget)
         int budget_org = budget;
         struct vxge_ring *ring;
 
-        struct __vxge_hw_device  *hldev = (struct __vxge_hw_device *)
-                pci_get_drvdata(vdev->pdev);
+        struct __vxge_hw_device *hldev = pci_get_drvdata(vdev->pdev);
 
         for (i = 0; i < vdev->no_of_vpath; i++) {
                 ring = &vdev->vpaths[i].ring;
@@ -1645,11 +1668,11 @@ static int vxge_poll_inta(struct napi_struct *napi, int budget)
  */
 static void vxge_netpoll(struct net_device *dev)
 {
-        struct __vxge_hw_device  *hldev;
+        struct __vxge_hw_device *hldev;
         struct vxgedev *vdev;
 
-        vdev = (struct vxgedev *)netdev_priv(dev);
-        hldev = (struct __vxge_hw_device  *)pci_get_drvdata(vdev->pdev);
+        vdev = netdev_priv(dev);
+        hldev = pci_get_drvdata(vdev->pdev);
 
         vxge_debug_entryexit(VXGE_TRACE, "%s:%d", __func__, __LINE__);
 
@@ -1689,15 +1712,6 @@ static enum vxge_hw_status vxge_rth_configure(struct vxgedev *vdev)
                 mtable[index] = index % vdev->no_of_vpath;
         }
 
-        /* Fill RTH hash types */
-        hash_types.hash_type_tcpipv4_en   = vdev->config.rth_hash_type_tcpipv4;
-        hash_types.hash_type_ipv4_en      = vdev->config.rth_hash_type_ipv4;
-        hash_types.hash_type_tcpipv6_en   = vdev->config.rth_hash_type_tcpipv6;
-        hash_types.hash_type_ipv6_en      = vdev->config.rth_hash_type_ipv6;
-        hash_types.hash_type_tcpipv6ex_en =
-                                        vdev->config.rth_hash_type_tcpipv6ex;
-        hash_types.hash_type_ipv6ex_en    = vdev->config.rth_hash_type_ipv6ex;
-
         /* set indirection table, bucket-to-vpath mapping */
         status = vxge_hw_vpath_rts_rth_itable_set(vdev->vp_handles,
                                                 vdev->no_of_vpath,
@@ -1710,12 +1724,21 @@ static enum vxge_hw_status vxge_rth_configure(struct vxgedev *vdev)
                 return status;
         }
 
+        /* Fill RTH hash types */
+        hash_types.hash_type_tcpipv4_en   = vdev->config.rth_hash_type_tcpipv4;
+        hash_types.hash_type_ipv4_en      = vdev->config.rth_hash_type_ipv4;
+        hash_types.hash_type_tcpipv6_en   = vdev->config.rth_hash_type_tcpipv6;
+        hash_types.hash_type_ipv6_en      = vdev->config.rth_hash_type_ipv6;
+        hash_types.hash_type_tcpipv6ex_en =
+                                        vdev->config.rth_hash_type_tcpipv6ex;
+        hash_types.hash_type_ipv6ex_en    = vdev->config.rth_hash_type_ipv6ex;
+
         /*
-        * Because the itable_set() method uses the active_table field
-        * for the target virtual path the RTH config should be updated
-        * for all VPATHs. The h/w only uses the lowest numbered VPATH
-        * when steering frames.
-        */
+         * Because the itable_set() method uses the active_table field
+         * for the target virtual path the RTH config should be updated
+         * for all VPATHs. The h/w only uses the lowest numbered VPATH
+         * when steering frames.
+         */
          for (index = 0; index < vdev->no_of_vpath; index++) {
                 status = vxge_hw_vpath_rts_rth_set(
                                 vdev->vpaths[index].handle,
@@ -1797,7 +1820,7 @@ static int vxge_mac_list_del(struct vxge_vpath *vpath, struct macInfo *mac)
 {
         struct list_head *entry, *next;
         u64 del_mac = 0;
-        u8 *mac_address = (u8 *) (&del_mac);
+        u8 *mac_address = (u8 *)(&del_mac);
 
         /* Copy the mac address to delete from the list */
         memcpy(mac_address, mac->macaddr, ETH_ALEN);
@@ -1928,7 +1951,7 @@ static enum vxge_hw_status vxge_restore_vpath_mac_addr(struct vxge_vpath *vpath)
 }
 
 /* reset vpaths */
-static enum vxge_hw_status vxge_reset_all_vpaths(struct vxgedev *vdev)
+enum vxge_hw_status vxge_reset_all_vpaths(struct vxgedev *vdev)
 {
         enum vxge_hw_status status = VXGE_HW_OK;
         struct vxge_vpath *vpath;
@@ -1988,8 +2011,23 @@ static int vxge_open_vpaths(struct vxgedev *vdev)
 
         for (i = 0; i < vdev->no_of_vpath; i++) {
                 vpath = &vdev->vpaths[i];
-
                 vxge_assert(vpath->is_configured);
+
+                if (!vdev->titan1) {
+                        struct vxge_hw_vp_config *vcfg;
+                        vcfg = &vdev->devh->config.vp_config[vpath->device_id];
+
+                        vcfg->rti.urange_a = RTI_T1A_RX_URANGE_A;
+                        vcfg->rti.urange_b = RTI_T1A_RX_URANGE_B;
+                        vcfg->rti.urange_c = RTI_T1A_RX_URANGE_C;
+                        vcfg->tti.uec_a = TTI_T1A_TX_UFC_A;
+                        vcfg->tti.uec_b = TTI_T1A_TX_UFC_B;
+                        vcfg->tti.uec_c = TTI_T1A_TX_UFC_C(vdev->mtu);
+                        vcfg->tti.uec_d = TTI_T1A_TX_UFC_D(vdev->mtu);
+                        vcfg->tti.ltimer_val = VXGE_T1A_TTI_LTIMER_VAL;
+                        vcfg->tti.rtimer_val = VXGE_T1A_TTI_RTIMER_VAL;
+                }
+
                 attr.vp_id = vpath->device_id;
                 attr.fifo_attr.callback = vxge_xmit_compl;
                 attr.fifo_attr.txdl_term = vxge_tx_term;
@@ -2024,6 +2062,7 @@ static int vxge_open_vpaths(struct vxgedev *vdev)
                                 vdev->config.fifo_indicate_max_pkts;
                         vpath->ring.rx_vector_no = 0;
                         vpath->ring.rx_csum = vdev->rx_csum;
+                        vpath->ring.rx_hwts = vdev->rx_hwts;
                         vpath->is_open = 1;
                         vdev->vp_handles[i] = vpath->handle;
                         vpath->ring.gro_enable = vdev->config.gro_enable;
@@ -2062,18 +2101,18 @@ static irqreturn_t vxge_isr_napi(int irq, void *dev_id)
         struct __vxge_hw_device *hldev;
         u64 reason;
         enum vxge_hw_status status;
-        struct vxgedev *vdev = (struct vxgedev *) dev_id;;
+        struct vxgedev *vdev = (struct vxgedev *)dev_id;
 
         vxge_debug_intr(VXGE_TRACE, "%s:%d", __func__, __LINE__);
 
         dev = vdev->ndev;
-        hldev = (struct __vxge_hw_device *)pci_get_drvdata(vdev->pdev);
+        hldev = pci_get_drvdata(vdev->pdev);
 
         if (pci_channel_offline(vdev->pdev))
                 return IRQ_NONE;
 
         if (unlikely(!is_vxge_card_up(vdev)))
-                return IRQ_NONE;
+                return IRQ_HANDLED;
 
         status = vxge_hw_device_begin_irq(hldev, vdev->exec_mode,
                         &reason);
@@ -2301,8 +2340,8 @@ static void vxge_rem_msix_isr(struct vxgedev *vdev)
 
 static void vxge_rem_isr(struct vxgedev *vdev)
 {
-        struct __vxge_hw_device  *hldev;
-        hldev = (struct __vxge_hw_device  *) pci_get_drvdata(vdev->pdev);
+        struct __vxge_hw_device *hldev;
+        hldev = pci_get_drvdata(vdev->pdev);
 
 #ifdef CONFIG_PCI_MSI
         if (vdev->config.intr_type == MSI_X) {
@@ -2542,8 +2581,8 @@ vxge_open(struct net_device *dev)
         vxge_debug_entryexit(VXGE_TRACE,
                 "%s: %s:%d", dev->name, __func__, __LINE__);
 
-        vdev = (struct vxgedev *)netdev_priv(dev);
-        hldev = (struct __vxge_hw_device *) pci_get_drvdata(vdev->pdev);
+        vdev = netdev_priv(dev);
+        hldev = pci_get_drvdata(vdev->pdev);
         function_mode = vdev->config.device_hw_info.function_mode;
 
         /* make sure you have link off by default every time Nic is
@@ -2598,6 +2637,8 @@ vxge_open(struct net_device *dev)
                         goto out2;
                 }
         }
+        printk(KERN_INFO "%s: Receive Hashing Offload %s\n", dev->name,
+               hldev->config.rth_en ? "enabled" : "disabled");
 
         for (i = 0; i < vdev->no_of_vpath; i++) {
                 vpath = &vdev->vpaths[i];
@@ -2683,9 +2724,10 @@ vxge_open(struct net_device *dev)
                 vxge_os_timer(vdev->vp_reset_timer,
                         vxge_poll_vp_reset, vdev, (HZ/2));
 
-        if (vdev->vp_lockup_timer.function == NULL)
-                vxge_os_timer(vdev->vp_lockup_timer,
-                        vxge_poll_vp_lockup, vdev, (HZ/2));
+        /* There is no need to check for RxD leak and RxD lookup on Titan1A */
+        if (vdev->titan1 && vdev->vp_lockup_timer.function == NULL)
+                vxge_os_timer(vdev->vp_lockup_timer, vxge_poll_vp_lockup, vdev,
+                              HZ / 2);
 
         set_bit(__VXGE_STATE_CARD_UP, &vdev->state);
 
@@ -2767,8 +2809,8 @@ static int do_vxge_close(struct net_device *dev, int do_io)
         vxge_debug_entryexit(VXGE_TRACE, "%s: %s:%d",
                 dev->name, __func__, __LINE__);
 
-        vdev = (struct vxgedev *)netdev_priv(dev);
-        hldev = (struct __vxge_hw_device *) pci_get_drvdata(vdev->pdev);
+        vdev = netdev_priv(dev);
+        hldev = pci_get_drvdata(vdev->pdev);
 
         if (unlikely(!is_vxge_card_up(vdev)))
                 return 0;
@@ -2778,7 +2820,6 @@ static int do_vxge_close(struct net_device *dev, int do_io)
         while (test_and_set_bit(__VXGE_STATE_RESET_CARD, &vdev->state))
                 msleep(50);
 
-        clear_bit(__VXGE_STATE_CARD_UP, &vdev->state);
         if (do_io) {
                 /* Put the vpath back in normal mode */
                 vpath_vector = vxge_mBIT(vdev->vpaths[0].device_id);
@@ -2818,10 +2859,17 @@ static int do_vxge_close(struct net_device *dev, int do_io)
 
                 smp_wmb();
         }
-        del_timer_sync(&vdev->vp_lockup_timer);
+
+        if (vdev->titan1)
+                del_timer_sync(&vdev->vp_lockup_timer);
 
         del_timer_sync(&vdev->vp_reset_timer);
 
+        if (do_io)
+                vxge_hw_device_wait_receive_idle(hldev);
+
+        clear_bit(__VXGE_STATE_CARD_UP, &vdev->state);
+
         /* Disable napi */
         if (vdev->config.intr_type != MSI_X)
                 napi_disable(&vdev->napi);
@@ -2838,8 +2886,6 @@ static int do_vxge_close(struct net_device *dev, int do_io)
         if (do_io)
                 vxge_hw_device_intr_disable(vdev->devh);
 
-        mdelay(1000);
-
         vxge_rem_isr(vdev);
 
         vxge_napi_del_all(vdev);
@@ -2954,6 +3000,101 @@ vxge_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *net_stats)
         return net_stats;
 }
 
+static enum vxge_hw_status vxge_timestamp_config(struct vxgedev *vdev,
+                                                 int enable)
+{
+        enum vxge_hw_status status;
+        u64 val64;
+
+        /* Timestamp is passed to the driver via the FCS, therefore we
+         * must disable the FCS stripping by the adapter.  Since this is
+         * required for the driver to load (due to a hardware bug),
+         * there is no need to do anything special here.
+         */
+        if (enable)
+                val64 = VXGE_HW_XMAC_TIMESTAMP_EN |
+                        VXGE_HW_XMAC_TIMESTAMP_USE_LINK_ID(0) |
+                        VXGE_HW_XMAC_TIMESTAMP_INTERVAL(0);
+        else
+                val64 = 0;
+
+        status = vxge_hw_mgmt_reg_write(vdev->devh,
+                                        vxge_hw_mgmt_reg_type_mrpcim,
+                                        0,
+                                        offsetof(struct vxge_hw_mrpcim_reg,
+                                                 xmac_timestamp),
+                                        val64);
+        vxge_hw_device_flush_io(vdev->devh);
+        return status;
+}
+
+static int vxge_hwtstamp_ioctl(struct vxgedev *vdev, void __user *data)
+{
+        struct hwtstamp_config config;
+        enum vxge_hw_status status;
+        int i;
+
+        if (copy_from_user(&config, data, sizeof(config)))
+                return -EFAULT;
+
+        /* reserved for future extensions */
+        if (config.flags)
+                return -EINVAL;
+
+        /* Transmit HW Timestamp not supported */
+        switch (config.tx_type) {
+        case HWTSTAMP_TX_OFF:
+                break;
+        case HWTSTAMP_TX_ON:
+        default:
+                return -ERANGE;
+        }
+
+        switch (config.rx_filter) {
+        case HWTSTAMP_FILTER_NONE:
+                status = vxge_timestamp_config(vdev, 0);
+                if (status != VXGE_HW_OK)
+                        return -EFAULT;
+
+                vdev->rx_hwts = 0;
+                config.rx_filter = HWTSTAMP_FILTER_NONE;
+                break;
+
+        case HWTSTAMP_FILTER_ALL:
+        case HWTSTAMP_FILTER_SOME:
+        case HWTSTAMP_FILTER_PTP_V1_L4_EVENT:
+        case HWTSTAMP_FILTER_PTP_V1_L4_SYNC:
+        case HWTSTAMP_FILTER_PTP_V1_L4_DELAY_REQ:
+        case HWTSTAMP_FILTER_PTP_V2_L4_EVENT:
+        case HWTSTAMP_FILTER_PTP_V2_L4_SYNC:
+        case HWTSTAMP_FILTER_PTP_V2_L4_DELAY_REQ:
+        case HWTSTAMP_FILTER_PTP_V2_L2_EVENT:
+        case HWTSTAMP_FILTER_PTP_V2_L2_SYNC:
+        case HWTSTAMP_FILTER_PTP_V2_L2_DELAY_REQ:
+        case HWTSTAMP_FILTER_PTP_V2_EVENT:
+        case HWTSTAMP_FILTER_PTP_V2_SYNC:
+        case HWTSTAMP_FILTER_PTP_V2_DELAY_REQ:
+                status = vxge_timestamp_config(vdev, 1);
+                if (status != VXGE_HW_OK)
+                        return -EFAULT;
+
+                vdev->rx_hwts = 1;
+                config.rx_filter = HWTSTAMP_FILTER_ALL;
+                break;
+
+        default:
+                 return -ERANGE;
+        }
+
+        for (i = 0; i < vdev->no_of_vpath; i++)
+                vdev->vpaths[i].ring.rx_hwts = vdev->rx_hwts;
+
+        if (copy_to_user(data, &config, sizeof(config)))
+                return -EFAULT;
+
+        return 0;
+}
+
 /**
  * vxge_ioctl
  * @dev: Device pointer.
@@ -2966,7 +3107,20 @@ vxge_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *net_stats)
  */
 static int vxge_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
 {
-        return -EOPNOTSUPP;
+        struct vxgedev *vdev = netdev_priv(dev);
+        int ret;
+
+        switch (cmd) {
+        case SIOCSHWTSTAMP:
+                ret = vxge_hwtstamp_ioctl(vdev, rq->ifr_data);
+                if (ret)
+                        return ret;
+                break;
+        default:
+                return -EOPNOTSUPP;
+        }
+
+        return 0;
 }
 
 /**
@@ -2984,7 +3138,7 @@ vxge_tx_watchdog(struct net_device *dev)
 
         vxge_debug_entryexit(VXGE_TRACE, "%s:%d", __func__, __LINE__);
 
-        vdev = (struct vxgedev *)netdev_priv(dev);
+        vdev = netdev_priv(dev);
 
         vdev->cric_err_event = VXGE_HW_EVENT_RESET_START;
 
@@ -3012,7 +3166,7 @@ vxge_vlan_rx_register(struct net_device *dev, struct vlan_group *grp)
 
         vxge_debug_entryexit(VXGE_TRACE, "%s:%d", __func__, __LINE__);
 
-        vdev = (struct vxgedev *)netdev_priv(dev);
+        vdev = netdev_priv(dev);
 
         vpath = &vdev->vpaths[0];
         if ((NULL == grp) && (vpath->is_open)) {
@@ -3061,7 +3215,7 @@ vxge_vlan_rx_add_vid(struct net_device *dev, unsigned short vid)
         struct vxge_vpath *vpath;
         int vp_id;
 
-        vdev = (struct vxgedev *)netdev_priv(dev);
+        vdev = netdev_priv(dev);
 
         /* Add these vlan to the vid table */
         for (vp_id = 0; vp_id < vdev->no_of_vpath; vp_id++) {
@@ -3088,7 +3242,7 @@ vxge_vlan_rx_kill_vid(struct net_device *dev, unsigned short vid)
 
         vxge_debug_entryexit(VXGE_TRACE, "%s:%d", __func__, __LINE__);
 
-        vdev = (struct vxgedev *)netdev_priv(dev);
+        vdev = netdev_priv(dev);
 
         vlan_group_set_device(vdev->vlgrp, vid, NULL);
 
@@ -3125,6 +3279,19 @@ static const struct net_device_ops vxge_netdev_ops = {
 #endif
 };
 
+static int __devinit vxge_device_revision(struct vxgedev *vdev)
+{
+        int ret;
+        u8 revision;
+
+        ret = pci_read_config_byte(vdev->pdev, PCI_REVISION_ID, &revision);
+        if (ret)
+                return -EIO;
+
+        vdev->titan1 = (revision == VXGE_HW_TITAN1_PCI_REVISION);
+        return 0;
+}
+
 static int __devinit vxge_device_register(struct __vxge_hw_device *hldev,
                                           struct vxge_config *config,
                                           int high_dma, int no_of_vpath,
@@ -3163,6 +3330,11 @@ static int __devinit vxge_device_register(struct __vxge_hw_device *hldev,
         vdev->pdev = hldev->pdev;
         memcpy(&vdev->config, config, sizeof(struct vxge_config));
         vdev->rx_csum = 1;      /* Enable Rx CSUM by default. */
+        vdev->rx_hwts = 0;
+
+        ret = vxge_device_revision(vdev);
+        if (ret < 0)
+                goto _out1;
 
         SET_NETDEV_DEV(ndev, &vdev->pdev->dev);
 
@@ -3178,6 +3350,11 @@ static int __devinit vxge_device_register(struct __vxge_hw_device *hldev,
 
         vxge_initialize_ethtool_ops(ndev);
 
+        if (vdev->config.rth_steering != NO_STEERING) {
+                ndev->features |= NETIF_F_RXHASH;
+                hldev->config.rth_en = VXGE_HW_RTH_ENABLE;
+        }
+
         /* Allocate memory for vpath */
         vdev->vpaths = kzalloc((sizeof(struct vxge_vpath)) *
                                 no_of_vpath, GFP_KERNEL);
@@ -3191,7 +3368,7 @@ static int __devinit vxge_device_register(struct __vxge_hw_device *hldev,
 
         ndev->features |= NETIF_F_SG;
 
-        ndev->features |= NETIF_F_HW_CSUM;
+        ndev->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
         vxge_debug_init(vxge_hw_device_trace_level_get(hldev),
                 "%s : checksuming enabled", __func__);
 
@@ -3227,6 +3404,7 @@ static int __devinit vxge_device_register(struct __vxge_hw_device *hldev,
                 "%s: Ethernet device registered",
                 ndev->name);
 
+        hldev->ndev = ndev;
         *vdev_out = vdev;
 
         /* Resetting the Device stats */
@@ -3261,36 +3439,29 @@ _out0:
  *
  * This function will unregister and free network device
  */
-static void
-vxge_device_unregister(struct __vxge_hw_device *hldev)
+static void vxge_device_unregister(struct __vxge_hw_device *hldev)
 {
         struct vxgedev *vdev;
         struct net_device *dev;
         char buf[IFNAMSIZ];
-#if ((VXGE_DEBUG_INIT & VXGE_DEBUG_MASK) || \
-        (VXGE_DEBUG_ENTRYEXIT & VXGE_DEBUG_MASK))
-        u32 level_trace;
-#endif
 
         dev = hldev->ndev;
         vdev = netdev_priv(dev);
-#if ((VXGE_DEBUG_INIT & VXGE_DEBUG_MASK) || \
-        (VXGE_DEBUG_ENTRYEXIT & VXGE_DEBUG_MASK))
-        level_trace = vdev->level_trace;
-#endif
-        vxge_debug_entryexit(level_trace,
-                "%s: %s:%d", vdev->ndev->name, __func__, __LINE__);
 
-        memcpy(buf, vdev->ndev->name, IFNAMSIZ);
+        vxge_debug_entryexit(vdev->level_trace, "%s: %s:%d", vdev->ndev->name,
+                             __func__, __LINE__);
+
+        strncpy(buf, dev->name, IFNAMSIZ);
 
         /* in 2.6 will call stop() if device is up */
         unregister_netdev(dev);
 
         flush_scheduled_work();
 
-        vxge_debug_init(level_trace, "%s: ethernet device unregistered", buf);
-        vxge_debug_entryexit(level_trace,
-                "%s: %s:%d  Exiting...", buf, __func__, __LINE__);
+        vxge_debug_init(vdev->level_trace, "%s: ethernet device unregistered",
+                        buf);
+        vxge_debug_entryexit(vdev->level_trace, "%s: %s:%d  Exiting...", buf,
+                             __func__, __LINE__);
 }
 
 /*
@@ -3304,7 +3475,7 @@ vxge_callback_crit_err(struct __vxge_hw_device *hldev,
                         enum vxge_hw_event type, u64 vp_id)
 {
         struct net_device *dev = hldev->ndev;
-        struct vxgedev *vdev = (struct vxgedev *)netdev_priv(dev);
+        struct vxgedev *vdev = netdev_priv(dev);
         struct vxge_vpath *vpath = NULL;
         int vpath_idx;
 
@@ -3751,9 +3922,6 @@ static void __devinit vxge_print_parm(struct vxgedev *vdev, u64 vpath_mask)
                 vxge_debug_init(VXGE_TRACE,
                         "%s: MAC Address learning enabled", vdev->ndev->name);
 
-        vxge_debug_init(VXGE_TRACE,
-                "%s: Rx doorbell mode enabled", vdev->ndev->name);
-
         for (i = 0; i < VXGE_HW_MAX_VIRTUAL_PATHS; i++) {
                 if (!vxge_bVALn(vpath_mask, i, 1))
                         continue;
@@ -3766,14 +3934,6 @@ static void __devinit vxge_print_parm(struct vxgedev *vdev, u64 vpath_mask)
                         ((struct __vxge_hw_device  *)(vdev->devh))->
                                 config.vp_config[i].rpa_strip_vlan_tag
                         ? "Enabled" : "Disabled");
-                vxge_debug_init(VXGE_TRACE,
-                        "%s: Ring blocks : %d", vdev->ndev->name,
-                        ((struct __vxge_hw_device  *)(vdev->devh))->
-                                config.vp_config[i].ring.ring_blocks);
-                vxge_debug_init(VXGE_TRACE,
-                        "%s: Fifo blocks : %d", vdev->ndev->name,
-                        ((struct __vxge_hw_device  *)(vdev->devh))->
-                                config.vp_config[i].fifo.fifo_blocks);
                 vxge_debug_ll_config(VXGE_TRACE,
                         "%s: Max frags : %d", vdev->ndev->name,
                         ((struct __vxge_hw_device  *)(vdev->devh))->
@@ -3813,8 +3973,7 @@ static int vxge_pm_resume(struct pci_dev *pdev)
 static pci_ers_result_t vxge_io_error_detected(struct pci_dev *pdev,
                                                 pci_channel_state_t state)
 {
-        struct __vxge_hw_device  *hldev =
-                (struct __vxge_hw_device  *) pci_get_drvdata(pdev);
+        struct __vxge_hw_device *hldev = pci_get_drvdata(pdev);
         struct net_device *netdev = hldev->ndev;
 
         netif_device_detach(netdev);
@@ -3843,8 +4002,7 @@ static pci_ers_result_t vxge_io_error_detected(struct pci_dev *pdev,
  */
 static pci_ers_result_t vxge_io_slot_reset(struct pci_dev *pdev)
 {
-        struct __vxge_hw_device  *hldev =
-                (struct __vxge_hw_device  *) pci_get_drvdata(pdev);
+        struct __vxge_hw_device *hldev = pci_get_drvdata(pdev);
         struct net_device *netdev = hldev->ndev;
 
         struct vxgedev *vdev = netdev_priv(netdev);
@@ -3869,8 +4027,7 @@ static pci_ers_result_t vxge_io_slot_reset(struct pci_dev *pdev)
  */
 static void vxge_io_resume(struct pci_dev *pdev)
 {
-        struct __vxge_hw_device  *hldev =
-                (struct __vxge_hw_device  *) pci_get_drvdata(pdev);
+        struct __vxge_hw_device *hldev = pci_get_drvdata(pdev);
         struct net_device *netdev = hldev->ndev;
 
         if (netif_running(netdev)) {
@@ -3914,6 +4071,142 @@ static inline u32 vxge_get_num_vfs(u64 function_mode)
         return num_functions;
 }
 
+int vxge_fw_upgrade(struct vxgedev *vdev, char *fw_name, int override)
+{
+        struct __vxge_hw_device *hldev = vdev->devh;
+        u32 maj, min, bld, cmaj, cmin, cbld;
+        enum vxge_hw_status status;
+        const struct firmware *fw;
+        int ret;
+
+        ret = request_firmware(&fw, fw_name, &vdev->pdev->dev);
+        if (ret) {
+                vxge_debug_init(VXGE_ERR, "%s: Firmware file '%s' not found",
+                                VXGE_DRIVER_NAME, fw_name);
+                goto out;
+        }
+
+        /* Load the new firmware onto the adapter */
+        status = vxge_update_fw_image(hldev, fw->data, fw->size);
+        if (status != VXGE_HW_OK) {
+                vxge_debug_init(VXGE_ERR,
+                                "%s: FW image download to adapter failed '%s'.",
+                                VXGE_DRIVER_NAME, fw_name);
+                ret = -EIO;
+                goto out;
+        }
+
+        /* Read the version of the new firmware */
+        status = vxge_hw_upgrade_read_version(hldev, &maj, &min, &bld);
+        if (status != VXGE_HW_OK) {
+                vxge_debug_init(VXGE_ERR,
+                                "%s: Upgrade read version failed '%s'.",
+                                VXGE_DRIVER_NAME, fw_name);
+                ret = -EIO;
+                goto out;
+        }
+
+        cmaj = vdev->config.device_hw_info.fw_version.major;
+        cmin = vdev->config.device_hw_info.fw_version.minor;
+        cbld = vdev->config.device_hw_info.fw_version.build;
+        /* It's possible the version in /lib/firmware is not the latest version.
+         * If so, we could get into a loop of trying to upgrade to the latest
+         * and flashing the older version.
+         */
+        if (VXGE_FW_VER(maj, min, bld) == VXGE_FW_VER(cmaj, cmin, cbld) &&
+            !override) {
+                ret = -EINVAL;
+                goto out;
+        }
+
+        printk(KERN_NOTICE "Upgrade to firmware version %d.%d.%d commencing\n",
+               maj, min, bld);
+
+        /* Flash the adapter with the new firmware */
+        status = vxge_hw_flash_fw(hldev);
+        if (status != VXGE_HW_OK) {
+                vxge_debug_init(VXGE_ERR, "%s: Upgrade commit failed '%s'.",
+                                VXGE_DRIVER_NAME, fw_name);
+                ret = -EIO;
+                goto out;
+        }
+
+        printk(KERN_NOTICE "Upgrade of firmware successful!  Adapter must be "
+               "hard reset before using, thus requiring a system reboot or a "
+               "hotplug event.\n");
+
+out:
+        return ret;
+}
+
+static int vxge_probe_fw_update(struct vxgedev *vdev)
+{
+        u32 maj, min, bld;
+        int ret, gpxe = 0;
+        char *fw_name;
+
+        maj = vdev->config.device_hw_info.fw_version.major;
+        min = vdev->config.device_hw_info.fw_version.minor;
+        bld = vdev->config.device_hw_info.fw_version.build;
+
+        if (VXGE_FW_VER(maj, min, bld) == VXGE_CERT_FW_VER)
+                return 0;
+
+        /* Ignore the build number when determining if the current firmware is
+         * "too new" to load the driver
+         */
+        if (VXGE_FW_VER(maj, min, 0) > VXGE_CERT_FW_VER) {
+                vxge_debug_init(VXGE_ERR, "%s: Firmware newer than last known "
+                                "version, unable to load driver\n",
+                                VXGE_DRIVER_NAME);
+                return -EINVAL;
+        }
+
+        /* Firmware 1.4.4 and older cannot be upgraded, and is too ancient to
+         * work with this driver.
+         */
+        if (VXGE_FW_VER(maj, min, bld) <= VXGE_FW_DEAD_VER) {
+                vxge_debug_init(VXGE_ERR, "%s: Firmware %d.%d.%d cannot be "
+                                "upgraded\n", VXGE_DRIVER_NAME, maj, min, bld);
+                return -EINVAL;
+        }
+
+        /* If file not specified, determine gPXE or not */
+        if (VXGE_FW_VER(maj, min, bld) >= VXGE_EPROM_FW_VER) {
+                int i;
+                for (i = 0; i < VXGE_HW_MAX_ROM_IMAGES; i++)
+                        if (vdev->devh->eprom_versions[i]) {
+                                gpxe = 1;
+                                break;
+                        }
+        }
+        if (gpxe)
+                fw_name = "vxge/X3fw-pxe.ncf";
+        else
+                fw_name = "vxge/X3fw.ncf";
+
+        ret = vxge_fw_upgrade(vdev, fw_name, 0);
+        /* -EINVAL and -ENOENT are not fatal errors for flashing firmware on
+         * probe, so ignore them
+         */
+        if (ret != -EINVAL && ret != -ENOENT)
+                return -EIO;
+        else
+                ret = 0;
+
+        if (VXGE_FW_VER(VXGE_CERT_FW_VER_MAJOR, VXGE_CERT_FW_VER_MINOR, 0) >
+            VXGE_FW_VER(maj, min, 0)) {
+                vxge_debug_init(VXGE_ERR, "%s: Firmware %d.%d.%d is too old to"
+                                " be used with this driver.\n"
+                                "Please get the latest version from "
+                                "ftp://ftp.s2io.com/pub/X3100-Drivers/FIRMWARE",
+                                VXGE_DRIVER_NAME, maj, min, bld);
+                return -EINVAL;
+        }
+
+        return ret;
+}
+
 /**
  * vxge_probe
  * @pdev : structure containing the PCI related information of the device.
@@ -3928,7 +4221,7 @@ static inline u32 vxge_get_num_vfs(u64 function_mode)
 static int __devinit
 vxge_probe(struct pci_dev *pdev, const struct pci_device_id *pre)
 {
-        struct __vxge_hw_device  *hldev;
+        struct __vxge_hw_device *hldev;
         enum vxge_hw_status status;
         int ret;
         int high_dma = 0;
@@ -4072,16 +4365,6 @@ vxge_probe(struct pci_dev *pdev, const struct pci_device_id *pre)
                 goto _exit3;
         }
 
-        if (ll_config->device_hw_info.fw_version.major !=
-                VXGE_DRIVER_FW_VERSION_MAJOR) {
-                vxge_debug_init(VXGE_ERR,
-                        "%s: Incorrect firmware version."
-                        "Please upgrade the firmware to version 1.x.x",
-                        VXGE_DRIVER_NAME);
-                ret = -EINVAL;
-                goto _exit3;
-        }
-
         vpath_mask = ll_config->device_hw_info.vpath_mask;
         if (vpath_mask == 0) {
                 vxge_debug_ll_config(VXGE_TRACE,
@@ -4145,11 +4428,37 @@ vxge_probe(struct pci_dev *pdev, const struct pci_device_id *pre)
                         goto _exit3;
         }
 
+        if (VXGE_FW_VER(ll_config->device_hw_info.fw_version.major,
+                        ll_config->device_hw_info.fw_version.minor,
+                        ll_config->device_hw_info.fw_version.build) >=
+            VXGE_EPROM_FW_VER) {
+                struct eprom_image img[VXGE_HW_MAX_ROM_IMAGES];
+
+                status = vxge_hw_vpath_eprom_img_ver_get(hldev, img);
+                if (status != VXGE_HW_OK) {
+                        vxge_debug_init(VXGE_ERR, "%s: Reading of EPROM failed",
+                                        VXGE_DRIVER_NAME);
+                        /* This is a non-fatal error, continue */
+                }
+
+                for (i = 0; i < VXGE_HW_MAX_ROM_IMAGES; i++) {
+                        hldev->eprom_versions[i] = img[i].version;
+                        if (!img[i].is_valid)
+                                break;
+                        vxge_debug_init(VXGE_TRACE, "%s: EPROM %d, version "
+                                        "%d.%d.%d.%d\n", VXGE_DRIVER_NAME, i,
+                                        VXGE_EPROM_IMG_MAJOR(img[i].version),
+                                        VXGE_EPROM_IMG_MINOR(img[i].version),
+                                        VXGE_EPROM_IMG_FIX(img[i].version),
+                                        VXGE_EPROM_IMG_BUILD(img[i].version));
+                }
+        }
+
         /* if FCS stripping is not disabled in MAC fail driver load */
-        if (vxge_hw_vpath_strip_fcs_check(hldev, vpath_mask) != VXGE_HW_OK) {
-                vxge_debug_init(VXGE_ERR,
-                        "%s: FCS stripping is not disabled in MAC"
-                        " failing driver load", VXGE_DRIVER_NAME);
+        status = vxge_hw_vpath_strip_fcs_check(hldev, vpath_mask);
+        if (status != VXGE_HW_OK) {
+                vxge_debug_init(VXGE_ERR, "%s: FCS stripping is enabled in MAC"
+                                " failing driver load", VXGE_DRIVER_NAME);
                 ret = -EINVAL;
                 goto _exit4;
         }
@@ -4163,28 +4472,32 @@ vxge_probe(struct pci_dev *pdev, const struct pci_device_id *pre)
         ll_config->fifo_indicate_max_pkts = VXGE_FIFO_INDICATE_MAX_PKTS;
         ll_config->addr_learn_en = addr_learn_en;
         ll_config->rth_algorithm = RTH_ALG_JENKINS;
-        ll_config->rth_hash_type_tcpipv4 = VXGE_HW_RING_HASH_TYPE_TCP_IPV4;
-        ll_config->rth_hash_type_ipv4 = VXGE_HW_RING_HASH_TYPE_NONE;
-        ll_config->rth_hash_type_tcpipv6 = VXGE_HW_RING_HASH_TYPE_NONE;
-        ll_config->rth_hash_type_ipv6 = VXGE_HW_RING_HASH_TYPE_NONE;
-        ll_config->rth_hash_type_tcpipv6ex = VXGE_HW_RING_HASH_TYPE_NONE;
-        ll_config->rth_hash_type_ipv6ex = VXGE_HW_RING_HASH_TYPE_NONE;
+        ll_config->rth_hash_type_tcpipv4 = 1;
+        ll_config->rth_hash_type_ipv4 = 0;
+        ll_config->rth_hash_type_tcpipv6 = 0;
+        ll_config->rth_hash_type_ipv6 = 0;
+        ll_config->rth_hash_type_tcpipv6ex = 0;
+        ll_config->rth_hash_type_ipv6ex = 0;
         ll_config->rth_bkt_sz = RTH_BUCKET_SIZE;
         ll_config->tx_pause_enable = VXGE_PAUSE_CTRL_ENABLE;
         ll_config->rx_pause_enable = VXGE_PAUSE_CTRL_ENABLE;
 
-        if (vxge_device_register(hldev, ll_config, high_dma, no_of_vpath,
-                &vdev)) {
+        ret = vxge_device_register(hldev, ll_config, high_dma, no_of_vpath,
+                                   &vdev);
+        if (ret) {
                 ret = -EINVAL;
                 goto _exit4;
         }
 
+        ret = vxge_probe_fw_update(vdev);
+        if (ret)
+                goto _exit5;
+
         vxge_hw_device_debug_set(hldev, VXGE_TRACE, VXGE_COMPONENT_LL);
         VXGE_COPY_DEBUG_INFO_TO_LL(vdev, vxge_hw_device_error_level_get(hldev),
                 vxge_hw_device_trace_level_get(hldev));
 
         /* set private HW device info */
-        hldev->ndev = vdev->ndev;
         vdev->mtu = VXGE_HW_DEFAULT_MTU;
         vdev->bar0 = attr.bar0;
         vdev->max_vpath_supported = max_vpath_supported;
@@ -4278,15 +4591,13 @@ vxge_probe(struct pci_dev *pdev, const struct pci_device_id *pre)
 
         /* Copy the station mac address to the list */
         for (i = 0; i < vdev->no_of_vpath; i++) {
-                entry = (struct vxge_mac_addrs *)
-                                kzalloc(sizeof(struct vxge_mac_addrs),
-                                        GFP_KERNEL);
+                entry = kzalloc(sizeof(struct vxge_mac_addrs), GFP_KERNEL);
                 if (NULL == entry) {
                         vxge_debug_init(VXGE_ERR,
                                 "%s: mac_addr_list : memory allocation failed",
                                 vdev->ndev->name);
                         ret = -EPERM;
-                        goto _exit5;
+                        goto _exit6;
                 }
                 macaddr = (u8 *)&entry->macaddr;
                 memcpy(macaddr, vdev->ndev->dev_addr, ETH_ALEN);
@@ -4326,10 +4637,10 @@ vxge_probe(struct pci_dev *pdev, const struct pci_device_id *pre)
         kfree(ll_config);
         return 0;
 
-_exit5:
+_exit6:
         for (i = 0; i < vdev->no_of_vpath; i++)
                 vxge_free_mac_add_list(&vdev->vpaths[i]);
-
+_exit5:
         vxge_device_unregister(hldev);
 _exit4:
         pci_disable_sriov(pdev);
@@ -4354,34 +4665,25 @@ _exit0:
  * Description: This function is called by the Pci subsystem to release a
  * PCI device and free up all resource held up by the device.
  */
-static void __devexit
-vxge_remove(struct pci_dev *pdev)
+static void __devexit vxge_remove(struct pci_dev *pdev)
 {
-        struct __vxge_hw_device  *hldev;
+        struct __vxge_hw_device *hldev;
         struct vxgedev *vdev = NULL;
         struct net_device *dev;
         int i = 0;
-#if ((VXGE_DEBUG_INIT & VXGE_DEBUG_MASK) || \
-        (VXGE_DEBUG_ENTRYEXIT & VXGE_DEBUG_MASK))
-        u32 level_trace;
-#endif
 
-        hldev = (struct __vxge_hw_device  *) pci_get_drvdata(pdev);
+        hldev = pci_get_drvdata(pdev);
 
         if (hldev == NULL)
                 return;
+
         dev = hldev->ndev;
         vdev = netdev_priv(dev);
 
-#if ((VXGE_DEBUG_INIT & VXGE_DEBUG_MASK) || \
-        (VXGE_DEBUG_ENTRYEXIT & VXGE_DEBUG_MASK))
-        level_trace = vdev->level_trace;
-#endif
-        vxge_debug_entryexit(level_trace,
-                "%s:%d", __func__, __LINE__);
+        vxge_debug_entryexit(vdev->level_trace, "%s:%d", __func__, __LINE__);
 
-        vxge_debug_init(level_trace,
-                "%s : removing PCI device...", __func__);
+        vxge_debug_init(vdev->level_trace, "%s : removing PCI device...",
+                        __func__);
         vxge_device_unregister(hldev);
 
         for (i = 0; i < vdev->no_of_vpath; i++) {
@@ -4399,16 +4701,16 @@ vxge_remove(struct pci_dev *pdev)
         /* we are safe to free it now */
         free_netdev(dev);
 
-        vxge_debug_init(level_trace,
-                "%s:%d  Device unregistered", __func__, __LINE__);
+        vxge_debug_init(vdev->level_trace, "%s:%d Device unregistered",
+                        __func__, __LINE__);
 
         vxge_hw_device_terminate(hldev);
 
         pci_disable_device(pdev);
         pci_release_regions(pdev);
         pci_set_drvdata(pdev, NULL);
-        vxge_debug_entryexit(level_trace,
-                "%s:%d  Exiting...", __func__, __LINE__);
+        vxge_debug_entryexit(vdev->level_trace, "%s:%d  Exiting...", __func__,
+                             __LINE__);
 }
 
 static struct pci_error_handlers vxge_err_handler = {
diff --git a/drivers/net/vxge/vxge-main.h b/drivers/net/vxge/vxge-main.h
index de64536cb7d..953cb0ded3e 100644
--- a/drivers/net/vxge/vxge-main.h
+++ b/drivers/net/vxge/vxge-main.h
@@ -29,6 +29,9 @@
 
 #define PCI_DEVICE_ID_TITAN_WIN         0x5733
 #define PCI_DEVICE_ID_TITAN_UNI         0x5833
+#define VXGE_HW_TITAN1_PCI_REVISION     1
+#define VXGE_HW_TITAN1A_PCI_REVISION    2
+
 #define VXGE_USE_DEFAULT                0xffffffff
 #define VXGE_HW_VPATH_MSIX_ACTIVE       4
 #define VXGE_ALARM_MSIX_ID              2
@@ -53,11 +56,13 @@
 
 #define VXGE_TTI_BTIMER_VAL 250000
 
-#define VXGE_TTI_LTIMER_VAL 1000
-#define VXGE_TTI_RTIMER_VAL 0
-#define VXGE_RTI_BTIMER_VAL 250
-#define VXGE_RTI_LTIMER_VAL 100
-#define VXGE_RTI_RTIMER_VAL 0
+#define VXGE_TTI_LTIMER_VAL     1000
+#define VXGE_T1A_TTI_LTIMER_VAL 80
+#define VXGE_TTI_RTIMER_VAL     0
+#define VXGE_T1A_TTI_RTIMER_VAL 400
+#define VXGE_RTI_BTIMER_VAL     250
+#define VXGE_RTI_LTIMER_VAL     100
+#define VXGE_RTI_RTIMER_VAL     0
 #define VXGE_FIFO_INDICATE_MAX_PKTS VXGE_DEF_FIFO_LENGTH
 #define VXGE_ISR_POLLING_CNT    8
 #define VXGE_MAX_CONFIG_DEV     0xFF
@@ -76,14 +81,32 @@
 #define TTI_TX_UFC_B    40
 #define TTI_TX_UFC_C    60
 #define TTI_TX_UFC_D    100
+#define TTI_T1A_TX_UFC_A        30
+#define TTI_T1A_TX_UFC_B        80
+/* Slope - (max_mtu - min_mtu)/(max_mtu_ufc - min_mtu_ufc) */
+/* Slope - 93 */
+/* 60 - 9k Mtu, 140 - 1.5k mtu */
+#define TTI_T1A_TX_UFC_C(mtu)   (60 + ((VXGE_HW_MAX_MTU - mtu) / 93))
+
+/* Slope - 37 */
+/* 100 - 9k Mtu, 300 - 1.5k mtu */
+#define TTI_T1A_TX_UFC_D(mtu)   (100 + ((VXGE_HW_MAX_MTU - mtu) / 37))
+
+
+#define RTI_RX_URANGE_A         5
+#define RTI_RX_URANGE_B         15
+#define RTI_RX_URANGE_C         40
+#define RTI_T1A_RX_URANGE_A     1
+#define RTI_T1A_RX_URANGE_B     20
+#define RTI_T1A_RX_URANGE_C     50
+#define RTI_RX_UFC_A            1
+#define RTI_RX_UFC_B            5
+#define RTI_RX_UFC_C            10
+#define RTI_RX_UFC_D            15
+#define RTI_T1A_RX_UFC_B        20
+#define RTI_T1A_RX_UFC_C        50
+#define RTI_T1A_RX_UFC_D        60
 
-#define RTI_RX_URANGE_A 5
-#define RTI_RX_URANGE_B 15
-#define RTI_RX_URANGE_C 40
-#define RTI_RX_UFC_A    1
-#define RTI_RX_UFC_B    5
-#define RTI_RX_UFC_C    10
-#define RTI_RX_UFC_D    15
 
 /* Milli secs timer period */
 #define VXGE_TIMER_DELAY                10000
@@ -145,15 +168,15 @@ struct vxge_config {
 
         int             addr_learn_en;
 
-        int             rth_steering;
-        int             rth_algorithm;
-        int             rth_hash_type_tcpipv4;
-        int             rth_hash_type_ipv4;
-        int             rth_hash_type_tcpipv6;
-        int             rth_hash_type_ipv6;
-        int             rth_hash_type_tcpipv6ex;
-        int             rth_hash_type_ipv6ex;
-        int             rth_bkt_sz;
+        u32             rth_steering:2,
+                        rth_algorithm:2,
+                        rth_hash_type_tcpipv4:1,
+                        rth_hash_type_ipv4:1,
+                        rth_hash_type_tcpipv6:1,
+                        rth_hash_type_ipv6:1,
+                        rth_hash_type_tcpipv6ex:1,
+                        rth_hash_type_ipv6ex:1,
+                        rth_bkt_sz:8;
         int             rth_jhash_golden_ratio;
         int             tx_steering_type;
         int     fifo_indicate_max_pkts;
@@ -248,8 +271,9 @@ struct vxge_ring {
          */
         int driver_id;
 
-         /* copy of the flag indicating whether rx_csum is to be used */
-        u32 rx_csum;
+        /* copy of the flag indicating whether rx_csum is to be used */
+        u32 rx_csum:1,
+            rx_hwts:1;
 
         int pkts_processed;
         int budget;
@@ -327,7 +351,9 @@ struct vxgedev {
         u16             all_multi_flg;
 
          /* A flag indicating whether rx_csum is to be used or not. */
-        u32     rx_csum;
+        u32     rx_csum:1,
+                rx_hwts:1,
+                titan1:1;
 
         struct vxge_msix_entry *vxge_entries;
         struct msix_entry *entries;
@@ -387,8 +413,6 @@ struct vxge_tx_priv {
         static int p = val; \
         module_param(p, int, 0)
 
-#define vxge_os_bug(fmt...)             { printk(fmt); BUG(); }
-
 #define vxge_os_timer(timer, handle, arg, exp) do { \
                 init_timer(&timer); \
                 timer.function = handle; \
@@ -397,6 +421,11 @@ struct vxge_tx_priv {
         } while (0);
 
 extern void vxge_initialize_ethtool_ops(struct net_device *ndev);
+
+enum vxge_hw_status vxge_reset_all_vpaths(struct vxgedev *vdev);
+
+int vxge_fw_upgrade(struct vxgedev *vdev, char *fw_name, int override);
+
 /**
  * #define VXGE_DEBUG_INIT: debug for initialization functions
  * #define VXGE_DEBUG_TX         : debug transmit related functions
diff --git a/drivers/net/vxge/vxge-reg.h b/drivers/net/vxge/vxge-reg.h
index 3dd5c9615ef..3e658b17594 100644
--- a/drivers/net/vxge/vxge-reg.h
+++ b/drivers/net/vxge/vxge-reg.h
@@ -49,6 +49,33 @@
 #define VXGE_HW_TITAN_VPMGMT_REG_SPACES                 17
 #define VXGE_HW_TITAN_VPATH_REG_SPACES                  17
 
+#define VXGE_HW_FW_API_GET_EPROM_REV                    31
+
+#define VXGE_EPROM_IMG_MAJOR(val)               (u32) vxge_bVALn(val, 48, 4)
+#define VXGE_EPROM_IMG_MINOR(val)               (u32) vxge_bVALn(val, 52, 4)
+#define VXGE_EPROM_IMG_FIX(val)                 (u32) vxge_bVALn(val, 56, 4)
+#define VXGE_EPROM_IMG_BUILD(val)               (u32) vxge_bVALn(val, 60, 4)
+
+#define VXGE_HW_GET_EPROM_IMAGE_INDEX(val)              vxge_bVALn(val, 16, 8)
+#define VXGE_HW_GET_EPROM_IMAGE_VALID(val)              vxge_bVALn(val, 31, 1)
+#define VXGE_HW_GET_EPROM_IMAGE_TYPE(val)               vxge_bVALn(val, 40, 8)
+#define VXGE_HW_GET_EPROM_IMAGE_REV(val)                vxge_bVALn(val, 48, 16)
+#define VXGE_HW_RTS_ACCESS_STEER_ROM_IMAGE_INDEX(val)   vxge_vBIT(val, 16, 8)
+
+#define VXGE_HW_FW_API_GET_FUNC_MODE                    29
+#define VXGE_HW_GET_FUNC_MODE_VAL(val)                  (val & 0xFF)
+
+#define VXGE_HW_FW_UPGRADE_MEMO                         13
+#define VXGE_HW_FW_UPGRADE_ACTION                       16
+#define VXGE_HW_FW_UPGRADE_OFFSET_START                 2
+#define VXGE_HW_FW_UPGRADE_OFFSET_SEND                  3
+#define VXGE_HW_FW_UPGRADE_OFFSET_COMMIT                4
+#define VXGE_HW_FW_UPGRADE_OFFSET_READ                  5
+
+#define VXGE_HW_FW_UPGRADE_BLK_SIZE                     16
+#define VXGE_HW_UPGRADE_GET_RET_ERR_CODE(val)           (val & 0xff)
+#define VXGE_HW_UPGRADE_GET_SEC_ERR_CODE(val)           ((val >> 8) & 0xff)
+
 #define VXGE_HW_ASIC_MODE_RESERVED                              0
 #define VXGE_HW_ASIC_MODE_NO_IOV                                1
 #define VXGE_HW_ASIC_MODE_SR_IOV                                2
@@ -165,13 +192,13 @@
 #define VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL_ETYPE             2
 #define VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL_PN                3
 #define VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL_RTH_GEN_CFG       5
-#define VXGE_HW_RTS_ACS_STEER_CTRL_DATA_STRUCT_SEL_RTH_SOLO_IT  6
+#define VXGE_HW_RTS_ACS_STEER_CTRL_DATA_STRUCT_SEL_RTH_SOLO_IT          6
 #define VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL_RTH_JHASH_CFG     7
 #define VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL_RTH_MASK          8
 #define VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL_RTH_KEY           9
 #define VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL_QOS               10
 #define VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL_DS                11
-#define VXGE_HW_RTS_ACS_STEER_CTRL_DATA_STRUCT_SEL_RTH_MULTI_IT 12
+#define VXGE_HW_RTS_ACS_STEER_CTRL_DATA_STRUCT_SEL_RTH_MULTI_IT         12
 #define VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL_FW_MEMO           13
 
 #define VXGE_HW_RTS_ACCESS_STEER_DATA0_GET_DA_MAC_ADDR(bits) \
@@ -437,6 +464,7 @@
 #define VXGE_HW_RTS_ACCESS_STEER_DATA1_GET_FLASH_VER_BUILD(bits) \
                                                         vxge_bVALn(bits, 48, 16)
 #define VXGE_HW_RTS_ACCESS_STEER_DATA1_FLASH_VER_BUILD vxge_vBIT(val, 48, 16)
+#define VXGE_HW_RTS_ACCESS_STEER_CTRL_GET_ACTION(bits) vxge_bVALn(bits, 0, 8)
 
 #define VXGE_HW_SRPCIM_TO_VPATH_ALARM_REG_GET_PPIF_SRPCIM_TO_VPATH_ALARM(bits)\
                                                         vxge_bVALn(bits, 0, 18)
@@ -3998,6 +4026,7 @@ struct vxge_hw_vpath_reg {
 #define VXGE_HW_PRC_CFG6_L4_CPC_TRSFR_CODE_EN   vxge_mBIT(9)
 #define VXGE_HW_PRC_CFG6_RXD_CRXDT(val) vxge_vBIT(val, 23, 9)
 #define VXGE_HW_PRC_CFG6_RXD_SPAT(val) vxge_vBIT(val, 36, 9)
+#define VXGE_HW_PRC_CFG6_GET_RXD_SPAT(val)      vxge_bVALn(val, 36, 9)
 /*0x00a78*/     u64     prc_cfg7;
 #define VXGE_HW_PRC_CFG7_SCATTER_MODE(val) vxge_vBIT(val, 6, 2)
 #define VXGE_HW_PRC_CFG7_SMART_SCAT_EN  vxge_mBIT(11)
diff --git a/drivers/net/vxge/vxge-traffic.h b/drivers/net/vxge/vxge-traffic.h
index 9890d4d596d..1fceee87622 100644
--- a/drivers/net/vxge/vxge-traffic.h
+++ b/drivers/net/vxge/vxge-traffic.h
@@ -1904,34 +1904,6 @@ enum vxge_hw_ring_tcode {
         VXGE_HW_RING_T_CODE_MULTI_ERR                   = 0xF
 };
 
-/**
- * enum enum vxge_hw_ring_hash_type - RTH hash types
- * @VXGE_HW_RING_HASH_TYPE_NONE: No Hash
- * @VXGE_HW_RING_HASH_TYPE_TCP_IPV4: TCP IPv4
- * @VXGE_HW_RING_HASH_TYPE_UDP_IPV4: UDP IPv4
- * @VXGE_HW_RING_HASH_TYPE_IPV4: IPv4
- * @VXGE_HW_RING_HASH_TYPE_TCP_IPV6: TCP IPv6
- * @VXGE_HW_RING_HASH_TYPE_UDP_IPV6: UDP IPv6
- * @VXGE_HW_RING_HASH_TYPE_IPV6: IPv6
- * @VXGE_HW_RING_HASH_TYPE_TCP_IPV6_EX: TCP IPv6 extension
- * @VXGE_HW_RING_HASH_TYPE_UDP_IPV6_EX: UDP IPv6 extension
- * @VXGE_HW_RING_HASH_TYPE_IPV6_EX: IPv6 extension
- *
- * RTH hash types
- */
-enum vxge_hw_ring_hash_type {
-        VXGE_HW_RING_HASH_TYPE_NONE                     = 0x0,
-        VXGE_HW_RING_HASH_TYPE_TCP_IPV4         = 0x1,
-        VXGE_HW_RING_HASH_TYPE_UDP_IPV4         = 0x2,
-        VXGE_HW_RING_HASH_TYPE_IPV4                     = 0x3,
-        VXGE_HW_RING_HASH_TYPE_TCP_IPV6         = 0x4,
-        VXGE_HW_RING_HASH_TYPE_UDP_IPV6         = 0x5,
-        VXGE_HW_RING_HASH_TYPE_IPV6                     = 0x6,
-        VXGE_HW_RING_HASH_TYPE_TCP_IPV6_EX      = 0x7,
-        VXGE_HW_RING_HASH_TYPE_UDP_IPV6_EX      = 0x8,
-        VXGE_HW_RING_HASH_TYPE_IPV6_EX          = 0x9
-};
-
 enum vxge_hw_status vxge_hw_ring_rxd_reserve(
         struct __vxge_hw_ring *ring_handle,
         void **rxdh);
diff --git a/drivers/net/vxge/vxge-version.h b/drivers/net/vxge/vxge-version.h
index 53fefe13736..9c93e0a1717 100644
--- a/drivers/net/vxge/vxge-version.h
+++ b/drivers/net/vxge/vxge-version.h
@@ -16,7 +16,34 @@
 
 #define VXGE_VERSION_MAJOR      "2"
 #define VXGE_VERSION_MINOR      "0"
-#define VXGE_VERSION_FIX        "9"
-#define VXGE_VERSION_BUILD      "20840"
+#define VXGE_VERSION_FIX        "11"
+#define VXGE_VERSION_BUILD      "21932"
 #define VXGE_VERSION_FOR        "k"
+
+#define VXGE_FW_VER(maj, min, bld) (((maj) << 16) + ((min) << 8) + (bld))
+
+#define VXGE_DEAD_FW_VER_MAJOR  1
+#define VXGE_DEAD_FW_VER_MINOR  4
+#define VXGE_DEAD_FW_VER_BUILD  4
+
+#define VXGE_FW_DEAD_VER VXGE_FW_VER(VXGE_DEAD_FW_VER_MAJOR, \
+                                     VXGE_DEAD_FW_VER_MINOR, \
+                                     VXGE_DEAD_FW_VER_BUILD)
+
+#define VXGE_EPROM_FW_VER_MAJOR 1
+#define VXGE_EPROM_FW_VER_MINOR 6
+#define VXGE_EPROM_FW_VER_BUILD 1
+
+#define VXGE_EPROM_FW_VER VXGE_FW_VER(VXGE_EPROM_FW_VER_MAJOR, \
+                                      VXGE_EPROM_FW_VER_MINOR, \
+                                      VXGE_EPROM_FW_VER_BUILD)
+
+#define VXGE_CERT_FW_VER_MAJOR  1
+#define VXGE_CERT_FW_VER_MINOR  8
+#define VXGE_CERT_FW_VER_BUILD  1
+
+#define VXGE_CERT_FW_VER VXGE_FW_VER(VXGE_CERT_FW_VER_MAJOR, \
+                                     VXGE_CERT_FW_VER_MINOR, \
+                                     VXGE_CERT_FW_VER_BUILD)
+
 #endif
diff --git a/drivers/net/wireless/ath/ar9170/cmd.c b/drivers/net/wireless/ath/ar9170/cmd.c
index 4604de09a8b..6452c5055a6 100644
--- a/drivers/net/wireless/ath/ar9170/cmd.c
+++ b/drivers/net/wireless/ath/ar9170/cmd.c
@@ -54,7 +54,7 @@ int ar9170_write_mem(struct ar9170 *ar, const __le32 *data, size_t len)
 
 int ar9170_write_reg(struct ar9170 *ar, const u32 reg, const u32 val)
 {
-        __le32 buf[2] = {
+        const __le32 buf[2] = {
                 cpu_to_le32(reg),
                 cpu_to_le32(val),
         };
diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h
index 501050c0296..20ea68c59f7 100644
--- a/drivers/net/wireless/ath/ath.h
+++ b/drivers/net/wireless/ath/ath.h
@@ -104,6 +104,11 @@ enum ath_cipher {
         ATH_CIPHER_MIC = 127
 };
 
+enum ath_drv_info {
+        AR7010_DEVICE           = BIT(0),
+        AR9287_DEVICE           = BIT(1),
+};
+
 /**
  * struct ath_ops - Register read/write operations
  *
@@ -147,6 +152,7 @@ struct ath_common {
         u8 rx_chainmask;
 
         u32 rx_bufsize;
+        u32 driver_info;
 
         u32 keymax;
         DECLARE_BITMAP(keymap, ATH_KEYMAX);
diff --git a/drivers/net/wireless/ath/ath5k/Kconfig b/drivers/net/wireless/ath/ath5k/Kconfig
index eb83b7b4d0e..47844575caa 100644
--- a/drivers/net/wireless/ath/ath5k/Kconfig
+++ b/drivers/net/wireless/ath/ath5k/Kconfig
@@ -4,6 +4,7 @@ config ATH5K
         select MAC80211_LEDS
         select LEDS_CLASS
         select NEW_LEDS
+        select AVERAGE
         ---help---
           This module adds support for wireless adapters based on
           Atheros 5xxx chipset.
diff --git a/drivers/net/wireless/ath/ath5k/ani.c b/drivers/net/wireless/ath/ath5k/ani.c
index f1419198a47..6b75b22a929 100644
--- a/drivers/net/wireless/ath/ath5k/ani.c
+++ b/drivers/net/wireless/ath/ath5k/ani.c
@@ -63,15 +63,15 @@ ath5k_ani_set_noise_immunity_level(struct ath5k_hw *ah, int level)
          * so i stick with the HAL version for now...
          */
 #if 0
-        const s8 hi[] = { -18, -18, -16, -14, -12 };
-        const s8 lo[] = { -52, -56, -60, -64, -70 };
-        const s8 sz[] = { -34, -41, -48, -55, -62 };
-        const s8 fr[] = { -70, -72, -75, -78, -80 };
+        static const s8 hi[] = { -18, -18, -16, -14, -12 };
+        static const s8 lo[] = { -52, -56, -60, -64, -70 };
+        static const s8 sz[] = { -34, -41, -48, -55, -62 };
+        static const s8 fr[] = { -70, -72, -75, -78, -80 };
 #else
-        const s8 sz[] = { -55, -62 };
-        const s8 lo[] = { -64, -70 };
-        const s8 hi[] = { -14, -12 };
-        const s8 fr[] = { -78, -80 };
+        static const s8 sz[] = { -55, -62 };
+        static const s8 lo[] = { -64, -70 };
+        static const s8 hi[] = { -14, -12 };
+        static const s8 fr[] = { -78, -80 };
 #endif
         if (level < 0 || level >= ARRAY_SIZE(sz)) {
                 ATH5K_ERR(ah->ah_sc, "noise immuniy level %d out of range",
@@ -102,7 +102,7 @@ ath5k_ani_set_noise_immunity_level(struct ath5k_hw *ah, int level)
 void
 ath5k_ani_set_spur_immunity_level(struct ath5k_hw *ah, int level)
 {
-        const int val[] = { 2, 4, 6, 8, 10, 12, 14, 16 };
+        static const int val[] = { 2, 4, 6, 8, 10, 12, 14, 16 };
 
         if (level < 0 || level >= ARRAY_SIZE(val) ||
             level > ah->ah_sc->ani_state.max_spur_level) {
@@ -127,7 +127,7 @@ ath5k_ani_set_spur_immunity_level(struct ath5k_hw *ah, int level)
 void
 ath5k_ani_set_firstep_level(struct ath5k_hw *ah, int level)
 {
-        const int val[] = { 0, 4, 8 };
+        static const int val[] = { 0, 4, 8 };
 
         if (level < 0 || level >= ARRAY_SIZE(val)) {
                 ATH5K_ERR(ah->ah_sc, "firstep level %d out of range", level);
@@ -151,12 +151,12 @@ ath5k_ani_set_firstep_level(struct ath5k_hw *ah, int level)
 void
 ath5k_ani_set_ofdm_weak_signal_detection(struct ath5k_hw *ah, bool on)
 {
-        const int m1l[] = { 127, 50 };
-        const int m2l[] = { 127, 40 };
-        const int m1[] = { 127, 0x4d };
-        const int m2[] = { 127, 0x40 };
-        const int m2cnt[] = { 31, 16 };
-        const int m2lcnt[] = { 63, 48 };
+        static const int m1l[] = { 127, 50 };
+        static const int m2l[] = { 127, 40 };
+        static const int m1[] = { 127, 0x4d };
+        static const int m2[] = { 127, 0x40 };
+        static const int m2cnt[] = { 31, 16 };
+        static const int m2lcnt[] = { 63, 48 };
 
         AR5K_REG_WRITE_BITS(ah, AR5K_PHY_WEAK_OFDM_LOW_THR,
                                 AR5K_PHY_WEAK_OFDM_LOW_THR_M1, m1l[on]);
@@ -192,7 +192,7 @@ ath5k_ani_set_ofdm_weak_signal_detection(struct ath5k_hw *ah, bool on)
 void
 ath5k_ani_set_cck_weak_signal_detection(struct ath5k_hw *ah, bool on)
 {
-        const int val[] = { 8, 6 };
+        static const int val[] = { 8, 6 };
         AR5K_REG_WRITE_BITS(ah, AR5K_PHY_CCK_CROSSCORR,
                                 AR5K_PHY_CCK_CROSSCORR_WEAK_SIG_THR, val[on]);
         ah->ah_sc->ani_state.cck_weak_sig = on;
@@ -216,7 +216,7 @@ static void
 ath5k_ani_raise_immunity(struct ath5k_hw *ah, struct ath5k_ani_state *as,
                          bool ofdm_trigger)
 {
-        int rssi = ah->ah_beacon_rssi_avg.avg;
+        int rssi = ewma_read(&ah->ah_beacon_rssi_avg);
 
         ATH5K_DBG_UNLIMIT(ah->ah_sc, ATH5K_DEBUG_ANI, "raise immunity (%s)",
                 ofdm_trigger ? "ODFM" : "CCK");
@@ -301,7 +301,7 @@ ath5k_ani_raise_immunity(struct ath5k_hw *ah, struct ath5k_ani_state *as,
 static void
 ath5k_ani_lower_immunity(struct ath5k_hw *ah, struct ath5k_ani_state *as)
 {
-        int rssi = ah->ah_beacon_rssi_avg.avg;
+        int rssi = ewma_read(&ah->ah_beacon_rssi_avg);
 
         ATH5K_DBG_UNLIMIT(ah->ah_sc, ATH5K_DEBUG_ANI, "lower immunity");
 
diff --git a/drivers/net/wireless/ath/ath5k/ath5k.h b/drivers/net/wireless/ath/ath5k/ath5k.h
index 308b79e1ff0..2718136e488 100644
--- a/drivers/net/wireless/ath/ath5k/ath5k.h
+++ b/drivers/net/wireless/ath/ath5k/ath5k.h
@@ -25,6 +25,7 @@
 
 #include <linux/io.h>
 #include <linux/types.h>
+#include <linux/average.h>
 #include <net/mac80211.h>
 
 /* RX/TX descriptor hw structs
@@ -1102,7 +1103,7 @@ struct ath5k_hw {
         struct ath5k_nfcal_hist ah_nfcal_hist;
 
         /* average beacon RSSI in our BSS (used by ANI) */
-        struct ath5k_avg_val    ah_beacon_rssi_avg;
+        struct ewma             ah_beacon_rssi_avg;
 
         /* noise floor from last periodic calibration */
         s32                     ah_noise_floor;
@@ -1315,27 +1316,4 @@ static inline u32 ath5k_hw_bitswap(u32 val, unsigned int bits)
         return retval;
 }
 
-#define AVG_SAMPLES     8
-#define AVG_FACTOR      1000
-
-/**
- * ath5k_moving_average -  Exponentially weighted moving average
- * @avg: average structure
- * @val: current value
- *
- * This implementation make use of a struct ath5k_avg_val to prevent rounding
- * errors.
- */
-static inline struct ath5k_avg_val
-ath5k_moving_average(const struct ath5k_avg_val avg, const int val)
-{
-        struct ath5k_avg_val new;
-        new.avg_weight = avg.avg_weight  ?
-                (((avg.avg_weight * ((AVG_SAMPLES) - 1)) +
-                        (val * (AVG_FACTOR))) / (AVG_SAMPLES)) :
-                (val * (AVG_FACTOR));
-        new.avg = new.avg_weight / (AVG_FACTOR);
-        return new;
-}
-
 #endif
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index 8251946842e..7f783d9462a 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -549,7 +549,7 @@ static void ath_vif_iter(void *data, u8 *mac, struct ieee80211_vif *vif)
         /* Calculate combined mode - when APs are active, operate in AP mode.
          * Otherwise use the mode of the new interface. This can currently
          * only deal with combinations of APs and STAs. Only one ad-hoc
-         * interfaces is allowed above.
+         * interfaces is allowed.
          */
         if (avf->opmode == NL80211_IFTYPE_AP)
                 iter_data->opmode = NL80211_IFTYPE_AP;
@@ -558,16 +558,8 @@ static void ath_vif_iter(void *data, u8 *mac, struct ieee80211_vif *vif)
                         iter_data->opmode = avf->opmode;
 }
 
-static void ath_do_set_opmode(struct ath5k_softc *sc)
-{
-        struct ath5k_hw *ah = sc->ah;
-        ath5k_hw_set_opmode(ah, sc->opmode);
-        ATH5K_DBG(sc, ATH5K_DEBUG_MODE, "mode setup opmode %d (%s)\n",
-                  sc->opmode, ath_opmode_to_string(sc->opmode));
-}
-
-void ath5k_update_bssid_mask_and_opmode(struct ath5k_softc *sc,
-                                        struct ieee80211_vif *vif)
+static void ath5k_update_bssid_mask_and_opmode(struct ath5k_softc *sc,
+                                               struct ieee80211_vif *vif)
 {
         struct ath_common *common = ath5k_hw_common(sc->ah);
         struct ath_vif_iter_data iter_data;
@@ -595,7 +587,9 @@ void ath5k_update_bssid_mask_and_opmode(struct ath5k_softc *sc,
                 /* Nothing active, default to station mode */
                 sc->opmode = NL80211_IFTYPE_STATION;
 
-        ath_do_set_opmode(sc);
+        ath5k_hw_set_opmode(sc->ah, sc->opmode);
+        ATH5K_DBG(sc, ATH5K_DEBUG_MODE, "mode setup opmode %d (%s)\n",
+                  sc->opmode, ath_opmode_to_string(sc->opmode));
 
         if (iter_data.need_set_hw_addr && iter_data.found_active)
                 ath5k_hw_set_lladdr(sc->ah, iter_data.active_mac);
@@ -1307,8 +1301,7 @@ ath5k_update_beacon_rssi(struct ath5k_softc *sc, struct sk_buff *skb, int rssi)
             memcmp(mgmt->bssid, common->curbssid, ETH_ALEN) != 0)
                 return;
 
-        ah->ah_beacon_rssi_avg = ath5k_moving_average(ah->ah_beacon_rssi_avg,
-                                                      rssi);
+        ewma_add(&ah->ah_beacon_rssi_avg, rssi);
 
         /* in IBSS mode we should keep RSSI statistics per neighbour */
         /* le16_to_cpu(mgmt->u.beacon.capab_info) & WLAN_CAPABILITY_IBSS */
@@ -2562,6 +2555,7 @@ ath5k_reset(struct ath5k_softc *sc, struct ieee80211_channel *chan)
         ah->ah_cal_next_full = jiffies;
         ah->ah_cal_next_ani = jiffies;
         ah->ah_cal_next_nf = jiffies;
+        ewma_init(&ah->ah_beacon_rssi_avg, 1000, 8);
 
         /*
          * Change channels and update the h/w rate map if we're switching;
@@ -3206,14 +3200,32 @@ static int ath5k_get_survey(struct ieee80211_hw *hw, int idx,
 {
         struct ath5k_softc *sc = hw->priv;
         struct ieee80211_conf *conf = &hw->conf;
+        struct ath_common *common = ath5k_hw_common(sc->ah);
+        struct ath_cycle_counters *cc = &common->cc_survey;
+        unsigned int div = common->clockrate * 1000;
 
-         if (idx != 0)
+        if (idx != 0)
                 return -ENOENT;
 
         survey->channel = conf->channel;
         survey->filled = SURVEY_INFO_NOISE_DBM;
         survey->noise = sc->ah->ah_noise_floor;
 
+        spin_lock_bh(&common->cc_lock);
+        ath_hw_cycle_counters_update(common);
+        if (cc->cycles > 0) {
+                survey->filled |= SURVEY_INFO_CHANNEL_TIME |
+                        SURVEY_INFO_CHANNEL_TIME_BUSY |
+                        SURVEY_INFO_CHANNEL_TIME_RX |
+                        SURVEY_INFO_CHANNEL_TIME_TX;
+                survey->channel_time += cc->cycles / div;
+                survey->channel_time_busy += cc->rx_busy / div;
+                survey->channel_time_rx += cc->rx_frame / div;
+                survey->channel_time_tx += cc->tx_frame / div;
+        }
+        memset(cc, 0, sizeof(*cc));
+        spin_unlock_bh(&common->cc_lock);
+
         return 0;
 }
 
@@ -3395,6 +3407,36 @@ static int ath5k_conf_tx(struct ieee80211_hw *hw, u16 queue,
         return ret;
 }
 
+static int ath5k_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
+{
+        struct ath5k_softc *sc = hw->priv;
+
+        if (tx_ant == 1 && rx_ant == 1)
+                ath5k_hw_set_antenna_mode(sc->ah, AR5K_ANTMODE_FIXED_A);
+        else if (tx_ant == 2 && rx_ant == 2)
+                ath5k_hw_set_antenna_mode(sc->ah, AR5K_ANTMODE_FIXED_B);
+        else if ((tx_ant & 3) == 3 && (rx_ant & 3) == 3)
+                ath5k_hw_set_antenna_mode(sc->ah, AR5K_ANTMODE_DEFAULT);
+        else
+                return -EINVAL;
+        return 0;
+}
+
+static int ath5k_get_antenna(struct ieee80211_hw *hw, u32 *tx_ant, u32 *rx_ant)
+{
+        struct ath5k_softc *sc = hw->priv;
+
+        switch (sc->ah->ah_ant_mode) {
+        case AR5K_ANTMODE_FIXED_A:
+                *tx_ant = 1; *rx_ant = 1; break;
+        case AR5K_ANTMODE_FIXED_B:
+                *tx_ant = 2; *rx_ant = 2; break;
+        case AR5K_ANTMODE_DEFAULT:
+                *tx_ant = 3; *rx_ant = 3; break;
+        }
+        return 0;
+}
+
 static const struct ieee80211_ops ath5k_hw_ops = {
         .tx             = ath5k_tx,
         .start          = ath5k_start,
@@ -3415,6 +3457,8 @@ static const struct ieee80211_ops ath5k_hw_ops = {
         .sw_scan_start  = ath5k_sw_scan_start,
         .sw_scan_complete = ath5k_sw_scan_complete,
         .set_coverage_class = ath5k_set_coverage_class,
+        .set_antenna    = ath5k_set_antenna,
+        .get_antenna    = ath5k_get_antenna,
 };
 
 /********************\
diff --git a/drivers/net/wireless/ath/ath5k/debug.c b/drivers/net/wireless/ath/ath5k/debug.c
index acda56ee521..7d785cb60ce 100644
--- a/drivers/net/wireless/ath/ath5k/debug.c
+++ b/drivers/net/wireless/ath/ath5k/debug.c
@@ -554,63 +554,63 @@ static ssize_t read_file_frameerrors(struct file *file, char __user *user_buf,
 
         len += snprintf(buf+len, sizeof(buf)-len,
                         "RX\n---------------------\n");
-        len += snprintf(buf+len, sizeof(buf)-len, "CRC\t%d\t(%d%%)\n",
+        len += snprintf(buf+len, sizeof(buf)-len, "CRC\t%u\t(%u%%)\n",
                         st->rxerr_crc,
                         st->rx_all_count > 0 ?
                                 st->rxerr_crc*100/st->rx_all_count : 0);
-        len += snprintf(buf+len, sizeof(buf)-len, "PHY\t%d\t(%d%%)\n",
+        len += snprintf(buf+len, sizeof(buf)-len, "PHY\t%u\t(%u%%)\n",
                         st->rxerr_phy,
                         st->rx_all_count > 0 ?
                                 st->rxerr_phy*100/st->rx_all_count : 0);
         for (i = 0; i < 32; i++) {
                 if (st->rxerr_phy_code[i])
                         len += snprintf(buf+len, sizeof(buf)-len,
-                                " phy_err[%d]\t%d\n",
+                                " phy_err[%u]\t%u\n",
                                 i, st->rxerr_phy_code[i]);
         }
 
-        len += snprintf(buf+len, sizeof(buf)-len, "FIFO\t%d\t(%d%%)\n",
+        len += snprintf(buf+len, sizeof(buf)-len, "FIFO\t%u\t(%u%%)\n",
                         st->rxerr_fifo,
                         st->rx_all_count > 0 ?
                                 st->rxerr_fifo*100/st->rx_all_count : 0);
-        len += snprintf(buf+len, sizeof(buf)-len, "decrypt\t%d\t(%d%%)\n",
+        len += snprintf(buf+len, sizeof(buf)-len, "decrypt\t%u\t(%u%%)\n",
                         st->rxerr_decrypt,
                         st->rx_all_count > 0 ?
                                 st->rxerr_decrypt*100/st->rx_all_count : 0);
-        len += snprintf(buf+len, sizeof(buf)-len, "MIC\t%d\t(%d%%)\n",
+        len += snprintf(buf+len, sizeof(buf)-len, "MIC\t%u\t(%u%%)\n",
                         st->rxerr_mic,
                         st->rx_all_count > 0 ?
                                 st->rxerr_mic*100/st->rx_all_count : 0);
-        len += snprintf(buf+len, sizeof(buf)-len, "process\t%d\t(%d%%)\n",
+        len += snprintf(buf+len, sizeof(buf)-len, "process\t%u\t(%u%%)\n",
                         st->rxerr_proc,
                         st->rx_all_count > 0 ?
                                 st->rxerr_proc*100/st->rx_all_count : 0);
-        len += snprintf(buf+len, sizeof(buf)-len, "jumbo\t%d\t(%d%%)\n",
+        len += snprintf(buf+len, sizeof(buf)-len, "jumbo\t%u\t(%u%%)\n",
                         st->rxerr_jumbo,
                         st->rx_all_count > 0 ?
                                 st->rxerr_jumbo*100/st->rx_all_count : 0);
-        len += snprintf(buf+len, sizeof(buf)-len, "[RX all\t%d]\n",
+        len += snprintf(buf+len, sizeof(buf)-len, "[RX all\t%u]\n",
                         st->rx_all_count);
-        len += snprintf(buf+len, sizeof(buf)-len, "RX-all-bytes\t%d\n",
+        len += snprintf(buf+len, sizeof(buf)-len, "RX-all-bytes\t%u\n",
                         st->rx_bytes_count);
 
         len += snprintf(buf+len, sizeof(buf)-len,
                         "\nTX\n---------------------\n");
-        len += snprintf(buf+len, sizeof(buf)-len, "retry\t%d\t(%d%%)\n",
+        len += snprintf(buf+len, sizeof(buf)-len, "retry\t%u\t(%u%%)\n",
                         st->txerr_retry,
                         st->tx_all_count > 0 ?
                                 st->txerr_retry*100/st->tx_all_count : 0);
-        len += snprintf(buf+len, sizeof(buf)-len, "FIFO\t%d\t(%d%%)\n",
+        len += snprintf(buf+len, sizeof(buf)-len, "FIFO\t%u\t(%u%%)\n",
                         st->txerr_fifo,
                         st->tx_all_count > 0 ?
                                 st->txerr_fifo*100/st->tx_all_count : 0);
-        len += snprintf(buf+len, sizeof(buf)-len, "filter\t%d\t(%d%%)\n",
+        len += snprintf(buf+len, sizeof(buf)-len, "filter\t%u\t(%u%%)\n",
                         st->txerr_filt,
                         st->tx_all_count > 0 ?
                                 st->txerr_filt*100/st->tx_all_count : 0);
-        len += snprintf(buf+len, sizeof(buf)-len, "[TX all\t%d]\n",
+        len += snprintf(buf+len, sizeof(buf)-len, "[TX all\t%u]\n",
                         st->tx_all_count);
-        len += snprintf(buf+len, sizeof(buf)-len, "TX-all-bytes\t%d\n",
+        len += snprintf(buf+len, sizeof(buf)-len, "TX-all-bytes\t%u\n",
                         st->tx_bytes_count);
 
         if (len > sizeof(buf))
@@ -719,7 +719,7 @@ static ssize_t read_file_ani(struct file *file, char __user *user_buf,
                         st->mib_intr);
         len += snprintf(buf+len, sizeof(buf)-len,
                         "beacon RSSI average:\t%d\n",
-                        sc->ah->ah_beacon_rssi_avg.avg);
+                        (int)ewma_read(&sc->ah->ah_beacon_rssi_avg));
 
 #define CC_PRINT(_struct, _field) \
         _struct._field, \
diff --git a/drivers/net/wireless/ath/ath5k/desc.h b/drivers/net/wireless/ath/ath5k/desc.h
index b2adb2a281c..2509d0bf037 100644
--- a/drivers/net/wireless/ath/ath5k/desc.h
+++ b/drivers/net/wireless/ath/ath5k/desc.h
@@ -26,7 +26,7 @@
 struct ath5k_hw_rx_ctl {
         u32     rx_control_0; /* RX control word 0 */
         u32     rx_control_1; /* RX control word 1 */
-} __packed;
+} __packed __aligned(4);
 
 /* RX control word 1 fields/flags */
 #define AR5K_DESC_RX_CTL1_BUF_LEN               0x00000fff /* data buffer length */
@@ -39,7 +39,7 @@ struct ath5k_hw_rx_ctl {
 struct ath5k_hw_rx_status {
         u32     rx_status_0; /* RX status word 0 */
         u32     rx_status_1; /* RX status word 1 */
-} __packed;
+} __packed __aligned(4);
 
 /* 5210/5211 */
 /* RX status word 0 fields/flags */
@@ -129,7 +129,7 @@ enum ath5k_phy_error_code {
 struct ath5k_hw_2w_tx_ctl {
         u32     tx_control_0; /* TX control word 0 */
         u32     tx_control_1; /* TX control word 1 */
-} __packed;
+} __packed __aligned(4);
 
 /* TX control word 0 fields/flags */
 #define AR5K_2W_TX_DESC_CTL0_FRAME_LEN          0x00000fff /* frame length */
@@ -185,7 +185,7 @@ struct ath5k_hw_4w_tx_ctl {
         u32     tx_control_1; /* TX control word 1 */
         u32     tx_control_2; /* TX control word 2 */
         u32     tx_control_3; /* TX control word 3 */
-} __packed;
+} __packed __aligned(4);
 
 /* TX control word 0 fields/flags */
 #define AR5K_4W_TX_DESC_CTL0_FRAME_LEN          0x00000fff /* frame length */
@@ -244,7 +244,7 @@ struct ath5k_hw_4w_tx_ctl {
 struct ath5k_hw_tx_status {
         u32     tx_status_0; /* TX status word 0 */
         u32     tx_status_1; /* TX status word 1 */
-} __packed;
+} __packed __aligned(4);
 
 /* TX status word 0 fields/flags */
 #define AR5K_DESC_TX_STATUS0_FRAME_XMIT_OK      0x00000001 /* TX success */
@@ -282,7 +282,7 @@ struct ath5k_hw_tx_status {
 struct ath5k_hw_5210_tx_desc {
         struct ath5k_hw_2w_tx_ctl       tx_ctl;
         struct ath5k_hw_tx_status       tx_stat;
-} __packed;
+} __packed __aligned(4);
 
 /*
  * 5212 hardware TX descriptor
@@ -290,7 +290,7 @@ struct ath5k_hw_5210_tx_desc {
 struct ath5k_hw_5212_tx_desc {
         struct ath5k_hw_4w_tx_ctl       tx_ctl;
         struct ath5k_hw_tx_status       tx_stat;
-} __packed;
+} __packed __aligned(4);
 
 /*
  * Common hardware RX descriptor
@@ -298,7 +298,7 @@ struct ath5k_hw_5212_tx_desc {
 struct ath5k_hw_all_rx_desc {
         struct ath5k_hw_rx_ctl          rx_ctl;
         struct ath5k_hw_rx_status       rx_stat;
-} __packed;
+} __packed __aligned(4);
 
 /*
  * Atheros hardware DMA descriptor
@@ -313,7 +313,7 @@ struct ath5k_desc {
                 struct ath5k_hw_5212_tx_desc    ds_tx5212;
                 struct ath5k_hw_all_rx_desc     ds_rx;
         } ud;
-} __packed;
+} __packed __aligned(4);
 
 #define AR5K_RXDESC_INTREQ      0x0020
 
diff --git a/drivers/net/wireless/ath/ath5k/phy.c b/drivers/net/wireless/ath/ath5k/phy.c
index 219367884e6..6b43f535ff5 100644
--- a/drivers/net/wireless/ath/ath5k/phy.c
+++ b/drivers/net/wireless/ath/ath5k/phy.c
@@ -1102,18 +1102,12 @@ int ath5k_hw_channel(struct ath5k_hw *ah, struct ieee80211_channel *channel)
   PHY calibration
 \*****************/
 
-static int sign_extend(int val, const int nbits)
-{
-        int order = BIT(nbits-1);
-        return (val ^ order) - order;
-}
-
 static s32 ath5k_hw_read_measured_noise_floor(struct ath5k_hw *ah)
 {
         s32 val;
 
         val = ath5k_hw_reg_read(ah, AR5K_PHY_NF);
-        return sign_extend(AR5K_REG_MS(val, AR5K_PHY_NF_MINCCA_PWR), 9);
+        return sign_extend32(AR5K_REG_MS(val, AR5K_PHY_NF_MINCCA_PWR), 8);
 }
 
 void ath5k_hw_init_nfcal_hist(struct ath5k_hw *ah)
diff --git a/drivers/net/wireless/ath/ath9k/ani.c b/drivers/net/wireless/ath/ath9k/ani.c
index 63ccb39cdcd..29a045da184 100644
--- a/drivers/net/wireless/ath/ath9k/ani.c
+++ b/drivers/net/wireless/ath/ath9k/ani.c
@@ -834,10 +834,10 @@ void ath9k_hw_ani_setup(struct ath_hw *ah)
 {
         int i;
 
-        const int totalSizeDesired[] = { -55, -55, -55, -55, -62 };
-        const int coarseHigh[] = { -14, -14, -14, -14, -12 };
-        const int coarseLow[] = { -64, -64, -64, -64, -70 };
-        const int firpwr[] = { -78, -78, -78, -78, -80 };
+        static const int totalSizeDesired[] = { -55, -55, -55, -55, -62 };
+        static const int coarseHigh[] = { -14, -14, -14, -14, -12 };
+        static const int coarseLow[] = { -64, -64, -64, -64, -70 };
+        static const int firpwr[] = { -78, -78, -78, -78, -80 };
 
         for (i = 0; i < 5; i++) {
                 ah->totalSizeDesired[i] = totalSizeDesired[i];
diff --git a/drivers/net/wireless/ath/ath9k/ar5008_phy.c b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
index ea9f4497f58..06e34d293dc 100644
--- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
@@ -244,13 +244,15 @@ static void ar5008_hw_spur_mitigate(struct ath_hw *ah,
         int upper, lower, cur_vit_mask;
         int tmp, new;
         int i;
-        int pilot_mask_reg[4] = { AR_PHY_TIMING7, AR_PHY_TIMING8,
-                          AR_PHY_PILOT_MASK_01_30, AR_PHY_PILOT_MASK_31_60
+        static int pilot_mask_reg[4] = {
+                AR_PHY_TIMING7, AR_PHY_TIMING8,
+                AR_PHY_PILOT_MASK_01_30, AR_PHY_PILOT_MASK_31_60
         };
-        int chan_mask_reg[4] = { AR_PHY_TIMING9, AR_PHY_TIMING10,
-                         AR_PHY_CHANNEL_MASK_01_30, AR_PHY_CHANNEL_MASK_31_60
+        static int chan_mask_reg[4] = {
+                AR_PHY_TIMING9, AR_PHY_TIMING10,
+                AR_PHY_CHANNEL_MASK_01_30, AR_PHY_CHANNEL_MASK_31_60
         };
-        int inc[4] = { 0, 100, 0, 0 };
+        static int inc[4] = { 0, 100, 0, 0 };
 
         int8_t mask_m[123];
         int8_t mask_p[123];
@@ -873,7 +875,7 @@ static int ar5008_hw_process_ini(struct ath_hw *ah,
                                  channel->max_antenna_gain * 2,
                                  channel->max_power * 2,
                                  min((u32) MAX_RATE_POWER,
-                                 (u32) regulatory->power_limit));
+                                 (u32) regulatory->power_limit), false);
 
         /* Write analog registers */
         if (!ath9k_hw_set_rf_regs(ah, chan, freqIndex)) {
@@ -1084,12 +1086,12 @@ static bool ar5008_hw_ani_control_old(struct ath_hw *ah,
                 break;
         }
         case ATH9K_ANI_OFDM_WEAK_SIGNAL_DETECTION:{
-                const int m1ThreshLow[] = { 127, 50 };
-                const int m2ThreshLow[] = { 127, 40 };
-                const int m1Thresh[] = { 127, 0x4d };
-                const int m2Thresh[] = { 127, 0x40 };
-                const int m2CountThr[] = { 31, 16 };
-                const int m2CountThrLow[] = { 63, 48 };
+                static const int m1ThreshLow[] = { 127, 50 };
+                static const int m2ThreshLow[] = { 127, 40 };
+                static const int m1Thresh[] = { 127, 0x4d };
+                static const int m2Thresh[] = { 127, 0x40 };
+                static const int m2CountThr[] = { 31, 16 };
+                static const int m2CountThrLow[] = { 63, 48 };
                 u32 on = param ? 1 : 0;
 
                 REG_RMW_FIELD(ah, AR_PHY_SFCORR_LOW,
@@ -1141,7 +1143,7 @@ static bool ar5008_hw_ani_control_old(struct ath_hw *ah,
                 break;
         }
         case ATH9K_ANI_CCK_WEAK_SIGNAL_THR:{
-                const int weakSigThrCck[] = { 8, 6 };
+                static const int weakSigThrCck[] = { 8, 6 };
                 u32 high = param ? 1 : 0;
 
                 REG_RMW_FIELD(ah, AR_PHY_CCK_DETECT,
@@ -1157,7 +1159,7 @@ static bool ar5008_hw_ani_control_old(struct ath_hw *ah,
                 break;
         }
         case ATH9K_ANI_FIRSTEP_LEVEL:{
-                const int firstep[] = { 0, 4, 8 };
+                static const int firstep[] = { 0, 4, 8 };
                 u32 level = param;
 
                 if (level >= ARRAY_SIZE(firstep)) {
@@ -1178,7 +1180,7 @@ static bool ar5008_hw_ani_control_old(struct ath_hw *ah,
                 break;
         }
         case ATH9K_ANI_SPUR_IMMUNITY_LEVEL:{
-                const int cycpwrThr1[] = { 2, 4, 6, 8, 10, 12, 14, 16 };
+                static const int cycpwrThr1[] = { 2, 4, 6, 8, 10, 12, 14, 16 };
                 u32 level = param;
 
                 if (level >= ARRAY_SIZE(cycpwrThr1)) {
@@ -1490,25 +1492,25 @@ static void ar5008_hw_do_getnf(struct ath_hw *ah,
         int16_t nf;
 
         nf = MS(REG_READ(ah, AR_PHY_CCA), AR_PHY_MINCCA_PWR);
-        nfarray[0] = sign_extend(nf, 9);
+        nfarray[0] = sign_extend32(nf, 8);
 
         nf = MS(REG_READ(ah, AR_PHY_CH1_CCA), AR_PHY_CH1_MINCCA_PWR);
-        nfarray[1] = sign_extend(nf, 9);
+        nfarray[1] = sign_extend32(nf, 8);
 
         nf = MS(REG_READ(ah, AR_PHY_CH2_CCA), AR_PHY_CH2_MINCCA_PWR);
-        nfarray[2] = sign_extend(nf, 9);
+        nfarray[2] = sign_extend32(nf, 8);
 
         if (!IS_CHAN_HT40(ah->curchan))
                 return;
 
         nf = MS(REG_READ(ah, AR_PHY_EXT_CCA), AR_PHY_EXT_MINCCA_PWR);
-        nfarray[3] = sign_extend(nf, 9);
+        nfarray[3] = sign_extend32(nf, 8);
 
         nf = MS(REG_READ(ah, AR_PHY_CH1_EXT_CCA), AR_PHY_CH1_EXT_MINCCA_PWR);
-        nfarray[4] = sign_extend(nf, 9);
+        nfarray[4] = sign_extend32(nf, 8);
 
         nf = MS(REG_READ(ah, AR_PHY_CH2_EXT_CCA), AR_PHY_CH2_EXT_MINCCA_PWR);
-        nfarray[5] = sign_extend(nf, 9);
+        nfarray[5] = sign_extend32(nf, 8);
 }
 
 /*
@@ -1579,10 +1581,55 @@ static void ar5008_hw_set_nf_limits(struct ath_hw *ah)
         ah->nf_5g.nominal = AR_PHY_CCA_NOM_VAL_5416_5GHZ;
 }
 
+static void ar5008_hw_set_radar_params(struct ath_hw *ah,
+                                       struct ath_hw_radar_conf *conf)
+{
+        u32 radar_0 = 0, radar_1 = 0;
+
+        if (!conf) {
+                REG_CLR_BIT(ah, AR_PHY_RADAR_0, AR_PHY_RADAR_0_ENA);
+                return;
+        }
+
+        radar_0 |= AR_PHY_RADAR_0_ENA | AR_PHY_RADAR_0_FFT_ENA;
+        radar_0 |= SM(conf->fir_power, AR_PHY_RADAR_0_FIRPWR);
+        radar_0 |= SM(conf->radar_rssi, AR_PHY_RADAR_0_RRSSI);
+        radar_0 |= SM(conf->pulse_height, AR_PHY_RADAR_0_HEIGHT);
+        radar_0 |= SM(conf->pulse_rssi, AR_PHY_RADAR_0_PRSSI);
+        radar_0 |= SM(conf->pulse_inband, AR_PHY_RADAR_0_INBAND);
+
+        radar_1 |= AR_PHY_RADAR_1_MAX_RRSSI;
+        radar_1 |= AR_PHY_RADAR_1_BLOCK_CHECK;
+        radar_1 |= SM(conf->pulse_maxlen, AR_PHY_RADAR_1_MAXLEN);
+        radar_1 |= SM(conf->pulse_inband_step, AR_PHY_RADAR_1_RELSTEP_THRESH);
+        radar_1 |= SM(conf->radar_inband, AR_PHY_RADAR_1_RELPWR_THRESH);
+
+        REG_WRITE(ah, AR_PHY_RADAR_0, radar_0);
+        REG_WRITE(ah, AR_PHY_RADAR_1, radar_1);
+        if (conf->ext_channel)
+                REG_SET_BIT(ah, AR_PHY_RADAR_EXT, AR_PHY_RADAR_EXT_ENA);
+        else
+                REG_CLR_BIT(ah, AR_PHY_RADAR_EXT, AR_PHY_RADAR_EXT_ENA);
+}
+
+static void ar5008_hw_set_radar_conf(struct ath_hw *ah)
+{
+        struct ath_hw_radar_conf *conf = &ah->radar_conf;
+
+        conf->fir_power = -33;
+        conf->radar_rssi = 20;
+        conf->pulse_height = 10;
+        conf->pulse_rssi = 24;
+        conf->pulse_inband = 15;
+        conf->pulse_maxlen = 255;
+        conf->pulse_inband_step = 12;
+        conf->radar_inband = 8;
+}
+
 void ar5008_hw_attach_phy_ops(struct ath_hw *ah)
 {
         struct ath_hw_private_ops *priv_ops = ath9k_hw_private_ops(ah);
-        const u32 ar5416_cca_regs[6] = {
+        static const u32 ar5416_cca_regs[6] = {
                 AR_PHY_CCA,
                 AR_PHY_CH1_CCA,
                 AR_PHY_CH2_CCA,
@@ -1609,6 +1656,7 @@ void ar5008_hw_attach_phy_ops(struct ath_hw *ah)
         priv_ops->restore_chainmask = ar5008_restore_chainmask;
         priv_ops->set_diversity = ar5008_set_diversity;
         priv_ops->do_getnf = ar5008_hw_do_getnf;
+        priv_ops->set_radar_params = ar5008_hw_set_radar_params;
 
         if (modparam_force_new_ani) {
                 priv_ops->ani_control = ar5008_hw_ani_control_new;
@@ -1624,5 +1672,6 @@ void ar5008_hw_attach_phy_ops(struct ath_hw *ah)
                 priv_ops->compute_pll_control = ar5008_hw_compute_pll_control;
 
         ar5008_hw_set_nf_limits(ah);
+        ar5008_hw_set_radar_conf(ah);
         memcpy(ah->nf_regs, ar5416_cca_regs, sizeof(ah->nf_regs));
 }
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_mac.c b/drivers/net/wireless/ath/ath9k/ar9002_mac.c
index 50dda394f8b..f0268e5eab3 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_mac.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_mac.c
@@ -90,13 +90,10 @@ static bool ar9002_hw_get_isr(struct ath_hw *ah, enum ath9k_int *masked)
 
                 *masked = isr & ATH9K_INT_COMMON;
 
-                if (ah->config.rx_intr_mitigation) {
-                        if (isr & (AR_ISR_RXMINTR | AR_ISR_RXINTM))
-                                *masked |= ATH9K_INT_RX;
-                }
-
-                if (isr & (AR_ISR_RXOK | AR_ISR_RXERR))
+                if (isr & (AR_ISR_RXMINTR | AR_ISR_RXINTM |
+                           AR_ISR_RXOK | AR_ISR_RXERR))
                         *masked |= ATH9K_INT_RX;
+
                 if (isr &
                     (AR_ISR_TXOK | AR_ISR_TXDESC | AR_ISR_TXERR |
                      AR_ISR_TXEOL)) {
@@ -118,14 +115,6 @@ static bool ar9002_hw_get_isr(struct ath_hw *ah, enum ath9k_int *masked)
                                   "receive FIFO overrun interrupt\n");
                 }
 
-                if (!AR_SREV_9100(ah)) {
-                        if (!(pCap->hw_caps & ATH9K_HW_CAP_AUTOSLEEP)) {
-                                u32 isr5 = REG_READ(ah, AR_ISR_S5_S);
-                                if (isr5 & AR_ISR_S5_TIM_TIMER)
-                                        *masked |= ATH9K_INT_TIM_TIMER;
-                        }
-                }
-
                 *masked |= mask2;
         }
 
@@ -136,17 +125,18 @@ static bool ar9002_hw_get_isr(struct ath_hw *ah, enum ath9k_int *masked)
                 u32 s5_s;
 
                 s5_s = REG_READ(ah, AR_ISR_S5_S);
-                if (isr & AR_ISR_GENTMR) {
-                        ah->intr_gen_timer_trigger =
+                ah->intr_gen_timer_trigger =
                                 MS(s5_s, AR_ISR_S5_GENTIMER_TRIG);
 
-                        ah->intr_gen_timer_thresh =
-                                MS(s5_s, AR_ISR_S5_GENTIMER_THRESH);
+                ah->intr_gen_timer_thresh =
+                        MS(s5_s, AR_ISR_S5_GENTIMER_THRESH);
 
-                        if (ah->intr_gen_timer_trigger)
-                                *masked |= ATH9K_INT_GENTIMER;
+                if (ah->intr_gen_timer_trigger)
+                        *masked |= ATH9K_INT_GENTIMER;
 
-                }
+                if ((s5_s & AR_ISR_S5_TIM_TIMER) &&
+                    !(pCap->hw_caps & ATH9K_HW_CAP_AUTOSLEEP))
+                        *masked |= ATH9K_INT_TIM_TIMER;
         }
 
         if (sync_cause) {
@@ -218,77 +208,70 @@ static int ar9002_hw_proc_txdesc(struct ath_hw *ah, void *ds,
                                  struct ath_tx_status *ts)
 {
         struct ar5416_desc *ads = AR5416DESC(ds);
+        u32 status;
 
-        if ((ads->ds_txstatus9 & AR_TxDone) == 0)
+        status = ACCESS_ONCE(ads->ds_txstatus9);
+        if ((status & AR_TxDone) == 0)
                 return -EINPROGRESS;
 
-        ts->ts_seqnum = MS(ads->ds_txstatus9, AR_SeqNum);
         ts->ts_tstamp = ads->AR_SendTimestamp;
         ts->ts_status = 0;
         ts->ts_flags = 0;
 
-        if (ads->ds_txstatus1 & AR_FrmXmitOK)
+        if (status & AR_TxOpExceeded)
+                ts->ts_status |= ATH9K_TXERR_XTXOP;
+        ts->tid = MS(status, AR_TxTid);
+        ts->ts_rateindex = MS(status, AR_FinalTxIdx);
+        ts->ts_seqnum = MS(status, AR_SeqNum);
+
+        status = ACCESS_ONCE(ads->ds_txstatus0);
+        ts->ts_rssi_ctl0 = MS(status, AR_TxRSSIAnt00);
+        ts->ts_rssi_ctl1 = MS(status, AR_TxRSSIAnt01);
+        ts->ts_rssi_ctl2 = MS(status, AR_TxRSSIAnt02);
+        if (status & AR_TxBaStatus) {
+                ts->ts_flags |= ATH9K_TX_BA;
+                ts->ba_low = ads->AR_BaBitmapLow;
+                ts->ba_high = ads->AR_BaBitmapHigh;
+        }
+
+        status = ACCESS_ONCE(ads->ds_txstatus1);
+        if (status & AR_FrmXmitOK)
                 ts->ts_status |= ATH9K_TX_ACKED;
-        if (ads->ds_txstatus1 & AR_ExcessiveRetries)
-                ts->ts_status |= ATH9K_TXERR_XRETRY;
-        if (ads->ds_txstatus1 & AR_Filtered)
-                ts->ts_status |= ATH9K_TXERR_FILT;
-        if (ads->ds_txstatus1 & AR_FIFOUnderrun) {
-                ts->ts_status |= ATH9K_TXERR_FIFO;
-                ath9k_hw_updatetxtriglevel(ah, true);
+        else {
+                if (status & AR_ExcessiveRetries)
+                        ts->ts_status |= ATH9K_TXERR_XRETRY;
+                if (status & AR_Filtered)
+                        ts->ts_status |= ATH9K_TXERR_FILT;
+                if (status & AR_FIFOUnderrun) {
+                        ts->ts_status |= ATH9K_TXERR_FIFO;
+                        ath9k_hw_updatetxtriglevel(ah, true);
+                }
         }
-        if (ads->ds_txstatus9 & AR_TxOpExceeded)
-                ts->ts_status |= ATH9K_TXERR_XTXOP;
-        if (ads->ds_txstatus1 & AR_TxTimerExpired)
+        if (status & AR_TxTimerExpired)
                 ts->ts_status |= ATH9K_TXERR_TIMER_EXPIRED;
-
-        if (ads->ds_txstatus1 & AR_DescCfgErr)
+        if (status & AR_DescCfgErr)
                 ts->ts_flags |= ATH9K_TX_DESC_CFG_ERR;
-        if (ads->ds_txstatus1 & AR_TxDataUnderrun) {
+        if (status & AR_TxDataUnderrun) {
                 ts->ts_flags |= ATH9K_TX_DATA_UNDERRUN;
                 ath9k_hw_updatetxtriglevel(ah, true);
         }
-        if (ads->ds_txstatus1 & AR_TxDelimUnderrun) {
+        if (status & AR_TxDelimUnderrun) {
                 ts->ts_flags |= ATH9K_TX_DELIM_UNDERRUN;
                 ath9k_hw_updatetxtriglevel(ah, true);
         }
-        if (ads->ds_txstatus0 & AR_TxBaStatus) {
-                ts->ts_flags |= ATH9K_TX_BA;
-                ts->ba_low = ads->AR_BaBitmapLow;
-                ts->ba_high = ads->AR_BaBitmapHigh;
-        }
+        ts->ts_shortretry = MS(status, AR_RTSFailCnt);
+        ts->ts_longretry = MS(status, AR_DataFailCnt);
+        ts->ts_virtcol = MS(status, AR_VirtRetryCnt);
 
-        ts->ts_rateindex = MS(ads->ds_txstatus9, AR_FinalTxIdx);
-        switch (ts->ts_rateindex) {
-        case 0:
-                ts->ts_ratecode = MS(ads->ds_ctl3, AR_XmitRate0);
-                break;
-        case 1:
-                ts->ts_ratecode = MS(ads->ds_ctl3, AR_XmitRate1);
-                break;
-        case 2:
-                ts->ts_ratecode = MS(ads->ds_ctl3, AR_XmitRate2);
-                break;
-        case 3:
-                ts->ts_ratecode = MS(ads->ds_ctl3, AR_XmitRate3);
-                break;
-        }
+        status = ACCESS_ONCE(ads->ds_txstatus5);
+        ts->ts_rssi = MS(status, AR_TxRSSICombined);
+        ts->ts_rssi_ext0 = MS(status, AR_TxRSSIAnt10);
+        ts->ts_rssi_ext1 = MS(status, AR_TxRSSIAnt11);
+        ts->ts_rssi_ext2 = MS(status, AR_TxRSSIAnt12);
 
-        ts->ts_rssi = MS(ads->ds_txstatus5, AR_TxRSSICombined);
-        ts->ts_rssi_ctl0 = MS(ads->ds_txstatus0, AR_TxRSSIAnt00);
-        ts->ts_rssi_ctl1 = MS(ads->ds_txstatus0, AR_TxRSSIAnt01);
-        ts->ts_rssi_ctl2 = MS(ads->ds_txstatus0, AR_TxRSSIAnt02);
-        ts->ts_rssi_ext0 = MS(ads->ds_txstatus5, AR_TxRSSIAnt10);
-        ts->ts_rssi_ext1 = MS(ads->ds_txstatus5, AR_TxRSSIAnt11);
-        ts->ts_rssi_ext2 = MS(ads->ds_txstatus5, AR_TxRSSIAnt12);
         ts->evm0 = ads->AR_TxEVM0;
         ts->evm1 = ads->AR_TxEVM1;
         ts->evm2 = ads->AR_TxEVM2;
-        ts->ts_shortretry = MS(ads->ds_txstatus1, AR_RTSFailCnt);
-        ts->ts_longretry = MS(ads->ds_txstatus1, AR_DataFailCnt);
-        ts->ts_virtcol = MS(ads->ds_txstatus1, AR_VirtRetryCnt);
-        ts->tid = MS(ads->ds_txstatus9, AR_TxTid);
-        ts->ts_antenna = 0;
 
         return 0;
 }
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_phy.c b/drivers/net/wireless/ath/ath9k/ar9002_phy.c
index c00cdc67b55..7ae66a889f5 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_phy.c
@@ -175,13 +175,15 @@ static void ar9002_hw_spur_mitigate(struct ath_hw *ah,
         int upper, lower, cur_vit_mask;
         int tmp, newVal;
         int i;
-        int pilot_mask_reg[4] = { AR_PHY_TIMING7, AR_PHY_TIMING8,
-                          AR_PHY_PILOT_MASK_01_30, AR_PHY_PILOT_MASK_31_60
+        static const int pilot_mask_reg[4] = {
+                AR_PHY_TIMING7, AR_PHY_TIMING8,
+                AR_PHY_PILOT_MASK_01_30, AR_PHY_PILOT_MASK_31_60
         };
-        int chan_mask_reg[4] = { AR_PHY_TIMING9, AR_PHY_TIMING10,
-                         AR_PHY_CHANNEL_MASK_01_30, AR_PHY_CHANNEL_MASK_31_60
+        static const int chan_mask_reg[4] = {
+                AR_PHY_TIMING9, AR_PHY_TIMING10,
+                AR_PHY_CHANNEL_MASK_01_30, AR_PHY_CHANNEL_MASK_31_60
         };
-        int inc[4] = { 0, 100, 0, 0 };
+        static const int inc[4] = { 0, 100, 0, 0 };
         struct chan_centers centers;
 
         int8_t mask_m[123];
@@ -473,21 +475,21 @@ static void ar9002_hw_do_getnf(struct ath_hw *ah,
         int16_t nf;
 
         nf = MS(REG_READ(ah, AR_PHY_CCA), AR9280_PHY_MINCCA_PWR);
-        nfarray[0] = sign_extend(nf, 9);
+        nfarray[0] = sign_extend32(nf, 8);
 
         nf = MS(REG_READ(ah, AR_PHY_EXT_CCA), AR9280_PHY_EXT_MINCCA_PWR);
         if (IS_CHAN_HT40(ah->curchan))
-                nfarray[3] = sign_extend(nf, 9);
+                nfarray[3] = sign_extend32(nf, 8);
 
         if (AR_SREV_9285(ah) || AR_SREV_9271(ah))
                 return;
 
         nf = MS(REG_READ(ah, AR_PHY_CH1_CCA), AR9280_PHY_CH1_MINCCA_PWR);
-        nfarray[1] = sign_extend(nf, 9);
+        nfarray[1] = sign_extend32(nf, 8);
 
         nf = MS(REG_READ(ah, AR_PHY_CH1_EXT_CCA), AR9280_PHY_CH1_EXT_MINCCA_PWR);
         if (IS_CHAN_HT40(ah->curchan))
-                nfarray[4] = sign_extend(nf, 9);
+                nfarray[4] = sign_extend32(nf, 8);
 }
 
 static void ar9002_hw_set_nf_limits(struct ath_hw *ah)
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_calib.c b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
index 9e6edffe0bd..4c94c9ed5f8 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
@@ -196,7 +196,7 @@ static void ar9003_hw_iqcalibrate(struct ath_hw *ah, u8 numChains)
         u32 qCoffDenom, iCoffDenom;
         int32_t qCoff, iCoff;
         int iqCorrNeg, i;
-        const u_int32_t offset_array[3] = {
+        static const u_int32_t offset_array[3] = {
                 AR_PHY_RX_IQCAL_CORR_B0,
                 AR_PHY_RX_IQCAL_CORR_B1,
                 AR_PHY_RX_IQCAL_CORR_B2,
@@ -603,22 +603,22 @@ static bool ar9003_hw_calc_iq_corr(struct ath_hw *ah,
 static void ar9003_hw_tx_iq_cal(struct ath_hw *ah)
 {
         struct ath_common *common = ath9k_hw_common(ah);
-        const u32 txiqcal_status[AR9300_MAX_CHAINS] = {
+        static const u32 txiqcal_status[AR9300_MAX_CHAINS] = {
                 AR_PHY_TX_IQCAL_STATUS_B0,
                 AR_PHY_TX_IQCAL_STATUS_B1,
                 AR_PHY_TX_IQCAL_STATUS_B2,
         };
-        const u32 tx_corr_coeff[AR9300_MAX_CHAINS] = {
+        static const u32 tx_corr_coeff[AR9300_MAX_CHAINS] = {
                 AR_PHY_TX_IQCAL_CORR_COEFF_01_B0,
                 AR_PHY_TX_IQCAL_CORR_COEFF_01_B1,
                 AR_PHY_TX_IQCAL_CORR_COEFF_01_B2,
         };
-        const u32 rx_corr[AR9300_MAX_CHAINS] = {
+        static const u32 rx_corr[AR9300_MAX_CHAINS] = {
                 AR_PHY_RX_IQCAL_CORR_B0,
                 AR_PHY_RX_IQCAL_CORR_B1,
                 AR_PHY_RX_IQCAL_CORR_B2,
         };
-        const u_int32_t chan_info_tab[] = {
+        static const u_int32_t chan_info_tab[] = {
                 AR_PHY_CHAN_INFO_TAB_0,
                 AR_PHY_CHAN_INFO_TAB_1,
                 AR_PHY_CHAN_INFO_TAB_2,
@@ -718,12 +718,19 @@ static bool ar9003_hw_init_cal(struct ath_hw *ah,
                                struct ath9k_channel *chan)
 {
         struct ath_common *common = ath9k_hw_common(ah);
+        int val;
 
-        /*
-         * 0x7 = 0b111 , AR9003 needs to be configured for 3-chain mode before
-         * running AGC/TxIQ cals
-         */
-        ar9003_hw_set_chain_masks(ah, 0x7, 0x7);
+        val = REG_READ(ah, AR_ENT_OTP);
+        ath_print(common, ATH_DBG_CALIBRATE, "ath9k: AR_ENT_OTP 0x%x\n", val);
+
+        if (val & AR_ENT_OTP_CHAIN2_DISABLE)
+                ar9003_hw_set_chain_masks(ah, 0x3, 0x3);
+        else
+                /*
+                 * 0x7 = 0b111 , AR9003 needs to be configured for 3-chain
+                 * mode before running AGC/TxIQ cals
+                 */
+                ar9003_hw_set_chain_masks(ah, 0x7, 0x7);
 
         /* Do Tx IQ Calibration */
         ar9003_hw_tx_iq_cal(ah);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index a7b82f0085d..f2eec388693 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -22,12 +22,14 @@
 #define COMP_CKSUM_LEN 2
 
 #define AR_CH0_TOP (0x00016288)
-#define AR_CH0_TOP_XPABIASLVL (0x3)
+#define AR_CH0_TOP_XPABIASLVL (0x300)
 #define AR_CH0_TOP_XPABIASLVL_S (8)
 
 #define AR_CH0_THERM (0x00016290)
-#define AR_CH0_THERM_SPARE (0x3f)
-#define AR_CH0_THERM_SPARE_S (0)
+#define AR_CH0_THERM_XPABIASLVL_MSB 0x3
+#define AR_CH0_THERM_XPABIASLVL_MSB_S 0
+#define AR_CH0_THERM_XPASHORT2GND 0x4
+#define AR_CH0_THERM_XPASHORT2GND_S 2
 
 #define AR_SWITCH_TABLE_COM_ALL (0xffff)
 #define AR_SWITCH_TABLE_COM_ALL_S (0)
@@ -55,6 +57,9 @@
 #define SUB_NUM_CTL_MODES_AT_5G_40 2    /* excluding HT40, EXT-OFDM */
 #define SUB_NUM_CTL_MODES_AT_2G_40 3    /* excluding HT40, EXT-OFDM, EXT-CCK */
 
+static int ar9003_hw_power_interpolate(int32_t x,
+                                       int32_t *px, int32_t *py, u_int16_t np);
+
 #define CTL(_tpower, _flag) ((_tpower) | ((_flag) << 6))
 
 static const struct ar9300_eeprom ar9300_default = {
@@ -146,13 +151,16 @@ static const struct ar9300_eeprom ar9300_default = {
                 .txEndToRxOn = 0x2,
                 .txFrameToXpaOn = 0xe,
                 .thresh62 = 28,
-                .papdRateMaskHt20 = LE32(0x80c080),
-                .papdRateMaskHt40 = LE32(0x80c080),
+                .papdRateMaskHt20 = LE32(0x0cf0e0e0),
+                .papdRateMaskHt40 = LE32(0x6cf0e0e0),
                 .futureModal = {
-                        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-                        0, 0, 0, 0, 0, 0, 0, 0
+                        0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
                 },
          },
+        .base_ext1 = {
+                .ant_div_control = 0,
+                .future = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}
+        },
         .calFreqPier2G = {
                 FREQ2FBIN(2412, 1),
                 FREQ2FBIN(2437, 1),
@@ -287,8 +295,7 @@ static const struct ar9300_eeprom ar9300_default = {
                         /* Data[11].ctlEdges[0].bChannel */ FREQ2FBIN(2422, 1),
                         /* Data[11].ctlEdges[1].bChannel */ FREQ2FBIN(2427, 1),
                         /* Data[11].ctlEdges[2].bChannel */ FREQ2FBIN(2447, 1),
-                        /* Data[11].ctlEdges[3].bChannel */
-                        FREQ2FBIN(2462, 1),
+                        /* Data[11].ctlEdges[3].bChannel */ FREQ2FBIN(2462, 1),
                 }
          },
         .ctlPowerData_2G = {
@@ -346,13 +353,20 @@ static const struct ar9300_eeprom ar9300_default = {
                 .txEndToRxOn = 0x2,
                 .txFrameToXpaOn = 0xe,
                 .thresh62 = 28,
-                .papdRateMaskHt20 = LE32(0xf0e0e0),
-                .papdRateMaskHt40 = LE32(0xf0e0e0),
+                .papdRateMaskHt20 = LE32(0x0c80c080),
+                .papdRateMaskHt40 = LE32(0x0080c080),
                 .futureModal = {
-                        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-                        0, 0, 0, 0, 0, 0, 0, 0
+                        0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
                 },
          },
+        .base_ext2 = {
+                .tempSlopeLow = 0,
+                .tempSlopeHigh = 0,
+                .xatten1DBLow = {0, 0, 0},
+                .xatten1MarginLow = {0, 0, 0},
+                .xatten1DBHigh = {0, 0, 0},
+                .xatten1MarginHigh = {0, 0, 0}
+        },
         .calFreqPier5G = {
                 FREQ2FBIN(5180, 0),
                 FREQ2FBIN(5220, 0),
@@ -626,6 +640,2338 @@ static const struct ar9300_eeprom ar9300_default = {
          }
 };
 
+static const struct ar9300_eeprom ar9300_x113 = {
+        .eepromVersion = 2,
+        .templateVersion = 6,
+        .macAddr = {0x00, 0x03, 0x7f, 0x0, 0x0, 0x0},
+        .custData = {"x113-023-f0000"},
+        .baseEepHeader = {
+                .regDmn = { LE16(0), LE16(0x1f) },
+                .txrxMask =  0x77, /* 4 bits tx and 4 bits rx */
+                .opCapFlags = {
+                        .opFlags = AR9300_OPFLAGS_11G | AR9300_OPFLAGS_11A,
+                        .eepMisc = 0,
+                },
+                .rfSilent = 0,
+                .blueToothOptions = 0,
+                .deviceCap = 0,
+                .deviceType = 5, /* takes lower byte in eeprom location */
+                .pwrTableOffset = AR9300_PWR_TABLE_OFFSET,
+                .params_for_tuning_caps = {0, 0},
+                .featureEnable = 0x0d,
+                 /*
+                  * bit0 - enable tx temp comp - disabled
+                  * bit1 - enable tx volt comp - disabled
+                  * bit2 - enable fastClock - enabled
+                  * bit3 - enable doubling - enabled
+                  * bit4 - enable internal regulator - disabled
+                  * bit5 - enable pa predistortion - disabled
+                  */
+                .miscConfiguration = 0, /* bit0 - turn down drivestrength */
+                .eepromWriteEnableGpio = 6,
+                .wlanDisableGpio = 0,
+                .wlanLedGpio = 8,
+                .rxBandSelectGpio = 0xff,
+                .txrxgain = 0x21,
+                .swreg = 0,
+         },
+        .modalHeader2G = {
+        /* ar9300_modal_eep_header  2g */
+                /* 4 idle,t1,t2,b(4 bits per setting) */
+                .antCtrlCommon = LE32(0x110),
+                /* 4 ra1l1, ra2l1, ra1l2, ra2l2, ra12 */
+                .antCtrlCommon2 = LE32(0x44444),
+
+                /*
+                 * antCtrlChain[AR9300_MAX_CHAINS]; 6 idle, t, r,
+                 * rx1, rx12, b (2 bits each)
+                 */
+                .antCtrlChain = { LE16(0x150), LE16(0x150), LE16(0x150) },
+
+                /*
+                 * xatten1DB[AR9300_MAX_CHAINS];  3 xatten1_db
+                 * for ar9280 (0xa20c/b20c 5:0)
+                 */
+                .xatten1DB = {0, 0, 0},
+
+                /*
+                 * xatten1Margin[AR9300_MAX_CHAINS]; 3 xatten1_margin
+                 * for ar9280 (0xa20c/b20c 16:12
+                 */
+                .xatten1Margin = {0, 0, 0},
+                .tempSlope = 25,
+                .voltSlope = 0,
+
+                /*
+                 * spurChans[OSPREY_EEPROM_MODAL_SPURS]; spur
+                 * channels in usual fbin coding format
+                 */
+                .spurChans = {FREQ2FBIN(2464, 1), 0, 0, 0, 0},
+
+                /*
+                 * noiseFloorThreshCh[AR9300_MAX_CHAINS]; 3 Check
+                 * if the register is per chain
+                 */
+                .noiseFloorThreshCh = {-1, 0, 0},
+                .ob = {1, 1, 1},/* 3 chain */
+                .db_stage2 = {1, 1, 1}, /* 3 chain  */
+                .db_stage3 = {0, 0, 0},
+                .db_stage4 = {0, 0, 0},
+                .xpaBiasLvl = 0,
+                .txFrameToDataStart = 0x0e,
+                .txFrameToPaOn = 0x0e,
+                .txClip = 3, /* 4 bits tx_clip, 4 bits dac_scale_cck */
+                .antennaGain = 0,
+                .switchSettling = 0x2c,
+                .adcDesiredSize = -30,
+                .txEndToXpaOff = 0,
+                .txEndToRxOn = 0x2,
+                .txFrameToXpaOn = 0xe,
+                .thresh62 = 28,
+                .papdRateMaskHt20 = LE32(0x0c80c080),
+                .papdRateMaskHt40 = LE32(0x0080c080),
+                .futureModal = {
+                        0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+                },
+         },
+         .base_ext1 = {
+                .ant_div_control = 0,
+                .future = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}
+         },
+        .calFreqPier2G = {
+                FREQ2FBIN(2412, 1),
+                FREQ2FBIN(2437, 1),
+                FREQ2FBIN(2472, 1),
+         },
+        /* ar9300_cal_data_per_freq_op_loop 2g */
+        .calPierData2G = {
+                { {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0, 0} },
+                { {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0, 0} },
+                { {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0, 0} },
+         },
+        .calTarget_freqbin_Cck = {
+                FREQ2FBIN(2412, 1),
+                FREQ2FBIN(2472, 1),
+         },
+        .calTarget_freqbin_2G = {
+                FREQ2FBIN(2412, 1),
+                FREQ2FBIN(2437, 1),
+                FREQ2FBIN(2472, 1)
+         },
+        .calTarget_freqbin_2GHT20 = {
+                FREQ2FBIN(2412, 1),
+                FREQ2FBIN(2437, 1),
+                FREQ2FBIN(2472, 1)
+         },
+        .calTarget_freqbin_2GHT40 = {
+                FREQ2FBIN(2412, 1),
+                FREQ2FBIN(2437, 1),
+                FREQ2FBIN(2472, 1)
+         },
+        .calTargetPowerCck = {
+                 /* 1L-5L,5S,11L,11S */
+                 { {34, 34, 34, 34} },
+                 { {34, 34, 34, 34} },
+        },
+        .calTargetPower2G = {
+                 /* 6-24,36,48,54 */
+                 { {34, 34, 32, 32} },
+                 { {34, 34, 32, 32} },
+                 { {34, 34, 32, 32} },
+        },
+        .calTargetPower2GHT20 = {
+                { {32, 32, 32, 32, 32, 28, 32, 32, 30, 28, 0, 0, 0, 0} },
+                { {32, 32, 32, 32, 32, 28, 32, 32, 30, 28, 0, 0, 0, 0} },
+                { {32, 32, 32, 32, 32, 28, 32, 32, 30, 28, 0, 0, 0, 0} },
+        },
+        .calTargetPower2GHT40 = {
+                { {30, 30, 30, 30, 30, 28, 30, 30, 28, 26, 0, 0, 0, 0} },
+                { {30, 30, 30, 30, 30, 28, 30, 30, 28, 26, 0, 0, 0, 0} },
+                { {30, 30, 30, 30, 30, 28, 30, 30, 28, 26, 0, 0, 0, 0} },
+        },
+        .ctlIndex_2G =  {
+                0x11, 0x12, 0x15, 0x17, 0x41, 0x42,
+                0x45, 0x47, 0x31, 0x32, 0x35, 0x37,
+        },
+        .ctl_freqbin_2G = {
+                {
+                        FREQ2FBIN(2412, 1),
+                        FREQ2FBIN(2417, 1),
+                        FREQ2FBIN(2457, 1),
+                        FREQ2FBIN(2462, 1)
+                },
+                {
+                        FREQ2FBIN(2412, 1),
+                        FREQ2FBIN(2417, 1),
+                        FREQ2FBIN(2462, 1),
+                        0xFF,
+                },
+
+                {
+                        FREQ2FBIN(2412, 1),
+                        FREQ2FBIN(2417, 1),
+                        FREQ2FBIN(2462, 1),
+                        0xFF,
+                },
+                {
+                        FREQ2FBIN(2422, 1),
+                        FREQ2FBIN(2427, 1),
+                        FREQ2FBIN(2447, 1),
+                        FREQ2FBIN(2452, 1)
+                },
+
+                {
+                        /* Data[4].ctlEdges[0].bChannel */ FREQ2FBIN(2412, 1),
+                        /* Data[4].ctlEdges[1].bChannel */ FREQ2FBIN(2417, 1),
+                        /* Data[4].ctlEdges[2].bChannel */ FREQ2FBIN(2472, 1),
+                        /* Data[4].ctlEdges[3].bChannel */ FREQ2FBIN(2484, 1),
+                },
+
+                {
+                        /* Data[5].ctlEdges[0].bChannel */ FREQ2FBIN(2412, 1),
+                        /* Data[5].ctlEdges[1].bChannel */ FREQ2FBIN(2417, 1),
+                        /* Data[5].ctlEdges[2].bChannel */ FREQ2FBIN(2472, 1),
+                        0,
+                },
+
+                {
+                        /* Data[6].ctlEdges[0].bChannel */ FREQ2FBIN(2412, 1),
+                        /* Data[6].ctlEdges[1].bChannel */ FREQ2FBIN(2417, 1),
+                        FREQ2FBIN(2472, 1),
+                        0,
+                },
+
+                {
+                        /* Data[7].ctlEdges[0].bChannel */ FREQ2FBIN(2422, 1),
+                        /* Data[7].ctlEdges[1].bChannel */ FREQ2FBIN(2427, 1),
+                        /* Data[7].ctlEdges[2].bChannel */ FREQ2FBIN(2447, 1),
+                        /* Data[7].ctlEdges[3].bChannel */ FREQ2FBIN(2462, 1),
+                },
+
+                {
+                        /* Data[8].ctlEdges[0].bChannel */ FREQ2FBIN(2412, 1),
+                        /* Data[8].ctlEdges[1].bChannel */ FREQ2FBIN(2417, 1),
+                        /* Data[8].ctlEdges[2].bChannel */ FREQ2FBIN(2472, 1),
+                },
+
+                {
+                        /* Data[9].ctlEdges[0].bChannel */ FREQ2FBIN(2412, 1),
+                        /* Data[9].ctlEdges[1].bChannel */ FREQ2FBIN(2417, 1),
+                        /* Data[9].ctlEdges[2].bChannel */ FREQ2FBIN(2472, 1),
+                        0
+                },
+
+                {
+                        /* Data[10].ctlEdges[0].bChannel */ FREQ2FBIN(2412, 1),
+                        /* Data[10].ctlEdges[1].bChannel */ FREQ2FBIN(2417, 1),
+                        /* Data[10].ctlEdges[2].bChannel */ FREQ2FBIN(2472, 1),
+                        0
+                },
+
+                {
+                        /* Data[11].ctlEdges[0].bChannel */ FREQ2FBIN(2422, 1),
+                        /* Data[11].ctlEdges[1].bChannel */ FREQ2FBIN(2427, 1),
+                        /* Data[11].ctlEdges[2].bChannel */ FREQ2FBIN(2447, 1),
+                        /* Data[11].ctlEdges[3].bChannel */ FREQ2FBIN(2462, 1),
+                }
+         },
+        .ctlPowerData_2G = {
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                 { { CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 1) } },
+
+                 { { CTL(60, 1), CTL(60, 0), CTL(0, 0), CTL(0, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 1) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 1) } },
+         },
+        .modalHeader5G = {
+                /* 4 idle,t1,t2,b (4 bits per setting) */
+                .antCtrlCommon = LE32(0x220),
+                /* 4 ra1l1, ra2l1, ra1l2,ra2l2,ra12 */
+                .antCtrlCommon2 = LE32(0x11111),
+                 /* antCtrlChain 6 idle, t,r,rx1,rx12,b (2 bits each) */
+                .antCtrlChain = {
+                        LE16(0x150), LE16(0x150), LE16(0x150),
+                },
+                 /* xatten1DB 3 xatten1_db for AR9280 (0xa20c/b20c 5:0) */
+                .xatten1DB = {0, 0, 0},
+
+                /*
+                 * xatten1Margin[AR9300_MAX_CHAINS]; 3 xatten1_margin
+                 * for merlin (0xa20c/b20c 16:12
+                 */
+                .xatten1Margin = {0, 0, 0},
+                .tempSlope = 68,
+                .voltSlope = 0,
+                /* spurChans spur channels in usual fbin coding format */
+                .spurChans = {FREQ2FBIN(5500, 0), 0, 0, 0, 0},
+                /* noiseFloorThreshCh Check if the register is per chain */
+                .noiseFloorThreshCh = {-1, 0, 0},
+                .ob = {3, 3, 3}, /* 3 chain */
+                .db_stage2 = {3, 3, 3}, /* 3 chain */
+                .db_stage3 = {3, 3, 3}, /* doesn't exist for 2G */
+                .db_stage4 = {3, 3, 3},  /* don't exist for 2G */
+                .xpaBiasLvl = 0,
+                .txFrameToDataStart = 0x0e,
+                .txFrameToPaOn = 0x0e,
+                .txClip = 3, /* 4 bits tx_clip, 4 bits dac_scale_cck */
+                .antennaGain = 0,
+                .switchSettling = 0x2d,
+                .adcDesiredSize = -30,
+                .txEndToXpaOff = 0,
+                .txEndToRxOn = 0x2,
+                .txFrameToXpaOn = 0xe,
+                .thresh62 = 28,
+                .papdRateMaskHt20 = LE32(0x0cf0e0e0),
+                .papdRateMaskHt40 = LE32(0x6cf0e0e0),
+                .futureModal = {
+                        0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+                },
+         },
+        .base_ext2 = {
+                .tempSlopeLow = 72,
+                .tempSlopeHigh = 105,
+                .xatten1DBLow = {0, 0, 0},
+                .xatten1MarginLow = {0, 0, 0},
+                .xatten1DBHigh = {0, 0, 0},
+                .xatten1MarginHigh = {0, 0, 0}
+         },
+        .calFreqPier5G = {
+                FREQ2FBIN(5180, 0),
+                FREQ2FBIN(5240, 0),
+                FREQ2FBIN(5320, 0),
+                FREQ2FBIN(5400, 0),
+                FREQ2FBIN(5500, 0),
+                FREQ2FBIN(5600, 0),
+                FREQ2FBIN(5745, 0),
+                FREQ2FBIN(5785, 0)
+        },
+        .calPierData5G = {
+                        {
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                        },
+                        {
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                        },
+                        {
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                        },
+
+        },
+        .calTarget_freqbin_5G = {
+                FREQ2FBIN(5180, 0),
+                FREQ2FBIN(5220, 0),
+                FREQ2FBIN(5320, 0),
+                FREQ2FBIN(5400, 0),
+                FREQ2FBIN(5500, 0),
+                FREQ2FBIN(5600, 0),
+                FREQ2FBIN(5745, 0),
+                FREQ2FBIN(5785, 0)
+        },
+        .calTarget_freqbin_5GHT20 = {
+                FREQ2FBIN(5180, 0),
+                FREQ2FBIN(5240, 0),
+                FREQ2FBIN(5320, 0),
+                FREQ2FBIN(5400, 0),
+                FREQ2FBIN(5500, 0),
+                FREQ2FBIN(5700, 0),
+                FREQ2FBIN(5745, 0),
+                FREQ2FBIN(5825, 0)
+        },
+        .calTarget_freqbin_5GHT40 = {
+                FREQ2FBIN(5190, 0),
+                FREQ2FBIN(5230, 0),
+                FREQ2FBIN(5320, 0),
+                FREQ2FBIN(5410, 0),
+                FREQ2FBIN(5510, 0),
+                FREQ2FBIN(5670, 0),
+                FREQ2FBIN(5755, 0),
+                FREQ2FBIN(5825, 0)
+         },
+        .calTargetPower5G = {
+                /* 6-24,36,48,54 */
+                { {42, 40, 40, 34} },
+                { {42, 40, 40, 34} },
+                { {42, 40, 40, 34} },
+                { {42, 40, 40, 34} },
+                { {42, 40, 40, 34} },
+                { {42, 40, 40, 34} },
+                { {42, 40, 40, 34} },
+                { {42, 40, 40, 34} },
+         },
+        .calTargetPower5GHT20 = {
+                /*
+                 * 0_8_16,1-3_9-11_17-19,
+                 * 4,5,6,7,12,13,14,15,20,21,22,23
+                 */
+                { {40, 40, 40, 40, 32, 28, 40, 40, 32, 28, 40, 40, 32, 20} },
+                { {40, 40, 40, 40, 32, 28, 40, 40, 32, 28, 40, 40, 32, 20} },
+                { {40, 40, 40, 40, 32, 28, 40, 40, 32, 28, 40, 40, 32, 20} },
+                { {40, 40, 40, 40, 32, 28, 40, 40, 32, 28, 40, 40, 32, 20} },
+                { {40, 40, 40, 40, 32, 28, 40, 40, 32, 28, 40, 40, 32, 20} },
+                { {40, 40, 40, 40, 32, 28, 40, 40, 32, 28, 40, 40, 32, 20} },
+                { {38, 38, 38, 38, 32, 28, 38, 38, 32, 28, 38, 38, 32, 26} },
+                { {36, 36, 36, 36, 32, 28, 36, 36, 32, 28, 36, 36, 32, 26} },
+         },
+        .calTargetPower5GHT40 =  {
+                /*
+                 * 0_8_16,1-3_9-11_17-19,
+                 * 4,5,6,7,12,13,14,15,20,21,22,23
+                 */
+                { {40, 40, 40, 38, 30, 26, 40, 40, 30, 26, 40, 40, 30, 24} },
+                { {40, 40, 40, 38, 30, 26, 40, 40, 30, 26, 40, 40, 30, 24} },
+                { {40, 40, 40, 38, 30, 26, 40, 40, 30, 26, 40, 40, 30, 24} },
+                { {40, 40, 40, 38, 30, 26, 40, 40, 30, 26, 40, 40, 30, 24} },
+                { {40, 40, 40, 38, 30, 26, 40, 40, 30, 26, 40, 40, 30, 24} },
+                { {40, 40, 40, 38, 30, 26, 40, 40, 30, 26, 40, 40, 30, 24} },
+                { {36, 36, 36, 36, 30, 26, 36, 36, 30, 26, 36, 36, 30, 24} },
+                { {34, 34, 34, 34, 30, 26, 34, 34, 30, 26, 34, 34, 30, 24} },
+         },
+        .ctlIndex_5G =  {
+                0x10, 0x16, 0x18, 0x40, 0x46,
+                0x48, 0x30, 0x36, 0x38
+        },
+        .ctl_freqbin_5G =  {
+                {
+                        /* Data[0].ctlEdges[0].bChannel */ FREQ2FBIN(5180, 0),
+                        /* Data[0].ctlEdges[1].bChannel */ FREQ2FBIN(5260, 0),
+                        /* Data[0].ctlEdges[2].bChannel */ FREQ2FBIN(5280, 0),
+                        /* Data[0].ctlEdges[3].bChannel */ FREQ2FBIN(5500, 0),
+                        /* Data[0].ctlEdges[4].bChannel */ FREQ2FBIN(5600, 0),
+                        /* Data[0].ctlEdges[5].bChannel */ FREQ2FBIN(5700, 0),
+                        /* Data[0].ctlEdges[6].bChannel */ FREQ2FBIN(5745, 0),
+                        /* Data[0].ctlEdges[7].bChannel */ FREQ2FBIN(5825, 0)
+                },
+                {
+                        /* Data[1].ctlEdges[0].bChannel */ FREQ2FBIN(5180, 0),
+                        /* Data[1].ctlEdges[1].bChannel */ FREQ2FBIN(5260, 0),
+                        /* Data[1].ctlEdges[2].bChannel */ FREQ2FBIN(5280, 0),
+                        /* Data[1].ctlEdges[3].bChannel */ FREQ2FBIN(5500, 0),
+                        /* Data[1].ctlEdges[4].bChannel */ FREQ2FBIN(5520, 0),
+                        /* Data[1].ctlEdges[5].bChannel */ FREQ2FBIN(5700, 0),
+                        /* Data[1].ctlEdges[6].bChannel */ FREQ2FBIN(5745, 0),
+                        /* Data[1].ctlEdges[7].bChannel */ FREQ2FBIN(5825, 0)
+                },
+
+                {
+                        /* Data[2].ctlEdges[0].bChannel */ FREQ2FBIN(5190, 0),
+                        /* Data[2].ctlEdges[1].bChannel */ FREQ2FBIN(5230, 0),
+                        /* Data[2].ctlEdges[2].bChannel */ FREQ2FBIN(5270, 0),
+                        /* Data[2].ctlEdges[3].bChannel */ FREQ2FBIN(5310, 0),
+                        /* Data[2].ctlEdges[4].bChannel */ FREQ2FBIN(5510, 0),
+                        /* Data[2].ctlEdges[5].bChannel */ FREQ2FBIN(5550, 0),
+                        /* Data[2].ctlEdges[6].bChannel */ FREQ2FBIN(5670, 0),
+                        /* Data[2].ctlEdges[7].bChannel */ FREQ2FBIN(5755, 0)
+                },
+
+                {
+                        /* Data[3].ctlEdges[0].bChannel */ FREQ2FBIN(5180, 0),
+                        /* Data[3].ctlEdges[1].bChannel */ FREQ2FBIN(5200, 0),
+                        /* Data[3].ctlEdges[2].bChannel */ FREQ2FBIN(5260, 0),
+                        /* Data[3].ctlEdges[3].bChannel */ FREQ2FBIN(5320, 0),
+                        /* Data[3].ctlEdges[4].bChannel */ FREQ2FBIN(5500, 0),
+                        /* Data[3].ctlEdges[5].bChannel */ FREQ2FBIN(5700, 0),
+                        /* Data[3].ctlEdges[6].bChannel */ 0xFF,
+                        /* Data[3].ctlEdges[7].bChannel */ 0xFF,
+                },
+
+                {
+                        /* Data[4].ctlEdges[0].bChannel */ FREQ2FBIN(5180, 0),
+                        /* Data[4].ctlEdges[1].bChannel */ FREQ2FBIN(5260, 0),
+                        /* Data[4].ctlEdges[2].bChannel */ FREQ2FBIN(5500, 0),
+                        /* Data[4].ctlEdges[3].bChannel */ FREQ2FBIN(5700, 0),
+                        /* Data[4].ctlEdges[4].bChannel */ 0xFF,
+                        /* Data[4].ctlEdges[5].bChannel */ 0xFF,
+                        /* Data[4].ctlEdges[6].bChannel */ 0xFF,
+                        /* Data[4].ctlEdges[7].bChannel */ 0xFF,
+                },
+
+                {
+                        /* Data[5].ctlEdges[0].bChannel */ FREQ2FBIN(5190, 0),
+                        /* Data[5].ctlEdges[1].bChannel */ FREQ2FBIN(5270, 0),
+                        /* Data[5].ctlEdges[2].bChannel */ FREQ2FBIN(5310, 0),
+                        /* Data[5].ctlEdges[3].bChannel */ FREQ2FBIN(5510, 0),
+                        /* Data[5].ctlEdges[4].bChannel */ FREQ2FBIN(5590, 0),
+                        /* Data[5].ctlEdges[5].bChannel */ FREQ2FBIN(5670, 0),
+                        /* Data[5].ctlEdges[6].bChannel */ 0xFF,
+                        /* Data[5].ctlEdges[7].bChannel */ 0xFF
+                },
+
+                {
+                        /* Data[6].ctlEdges[0].bChannel */ FREQ2FBIN(5180, 0),
+                        /* Data[6].ctlEdges[1].bChannel */ FREQ2FBIN(5200, 0),
+                        /* Data[6].ctlEdges[2].bChannel */ FREQ2FBIN(5220, 0),
+                        /* Data[6].ctlEdges[3].bChannel */ FREQ2FBIN(5260, 0),
+                        /* Data[6].ctlEdges[4].bChannel */ FREQ2FBIN(5500, 0),
+                        /* Data[6].ctlEdges[5].bChannel */ FREQ2FBIN(5600, 0),
+                        /* Data[6].ctlEdges[6].bChannel */ FREQ2FBIN(5700, 0),
+                        /* Data[6].ctlEdges[7].bChannel */ FREQ2FBIN(5745, 0)
+                },
+
+                {
+                        /* Data[7].ctlEdges[0].bChannel */ FREQ2FBIN(5180, 0),
+                        /* Data[7].ctlEdges[1].bChannel */ FREQ2FBIN(5260, 0),
+                        /* Data[7].ctlEdges[2].bChannel */ FREQ2FBIN(5320, 0),
+                        /* Data[7].ctlEdges[3].bChannel */ FREQ2FBIN(5500, 0),
+                        /* Data[7].ctlEdges[4].bChannel */ FREQ2FBIN(5560, 0),
+                        /* Data[7].ctlEdges[5].bChannel */ FREQ2FBIN(5700, 0),
+                        /* Data[7].ctlEdges[6].bChannel */ FREQ2FBIN(5745, 0),
+                        /* Data[7].ctlEdges[7].bChannel */ FREQ2FBIN(5825, 0)
+                },
+
+                {
+                        /* Data[8].ctlEdges[0].bChannel */ FREQ2FBIN(5190, 0),
+                        /* Data[8].ctlEdges[1].bChannel */ FREQ2FBIN(5230, 0),
+                        /* Data[8].ctlEdges[2].bChannel */ FREQ2FBIN(5270, 0),
+                        /* Data[8].ctlEdges[3].bChannel */ FREQ2FBIN(5510, 0),
+                        /* Data[8].ctlEdges[4].bChannel */ FREQ2FBIN(5550, 0),
+                        /* Data[8].ctlEdges[5].bChannel */ FREQ2FBIN(5670, 0),
+                        /* Data[8].ctlEdges[6].bChannel */ FREQ2FBIN(5755, 0),
+                        /* Data[8].ctlEdges[7].bChannel */ FREQ2FBIN(5795, 0)
+                }
+         },
+        .ctlPowerData_5G = {
+                {
+                        {
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
+                        }
+                },
+                {
+                        {
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
+                        }
+                },
+                {
+                        {
+                                CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                        }
+                },
+                {
+                        {
+                                CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 0),
+                                CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 0),
+                        }
+                },
+                {
+                        {
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
+                                CTL(60, 0), CTL(60, 0), CTL(60, 0), CTL(60, 0),
+                        }
+                },
+                {
+                        {
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 0),
+                        }
+                },
+                {
+                        {
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                        }
+                },
+                {
+                        {
+                                CTL(60, 1), CTL(60, 1), CTL(60, 0), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
+                        }
+                },
+                {
+                        {
+                                CTL(60, 1), CTL(60, 0), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 0), CTL(60, 1),
+                        }
+                },
+         }
+};
+
+
+static const struct ar9300_eeprom ar9300_h112 = {
+        .eepromVersion = 2,
+        .templateVersion = 3,
+        .macAddr = {0x00, 0x03, 0x7f, 0x0, 0x0, 0x0},
+        .custData = {"h112-241-f0000"},
+        .baseEepHeader = {
+                .regDmn = { LE16(0), LE16(0x1f) },
+                .txrxMask =  0x77, /* 4 bits tx and 4 bits rx */
+                .opCapFlags = {
+                        .opFlags = AR9300_OPFLAGS_11G | AR9300_OPFLAGS_11A,
+                        .eepMisc = 0,
+                },
+                .rfSilent = 0,
+                .blueToothOptions = 0,
+                .deviceCap = 0,
+                .deviceType = 5, /* takes lower byte in eeprom location */
+                .pwrTableOffset = AR9300_PWR_TABLE_OFFSET,
+                .params_for_tuning_caps = {0, 0},
+                .featureEnable = 0x0d,
+                /*
+                 * bit0 - enable tx temp comp - disabled
+                 * bit1 - enable tx volt comp - disabled
+                 * bit2 - enable fastClock - enabled
+                 * bit3 - enable doubling - enabled
+                 * bit4 - enable internal regulator - disabled
+                 * bit5 - enable pa predistortion - disabled
+                 */
+                .miscConfiguration = 0, /* bit0 - turn down drivestrength */
+                .eepromWriteEnableGpio = 6,
+                .wlanDisableGpio = 0,
+                .wlanLedGpio = 8,
+                .rxBandSelectGpio = 0xff,
+                .txrxgain = 0x10,
+                .swreg = 0,
+        },
+        .modalHeader2G = {
+                /* ar9300_modal_eep_header  2g */
+                /* 4 idle,t1,t2,b(4 bits per setting) */
+                .antCtrlCommon = LE32(0x110),
+                /* 4 ra1l1, ra2l1, ra1l2, ra2l2, ra12 */
+                .antCtrlCommon2 = LE32(0x44444),
+
+                /*
+                 * antCtrlChain[AR9300_MAX_CHAINS]; 6 idle, t, r,
+                 * rx1, rx12, b (2 bits each)
+                 */
+                .antCtrlChain = { LE16(0x150), LE16(0x150), LE16(0x150) },
+
+                /*
+                 * xatten1DB[AR9300_MAX_CHAINS];  3 xatten1_db
+                 * for ar9280 (0xa20c/b20c 5:0)
+                 */
+                .xatten1DB = {0, 0, 0},
+
+                /*
+                 * xatten1Margin[AR9300_MAX_CHAINS]; 3 xatten1_margin
+                 * for ar9280 (0xa20c/b20c 16:12
+                 */
+                .xatten1Margin = {0, 0, 0},
+                .tempSlope = 25,
+                .voltSlope = 0,
+
+                /*
+                 * spurChans[OSPREY_EEPROM_MODAL_SPURS]; spur
+                 * channels in usual fbin coding format
+                 */
+                .spurChans = {FREQ2FBIN(2464, 1), 0, 0, 0, 0},
+
+                /*
+                 * noiseFloorThreshCh[AR9300_MAX_CHAINS]; 3 Check
+                 * if the register is per chain
+                 */
+                .noiseFloorThreshCh = {-1, 0, 0},
+                .ob = {1, 1, 1},/* 3 chain */
+                .db_stage2 = {1, 1, 1}, /* 3 chain  */
+                .db_stage3 = {0, 0, 0},
+                .db_stage4 = {0, 0, 0},
+                .xpaBiasLvl = 0,
+                .txFrameToDataStart = 0x0e,
+                .txFrameToPaOn = 0x0e,
+                .txClip = 3, /* 4 bits tx_clip, 4 bits dac_scale_cck */
+                .antennaGain = 0,
+                .switchSettling = 0x2c,
+                .adcDesiredSize = -30,
+                .txEndToXpaOff = 0,
+                .txEndToRxOn = 0x2,
+                .txFrameToXpaOn = 0xe,
+                .thresh62 = 28,
+                .papdRateMaskHt20 = LE32(0x80c080),
+                .papdRateMaskHt40 = LE32(0x80c080),
+                .futureModal = {
+                        0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+                },
+        },
+        .base_ext1 = {
+                .ant_div_control = 0,
+                .future = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}
+        },
+        .calFreqPier2G = {
+                FREQ2FBIN(2412, 1),
+                FREQ2FBIN(2437, 1),
+                FREQ2FBIN(2472, 1),
+        },
+        /* ar9300_cal_data_per_freq_op_loop 2g */
+        .calPierData2G = {
+                { {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0, 0} },
+                { {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0, 0} },
+                { {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0, 0} },
+        },
+        .calTarget_freqbin_Cck = {
+                FREQ2FBIN(2412, 1),
+                FREQ2FBIN(2484, 1),
+        },
+        .calTarget_freqbin_2G = {
+                FREQ2FBIN(2412, 1),
+                FREQ2FBIN(2437, 1),
+                FREQ2FBIN(2472, 1)
+        },
+        .calTarget_freqbin_2GHT20 = {
+                FREQ2FBIN(2412, 1),
+                FREQ2FBIN(2437, 1),
+                FREQ2FBIN(2472, 1)
+        },
+        .calTarget_freqbin_2GHT40 = {
+                FREQ2FBIN(2412, 1),
+                FREQ2FBIN(2437, 1),
+                FREQ2FBIN(2472, 1)
+        },
+        .calTargetPowerCck = {
+                /* 1L-5L,5S,11L,11S */
+                { {34, 34, 34, 34} },
+                { {34, 34, 34, 34} },
+        },
+        .calTargetPower2G = {
+                /* 6-24,36,48,54 */
+                { {34, 34, 32, 32} },
+                { {34, 34, 32, 32} },
+                { {34, 34, 32, 32} },
+        },
+        .calTargetPower2GHT20 = {
+                { {32, 32, 32, 32, 32, 30, 32, 32, 30, 28, 28, 28, 28, 24} },
+                { {32, 32, 32, 32, 32, 30, 32, 32, 30, 28, 28, 28, 28, 24} },
+                { {32, 32, 32, 32, 32, 30, 32, 32, 30, 28, 28, 28, 28, 24} },
+        },
+        .calTargetPower2GHT40 = {
+                { {30, 30, 30, 30, 30, 28, 30, 30, 28, 26, 26, 26, 26, 22} },
+                { {30, 30, 30, 30, 30, 28, 30, 30, 28, 26, 26, 26, 26, 22} },
+                { {30, 30, 30, 30, 30, 28, 30, 30, 28, 26, 26, 26, 26, 22} },
+        },
+        .ctlIndex_2G =  {
+                0x11, 0x12, 0x15, 0x17, 0x41, 0x42,
+                0x45, 0x47, 0x31, 0x32, 0x35, 0x37,
+        },
+        .ctl_freqbin_2G = {
+                {
+                        FREQ2FBIN(2412, 1),
+                        FREQ2FBIN(2417, 1),
+                        FREQ2FBIN(2457, 1),
+                        FREQ2FBIN(2462, 1)
+                },
+                {
+                        FREQ2FBIN(2412, 1),
+                        FREQ2FBIN(2417, 1),
+                        FREQ2FBIN(2462, 1),
+                        0xFF,
+                },
+
+                {
+                        FREQ2FBIN(2412, 1),
+                        FREQ2FBIN(2417, 1),
+                        FREQ2FBIN(2462, 1),
+                        0xFF,
+                },
+                {
+                        FREQ2FBIN(2422, 1),
+                        FREQ2FBIN(2427, 1),
+                        FREQ2FBIN(2447, 1),
+                        FREQ2FBIN(2452, 1)
+                },
+
+                {
+                        /* Data[4].ctlEdges[0].bChannel */ FREQ2FBIN(2412, 1),
+                        /* Data[4].ctlEdges[1].bChannel */ FREQ2FBIN(2417, 1),
+                        /* Data[4].ctlEdges[2].bChannel */ FREQ2FBIN(2472, 1),
+                        /* Data[4].ctlEdges[3].bChannel */ FREQ2FBIN(2484, 1),
+                },
+
+                {
+                        /* Data[5].ctlEdges[0].bChannel */ FREQ2FBIN(2412, 1),
+                        /* Data[5].ctlEdges[1].bChannel */ FREQ2FBIN(2417, 1),
+                        /* Data[5].ctlEdges[2].bChannel */ FREQ2FBIN(2472, 1),
+                        0,
+                },
+
+                {
+                        /* Data[6].ctlEdges[0].bChannel */ FREQ2FBIN(2412, 1),
+                        /* Data[6].ctlEdges[1].bChannel */ FREQ2FBIN(2417, 1),
+                        FREQ2FBIN(2472, 1),
+                        0,
+                },
+
+                {
+                        /* Data[7].ctlEdges[0].bChannel */ FREQ2FBIN(2422, 1),
+                        /* Data[7].ctlEdges[1].bChannel */ FREQ2FBIN(2427, 1),
+                        /* Data[7].ctlEdges[2].bChannel */ FREQ2FBIN(2447, 1),
+                        /* Data[7].ctlEdges[3].bChannel */ FREQ2FBIN(2462, 1),
+                },
+
+                {
+                        /* Data[8].ctlEdges[0].bChannel */ FREQ2FBIN(2412, 1),
+                        /* Data[8].ctlEdges[1].bChannel */ FREQ2FBIN(2417, 1),
+                        /* Data[8].ctlEdges[2].bChannel */ FREQ2FBIN(2472, 1),
+                },
+
+                {
+                        /* Data[9].ctlEdges[0].bChannel */ FREQ2FBIN(2412, 1),
+                        /* Data[9].ctlEdges[1].bChannel */ FREQ2FBIN(2417, 1),
+                        /* Data[9].ctlEdges[2].bChannel */ FREQ2FBIN(2472, 1),
+                        0
+                },
+
+                {
+                        /* Data[10].ctlEdges[0].bChannel */ FREQ2FBIN(2412, 1),
+                        /* Data[10].ctlEdges[1].bChannel */ FREQ2FBIN(2417, 1),
+                        /* Data[10].ctlEdges[2].bChannel */ FREQ2FBIN(2472, 1),
+                        0
+                },
+
+                {
+                        /* Data[11].ctlEdges[0].bChannel */ FREQ2FBIN(2422, 1),
+                        /* Data[11].ctlEdges[1].bChannel */ FREQ2FBIN(2427, 1),
+                        /* Data[11].ctlEdges[2].bChannel */ FREQ2FBIN(2447, 1),
+                        /* Data[11].ctlEdges[3].bChannel */ FREQ2FBIN(2462, 1),
+                }
+        },
+        .ctlPowerData_2G = {
+                { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                { { CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 1) } },
+
+                { { CTL(60, 1), CTL(60, 0), CTL(0, 0), CTL(0, 0) } },
+                { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+
+                { { CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 0) } },
+                { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+
+                { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                { { CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 1) } },
+                { { CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 1) } },
+        },
+        .modalHeader5G = {
+                /* 4 idle,t1,t2,b (4 bits per setting) */
+                .antCtrlCommon = LE32(0x220),
+                /* 4 ra1l1, ra2l1, ra1l2,ra2l2,ra12 */
+                .antCtrlCommon2 = LE32(0x44444),
+                /* antCtrlChain 6 idle, t,r,rx1,rx12,b (2 bits each) */
+                .antCtrlChain = {
+                        LE16(0x150), LE16(0x150), LE16(0x150),
+                },
+                /* xatten1DB 3 xatten1_db for AR9280 (0xa20c/b20c 5:0) */
+                .xatten1DB = {0, 0, 0},
+
+                /*
+                 * xatten1Margin[AR9300_MAX_CHAINS]; 3 xatten1_margin
+                 * for merlin (0xa20c/b20c 16:12
+                 */
+                .xatten1Margin = {0, 0, 0},
+                .tempSlope = 45,
+                .voltSlope = 0,
+                /* spurChans spur channels in usual fbin coding format */
+                .spurChans = {0, 0, 0, 0, 0},
+                /* noiseFloorThreshCh Check if the register is per chain */
+                .noiseFloorThreshCh = {-1, 0, 0},
+                .ob = {3, 3, 3}, /* 3 chain */
+                .db_stage2 = {3, 3, 3}, /* 3 chain */
+                .db_stage3 = {3, 3, 3}, /* doesn't exist for 2G */
+                .db_stage4 = {3, 3, 3},  /* don't exist for 2G */
+                .xpaBiasLvl = 0,
+                .txFrameToDataStart = 0x0e,
+                .txFrameToPaOn = 0x0e,
+                .txClip = 3, /* 4 bits tx_clip, 4 bits dac_scale_cck */
+                .antennaGain = 0,
+                .switchSettling = 0x2d,
+                .adcDesiredSize = -30,
+                .txEndToXpaOff = 0,
+                .txEndToRxOn = 0x2,
+                .txFrameToXpaOn = 0xe,
+                .thresh62 = 28,
+                .papdRateMaskHt20 = LE32(0x0cf0e0e0),
+                .papdRateMaskHt40 = LE32(0x6cf0e0e0),
+                .futureModal = {
+                        0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+                },
+        },
+        .base_ext2 = {
+                .tempSlopeLow = 40,
+                .tempSlopeHigh = 50,
+                .xatten1DBLow = {0, 0, 0},
+                .xatten1MarginLow = {0, 0, 0},
+                .xatten1DBHigh = {0, 0, 0},
+                .xatten1MarginHigh = {0, 0, 0}
+        },
+        .calFreqPier5G = {
+                FREQ2FBIN(5180, 0),
+                FREQ2FBIN(5220, 0),
+                FREQ2FBIN(5320, 0),
+                FREQ2FBIN(5400, 0),
+                FREQ2FBIN(5500, 0),
+                FREQ2FBIN(5600, 0),
+                FREQ2FBIN(5700, 0),
+                FREQ2FBIN(5825, 0)
+        },
+        .calPierData5G = {
+                {
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                },
+                {
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                },
+                {
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                },
+
+        },
+        .calTarget_freqbin_5G = {
+                FREQ2FBIN(5180, 0),
+                FREQ2FBIN(5240, 0),
+                FREQ2FBIN(5320, 0),
+                FREQ2FBIN(5400, 0),
+                FREQ2FBIN(5500, 0),
+                FREQ2FBIN(5600, 0),
+                FREQ2FBIN(5700, 0),
+                FREQ2FBIN(5825, 0)
+        },
+        .calTarget_freqbin_5GHT20 = {
+                FREQ2FBIN(5180, 0),
+                FREQ2FBIN(5240, 0),
+                FREQ2FBIN(5320, 0),
+                FREQ2FBIN(5400, 0),
+                FREQ2FBIN(5500, 0),
+                FREQ2FBIN(5700, 0),
+                FREQ2FBIN(5745, 0),
+                FREQ2FBIN(5825, 0)
+        },
+        .calTarget_freqbin_5GHT40 = {
+                FREQ2FBIN(5180, 0),
+                FREQ2FBIN(5240, 0),
+                FREQ2FBIN(5320, 0),
+                FREQ2FBIN(5400, 0),
+                FREQ2FBIN(5500, 0),
+                FREQ2FBIN(5700, 0),
+                FREQ2FBIN(5745, 0),
+                FREQ2FBIN(5825, 0)
+        },
+        .calTargetPower5G = {
+                /* 6-24,36,48,54 */
+                { {30, 30, 28, 24} },
+                { {30, 30, 28, 24} },
+                { {30, 30, 28, 24} },
+                { {30, 30, 28, 24} },
+                { {30, 30, 28, 24} },
+                { {30, 30, 28, 24} },
+                { {30, 30, 28, 24} },
+                { {30, 30, 28, 24} },
+        },
+        .calTargetPower5GHT20 = {
+                /*
+                 * 0_8_16,1-3_9-11_17-19,
+                 * 4,5,6,7,12,13,14,15,20,21,22,23
+                 */
+                { {30, 30, 30, 28, 24, 20, 30, 28, 24, 20, 20, 20, 20, 16} },
+                { {30, 30, 30, 28, 24, 20, 30, 28, 24, 20, 20, 20, 20, 16} },
+                { {30, 30, 30, 26, 22, 18, 30, 26, 22, 18, 18, 18, 18, 16} },
+                { {30, 30, 30, 26, 22, 18, 30, 26, 22, 18, 18, 18, 18, 16} },
+                { {30, 30, 30, 24, 20, 16, 30, 24, 20, 16, 16, 16, 16, 14} },
+                { {30, 30, 30, 24, 20, 16, 30, 24, 20, 16, 16, 16, 16, 14} },
+                { {30, 30, 30, 22, 18, 14, 30, 22, 18, 14, 14, 14, 14, 12} },
+                { {30, 30, 30, 22, 18, 14, 30, 22, 18, 14, 14, 14, 14, 12} },
+        },
+        .calTargetPower5GHT40 =  {
+                /*
+                 * 0_8_16,1-3_9-11_17-19,
+                 * 4,5,6,7,12,13,14,15,20,21,22,23
+                 */
+                { {28, 28, 28, 26, 22, 18, 28, 26, 22, 18, 18, 18, 18, 14} },
+                { {28, 28, 28, 26, 22, 18, 28, 26, 22, 18, 18, 18, 18, 14} },
+                { {28, 28, 28, 24, 20, 16, 28, 24, 20, 16, 16, 16, 16, 12} },
+                { {28, 28, 28, 24, 20, 16, 28, 24, 20, 16, 16, 16, 16, 12} },
+                { {28, 28, 28, 22, 18, 14, 28, 22, 18, 14, 14, 14, 14, 10} },
+                { {28, 28, 28, 22, 18, 14, 28, 22, 18, 14, 14, 14, 14, 10} },
+                { {28, 28, 28, 20, 16, 12, 28, 20, 16, 12, 12, 12, 12, 8} },
+                { {28, 28, 28, 20, 16, 12, 28, 20, 16, 12, 12, 12, 12, 8} },
+        },
+        .ctlIndex_5G =  {
+                0x10, 0x16, 0x18, 0x40, 0x46,
+                0x48, 0x30, 0x36, 0x38
+        },
+        .ctl_freqbin_5G =  {
+                {
+                        /* Data[0].ctlEdges[0].bChannel */ FREQ2FBIN(5180, 0),
+                        /* Data[0].ctlEdges[1].bChannel */ FREQ2FBIN(5260, 0),
+                        /* Data[0].ctlEdges[2].bChannel */ FREQ2FBIN(5280, 0),
+                        /* Data[0].ctlEdges[3].bChannel */ FREQ2FBIN(5500, 0),
+                        /* Data[0].ctlEdges[4].bChannel */ FREQ2FBIN(5600, 0),
+                        /* Data[0].ctlEdges[5].bChannel */ FREQ2FBIN(5700, 0),
+                        /* Data[0].ctlEdges[6].bChannel */ FREQ2FBIN(5745, 0),
+                        /* Data[0].ctlEdges[7].bChannel */ FREQ2FBIN(5825, 0)
+                },
+                {
+                        /* Data[1].ctlEdges[0].bChannel */ FREQ2FBIN(5180, 0),
+                        /* Data[1].ctlEdges[1].bChannel */ FREQ2FBIN(5260, 0),
+                        /* Data[1].ctlEdges[2].bChannel */ FREQ2FBIN(5280, 0),
+                        /* Data[1].ctlEdges[3].bChannel */ FREQ2FBIN(5500, 0),
+                        /* Data[1].ctlEdges[4].bChannel */ FREQ2FBIN(5520, 0),
+                        /* Data[1].ctlEdges[5].bChannel */ FREQ2FBIN(5700, 0),
+                        /* Data[1].ctlEdges[6].bChannel */ FREQ2FBIN(5745, 0),
+                        /* Data[1].ctlEdges[7].bChannel */ FREQ2FBIN(5825, 0)
+                },
+
+                {
+                        /* Data[2].ctlEdges[0].bChannel */ FREQ2FBIN(5190, 0),
+                        /* Data[2].ctlEdges[1].bChannel */ FREQ2FBIN(5230, 0),
+                        /* Data[2].ctlEdges[2].bChannel */ FREQ2FBIN(5270, 0),
+                        /* Data[2].ctlEdges[3].bChannel */ FREQ2FBIN(5310, 0),
+                        /* Data[2].ctlEdges[4].bChannel */ FREQ2FBIN(5510, 0),
+                        /* Data[2].ctlEdges[5].bChannel */ FREQ2FBIN(5550, 0),
+                        /* Data[2].ctlEdges[6].bChannel */ FREQ2FBIN(5670, 0),
+                        /* Data[2].ctlEdges[7].bChannel */ FREQ2FBIN(5755, 0)
+                },
+
+                {
+                        /* Data[3].ctlEdges[0].bChannel */ FREQ2FBIN(5180, 0),
+                        /* Data[3].ctlEdges[1].bChannel */ FREQ2FBIN(5200, 0),
+                        /* Data[3].ctlEdges[2].bChannel */ FREQ2FBIN(5260, 0),
+                        /* Data[3].ctlEdges[3].bChannel */ FREQ2FBIN(5320, 0),
+                        /* Data[3].ctlEdges[4].bChannel */ FREQ2FBIN(5500, 0),
+                        /* Data[3].ctlEdges[5].bChannel */ FREQ2FBIN(5700, 0),
+                        /* Data[3].ctlEdges[6].bChannel */ 0xFF,
+                        /* Data[3].ctlEdges[7].bChannel */ 0xFF,
+                },
+
+                {
+                        /* Data[4].ctlEdges[0].bChannel */ FREQ2FBIN(5180, 0),
+                        /* Data[4].ctlEdges[1].bChannel */ FREQ2FBIN(5260, 0),
+                        /* Data[4].ctlEdges[2].bChannel */ FREQ2FBIN(5500, 0),
+                        /* Data[4].ctlEdges[3].bChannel */ FREQ2FBIN(5700, 0),
+                        /* Data[4].ctlEdges[4].bChannel */ 0xFF,
+                        /* Data[4].ctlEdges[5].bChannel */ 0xFF,
+                        /* Data[4].ctlEdges[6].bChannel */ 0xFF,
+                        /* Data[4].ctlEdges[7].bChannel */ 0xFF,
+                },
+
+                {
+                        /* Data[5].ctlEdges[0].bChannel */ FREQ2FBIN(5190, 0),
+                        /* Data[5].ctlEdges[1].bChannel */ FREQ2FBIN(5270, 0),
+                        /* Data[5].ctlEdges[2].bChannel */ FREQ2FBIN(5310, 0),
+                        /* Data[5].ctlEdges[3].bChannel */ FREQ2FBIN(5510, 0),
+                        /* Data[5].ctlEdges[4].bChannel */ FREQ2FBIN(5590, 0),
+                        /* Data[5].ctlEdges[5].bChannel */ FREQ2FBIN(5670, 0),
+                        /* Data[5].ctlEdges[6].bChannel */ 0xFF,
+                        /* Data[5].ctlEdges[7].bChannel */ 0xFF
+                },
+
+                {
+                        /* Data[6].ctlEdges[0].bChannel */ FREQ2FBIN(5180, 0),
+                        /* Data[6].ctlEdges[1].bChannel */ FREQ2FBIN(5200, 0),
+                        /* Data[6].ctlEdges[2].bChannel */ FREQ2FBIN(5220, 0),
+                        /* Data[6].ctlEdges[3].bChannel */ FREQ2FBIN(5260, 0),
+                        /* Data[6].ctlEdges[4].bChannel */ FREQ2FBIN(5500, 0),
+                        /* Data[6].ctlEdges[5].bChannel */ FREQ2FBIN(5600, 0),
+                        /* Data[6].ctlEdges[6].bChannel */ FREQ2FBIN(5700, 0),
+                        /* Data[6].ctlEdges[7].bChannel */ FREQ2FBIN(5745, 0)
+                },
+
+                {
+                        /* Data[7].ctlEdges[0].bChannel */ FREQ2FBIN(5180, 0),
+                        /* Data[7].ctlEdges[1].bChannel */ FREQ2FBIN(5260, 0),
+                        /* Data[7].ctlEdges[2].bChannel */ FREQ2FBIN(5320, 0),
+                        /* Data[7].ctlEdges[3].bChannel */ FREQ2FBIN(5500, 0),
+                        /* Data[7].ctlEdges[4].bChannel */ FREQ2FBIN(5560, 0),
+                        /* Data[7].ctlEdges[5].bChannel */ FREQ2FBIN(5700, 0),
+                        /* Data[7].ctlEdges[6].bChannel */ FREQ2FBIN(5745, 0),
+                        /* Data[7].ctlEdges[7].bChannel */ FREQ2FBIN(5825, 0)
+                },
+
+                {
+                        /* Data[8].ctlEdges[0].bChannel */ FREQ2FBIN(5190, 0),
+                        /* Data[8].ctlEdges[1].bChannel */ FREQ2FBIN(5230, 0),
+                        /* Data[8].ctlEdges[2].bChannel */ FREQ2FBIN(5270, 0),
+                        /* Data[8].ctlEdges[3].bChannel */ FREQ2FBIN(5510, 0),
+                        /* Data[8].ctlEdges[4].bChannel */ FREQ2FBIN(5550, 0),
+                        /* Data[8].ctlEdges[5].bChannel */ FREQ2FBIN(5670, 0),
+                        /* Data[8].ctlEdges[6].bChannel */ FREQ2FBIN(5755, 0),
+                        /* Data[8].ctlEdges[7].bChannel */ FREQ2FBIN(5795, 0)
+                }
+        },
+        .ctlPowerData_5G = {
+                {
+                        {
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
+                        }
+                },
+                {
+                        {
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
+                        }
+                },
+                {
+                        {
+                                CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                        }
+                },
+                {
+                        {
+                                CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 0),
+                                CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 0),
+                        }
+                },
+                {
+                        {
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
+                                CTL(60, 0), CTL(60, 0), CTL(60, 0), CTL(60, 0),
+                        }
+                },
+                {
+                        {
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 0),
+                        }
+                },
+                {
+                        {
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                        }
+                },
+                {
+                        {
+                                CTL(60, 1), CTL(60, 1), CTL(60, 0), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
+                        }
+                },
+                {
+                        {
+                                CTL(60, 1), CTL(60, 0), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 0), CTL(60, 1),
+                        }
+                },
+        }
+};
+
+
+static const struct ar9300_eeprom ar9300_x112 = {
+        .eepromVersion = 2,
+        .templateVersion = 5,
+        .macAddr = {0x00, 0x03, 0x7f, 0x0, 0x0, 0x0},
+        .custData = {"x112-041-f0000"},
+        .baseEepHeader = {
+                .regDmn = { LE16(0), LE16(0x1f) },
+                .txrxMask =  0x77, /* 4 bits tx and 4 bits rx */
+                .opCapFlags = {
+                        .opFlags = AR9300_OPFLAGS_11G | AR9300_OPFLAGS_11A,
+                        .eepMisc = 0,
+                },
+                .rfSilent = 0,
+                .blueToothOptions = 0,
+                .deviceCap = 0,
+                .deviceType = 5, /* takes lower byte in eeprom location */
+                .pwrTableOffset = AR9300_PWR_TABLE_OFFSET,
+                .params_for_tuning_caps = {0, 0},
+                .featureEnable = 0x0d,
+                /*
+                 * bit0 - enable tx temp comp - disabled
+                 * bit1 - enable tx volt comp - disabled
+                 * bit2 - enable fastclock - enabled
+                 * bit3 - enable doubling - enabled
+                 * bit4 - enable internal regulator - disabled
+                 * bit5 - enable pa predistortion - disabled
+                 */
+                .miscConfiguration = 0, /* bit0 - turn down drivestrength */
+                .eepromWriteEnableGpio = 6,
+                .wlanDisableGpio = 0,
+                .wlanLedGpio = 8,
+                .rxBandSelectGpio = 0xff,
+                .txrxgain = 0x0,
+                .swreg = 0,
+        },
+        .modalHeader2G = {
+                /* ar9300_modal_eep_header  2g */
+                /* 4 idle,t1,t2,b(4 bits per setting) */
+                .antCtrlCommon = LE32(0x110),
+                /* 4 ra1l1, ra2l1, ra1l2, ra2l2, ra12 */
+                .antCtrlCommon2 = LE32(0x22222),
+
+                /*
+                 * antCtrlChain[ar9300_max_chains]; 6 idle, t, r,
+                 * rx1, rx12, b (2 bits each)
+                 */
+                .antCtrlChain = { LE16(0x10), LE16(0x10), LE16(0x10) },
+
+                /*
+                 * xatten1DB[AR9300_max_chains];  3 xatten1_db
+                 * for ar9280 (0xa20c/b20c 5:0)
+                 */
+                .xatten1DB = {0x1b, 0x1b, 0x1b},
+
+                /*
+                 * xatten1Margin[ar9300_max_chains]; 3 xatten1_margin
+                 * for ar9280 (0xa20c/b20c 16:12
+                 */
+                .xatten1Margin = {0x15, 0x15, 0x15},
+                .tempSlope = 50,
+                .voltSlope = 0,
+
+                /*
+                 * spurChans[OSPrey_eeprom_modal_sPURS]; spur
+                 * channels in usual fbin coding format
+                 */
+                .spurChans = {FREQ2FBIN(2464, 1), 0, 0, 0, 0},
+
+                /*
+                 * noiseFloorThreshch[ar9300_max_cHAINS]; 3 Check
+                 * if the register is per chain
+                 */
+                .noiseFloorThreshCh = {-1, 0, 0},
+                .ob = {1, 1, 1},/* 3 chain */
+                .db_stage2 = {1, 1, 1}, /* 3 chain  */
+                .db_stage3 = {0, 0, 0},
+                .db_stage4 = {0, 0, 0},
+                .xpaBiasLvl = 0,
+                .txFrameToDataStart = 0x0e,
+                .txFrameToPaOn = 0x0e,
+                .txClip = 3, /* 4 bits tx_clip, 4 bits dac_scale_cck */
+                .antennaGain = 0,
+                .switchSettling = 0x2c,
+                .adcDesiredSize = -30,
+                .txEndToXpaOff = 0,
+                .txEndToRxOn = 0x2,
+                .txFrameToXpaOn = 0xe,
+                .thresh62 = 28,
+                .papdRateMaskHt20 = LE32(0x0c80c080),
+                .papdRateMaskHt40 = LE32(0x0080c080),
+                .futureModal = {
+                        0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+                },
+        },
+        .base_ext1 = {
+                .ant_div_control = 0,
+                .future = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}
+        },
+        .calFreqPier2G = {
+                FREQ2FBIN(2412, 1),
+                FREQ2FBIN(2437, 1),
+                FREQ2FBIN(2472, 1),
+        },
+        /* ar9300_cal_data_per_freq_op_loop 2g */
+        .calPierData2G = {
+                { {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0, 0} },
+                { {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0, 0} },
+                { {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0, 0} },
+        },
+        .calTarget_freqbin_Cck = {
+                FREQ2FBIN(2412, 1),
+                FREQ2FBIN(2472, 1),
+        },
+        .calTarget_freqbin_2G = {
+                FREQ2FBIN(2412, 1),
+                FREQ2FBIN(2437, 1),
+                FREQ2FBIN(2472, 1)
+        },
+        .calTarget_freqbin_2GHT20 = {
+                FREQ2FBIN(2412, 1),
+                FREQ2FBIN(2437, 1),
+                FREQ2FBIN(2472, 1)
+        },
+        .calTarget_freqbin_2GHT40 = {
+                FREQ2FBIN(2412, 1),
+                FREQ2FBIN(2437, 1),
+                FREQ2FBIN(2472, 1)
+        },
+        .calTargetPowerCck = {
+                /* 1L-5L,5S,11L,11s */
+                { {38, 38, 38, 38} },
+                { {38, 38, 38, 38} },
+        },
+        .calTargetPower2G = {
+                /* 6-24,36,48,54 */
+                { {38, 38, 36, 34} },
+                { {38, 38, 36, 34} },
+                { {38, 38, 34, 32} },
+        },
+        .calTargetPower2GHT20 = {
+                { {36, 36, 36, 36, 36, 34, 34, 32, 30, 28, 28, 28, 28, 26} },
+                { {36, 36, 36, 36, 36, 34, 36, 34, 32, 30, 30, 30, 28, 26} },
+                { {36, 36, 36, 36, 36, 34, 34, 32, 30, 28, 28, 28, 28, 26} },
+        },
+        .calTargetPower2GHT40 = {
+                { {36, 36, 36, 36, 34, 32, 32, 30, 28, 26, 26, 26, 26, 24} },
+                { {36, 36, 36, 36, 34, 32, 34, 32, 30, 28, 28, 28, 28, 24} },
+                { {36, 36, 36, 36, 34, 32, 32, 30, 28, 26, 26, 26, 26, 24} },
+        },
+        .ctlIndex_2G =  {
+                0x11, 0x12, 0x15, 0x17, 0x41, 0x42,
+                0x45, 0x47, 0x31, 0x32, 0x35, 0x37,
+        },
+        .ctl_freqbin_2G = {
+                {
+                        FREQ2FBIN(2412, 1),
+                        FREQ2FBIN(2417, 1),
+                        FREQ2FBIN(2457, 1),
+                        FREQ2FBIN(2462, 1)
+                },
+                {
+                        FREQ2FBIN(2412, 1),
+                        FREQ2FBIN(2417, 1),
+                        FREQ2FBIN(2462, 1),
+                        0xFF,
+                },
+
+                {
+                        FREQ2FBIN(2412, 1),
+                        FREQ2FBIN(2417, 1),
+                        FREQ2FBIN(2462, 1),
+                        0xFF,
+                },
+                {
+                        FREQ2FBIN(2422, 1),
+                        FREQ2FBIN(2427, 1),
+                        FREQ2FBIN(2447, 1),
+                        FREQ2FBIN(2452, 1)
+                },
+
+                {
+                        /* Data[4].ctledges[0].bchannel */ FREQ2FBIN(2412, 1),
+                        /* Data[4].ctledges[1].bchannel */ FREQ2FBIN(2417, 1),
+                        /* Data[4].ctledges[2].bchannel */ FREQ2FBIN(2472, 1),
+                        /* Data[4].ctledges[3].bchannel */ FREQ2FBIN(2484, 1),
+                },
+
+                {
+                        /* Data[5].ctledges[0].bchannel */ FREQ2FBIN(2412, 1),
+                        /* Data[5].ctledges[1].bchannel */ FREQ2FBIN(2417, 1),
+                        /* Data[5].ctledges[2].bchannel */ FREQ2FBIN(2472, 1),
+                        0,
+                },
+
+                {
+                        /* Data[6].ctledges[0].bchannel */ FREQ2FBIN(2412, 1),
+                        /* Data[6].ctledges[1].bchannel */ FREQ2FBIN(2417, 1),
+                        FREQ2FBIN(2472, 1),
+                        0,
+                },
+
+                {
+                        /* Data[7].ctledges[0].bchannel */ FREQ2FBIN(2422, 1),
+                        /* Data[7].ctledges[1].bchannel */ FREQ2FBIN(2427, 1),
+                        /* Data[7].ctledges[2].bchannel */ FREQ2FBIN(2447, 1),
+                        /* Data[7].ctledges[3].bchannel */ FREQ2FBIN(2462, 1),
+                },
+
+                {
+                        /* Data[8].ctledges[0].bchannel */ FREQ2FBIN(2412, 1),
+                        /* Data[8].ctledges[1].bchannel */ FREQ2FBIN(2417, 1),
+                        /* Data[8].ctledges[2].bchannel */ FREQ2FBIN(2472, 1),
+                },
+
+                {
+                        /* Data[9].ctledges[0].bchannel */ FREQ2FBIN(2412, 1),
+                        /* Data[9].ctledges[1].bchannel */ FREQ2FBIN(2417, 1),
+                        /* Data[9].ctledges[2].bchannel */ FREQ2FBIN(2472, 1),
+                        0
+                },
+
+                {
+                        /* Data[10].ctledges[0].bchannel */ FREQ2FBIN(2412, 1),
+                        /* Data[10].ctledges[1].bchannel */ FREQ2FBIN(2417, 1),
+                        /* Data[10].ctledges[2].bchannel */ FREQ2FBIN(2472, 1),
+                        0
+                },
+
+                {
+                        /* Data[11].ctledges[0].bchannel */ FREQ2FBIN(2422, 1),
+                        /* Data[11].ctledges[1].bchannel */ FREQ2FBIN(2427, 1),
+                        /* Data[11].ctledges[2].bchannel */ FREQ2FBIN(2447, 1),
+                        /* Data[11].ctledges[3].bchannel */ FREQ2FBIN(2462, 1),
+                }
+        },
+        .ctlPowerData_2G = {
+                { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                { { CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 1) } },
+
+                { { CTL(60, 1), CTL(60, 0), CTL(0, 0), CTL(0, 0) } },
+                { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+
+                { { CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 0) } },
+                { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+
+                { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                { { CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 1) } },
+                { { CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 1) } },
+        },
+        .modalHeader5G = {
+                /* 4 idle,t1,t2,b (4 bits per setting) */
+                .antCtrlCommon = LE32(0x110),
+                /* 4 ra1l1, ra2l1, ra1l2,ra2l2,ra12 */
+                .antCtrlCommon2 = LE32(0x22222),
+                /* antCtrlChain 6 idle, t,r,rx1,rx12,b (2 bits each) */
+                .antCtrlChain = {
+                        LE16(0x0), LE16(0x0), LE16(0x0),
+                },
+                /* xatten1DB 3 xatten1_db for ar9280 (0xa20c/b20c 5:0) */
+                .xatten1DB = {0x13, 0x19, 0x17},
+
+                /*
+                 * xatten1Margin[ar9300_max_chains]; 3 xatten1_margin
+                 * for merlin (0xa20c/b20c 16:12
+                 */
+                .xatten1Margin = {0x19, 0x19, 0x19},
+                .tempSlope = 70,
+                .voltSlope = 15,
+                /* spurChans spur channels in usual fbin coding format */
+                .spurChans = {0, 0, 0, 0, 0},
+                /* noiseFloorThreshch check if the register is per chain */
+                .noiseFloorThreshCh = {-1, 0, 0},
+                .ob = {3, 3, 3}, /* 3 chain */
+                .db_stage2 = {3, 3, 3}, /* 3 chain */
+                .db_stage3 = {3, 3, 3}, /* doesn't exist for 2G */
+                .db_stage4 = {3, 3, 3},  /* don't exist for 2G */
+                .xpaBiasLvl = 0,
+                .txFrameToDataStart = 0x0e,
+                .txFrameToPaOn = 0x0e,
+                .txClip = 3, /* 4 bits tx_clip, 4 bits dac_scale_cck */
+                .antennaGain = 0,
+                .switchSettling = 0x2d,
+                .adcDesiredSize = -30,
+                .txEndToXpaOff = 0,
+                .txEndToRxOn = 0x2,
+                .txFrameToXpaOn = 0xe,
+                .thresh62 = 28,
+                .papdRateMaskHt20 = LE32(0x0cf0e0e0),
+                .papdRateMaskHt40 = LE32(0x6cf0e0e0),
+                .futureModal = {
+                        0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+                },
+        },
+        .base_ext2 = {
+                .tempSlopeLow = 72,
+                .tempSlopeHigh = 105,
+                .xatten1DBLow = {0x10, 0x14, 0x10},
+                .xatten1MarginLow = {0x19, 0x19 , 0x19},
+                .xatten1DBHigh = {0x1d, 0x20, 0x24},
+                .xatten1MarginHigh = {0x10, 0x10, 0x10}
+        },
+        .calFreqPier5G = {
+                FREQ2FBIN(5180, 0),
+                FREQ2FBIN(5220, 0),
+                FREQ2FBIN(5320, 0),
+                FREQ2FBIN(5400, 0),
+                FREQ2FBIN(5500, 0),
+                FREQ2FBIN(5600, 0),
+                FREQ2FBIN(5700, 0),
+                FREQ2FBIN(5785, 0)
+        },
+        .calPierData5G = {
+                {
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                },
+                {
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                },
+                {
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                        {0, 0, 0, 0, 0},
+                },
+
+        },
+        .calTarget_freqbin_5G = {
+                FREQ2FBIN(5180, 0),
+                FREQ2FBIN(5220, 0),
+                FREQ2FBIN(5320, 0),
+                FREQ2FBIN(5400, 0),
+                FREQ2FBIN(5500, 0),
+                FREQ2FBIN(5600, 0),
+                FREQ2FBIN(5725, 0),
+                FREQ2FBIN(5825, 0)
+        },
+        .calTarget_freqbin_5GHT20 = {
+                FREQ2FBIN(5180, 0),
+                FREQ2FBIN(5220, 0),
+                FREQ2FBIN(5320, 0),
+                FREQ2FBIN(5400, 0),
+                FREQ2FBIN(5500, 0),
+                FREQ2FBIN(5600, 0),
+                FREQ2FBIN(5725, 0),
+                FREQ2FBIN(5825, 0)
+        },
+        .calTarget_freqbin_5GHT40 = {
+                FREQ2FBIN(5180, 0),
+                FREQ2FBIN(5220, 0),
+                FREQ2FBIN(5320, 0),
+                FREQ2FBIN(5400, 0),
+                FREQ2FBIN(5500, 0),
+                FREQ2FBIN(5600, 0),
+                FREQ2FBIN(5725, 0),
+                FREQ2FBIN(5825, 0)
+        },
+        .calTargetPower5G = {
+                /* 6-24,36,48,54 */
+                { {32, 32, 28, 26} },
+                { {32, 32, 28, 26} },
+                { {32, 32, 28, 26} },
+                { {32, 32, 26, 24} },
+                { {32, 32, 26, 24} },
+                { {32, 32, 24, 22} },
+                { {30, 30, 24, 22} },
+                { {30, 30, 24, 22} },
+        },
+        .calTargetPower5GHT20 = {
+                /*
+                 * 0_8_16,1-3_9-11_17-19,
+                 * 4,5,6,7,12,13,14,15,20,21,22,23
+                 */
+                { {32, 32, 32, 32, 28, 26, 32, 28, 26, 24, 24, 24, 22, 22} },
+                { {32, 32, 32, 32, 28, 26, 32, 28, 26, 24, 24, 24, 22, 22} },
+                { {32, 32, 32, 32, 28, 26, 32, 28, 26, 24, 24, 24, 22, 22} },
+                { {32, 32, 32, 32, 28, 26, 32, 26, 24, 22, 22, 22, 20, 20} },
+                { {32, 32, 32, 32, 28, 26, 32, 26, 24, 22, 20, 18, 16, 16} },
+                { {32, 32, 32, 32, 28, 26, 32, 24, 20, 16, 18, 16, 14, 14} },
+                { {30, 30, 30, 30, 28, 26, 30, 24, 20, 16, 18, 16, 14, 14} },
+                { {30, 30, 30, 30, 28, 26, 30, 24, 20, 16, 18, 16, 14, 14} },
+        },
+        .calTargetPower5GHT40 =  {
+                /*
+                 * 0_8_16,1-3_9-11_17-19,
+                 * 4,5,6,7,12,13,14,15,20,21,22,23
+                 */
+                { {32, 32, 32, 30, 28, 26, 30, 28, 26, 24, 24, 24, 22, 22} },
+                { {32, 32, 32, 30, 28, 26, 30, 28, 26, 24, 24, 24, 22, 22} },
+                { {32, 32, 32, 30, 28, 26, 30, 28, 26, 24, 24, 24, 22, 22} },
+                { {32, 32, 32, 30, 28, 26, 30, 26, 24, 22, 22, 22, 20, 20} },
+                { {32, 32, 32, 30, 28, 26, 30, 26, 24, 22, 20, 18, 16, 16} },
+                { {32, 32, 32, 30, 28, 26, 30, 22, 20, 16, 18, 16, 14, 14} },
+                { {30, 30, 30, 30, 28, 26, 30, 22, 20, 16, 18, 16, 14, 14} },
+                { {30, 30, 30, 30, 28, 26, 30, 22, 20, 16, 18, 16, 14, 14} },
+        },
+        .ctlIndex_5G =  {
+                0x10, 0x16, 0x18, 0x40, 0x46,
+                0x48, 0x30, 0x36, 0x38
+        },
+        .ctl_freqbin_5G =  {
+                {
+                        /* Data[0].ctledges[0].bchannel */ FREQ2FBIN(5180, 0),
+                        /* Data[0].ctledges[1].bchannel */ FREQ2FBIN(5260, 0),
+                        /* Data[0].ctledges[2].bchannel */ FREQ2FBIN(5280, 0),
+                        /* Data[0].ctledges[3].bchannel */ FREQ2FBIN(5500, 0),
+                        /* Data[0].ctledges[4].bchannel */ FREQ2FBIN(5600, 0),
+                        /* Data[0].ctledges[5].bchannel */ FREQ2FBIN(5700, 0),
+                        /* Data[0].ctledges[6].bchannel */ FREQ2FBIN(5745, 0),
+                        /* Data[0].ctledges[7].bchannel */ FREQ2FBIN(5825, 0)
+                },
+                {
+                        /* Data[1].ctledges[0].bchannel */ FREQ2FBIN(5180, 0),
+                        /* Data[1].ctledges[1].bchannel */ FREQ2FBIN(5260, 0),
+                        /* Data[1].ctledges[2].bchannel */ FREQ2FBIN(5280, 0),
+                        /* Data[1].ctledges[3].bchannel */ FREQ2FBIN(5500, 0),
+                        /* Data[1].ctledges[4].bchannel */ FREQ2FBIN(5520, 0),
+                        /* Data[1].ctledges[5].bchannel */ FREQ2FBIN(5700, 0),
+                        /* Data[1].ctledges[6].bchannel */ FREQ2FBIN(5745, 0),
+                        /* Data[1].ctledges[7].bchannel */ FREQ2FBIN(5825, 0)
+                },
+
+                {
+                        /* Data[2].ctledges[0].bchannel */ FREQ2FBIN(5190, 0),
+                        /* Data[2].ctledges[1].bchannel */ FREQ2FBIN(5230, 0),
+                        /* Data[2].ctledges[2].bchannel */ FREQ2FBIN(5270, 0),
+                        /* Data[2].ctledges[3].bchannel */ FREQ2FBIN(5310, 0),
+                        /* Data[2].ctledges[4].bchannel */ FREQ2FBIN(5510, 0),
+                        /* Data[2].ctledges[5].bchannel */ FREQ2FBIN(5550, 0),
+                        /* Data[2].ctledges[6].bchannel */ FREQ2FBIN(5670, 0),
+                        /* Data[2].ctledges[7].bchannel */ FREQ2FBIN(5755, 0)
+                },
+
+                {
+                        /* Data[3].ctledges[0].bchannel */ FREQ2FBIN(5180, 0),
+                        /* Data[3].ctledges[1].bchannel */ FREQ2FBIN(5200, 0),
+                        /* Data[3].ctledges[2].bchannel */ FREQ2FBIN(5260, 0),
+                        /* Data[3].ctledges[3].bchannel */ FREQ2FBIN(5320, 0),
+                        /* Data[3].ctledges[4].bchannel */ FREQ2FBIN(5500, 0),
+                        /* Data[3].ctledges[5].bchannel */ FREQ2FBIN(5700, 0),
+                        /* Data[3].ctledges[6].bchannel */ 0xFF,
+                        /* Data[3].ctledges[7].bchannel */ 0xFF,
+                },
+
+                {
+                        /* Data[4].ctledges[0].bchannel */ FREQ2FBIN(5180, 0),
+                        /* Data[4].ctledges[1].bchannel */ FREQ2FBIN(5260, 0),
+                        /* Data[4].ctledges[2].bchannel */ FREQ2FBIN(5500, 0),
+                        /* Data[4].ctledges[3].bchannel */ FREQ2FBIN(5700, 0),
+                        /* Data[4].ctledges[4].bchannel */ 0xFF,
+                        /* Data[4].ctledges[5].bchannel */ 0xFF,
+                        /* Data[4].ctledges[6].bchannel */ 0xFF,
+                        /* Data[4].ctledges[7].bchannel */ 0xFF,
+                },
+
+                {
+                        /* Data[5].ctledges[0].bchannel */ FREQ2FBIN(5190, 0),
+                        /* Data[5].ctledges[1].bchannel */ FREQ2FBIN(5270, 0),
+                        /* Data[5].ctledges[2].bchannel */ FREQ2FBIN(5310, 0),
+                        /* Data[5].ctledges[3].bchannel */ FREQ2FBIN(5510, 0),
+                        /* Data[5].ctledges[4].bchannel */ FREQ2FBIN(5590, 0),
+                        /* Data[5].ctledges[5].bchannel */ FREQ2FBIN(5670, 0),
+                        /* Data[5].ctledges[6].bchannel */ 0xFF,
+                        /* Data[5].ctledges[7].bchannel */ 0xFF
+                },
+
+                {
+                        /* Data[6].ctledges[0].bchannel */ FREQ2FBIN(5180, 0),
+                        /* Data[6].ctledges[1].bchannel */ FREQ2FBIN(5200, 0),
+                        /* Data[6].ctledges[2].bchannel */ FREQ2FBIN(5220, 0),
+                        /* Data[6].ctledges[3].bchannel */ FREQ2FBIN(5260, 0),
+                        /* Data[6].ctledges[4].bchannel */ FREQ2FBIN(5500, 0),
+                        /* Data[6].ctledges[5].bchannel */ FREQ2FBIN(5600, 0),
+                        /* Data[6].ctledges[6].bchannel */ FREQ2FBIN(5700, 0),
+                        /* Data[6].ctledges[7].bchannel */ FREQ2FBIN(5745, 0)
+                },
+
+                {
+                        /* Data[7].ctledges[0].bchannel */ FREQ2FBIN(5180, 0),
+                        /* Data[7].ctledges[1].bchannel */ FREQ2FBIN(5260, 0),
+                        /* Data[7].ctledges[2].bchannel */ FREQ2FBIN(5320, 0),
+                        /* Data[7].ctledges[3].bchannel */ FREQ2FBIN(5500, 0),
+                        /* Data[7].ctledges[4].bchannel */ FREQ2FBIN(5560, 0),
+                        /* Data[7].ctledges[5].bchannel */ FREQ2FBIN(5700, 0),
+                        /* Data[7].ctledges[6].bchannel */ FREQ2FBIN(5745, 0),
+                        /* Data[7].ctledges[7].bchannel */ FREQ2FBIN(5825, 0)
+                },
+
+                {
+                        /* Data[8].ctledges[0].bchannel */ FREQ2FBIN(5190, 0),
+                        /* Data[8].ctledges[1].bchannel */ FREQ2FBIN(5230, 0),
+                        /* Data[8].ctledges[2].bchannel */ FREQ2FBIN(5270, 0),
+                        /* Data[8].ctledges[3].bchannel */ FREQ2FBIN(5510, 0),
+                        /* Data[8].ctledges[4].bchannel */ FREQ2FBIN(5550, 0),
+                        /* Data[8].ctledges[5].bchannel */ FREQ2FBIN(5670, 0),
+                        /* Data[8].ctledges[6].bchannel */ FREQ2FBIN(5755, 0),
+                        /* Data[8].ctledges[7].bchannel */ FREQ2FBIN(5795, 0)
+                }
+        },
+        .ctlPowerData_5G = {
+                {
+                        {
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
+                        }
+                },
+                {
+                        {
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
+                        }
+                },
+                {
+                        {
+                                CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                        }
+                },
+                {
+                        {
+                                CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 0),
+                                CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 0),
+                        }
+                },
+                {
+                        {
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
+                                CTL(60, 0), CTL(60, 0), CTL(60, 0), CTL(60, 0),
+                        }
+                },
+                {
+                        {
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 0),
+                        }
+                },
+                {
+                        {
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                        }
+                },
+                {
+                        {
+                                CTL(60, 1), CTL(60, 1), CTL(60, 0), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
+                        }
+                },
+                {
+                        {
+                                CTL(60, 1), CTL(60, 0), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 0), CTL(60, 1),
+                        }
+                },
+        }
+};
+
+static const struct ar9300_eeprom ar9300_h116 = {
+        .eepromVersion = 2,
+        .templateVersion = 4,
+        .macAddr = {0x00, 0x03, 0x7f, 0x0, 0x0, 0x0},
+        .custData = {"h116-041-f0000"},
+        .baseEepHeader = {
+                .regDmn = { LE16(0), LE16(0x1f) },
+                .txrxMask =  0x33, /* 4 bits tx and 4 bits rx */
+                .opCapFlags = {
+                        .opFlags = AR9300_OPFLAGS_11G | AR9300_OPFLAGS_11A,
+                        .eepMisc = 0,
+                },
+                .rfSilent = 0,
+                .blueToothOptions = 0,
+                .deviceCap = 0,
+                .deviceType = 5, /* takes lower byte in eeprom location */
+                .pwrTableOffset = AR9300_PWR_TABLE_OFFSET,
+                .params_for_tuning_caps = {0, 0},
+                .featureEnable = 0x0d,
+                 /*
+                  * bit0 - enable tx temp comp - disabled
+                  * bit1 - enable tx volt comp - disabled
+                  * bit2 - enable fastClock - enabled
+                  * bit3 - enable doubling - enabled
+                  * bit4 - enable internal regulator - disabled
+                  * bit5 - enable pa predistortion - disabled
+                  */
+                .miscConfiguration = 0, /* bit0 - turn down drivestrength */
+                .eepromWriteEnableGpio = 6,
+                .wlanDisableGpio = 0,
+                .wlanLedGpio = 8,
+                .rxBandSelectGpio = 0xff,
+                .txrxgain = 0x10,
+                .swreg = 0,
+         },
+        .modalHeader2G = {
+        /* ar9300_modal_eep_header  2g */
+                /* 4 idle,t1,t2,b(4 bits per setting) */
+                .antCtrlCommon = LE32(0x110),
+                /* 4 ra1l1, ra2l1, ra1l2, ra2l2, ra12 */
+                .antCtrlCommon2 = LE32(0x44444),
+
+                /*
+                 * antCtrlChain[AR9300_MAX_CHAINS]; 6 idle, t, r,
+                 * rx1, rx12, b (2 bits each)
+                 */
+                .antCtrlChain = { LE16(0x10), LE16(0x10), LE16(0x10) },
+
+                /*
+                 * xatten1DB[AR9300_MAX_CHAINS];  3 xatten1_db
+                 * for ar9280 (0xa20c/b20c 5:0)
+                 */
+                .xatten1DB = {0x1f, 0x1f, 0x1f},
+
+                /*
+                 * xatten1Margin[AR9300_MAX_CHAINS]; 3 xatten1_margin
+                 * for ar9280 (0xa20c/b20c 16:12
+                 */
+                .xatten1Margin = {0x12, 0x12, 0x12},
+                .tempSlope = 25,
+                .voltSlope = 0,
+
+                /*
+                 * spurChans[OSPREY_EEPROM_MODAL_SPURS]; spur
+                 * channels in usual fbin coding format
+                 */
+                .spurChans = {FREQ2FBIN(2464, 1), 0, 0, 0, 0},
+
+                /*
+                 * noiseFloorThreshCh[AR9300_MAX_CHAINS]; 3 Check
+                 * if the register is per chain
+                 */
+                .noiseFloorThreshCh = {-1, 0, 0},
+                .ob = {1, 1, 1},/* 3 chain */
+                .db_stage2 = {1, 1, 1}, /* 3 chain  */
+                .db_stage3 = {0, 0, 0},
+                .db_stage4 = {0, 0, 0},
+                .xpaBiasLvl = 0,
+                .txFrameToDataStart = 0x0e,
+                .txFrameToPaOn = 0x0e,
+                .txClip = 3, /* 4 bits tx_clip, 4 bits dac_scale_cck */
+                .antennaGain = 0,
+                .switchSettling = 0x2c,
+                .adcDesiredSize = -30,
+                .txEndToXpaOff = 0,
+                .txEndToRxOn = 0x2,
+                .txFrameToXpaOn = 0xe,
+                .thresh62 = 28,
+                .papdRateMaskHt20 = LE32(0x0c80C080),
+                .papdRateMaskHt40 = LE32(0x0080C080),
+                .futureModal = {
+                        0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+                },
+         },
+         .base_ext1 = {
+                .ant_div_control = 0,
+                .future = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}
+         },
+        .calFreqPier2G = {
+                FREQ2FBIN(2412, 1),
+                FREQ2FBIN(2437, 1),
+                FREQ2FBIN(2472, 1),
+         },
+        /* ar9300_cal_data_per_freq_op_loop 2g */
+        .calPierData2G = {
+                { {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0, 0} },
+                { {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0, 0} },
+                { {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0, 0} },
+         },
+        .calTarget_freqbin_Cck = {
+                FREQ2FBIN(2412, 1),
+                FREQ2FBIN(2472, 1),
+         },
+        .calTarget_freqbin_2G = {
+                FREQ2FBIN(2412, 1),
+                FREQ2FBIN(2437, 1),
+                FREQ2FBIN(2472, 1)
+         },
+        .calTarget_freqbin_2GHT20 = {
+                FREQ2FBIN(2412, 1),
+                FREQ2FBIN(2437, 1),
+                FREQ2FBIN(2472, 1)
+         },
+        .calTarget_freqbin_2GHT40 = {
+                FREQ2FBIN(2412, 1),
+                FREQ2FBIN(2437, 1),
+                FREQ2FBIN(2472, 1)
+         },
+        .calTargetPowerCck = {
+                 /* 1L-5L,5S,11L,11S */
+                 { {34, 34, 34, 34} },
+                 { {34, 34, 34, 34} },
+        },
+        .calTargetPower2G = {
+                 /* 6-24,36,48,54 */
+                 { {34, 34, 32, 32} },
+                 { {34, 34, 32, 32} },
+                 { {34, 34, 32, 32} },
+        },
+        .calTargetPower2GHT20 = {
+                { {32, 32, 32, 32, 32, 30, 32, 32, 30, 28, 0, 0, 0, 0} },
+                { {32, 32, 32, 32, 32, 30, 32, 32, 30, 28, 0, 0, 0, 0} },
+                { {32, 32, 32, 32, 32, 30, 32, 32, 30, 28, 0, 0, 0, 0} },
+        },
+        .calTargetPower2GHT40 = {
+                { {30, 30, 30, 30, 30, 28, 30, 30, 28, 26, 0, 0, 0, 0} },
+                { {30, 30, 30, 30, 30, 28, 30, 30, 28, 26, 0, 0, 0, 0} },
+                { {30, 30, 30, 30, 30, 28, 30, 30, 28, 26, 0, 0, 0, 0} },
+        },
+        .ctlIndex_2G =  {
+                0x11, 0x12, 0x15, 0x17, 0x41, 0x42,
+                0x45, 0x47, 0x31, 0x32, 0x35, 0x37,
+        },
+        .ctl_freqbin_2G = {
+                {
+                        FREQ2FBIN(2412, 1),
+                        FREQ2FBIN(2417, 1),
+                        FREQ2FBIN(2457, 1),
+                        FREQ2FBIN(2462, 1)
+                },
+                {
+                        FREQ2FBIN(2412, 1),
+                        FREQ2FBIN(2417, 1),
+                        FREQ2FBIN(2462, 1),
+                        0xFF,
+                },
+
+                {
+                        FREQ2FBIN(2412, 1),
+                        FREQ2FBIN(2417, 1),
+                        FREQ2FBIN(2462, 1),
+                        0xFF,
+                },
+                {
+                        FREQ2FBIN(2422, 1),
+                        FREQ2FBIN(2427, 1),
+                        FREQ2FBIN(2447, 1),
+                        FREQ2FBIN(2452, 1)
+                },
+
+                {
+                        /* Data[4].ctlEdges[0].bChannel */ FREQ2FBIN(2412, 1),
+                        /* Data[4].ctlEdges[1].bChannel */ FREQ2FBIN(2417, 1),
+                        /* Data[4].ctlEdges[2].bChannel */ FREQ2FBIN(2472, 1),
+                        /* Data[4].ctlEdges[3].bChannel */ FREQ2FBIN(2484, 1),
+                },
+
+                {
+                        /* Data[5].ctlEdges[0].bChannel */ FREQ2FBIN(2412, 1),
+                        /* Data[5].ctlEdges[1].bChannel */ FREQ2FBIN(2417, 1),
+                        /* Data[5].ctlEdges[2].bChannel */ FREQ2FBIN(2472, 1),
+                        0,
+                },
+
+                {
+                        /* Data[6].ctlEdges[0].bChannel */ FREQ2FBIN(2412, 1),
+                        /* Data[6].ctlEdges[1].bChannel */ FREQ2FBIN(2417, 1),
+                        FREQ2FBIN(2472, 1),
+                        0,
+                },
+
+                {
+                        /* Data[7].ctlEdges[0].bChannel */ FREQ2FBIN(2422, 1),
+                        /* Data[7].ctlEdges[1].bChannel */ FREQ2FBIN(2427, 1),
+                        /* Data[7].ctlEdges[2].bChannel */ FREQ2FBIN(2447, 1),
+                        /* Data[7].ctlEdges[3].bChannel */ FREQ2FBIN(2462, 1),
+                },
+
+                {
+                        /* Data[8].ctlEdges[0].bChannel */ FREQ2FBIN(2412, 1),
+                        /* Data[8].ctlEdges[1].bChannel */ FREQ2FBIN(2417, 1),
+                        /* Data[8].ctlEdges[2].bChannel */ FREQ2FBIN(2472, 1),
+                },
+
+                {
+                        /* Data[9].ctlEdges[0].bChannel */ FREQ2FBIN(2412, 1),
+                        /* Data[9].ctlEdges[1].bChannel */ FREQ2FBIN(2417, 1),
+                        /* Data[9].ctlEdges[2].bChannel */ FREQ2FBIN(2472, 1),
+                        0
+                },
+
+                {
+                        /* Data[10].ctlEdges[0].bChannel */ FREQ2FBIN(2412, 1),
+                        /* Data[10].ctlEdges[1].bChannel */ FREQ2FBIN(2417, 1),
+                        /* Data[10].ctlEdges[2].bChannel */ FREQ2FBIN(2472, 1),
+                        0
+                },
+
+                {
+                        /* Data[11].ctlEdges[0].bChannel */ FREQ2FBIN(2422, 1),
+                        /* Data[11].ctlEdges[1].bChannel */ FREQ2FBIN(2427, 1),
+                        /* Data[11].ctlEdges[2].bChannel */ FREQ2FBIN(2447, 1),
+                        /* Data[11].ctlEdges[3].bChannel */ FREQ2FBIN(2462, 1),
+                }
+         },
+        .ctlPowerData_2G = {
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                 { { CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 1) } },
+
+                 { { CTL(60, 1), CTL(60, 0), CTL(0, 0), CTL(0, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 1) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 1) } },
+         },
+        .modalHeader5G = {
+                /* 4 idle,t1,t2,b (4 bits per setting) */
+                .antCtrlCommon = LE32(0x220),
+                /* 4 ra1l1, ra2l1, ra1l2,ra2l2,ra12 */
+                .antCtrlCommon2 = LE32(0x44444),
+                 /* antCtrlChain 6 idle, t,r,rx1,rx12,b (2 bits each) */
+                .antCtrlChain = {
+                        LE16(0x150), LE16(0x150), LE16(0x150),
+                },
+                 /* xatten1DB 3 xatten1_db for AR9280 (0xa20c/b20c 5:0) */
+                .xatten1DB = {0x19, 0x19, 0x19},
+
+                /*
+                 * xatten1Margin[AR9300_MAX_CHAINS]; 3 xatten1_margin
+                 * for merlin (0xa20c/b20c 16:12
+                 */
+                .xatten1Margin = {0x14, 0x14, 0x14},
+                .tempSlope = 70,
+                .voltSlope = 0,
+                /* spurChans spur channels in usual fbin coding format */
+                .spurChans = {0, 0, 0, 0, 0},
+                /* noiseFloorThreshCh Check if the register is per chain */
+                .noiseFloorThreshCh = {-1, 0, 0},
+                .ob = {3, 3, 3}, /* 3 chain */
+                .db_stage2 = {3, 3, 3}, /* 3 chain */
+                .db_stage3 = {3, 3, 3}, /* doesn't exist for 2G */
+                .db_stage4 = {3, 3, 3},  /* don't exist for 2G */
+                .xpaBiasLvl = 0,
+                .txFrameToDataStart = 0x0e,
+                .txFrameToPaOn = 0x0e,
+                .txClip = 3, /* 4 bits tx_clip, 4 bits dac_scale_cck */
+                .antennaGain = 0,
+                .switchSettling = 0x2d,
+                .adcDesiredSize = -30,
+                .txEndToXpaOff = 0,
+                .txEndToRxOn = 0x2,
+                .txFrameToXpaOn = 0xe,
+                .thresh62 = 28,
+                .papdRateMaskHt20 = LE32(0x0cf0e0e0),
+                .papdRateMaskHt40 = LE32(0x6cf0e0e0),
+                .futureModal = {
+                        0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+                },
+         },
+        .base_ext2 = {
+                .tempSlopeLow = 35,
+                .tempSlopeHigh = 50,
+                .xatten1DBLow = {0, 0, 0},
+                .xatten1MarginLow = {0, 0, 0},
+                .xatten1DBHigh = {0, 0, 0},
+                .xatten1MarginHigh = {0, 0, 0}
+         },
+        .calFreqPier5G = {
+                FREQ2FBIN(5180, 0),
+                FREQ2FBIN(5220, 0),
+                FREQ2FBIN(5320, 0),
+                FREQ2FBIN(5400, 0),
+                FREQ2FBIN(5500, 0),
+                FREQ2FBIN(5600, 0),
+                FREQ2FBIN(5700, 0),
+                FREQ2FBIN(5785, 0)
+        },
+        .calPierData5G = {
+                        {
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                        },
+                        {
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                        },
+                        {
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                        },
+
+        },
+        .calTarget_freqbin_5G = {
+                FREQ2FBIN(5180, 0),
+                FREQ2FBIN(5240, 0),
+                FREQ2FBIN(5320, 0),
+                FREQ2FBIN(5400, 0),
+                FREQ2FBIN(5500, 0),
+                FREQ2FBIN(5600, 0),
+                FREQ2FBIN(5700, 0),
+                FREQ2FBIN(5825, 0)
+        },
+        .calTarget_freqbin_5GHT20 = {
+                FREQ2FBIN(5180, 0),
+                FREQ2FBIN(5240, 0),
+                FREQ2FBIN(5320, 0),
+                FREQ2FBIN(5400, 0),
+                FREQ2FBIN(5500, 0),
+                FREQ2FBIN(5700, 0),
+                FREQ2FBIN(5745, 0),
+                FREQ2FBIN(5825, 0)
+        },
+        .calTarget_freqbin_5GHT40 = {
+                FREQ2FBIN(5180, 0),
+                FREQ2FBIN(5240, 0),
+                FREQ2FBIN(5320, 0),
+                FREQ2FBIN(5400, 0),
+                FREQ2FBIN(5500, 0),
+                FREQ2FBIN(5700, 0),
+                FREQ2FBIN(5745, 0),
+                FREQ2FBIN(5825, 0)
+         },
+        .calTargetPower5G = {
+                /* 6-24,36,48,54 */
+                { {30, 30, 28, 24} },
+                { {30, 30, 28, 24} },
+                { {30, 30, 28, 24} },
+                { {30, 30, 28, 24} },
+                { {30, 30, 28, 24} },
+                { {30, 30, 28, 24} },
+                { {30, 30, 28, 24} },
+                { {30, 30, 28, 24} },
+         },
+        .calTargetPower5GHT20 = {
+                /*
+                 * 0_8_16,1-3_9-11_17-19,
+                 * 4,5,6,7,12,13,14,15,20,21,22,23
+                 */
+                { {30, 30, 30, 28, 24, 20, 30, 28, 24, 20, 0, 0, 0, 0} },
+                { {30, 30, 30, 28, 24, 20, 30, 28, 24, 20, 0, 0, 0, 0} },
+                { {30, 30, 30, 26, 22, 18, 30, 26, 22, 18, 0, 0, 0, 0} },
+                { {30, 30, 30, 26, 22, 18, 30, 26, 22, 18, 0, 0, 0, 0} },
+                { {30, 30, 30, 24, 20, 16, 30, 24, 20, 16, 0, 0, 0, 0} },
+                { {30, 30, 30, 24, 20, 16, 30, 24, 20, 16, 0, 0, 0, 0} },
+                { {30, 30, 30, 22, 18, 14, 30, 22, 18, 14, 0, 0, 0, 0} },
+                { {30, 30, 30, 22, 18, 14, 30, 22, 18, 14, 0, 0, 0, 0} },
+         },
+        .calTargetPower5GHT40 =  {
+                /*
+                 * 0_8_16,1-3_9-11_17-19,
+                 * 4,5,6,7,12,13,14,15,20,21,22,23
+                 */
+                { {28, 28, 28, 26, 22, 18, 28, 26, 22, 18, 0, 0, 0, 0} },
+                { {28, 28, 28, 26, 22, 18, 28, 26, 22, 18, 0, 0, 0, 0} },
+                { {28, 28, 28, 24, 20, 16, 28, 24, 20, 16, 0, 0, 0, 0} },
+                { {28, 28, 28, 24, 20, 16, 28, 24, 20, 16, 0, 0, 0, 0} },
+                { {28, 28, 28, 22, 18, 14, 28, 22, 18, 14, 0, 0, 0, 0} },
+                { {28, 28, 28, 22, 18, 14, 28, 22, 18, 14, 0, 0, 0, 0} },
+                { {28, 28, 28, 20, 16, 12, 28, 20, 16, 12, 0, 0, 0, 0} },
+                { {28, 28, 28, 20, 16, 12, 28, 20, 16, 12, 0, 0, 0, 0} },
+         },
+        .ctlIndex_5G =  {
+                0x10, 0x16, 0x18, 0x40, 0x46,
+                0x48, 0x30, 0x36, 0x38
+        },
+        .ctl_freqbin_5G =  {
+                {
+                        /* Data[0].ctlEdges[0].bChannel */ FREQ2FBIN(5180, 0),
+                        /* Data[0].ctlEdges[1].bChannel */ FREQ2FBIN(5260, 0),
+                        /* Data[0].ctlEdges[2].bChannel */ FREQ2FBIN(5280, 0),
+                        /* Data[0].ctlEdges[3].bChannel */ FREQ2FBIN(5500, 0),
+                        /* Data[0].ctlEdges[4].bChannel */ FREQ2FBIN(5600, 0),
+                        /* Data[0].ctlEdges[5].bChannel */ FREQ2FBIN(5700, 0),
+                        /* Data[0].ctlEdges[6].bChannel */ FREQ2FBIN(5745, 0),
+                        /* Data[0].ctlEdges[7].bChannel */ FREQ2FBIN(5825, 0)
+                },
+                {
+                        /* Data[1].ctlEdges[0].bChannel */ FREQ2FBIN(5180, 0),
+                        /* Data[1].ctlEdges[1].bChannel */ FREQ2FBIN(5260, 0),
+                        /* Data[1].ctlEdges[2].bChannel */ FREQ2FBIN(5280, 0),
+                        /* Data[1].ctlEdges[3].bChannel */ FREQ2FBIN(5500, 0),
+                        /* Data[1].ctlEdges[4].bChannel */ FREQ2FBIN(5520, 0),
+                        /* Data[1].ctlEdges[5].bChannel */ FREQ2FBIN(5700, 0),
+                        /* Data[1].ctlEdges[6].bChannel */ FREQ2FBIN(5745, 0),
+                        /* Data[1].ctlEdges[7].bChannel */ FREQ2FBIN(5825, 0)
+                },
+
+                {
+                        /* Data[2].ctlEdges[0].bChannel */ FREQ2FBIN(5190, 0),
+                        /* Data[2].ctlEdges[1].bChannel */ FREQ2FBIN(5230, 0),
+                        /* Data[2].ctlEdges[2].bChannel */ FREQ2FBIN(5270, 0),
+                        /* Data[2].ctlEdges[3].bChannel */ FREQ2FBIN(5310, 0),
+                        /* Data[2].ctlEdges[4].bChannel */ FREQ2FBIN(5510, 0),
+                        /* Data[2].ctlEdges[5].bChannel */ FREQ2FBIN(5550, 0),
+                        /* Data[2].ctlEdges[6].bChannel */ FREQ2FBIN(5670, 0),
+                        /* Data[2].ctlEdges[7].bChannel */ FREQ2FBIN(5755, 0)
+                },
+
+                {
+                        /* Data[3].ctlEdges[0].bChannel */ FREQ2FBIN(5180, 0),
+                        /* Data[3].ctlEdges[1].bChannel */ FREQ2FBIN(5200, 0),
+                        /* Data[3].ctlEdges[2].bChannel */ FREQ2FBIN(5260, 0),
+                        /* Data[3].ctlEdges[3].bChannel */ FREQ2FBIN(5320, 0),
+                        /* Data[3].ctlEdges[4].bChannel */ FREQ2FBIN(5500, 0),
+                        /* Data[3].ctlEdges[5].bChannel */ FREQ2FBIN(5700, 0),
+                        /* Data[3].ctlEdges[6].bChannel */ 0xFF,
+                        /* Data[3].ctlEdges[7].bChannel */ 0xFF,
+                },
+
+                {
+                        /* Data[4].ctlEdges[0].bChannel */ FREQ2FBIN(5180, 0),
+                        /* Data[4].ctlEdges[1].bChannel */ FREQ2FBIN(5260, 0),
+                        /* Data[4].ctlEdges[2].bChannel */ FREQ2FBIN(5500, 0),
+                        /* Data[4].ctlEdges[3].bChannel */ FREQ2FBIN(5700, 0),
+                        /* Data[4].ctlEdges[4].bChannel */ 0xFF,
+                        /* Data[4].ctlEdges[5].bChannel */ 0xFF,
+                        /* Data[4].ctlEdges[6].bChannel */ 0xFF,
+                        /* Data[4].ctlEdges[7].bChannel */ 0xFF,
+                },
+
+                {
+                        /* Data[5].ctlEdges[0].bChannel */ FREQ2FBIN(5190, 0),
+                        /* Data[5].ctlEdges[1].bChannel */ FREQ2FBIN(5270, 0),
+                        /* Data[5].ctlEdges[2].bChannel */ FREQ2FBIN(5310, 0),
+                        /* Data[5].ctlEdges[3].bChannel */ FREQ2FBIN(5510, 0),
+                        /* Data[5].ctlEdges[4].bChannel */ FREQ2FBIN(5590, 0),
+                        /* Data[5].ctlEdges[5].bChannel */ FREQ2FBIN(5670, 0),
+                        /* Data[5].ctlEdges[6].bChannel */ 0xFF,
+                        /* Data[5].ctlEdges[7].bChannel */ 0xFF
+                },
+
+                {
+                        /* Data[6].ctlEdges[0].bChannel */ FREQ2FBIN(5180, 0),
+                        /* Data[6].ctlEdges[1].bChannel */ FREQ2FBIN(5200, 0),
+                        /* Data[6].ctlEdges[2].bChannel */ FREQ2FBIN(5220, 0),
+                        /* Data[6].ctlEdges[3].bChannel */ FREQ2FBIN(5260, 0),
+                        /* Data[6].ctlEdges[4].bChannel */ FREQ2FBIN(5500, 0),
+                        /* Data[6].ctlEdges[5].bChannel */ FREQ2FBIN(5600, 0),
+                        /* Data[6].ctlEdges[6].bChannel */ FREQ2FBIN(5700, 0),
+                        /* Data[6].ctlEdges[7].bChannel */ FREQ2FBIN(5745, 0)
+                },
+
+                {
+                        /* Data[7].ctlEdges[0].bChannel */ FREQ2FBIN(5180, 0),
+                        /* Data[7].ctlEdges[1].bChannel */ FREQ2FBIN(5260, 0),
+                        /* Data[7].ctlEdges[2].bChannel */ FREQ2FBIN(5320, 0),
+                        /* Data[7].ctlEdges[3].bChannel */ FREQ2FBIN(5500, 0),
+                        /* Data[7].ctlEdges[4].bChannel */ FREQ2FBIN(5560, 0),
+                        /* Data[7].ctlEdges[5].bChannel */ FREQ2FBIN(5700, 0),
+                        /* Data[7].ctlEdges[6].bChannel */ FREQ2FBIN(5745, 0),
+                        /* Data[7].ctlEdges[7].bChannel */ FREQ2FBIN(5825, 0)
+                },
+
+                {
+                        /* Data[8].ctlEdges[0].bChannel */ FREQ2FBIN(5190, 0),
+                        /* Data[8].ctlEdges[1].bChannel */ FREQ2FBIN(5230, 0),
+                        /* Data[8].ctlEdges[2].bChannel */ FREQ2FBIN(5270, 0),
+                        /* Data[8].ctlEdges[3].bChannel */ FREQ2FBIN(5510, 0),
+                        /* Data[8].ctlEdges[4].bChannel */ FREQ2FBIN(5550, 0),
+                        /* Data[8].ctlEdges[5].bChannel */ FREQ2FBIN(5670, 0),
+                        /* Data[8].ctlEdges[6].bChannel */ FREQ2FBIN(5755, 0),
+                        /* Data[8].ctlEdges[7].bChannel */ FREQ2FBIN(5795, 0)
+                }
+         },
+        .ctlPowerData_5G = {
+                {
+                        {
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
+                        }
+                },
+                {
+                        {
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
+                        }
+                },
+                {
+                        {
+                                CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                        }
+                },
+                {
+                        {
+                                CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 0),
+                                CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 0),
+                        }
+                },
+                {
+                        {
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
+                                CTL(60, 0), CTL(60, 0), CTL(60, 0), CTL(60, 0),
+                        }
+                },
+                {
+                        {
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 0),
+                        }
+                },
+                {
+                        {
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                        }
+                },
+                {
+                        {
+                                CTL(60, 1), CTL(60, 1), CTL(60, 0), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
+                        }
+                },
+                {
+                        {
+                                CTL(60, 1), CTL(60, 0), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 0), CTL(60, 1),
+                        }
+                },
+         }
+};
+
+
+static const struct ar9300_eeprom *ar9300_eep_templates[] = {
+        &ar9300_default,
+        &ar9300_x112,
+        &ar9300_h116,
+        &ar9300_h112,
+        &ar9300_x113,
+};
+
+static const struct ar9300_eeprom *ar9003_eeprom_struct_find_by_id(int id)
+{
+#define N_LOOP (sizeof(ar9300_eep_templates) / sizeof(ar9300_eep_templates[0]))
+        int it;
+
+        for (it = 0; it < N_LOOP; it++)
+                if (ar9300_eep_templates[it]->templateVersion == id)
+                        return ar9300_eep_templates[it];
+        return NULL;
+#undef N_LOOP
+}
+
+
 static u16 ath9k_hw_fbin2freq(u8 fbin, bool is2GHz)
 {
         if (fbin == AR9300_BCHAN_UNUSED)
@@ -639,6 +2985,16 @@ static int ath9k_hw_ar9300_check_eeprom(struct ath_hw *ah)
         return 0;
 }
 
+static int interpolate(int x, int xa, int xb, int ya, int yb)
+{
+        int bf, factor, plus;
+
+        bf = 2 * (yb - ya) * (x - xa) / (xb - xa);
+        factor = bf / 2;
+        plus = bf % 2;
+        return ya + factor + plus;
+}
+
 static u32 ath9k_hw_ar9300_get_eeprom(struct ath_hw *ah,
                                       enum eeprom_param param)
 {
@@ -751,6 +3107,36 @@ error:
         return false;
 }
 
+static bool ar9300_otp_read_word(struct ath_hw *ah, int addr, u32 *data)
+{
+        REG_READ(ah, AR9300_OTP_BASE + (4 * addr));
+
+        if (!ath9k_hw_wait(ah, AR9300_OTP_STATUS, AR9300_OTP_STATUS_TYPE,
+                           AR9300_OTP_STATUS_VALID, 1000))
+                return false;
+
+        *data = REG_READ(ah, AR9300_OTP_READ_DATA);
+        return true;
+}
+
+static bool ar9300_read_otp(struct ath_hw *ah, int address, u8 *buffer,
+                            int count)
+{
+        u32 data;
+        int i;
+
+        for (i = 0; i < count; i++) {
+                int offset = 8 * ((address - i) % 4);
+                if (!ar9300_otp_read_word(ah, (address - i) / 4, &data))
+                        return false;
+
+                buffer[i] = (data >> offset) & 0xff;
+        }
+
+        return true;
+}
+
+
 static void ar9300_comp_hdr_unpack(u8 *best, int *code, int *reference,
                                    int *length, int *major, int *minor)
 {
@@ -827,6 +3213,7 @@ static int ar9300_compress_decision(struct ath_hw *ah,
 {
         struct ath_common *common = ath9k_hw_common(ah);
         u8 *dptr;
+        const struct ar9300_eeprom *eep = NULL;
 
         switch (code) {
         case _CompressNone:
@@ -844,13 +3231,14 @@ static int ar9300_compress_decision(struct ath_hw *ah,
                 if (reference == 0) {
                         dptr = mptr;
                 } else {
-                        if (reference != 2) {
+                        eep = ar9003_eeprom_struct_find_by_id(reference);
+                        if (eep == NULL) {
                                 ath_print(common, ATH_DBG_EEPROM,
                                           "cant find reference eeprom"
                                           "struct %d\n", reference);
                                 return -1;
                         }
-                        memcpy(mptr, &ar9300_default, mdata_size);
+                        memcpy(mptr, eep, mdata_size);
                 }
                 ath_print(common, ATH_DBG_EEPROM,
                           "restore eeprom %d: block, reference %d,"
@@ -866,6 +3254,38 @@ static int ar9300_compress_decision(struct ath_hw *ah,
         return 0;
 }
 
+typedef bool (*eeprom_read_op)(struct ath_hw *ah, int address, u8 *buffer,
+                               int count);
+
+static bool ar9300_check_header(void *data)
+{
+        u32 *word = data;
+        return !(*word == 0 || *word == ~0);
+}
+
+static bool ar9300_check_eeprom_header(struct ath_hw *ah, eeprom_read_op read,
+                                       int base_addr)
+{
+        u8 header[4];
+
+        if (!read(ah, base_addr, header, 4))
+                return false;
+
+        return ar9300_check_header(header);
+}
+
+static int ar9300_eeprom_restore_flash(struct ath_hw *ah, u8 *mptr,
+                                       int mdata_size)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+        u16 *data = (u16 *) mptr;
+        int i;
+
+        for (i = 0; i < mdata_size / 2; i++, data++)
+                ath9k_hw_nvram_read(common, i, data);
+
+        return 0;
+}
 /*
  * Read the configuration data from the eeprom.
  * The data can be put in any specified memory buffer.
@@ -886,6 +3306,10 @@ static int ar9300_eeprom_restore_internal(struct ath_hw *ah,
         int it;
         u16 checksum, mchecksum;
         struct ath_common *common = ath9k_hw_common(ah);
+        eeprom_read_op read;
+
+        if (ath9k_hw_use_flash(ah))
+                return ar9300_eeprom_restore_flash(ah, mptr, mdata_size);
 
         word = kzalloc(2048, GFP_KERNEL);
         if (!word)
@@ -893,14 +3317,42 @@ static int ar9300_eeprom_restore_internal(struct ath_hw *ah,
 
         memcpy(mptr, &ar9300_default, mdata_size);
 
+        read = ar9300_read_eeprom;
         cptr = AR9300_BASE_ADDR;
+        ath_print(common, ATH_DBG_EEPROM,
+                "Trying EEPROM accesss at Address 0x%04x\n", cptr);
+        if (ar9300_check_eeprom_header(ah, read, cptr))
+                goto found;
+
+        cptr = AR9300_BASE_ADDR_512;
+        ath_print(common, ATH_DBG_EEPROM,
+                "Trying EEPROM accesss at Address 0x%04x\n", cptr);
+        if (ar9300_check_eeprom_header(ah, read, cptr))
+                goto found;
+
+        read = ar9300_read_otp;
+        cptr = AR9300_BASE_ADDR;
+        ath_print(common, ATH_DBG_EEPROM,
+                "Trying OTP accesss at Address 0x%04x\n", cptr);
+        if (ar9300_check_eeprom_header(ah, read, cptr))
+                goto found;
+
+        cptr = AR9300_BASE_ADDR_512;
+        ath_print(common, ATH_DBG_EEPROM,
+                "Trying OTP accesss at Address 0x%04x\n", cptr);
+        if (ar9300_check_eeprom_header(ah, read, cptr))
+                goto found;
+
+        goto fail;
+
+found:
+        ath_print(common, ATH_DBG_EEPROM, "Found valid EEPROM data");
+
         for (it = 0; it < MSTATE; it++) {
-                if (!ar9300_read_eeprom(ah, cptr, word, COMP_HDR_LEN))
+                if (!read(ah, cptr, word, COMP_HDR_LEN))
                         goto fail;
 
-                if ((word[0] == 0 && word[1] == 0 && word[2] == 0 &&
-                     word[3] == 0) || (word[0] == 0xff && word[1] == 0xff
-                                       && word[2] == 0xff && word[3] == 0xff))
+                if (!ar9300_check_header(word))
                         break;
 
                 ar9300_comp_hdr_unpack(word, &code, &reference,
@@ -917,8 +3369,7 @@ static int ar9300_eeprom_restore_internal(struct ath_hw *ah,
                 }
 
                 osize = length;
-                ar9300_read_eeprom(ah, cptr, word,
-                                   COMP_HDR_LEN + osize + COMP_CKSUM_LEN);
+                read(ah, cptr, word, COMP_HDR_LEN + osize + COMP_CKSUM_LEN);
                 checksum = ar9300_comp_cksum(&word[COMP_HDR_LEN], length);
                 mchecksum = word[COMP_HDR_LEN + osize] |
                     (word[COMP_HDR_LEN + osize + 1] << 8);
@@ -995,9 +3446,9 @@ static s32 ar9003_hw_xpa_bias_level_get(struct ath_hw *ah, bool is2ghz)
 static void ar9003_hw_xpa_bias_level_apply(struct ath_hw *ah, bool is2ghz)
 {
         int bias = ar9003_hw_xpa_bias_level_get(ah, is2ghz);
-        REG_RMW_FIELD(ah, AR_CH0_TOP, AR_CH0_TOP_XPABIASLVL, (bias & 0x3));
-        REG_RMW_FIELD(ah, AR_CH0_THERM, AR_CH0_THERM_SPARE,
-                      ((bias >> 2) & 0x3));
+        REG_RMW_FIELD(ah, AR_CH0_TOP, AR_CH0_TOP_XPABIASLVL, bias);
+        REG_RMW_FIELD(ah, AR_CH0_THERM, AR_CH0_THERM_XPABIASLVL_MSB, bias >> 2);
+        REG_RMW_FIELD(ah, AR_CH0_THERM, AR_CH0_THERM_XPASHORT2GND, 1);
 }
 
 static u32 ar9003_hw_ant_ctrl_common_get(struct ath_hw *ah, bool is2ghz)
@@ -1100,6 +3551,82 @@ static void ar9003_hw_drive_strength_apply(struct ath_hw *ah)
         REG_WRITE(ah, AR_PHY_65NM_CH0_BIAS4, reg);
 }
 
+static u16 ar9003_hw_atten_chain_get(struct ath_hw *ah, int chain,
+                                     struct ath9k_channel *chan)
+{
+        int f[3], t[3];
+        u16 value;
+        struct ar9300_eeprom *eep = &ah->eeprom.ar9300_eep;
+
+        if (chain >= 0 && chain < 3) {
+                if (IS_CHAN_2GHZ(chan))
+                        return eep->modalHeader2G.xatten1DB[chain];
+                else if (eep->base_ext2.xatten1DBLow[chain] != 0) {
+                        t[0] = eep->base_ext2.xatten1DBLow[chain];
+                        f[0] = 5180;
+                        t[1] = eep->modalHeader5G.xatten1DB[chain];
+                        f[1] = 5500;
+                        t[2] = eep->base_ext2.xatten1DBHigh[chain];
+                        f[2] = 5785;
+                        value = ar9003_hw_power_interpolate((s32) chan->channel,
+                                                            f, t, 3);
+                        return value;
+                } else
+                        return eep->modalHeader5G.xatten1DB[chain];
+        }
+
+        return 0;
+}
+
+
+static u16 ar9003_hw_atten_chain_get_margin(struct ath_hw *ah, int chain,
+                                            struct ath9k_channel *chan)
+{
+        int f[3], t[3];
+        u16 value;
+        struct ar9300_eeprom *eep = &ah->eeprom.ar9300_eep;
+
+        if (chain >= 0 && chain < 3) {
+                if (IS_CHAN_2GHZ(chan))
+                        return eep->modalHeader2G.xatten1Margin[chain];
+                else if (eep->base_ext2.xatten1MarginLow[chain] != 0) {
+                        t[0] = eep->base_ext2.xatten1MarginLow[chain];
+                        f[0] = 5180;
+                        t[1] = eep->modalHeader5G.xatten1Margin[chain];
+                        f[1] = 5500;
+                        t[2] = eep->base_ext2.xatten1MarginHigh[chain];
+                        f[2] = 5785;
+                        value = ar9003_hw_power_interpolate((s32) chan->channel,
+                                                            f, t, 3);
+                        return value;
+                } else
+                        return eep->modalHeader5G.xatten1Margin[chain];
+        }
+
+        return 0;
+}
+
+static void ar9003_hw_atten_apply(struct ath_hw *ah, struct ath9k_channel *chan)
+{
+        int i;
+        u16 value;
+        unsigned long ext_atten_reg[3] = {AR_PHY_EXT_ATTEN_CTL_0,
+                                          AR_PHY_EXT_ATTEN_CTL_1,
+                                          AR_PHY_EXT_ATTEN_CTL_2,
+                                         };
+
+        /* Test value. if 0 then attenuation is unused. Don't load anything. */
+        for (i = 0; i < 3; i++) {
+                value = ar9003_hw_atten_chain_get(ah, i, chan);
+                REG_RMW_FIELD(ah, ext_atten_reg[i],
+                              AR_PHY_EXT_ATTEN_CTL_XATTEN1_DB, value);
+
+                value = ar9003_hw_atten_chain_get_margin(ah, i, chan);
+                REG_RMW_FIELD(ah, ext_atten_reg[i],
+                              AR_PHY_EXT_ATTEN_CTL_XATTEN1_MARGIN, value);
+        }
+}
+
 static void ar9003_hw_internal_regulator_apply(struct ath_hw *ah)
 {
         int internal_regulator =
@@ -1131,6 +3658,7 @@ static void ath9k_hw_ar9300_set_board_values(struct ath_hw *ah,
         ar9003_hw_xpa_bias_level_apply(ah, IS_CHAN_2GHZ(chan));
         ar9003_hw_ant_ctrl_apply(ah, IS_CHAN_2GHZ(chan));
         ar9003_hw_drive_strength_apply(ah);
+        ar9003_hw_atten_apply(ah, chan);
         ar9003_hw_internal_regulator_apply(ah);
 }
 
@@ -1192,7 +3720,7 @@ static int ar9003_hw_power_interpolate(int32_t x,
                         if (hx == lx)
                                 y = ly;
                         else    /* interpolate  */
-                                y = ly + (((x - lx) * (hy - ly)) / (hx - lx));
+                                y = interpolate(x, lx, hx, ly, hy);
                 } else          /* only low is good, use it */
                         y = ly;
         } else if (hhave)       /* only high is good, use it */
@@ -1640,6 +4168,7 @@ static int ar9003_hw_power_control_override(struct ath_hw *ah,
 {
         int tempSlope = 0;
         struct ar9300_eeprom *eep = &ah->eeprom.ar9300_eep;
+        int f[3], t[3];
 
         REG_RMW(ah, AR_PHY_TPC_11_B0,
                 (correction[0] << AR_PHY_TPC_OLPC_GAIN_DELTA_S),
@@ -1668,7 +4197,16 @@ static int ar9003_hw_power_control_override(struct ath_hw *ah,
          */
         if (frequency < 4000)
                 tempSlope = eep->modalHeader2G.tempSlope;
-        else
+        else if (eep->base_ext2.tempSlopeLow != 0) {
+                t[0] = eep->base_ext2.tempSlopeLow;
+                f[0] = 5180;
+                t[1] = eep->modalHeader5G.tempSlope;
+                f[1] = 5500;
+                t[2] = eep->base_ext2.tempSlopeHigh;
+                f[2] = 5785;
+                tempSlope = ar9003_hw_power_interpolate((s32) frequency,
+                                                        f, t, 3);
+        } else
                 tempSlope = eep->modalHeader5G.tempSlope;
 
         REG_RMW_FIELD(ah, AR_PHY_TPC_19, AR_PHY_TPC_19_ALPHA_THERM, tempSlope);
@@ -1772,25 +4310,23 @@ static int ar9003_hw_calibration_apply(struct ath_hw *ah, int frequency)
                         /* so is the high frequency, interpolate */
                         if (hfrequency[ichain] - frequency < 1000) {
 
-                                correction[ichain] = lcorrection[ichain] +
-                                    (((frequency - lfrequency[ichain]) *
-                                      (hcorrection[ichain] -
-                                       lcorrection[ichain])) /
-                                     (hfrequency[ichain] - lfrequency[ichain]));
-
-                                temperature[ichain] = ltemperature[ichain] +
-                                    (((frequency - lfrequency[ichain]) *
-                                      (htemperature[ichain] -
-                                       ltemperature[ichain])) /
-                                     (hfrequency[ichain] - lfrequency[ichain]));
-
-                                voltage[ichain] =
-                                    lvoltage[ichain] +
-                                    (((frequency -
-                                       lfrequency[ichain]) * (hvoltage[ichain] -
-                                                              lvoltage[ichain]))
-                                     / (hfrequency[ichain] -
-                                        lfrequency[ichain]));
+                                correction[ichain] = interpolate(frequency,
+                                                lfrequency[ichain],
+                                                hfrequency[ichain],
+                                                lcorrection[ichain],
+                                                hcorrection[ichain]);
+
+                                temperature[ichain] = interpolate(frequency,
+                                                lfrequency[ichain],
+                                                hfrequency[ichain],
+                                                ltemperature[ichain],
+                                                htemperature[ichain]);
+
+                                voltage[ichain] = interpolate(frequency,
+                                                lfrequency[ichain],
+                                                hfrequency[ichain],
+                                                lvoltage[ichain],
+                                                hvoltage[ichain]);
                         }
                         /* only low is good, use it */
                         else {
@@ -1922,14 +4458,16 @@ static void ar9003_hw_set_power_per_rate_table(struct ath_hw *ah,
         int i;
         int16_t  twiceLargestAntenna;
         u16 scaledPower = 0, minCtlPower, maxRegAllowedPower;
-        u16 ctlModesFor11a[] = {
+        static const u16 ctlModesFor11a[] = {
                 CTL_11A, CTL_5GHT20, CTL_11A_EXT, CTL_5GHT40
         };
-        u16 ctlModesFor11g[] = {
+        static const u16 ctlModesFor11g[] = {
                 CTL_11B, CTL_11G, CTL_2GHT20, CTL_11B_EXT,
                 CTL_11G_EXT, CTL_2GHT40
         };
-        u16 numCtlModes, *pCtlMode, ctlMode, freq;
+        u16 numCtlModes;
+        const u16 *pCtlMode;
+        u16 ctlMode, freq;
         struct chan_centers centers;
         u8 *ctlIndex;
         u8 ctlNum;
@@ -2134,8 +4672,9 @@ static void ath9k_hw_ar9300_set_txpower(struct ath_hw *ah,
                                         struct ath9k_channel *chan, u16 cfgCtl,
                                         u8 twiceAntennaReduction,
                                         u8 twiceMaxRegulatoryPower,
-                                        u8 powerLimit)
+                                        u8 powerLimit, bool test)
 {
+        struct ath_regulatory *regulatory = ath9k_hw_regulatory(ah);
         struct ath_common *common = ath9k_hw_common(ah);
         u8 targetPowerValT2[ar9300RateSize];
         unsigned int i = 0;
@@ -2147,7 +4686,16 @@ static void ath9k_hw_ar9300_set_txpower(struct ath_hw *ah,
                                            twiceMaxRegulatoryPower,
                                            powerLimit);
 
-        while (i < ar9300RateSize) {
+        regulatory->max_power_level = 0;
+        for (i = 0; i < ar9300RateSize; i++) {
+                if (targetPowerValT2[i] > regulatory->max_power_level)
+                        regulatory->max_power_level = targetPowerValT2[i];
+        }
+
+        if (test)
+                return;
+
+        for (i = 0; i < ar9300RateSize; i++) {
                 ath_print(common, ATH_DBG_EEPROM,
                           "TPC[%02d] 0x%08x ", i, targetPowerValT2[i]);
                 i++;
@@ -2162,9 +4710,6 @@ static void ath9k_hw_ar9300_set_txpower(struct ath_hw *ah,
                 i++;
         }
 
-        /* Write target power array to registers */
-        ar9003_hw_tx_power_regwrite(ah, targetPowerValT2);
-
         /*
          * This is the TX power we send back to driver core,
          * and it can use to pass to userspace to display our
@@ -2183,7 +4728,10 @@ static void ath9k_hw_ar9300_set_txpower(struct ath_hw *ah,
                 i = ALL_TARGET_HT20_0_8_16; /* ht20 */
 
         ah->txpower_limit = targetPowerValT2[i];
+        regulatory->max_power_level = targetPowerValT2[i];
 
+        /* Write target power array to registers */
+        ar9003_hw_tx_power_regwrite(ah, targetPowerValT2);
         ar9003_hw_calibration_apply(ah, chan->channel);
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h
index 655b3033396..9c1463307f0 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h
@@ -79,6 +79,15 @@
 #define FIXED_CCA_THRESHOLD 15
 
 #define AR9300_BASE_ADDR 0x3ff
+#define AR9300_BASE_ADDR_512 0x1ff
+
+#define AR9300_OTP_BASE                 0x14000
+#define AR9300_OTP_STATUS               0x15f18
+#define AR9300_OTP_STATUS_TYPE          0x7
+#define AR9300_OTP_STATUS_VALID         0x4
+#define AR9300_OTP_STATUS_ACCESS_BUSY   0x2
+#define AR9300_OTP_STATUS_SM_BUSY       0x1
+#define AR9300_OTP_READ_DATA            0x15f1c
 
 enum targetPowerHTRates {
         HT_TARGET_RATE_0_8_16,
@@ -236,7 +245,7 @@ struct ar9300_modal_eep_header {
         u8 thresh62;
         __le32 papdRateMaskHt20;
         __le32 papdRateMaskHt40;
-        u8 futureModal[24];
+        u8 futureModal[10];
 } __packed;
 
 struct ar9300_cal_data_per_freq_op_loop {
@@ -269,6 +278,20 @@ struct cal_ctl_data_5g {
         u8 ctlEdges[AR9300_NUM_BAND_EDGES_5G];
 } __packed;
 
+struct ar9300_BaseExtension_1 {
+        u8 ant_div_control;
+        u8 future[13];
+} __packed;
+
+struct ar9300_BaseExtension_2 {
+        int8_t    tempSlopeLow;
+        int8_t    tempSlopeHigh;
+        u8   xatten1DBLow[AR9300_MAX_CHAINS];
+        u8   xatten1MarginLow[AR9300_MAX_CHAINS];
+        u8   xatten1DBHigh[AR9300_MAX_CHAINS];
+        u8   xatten1MarginHigh[AR9300_MAX_CHAINS];
+} __packed;
+
 struct ar9300_eeprom {
         u8 eepromVersion;
         u8 templateVersion;
@@ -278,6 +301,7 @@ struct ar9300_eeprom {
         struct ar9300_base_eep_hdr baseEepHeader;
 
         struct ar9300_modal_eep_header modalHeader2G;
+        struct ar9300_BaseExtension_1 base_ext1;
         u8 calFreqPier2G[AR9300_NUM_2G_CAL_PIERS];
         struct ar9300_cal_data_per_freq_op_loop
          calPierData2G[AR9300_MAX_CHAINS][AR9300_NUM_2G_CAL_PIERS];
@@ -297,6 +321,7 @@ struct ar9300_eeprom {
         u8 ctl_freqbin_2G[AR9300_NUM_CTLS_2G][AR9300_NUM_BAND_EDGES_2G];
         struct cal_ctl_data_2g ctlPowerData_2G[AR9300_NUM_CTLS_2G];
         struct ar9300_modal_eep_header modalHeader5G;
+        struct ar9300_BaseExtension_2 base_ext2;
         u8 calFreqPier5G[AR9300_NUM_5G_CAL_PIERS];
         struct ar9300_cal_data_per_freq_op_loop
          calPierData5G[AR9300_MAX_CHAINS][AR9300_NUM_5G_CAL_PIERS];
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_mac.c b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
index 3b424ca1ba8..f5896aa3000 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_mac.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
@@ -237,10 +237,12 @@ static int ar9003_hw_proc_txdesc(struct ath_hw *ah, void *ds,
                                  struct ath_tx_status *ts)
 {
         struct ar9003_txs *ads;
+        u32 status;
 
         ads = &ah->ts_ring[ah->ts_tail];
 
-        if ((ads->status8 & AR_TxDone) == 0)
+        status = ACCESS_ONCE(ads->status8);
+        if ((status & AR_TxDone) == 0)
                 return -EINPROGRESS;
 
         ah->ts_tail = (ah->ts_tail + 1) % ah->ts_size;
@@ -253,57 +255,58 @@ static int ar9003_hw_proc_txdesc(struct ath_hw *ah, void *ds,
                 return -EIO;
         }
 
+        if (status & AR_TxOpExceeded)
+                ts->ts_status |= ATH9K_TXERR_XTXOP;
+        ts->ts_rateindex = MS(status, AR_FinalTxIdx);
+        ts->ts_seqnum = MS(status, AR_SeqNum);
+        ts->tid = MS(status, AR_TxTid);
+
         ts->qid = MS(ads->ds_info, AR_TxQcuNum);
         ts->desc_id = MS(ads->status1, AR_TxDescId);
-        ts->ts_seqnum = MS(ads->status8, AR_SeqNum);
         ts->ts_tstamp = ads->status4;
         ts->ts_status = 0;
         ts->ts_flags  = 0;
 
-        if (ads->status3 & AR_ExcessiveRetries)
+        status = ACCESS_ONCE(ads->status2);
+        ts->ts_rssi_ctl0 = MS(status, AR_TxRSSIAnt00);
+        ts->ts_rssi_ctl1 = MS(status, AR_TxRSSIAnt01);
+        ts->ts_rssi_ctl2 = MS(status, AR_TxRSSIAnt02);
+        if (status & AR_TxBaStatus) {
+                ts->ts_flags |= ATH9K_TX_BA;
+                ts->ba_low = ads->status5;
+                ts->ba_high = ads->status6;
+        }
+
+        status = ACCESS_ONCE(ads->status3);
+        if (status & AR_ExcessiveRetries)
                 ts->ts_status |= ATH9K_TXERR_XRETRY;
-        if (ads->status3 & AR_Filtered)
+        if (status & AR_Filtered)
                 ts->ts_status |= ATH9K_TXERR_FILT;
-        if (ads->status3 & AR_FIFOUnderrun) {
+        if (status & AR_FIFOUnderrun) {
                 ts->ts_status |= ATH9K_TXERR_FIFO;
                 ath9k_hw_updatetxtriglevel(ah, true);
         }
-        if (ads->status8 & AR_TxOpExceeded)
-                ts->ts_status |= ATH9K_TXERR_XTXOP;
-        if (ads->status3 & AR_TxTimerExpired)
+        if (status & AR_TxTimerExpired)
                 ts->ts_status |= ATH9K_TXERR_TIMER_EXPIRED;
-
-        if (ads->status3 & AR_DescCfgErr)
+        if (status & AR_DescCfgErr)
                 ts->ts_flags |= ATH9K_TX_DESC_CFG_ERR;
-        if (ads->status3 & AR_TxDataUnderrun) {
+        if (status & AR_TxDataUnderrun) {
                 ts->ts_flags |= ATH9K_TX_DATA_UNDERRUN;
                 ath9k_hw_updatetxtriglevel(ah, true);
         }
-        if (ads->status3 & AR_TxDelimUnderrun) {
+        if (status & AR_TxDelimUnderrun) {
                 ts->ts_flags |= ATH9K_TX_DELIM_UNDERRUN;
                 ath9k_hw_updatetxtriglevel(ah, true);
         }
-        if (ads->status2 & AR_TxBaStatus) {
-                ts->ts_flags |= ATH9K_TX_BA;
-                ts->ba_low = ads->status5;
-                ts->ba_high = ads->status6;
-        }
-
-        ts->ts_rateindex = MS(ads->status8, AR_FinalTxIdx);
-
-        ts->ts_rssi = MS(ads->status7, AR_TxRSSICombined);
-        ts->ts_rssi_ctl0 = MS(ads->status2, AR_TxRSSIAnt00);
-        ts->ts_rssi_ctl1 = MS(ads->status2, AR_TxRSSIAnt01);
-        ts->ts_rssi_ctl2 = MS(ads->status2, AR_TxRSSIAnt02);
-        ts->ts_rssi_ext0 = MS(ads->status7, AR_TxRSSIAnt10);
-        ts->ts_rssi_ext1 = MS(ads->status7, AR_TxRSSIAnt11);
-        ts->ts_rssi_ext2 = MS(ads->status7, AR_TxRSSIAnt12);
-        ts->ts_shortretry = MS(ads->status3, AR_RTSFailCnt);
-        ts->ts_longretry = MS(ads->status3, AR_DataFailCnt);
-        ts->ts_virtcol = MS(ads->status3, AR_VirtRetryCnt);
-        ts->ts_antenna = 0;
+        ts->ts_shortretry = MS(status, AR_RTSFailCnt);
+        ts->ts_longretry = MS(status, AR_DataFailCnt);
+        ts->ts_virtcol = MS(status, AR_VirtRetryCnt);
 
-        ts->tid = MS(ads->status8, AR_TxTid);
+        status = ACCESS_ONCE(ads->status7);
+        ts->ts_rssi = MS(status, AR_TxRSSICombined);
+        ts->ts_rssi_ext0 = MS(status, AR_TxRSSIAnt10);
+        ts->ts_rssi_ext1 = MS(status, AR_TxRSSIAnt11);
+        ts->ts_rssi_ext2 = MS(status, AR_TxRSSIAnt12);
 
         memset(ads, 0, sizeof(*ads));
 
@@ -407,12 +410,36 @@ static void ar9003_hw_set11n_ratescenario(struct ath_hw *ah, void *ds,
 static void ar9003_hw_set11n_aggr_first(struct ath_hw *ah, void *ds,
                                         u32 aggrLen)
 {
+#define FIRST_DESC_NDELIMS 60
         struct ar9003_txc *ads = (struct ar9003_txc *) ds;
 
         ads->ctl12 |= (AR_IsAggr | AR_MoreAggr);
 
-        ads->ctl17 &= ~AR_AggrLen;
-        ads->ctl17 |= SM(aggrLen, AR_AggrLen);
+        if (ah->ent_mode & AR_ENT_OTP_MPSD) {
+                u32 ctl17, ndelim;
+                /*
+                 * Add delimiter when using RTS/CTS with aggregation
+                 * and non enterprise AR9003 card
+                 */
+                ctl17 = ads->ctl17;
+                ndelim = MS(ctl17, AR_PadDelim);
+
+                if (ndelim < FIRST_DESC_NDELIMS) {
+                        aggrLen += (FIRST_DESC_NDELIMS - ndelim) * 4;
+                        ndelim = FIRST_DESC_NDELIMS;
+                }
+
+                ctl17 &= ~AR_AggrLen;
+                ctl17 |= SM(aggrLen, AR_AggrLen);
+
+                ctl17 &= ~AR_PadDelim;
+                ctl17 |= SM(ndelim, AR_PadDelim);
+
+                ads->ctl17 = ctl17;
+        } else {
+                ads->ctl17 &= ~AR_AggrLen;
+                ads->ctl17 |= SM(aggrLen, AR_AggrLen);
+        }
 }
 
 static void ar9003_hw_set11n_aggr_middle(struct ath_hw *ah, void *ds,
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_mac.h b/drivers/net/wireless/ath/ath9k/ar9003_mac.h
index 9f2cea70a84..45cc7e80436 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_mac.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_mac.h
@@ -65,7 +65,7 @@ struct ar9003_rxs {
         u32 status9;
         u32 status10;
         u32 status11;
-} __packed;
+} __packed __aligned(4);
 
 /* Transmit Control Descriptor */
 struct ar9003_txc {
@@ -93,7 +93,7 @@ struct ar9003_txc {
         u32 ctl21;  /* DMA control 21 */
         u32 ctl22;  /* DMA control 22 */
         u32 pad[9]; /* pad to cache line (128 bytes/32 dwords) */
-} __packed;
+} __packed __aligned(4);
 
 struct ar9003_txs {
         u32 ds_info;
@@ -105,7 +105,7 @@ struct ar9003_txs {
         u32 status6;
         u32 status7;
         u32 status8;
-} __packed;
+} __packed __aligned(4);
 
 void ar9003_hw_attach_mac_ops(struct ath_hw *hw);
 void ath9k_hw_set_rx_bufsize(struct ath_hw *ah, u16 buf_size);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
index 716db414c25..850bc9866c1 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
@@ -32,12 +32,12 @@ static void ar9003_paprd_setup_single_table(struct ath_hw *ah)
 {
         struct ar9300_eeprom *eep = &ah->eeprom.ar9300_eep;
         struct ar9300_modal_eep_header *hdr;
-        const u32 ctrl0[3] = {
+        static const u32 ctrl0[3] = {
                 AR_PHY_PAPRD_CTRL0_B0,
                 AR_PHY_PAPRD_CTRL0_B1,
                 AR_PHY_PAPRD_CTRL0_B2
         };
-        const u32 ctrl1[3] = {
+        static const u32 ctrl1[3] = {
                 AR_PHY_PAPRD_CTRL1_B0,
                 AR_PHY_PAPRD_CTRL1_B1,
                 AR_PHY_PAPRD_CTRL1_B2
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index 669b777729b..656d8ce251a 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -128,7 +128,7 @@ static int ar9003_hw_set_channel(struct ath_hw *ah, struct ath9k_channel *chan)
 static void ar9003_hw_spur_mitigate_mrc_cck(struct ath_hw *ah,
                                             struct ath9k_channel *chan)
 {
-        u32 spur_freq[4] = { 2420, 2440, 2464, 2480 };
+        static const u32 spur_freq[4] = { 2420, 2440, 2464, 2480 };
         int cur_bb_spur, negative = 0, cck_spur_freq;
         int i;
 
@@ -614,7 +614,7 @@ static int ar9003_hw_process_ini(struct ath_hw *ah,
                                  channel->max_antenna_gain * 2,
                                  channel->max_power * 2,
                                  min((u32) MAX_RATE_POWER,
-                                 (u32) regulatory->power_limit));
+                                 (u32) regulatory->power_limit), false);
 
         return 0;
 }
@@ -1023,25 +1023,25 @@ static void ar9003_hw_do_getnf(struct ath_hw *ah,
         int16_t nf;
 
         nf = MS(REG_READ(ah, AR_PHY_CCA_0), AR_PHY_MINCCA_PWR);
-        nfarray[0] = sign_extend(nf, 9);
+        nfarray[0] = sign_extend32(nf, 8);
 
         nf = MS(REG_READ(ah, AR_PHY_CCA_1), AR_PHY_CH1_MINCCA_PWR);
-        nfarray[1] = sign_extend(nf, 9);
+        nfarray[1] = sign_extend32(nf, 8);
 
         nf = MS(REG_READ(ah, AR_PHY_CCA_2), AR_PHY_CH2_MINCCA_PWR);
-        nfarray[2] = sign_extend(nf, 9);
+        nfarray[2] = sign_extend32(nf, 8);
 
         if (!IS_CHAN_HT40(ah->curchan))
                 return;
 
         nf = MS(REG_READ(ah, AR_PHY_EXT_CCA), AR_PHY_EXT_MINCCA_PWR);
-        nfarray[3] = sign_extend(nf, 9);
+        nfarray[3] = sign_extend32(nf, 8);
 
         nf = MS(REG_READ(ah, AR_PHY_EXT_CCA_1), AR_PHY_CH1_EXT_MINCCA_PWR);
-        nfarray[4] = sign_extend(nf, 9);
+        nfarray[4] = sign_extend32(nf, 8);
 
         nf = MS(REG_READ(ah, AR_PHY_EXT_CCA_2), AR_PHY_CH2_EXT_MINCCA_PWR);
-        nfarray[5] = sign_extend(nf, 9);
+        nfarray[5] = sign_extend32(nf, 8);
 }
 
 static void ar9003_hw_set_nf_limits(struct ath_hw *ah)
@@ -1113,10 +1113,55 @@ static void ar9003_hw_ani_cache_ini_regs(struct ath_hw *ah)
         aniState->mrcCCKOff = !ATH9K_ANI_ENABLE_MRC_CCK;
 }
 
+static void ar9003_hw_set_radar_params(struct ath_hw *ah,
+                                       struct ath_hw_radar_conf *conf)
+{
+        u32 radar_0 = 0, radar_1 = 0;
+
+        if (!conf) {
+                REG_CLR_BIT(ah, AR_PHY_RADAR_0, AR_PHY_RADAR_0_ENA);
+                return;
+        }
+
+        radar_0 |= AR_PHY_RADAR_0_ENA | AR_PHY_RADAR_0_FFT_ENA;
+        radar_0 |= SM(conf->fir_power, AR_PHY_RADAR_0_FIRPWR);
+        radar_0 |= SM(conf->radar_rssi, AR_PHY_RADAR_0_RRSSI);
+        radar_0 |= SM(conf->pulse_height, AR_PHY_RADAR_0_HEIGHT);
+        radar_0 |= SM(conf->pulse_rssi, AR_PHY_RADAR_0_PRSSI);
+        radar_0 |= SM(conf->pulse_inband, AR_PHY_RADAR_0_INBAND);
+
+        radar_1 |= AR_PHY_RADAR_1_MAX_RRSSI;
+        radar_1 |= AR_PHY_RADAR_1_BLOCK_CHECK;
+        radar_1 |= SM(conf->pulse_maxlen, AR_PHY_RADAR_1_MAXLEN);
+        radar_1 |= SM(conf->pulse_inband_step, AR_PHY_RADAR_1_RELSTEP_THRESH);
+        radar_1 |= SM(conf->radar_inband, AR_PHY_RADAR_1_RELPWR_THRESH);
+
+        REG_WRITE(ah, AR_PHY_RADAR_0, radar_0);
+        REG_WRITE(ah, AR_PHY_RADAR_1, radar_1);
+        if (conf->ext_channel)
+                REG_SET_BIT(ah, AR_PHY_RADAR_EXT, AR_PHY_RADAR_EXT_ENA);
+        else
+                REG_CLR_BIT(ah, AR_PHY_RADAR_EXT, AR_PHY_RADAR_EXT_ENA);
+}
+
+static void ar9003_hw_set_radar_conf(struct ath_hw *ah)
+{
+        struct ath_hw_radar_conf *conf = &ah->radar_conf;
+
+        conf->fir_power = -28;
+        conf->radar_rssi = 0;
+        conf->pulse_height = 10;
+        conf->pulse_rssi = 24;
+        conf->pulse_inband = 8;
+        conf->pulse_maxlen = 255;
+        conf->pulse_inband_step = 12;
+        conf->radar_inband = 8;
+}
+
 void ar9003_hw_attach_phy_ops(struct ath_hw *ah)
 {
         struct ath_hw_private_ops *priv_ops = ath9k_hw_private_ops(ah);
-        const u32 ar9300_cca_regs[6] = {
+        static const u32 ar9300_cca_regs[6] = {
                 AR_PHY_CCA_0,
                 AR_PHY_CCA_1,
                 AR_PHY_CCA_2,
@@ -1141,8 +1186,10 @@ void ar9003_hw_attach_phy_ops(struct ath_hw *ah)
         priv_ops->ani_control = ar9003_hw_ani_control;
         priv_ops->do_getnf = ar9003_hw_do_getnf;
         priv_ops->ani_cache_ini_regs = ar9003_hw_ani_cache_ini_regs;
+        priv_ops->set_radar_params = ar9003_hw_set_radar_params;
 
         ar9003_hw_set_nf_limits(ah);
+        ar9003_hw_set_radar_conf(ah);
         memcpy(ah->nf_regs, ar9300_cca_regs, sizeof(ah->nf_regs));
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 0d0bec3628e..0b4b4704b1f 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -87,33 +87,19 @@ struct ath_config {
 /**
  * enum buffer_type - Buffer type flags
  *
- * @BUF_HT: Send this buffer using HT capabilities
  * @BUF_AMPDU: This buffer is an ampdu, as part of an aggregate (during TX)
  * @BUF_AGGR: Indicates whether the buffer can be aggregated
  *      (used in aggregation scheduling)
- * @BUF_RETRY: Indicates whether the buffer is retried
  * @BUF_XRETRY: To denote excessive retries of the buffer
  */
 enum buffer_type {
-        BUF_HT                  = BIT(1),
         BUF_AMPDU               = BIT(2),
         BUF_AGGR                = BIT(3),
-        BUF_RETRY               = BIT(4),
         BUF_XRETRY              = BIT(5),
 };
 
-#define bf_nframes              bf_state.bfs_nframes
-#define bf_al                   bf_state.bfs_al
-#define bf_frmlen               bf_state.bfs_frmlen
-#define bf_retries              bf_state.bfs_retries
-#define bf_seqno                bf_state.bfs_seqno
-#define bf_tidno                bf_state.bfs_tidno
-#define bf_keyix                bf_state.bfs_keyix
-#define bf_keytype              bf_state.bfs_keytype
-#define bf_isht(bf)             (bf->bf_state.bf_type & BUF_HT)
 #define bf_isampdu(bf)          (bf->bf_state.bf_type & BUF_AMPDU)
 #define bf_isaggr(bf)           (bf->bf_state.bf_type & BUF_AGGR)
-#define bf_isretried(bf)        (bf->bf_state.bf_type & BUF_RETRY)
 #define bf_isxretried(bf)       (bf->bf_state.bf_type & BUF_XRETRY)
 
 #define ATH_TXSTATUS_RING_SIZE 64
@@ -178,8 +164,8 @@ void ath_descdma_cleanup(struct ath_softc *sc, struct ath_descdma *dd,
 
 /* returns delimiter padding required given the packet length */
 #define ATH_AGGR_GET_NDELIM(_len)                                       \
-        (((((_len) + ATH_AGGR_DELIM_SZ) < ATH_AGGR_MINPLEN) ?           \
-          (ATH_AGGR_MINPLEN - (_len) - ATH_AGGR_DELIM_SZ) : 0) >> 2)
+       (((_len) >= ATH_AGGR_MINPLEN) ? 0 :                             \
+        DIV_ROUND_UP(ATH_AGGR_MINPLEN - (_len), ATH_AGGR_DELIM_SZ))
 
 #define BAW_WITHIN(_start, _bawsz, _seqno) \
         ((((_seqno) - (_start)) & 4095) < (_bawsz))
@@ -196,7 +182,6 @@ enum ATH_AGGR_STATUS {
 
 #define ATH_TXFIFO_DEPTH 8
 struct ath_txq {
-        int axq_class;
         u32 axq_qnum;
         u32 *axq_link;
         struct list_head axq_q;
@@ -209,27 +194,28 @@ struct ath_txq {
         struct list_head txq_fifo_pending;
         u8 txq_headidx;
         u8 txq_tailidx;
+        int pending_frames;
 };
 
 struct ath_atx_ac {
+        struct ath_txq *txq;
         int sched;
-        int qnum;
         struct list_head list;
         struct list_head tid_q;
 };
 
+struct ath_frame_info {
+        int framelen;
+        u32 keyix;
+        enum ath9k_key_type keytype;
+        u8 retries;
+        u16 seqno;
+};
+
 struct ath_buf_state {
-        int bfs_nframes;
-        u16 bfs_al;
-        u16 bfs_frmlen;
-        int bfs_seqno;
-        int bfs_tidno;
-        int bfs_retries;
         u8 bf_type;
         u8 bfs_paprd;
-        unsigned long bfs_paprd_timestamp;
-        u32 bfs_keyix;
-        enum ath9k_key_type bfs_keytype;
+        enum ath9k_internal_frame_type bfs_ftype;
 };
 
 struct ath_buf {
@@ -242,7 +228,6 @@ struct ath_buf {
         dma_addr_t bf_daddr;            /* physical addr of desc */
         dma_addr_t bf_buf_addr; /* physical addr of data buffer, for DMA */
         bool bf_stale;
-        bool bf_tx_aborted;
         u16 bf_flags;
         struct ath_buf_state bf_state;
         struct ath_wiphy *aphy;
@@ -271,7 +256,6 @@ struct ath_node {
         struct ath_atx_ac ac[WME_NUM_AC];
         u16 maxampdu;
         u8 mpdudensity;
-        int last_rssi;
 };
 
 #define AGGR_CLEANUP         BIT(1)
@@ -280,6 +264,7 @@ struct ath_node {
 
 struct ath_tx_control {
         struct ath_txq *txq;
+        struct ath_node *an;
         int if_id;
         enum ath9k_internal_frame_type frame_type;
         u8 paprd;
@@ -292,12 +277,11 @@ struct ath_tx_control {
 struct ath_tx {
         u16 seq_no;
         u32 txqsetup;
-        int hwq_map[WME_NUM_AC];
         spinlock_t txbuflock;
         struct list_head txbuf;
         struct ath_txq txq[ATH9K_NUM_TX_QUEUES];
         struct ath_descdma txdma;
-        int pending_frames[WME_NUM_AC];
+        struct ath_txq *txq_map[WME_NUM_AC];
 };
 
 struct ath_rx_edma {
@@ -311,7 +295,6 @@ struct ath_rx {
         u8 rxotherant;
         u32 *rxlink;
         unsigned int rxfilter;
-        spinlock_t pcu_lock;
         spinlock_t rxbuflock;
         struct list_head rxbuf;
         struct ath_descdma rxdma;
@@ -328,7 +311,6 @@ void ath_rx_cleanup(struct ath_softc *sc);
 int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp);
 struct ath_txq *ath_txq_setup(struct ath_softc *sc, int qtype, int subtype);
 void ath_tx_cleanupq(struct ath_softc *sc, struct ath_txq *txq);
-int ath_tx_setup(struct ath_softc *sc, int haltype);
 void ath_drain_all_txq(struct ath_softc *sc, bool retry_tx);
 void ath_draintxq(struct ath_softc *sc,
                      struct ath_txq *txq, bool retry_tx);
@@ -343,7 +325,6 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
                  struct ath_tx_control *txctl);
 void ath_tx_tasklet(struct ath_softc *sc);
 void ath_tx_edma_tasklet(struct ath_softc *sc);
-void ath_tx_cabq(struct ieee80211_hw *hw, struct sk_buff *skb);
 int ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
                       u16 tid, u16 *ssn);
 void ath_tx_aggr_stop(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid);
@@ -601,13 +582,14 @@ struct ath_softc {
         struct ath_hw *sc_ah;
         void __iomem *mem;
         int irq;
-        spinlock_t sc_resetlock;
         spinlock_t sc_serial_rw;
         spinlock_t sc_pm_lock;
+        spinlock_t sc_pcu_lock;
         struct mutex mutex;
         struct work_struct paprd_work;
         struct work_struct hw_check_work;
         struct completion paprd_complete;
+        bool paprd_pending;
 
         u32 intrstatus;
         u32 sc_flags; /* SC_OP_* */
@@ -665,11 +647,11 @@ struct ath_wiphy {
         bool idle;
         int chan_idx;
         int chan_is_ht;
+        int last_rssi;
 };
 
 void ath9k_tasklet(unsigned long data);
 int ath_reset(struct ath_softc *sc, bool retry_tx);
-int ath_get_mac80211_qnum(u32 queue, struct ath_softc *sc);
 int ath_cabq_update(struct ath_softc *);
 
 static inline void ath_read_cachesize(struct ath_common *common, int *csz)
@@ -718,7 +700,7 @@ void ath9k_ps_restore(struct ath_softc *sc);
 void ath9k_set_bssid_mask(struct ieee80211_hw *hw, struct ieee80211_vif *vif);
 int ath9k_wiphy_add(struct ath_softc *sc);
 int ath9k_wiphy_del(struct ath_wiphy *aphy);
-void ath9k_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb);
+void ath9k_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb, int ftype);
 int ath9k_wiphy_pause(struct ath_wiphy *aphy);
 int ath9k_wiphy_unpause(struct ath_wiphy *aphy);
 int ath9k_wiphy_select(struct ath_wiphy *aphy);
diff --git a/drivers/net/wireless/ath/ath9k/beacon.c b/drivers/net/wireless/ath/ath9k/beacon.c
index 19891e7d49a..30724a4e8bb 100644
--- a/drivers/net/wireless/ath/ath9k/beacon.c
+++ b/drivers/net/wireless/ath/ath9k/beacon.c
@@ -28,7 +28,7 @@ int ath_beaconq_config(struct ath_softc *sc)
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
         struct ath9k_tx_queue_info qi, qi_be;
-        int qnum;
+        struct ath_txq *txq;
 
         ath9k_hw_get_txq_props(ah, sc->beacon.beaconq, &qi);
         if (sc->sc_ah->opmode == NL80211_IFTYPE_AP) {
@@ -38,8 +38,8 @@ int ath_beaconq_config(struct ath_softc *sc)
                 qi.tqi_cwmax = 0;
         } else {
                 /* Adhoc mode; important thing is to use 2x cwmin. */
-                qnum = sc->tx.hwq_map[WME_AC_BE];
-                ath9k_hw_get_txq_props(ah, qnum, &qi_be);
+                txq = sc->tx.txq_map[WME_AC_BE];
+                ath9k_hw_get_txq_props(ah, txq->axq_qnum, &qi_be);
                 qi.tqi_aifs = qi_be.tqi_aifs;
                 qi.tqi_cwmin = 4*qi_be.tqi_cwmin;
                 qi.tqi_cwmax = qi_be.tqi_cwmax;
@@ -109,6 +109,25 @@ static void ath_beacon_setup(struct ath_softc *sc, struct ath_vif *avp,
                                      series, 4, 0);
 }
 
+static void ath_tx_cabq(struct ieee80211_hw *hw, struct sk_buff *skb)
+{
+        struct ath_wiphy *aphy = hw->priv;
+        struct ath_softc *sc = aphy->sc;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        struct ath_tx_control txctl;
+
+        memset(&txctl, 0, sizeof(struct ath_tx_control));
+        txctl.txq = sc->beacon.cabq;
+
+        ath_print(common, ATH_DBG_XMIT,
+                  "transmitting CABQ packet, skb: %p\n", skb);
+
+        if (ath_tx_start(hw, skb, &txctl) != 0) {
+                ath_print(common, ATH_DBG_XMIT, "CABQ TX failed\n");
+                dev_kfree_skb_any(skb);
+        }
+}
+
 static struct ath_buf *ath_beacon_generate(struct ieee80211_hw *hw,
                                            struct ieee80211_vif *vif)
 {
@@ -503,7 +522,7 @@ static void ath_beacon_config_ap(struct ath_softc *sc,
 
         /* Set the computed AP beacon timers */
 
-        ath9k_hw_set_interrupts(ah, 0);
+        ath9k_hw_disable_interrupts(ah);
         ath9k_beacon_init(sc, nexttbtt, intval);
         sc->beacon.bmisscnt = 0;
         ath9k_hw_set_interrupts(ah, ah->imask);
@@ -638,7 +657,7 @@ static void ath_beacon_config_sta(struct ath_softc *sc,
 
         /* Set the computed STA beacon timers */
 
-        ath9k_hw_set_interrupts(ah, 0);
+        ath9k_hw_disable_interrupts(ah);
         ath9k_hw_set_sta_beacon_timers(ah, &bs);
         ah->imask |= ATH9K_INT_BMISS;
         ath9k_hw_set_interrupts(ah, ah->imask);
@@ -686,7 +705,7 @@ static void ath_beacon_config_adhoc(struct ath_softc *sc,
 
         /* Set the computed ADHOC beacon timers */
 
-        ath9k_hw_set_interrupts(ah, 0);
+        ath9k_hw_disable_interrupts(ah);
         ath9k_beacon_init(sc, nexttbtt, intval);
         sc->beacon.bmisscnt = 0;
         ath9k_hw_set_interrupts(ah, ah->imask);
diff --git a/drivers/net/wireless/ath/ath9k/common.c b/drivers/net/wireless/ath/ath9k/common.c
index f43a2d98421..48b07c319a7 100644
--- a/drivers/net/wireless/ath/ath9k/common.c
+++ b/drivers/net/wireless/ath/ath9k/common.c
@@ -107,12 +107,10 @@ static u32 ath9k_get_extchanmode(struct ieee80211_channel *chan,
 /*
  * Update internal channel flags.
  */
-void ath9k_cmn_update_ichannel(struct ieee80211_hw *hw,
-                               struct ath9k_channel *ichan)
+void ath9k_cmn_update_ichannel(struct ath9k_channel *ichan,
+                               struct ieee80211_channel *chan,
+                               enum nl80211_channel_type channel_type)
 {
-        struct ieee80211_channel *chan = hw->conf.channel;
-        struct ieee80211_conf *conf = &hw->conf;
-
         ichan->channel = chan->center_freq;
         ichan->chan = chan;
 
@@ -124,9 +122,8 @@ void ath9k_cmn_update_ichannel(struct ieee80211_hw *hw,
                 ichan->channelFlags = CHANNEL_5GHZ | CHANNEL_OFDM;
         }
 
-        if (conf_is_ht(conf))
-                ichan->chanmode = ath9k_get_extchanmode(chan,
-                                                        conf->channel_type);
+        if (channel_type != NL80211_CHAN_NO_HT)
+                ichan->chanmode = ath9k_get_extchanmode(chan, channel_type);
 }
 EXPORT_SYMBOL(ath9k_cmn_update_ichannel);
 
@@ -142,7 +139,7 @@ struct ath9k_channel *ath9k_cmn_get_curchannel(struct ieee80211_hw *hw,
 
         chan_idx = curchan->hw_value;
         channel = &ah->channels[chan_idx];
-        ath9k_cmn_update_ichannel(hw, channel);
+        ath9k_cmn_update_ichannel(channel, curchan, hw->conf.channel_type);
 
         return channel;
 }
diff --git a/drivers/net/wireless/ath/ath9k/common.h b/drivers/net/wireless/ath/ath9k/common.h
index fea3b331539..4c04ee85ff0 100644
--- a/drivers/net/wireless/ath/ath9k/common.h
+++ b/drivers/net/wireless/ath/ath9k/common.h
@@ -31,10 +31,11 @@
 #define WME_MAX_BA              WME_BA_BMP_SIZE
 #define ATH_TID_MAX_BUFS        (2 * WME_MAX_BA)
 
-#define WME_AC_BE   0
-#define WME_AC_BK   1
-#define WME_AC_VI   2
-#define WME_AC_VO   3
+/* These must match mac80211 skb queue mapping numbers */
+#define WME_AC_VO   0
+#define WME_AC_VI   1
+#define WME_AC_BE   2
+#define WME_AC_BK   3
 #define WME_NUM_AC  4
 
 #define ATH_RSSI_DUMMY_MARKER   0x127
@@ -62,8 +63,9 @@ enum ath_stomp_type {
 
 int ath9k_cmn_padpos(__le16 frame_control);
 int ath9k_cmn_get_hw_crypto_keytype(struct sk_buff *skb);
-void ath9k_cmn_update_ichannel(struct ieee80211_hw *hw,
-                               struct ath9k_channel *ichan);
+void ath9k_cmn_update_ichannel(struct ath9k_channel *ichan,
+                               struct ieee80211_channel *chan,
+                               enum nl80211_channel_type channel_type);
 struct ath9k_channel *ath9k_cmn_get_curchannel(struct ieee80211_hw *hw,
                                                struct ath_hw *ah);
 int ath9k_cmn_count_streams(unsigned int chainmask, int max);
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index 43e71a944cb..0c3c74c157f 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -461,16 +461,16 @@ static ssize_t read_file_wiphy(struct file *file, char __user *user_buf,
 
         /* Put variable-length stuff down here, and check for overflows. */
         for (i = 0; i < sc->num_sec_wiphy; i++) {
-                struct ath_wiphy *aphy = sc->sec_wiphy[i];
-                if (aphy == NULL)
+                struct ath_wiphy *aphy_tmp = sc->sec_wiphy[i];
+                if (aphy_tmp == NULL)
                         continue;
-                chan = aphy->hw->conf.channel;
+                chan = aphy_tmp->hw->conf.channel;
                 len += snprintf(buf + len, sizeof(buf) - len,
                         "secondary: %s (%s chan=%d ht=%d)\n",
-                        wiphy_name(aphy->hw->wiphy),
-                        ath_wiphy_state_str(aphy->state),
+                        wiphy_name(aphy_tmp->hw->wiphy),
+                        ath_wiphy_state_str(aphy_tmp->state),
                         ieee80211_frequency_to_channel(chan->center_freq),
-                        aphy->chan_is_ht);
+                                                       aphy_tmp->chan_is_ht);
         }
         if (len > sizeof(buf))
                 len = sizeof(buf);
@@ -585,10 +585,10 @@ static const struct file_operations fops_wiphy = {
         do {                                                            \
                 len += snprintf(buf + len, size - len,                  \
                                 "%s%13u%11u%10u%10u\n", str,            \
-                sc->debug.stats.txstats[sc->tx.hwq_map[WME_AC_BE]].elem, \
-                sc->debug.stats.txstats[sc->tx.hwq_map[WME_AC_BK]].elem, \
-                sc->debug.stats.txstats[sc->tx.hwq_map[WME_AC_VI]].elem, \
-                sc->debug.stats.txstats[sc->tx.hwq_map[WME_AC_VO]].elem); \
+                sc->debug.stats.txstats[WME_AC_BE].elem, \
+                sc->debug.stats.txstats[WME_AC_BK].elem, \
+                sc->debug.stats.txstats[WME_AC_VI].elem, \
+                sc->debug.stats.txstats[WME_AC_VO].elem); \
 } while(0)
 
 static ssize_t read_file_xmit(struct file *file, char __user *user_buf,
@@ -630,33 +630,35 @@ static ssize_t read_file_xmit(struct file *file, char __user *user_buf,
         return retval;
 }
 
-void ath_debug_stat_tx(struct ath_softc *sc, struct ath_txq *txq,
-                       struct ath_buf *bf, struct ath_tx_status *ts)
+void ath_debug_stat_tx(struct ath_softc *sc, struct ath_buf *bf,
+                       struct ath_tx_status *ts)
 {
-        TX_STAT_INC(txq->axq_qnum, tx_pkts_all);
-        sc->debug.stats.txstats[txq->axq_qnum].tx_bytes_all += bf->bf_mpdu->len;
+        int qnum = skb_get_queue_mapping(bf->bf_mpdu);
+
+        TX_STAT_INC(qnum, tx_pkts_all);
+        sc->debug.stats.txstats[qnum].tx_bytes_all += bf->bf_mpdu->len;
 
         if (bf_isampdu(bf)) {
                 if (bf_isxretried(bf))
-                        TX_STAT_INC(txq->axq_qnum, a_xretries);
+                        TX_STAT_INC(qnum, a_xretries);
                 else
-                        TX_STAT_INC(txq->axq_qnum, a_completed);
+                        TX_STAT_INC(qnum, a_completed);
         } else {
-                TX_STAT_INC(txq->axq_qnum, completed);
+                TX_STAT_INC(qnum, completed);
         }
 
         if (ts->ts_status & ATH9K_TXERR_FIFO)
-                TX_STAT_INC(txq->axq_qnum, fifo_underrun);
+                TX_STAT_INC(qnum, fifo_underrun);
         if (ts->ts_status & ATH9K_TXERR_XTXOP)
-                TX_STAT_INC(txq->axq_qnum, xtxop);
+                TX_STAT_INC(qnum, xtxop);
         if (ts->ts_status & ATH9K_TXERR_TIMER_EXPIRED)
-                TX_STAT_INC(txq->axq_qnum, timer_exp);
+                TX_STAT_INC(qnum, timer_exp);
         if (ts->ts_flags & ATH9K_TX_DESC_CFG_ERR)
-                TX_STAT_INC(txq->axq_qnum, desc_cfg_err);
+                TX_STAT_INC(qnum, desc_cfg_err);
         if (ts->ts_flags & ATH9K_TX_DATA_UNDERRUN)
-                TX_STAT_INC(txq->axq_qnum, data_underrun);
+                TX_STAT_INC(qnum, data_underrun);
         if (ts->ts_flags & ATH9K_TX_DELIM_UNDERRUN)
-                TX_STAT_INC(txq->axq_qnum, delim_underrun);
+                TX_STAT_INC(qnum, delim_underrun);
 }
 
 static const struct file_operations fops_xmit = {
diff --git a/drivers/net/wireless/ath/ath9k/debug.h b/drivers/net/wireless/ath/ath9k/debug.h
index bb0823242ba..646ff7e04c8 100644
--- a/drivers/net/wireless/ath/ath9k/debug.h
+++ b/drivers/net/wireless/ath/ath9k/debug.h
@@ -169,8 +169,8 @@ void ath9k_exit_debug(struct ath_hw *ah);
 int ath9k_debug_create_root(void);
 void ath9k_debug_remove_root(void);
 void ath_debug_stat_interrupt(struct ath_softc *sc, enum ath9k_int status);
-void ath_debug_stat_tx(struct ath_softc *sc, struct ath_txq *txq,
-                       struct ath_buf *bf, struct ath_tx_status *ts);
+void ath_debug_stat_tx(struct ath_softc *sc, struct ath_buf *bf,
+                       struct ath_tx_status *ts);
 void ath_debug_stat_rx(struct ath_softc *sc, struct ath_rx_status *rs);
 
 #else
@@ -199,7 +199,6 @@ static inline void ath_debug_stat_interrupt(struct ath_softc *sc,
 }
 
 static inline void ath_debug_stat_tx(struct ath_softc *sc,
-                                     struct ath_txq *txq,
                                      struct ath_buf *bf,
                                      struct ath_tx_status *ts)
 {
diff --git a/drivers/net/wireless/ath/ath9k/eeprom.h b/drivers/net/wireless/ath/ath9k/eeprom.h
index dd59f09441a..8a644fced5c 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom.h
+++ b/drivers/net/wireless/ath/ath9k/eeprom.h
@@ -681,7 +681,8 @@ struct eeprom_ops {
         void (*set_addac)(struct ath_hw *hw, struct ath9k_channel *chan);
         void (*set_txpower)(struct ath_hw *hw, struct ath9k_channel *chan,
                            u16 cfgCtl, u8 twiceAntennaReduction,
-                           u8 twiceMaxRegulatoryPower, u8 powerLimit);
+                           u8 twiceMaxRegulatoryPower, u8 powerLimit,
+                           bool test);
         u16 (*get_spur_channel)(struct ath_hw *ah, u16 i, bool is2GHz);
 };
 
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_4k.c b/drivers/net/wireless/ath/ath9k/eeprom_4k.c
index 4fa4d8e28c6..c2481b3ac7e 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_4k.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_4k.c
@@ -534,7 +534,9 @@ static void ath9k_hw_set_4k_power_per_rate_table(struct ath_hw *ah,
         u16 twiceMinEdgePower;
         u16 twiceMaxEdgePower = AR5416_MAX_RATE_POWER;
         u16 scaledPower = 0, minCtlPower, maxRegAllowedPower;
-        u16 numCtlModes, *pCtlMode, ctlMode, freq;
+        u16 numCtlModes;
+        const u16 *pCtlMode;
+        u16 ctlMode, freq;
         struct chan_centers centers;
         struct cal_ctl_data_4k *rep;
         struct ar5416_eeprom_4k *pEepData = &ah->eeprom.map4k;
@@ -550,10 +552,10 @@ static void ath9k_hw_set_4k_power_per_rate_table(struct ath_hw *ah,
         struct cal_target_power_ht targetPowerHt20, targetPowerHt40 = {
                 0, {0, 0, 0, 0}
         };
-        u16 ctlModesFor11g[] =
-                { CTL_11B, CTL_11G, CTL_2GHT20, CTL_11B_EXT, CTL_11G_EXT,
-                  CTL_2GHT40
-                };
+        static const u16 ctlModesFor11g[] = {
+                CTL_11B, CTL_11G, CTL_2GHT20,
+                CTL_11B_EXT, CTL_11G_EXT, CTL_2GHT40
+        };
 
         ath9k_hw_get_channel_centers(ah, chan, &centers);
 
@@ -726,7 +728,7 @@ static void ath9k_hw_4k_set_txpower(struct ath_hw *ah,
                                     u16 cfgCtl,
                                     u8 twiceAntennaReduction,
                                     u8 twiceMaxRegulatoryPower,
-                                    u8 powerLimit)
+                                    u8 powerLimit, bool test)
 {
         struct ath_regulatory *regulatory = ath9k_hw_regulatory(ah);
         struct ar5416_eeprom_4k *pEepData = &ah->eeprom.map4k;
@@ -751,15 +753,20 @@ static void ath9k_hw_4k_set_txpower(struct ath_hw *ah,
 
         ath9k_hw_set_4k_power_cal_table(ah, chan, &txPowerIndexOffset);
 
+        regulatory->max_power_level = 0;
         for (i = 0; i < ARRAY_SIZE(ratesArray); i++) {
                 ratesArray[i] = (int16_t)(txPowerIndexOffset + ratesArray[i]);
                 if (ratesArray[i] > AR5416_MAX_RATE_POWER)
                         ratesArray[i] = AR5416_MAX_RATE_POWER;
+
+                if (ratesArray[i] > regulatory->max_power_level)
+                        regulatory->max_power_level = ratesArray[i];
         }
 
+        if (test)
+            return;
 
         /* Update regulatory */
-
         i = rate6mb;
         if (IS_CHAN_HT40(chan))
                 i = rateHt40_0;
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_9287.c b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
index 195406db3bd..bcb9ed39c04 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_9287.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
@@ -37,10 +37,10 @@ static bool ath9k_hw_ar9287_fill_eeprom(struct ath_hw *ah)
         int addr, eep_start_loc;
         eep_data = (u16 *)eep;
 
-        if (AR9287_HTC_DEVID(ah))
-                eep_start_loc = AR9287_HTC_EEP_START_LOC;
-        else
+        if (!common->driver_info)
                 eep_start_loc = AR9287_EEP_START_LOC;
+        else
+                eep_start_loc = AR9287_HTC_EEP_START_LOC;
 
         if (!ath9k_hw_use_flash(ah)) {
                 ath_print(common, ATH_DBG_EEPROM,
@@ -626,13 +626,13 @@ static void ath9k_hw_set_ar9287_power_per_rate_table(struct ath_hw *ah,
         struct cal_target_power_ht targetPowerHt20,
                                     targetPowerHt40 = {0, {0, 0, 0, 0} };
         u16 scaledPower = 0, minCtlPower, maxRegAllowedPower;
-        u16 ctlModesFor11g[] = {CTL_11B,
-                                CTL_11G,
-                                CTL_2GHT20,
-                                CTL_11B_EXT,
-                                CTL_11G_EXT,
-                                CTL_2GHT40};
-        u16 numCtlModes = 0, *pCtlMode = NULL, ctlMode, freq;
+        static const u16 ctlModesFor11g[] = {
+                CTL_11B, CTL_11G, CTL_2GHT20,
+                CTL_11B_EXT, CTL_11G_EXT, CTL_2GHT40
+        };
+        u16 numCtlModes = 0;
+        const u16 *pCtlMode = NULL;
+        u16 ctlMode, freq;
         struct chan_centers centers;
         int tx_chainmask;
         u16 twiceMinEdgePower;
@@ -853,7 +853,7 @@ static void ath9k_hw_ar9287_set_txpower(struct ath_hw *ah,
                                         struct ath9k_channel *chan, u16 cfgCtl,
                                         u8 twiceAntennaReduction,
                                         u8 twiceMaxRegulatoryPower,
-                                        u8 powerLimit)
+                                        u8 powerLimit, bool test)
 {
         struct ath_regulatory *regulatory = ath9k_hw_regulatory(ah);
         struct ar9287_eeprom *pEepData = &ah->eeprom.map9287;
@@ -877,12 +877,26 @@ static void ath9k_hw_ar9287_set_txpower(struct ath_hw *ah,
 
         ath9k_hw_set_ar9287_power_cal_table(ah, chan, &txPowerIndexOffset);
 
+        regulatory->max_power_level = 0;
         for (i = 0; i < ARRAY_SIZE(ratesArray); i++) {
                 ratesArray[i] = (int16_t)(txPowerIndexOffset + ratesArray[i]);
                 if (ratesArray[i] > AR9287_MAX_RATE_POWER)
                         ratesArray[i] = AR9287_MAX_RATE_POWER;
+
+                if (ratesArray[i] > regulatory->max_power_level)
+                        regulatory->max_power_level = ratesArray[i];
         }
 
+        if (test)
+                return;
+
+        if (IS_CHAN_2GHZ(chan))
+                i = rate1l;
+        else
+                i = rate6mb;
+
+        regulatory->max_power_level = ratesArray[i];
+
         if (AR_SREV_9280_20_OR_LATER(ah)) {
                 for (i = 0; i < Ar5416RateSize; i++)
                         ratesArray[i] -= AR9287_PWR_TABLE_OFFSET_DB * 2;
@@ -971,17 +985,6 @@ static void ath9k_hw_ar9287_set_txpower(struct ath_hw *ah,
                           | ATH9K_POW_SM(ratesArray[rateDupOfdm], 8)
                           | ATH9K_POW_SM(ratesArray[rateDupCck], 0));
         }
-
-        if (IS_CHAN_2GHZ(chan))
-                i = rate1l;
-        else
-                i = rate6mb;
-
-        if (AR_SREV_9280_20_OR_LATER(ah))
-                regulatory->max_power_level =
-                        ratesArray[i] + AR9287_PWR_TABLE_OFFSET_DB * 2;
-        else
-                regulatory->max_power_level = ratesArray[i];
 }
 
 static void ath9k_hw_ar9287_set_addac(struct ath_hw *ah,
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_def.c b/drivers/net/wireless/ath/ath9k/eeprom_def.c
index 526d7c933f7..45f70b2404a 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_def.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_def.c
@@ -1022,13 +1022,16 @@ static void ath9k_hw_set_def_power_per_rate_table(struct ath_hw *ah,
                 0, {0, 0, 0, 0}
         };
         u16 scaledPower = 0, minCtlPower, maxRegAllowedPower;
-        u16 ctlModesFor11a[] =
-                { CTL_11A, CTL_5GHT20, CTL_11A_EXT, CTL_5GHT40 };
-        u16 ctlModesFor11g[] =
-                { CTL_11B, CTL_11G, CTL_2GHT20, CTL_11B_EXT, CTL_11G_EXT,
-                  CTL_2GHT40
-                };
-        u16 numCtlModes, *pCtlMode, ctlMode, freq;
+        static const u16 ctlModesFor11a[] = {
+                CTL_11A, CTL_5GHT20, CTL_11A_EXT, CTL_5GHT40
+        };
+        static const u16 ctlModesFor11g[] = {
+                CTL_11B, CTL_11G, CTL_2GHT20,
+                CTL_11B_EXT, CTL_11G_EXT, CTL_2GHT40
+        };
+        u16 numCtlModes;
+        const u16 *pCtlMode;
+        u16 ctlMode, freq;
         struct chan_centers centers;
         int tx_chainmask;
         u16 twiceMinEdgePower;
@@ -1259,7 +1262,7 @@ static void ath9k_hw_def_set_txpower(struct ath_hw *ah,
                                     u16 cfgCtl,
                                     u8 twiceAntennaReduction,
                                     u8 twiceMaxRegulatoryPower,
-                                    u8 powerLimit)
+                                    u8 powerLimit, bool test)
 {
 #define RT_AR_DELTA(x) (ratesArray[x] - cck_ofdm_delta)
         struct ath_regulatory *regulatory = ath9k_hw_regulatory(ah);
@@ -1286,12 +1289,44 @@ static void ath9k_hw_def_set_txpower(struct ath_hw *ah,
 
         ath9k_hw_set_def_power_cal_table(ah, chan, &txPowerIndexOffset);
 
+        regulatory->max_power_level = 0;
         for (i = 0; i < ARRAY_SIZE(ratesArray); i++) {
                 ratesArray[i] = (int16_t)(txPowerIndexOffset + ratesArray[i]);
                 if (ratesArray[i] > AR5416_MAX_RATE_POWER)
                         ratesArray[i] = AR5416_MAX_RATE_POWER;
+                if (ratesArray[i] > regulatory->max_power_level)
+                        regulatory->max_power_level = ratesArray[i];
+        }
+
+        if (!test) {
+                i = rate6mb;
+
+                if (IS_CHAN_HT40(chan))
+                        i = rateHt40_0;
+                else if (IS_CHAN_HT20(chan))
+                        i = rateHt20_0;
+
+                regulatory->max_power_level = ratesArray[i];
+        }
+
+        switch(ar5416_get_ntxchains(ah->txchainmask)) {
+        case 1:
+                break;
+        case 2:
+                regulatory->max_power_level += INCREASE_MAXPOW_BY_TWO_CHAIN;
+                break;
+        case 3:
+                regulatory->max_power_level += INCREASE_MAXPOW_BY_THREE_CHAIN;
+                break;
+        default:
+                ath_print(ath9k_hw_common(ah), ATH_DBG_EEPROM,
+                          "Invalid chainmask configuration\n");
+                break;
         }
 
+        if (test)
+                return;
+
         if (AR_SREV_9280_20_OR_LATER(ah)) {
                 for (i = 0; i < Ar5416RateSize; i++) {
                         int8_t pwr_table_offset;
@@ -1388,34 +1423,6 @@ static void ath9k_hw_def_set_txpower(struct ath_hw *ah,
         REG_WRITE(ah, AR_PHY_POWER_TX_SUB,
                   ATH9K_POW_SM(pModal->pwrDecreaseFor3Chain, 6)
                   | ATH9K_POW_SM(pModal->pwrDecreaseFor2Chain, 0));
-
-        i = rate6mb;
-
-        if (IS_CHAN_HT40(chan))
-                i = rateHt40_0;
-        else if (IS_CHAN_HT20(chan))
-                i = rateHt20_0;
-
-        if (AR_SREV_9280_20_OR_LATER(ah))
-                regulatory->max_power_level =
-                        ratesArray[i] + AR5416_PWR_TABLE_OFFSET_DB * 2;
-        else
-                regulatory->max_power_level = ratesArray[i];
-
-        switch(ar5416_get_ntxchains(ah->txchainmask)) {
-        case 1:
-                break;
-        case 2:
-                regulatory->max_power_level += INCREASE_MAXPOW_BY_TWO_CHAIN;
-                break;
-        case 3:
-                regulatory->max_power_level += INCREASE_MAXPOW_BY_THREE_CHAIN;
-                break;
-        default:
-                ath_print(ath9k_hw_common(ah), ATH_DBG_EEPROM,
-                          "Invalid chainmask configuration\n");
-                break;
-        }
 }
 
 static u8 ath9k_hw_def_get_num_ant_config(struct ath_hw *ah,
diff --git a/drivers/net/wireless/ath/ath9k/gpio.c b/drivers/net/wireless/ath/ath9k/gpio.c
index 4a9a68bba32..6a1a482f9dc 100644
--- a/drivers/net/wireless/ath/ath9k/gpio.c
+++ b/drivers/net/wireless/ath/ath9k/gpio.c
@@ -259,7 +259,7 @@ static void ath9k_gen_timer_start(struct ath_hw *ah,
         ath9k_hw_gen_timer_start(ah, timer, timer_next, timer_period);
 
         if ((ah->imask & ATH9K_INT_GENTIMER) == 0) {
-                ath9k_hw_set_interrupts(ah, 0);
+                ath9k_hw_disable_interrupts(ah);
                 ah->imask |= ATH9K_INT_GENTIMER;
                 ath9k_hw_set_interrupts(ah, ah->imask);
         }
@@ -273,7 +273,7 @@ static void ath9k_gen_timer_stop(struct ath_hw *ah, struct ath_gen_timer *timer)
 
         /* if no timer is enabled, turn off interrupt mask */
         if (timer_table->timer_mask.val == 0) {
-                ath9k_hw_set_interrupts(ah, 0);
+                ath9k_hw_disable_interrupts(ah);
                 ah->imask &= ~ATH9K_INT_GENTIMER;
                 ath9k_hw_set_interrupts(ah, ah->imask);
         }
@@ -310,10 +310,8 @@ static void ath_btcoex_period_timer(unsigned long data)
 
                 timer_period = is_btscan ? btcoex->btscan_no_stomp :
                                            btcoex->btcoex_no_stomp;
-                ath9k_gen_timer_start(ah,
-                                      btcoex->no_stomp_timer,
-                                      (ath9k_hw_gettsf32(ah) +
-                                       timer_period), timer_period * 10);
+                ath9k_gen_timer_start(ah, btcoex->no_stomp_timer, 0,
+                                      timer_period * 10);
                 btcoex->hw_timer_enabled = true;
         }
 
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index dfb6560dab9..ae842dbf9b5 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -28,10 +28,16 @@ MODULE_FIRMWARE(FIRMWARE_AR9271);
 static struct usb_device_id ath9k_hif_usb_ids[] = {
         { USB_DEVICE(0x0cf3, 0x9271) }, /* Atheros */
         { USB_DEVICE(0x0cf3, 0x1006) }, /* Atheros */
-        { USB_DEVICE(0x0cf3, 0x7010) }, /* Atheros */
-        { USB_DEVICE(0x0cf3, 0x7015) }, /* Atheros */
+        { USB_DEVICE(0x0cf3, 0x7010),
+                .driver_info = AR7010_DEVICE },
+                                        /* Atheros */
+        { USB_DEVICE(0x0cf3, 0x7015),
+                .driver_info = AR7010_DEVICE | AR9287_DEVICE },
+                                        /* Atheros */
         { USB_DEVICE(0x0846, 0x9030) }, /* Netgear N150 */
-        { USB_DEVICE(0x0846, 0x9018) }, /* Netgear WNDA3200 */
+        { USB_DEVICE(0x0846, 0x9018),
+                .driver_info = AR7010_DEVICE },
+                                        /* Netgear WNDA3200 */
         { USB_DEVICE(0x07D1, 0x3A10) }, /* Dlink Wireless 150 */
         { USB_DEVICE(0x13D3, 0x3327) }, /* Azurewave */
         { USB_DEVICE(0x13D3, 0x3328) }, /* Azurewave */
@@ -40,9 +46,13 @@ static struct usb_device_id ath9k_hif_usb_ids[] = {
         { USB_DEVICE(0x13D3, 0x3349) }, /* Azurewave */
         { USB_DEVICE(0x13D3, 0x3350) }, /* Azurewave */
         { USB_DEVICE(0x04CA, 0x4605) }, /* Liteon */
-        { USB_DEVICE(0x083A, 0xA704) }, /* SMC Networks */
+        { USB_DEVICE(0x083A, 0xA704),
+                .driver_info = AR7010_DEVICE },
+                                        /* SMC Networks */
         { USB_DEVICE(0x040D, 0x3801) }, /* VIA */
-        { USB_DEVICE(0x1668, 0x1200) }, /* Verizon */
+        { USB_DEVICE(0x1668, 0x1200),
+                .driver_info = AR7010_DEVICE | AR9287_DEVICE },
+                                        /* Verizon */
         { },
 };
 
@@ -776,7 +786,8 @@ static void ath9k_hif_usb_dealloc_urbs(struct hif_device_usb *hif_dev)
         ath9k_hif_usb_dealloc_rx_urbs(hif_dev);
 }
 
-static int ath9k_hif_usb_download_fw(struct hif_device_usb *hif_dev)
+static int ath9k_hif_usb_download_fw(struct hif_device_usb *hif_dev,
+                                     u32 drv_info)
 {
         int transfer, err;
         const void *data = hif_dev->firmware->data;
@@ -807,18 +818,10 @@ static int ath9k_hif_usb_download_fw(struct hif_device_usb *hif_dev)
         }
         kfree(buf);
 
-        switch (hif_dev->device_id) {
-        case 0x7010:
-        case 0x7015:
-        case 0x9018:
-        case 0xA704:
-        case 0x1200:
+        if (drv_info & AR7010_DEVICE)
                 firm_offset = AR7010_FIRMWARE_TEXT;
-                break;
-        default:
+        else
                 firm_offset = AR9271_FIRMWARE_TEXT;
-                break;
-        }
 
         /*
          * Issue FW download complete command to firmware.
@@ -836,7 +839,7 @@ static int ath9k_hif_usb_download_fw(struct hif_device_usb *hif_dev)
         return 0;
 }
 
-static int ath9k_hif_usb_dev_init(struct hif_device_usb *hif_dev)
+static int ath9k_hif_usb_dev_init(struct hif_device_usb *hif_dev, u32 drv_info)
 {
         int ret, idx;
         struct usb_host_interface *alt = &hif_dev->interface->altsetting[0];
@@ -852,7 +855,7 @@ static int ath9k_hif_usb_dev_init(struct hif_device_usb *hif_dev)
         }
 
         /* Download firmware */
-        ret = ath9k_hif_usb_download_fw(hif_dev);
+        ret = ath9k_hif_usb_download_fw(hif_dev, drv_info);
         if (ret) {
                 dev_err(&hif_dev->udev->dev,
                         "ath9k_htc: Firmware - %s download failed\n",
@@ -931,23 +934,15 @@ static int ath9k_hif_usb_probe(struct usb_interface *interface,
 
         /* Find out which firmware to load */
 
-        switch(hif_dev->device_id) {
-        case 0x7010:
-        case 0x7015:
-        case 0x9018:
-        case 0xA704:
-        case 0x1200:
+        if (id->driver_info & AR7010_DEVICE)
                 if (le16_to_cpu(udev->descriptor.bcdDevice) == 0x0202)
                         hif_dev->fw_name = FIRMWARE_AR7010_1_1;
                 else
                         hif_dev->fw_name = FIRMWARE_AR7010;
-                break;
-        default:
+        else
                 hif_dev->fw_name = FIRMWARE_AR9271;
-                break;
-        }
 
-        ret = ath9k_hif_usb_dev_init(hif_dev);
+        ret = ath9k_hif_usb_dev_init(hif_dev, id->driver_info);
         if (ret) {
                 ret = -EINVAL;
                 goto err_hif_init_usb;
@@ -955,7 +950,7 @@ static int ath9k_hif_usb_probe(struct usb_interface *interface,
 
         ret = ath9k_htc_hw_init(hif_dev->htc_handle,
                                 &hif_dev->udev->dev, hif_dev->device_id,
-                                hif_dev->udev->product);
+                                hif_dev->udev->product, id->driver_info);
         if (ret) {
                 ret = -EINVAL;
                 goto err_htc_hw_init;
@@ -1033,6 +1028,7 @@ static int ath9k_hif_usb_resume(struct usb_interface *interface)
 {
         struct hif_device_usb *hif_dev =
                 (struct hif_device_usb *) usb_get_intfdata(interface);
+        struct htc_target *htc_handle = hif_dev->htc_handle;
         int ret;
 
         ret = ath9k_hif_usb_alloc_urbs(hif_dev);
@@ -1040,7 +1036,8 @@ static int ath9k_hif_usb_resume(struct usb_interface *interface)
                 return ret;
 
         if (hif_dev->firmware) {
-                ret = ath9k_hif_usb_download_fw(hif_dev);
+                ret = ath9k_hif_usb_download_fw(hif_dev,
+                                htc_handle->drv_priv->ah->common.driver_info);
                 if (ret)
                         goto fail_resume;
         } else {
@@ -1050,7 +1047,7 @@ static int ath9k_hif_usb_resume(struct usb_interface *interface)
 
         mdelay(100);
 
-        ret = ath9k_htc_resume(hif_dev->htc_handle);
+        ret = ath9k_htc_resume(htc_handle);
 
         if (ret)
                 goto fail_resume;
diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
index 75ecf6a30d2..afe39a91190 100644
--- a/drivers/net/wireless/ath/ath9k/htc.h
+++ b/drivers/net/wireless/ath/ath9k/htc.h
@@ -368,7 +368,7 @@ struct ath9k_htc_priv {
         u16 seq_no;
         u32 bmiss_cnt;
 
-        struct ath9k_hw_cal_data caldata[38];
+        struct ath9k_hw_cal_data caldata[ATH9K_NUM_CHANNELS];
 
         spinlock_t beacon_lock;
 
@@ -461,7 +461,7 @@ void ath9k_init_leds(struct ath9k_htc_priv *priv);
 void ath9k_deinit_leds(struct ath9k_htc_priv *priv);
 
 int ath9k_htc_probe_device(struct htc_target *htc_handle, struct device *dev,
-                           u16 devid, char *product);
+                           u16 devid, char *product, u32 drv_info);
 void ath9k_htc_disconnect_device(struct htc_target *htc_handle, bool hotunplug);
 #ifdef CONFIG_PM
 int ath9k_htc_resume(struct htc_target *htc_handle);
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index 7c8a38d0456..071d0c97474 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -181,7 +181,8 @@ static inline int ath9k_htc_connect_svc(struct ath9k_htc_priv *priv,
         return htc_connect_service(priv->htc, &req, ep_id);
 }
 
-static int ath9k_init_htc_services(struct ath9k_htc_priv *priv, u16 devid)
+static int ath9k_init_htc_services(struct ath9k_htc_priv *priv, u16 devid,
+                                   u32 drv_info)
 {
         int ret;
 
@@ -245,17 +246,10 @@ static int ath9k_init_htc_services(struct ath9k_htc_priv *priv, u16 devid)
          * the HIF layer, shouldn't matter much.
          */
 
-        switch(devid) {
-        case 0x7010:
-        case 0x7015:
-        case 0x9018:
-        case 0xA704:
-        case 0x1200:
+        if (drv_info & AR7010_DEVICE)
                 priv->htc->credits = 45;
-                break;
-        default:
+        else
                 priv->htc->credits = 33;
-        }
 
         ret = htc_init(priv->htc);
         if (ret)
@@ -308,7 +302,7 @@ static void ath9k_regwrite_single(void *hw_priv, u32 val, u32 reg_offset)
         struct ath_hw *ah = (struct ath_hw *) hw_priv;
         struct ath_common *common = ath9k_hw_common(ah);
         struct ath9k_htc_priv *priv = (struct ath9k_htc_priv *) common->priv;
-        __be32 buf[2] = {
+        const __be32 buf[2] = {
                 cpu_to_be32(reg_offset),
                 cpu_to_be32(val),
         };
@@ -627,7 +621,8 @@ static void ath9k_init_btcoex(struct ath9k_htc_priv *priv)
 }
 
 static int ath9k_init_priv(struct ath9k_htc_priv *priv,
-                           u16 devid, char *product)
+                           u16 devid, char *product,
+                           u32 drv_info)
 {
         struct ath_hw *ah = NULL;
         struct ath_common *common;
@@ -641,6 +636,7 @@ static int ath9k_init_priv(struct ath9k_htc_priv *priv,
 
         ah->hw_version.devid = devid;
         ah->hw_version.subsysid = 0; /* FIXME */
+        ah->ah_flags |= AH_USE_EEPROM;
         priv->ah = ah;
 
         common = ath9k_hw_common(ah);
@@ -650,6 +646,7 @@ static int ath9k_init_priv(struct ath9k_htc_priv *priv,
         common->hw = priv->hw;
         common->priv = priv;
         common->debug_mask = ath9k_debug;
+        common->driver_info = drv_info;
 
         spin_lock_init(&priv->wmi->wmi_lock);
         spin_lock_init(&priv->beacon_lock);
@@ -762,7 +759,7 @@ static void ath9k_set_hw_capab(struct ath9k_htc_priv *priv,
 }
 
 static int ath9k_init_device(struct ath9k_htc_priv *priv,
-                             u16 devid, char *product)
+                             u16 devid, char *product, u32 drv_info)
 {
         struct ieee80211_hw *hw = priv->hw;
         struct ath_common *common;
@@ -771,7 +768,7 @@ static int ath9k_init_device(struct ath9k_htc_priv *priv,
         struct ath_regulatory *reg;
 
         /* Bring up device */
-        error = ath9k_init_priv(priv, devid, product);
+        error = ath9k_init_priv(priv, devid, product, drv_info);
         if (error != 0)
                 goto err_init;
 
@@ -829,7 +826,7 @@ err_init:
 }
 
 int ath9k_htc_probe_device(struct htc_target *htc_handle, struct device *dev,
-                           u16 devid, char *product)
+                           u16 devid, char *product, u32 drv_info)
 {
         struct ieee80211_hw *hw;
         struct ath9k_htc_priv *priv;
@@ -856,14 +853,14 @@ int ath9k_htc_probe_device(struct htc_target *htc_handle, struct device *dev,
                 goto err_free;
         }
 
-        ret = ath9k_init_htc_services(priv, devid);
+        ret = ath9k_init_htc_services(priv, devid, drv_info);
         if (ret)
                 goto err_init;
 
         /* The device may have been unplugged earlier. */
         priv->op_flags &= ~OP_UNPLUGGED;
 
-        ret = ath9k_init_device(priv, devid, product);
+        ret = ath9k_init_device(priv, devid, product, drv_info);
         if (ret)
                 goto err_init;
 
@@ -893,14 +890,15 @@ void ath9k_htc_disconnect_device(struct htc_target *htc_handle, bool hotunplug)
 #ifdef CONFIG_PM
 int ath9k_htc_resume(struct htc_target *htc_handle)
 {
+        struct ath9k_htc_priv *priv = htc_handle->drv_priv;
         int ret;
 
-        ret = ath9k_htc_wait_for_target(htc_handle->drv_priv);
+        ret = ath9k_htc_wait_for_target(priv);
         if (ret)
                 return ret;
 
-        ret = ath9k_init_htc_services(htc_handle->drv_priv,
-                              htc_handle->drv_priv->ah->hw_version.devid);
+        ret = ath9k_init_htc_services(priv, priv->ah->hw_version.devid,
+                                      priv->ah->common.driver_info);
         return ret;
 }
 #endif
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
index 9a3be8da755..e9761c2c870 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
@@ -29,7 +29,7 @@ static void ath_update_txpow(struct ath9k_htc_priv *priv)
         struct ath_hw *ah = priv->ah;
 
         if (priv->curtxpow != priv->txpowlimit) {
-                ath9k_hw_set_txpowerlimit(ah, priv->txpowlimit);
+                ath9k_hw_set_txpowerlimit(ah, priv->txpowlimit, false);
                 /* read back in case value is clamped */
                 priv->curtxpow = ath9k_hw_regulatory(ah)->power_limit;
         }
@@ -184,47 +184,6 @@ err:
         return ret;
 }
 
-static int ath9k_htc_add_monitor_interface(struct ath9k_htc_priv *priv)
-{
-        struct ath_common *common = ath9k_hw_common(priv->ah);
-        struct ath9k_htc_target_vif hvif;
-        int ret = 0;
-        u8 cmd_rsp;
-
-        if (priv->nvifs > 0)
-                return -ENOBUFS;
-
-        memset(&hvif, 0, sizeof(struct ath9k_htc_target_vif));
-        memcpy(&hvif.myaddr, common->macaddr, ETH_ALEN);
-
-        hvif.opmode = cpu_to_be32(HTC_M_MONITOR);
-        priv->ah->opmode = NL80211_IFTYPE_MONITOR;
-        hvif.index = priv->nvifs;
-
-        WMI_CMD_BUF(WMI_VAP_CREATE_CMDID, &hvif);
-        if (ret)
-                return ret;
-
-        priv->nvifs++;
-        return 0;
-}
-
-static int ath9k_htc_remove_monitor_interface(struct ath9k_htc_priv *priv)
-{
-        struct ath_common *common = ath9k_hw_common(priv->ah);
-        struct ath9k_htc_target_vif hvif;
-        int ret = 0;
-        u8 cmd_rsp;
-
-        memset(&hvif, 0, sizeof(struct ath9k_htc_target_vif));
-        memcpy(&hvif.myaddr, common->macaddr, ETH_ALEN);
-        hvif.index = 0; /* Should do for now */
-        WMI_CMD_BUF(WMI_VAP_REMOVE_CMDID, &hvif);
-        priv->nvifs--;
-
-        return ret;
-}
-
 static int ath9k_htc_add_station(struct ath9k_htc_priv *priv,
                                  struct ieee80211_vif *vif,
                                  struct ieee80211_sta *sta)
@@ -1240,16 +1199,6 @@ static void ath9k_htc_stop(struct ieee80211_hw *hw)
         WMI_CMD(WMI_STOP_RECV_CMDID);
         skb_queue_purge(&priv->tx_queue);
 
-        /* Remove monitor interface here */
-        if (ah->opmode == NL80211_IFTYPE_MONITOR) {
-                if (ath9k_htc_remove_monitor_interface(priv))
-                        ath_print(common, ATH_DBG_FATAL,
-                                  "Unable to remove monitor interface\n");
-                else
-                        ath_print(common, ATH_DBG_CONFIG,
-                                  "Monitor interface removed\n");
-        }
-
         if (ah->btcoex_hw.enabled) {
                 ath9k_hw_btcoex_disable(ah);
                 if (ah->btcoex_hw.scheme == ATH_BTCOEX_CFG_3WIRE)
@@ -1400,7 +1349,9 @@ static int ath9k_htc_config(struct ieee80211_hw *hw, u32 changed)
                 ath_print(common, ATH_DBG_CONFIG, "Set channel: %d MHz\n",
                           curchan->center_freq);
 
-                ath9k_cmn_update_ichannel(hw, &priv->ah->channels[pos]);
+                ath9k_cmn_update_ichannel(&priv->ah->channels[pos],
+                                          hw->conf.channel,
+                                          hw->conf.channel_type);
 
                 if (ath9k_htc_set_channel(priv, hw, &priv->ah->channels[pos]) < 0) {
                         ath_print(common, ATH_DBG_FATAL,
@@ -1421,16 +1372,13 @@ static int ath9k_htc_config(struct ieee80211_hw *hw, u32 changed)
                 }
         }
 
-        if (changed & IEEE80211_CONF_CHANGE_MONITOR) {
+        if (changed & IEEE80211_CONF_CHANGE_MONITOR)
                 if (conf->flags & IEEE80211_CONF_MONITOR) {
-                        if (ath9k_htc_add_monitor_interface(priv))
-                                ath_print(common, ATH_DBG_FATAL,
-                                          "Failed to set monitor mode\n");
-                        else
-                                ath_print(common, ATH_DBG_CONFIG,
-                                          "HW opmode set to Monitor mode\n");
+                        ath_print(common, ATH_DBG_CONFIG,
+                                  "HW opmode set to Monitor mode\n");
+                        priv->ah->opmode = NL80211_IFTYPE_MONITOR;
                 }
-        }
+
 
         if (changed & IEEE80211_CONF_CHANGE_IDLE) {
                 mutex_lock(&priv->htc_pm_lock);
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
index 29d80ca7839..77958675b55 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
@@ -20,8 +20,15 @@
 /* TX */
 /******/
 
+static const int subtype_txq_to_hwq[] = {
+        [WME_AC_BE] = ATH_TXQ_AC_BE,
+        [WME_AC_BK] = ATH_TXQ_AC_BK,
+        [WME_AC_VI] = ATH_TXQ_AC_VI,
+        [WME_AC_VO] = ATH_TXQ_AC_VO,
+};
+
 #define ATH9K_HTC_INIT_TXQ(subtype) do {                        \
-                qi.tqi_subtype = subtype;                       \
+                qi.tqi_subtype = subtype_txq_to_hwq[subtype];   \
                 qi.tqi_aifs = ATH9K_TXQ_USEDEFAULT;             \
                 qi.tqi_cwmin = ATH9K_TXQ_USEDEFAULT;            \
                 qi.tqi_cwmax = ATH9K_TXQ_USEDEFAULT;            \
diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
index 861ec926930..c41ab8c3016 100644
--- a/drivers/net/wireless/ath/ath9k/htc_hst.c
+++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
@@ -462,9 +462,10 @@ void ath9k_htc_hw_free(struct htc_target *htc)
 }
 
 int ath9k_htc_hw_init(struct htc_target *target,
-                      struct device *dev, u16 devid, char *product)
+                      struct device *dev, u16 devid,
+                      char *product, u32 drv_info)
 {
-        if (ath9k_htc_probe_device(target, dev, devid, product)) {
+        if (ath9k_htc_probe_device(target, dev, devid, product, drv_info)) {
                 printk(KERN_ERR "Failed to initialize the device\n");
                 return -ENODEV;
         }
diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.h b/drivers/net/wireless/ath/ath9k/htc_hst.h
index 07b6509d589..6fc1b21faa5 100644
--- a/drivers/net/wireless/ath/ath9k/htc_hst.h
+++ b/drivers/net/wireless/ath/ath9k/htc_hst.h
@@ -239,7 +239,8 @@ struct htc_target *ath9k_htc_hw_alloc(void *hif_handle,
                                       struct device *dev);
 void ath9k_htc_hw_free(struct htc_target *htc);
 int ath9k_htc_hw_init(struct htc_target *target,
-                      struct device *dev, u16 devid, char *product);
+                      struct device *dev, u16 devid, char *product,
+                      u32 drv_info);
 void ath9k_htc_hw_deinit(struct htc_target *target, bool hot_unplug);
 
 #endif /* HTC_HST_H */
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index c7fbe25cc12..380d0c65113 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -310,10 +310,9 @@ static bool ath9k_hw_chip_test(struct ath_hw *ah)
         struct ath_common *common = ath9k_hw_common(ah);
         u32 regAddr[2] = { AR_STA_ID0 };
         u32 regHold[2];
-        u32 patternData[4] = { 0x55555555,
-                               0xaaaaaaaa,
-                               0x66666666,
-                               0x99999999 };
+        static const u32 patternData[4] = {
+                0x55555555, 0xaaaaaaaa, 0x66666666, 0x99999999
+        };
         int i, j, loop_max;
 
         if (!AR_SREV_9300_20_OR_LATER(ah)) {
@@ -419,10 +418,6 @@ static void ath9k_hw_init_defaults(struct ath_hw *ah)
         ah->hw_version.magic = AR5416_MAGIC;
         ah->hw_version.subvendorid = 0;
 
-        ah->ah_flags = 0;
-        if (!AR_SREV_9100(ah))
-                ah->ah_flags = AH_USE_EEPROM;
-
         ah->atim_window = 0;
         ah->sta_id1_defaults =
                 AR_STA_ID1_CRPT_MIC_ENABLE |
@@ -440,7 +435,7 @@ static int ath9k_hw_init_macaddr(struct ath_hw *ah)
         u32 sum;
         int i;
         u16 eeval;
-        u32 EEP_MAC[] = { EEP_MAC_LSW, EEP_MAC_MID, EEP_MAC_MSW };
+        static const u32 EEP_MAC[] = { EEP_MAC_LSW, EEP_MAC_MID, EEP_MAC_MSW };
 
         sum = 0;
         for (i = 0; i < 3; i++) {
@@ -1170,7 +1165,7 @@ static bool ath9k_hw_channel_change(struct ath_hw *ah,
                              channel->max_antenna_gain * 2,
                              channel->max_power * 2,
                              min((u32) MAX_RATE_POWER,
-                             (u32) regulatory->power_limit));
+                             (u32) regulatory->power_limit), false);
 
         ath9k_hw_rfbus_done(ah);
 
@@ -1833,6 +1828,10 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
 
         ah->misc_mode |= AR_PCU_MIC_NEW_LOC_ENA;
 
+        /* enable key search for every frame in an aggregate */
+        if (AR_SREV_9300_20_OR_LATER(ah))
+                ah->misc_mode |= AR_PCU_ALWAYS_PERFORM_KEYSEARCH;
+
         pCap->low_2ghz_chan = 2312;
         pCap->high_2ghz_chan = 2732;
 
@@ -1963,6 +1962,9 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
         if (AR_SREV_9300_20_OR_LATER(ah))
                 pCap->hw_caps |= ATH9K_HW_CAP_RAC_SUPPORTED;
 
+        if (AR_SREV_9300_20_OR_LATER(ah))
+                ah->ent_mode = REG_READ(ah, AR_ENT_OTP);
+
         if (AR_SREV_9287_11_OR_LATER(ah) || AR_SREV_9271(ah))
                 pCap->hw_caps |= ATH9K_HW_CAP_SGI_20;
 
@@ -2177,7 +2179,7 @@ bool ath9k_hw_disable(struct ath_hw *ah)
 }
 EXPORT_SYMBOL(ath9k_hw_disable);
 
-void ath9k_hw_set_txpowerlimit(struct ath_hw *ah, u32 limit)
+void ath9k_hw_set_txpowerlimit(struct ath_hw *ah, u32 limit, bool test)
 {
         struct ath_regulatory *regulatory = ath9k_hw_regulatory(ah);
         struct ath9k_channel *chan = ah->curchan;
@@ -2190,7 +2192,7 @@ void ath9k_hw_set_txpowerlimit(struct ath_hw *ah, u32 limit)
                                  channel->max_antenna_gain * 2,
                                  channel->max_power * 2,
                                  min((u32) MAX_RATE_POWER,
-                                 (u32) regulatory->power_limit));
+                                 (u32) regulatory->power_limit), test);
 }
 EXPORT_SYMBOL(ath9k_hw_set_txpowerlimit);
 
@@ -2324,11 +2326,10 @@ static u32 rightmost_index(struct ath_gen_timer_table *timer_table, u32 *mask)
         return timer_table->gen_timer_index[b];
 }
 
-u32 ath9k_hw_gettsf32(struct ath_hw *ah)
+static u32 ath9k_hw_gettsf32(struct ath_hw *ah)
 {
         return REG_READ(ah, AR_TSF_L32);
 }
-EXPORT_SYMBOL(ath9k_hw_gettsf32);
 
 struct ath_gen_timer *ath_gen_timer_alloc(struct ath_hw *ah,
                                           void (*trigger)(void *),
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index d47d1b4b600..cc8f3b9af71 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -157,6 +157,13 @@
 #define PAPRD_GAIN_TABLE_ENTRIES    32
 #define PAPRD_TABLE_SZ              24
 
+enum ath_hw_txq_subtype {
+        ATH_TXQ_AC_BE = 0,
+        ATH_TXQ_AC_BK = 1,
+        ATH_TXQ_AC_VI = 2,
+        ATH_TXQ_AC_VO = 3,
+};
+
 enum ath_ini_subsys {
         ATH_INI_PRE = 0,
         ATH_INI_CORE,
@@ -478,6 +485,40 @@ struct ath_hw_antcomb_conf {
 };
 
 /**
+ * struct ath_hw_radar_conf - radar detection initialization parameters
+ *
+ * @pulse_inband: threshold for checking the ratio of in-band power
+ *      to total power for short radar pulses (half dB steps)
+ * @pulse_inband_step: threshold for checking an in-band power to total
+ *      power ratio increase for short radar pulses (half dB steps)
+ * @pulse_height: threshold for detecting the beginning of a short
+ *      radar pulse (dB step)
+ * @pulse_rssi: threshold for detecting if a short radar pulse is
+ *      gone (dB step)
+ * @pulse_maxlen: maximum pulse length (0.8 us steps)
+ *
+ * @radar_rssi: RSSI threshold for starting long radar detection (dB steps)
+ * @radar_inband: threshold for checking the ratio of in-band power
+ *      to total power for long radar pulses (half dB steps)
+ * @fir_power: threshold for detecting the end of a long radar pulse (dB)
+ *
+ * @ext_channel: enable extension channel radar detection
+ */
+struct ath_hw_radar_conf {
+        unsigned int pulse_inband;
+        unsigned int pulse_inband_step;
+        unsigned int pulse_height;
+        unsigned int pulse_rssi;
+        unsigned int pulse_maxlen;
+
+        unsigned int radar_rssi;
+        unsigned int radar_inband;
+        int fir_power;
+
+        bool ext_channel;
+};
+
+/**
  * struct ath_hw_private_ops - callbacks used internally by hardware code
  *
  * This structure contains private callbacks designed to only be used internally
@@ -542,6 +583,8 @@ struct ath_hw_private_ops {
         bool (*ani_control)(struct ath_hw *ah, enum ath9k_ani_cmd cmd,
                             int param);
         void (*do_getnf)(struct ath_hw *ah, int16_t nfarray[NUM_NF_READINGS]);
+        void (*set_radar_params)(struct ath_hw *ah,
+                                 struct ath_hw_radar_conf *conf);
 
         /* ANI */
         void (*ani_cache_ini_regs)(struct ath_hw *ah);
@@ -740,6 +783,8 @@ struct ath_hw {
         u8 txchainmask;
         u8 rxchainmask;
 
+        struct ath_hw_radar_conf radar_conf;
+
         u32 originalGain[22];
         int initPDADC;
         int PDADCdelta;
@@ -797,6 +842,9 @@ struct ath_hw {
          * this register when in sleep states.
          */
         u32 WARegVal;
+
+        /* Enterprise mode cap */
+        u32 ent_mode;
 };
 
 static inline struct ath_common *ath9k_hw_common(struct ath_hw *ah)
@@ -819,12 +867,6 @@ static inline struct ath_hw_ops *ath9k_hw_ops(struct ath_hw *ah)
         return &ah->ops;
 }
 
-static inline int sign_extend(int val, const int nbits)
-{
-        int order = BIT(nbits-1);
-        return (val ^ order) - order;
-}
-
 /* Initialization, Detach, Reset */
 const char *ath9k_hw_probe(u16 vendorid, u16 devid);
 void ath9k_hw_deinit(struct ath_hw *ah);
@@ -861,7 +903,7 @@ u32 ath9k_hw_getrxfilter(struct ath_hw *ah);
 void ath9k_hw_setrxfilter(struct ath_hw *ah, u32 bits);
 bool ath9k_hw_phy_disable(struct ath_hw *ah);
 bool ath9k_hw_disable(struct ath_hw *ah);
-void ath9k_hw_set_txpowerlimit(struct ath_hw *ah, u32 limit);
+void ath9k_hw_set_txpowerlimit(struct ath_hw *ah, u32 limit, bool test);
 void ath9k_hw_setopmode(struct ath_hw *ah);
 void ath9k_hw_setmcastfilter(struct ath_hw *ah, u32 filter0, u32 filter1);
 void ath9k_hw_setbssidmask(struct ath_hw *ah);
@@ -893,7 +935,6 @@ void ath9k_hw_gen_timer_stop(struct ath_hw *ah, struct ath_gen_timer *timer);
 
 void ath_gen_timer_free(struct ath_hw *ah, struct ath_gen_timer *timer);
 void ath_gen_timer_isr(struct ath_hw *hw);
-u32 ath9k_hw_gettsf32(struct ath_hw *ah);
 
 void ath9k_hw_name(struct ath_hw *ah, char *hw_name, size_t len);
 
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index 14b8ab386da..84e19e504dd 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -395,7 +395,8 @@ static void ath9k_init_crypto(struct ath_softc *sc)
 
 static int ath9k_init_btcoex(struct ath_softc *sc)
 {
-        int r, qnum;
+        struct ath_txq *txq;
+        int r;
 
         switch (sc->sc_ah->btcoex_hw.scheme) {
         case ATH_BTCOEX_CFG_NONE:
@@ -408,8 +409,8 @@ static int ath9k_init_btcoex(struct ath_softc *sc)
                 r = ath_init_btcoex_timer(sc);
                 if (r)
                         return -1;
-                qnum = sc->tx.hwq_map[WME_AC_BE];
-                ath9k_hw_init_btcoex_hw(sc->sc_ah, qnum);
+                txq = sc->tx.txq_map[WME_AC_BE];
+                ath9k_hw_init_btcoex_hw(sc->sc_ah, txq->axq_qnum);
                 sc->btcoex.bt_stomp_type = ATH_BTCOEX_STOMP_LOW;
                 break;
         default:
@@ -422,59 +423,18 @@ static int ath9k_init_btcoex(struct ath_softc *sc)
 
 static int ath9k_init_queues(struct ath_softc *sc)
 {
-        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         int i = 0;
 
-        for (i = 0; i < ARRAY_SIZE(sc->tx.hwq_map); i++)
-                sc->tx.hwq_map[i] = -1;
-
         sc->beacon.beaconq = ath9k_hw_beaconq_setup(sc->sc_ah);
-        if (sc->beacon.beaconq == -1) {
-                ath_print(common, ATH_DBG_FATAL,
-                          "Unable to setup a beacon xmit queue\n");
-                goto err;
-        }
-
         sc->beacon.cabq = ath_txq_setup(sc, ATH9K_TX_QUEUE_CAB, 0);
-        if (sc->beacon.cabq == NULL) {
-                ath_print(common, ATH_DBG_FATAL,
-                          "Unable to setup CAB xmit queue\n");
-                goto err;
-        }
 
         sc->config.cabqReadytime = ATH_CABQ_READY_TIME;
         ath_cabq_update(sc);
 
-        if (!ath_tx_setup(sc, WME_AC_BK)) {
-                ath_print(common, ATH_DBG_FATAL,
-                          "Unable to setup xmit queue for BK traffic\n");
-                goto err;
-        }
-
-        if (!ath_tx_setup(sc, WME_AC_BE)) {
-                ath_print(common, ATH_DBG_FATAL,
-                          "Unable to setup xmit queue for BE traffic\n");
-                goto err;
-        }
-        if (!ath_tx_setup(sc, WME_AC_VI)) {
-                ath_print(common, ATH_DBG_FATAL,
-                          "Unable to setup xmit queue for VI traffic\n");
-                goto err;
-        }
-        if (!ath_tx_setup(sc, WME_AC_VO)) {
-                ath_print(common, ATH_DBG_FATAL,
-                          "Unable to setup xmit queue for VO traffic\n");
-                goto err;
-        }
+        for (i = 0; i < WME_NUM_AC; i++)
+                sc->tx.txq_map[i] = ath_txq_setup(sc, ATH9K_TX_QUEUE_DATA, i);
 
         return 0;
-
-err:
-        for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++)
-                if (ATH_TXQ_SETUP(sc, i))
-                        ath_tx_cleanupq(sc, &sc->tx.txq[i]);
-
-        return -EIO;
 }
 
 static int ath9k_init_channels_rates(struct ath_softc *sc)
@@ -570,6 +530,9 @@ static int ath9k_init_softc(u16 devid, struct ath_softc *sc, u16 subsysid,
         ah->hw_version.subsysid = subsysid;
         sc->sc_ah = ah;
 
+        if (!sc->dev->platform_data)
+                ah->ah_flags |= AH_USE_EEPROM;
+
         common = ath9k_hw_common(ah);
         common->ops = &ath9k_common_ops;
         common->bus_ops = bus_ops;
@@ -580,7 +543,6 @@ static int ath9k_init_softc(u16 devid, struct ath_softc *sc, u16 subsysid,
         spin_lock_init(&common->cc_lock);
 
         spin_lock_init(&sc->wiphy_lock);
-        spin_lock_init(&sc->sc_resetlock);
         spin_lock_init(&sc->sc_serial_rw);
         spin_lock_init(&sc->sc_pm_lock);
         mutex_init(&sc->mutex);
@@ -642,6 +604,37 @@ err_hw:
         return ret;
 }
 
+static void ath9k_init_band_txpower(struct ath_softc *sc, int band)
+{
+        struct ieee80211_supported_band *sband;
+        struct ieee80211_channel *chan;
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_regulatory *reg = ath9k_hw_regulatory(ah);
+        int i;
+
+        sband = &sc->sbands[band];
+        for (i = 0; i < sband->n_channels; i++) {
+                chan = &sband->channels[i];
+                ah->curchan = &ah->channels[chan->hw_value];
+                ath9k_cmn_update_ichannel(ah->curchan, chan, NL80211_CHAN_HT20);
+                ath9k_hw_set_txpowerlimit(ah, MAX_RATE_POWER, true);
+                chan->max_power = reg->max_power_level / 2;
+        }
+}
+
+static void ath9k_init_txpower_limits(struct ath_softc *sc)
+{
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath9k_channel *curchan = ah->curchan;
+
+        if (ah->caps.hw_caps & ATH9K_HW_CAP_2GHZ)
+                ath9k_init_band_txpower(sc, IEEE80211_BAND_2GHZ);
+        if (ah->caps.hw_caps & ATH9K_HW_CAP_5GHZ)
+                ath9k_init_band_txpower(sc, IEEE80211_BAND_5GHZ);
+
+        ah->curchan = curchan;
+}
+
 void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
 {
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
@@ -705,6 +698,7 @@ int ath9k_init_device(u16 devid, struct ath_softc *sc, u16 subsysid,
                     const struct ath_bus_ops *bus_ops)
 {
         struct ieee80211_hw *hw = sc->hw;
+        struct ath_wiphy *aphy = hw->priv;
         struct ath_common *common;
         struct ath_hw *ah;
         int error = 0;
@@ -737,6 +731,8 @@ int ath9k_init_device(u16 devid, struct ath_softc *sc, u16 subsysid,
         if (error != 0)
                 goto error_rx;
 
+        ath9k_init_txpower_limits(sc);
+
         /* Register with mac80211 */
         error = ieee80211_register_hw(hw);
         if (error)
@@ -754,6 +750,7 @@ int ath9k_init_device(u16 devid, struct ath_softc *sc, u16 subsysid,
         INIT_WORK(&sc->chan_work, ath9k_wiphy_chan_work);
         INIT_DELAYED_WORK(&sc->wiphy_work, ath9k_wiphy_work);
         sc->wiphy_scheduler_int = msecs_to_jiffies(500);
+        aphy->last_rssi = ATH_RSSI_DUMMY_MARKER;
 
         ath_init_leds(sc);
         ath_start_rfkill_poll(sc);
diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
index 8c13479b17c..b04b37b1124 100644
--- a/drivers/net/wireless/ath/ath9k/mac.c
+++ b/drivers/net/wireless/ath/ath9k/mac.c
@@ -117,12 +117,11 @@ EXPORT_SYMBOL(ath9k_hw_numtxpending);
 bool ath9k_hw_updatetxtriglevel(struct ath_hw *ah, bool bIncTrigLevel)
 {
         u32 txcfg, curLevel, newLevel;
-        enum ath9k_int omask;
 
         if (ah->tx_trig_level >= ah->config.max_txtrig_level)
                 return false;
 
-        omask = ath9k_hw_set_interrupts(ah, ah->imask & ~ATH9K_INT_GLOBAL);
+        ath9k_hw_disable_interrupts(ah);
 
         txcfg = REG_READ(ah, AR_TXCFG);
         curLevel = MS(txcfg, AR_FTRIG);
@@ -136,7 +135,7 @@ bool ath9k_hw_updatetxtriglevel(struct ath_hw *ah, bool bIncTrigLevel)
                 REG_WRITE(ah, AR_TXCFG,
                           (txcfg & ~AR_FTRIG) | SM(newLevel, AR_FTRIG));
 
-        ath9k_hw_set_interrupts(ah, omask);
+        ath9k_hw_enable_interrupts(ah);
 
         ah->tx_trig_level = newLevel;
 
@@ -767,14 +766,6 @@ void ath9k_hw_startpcureceive(struct ath_hw *ah, bool is_scanning)
 }
 EXPORT_SYMBOL(ath9k_hw_startpcureceive);
 
-void ath9k_hw_stoppcurecv(struct ath_hw *ah)
-{
-        REG_SET_BIT(ah, AR_DIAG_SW, AR_DIAG_RX_DIS);
-
-        ath9k_hw_disable_mib_counters(ah);
-}
-EXPORT_SYMBOL(ath9k_hw_stoppcurecv);
-
 void ath9k_hw_abortpcurecv(struct ath_hw *ah)
 {
         REG_SET_BIT(ah, AR_DIAG_SW, AR_DIAG_RX_ABORT | AR_DIAG_RX_DIS);
@@ -849,28 +840,59 @@ bool ath9k_hw_intrpend(struct ath_hw *ah)
 }
 EXPORT_SYMBOL(ath9k_hw_intrpend);
 
-enum ath9k_int ath9k_hw_set_interrupts(struct ath_hw *ah,
-                                              enum ath9k_int ints)
+void ath9k_hw_disable_interrupts(struct ath_hw *ah)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        ath_print(common, ATH_DBG_INTERRUPT, "disable IER\n");
+        REG_WRITE(ah, AR_IER, AR_IER_DISABLE);
+        (void) REG_READ(ah, AR_IER);
+        if (!AR_SREV_9100(ah)) {
+                REG_WRITE(ah, AR_INTR_ASYNC_ENABLE, 0);
+                (void) REG_READ(ah, AR_INTR_ASYNC_ENABLE);
+
+                REG_WRITE(ah, AR_INTR_SYNC_ENABLE, 0);
+                (void) REG_READ(ah, AR_INTR_SYNC_ENABLE);
+        }
+}
+EXPORT_SYMBOL(ath9k_hw_disable_interrupts);
+
+void ath9k_hw_enable_interrupts(struct ath_hw *ah)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        if (!(ah->imask & ATH9K_INT_GLOBAL))
+                return;
+
+        ath_print(common, ATH_DBG_INTERRUPT, "enable IER\n");
+        REG_WRITE(ah, AR_IER, AR_IER_ENABLE);
+        if (!AR_SREV_9100(ah)) {
+                REG_WRITE(ah, AR_INTR_ASYNC_ENABLE,
+                          AR_INTR_MAC_IRQ);
+                REG_WRITE(ah, AR_INTR_ASYNC_MASK, AR_INTR_MAC_IRQ);
+
+
+                REG_WRITE(ah, AR_INTR_SYNC_ENABLE,
+                          AR_INTR_SYNC_DEFAULT);
+                REG_WRITE(ah, AR_INTR_SYNC_MASK,
+                          AR_INTR_SYNC_DEFAULT);
+        }
+        ath_print(common, ATH_DBG_INTERRUPT, "AR_IMR 0x%x IER 0x%x\n",
+                  REG_READ(ah, AR_IMR), REG_READ(ah, AR_IER));
+}
+EXPORT_SYMBOL(ath9k_hw_enable_interrupts);
+
+void ath9k_hw_set_interrupts(struct ath_hw *ah, enum ath9k_int ints)
 {
         enum ath9k_int omask = ah->imask;
         u32 mask, mask2;
         struct ath9k_hw_capabilities *pCap = &ah->caps;
         struct ath_common *common = ath9k_hw_common(ah);
 
-        ath_print(common, ATH_DBG_INTERRUPT, "0x%x => 0x%x\n", omask, ints);
-
-        if (omask & ATH9K_INT_GLOBAL) {
-                ath_print(common, ATH_DBG_INTERRUPT, "disable IER\n");
-                REG_WRITE(ah, AR_IER, AR_IER_DISABLE);
-                (void) REG_READ(ah, AR_IER);
-                if (!AR_SREV_9100(ah)) {
-                        REG_WRITE(ah, AR_INTR_ASYNC_ENABLE, 0);
-                        (void) REG_READ(ah, AR_INTR_ASYNC_ENABLE);
+        if (!(ints & ATH9K_INT_GLOBAL))
+                ath9k_hw_enable_interrupts(ah);
 
-                        REG_WRITE(ah, AR_INTR_SYNC_ENABLE, 0);
-                        (void) REG_READ(ah, AR_INTR_SYNC_ENABLE);
-                }
-        }
+        ath_print(common, ATH_DBG_INTERRUPT, "0x%x => 0x%x\n", omask, ints);
 
         /* TODO: global int Ref count */
         mask = ints & ATH9K_INT_COMMON;
@@ -946,24 +968,8 @@ enum ath9k_int ath9k_hw_set_interrupts(struct ath_hw *ah,
                         REG_CLR_BIT(ah, AR_IMR_S5, AR_IMR_S5_TIM_TIMER);
         }
 
-        if (ints & ATH9K_INT_GLOBAL) {
-                ath_print(common, ATH_DBG_INTERRUPT, "enable IER\n");
-                REG_WRITE(ah, AR_IER, AR_IER_ENABLE);
-                if (!AR_SREV_9100(ah)) {
-                        REG_WRITE(ah, AR_INTR_ASYNC_ENABLE,
-                                  AR_INTR_MAC_IRQ);
-                        REG_WRITE(ah, AR_INTR_ASYNC_MASK, AR_INTR_MAC_IRQ);
-
-
-                        REG_WRITE(ah, AR_INTR_SYNC_ENABLE,
-                                  AR_INTR_SYNC_DEFAULT);
-                        REG_WRITE(ah, AR_INTR_SYNC_MASK,
-                                  AR_INTR_SYNC_DEFAULT);
-                }
-                ath_print(common, ATH_DBG_INTERRUPT, "AR_IMR 0x%x IER 0x%x\n",
-                          REG_READ(ah, AR_IMR), REG_READ(ah, AR_IER));
-        }
+        ath9k_hw_enable_interrupts(ah);
 
-        return omask;
+        return;
 }
 EXPORT_SYMBOL(ath9k_hw_set_interrupts);
diff --git a/drivers/net/wireless/ath/ath9k/mac.h b/drivers/net/wireless/ath/ath9k/mac.h
index 7c1a34d64f6..7512f97e8f4 100644
--- a/drivers/net/wireless/ath/ath9k/mac.h
+++ b/drivers/net/wireless/ath/ath9k/mac.h
@@ -104,13 +104,11 @@ struct ath_tx_status {
         u32 ts_tstamp;
         u16 ts_seqnum;
         u8 ts_status;
-        u8 ts_ratecode;
         u8 ts_rateindex;
         int8_t ts_rssi;
         u8 ts_shortretry;
         u8 ts_longretry;
         u8 ts_virtcol;
-        u8 ts_antenna;
         u8 ts_flags;
         int8_t ts_rssi_ctl0;
         int8_t ts_rssi_ctl1;
@@ -121,7 +119,6 @@ struct ath_tx_status {
         u8 qid;
         u16 desc_id;
         u8 tid;
-        u8 pad[2];
         u32 ba_low;
         u32 ba_high;
         u32 evm0;
@@ -240,7 +237,7 @@ struct ath_desc {
         u32 ds_ctl1;
         u32 ds_hw[20];
         void *ds_vdata;
-} __packed;
+} __packed __aligned(4);
 
 #define ATH9K_TXDESC_CLRDMASK           0x0001
 #define ATH9K_TXDESC_NOACK              0x0002
@@ -310,7 +307,7 @@ struct ar5416_desc {
                         u32 status8;
                 } rx;
         } u;
-} __packed;
+} __packed __aligned(4);
 
 #define AR5416DESC(_ds)         ((struct ar5416_desc *)(_ds))
 #define AR5416DESC_CONST(_ds)   ((const struct ar5416_desc *)(_ds))
@@ -669,6 +666,7 @@ enum ath9k_key_type {
 
 struct ath_hw;
 struct ath9k_channel;
+enum ath9k_int;
 
 u32 ath9k_hw_gettxbuf(struct ath_hw *ah, u32 q);
 void ath9k_hw_puttxbuf(struct ath_hw *ah, u32 q, u32 txdp);
@@ -693,15 +691,15 @@ void ath9k_hw_setuprxdesc(struct ath_hw *ah, struct ath_desc *ds,
 bool ath9k_hw_setrxabort(struct ath_hw *ah, bool set);
 void ath9k_hw_putrxbuf(struct ath_hw *ah, u32 rxdp);
 void ath9k_hw_startpcureceive(struct ath_hw *ah, bool is_scanning);
-void ath9k_hw_stoppcurecv(struct ath_hw *ah);
 void ath9k_hw_abortpcurecv(struct ath_hw *ah);
 bool ath9k_hw_stopdmarecv(struct ath_hw *ah);
 int ath9k_hw_beaconq_setup(struct ath_hw *ah);
 
 /* Interrupt Handling */
 bool ath9k_hw_intrpend(struct ath_hw *ah);
-enum ath9k_int ath9k_hw_set_interrupts(struct ath_hw *ah,
-                                       enum ath9k_int ints);
+void ath9k_hw_set_interrupts(struct ath_hw *ah, enum ath9k_int ints);
+void ath9k_hw_enable_interrupts(struct ath_hw *ah);
+void ath9k_hw_disable_interrupts(struct ath_hw *ah);
 
 void ar9002_hw_attach_mac_ops(struct ath_hw *ah);
 
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index dace215b693..7acd6b0ca01 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -23,7 +23,7 @@ static void ath_update_txpow(struct ath_softc *sc)
         struct ath_hw *ah = sc->sc_ah;
 
         if (sc->curtxpow != sc->config.txpowlimit) {
-                ath9k_hw_set_txpowerlimit(ah, sc->config.txpowlimit);
+                ath9k_hw_set_txpowerlimit(ah, sc->config.txpowlimit, false);
                 /* read back in case value is clamped */
                 sc->curtxpow = ath9k_hw_regulatory(ah)->power_limit;
         }
@@ -234,6 +234,8 @@ int ath_set_channel(struct ath_softc *sc, struct ieee80211_hw *hw,
 
         ath9k_ps_wakeup(sc);
 
+        spin_lock_bh(&sc->sc_pcu_lock);
+
         /*
          * This is only performed if the channel settings have
          * actually changed.
@@ -243,11 +245,9 @@ int ath_set_channel(struct ath_softc *sc, struct ieee80211_hw *hw,
          * hardware at the new frequency, and then re-enable
          * the relevant bits of the h/w.
          */
-        ath9k_hw_set_interrupts(ah, 0);
+        ath9k_hw_disable_interrupts(ah);
         ath_drain_all_txq(sc, false);
 
-        spin_lock_bh(&sc->rx.pcu_lock);
-
         stopped = ath_stoprecv(sc);
 
         /* XXX: do not flush receive queue here. We don't want
@@ -266,30 +266,22 @@ int ath_set_channel(struct ath_softc *sc, struct ieee80211_hw *hw,
                   channel->center_freq, conf_is_ht40(conf),
                   fastcc);
 
-        spin_lock_bh(&sc->sc_resetlock);
-
         r = ath9k_hw_reset(ah, hchan, caldata, fastcc);
         if (r) {
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to reset channel (%u MHz), "
                           "reset status %d\n",
                           channel->center_freq, r);
-                spin_unlock_bh(&sc->sc_resetlock);
-                spin_unlock_bh(&sc->rx.pcu_lock);
                 goto ps_restore;
         }
-        spin_unlock_bh(&sc->sc_resetlock);
 
         if (ath_startrecv(sc) != 0) {
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to restart recv logic\n");
                 r = -EIO;
-                spin_unlock_bh(&sc->rx.pcu_lock);
                 goto ps_restore;
         }
 
-        spin_unlock_bh(&sc->rx.pcu_lock);
-
         ath_update_txpow(sc);
         ath9k_hw_set_interrupts(ah, ah->imask);
 
@@ -300,6 +292,8 @@ int ath_set_channel(struct ath_softc *sc, struct ieee80211_hw *hw,
         }
 
  ps_restore:
+        spin_unlock_bh(&sc->sc_pcu_lock);
+
         ath9k_ps_restore(sc);
         return r;
 }
@@ -340,7 +334,7 @@ void ath_paprd_calibrate(struct work_struct *work)
         struct ath_tx_control txctl;
         struct ath9k_hw_cal_data *caldata = ah->caldata;
         struct ath_common *common = ath9k_hw_common(ah);
-        int qnum, ftype;
+        int ftype;
         int chain_ok = 0;
         int chain;
         int len = 1800;
@@ -367,8 +361,7 @@ void ath_paprd_calibrate(struct work_struct *work)
         memcpy(hdr->addr3, hw->wiphy->perm_addr, ETH_ALEN);
 
         memset(&txctl, 0, sizeof(txctl));
-        qnum = sc->tx.hwq_map[WME_AC_BE];
-        txctl.txq = &sc->tx.txq[qnum];
+        txctl.txq = sc->tx.txq_map[WME_AC_BE];
 
         ath9k_ps_wakeup(sc);
         ar9003_paprd_init_table(ah);
@@ -386,6 +379,7 @@ void ath_paprd_calibrate(struct work_struct *work)
                 }
 
                 init_completion(&sc->paprd_complete);
+                sc->paprd_pending = true;
                 ar9003_paprd_setup_gain_table(ah, chain);
                 txctl.paprd = BIT(chain);
                 if (ath_tx_start(hw, skb, &txctl) != 0)
@@ -393,6 +387,7 @@ void ath_paprd_calibrate(struct work_struct *work)
 
                 time_left = wait_for_completion_timeout(&sc->paprd_complete,
                                 msecs_to_jiffies(ATH_PAPRD_TIMEOUT));
+                sc->paprd_pending = false;
                 if (!time_left) {
                         ath_print(ath9k_hw_common(ah), ATH_DBG_CALIBRATE,
                                   "Timeout waiting for paprd training on "
@@ -566,7 +561,6 @@ static void ath_node_attach(struct ath_softc *sc, struct ieee80211_sta *sta)
                 an->maxampdu = 1 << (IEEE80211_HT_MAX_AMPDU_FACTOR +
                                      sta->ht_cap.ampdu_factor);
                 an->mpdudensity = parse_mpdudensity(sta->ht_cap.ampdu_density);
-                an->last_rssi = ATH_RSSI_DUMMY_MARKER;
         }
 }
 
@@ -614,6 +608,8 @@ void ath9k_tasklet(unsigned long data)
                 return;
         }
 
+        spin_lock_bh(&sc->sc_pcu_lock);
+
         if (!ath9k_hw_check_alive(ah))
                 ieee80211_queue_work(sc->hw, &sc->hw_check_work);
 
@@ -624,15 +620,12 @@ void ath9k_tasklet(unsigned long data)
                 rxmask = (ATH9K_INT_RX | ATH9K_INT_RXEOL | ATH9K_INT_RXORN);
 
         if (status & rxmask) {
-                spin_lock_bh(&sc->rx.pcu_lock);
-
                 /* Check for high priority Rx first */
                 if ((ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) &&
                     (status & ATH9K_INT_RXHP))
                         ath_rx_tasklet(sc, 0, true);
 
                 ath_rx_tasklet(sc, 0, false);
-                spin_unlock_bh(&sc->rx.pcu_lock);
         }
 
         if (status & ATH9K_INT_TX) {
@@ -657,7 +650,9 @@ void ath9k_tasklet(unsigned long data)
                         ath_gen_timer_isr(sc->sc_ah);
 
         /* re-enable hardware interrupt */
-        ath9k_hw_set_interrupts(ah, ah->imask);
+        ath9k_hw_enable_interrupts(ah);
+
+        spin_unlock_bh(&sc->sc_pcu_lock);
         ath9k_ps_restore(sc);
 }
 
@@ -756,7 +751,7 @@ irqreturn_t ath_isr(int irq, void *dev)
                  * interrupt; otherwise it will continue to
                  * fire.
                  */
-                ath9k_hw_set_interrupts(ah, 0);
+                ath9k_hw_disable_interrupts(ah);
                 /*
                  * Let the hal handle the event. We assume
                  * it will clear whatever condition caused
@@ -765,7 +760,7 @@ irqreturn_t ath_isr(int irq, void *dev)
                 spin_lock(&common->cc_lock);
                 ath9k_hw_proc_mib_event(ah);
                 spin_unlock(&common->cc_lock);
-                ath9k_hw_set_interrupts(ah, ah->imask);
+                ath9k_hw_enable_interrupts(ah);
         }
 
         if (!(ah->caps.hw_caps & ATH9K_HW_CAP_AUTOSLEEP))
@@ -782,8 +777,8 @@ chip_reset:
         ath_debug_stat_interrupt(sc, status);
 
         if (sched) {
-                /* turn off every interrupt except SWBA */
-                ath9k_hw_set_interrupts(ah, (ah->imask & ATH9K_INT_SWBA));
+                /* turn off every interrupt */
+                ath9k_hw_disable_interrupts(ah);
                 tasklet_schedule(&sc->intr_tq);
         }
 
@@ -835,9 +830,11 @@ static u32 ath_get_extchanmode(struct ath_softc *sc,
 }
 
 static void ath9k_bss_assoc_info(struct ath_softc *sc,
+                                 struct ieee80211_hw *hw,
                                  struct ieee80211_vif *vif,
                                  struct ieee80211_bss_conf *bss_conf)
 {
+        struct ath_wiphy *aphy = hw->priv;
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
 
@@ -861,6 +858,7 @@ static void ath9k_bss_assoc_info(struct ath_softc *sc,
                 ath_beacon_config(sc, vif);
 
                 /* Reset rssi stats */
+                aphy->last_rssi = ATH_RSSI_DUMMY_MARKER;
                 sc->sc_ah->stats.avgbrssi = ATH_RSSI_DUMMY_MARKER;
 
                 sc->sc_flags |= SC_OP_ANI_RUN;
@@ -882,13 +880,13 @@ void ath_radio_enable(struct ath_softc *sc, struct ieee80211_hw *hw)
         int r;
 
         ath9k_ps_wakeup(sc);
+        spin_lock_bh(&sc->sc_pcu_lock);
+
         ath9k_hw_configpcipowersave(ah, 0, 0);
 
         if (!ah->curchan)
                 ah->curchan = ath_get_curchannel(sc, sc->hw);
 
-        spin_lock_bh(&sc->rx.pcu_lock);
-        spin_lock_bh(&sc->sc_resetlock);
         r = ath9k_hw_reset(ah, ah->curchan, ah->caldata, false);
         if (r) {
                 ath_print(common, ATH_DBG_FATAL,
@@ -896,17 +894,14 @@ void ath_radio_enable(struct ath_softc *sc, struct ieee80211_hw *hw)
                           "reset status %d\n",
                           channel->center_freq, r);
         }
-        spin_unlock_bh(&sc->sc_resetlock);
 
         ath_update_txpow(sc);
         if (ath_startrecv(sc) != 0) {
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to restart recv logic\n");
-                spin_unlock_bh(&sc->rx.pcu_lock);
+                spin_unlock_bh(&sc->sc_pcu_lock);
                 return;
         }
-        spin_unlock_bh(&sc->rx.pcu_lock);
-
         if (sc->sc_flags & SC_OP_BEACONS)
                 ath_beacon_config(sc, NULL);    /* restart beacons */
 
@@ -919,6 +914,8 @@ void ath_radio_enable(struct ath_softc *sc, struct ieee80211_hw *hw)
         ath9k_hw_set_gpio(ah, ah->led_pin, 0);
 
         ieee80211_wake_queues(hw);
+        spin_unlock_bh(&sc->sc_pcu_lock);
+
         ath9k_ps_restore(sc);
 }
 
@@ -929,6 +926,8 @@ void ath_radio_disable(struct ath_softc *sc, struct ieee80211_hw *hw)
         int r;
 
         ath9k_ps_wakeup(sc);
+        spin_lock_bh(&sc->sc_pcu_lock);
+
         ieee80211_stop_queues(hw);
 
         /*
@@ -941,19 +940,16 @@ void ath_radio_disable(struct ath_softc *sc, struct ieee80211_hw *hw)
         }
 
         /* Disable interrupts */
-        ath9k_hw_set_interrupts(ah, 0);
+        ath9k_hw_disable_interrupts(ah);
 
         ath_drain_all_txq(sc, false);   /* clear pending tx frames */
 
-        spin_lock_bh(&sc->rx.pcu_lock);
-
         ath_stoprecv(sc);               /* turn off frame recv */
         ath_flushrecv(sc);              /* flush recv queue */
 
         if (!ah->curchan)
                 ah->curchan = ath_get_curchannel(sc, hw);
 
-        spin_lock_bh(&sc->sc_resetlock);
         r = ath9k_hw_reset(ah, ah->curchan, ah->caldata, false);
         if (r) {
                 ath_print(ath9k_hw_common(sc->sc_ah), ATH_DBG_FATAL,
@@ -961,14 +957,14 @@ void ath_radio_disable(struct ath_softc *sc, struct ieee80211_hw *hw)
                           "reset status %d\n",
                           channel->center_freq, r);
         }
-        spin_unlock_bh(&sc->sc_resetlock);
 
         ath9k_hw_phy_disable(ah);
 
-        spin_unlock_bh(&sc->rx.pcu_lock);
-
         ath9k_hw_configpcipowersave(ah, 1, 1);
+
+        spin_unlock_bh(&sc->sc_pcu_lock);
         ath9k_ps_restore(sc);
+
         ath9k_setpower(sc, ATH9K_PM_FULL_SLEEP);
 }
 
@@ -982,29 +978,25 @@ int ath_reset(struct ath_softc *sc, bool retry_tx)
         /* Stop ANI */
         del_timer_sync(&common->ani.timer);
 
+        spin_lock_bh(&sc->sc_pcu_lock);
+
         ieee80211_stop_queues(hw);
 
-        ath9k_hw_set_interrupts(ah, 0);
+        ath9k_hw_disable_interrupts(ah);
         ath_drain_all_txq(sc, retry_tx);
 
-        spin_lock_bh(&sc->rx.pcu_lock);
-
         ath_stoprecv(sc);
         ath_flushrecv(sc);
 
-        spin_lock_bh(&sc->sc_resetlock);
         r = ath9k_hw_reset(ah, sc->sc_ah->curchan, ah->caldata, false);
         if (r)
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to reset hardware; reset status %d\n", r);
-        spin_unlock_bh(&sc->sc_resetlock);
 
         if (ath_startrecv(sc) != 0)
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to start recv logic\n");
 
-        spin_unlock_bh(&sc->rx.pcu_lock);
-
         /*
          * We may be doing a reset in response to a request
          * that changes the channel so update any state that
@@ -1029,6 +1021,7 @@ int ath_reset(struct ath_softc *sc, bool retry_tx)
         }
 
         ieee80211_wake_queues(hw);
+        spin_unlock_bh(&sc->sc_pcu_lock);
 
         /* Start ANI */
         ath_start_ani(common);
@@ -1036,56 +1029,6 @@ int ath_reset(struct ath_softc *sc, bool retry_tx)
         return r;
 }
 
-static int ath_get_hal_qnum(u16 queue, struct ath_softc *sc)
-{
-        int qnum;
-
-        switch (queue) {
-        case 0:
-                qnum = sc->tx.hwq_map[WME_AC_VO];
-                break;
-        case 1:
-                qnum = sc->tx.hwq_map[WME_AC_VI];
-                break;
-        case 2:
-                qnum = sc->tx.hwq_map[WME_AC_BE];
-                break;
-        case 3:
-                qnum = sc->tx.hwq_map[WME_AC_BK];
-                break;
-        default:
-                qnum = sc->tx.hwq_map[WME_AC_BE];
-                break;
-        }
-
-        return qnum;
-}
-
-int ath_get_mac80211_qnum(u32 queue, struct ath_softc *sc)
-{
-        int qnum;
-
-        switch (queue) {
-        case WME_AC_VO:
-                qnum = 0;
-                break;
-        case WME_AC_VI:
-                qnum = 1;
-                break;
-        case WME_AC_BE:
-                qnum = 2;
-                break;
-        case WME_AC_BK:
-                qnum = 3;
-                break;
-        default:
-                qnum = -1;
-                break;
-        }
-
-        return qnum;
-}
-
 /* XXX: Remove me once we don't depend on ath9k_channel for all
  * this redundant data */
 void ath9k_update_ichannel(struct ath_softc *sc, struct ieee80211_hw *hw,
@@ -1167,19 +1110,16 @@ static int ath9k_start(struct ieee80211_hw *hw)
          * be followed by initialization of the appropriate bits
          * and then setup of the interrupt mask.
          */
-        spin_lock_bh(&sc->rx.pcu_lock);
-        spin_lock_bh(&sc->sc_resetlock);
+        spin_lock_bh(&sc->sc_pcu_lock);
         r = ath9k_hw_reset(ah, init_channel, ah->caldata, false);
         if (r) {
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to reset hardware; reset status %d "
                           "(freq %u MHz)\n", r,
                           curchan->center_freq);
-                spin_unlock_bh(&sc->sc_resetlock);
-                spin_unlock_bh(&sc->rx.pcu_lock);
+                spin_unlock_bh(&sc->sc_pcu_lock);
                 goto mutex_unlock;
         }
-        spin_unlock_bh(&sc->sc_resetlock);
 
         /*
          * This is needed only to setup initial state
@@ -1198,10 +1138,10 @@ static int ath9k_start(struct ieee80211_hw *hw)
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to start recv logic\n");
                 r = -EIO;
-                spin_unlock_bh(&sc->rx.pcu_lock);
+                spin_unlock_bh(&sc->sc_pcu_lock);
                 goto mutex_unlock;
         }
-        spin_unlock_bh(&sc->rx.pcu_lock);
+        spin_unlock_bh(&sc->sc_pcu_lock);
 
         /* Setup our intr mask. */
         ah->imask = ATH9K_INT_TX | ATH9K_INT_RXEOL |
@@ -1254,14 +1194,11 @@ mutex_unlock:
 static int ath9k_tx(struct ieee80211_hw *hw,
                     struct sk_buff *skb)
 {
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct ath_wiphy *aphy = hw->priv;
         struct ath_softc *sc = aphy->sc;
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ath_tx_control txctl;
-        int padpos, padsize;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        int qnum;
 
         if (aphy->state != ATH_WIPHY_ACTIVE && aphy->state != ATH_WIPHY_SCAN) {
                 ath_print(common, ATH_DBG_XMIT,
@@ -1311,31 +1248,7 @@ static int ath9k_tx(struct ieee80211_hw *hw,
         }
 
         memset(&txctl, 0, sizeof(struct ath_tx_control));
-
-        /*
-         * As a temporary workaround, assign seq# here; this will likely need
-         * to be cleaned up to work better with Beacon transmission and virtual
-         * BSSes.
-         */
-        if (info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ) {
-                if (info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT)
-                        sc->tx.seq_no += 0x10;
-                hdr->seq_ctrl &= cpu_to_le16(IEEE80211_SCTL_FRAG);
-                hdr->seq_ctrl |= cpu_to_le16(sc->tx.seq_no);
-        }
-
-        /* Add the padding after the header if this is not already done */
-        padpos = ath9k_cmn_padpos(hdr->frame_control);
-        padsize = padpos & 3;
-        if (padsize && skb->len>padpos) {
-                if (skb_headroom(skb) < padsize)
-                        return -1;
-                skb_push(skb, padsize);
-                memmove(skb->data, skb->data + padsize, padpos);
-        }
-
-        qnum = ath_get_hal_qnum(skb_get_queue_mapping(skb), sc);
-        txctl.txq = &sc->tx.txq[qnum];
+        txctl.txq = sc->tx.txq_map[skb_get_queue_mapping(skb)];
 
         ath_print(common, ATH_DBG_XMIT, "transmitting packet, skb: %p\n", skb);
 
@@ -1399,22 +1312,25 @@ static void ath9k_stop(struct ieee80211_hw *hw)
                         ath9k_btcoex_timer_pause(sc);
         }
 
+        spin_lock_bh(&sc->sc_pcu_lock);
+
         /* make sure h/w will not generate any interrupt
          * before setting the invalid flag. */
-        ath9k_hw_set_interrupts(ah, 0);
+        ath9k_hw_disable_interrupts(ah);
 
-        spin_lock_bh(&sc->rx.pcu_lock);
         if (!(sc->sc_flags & SC_OP_INVALID)) {
                 ath_drain_all_txq(sc, false);
                 ath_stoprecv(sc);
                 ath9k_hw_phy_disable(ah);
         } else
                 sc->rx.rxlink = NULL;
-        spin_unlock_bh(&sc->rx.pcu_lock);
 
         /* disable HAL and put h/w to sleep */
         ath9k_hw_disable(ah);
         ath9k_hw_configpcipowersave(ah, 1, 1);
+
+        spin_unlock_bh(&sc->sc_pcu_lock);
+
         ath9k_ps_restore(sc);
 
         /* Finally, put the chip in FULL SLEEP mode */
@@ -1830,12 +1746,15 @@ static int ath9k_conf_tx(struct ieee80211_hw *hw, u16 queue,
         struct ath_wiphy *aphy = hw->priv;
         struct ath_softc *sc = aphy->sc;
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        struct ath_txq *txq;
         struct ath9k_tx_queue_info qi;
-        int ret = 0, qnum;
+        int ret = 0;
 
         if (queue >= WME_NUM_AC)
                 return 0;
 
+        txq = sc->tx.txq_map[queue];
+
         mutex_lock(&sc->mutex);
 
         memset(&qi, 0, sizeof(struct ath9k_tx_queue_info));
@@ -1844,20 +1763,19 @@ static int ath9k_conf_tx(struct ieee80211_hw *hw, u16 queue,
         qi.tqi_cwmin = params->cw_min;
         qi.tqi_cwmax = params->cw_max;
         qi.tqi_burstTime = params->txop;
-        qnum = ath_get_hal_qnum(queue, sc);
 
         ath_print(common, ATH_DBG_CONFIG,
                   "Configure tx [queue/halq] [%d/%d],  "
                   "aifs: %d, cw_min: %d, cw_max: %d, txop: %d\n",
-                  queue, qnum, params->aifs, params->cw_min,
+                  queue, txq->axq_qnum, params->aifs, params->cw_min,
                   params->cw_max, params->txop);
 
-        ret = ath_txq_update(sc, qnum, &qi);
+        ret = ath_txq_update(sc, txq->axq_qnum, &qi);
         if (ret)
                 ath_print(common, ATH_DBG_FATAL, "TXQ Update failed\n");
 
         if (sc->sc_ah->opmode == NL80211_IFTYPE_ADHOC)
-                if ((qnum == sc->tx.hwq_map[WME_AC_BE]) && !ret)
+                if (queue == WME_AC_BE && !ret)
                         ath_beaconq_config(sc);
 
         mutex_unlock(&sc->mutex);
@@ -2019,7 +1937,7 @@ static void ath9k_bss_info_changed(struct ieee80211_hw *hw,
         if (changed & BSS_CHANGED_ASSOC) {
                 ath_print(common, ATH_DBG_CONFIG, "BSS Changed ASSOC %d\n",
                         bss_conf->assoc);
-                ath9k_bss_assoc_info(sc, vif, bss_conf);
+                ath9k_bss_assoc_info(sc, hw, vif, bss_conf);
         }
 
         mutex_unlock(&sc->mutex);
@@ -2082,6 +2000,9 @@ static int ath9k_ampdu_action(struct ieee80211_hw *hw,
         case IEEE80211_AMPDU_RX_STOP:
                 break;
         case IEEE80211_AMPDU_TX_START:
+                if (!(sc->sc_flags & SC_OP_TXAGGR))
+                        return -EOPNOTSUPP;
+
                 ath9k_ps_wakeup(sc);
                 ret = ath_tx_aggr_start(sc, sta, tid, ssn);
                 if (!ret)
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index b5b651413e7..09f69a9617f 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -16,6 +16,7 @@
 
 #include <linux/nl80211.h>
 #include <linux/pci.h>
+#include <linux/ath9k_platform.h>
 #include "ath9k.h"
 
 static DEFINE_PCI_DEVICE_TABLE(ath_pci_id_table) = {
@@ -53,21 +54,36 @@ static void ath_pci_read_cachesize(struct ath_common *common, int *csz)
 
 static bool ath_pci_eeprom_read(struct ath_common *common, u32 off, u16 *data)
 {
-        struct ath_hw *ah = (struct ath_hw *) common->ah;
-
-        common->ops->read(ah, AR5416_EEPROM_OFFSET + (off << AR5416_EEPROM_S));
-
-        if (!ath9k_hw_wait(ah,
-                           AR_EEPROM_STATUS_DATA,
-                           AR_EEPROM_STATUS_DATA_BUSY |
-                           AR_EEPROM_STATUS_DATA_PROT_ACCESS, 0,
-                           AH_WAIT_TIMEOUT)) {
-                return false;
+        struct ath_softc *sc = (struct ath_softc *) common->priv;
+        struct ath9k_platform_data *pdata = sc->dev->platform_data;
+
+        if (pdata) {
+                if (off >= (ARRAY_SIZE(pdata->eeprom_data))) {
+                        ath_print(common, ATH_DBG_FATAL,
+                                  "%s: eeprom read failed, offset %08x "
+                                  "is out of range\n",
+                                  __func__, off);
+                }
+
+                *data = pdata->eeprom_data[off];
+        } else {
+                struct ath_hw *ah = (struct ath_hw *) common->ah;
+
+                common->ops->read(ah, AR5416_EEPROM_OFFSET +
+                                      (off << AR5416_EEPROM_S));
+
+                if (!ath9k_hw_wait(ah,
+                                   AR_EEPROM_STATUS_DATA,
+                                   AR_EEPROM_STATUS_DATA_BUSY |
+                                   AR_EEPROM_STATUS_DATA_PROT_ACCESS, 0,
+                                   AH_WAIT_TIMEOUT)) {
+                        return false;
+                }
+
+                *data = MS(common->ops->read(ah, AR_EEPROM_STATUS_DATA),
+                           AR_EEPROM_STATUS_DATA_VAL);
         }
 
-        *data = MS(common->ops->read(ah, AR_EEPROM_STATUS_DATA),
-                   AR_EEPROM_STATUS_DATA_VAL);
-
         return true;
 }
 
@@ -247,34 +263,25 @@ static void ath_pci_remove(struct pci_dev *pdev)
 
 #ifdef CONFIG_PM
 
-static int ath_pci_suspend(struct pci_dev *pdev, pm_message_t state)
+static int ath_pci_suspend(struct device *device)
 {
+        struct pci_dev *pdev = to_pci_dev(device);
         struct ieee80211_hw *hw = pci_get_drvdata(pdev);
         struct ath_wiphy *aphy = hw->priv;
         struct ath_softc *sc = aphy->sc;
 
         ath9k_hw_set_gpio(sc->sc_ah, sc->sc_ah->led_pin, 1);
 
-        pci_save_state(pdev);
-        pci_disable_device(pdev);
-        pci_set_power_state(pdev, PCI_D3hot);
-
         return 0;
 }
 
-static int ath_pci_resume(struct pci_dev *pdev)
+static int ath_pci_resume(struct device *device)
 {
+        struct pci_dev *pdev = to_pci_dev(device);
         struct ieee80211_hw *hw = pci_get_drvdata(pdev);
         struct ath_wiphy *aphy = hw->priv;
         struct ath_softc *sc = aphy->sc;
         u32 val;
-        int err;
-
-        pci_restore_state(pdev);
-
-        err = pci_enable_device(pdev);
-        if (err)
-                return err;
 
         /*
          * Suspend/Resume resets the PCI configuration space, so we have to
@@ -293,7 +300,23 @@ static int ath_pci_resume(struct pci_dev *pdev)
         return 0;
 }
 
-#endif /* CONFIG_PM */
+static const struct dev_pm_ops ath9k_pm_ops = {
+        .suspend = ath_pci_suspend,
+        .resume = ath_pci_resume,
+        .freeze = ath_pci_suspend,
+        .thaw = ath_pci_resume,
+        .poweroff = ath_pci_suspend,
+        .restore = ath_pci_resume,
+};
+
+#define ATH9K_PM_OPS    (&ath9k_pm_ops)
+
+#else /* !CONFIG_PM */
+
+#define ATH9K_PM_OPS    NULL
+
+#endif /* !CONFIG_PM */
+
 
 MODULE_DEVICE_TABLE(pci, ath_pci_id_table);
 
@@ -302,10 +325,7 @@ static struct pci_driver ath_pci_driver = {
         .id_table   = ath_pci_id_table,
         .probe      = ath_pci_probe,
         .remove     = ath_pci_remove,
-#ifdef CONFIG_PM
-        .suspend    = ath_pci_suspend,
-        .resume     = ath_pci_resume,
-#endif /* CONFIG_PM */
+        .driver.pm  = ATH9K_PM_OPS,
 };
 
 int ath_pci_init(void)
diff --git a/drivers/net/wireless/ath/ath9k/rc.c b/drivers/net/wireless/ath/ath9k/rc.c
index 89978d71617..3e6ea3bc3d8 100644
--- a/drivers/net/wireless/ath/ath9k/rc.c
+++ b/drivers/net/wireless/ath/ath9k/rc.c
@@ -381,25 +381,6 @@ static const struct ath_rate_table ar5416_11g_ratetable = {
 static int ath_rc_get_rateindex(const struct ath_rate_table *rate_table,
                                 struct ieee80211_tx_rate *rate);
 
-static inline int8_t median(int8_t a, int8_t b, int8_t c)
-{
-        if (a >= b) {
-                if (b >= c)
-                        return b;
-                else if (a > c)
-                        return c;
-                else
-                        return a;
-        } else {
-                if (a >= c)
-                        return a;
-                else if (b >= c)
-                        return c;
-                else
-                        return b;
-        }
-}
-
 static void ath_rc_sort_validrates(const struct ath_rate_table *rate_table,
                                    struct ath_rate_priv *ath_rc_priv)
 {
@@ -883,7 +864,7 @@ static bool ath_rc_update_per(struct ath_softc *sc,
         bool state_change = false;
         int count, n_bad_frames;
         u8 last_per;
-        static u32 nretry_to_per_lookup[10] = {
+        static const u32 nretry_to_per_lookup[10] = {
                 100 * 0 / 1,
                 100 * 1 / 4,
                 100 * 1 / 2,
@@ -1106,13 +1087,13 @@ static int ath_rc_get_rateindex(const struct ath_rate_table *rate_table,
                                 struct ieee80211_tx_rate *rate)
 {
         int rix = 0, i = 0;
-        int mcs_rix_off[] = { 7, 15, 20, 21, 22, 23 };
+        static const int mcs_rix_off[] = { 7, 15, 20, 21, 22, 23 };
 
         if (!(rate->flags & IEEE80211_TX_RC_MCS))
                 return rate->idx;
 
         while (rate->idx > mcs_rix_off[i] &&
-              i < sizeof(mcs_rix_off)/sizeof(int)) {
+               i < ARRAY_SIZE(mcs_rix_off)) {
                 rix++; i++;
         }
 
@@ -1373,23 +1354,7 @@ static void ath_tx_status(void *priv, struct ieee80211_supported_band *sband,
                 tx_info->status.ampdu_len = 1;
         }
 
-        /*
-         * If an underrun error is seen assume it as an excessive retry only
-         * if max frame trigger level has been reached (2 KB for singel stream,
-         * and 4 KB for dual stream). Adjust the long retry as if the frame was
-         * tried hw->max_rate_tries times to affect how ratectrl updates PER for
-         * the failed rate. In case of congestion on the bus penalizing these
-         * type of underruns should help hardware actually transmit new frames
-         * successfully by eventually preferring slower rates. This itself
-         * should also alleviate congestion on the bus.
-         */
-        if ((tx_info->pad[0] & ATH_TX_INFO_UNDERRUN) &&
-            (sc->sc_ah->tx_trig_level >= ath_rc_priv->tx_triglevel_max)) {
-                tx_status = 1;
-                is_underrun = 1;
-        }
-
-        if (tx_info->pad[0] & ATH_TX_INFO_XRETRY)
+        if (!(tx_info->flags & IEEE80211_TX_STAT_ACK))
                 tx_status = 1;
 
         ath_rc_tx_status(sc, ath_rc_priv, tx_info, final_ts_idx, tx_status,
@@ -1398,7 +1363,8 @@ static void ath_tx_status(void *priv, struct ieee80211_supported_band *sband,
         /* Check if aggregation has to be enabled for this tid */
         if (conf_is_ht(&sc->hw->conf) &&
             !(skb->protocol == cpu_to_be16(ETH_P_PAE))) {
-                if (ieee80211_is_data_qos(fc)) {
+                if (ieee80211_is_data_qos(fc) &&
+                    skb_get_queue_mapping(skb) != IEEE80211_AC_VO) {
                         u8 *qc, tid;
                         struct ath_node *an;
 
@@ -1444,12 +1410,12 @@ static void ath_rate_init(void *priv, struct ieee80211_supported_band *sband,
                 ath_rc_priv->neg_ht_rates.rs_nrates = j;
         }
 
-        is_cw40 = sta->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+        is_cw40 = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40);
 
         if (is_cw40)
-                is_sgi = sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40;
+                is_sgi = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40);
         else if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_SGI_20)
-                is_sgi = sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20;
+                is_sgi = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20);
 
         /* Choose rate table first */
 
@@ -1468,10 +1434,8 @@ static void ath_rate_update(void *priv, struct ieee80211_supported_band *sband,
         struct ath_rate_priv *ath_rc_priv = priv_sta;
         const struct ath_rate_table *rate_table = NULL;
         bool oper_cw40 = false, oper_sgi;
-        bool local_cw40 = (ath_rc_priv->ht_cap & WLAN_RC_40_FLAG) ?
-                true : false;
-        bool local_sgi = (ath_rc_priv->ht_cap & WLAN_RC_SGI_FLAG) ?
-                true : false;
+        bool local_cw40 = !!(ath_rc_priv->ht_cap & WLAN_RC_40_FLAG);
+        bool local_sgi = !!(ath_rc_priv->ht_cap & WLAN_RC_SGI_FLAG);
 
         /* FIXME: Handle AP mode later when we support CWM */
 
@@ -1617,8 +1581,6 @@ static void *ath_rate_alloc_sta(void *priv, struct ieee80211_sta *sta, gfp_t gfp
                 return NULL;
         }
 
-        rate_priv->tx_triglevel_max = sc->sc_ah->caps.tx_triglevel_max;
-
         return rate_priv;
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/rc.h b/drivers/net/wireless/ath/ath9k/rc.h
index 2f46a2266ba..31a004cb60a 100644
--- a/drivers/net/wireless/ath/ath9k/rc.h
+++ b/drivers/net/wireless/ath/ath9k/rc.h
@@ -215,7 +215,6 @@ struct ath_rate_priv {
         u32 per_down_time;
         u32 probe_interval;
         u32 prev_data_rix;
-        u32 tx_triglevel_max;
         struct ath_rateset neg_rates;
         struct ath_rateset neg_ht_rates;
         struct ath_rate_softc *asc;
@@ -225,11 +224,6 @@ struct ath_rate_priv {
         struct ath_rc_stats rcstats[RATE_TABLE_SIZE];
 };
 
-#define ATH_TX_INFO_FRAME_TYPE_INTERNAL (1 << 0)
-#define ATH_TX_INFO_FRAME_TYPE_PAUSE    (1 << 1)
-#define ATH_TX_INFO_XRETRY              (1 << 3)
-#define ATH_TX_INFO_UNDERRUN            (1 << 4)
-
 enum ath9k_internal_frame_type {
         ATH9K_IFT_NOT_INTERNAL,
         ATH9K_IFT_PAUSE,
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index 1a62e351ec7..262c81595f6 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -317,7 +317,7 @@ int ath_rx_init(struct ath_softc *sc, int nbufs)
         struct ath_buf *bf;
         int error = 0;
 
-        spin_lock_init(&sc->rx.pcu_lock);
+        spin_lock_init(&sc->sc_pcu_lock);
         sc->sc_flags &= ~SC_OP_RXFLUSH;
         spin_lock_init(&sc->rx.rxbuflock);
 
@@ -528,6 +528,8 @@ bool ath_stoprecv(struct ath_softc *sc)
                 sc->rx.rxlink = NULL;
         spin_unlock_bh(&sc->rx.rxbuflock);
 
+        ATH_DBG_WARN(!stopped, "Could not stop RX, we could be "
+                     "confusing the DMA engine when we start RX up\n");
         return stopped;
 }
 
@@ -962,36 +964,23 @@ static void ath9k_process_rssi(struct ath_common *common,
                                struct ieee80211_hdr *hdr,
                                struct ath_rx_status *rx_stats)
 {
+        struct ath_wiphy *aphy = hw->priv;
         struct ath_hw *ah = common->ah;
-        struct ieee80211_sta *sta;
-        struct ath_node *an;
-        int last_rssi = ATH_RSSI_DUMMY_MARKER;
+        int last_rssi;
         __le16 fc;
 
+        if (ah->opmode != NL80211_IFTYPE_STATION)
+                return;
+
         fc = hdr->frame_control;
+        if (!ieee80211_is_beacon(fc) ||
+            compare_ether_addr(hdr->addr3, common->curbssid))
+                return;
 
-        rcu_read_lock();
-        /*
-         * XXX: use ieee80211_find_sta! This requires quite a bit of work
-         * under the current ath9k virtual wiphy implementation as we have
-         * no way of tying a vif to wiphy. Typically vifs are attached to
-         * at least one sdata of a wiphy on mac80211 but with ath9k virtual
-         * wiphy you'd have to iterate over every wiphy and each sdata.
-         */
-        if (is_multicast_ether_addr(hdr->addr1))
-                sta = ieee80211_find_sta_by_ifaddr(hw, hdr->addr2, NULL);
-        else
-                sta = ieee80211_find_sta_by_ifaddr(hw, hdr->addr2, hdr->addr1);
-
-        if (sta) {
-                an = (struct ath_node *) sta->drv_priv;
-                if (rx_stats->rs_rssi != ATH9K_RSSI_BAD &&
-                   !rx_stats->rs_moreaggr)
-                        ATH_RSSI_LPF(an->last_rssi, rx_stats->rs_rssi);
-                last_rssi = an->last_rssi;
-        }
-        rcu_read_unlock();
+        if (rx_stats->rs_rssi != ATH9K_RSSI_BAD && !rx_stats->rs_moreaggr)
+                ATH_RSSI_LPF(aphy->last_rssi, rx_stats->rs_rssi);
 
+        last_rssi = aphy->last_rssi;
         if (likely(last_rssi != ATH_RSSI_DUMMY_MARKER))
                 rx_stats->rs_rssi = ATH_EP_RND(last_rssi,
                                               ATH_RSSI_EP_MULTIPLIER);
@@ -999,8 +988,7 @@ static void ath9k_process_rssi(struct ath_common *common,
                 rx_stats->rs_rssi = 0;
 
         /* Update Beacon RSSI, this is used by ANI. */
-        if (ieee80211_is_beacon(fc))
-                ah->stats.avgbrssi = rx_stats->rs_rssi;
+        ah->stats.avgbrssi = rx_stats->rs_rssi;
 }
 
 /*
diff --git a/drivers/net/wireless/ath/ath9k/reg.h b/drivers/net/wireless/ath/ath9k/reg.h
index 2c6a22fbb0f..c2472edab5e 100644
--- a/drivers/net/wireless/ath/ath9k/reg.h
+++ b/drivers/net/wireless/ath/ath9k/reg.h
@@ -864,15 +864,7 @@
      ((REG_READ(_ah, AR_AN_SYNTH9) & 0x7) == 0x1))
 
 #define AR_DEVID_7010(_ah) \
-        (((_ah)->hw_version.devid == 0x7010) || \
-         ((_ah)->hw_version.devid == 0x7015) || \
-         ((_ah)->hw_version.devid == 0x9018) || \
-         ((_ah)->hw_version.devid == 0xA704) || \
-         ((_ah)->hw_version.devid == 0x1200))
-
-#define AR9287_HTC_DEVID(_ah) \
-        (((_ah)->hw_version.devid == 0x7015) || \
-         ((_ah)->hw_version.devid == 0x1200))
+        ((_ah)->common.driver_info & AR7010_DEVICE)
 
 #define AR_RADIO_SREV_MAJOR                   0xf0
 #define AR_RAD5133_SREV_MAJOR                 0xc0
@@ -1074,6 +1066,9 @@ enum {
 #define AR_INTR_PRIO_ASYNC_MASK   0x40c8
 #define AR_INTR_PRIO_SYNC_MASK    0x40cc
 #define AR_INTR_PRIO_ASYNC_ENABLE 0x40d4
+#define AR_ENT_OTP                0x40d8
+#define AR_ENT_OTP_CHAIN2_DISABLE               0x00020000
+#define AR_ENT_OTP_MPSD         0x00800000
 
 #define AR_RTC_9300_PLL_DIV          0x000003ff
 #define AR_RTC_9300_PLL_DIV_S        0
@@ -1574,6 +1569,7 @@ enum {
 #define AR_PCU_TBTT_PROTECT        0x00200000
 #define AR_PCU_CLEAR_VMF           0x01000000
 #define AR_PCU_CLEAR_BA_VALID      0x04000000
+#define AR_PCU_ALWAYS_PERFORM_KEYSEARCH 0x10000000
 
 #define AR_PCU_BT_ANT_PREVENT_RX   0x00100000
 #define AR_PCU_BT_ANT_PREVENT_RX_S 20
diff --git a/drivers/net/wireless/ath/ath9k/virtual.c b/drivers/net/wireless/ath/ath9k/virtual.c
index ec7cf5ee56b..d5442c3745c 100644
--- a/drivers/net/wireless/ath/ath9k/virtual.c
+++ b/drivers/net/wireless/ath/ath9k/virtual.c
@@ -107,6 +107,7 @@ int ath9k_wiphy_add(struct ath_softc *sc)
         aphy->sc = sc;
         aphy->hw = hw;
         sc->sec_wiphy[i] = aphy;
+        aphy->last_rssi = ATH_RSSI_DUMMY_MARKER;
         spin_unlock_bh(&sc->wiphy_lock);
 
         memcpy(addr, common->macaddr, ETH_ALEN);
@@ -186,7 +187,7 @@ static int ath9k_send_nullfunc(struct ath_wiphy *aphy,
         info->control.rates[1].idx = -1;
 
         memset(&txctl, 0, sizeof(struct ath_tx_control));
-        txctl.txq = &sc->tx.txq[sc->tx.hwq_map[WME_AC_VO]];
+        txctl.txq = sc->tx.txq_map[WME_AC_VO];
         txctl.frame_type = ps ? ATH9K_IFT_PAUSE : ATH9K_IFT_UNPAUSE;
 
         if (ath_tx_start(aphy->hw, skb, &txctl) != 0)
@@ -304,13 +305,12 @@ void ath9k_wiphy_chan_work(struct work_struct *work)
  * ath9k version of ieee80211_tx_status() for TX frames that are generated
  * internally in the driver.
  */
-void ath9k_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
+void ath9k_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb, int ftype)
 {
         struct ath_wiphy *aphy = hw->priv;
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
 
-        if ((tx_info->pad[0] & ATH_TX_INFO_FRAME_TYPE_PAUSE) &&
-            aphy->state == ATH_WIPHY_PAUSING) {
+        if (ftype == ATH9K_IFT_PAUSE && aphy->state == ATH_WIPHY_PAUSING) {
                 if (!(tx_info->flags & IEEE80211_TX_STAT_ACK)) {
                         printk(KERN_DEBUG "ath9k: %s: no ACK for pause "
                                "frame\n", wiphy_name(hw->wiphy));
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index f2ade2402ce..495432ec85a 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -48,19 +48,17 @@ static u16 bits_per_symbol[][2] = {
 
 #define IS_HT_RATE(_rate)     ((_rate) & 0x80)
 
-static void ath_tx_send_ht_normal(struct ath_softc *sc, struct ath_txq *txq,
-                                  struct ath_atx_tid *tid,
-                                  struct list_head *bf_head);
+static void ath_tx_send_normal(struct ath_softc *sc, struct ath_txq *txq,
+                               struct ath_atx_tid *tid,
+                               struct list_head *bf_head);
 static void ath_tx_complete_buf(struct ath_softc *sc, struct ath_buf *bf,
                                 struct ath_txq *txq, struct list_head *bf_q,
                                 struct ath_tx_status *ts, int txok, int sendbar);
 static void ath_tx_txqaddbuf(struct ath_softc *sc, struct ath_txq *txq,
                              struct list_head *head);
-static void ath_buf_set_rate(struct ath_softc *sc, struct ath_buf *bf);
-static int ath_tx_num_badfrms(struct ath_softc *sc, struct ath_buf *bf,
-                              struct ath_tx_status *ts, int txok);
+static void ath_buf_set_rate(struct ath_softc *sc, struct ath_buf *bf, int len);
 static void ath_tx_rc_status(struct ath_buf *bf, struct ath_tx_status *ts,
-                             int nbad, int txok, bool update_rc);
+                             int nframes, int nbad, int txok, bool update_rc);
 static void ath_tx_update_baw(struct ath_softc *sc, struct ath_atx_tid *tid,
                               int seqno);
 
@@ -124,7 +122,7 @@ static void ath_tx_queue_tid(struct ath_txq *txq, struct ath_atx_tid *tid)
 
 static void ath_tx_resume_tid(struct ath_softc *sc, struct ath_atx_tid *tid)
 {
-        struct ath_txq *txq = &sc->tx.txq[tid->ac->qnum];
+        struct ath_txq *txq = tid->ac->txq;
 
         WARN_ON(!tid->paused);
 
@@ -140,12 +138,21 @@ unlock:
         spin_unlock_bh(&txq->axq_lock);
 }
 
+static struct ath_frame_info *get_frame_info(struct sk_buff *skb)
+{
+        struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
+        BUILD_BUG_ON(sizeof(struct ath_frame_info) >
+                     sizeof(tx_info->rate_driver_data));
+        return (struct ath_frame_info *) &tx_info->rate_driver_data[0];
+}
+
 static void ath_tx_flush_tid(struct ath_softc *sc, struct ath_atx_tid *tid)
 {
-        struct ath_txq *txq = &sc->tx.txq[tid->ac->qnum];
+        struct ath_txq *txq = tid->ac->txq;
         struct ath_buf *bf;
         struct list_head bf_head;
         struct ath_tx_status ts;
+        struct ath_frame_info *fi;
 
         INIT_LIST_HEAD(&bf_head);
 
@@ -156,12 +163,15 @@ static void ath_tx_flush_tid(struct ath_softc *sc, struct ath_atx_tid *tid)
                 bf = list_first_entry(&tid->buf_q, struct ath_buf, list);
                 list_move_tail(&bf->list, &bf_head);
 
-                if (bf_isretried(bf)) {
-                        ath_tx_update_baw(sc, tid, bf->bf_seqno);
+                spin_unlock_bh(&txq->axq_lock);
+                fi = get_frame_info(bf->bf_mpdu);
+                if (fi->retries) {
+                        ath_tx_update_baw(sc, tid, fi->seqno);
                         ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0, 0);
                 } else {
-                        ath_tx_send_ht_normal(sc, txq, tid, &bf_head);
+                        ath_tx_send_normal(sc, txq, tid, &bf_head);
                 }
+                spin_lock_bh(&txq->axq_lock);
         }
 
         spin_unlock_bh(&txq->axq_lock);
@@ -184,14 +194,11 @@ static void ath_tx_update_baw(struct ath_softc *sc, struct ath_atx_tid *tid,
 }
 
 static void ath_tx_addto_baw(struct ath_softc *sc, struct ath_atx_tid *tid,
-                             struct ath_buf *bf)
+                             u16 seqno)
 {
         int index, cindex;
 
-        if (bf_isretried(bf))
-                return;
-
-        index  = ATH_BA_INDEX(tid->seq_start, bf->bf_seqno);
+        index  = ATH_BA_INDEX(tid->seq_start, seqno);
         cindex = (tid->baw_head + index) & (ATH_TID_MAX_BUFS - 1);
         __set_bit(cindex, tid->tx_buf);
 
@@ -215,6 +222,7 @@ static void ath_tid_drain(struct ath_softc *sc, struct ath_txq *txq,
         struct ath_buf *bf;
         struct list_head bf_head;
         struct ath_tx_status ts;
+        struct ath_frame_info *fi;
 
         memset(&ts, 0, sizeof(ts));
         INIT_LIST_HEAD(&bf_head);
@@ -226,8 +234,9 @@ static void ath_tid_drain(struct ath_softc *sc, struct ath_txq *txq,
                 bf = list_first_entry(&tid->buf_q, struct ath_buf, list);
                 list_move_tail(&bf->list, &bf_head);
 
-                if (bf_isretried(bf))
-                        ath_tx_update_baw(sc, tid, bf->bf_seqno);
+                fi = get_frame_info(bf->bf_mpdu);
+                if (fi->retries)
+                        ath_tx_update_baw(sc, tid, fi->seqno);
 
                 spin_unlock(&txq->axq_lock);
                 ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0, 0);
@@ -239,16 +248,15 @@ static void ath_tid_drain(struct ath_softc *sc, struct ath_txq *txq,
 }
 
 static void ath_tx_set_retry(struct ath_softc *sc, struct ath_txq *txq,
-                             struct ath_buf *bf)
+                             struct sk_buff *skb)
 {
-        struct sk_buff *skb;
+        struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
         struct ieee80211_hdr *hdr;
 
-        bf->bf_state.bf_type |= BUF_RETRY;
-        bf->bf_retries++;
         TX_STAT_INC(txq->axq_qnum, a_retries);
+        if (tx_info->control.rates[4].count++ > 0)
+                return;
 
-        skb = bf->bf_mpdu;
         hdr = (struct ieee80211_hdr *)skb->data;
         hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_RETRY);
 }
@@ -298,9 +306,41 @@ static struct ath_buf* ath_clone_txbuf(struct ath_softc *sc, struct ath_buf *bf)
         return tbf;
 }
 
+static void ath_tx_count_frames(struct ath_softc *sc, struct ath_buf *bf,
+                                struct ath_tx_status *ts, int txok,
+                                int *nframes, int *nbad)
+{
+        struct ath_frame_info *fi;
+        u16 seq_st = 0;
+        u32 ba[WME_BA_BMP_SIZE >> 5];
+        int ba_index;
+        int isaggr = 0;
+
+        *nbad = 0;
+        *nframes = 0;
+
+        isaggr = bf_isaggr(bf);
+        if (isaggr) {
+                seq_st = ts->ts_seqnum;
+                memcpy(ba, &ts->ba_low, WME_BA_BMP_SIZE >> 3);
+        }
+
+        while (bf) {
+                fi = get_frame_info(bf->bf_mpdu);
+                ba_index = ATH_BA_INDEX(seq_st, fi->seqno);
+
+                (*nframes)++;
+                if (!txok || (isaggr && !ATH_BA_ISSET(ba, ba_index)))
+                        (*nbad)++;
+
+                bf = bf->bf_next;
+        }
+}
+
+
 static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
                                  struct ath_buf *bf, struct list_head *bf_q,
-                                 struct ath_tx_status *ts, int txok)
+                                 struct ath_tx_status *ts, int txok, bool retry)
 {
         struct ath_node *an = NULL;
         struct sk_buff *skb;
@@ -316,7 +356,9 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
         int isaggr, txfail, txpending, sendbar = 0, needreset = 0, nbad = 0;
         bool rc_update = true;
         struct ieee80211_tx_rate rates[4];
+        struct ath_frame_info *fi;
         int nframes;
+        u8 tidno;
 
         skb = bf->bf_mpdu;
         hdr = (struct ieee80211_hdr *)skb->data;
@@ -325,7 +367,6 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
         hw = bf->aphy->hw;
 
         memcpy(rates, tx_info->control.rates, sizeof(rates));
-        nframes = bf->bf_nframes;
 
         rcu_read_lock();
 
@@ -342,7 +383,7 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
                             !bf->bf_stale || bf_next != NULL)
                                 list_move_tail(&bf->list, &bf_head);
 
-                        ath_tx_rc_status(bf, ts, 1, 0, false);
+                        ath_tx_rc_status(bf, ts, 1, 1, 0, false);
                         ath_tx_complete_buf(sc, bf, txq, &bf_head, ts,
                                 0, 0);
 
@@ -352,14 +393,15 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
         }
 
         an = (struct ath_node *)sta->drv_priv;
-        tid = ATH_AN_2_TID(an, bf->bf_tidno);
+        tidno = ieee80211_get_qos_ctl(hdr)[0] & IEEE80211_QOS_CTL_TID_MASK;
+        tid = ATH_AN_2_TID(an, tidno);
 
         /*
          * The hardware occasionally sends a tx status for the wrong TID.
          * In this case, the BA status cannot be considered valid and all
          * subframes need to be retransmitted
          */
-        if (bf->bf_tidno != ts->tid)
+        if (tidno != ts->tid)
                 txok = false;
 
         isaggr = bf_isaggr(bf);
@@ -385,15 +427,16 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
         INIT_LIST_HEAD(&bf_pending);
         INIT_LIST_HEAD(&bf_head);
 
-        nbad = ath_tx_num_badfrms(sc, bf, ts, txok);
+        ath_tx_count_frames(sc, bf, ts, txok, &nframes, &nbad);
         while (bf) {
                 txfail = txpending = 0;
                 bf_next = bf->bf_next;
 
                 skb = bf->bf_mpdu;
                 tx_info = IEEE80211_SKB_CB(skb);
+                fi = get_frame_info(skb);
 
-                if (ATH_BA_ISSET(ba, ATH_BA_INDEX(seq_st, bf->bf_seqno))) {
+                if (ATH_BA_ISSET(ba, ATH_BA_INDEX(seq_st, fi->seqno))) {
                         /* transmit completion, subframe is
                          * acked by block ack */
                         acked_cnt++;
@@ -401,10 +444,9 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
                         /* transmit completion */
                         acked_cnt++;
                 } else {
-                        if (!(tid->state & AGGR_CLEANUP) &&
-                            !bf_last->bf_tx_aborted) {
-                                if (bf->bf_retries < ATH_MAX_SW_RETRIES) {
-                                        ath_tx_set_retry(sc, txq, bf);
+                        if (!(tid->state & AGGR_CLEANUP) && retry) {
+                                if (fi->retries < ATH_MAX_SW_RETRIES) {
+                                        ath_tx_set_retry(sc, txq, bf->bf_mpdu);
                                         txpending = 1;
                                 } else {
                                         bf->bf_state.bf_type |= BUF_XRETRY;
@@ -442,16 +484,15 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
                          * block-ack window
                          */
                         spin_lock_bh(&txq->axq_lock);
-                        ath_tx_update_baw(sc, tid, bf->bf_seqno);
+                        ath_tx_update_baw(sc, tid, fi->seqno);
                         spin_unlock_bh(&txq->axq_lock);
 
                         if (rc_update && (acked_cnt == 1 || txfail_cnt == 1)) {
                                 memcpy(tx_info->control.rates, rates, sizeof(rates));
-                                bf->bf_nframes = nframes;
-                                ath_tx_rc_status(bf, ts, nbad, txok, true);
+                                ath_tx_rc_status(bf, ts, nframes, nbad, txok, true);
                                 rc_update = false;
                         } else {
-                                ath_tx_rc_status(bf, ts, nbad, txok, false);
+                                ath_tx_rc_status(bf, ts, nframes, nbad, txok, false);
                         }
 
                         ath_tx_complete_buf(sc, bf, txq, &bf_head, ts,
@@ -470,14 +511,13 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
                                          */
                                         if (!tbf) {
                                                 spin_lock_bh(&txq->axq_lock);
-                                                ath_tx_update_baw(sc, tid,
-                                                                bf->bf_seqno);
+                                                ath_tx_update_baw(sc, tid, fi->seqno);
                                                 spin_unlock_bh(&txq->axq_lock);
 
                                                 bf->bf_state.bf_type |=
                                                         BUF_XRETRY;
-                                                ath_tx_rc_status(bf, ts, nbad,
-                                                                0, false);
+                                                ath_tx_rc_status(bf, ts, nframes,
+                                                                nbad, 0, false);
                                                 ath_tx_complete_buf(sc, bf, txq,
                                                                     &bf_head,
                                                                     ts, 0, 0);
@@ -611,6 +651,7 @@ static int ath_compute_num_delims(struct ath_softc *sc, struct ath_atx_tid *tid,
         u16 minlen;
         u8 flags, rix;
         int width, streams, half_gi, ndelim, mindelim;
+        struct ath_frame_info *fi = get_frame_info(bf->bf_mpdu);
 
         /* Select standard number of delimiters based on frame length alone */
         ndelim = ATH_AGGR_GET_NDELIM(frmlen);
@@ -621,7 +662,7 @@ static int ath_compute_num_delims(struct ath_softc *sc, struct ath_atx_tid *tid,
          * TODO - this could be improved to be dependent on the rate.
          *      The hardware can keep up at lower rates, but not higher rates
          */
-        if (bf->bf_keytype != ATH9K_KEY_TYPE_CLEAR)
+        if (fi->keyix != ATH9K_TXKEYIX_INVALID)
                 ndelim += ATH_AGGR_ENCRYPTDELIM;
 
         /*
@@ -665,7 +706,8 @@ static int ath_compute_num_delims(struct ath_softc *sc, struct ath_atx_tid *tid,
 static enum ATH_AGGR_STATUS ath_tx_form_aggr(struct ath_softc *sc,
                                              struct ath_txq *txq,
                                              struct ath_atx_tid *tid,
-                                             struct list_head *bf_q)
+                                             struct list_head *bf_q,
+                                             int *aggr_len)
 {
 #define PADBYTES(_len) ((4 - ((_len) % 4)) % 4)
         struct ath_buf *bf, *bf_first, *bf_prev = NULL;
@@ -674,14 +716,16 @@ static enum ATH_AGGR_STATUS ath_tx_form_aggr(struct ath_softc *sc,
                 al_delta, h_baw = tid->baw_size / 2;
         enum ATH_AGGR_STATUS status = ATH_AGGR_DONE;
         struct ieee80211_tx_info *tx_info;
+        struct ath_frame_info *fi;
 
         bf_first = list_first_entry(&tid->buf_q, struct ath_buf, list);
 
         do {
                 bf = list_first_entry(&tid->buf_q, struct ath_buf, list);
+                fi = get_frame_info(bf->bf_mpdu);
 
                 /* do not step over block-ack window */
-                if (!BAW_WITHIN(tid->seq_start, tid->baw_size, bf->bf_seqno)) {
+                if (!BAW_WITHIN(tid->seq_start, tid->baw_size, fi->seqno)) {
                         status = ATH_AGGR_BAW_CLOSED;
                         break;
                 }
@@ -692,7 +736,7 @@ static enum ATH_AGGR_STATUS ath_tx_form_aggr(struct ath_softc *sc,
                 }
 
                 /* do not exceed aggregation limit */
-                al_delta = ATH_AGGR_DELIM_SZ + bf->bf_frmlen;
+                al_delta = ATH_AGGR_DELIM_SZ + fi->framelen;
 
                 if (nframes &&
                     (aggr_limit < (al + bpad + al_delta + prev_al))) {
@@ -719,14 +763,15 @@ static enum ATH_AGGR_STATUS ath_tx_form_aggr(struct ath_softc *sc,
                  * Get the delimiters needed to meet the MPDU
                  * density for this node.
                  */
-                ndelim = ath_compute_num_delims(sc, tid, bf_first, bf->bf_frmlen);
+                ndelim = ath_compute_num_delims(sc, tid, bf_first, fi->framelen);
                 bpad = PADBYTES(al_delta) + (ndelim << 2);
 
                 bf->bf_next = NULL;
                 ath9k_hw_set_desc_link(sc->sc_ah, bf->bf_desc, 0);
 
                 /* link buffers of this frame to the aggregate */
-                ath_tx_addto_baw(sc, tid, bf);
+                if (!fi->retries)
+                        ath_tx_addto_baw(sc, tid, fi->seqno);
                 ath9k_hw_set11n_aggr_middle(sc->sc_ah, bf->bf_desc, ndelim);
                 list_move_tail(&bf->list, bf_q);
                 if (bf_prev) {
@@ -738,8 +783,7 @@ static enum ATH_AGGR_STATUS ath_tx_form_aggr(struct ath_softc *sc,
 
         } while (!list_empty(&tid->buf_q));
 
-        bf_first->bf_al = al;
-        bf_first->bf_nframes = nframes;
+        *aggr_len = al;
 
         return status;
 #undef PADBYTES
@@ -750,7 +794,9 @@ static void ath_tx_sched_aggr(struct ath_softc *sc, struct ath_txq *txq,
 {
         struct ath_buf *bf;
         enum ATH_AGGR_STATUS status;
+        struct ath_frame_info *fi;
         struct list_head bf_q;
+        int aggr_len;
 
         do {
                 if (list_empty(&tid->buf_q))
@@ -758,7 +804,7 @@ static void ath_tx_sched_aggr(struct ath_softc *sc, struct ath_txq *txq,
 
                 INIT_LIST_HEAD(&bf_q);
 
-                status = ath_tx_form_aggr(sc, txq, tid, &bf_q);
+                status = ath_tx_form_aggr(sc, txq, tid, &bf_q, &aggr_len);
 
                 /*
                  * no frames picked up to be aggregated;
@@ -771,18 +817,20 @@ static void ath_tx_sched_aggr(struct ath_softc *sc, struct ath_txq *txq,
                 bf->bf_lastbf = list_entry(bf_q.prev, struct ath_buf, list);
 
                 /* if only one frame, send as non-aggregate */
-                if (bf->bf_nframes == 1) {
+                if (bf == bf->bf_lastbf) {
+                        fi = get_frame_info(bf->bf_mpdu);
+
                         bf->bf_state.bf_type &= ~BUF_AGGR;
                         ath9k_hw_clr11n_aggr(sc->sc_ah, bf->bf_desc);
-                        ath_buf_set_rate(sc, bf);
+                        ath_buf_set_rate(sc, bf, fi->framelen);
                         ath_tx_txqaddbuf(sc, txq, &bf_q);
                         continue;
                 }
 
                 /* setup first desc of aggregate */
                 bf->bf_state.bf_type |= BUF_AGGR;
-                ath_buf_set_rate(sc, bf);
-                ath9k_hw_set11n_aggr_first(sc->sc_ah, bf->bf_desc, bf->bf_al);
+                ath_buf_set_rate(sc, bf, aggr_len);
+                ath9k_hw_set11n_aggr_first(sc->sc_ah, bf->bf_desc, aggr_len);
 
                 /* anchor last desc of aggregate */
                 ath9k_hw_set11n_aggr_last(sc->sc_ah, bf->bf_lastbf->bf_desc);
@@ -817,7 +865,7 @@ void ath_tx_aggr_stop(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid)
 {
         struct ath_node *an = (struct ath_node *)sta->drv_priv;
         struct ath_atx_tid *txtid = ATH_AN_2_TID(an, tid);
-        struct ath_txq *txq = &sc->tx.txq[txtid->ac->qnum];
+        struct ath_txq *txq = txtid->ac->txq;
 
         if (txtid->state & AGGR_CLEANUP)
                 return;
@@ -888,10 +936,16 @@ struct ath_txq *ath_txq_setup(struct ath_softc *sc, int qtype, int subtype)
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
         struct ath9k_tx_queue_info qi;
+        static const int subtype_txq_to_hwq[] = {
+                [WME_AC_BE] = ATH_TXQ_AC_BE,
+                [WME_AC_BK] = ATH_TXQ_AC_BK,
+                [WME_AC_VI] = ATH_TXQ_AC_VI,
+                [WME_AC_VO] = ATH_TXQ_AC_VO,
+        };
         int qnum, i;
 
         memset(&qi, 0, sizeof(qi));
-        qi.tqi_subtype = subtype;
+        qi.tqi_subtype = subtype_txq_to_hwq[subtype];
         qi.tqi_aifs = ATH9K_TXQ_USEDEFAULT;
         qi.tqi_cwmin = ATH9K_TXQ_USEDEFAULT;
         qi.tqi_cwmax = ATH9K_TXQ_USEDEFAULT;
@@ -940,7 +994,6 @@ struct ath_txq *ath_txq_setup(struct ath_softc *sc, int qtype, int subtype)
         if (!ATH_TXQ_SETUP(sc, qnum)) {
                 struct ath_txq *txq = &sc->tx.txq[qnum];
 
-                txq->axq_class = subtype;
                 txq->axq_qnum = qnum;
                 txq->axq_link = NULL;
                 INIT_LIST_HEAD(&txq->axq_q);
@@ -1062,8 +1115,6 @@ void ath_draintxq(struct ath_softc *sc, struct ath_txq *txq, bool retry_tx)
                 }
 
                 lastbf = bf->bf_lastbf;
-                if (!retry_tx)
-                        lastbf->bf_tx_aborted = true;
 
                 if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
                         list_cut_position(&bf_head,
@@ -1080,7 +1131,8 @@ void ath_draintxq(struct ath_softc *sc, struct ath_txq *txq, bool retry_tx)
                 spin_unlock_bh(&txq->axq_lock);
 
                 if (bf_isampdu(bf))
-                        ath_tx_complete_aggr(sc, txq, bf, &bf_head, &ts, 0);
+                        ath_tx_complete_aggr(sc, txq, bf, &bf_head, &ts, 0,
+                                             retry_tx);
                 else
                         ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0, 0);
         }
@@ -1101,7 +1153,7 @@ void ath_draintxq(struct ath_softc *sc, struct ath_txq *txq, bool retry_tx)
 
                         if (bf_isampdu(bf))
                                 ath_tx_complete_aggr(sc, txq, bf, &bf_head,
-                                                     &ts, 0);
+                                                     &ts, 0, retry_tx);
                         else
                                 ath_tx_complete_buf(sc, bf, txq, &bf_head,
                                                     &ts, 0, 0);
@@ -1148,13 +1200,11 @@ void ath_drain_all_txq(struct ath_softc *sc, bool retry_tx)
                 ath_print(common, ATH_DBG_FATAL,
                           "Failed to stop TX DMA. Resetting hardware!\n");
 
-                spin_lock_bh(&sc->sc_resetlock);
                 r = ath9k_hw_reset(ah, sc->sc_ah->curchan, ah->caldata, false);
                 if (r)
                         ath_print(common, ATH_DBG_FATAL,
                                   "Unable to reset hardware; reset status %d\n",
                                   r);
-                spin_unlock_bh(&sc->sc_resetlock);
         }
 
         for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) {
@@ -1212,24 +1262,6 @@ void ath_txq_schedule(struct ath_softc *sc, struct ath_txq *txq)
         }
 }
 
-int ath_tx_setup(struct ath_softc *sc, int haltype)
-{
-        struct ath_txq *txq;
-
-        if (haltype >= ARRAY_SIZE(sc->tx.hwq_map)) {
-                ath_print(ath9k_hw_common(sc->sc_ah), ATH_DBG_FATAL,
-                          "HAL AC %u out of range, max %zu!\n",
-                         haltype, ARRAY_SIZE(sc->tx.hwq_map));
-                return 0;
-        }
-        txq = ath_txq_setup(sc, ATH9K_TX_QUEUE_DATA, haltype);
-        if (txq != NULL) {
-                sc->tx.hwq_map[haltype] = txq->axq_qnum;
-                return 1;
-        } else
-                return 0;
-}
-
 /***********/
 /* TX, DMA */
 /***********/
@@ -1299,12 +1331,11 @@ static void ath_tx_txqaddbuf(struct ath_softc *sc, struct ath_txq *txq,
 }
 
 static void ath_tx_send_ampdu(struct ath_softc *sc, struct ath_atx_tid *tid,
-                              struct list_head *bf_head,
-                              struct ath_tx_control *txctl)
+                              struct ath_buf *bf, struct ath_tx_control *txctl)
 {
-        struct ath_buf *bf;
+        struct ath_frame_info *fi = get_frame_info(bf->bf_mpdu);
+        struct list_head bf_head;
 
-        bf = list_first_entry(bf_head, struct ath_buf, list);
         bf->bf_state.bf_type |= BUF_AMPDU;
         TX_STAT_INC(txctl->txq->axq_qnum, a_queued);
 
@@ -1316,56 +1347,47 @@ static void ath_tx_send_ampdu(struct ath_softc *sc, struct ath_atx_tid *tid,
          * - h/w queue depth exceeds low water mark
          */
         if (!list_empty(&tid->buf_q) || tid->paused ||
-            !BAW_WITHIN(tid->seq_start, tid->baw_size, bf->bf_seqno) ||
+            !BAW_WITHIN(tid->seq_start, tid->baw_size, fi->seqno) ||
             txctl->txq->axq_depth >= ATH_AGGR_MIN_QDEPTH) {
                 /*
                  * Add this frame to software queue for scheduling later
                  * for aggregation.
                  */
-                list_move_tail(&bf->list, &tid->buf_q);
+                list_add_tail(&bf->list, &tid->buf_q);
                 ath_tx_queue_tid(txctl->txq, tid);
                 return;
         }
 
+        INIT_LIST_HEAD(&bf_head);
+        list_add(&bf->list, &bf_head);
+
         /* Add sub-frame to BAW */
-        ath_tx_addto_baw(sc, tid, bf);
+        if (!fi->retries)
+                ath_tx_addto_baw(sc, tid, fi->seqno);
 
         /* Queue to h/w without aggregation */
-        bf->bf_nframes = 1;
         bf->bf_lastbf = bf;
-        ath_buf_set_rate(sc, bf);
-        ath_tx_txqaddbuf(sc, txctl->txq, bf_head);
+        ath_buf_set_rate(sc, bf, fi->framelen);
+        ath_tx_txqaddbuf(sc, txctl->txq, &bf_head);
 }
 
-static void ath_tx_send_ht_normal(struct ath_softc *sc, struct ath_txq *txq,
-                                  struct ath_atx_tid *tid,
-                                  struct list_head *bf_head)
+static void ath_tx_send_normal(struct ath_softc *sc, struct ath_txq *txq,
+                               struct ath_atx_tid *tid,
+                               struct list_head *bf_head)
 {
+        struct ath_frame_info *fi;
         struct ath_buf *bf;
 
         bf = list_first_entry(bf_head, struct ath_buf, list);
         bf->bf_state.bf_type &= ~BUF_AMPDU;
 
         /* update starting sequence number for subsequent ADDBA request */
-        INCR(tid->seq_start, IEEE80211_SEQ_MAX);
-
-        bf->bf_nframes = 1;
-        bf->bf_lastbf = bf;
-        ath_buf_set_rate(sc, bf);
-        ath_tx_txqaddbuf(sc, txq, bf_head);
-        TX_STAT_INC(txq->axq_qnum, queued);
-}
-
-static void ath_tx_send_normal(struct ath_softc *sc, struct ath_txq *txq,
-                               struct list_head *bf_head)
-{
-        struct ath_buf *bf;
-
-        bf = list_first_entry(bf_head, struct ath_buf, list);
+        if (tid)
+                INCR(tid->seq_start, IEEE80211_SEQ_MAX);
 
         bf->bf_lastbf = bf;
-        bf->bf_nframes = 1;
-        ath_buf_set_rate(sc, bf);
+        fi = get_frame_info(bf->bf_mpdu);
+        ath_buf_set_rate(sc, bf, fi->framelen);
         ath_tx_txqaddbuf(sc, txq, bf_head);
         TX_STAT_INC(txq->axq_qnum, queued);
 }
@@ -1393,40 +1415,52 @@ static enum ath9k_pkt_type get_hw_packet_type(struct sk_buff *skb)
         return htype;
 }
 
-static void assign_aggr_tid_seqno(struct sk_buff *skb,
-                                  struct ath_buf *bf)
+static void setup_frame_info(struct ieee80211_hw *hw, struct sk_buff *skb,
+                             int framelen)
 {
+        struct ath_wiphy *aphy = hw->priv;
+        struct ath_softc *sc = aphy->sc;
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
+        struct ieee80211_sta *sta = tx_info->control.sta;
+        struct ieee80211_key_conf *hw_key = tx_info->control.hw_key;
         struct ieee80211_hdr *hdr;
+        struct ath_frame_info *fi = get_frame_info(skb);
         struct ath_node *an;
         struct ath_atx_tid *tid;
-        __le16 fc;
-        u8 *qc;
+        enum ath9k_key_type keytype;
+        u16 seqno = 0;
+        u8 tidno;
 
-        if (!tx_info->control.sta)
-                return;
+        keytype = ath9k_cmn_get_hw_crypto_keytype(skb);
 
-        an = (struct ath_node *)tx_info->control.sta->drv_priv;
         hdr = (struct ieee80211_hdr *)skb->data;
-        fc = hdr->frame_control;
+        if (sta && ieee80211_is_data_qos(hdr->frame_control) &&
+                conf_is_ht(&hw->conf) && (sc->sc_flags & SC_OP_TXAGGR)) {
 
-        if (ieee80211_is_data_qos(fc)) {
-                qc = ieee80211_get_qos_ctl(hdr);
-                bf->bf_tidno = qc[0] & 0xf;
+                an = (struct ath_node *) sta->drv_priv;
+                tidno = ieee80211_get_qos_ctl(hdr)[0] & IEEE80211_QOS_CTL_TID_MASK;
+
+                /*
+                 * Override seqno set by upper layer with the one
+                 * in tx aggregation state.
+                 */
+                tid = ATH_AN_2_TID(an, tidno);
+                seqno = tid->seq_next;
+                hdr->seq_ctrl = cpu_to_le16(seqno << IEEE80211_SEQ_SEQ_SHIFT);
+                INCR(tid->seq_next, IEEE80211_SEQ_MAX);
         }
 
-        /*
-         * For HT capable stations, we save tidno for later use.
-         * We also override seqno set by upper layer with the one
-         * in tx aggregation state.
-         */
-        tid = ATH_AN_2_TID(an, bf->bf_tidno);
-        hdr->seq_ctrl = cpu_to_le16(tid->seq_next << IEEE80211_SEQ_SEQ_SHIFT);
-        bf->bf_seqno = tid->seq_next;
-        INCR(tid->seq_next, IEEE80211_SEQ_MAX);
+        memset(fi, 0, sizeof(*fi));
+        if (hw_key)
+                fi->keyix = hw_key->hw_key_idx;
+        else
+                fi->keyix = ATH9K_TXKEYIX_INVALID;
+        fi->keytype = keytype;
+        fi->framelen = framelen;
+        fi->seqno = seqno;
 }
 
-static int setup_tx_flags(struct sk_buff *skb, bool use_ldpc)
+static int setup_tx_flags(struct sk_buff *skb)
 {
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
         int flags = 0;
@@ -1437,7 +1471,7 @@ static int setup_tx_flags(struct sk_buff *skb, bool use_ldpc)
         if (tx_info->flags & IEEE80211_TX_CTL_NO_ACK)
                 flags |= ATH9K_TXDESC_NOACK;
 
-        if (use_ldpc)
+        if (tx_info->flags & IEEE80211_TX_CTL_LDPC)
                 flags |= ATH9K_TXDESC_LDPC;
 
         return flags;
@@ -1449,13 +1483,11 @@ static int setup_tx_flags(struct sk_buff *skb, bool use_ldpc)
  * width  - 0 for 20 MHz, 1 for 40 MHz
  * half_gi - to use 4us v/s 3.6 us for symbol time
  */
-static u32 ath_pkt_duration(struct ath_softc *sc, u8 rix, struct ath_buf *bf,
+static u32 ath_pkt_duration(struct ath_softc *sc, u8 rix, int pktlen,
                             int width, int half_gi, bool shortPreamble)
 {
         u32 nbits, nsymbits, duration, nsymbols;
-        int streams, pktlen;
-
-        pktlen = bf_isaggr(bf) ? bf->bf_al : bf->bf_frmlen;
+        int streams;
 
         /* find number of symbols: PLCP + data */
         streams = HT_RC_2_STREAMS(rix);
@@ -1474,7 +1506,7 @@ static u32 ath_pkt_duration(struct ath_softc *sc, u8 rix, struct ath_buf *bf,
         return duration;
 }
 
-static void ath_buf_set_rate(struct ath_softc *sc, struct ath_buf *bf)
+static void ath_buf_set_rate(struct ath_softc *sc, struct ath_buf *bf, int len)
 {
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ath9k_11n_rate_series series[4];
@@ -1537,7 +1569,7 @@ static void ath_buf_set_rate(struct ath_softc *sc, struct ath_buf *bf)
                 if (rates[i].flags & IEEE80211_TX_RC_MCS) {
                         /* MCS rates */
                         series[i].Rate = rix | 0x80;
-                        series[i].PktDuration = ath_pkt_duration(sc, rix, bf,
+                        series[i].PktDuration = ath_pkt_duration(sc, rix, len,
                                  is_40, is_sgi, is_sp);
                         if (rix < 8 && (tx_info->flags & IEEE80211_TX_CTL_STBC))
                                 series[i].RateFlags |= ATH9K_RATESERIES_STBC;
@@ -1561,11 +1593,11 @@ static void ath_buf_set_rate(struct ath_softc *sc, struct ath_buf *bf)
                 }
 
                 series[i].PktDuration = ath9k_hw_computetxtime(sc->sc_ah,
-                        phy, rate->bitrate * 100, bf->bf_frmlen, rix, is_sp);
+                        phy, rate->bitrate * 100, len, rix, is_sp);
         }
 
         /* For AR5416 - RTS cannot be followed by a frame larger than 8K */
-        if (bf_isaggr(bf) && (bf->bf_al > sc->sc_ah->caps.rts_aggr_limit))
+        if (bf_isaggr(bf) && (len > sc->sc_ah->caps.rts_aggr_limit))
                 flags &= ~ATH9K_TXDESC_RTSENA;
 
         /* ATH9K_TXDESC_RTSENA and ATH9K_TXDESC_CTSENA are mutually exclusive. */
@@ -1582,67 +1614,29 @@ static void ath_buf_set_rate(struct ath_softc *sc, struct ath_buf *bf)
                 ath9k_hw_set11n_burstduration(sc->sc_ah, bf->bf_desc, 8192);
 }
 
-static int ath_tx_setup_buffer(struct ieee80211_hw *hw, struct ath_buf *bf,
-                                struct sk_buff *skb,
-                                struct ath_tx_control *txctl)
+static struct ath_buf *ath_tx_setup_buffer(struct ieee80211_hw *hw,
+                                           struct ath_txq *txq,
+                                           struct sk_buff *skb)
 {
         struct ath_wiphy *aphy = hw->priv;
         struct ath_softc *sc = aphy->sc;
-        struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
-        int hdrlen;
-        __le16 fc;
-        int padpos, padsize;
-        bool use_ldpc = false;
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        struct ath_frame_info *fi = get_frame_info(skb);
+        struct ath_buf *bf;
+        struct ath_desc *ds;
+        int frm_type;
 
-        tx_info->pad[0] = 0;
-        switch (txctl->frame_type) {
-        case ATH9K_IFT_NOT_INTERNAL:
-                break;
-        case ATH9K_IFT_PAUSE:
-                tx_info->pad[0] |= ATH_TX_INFO_FRAME_TYPE_PAUSE;
-                /* fall through */
-        case ATH9K_IFT_UNPAUSE:
-                tx_info->pad[0] |= ATH_TX_INFO_FRAME_TYPE_INTERNAL;
-                break;
+        bf = ath_tx_get_buffer(sc);
+        if (!bf) {
+                ath_print(common, ATH_DBG_XMIT, "TX buffers are full\n");
+                return NULL;
         }
-        hdrlen = ieee80211_get_hdrlen_from_skb(skb);
-        fc = hdr->frame_control;
 
         ATH_TXBUF_RESET(bf);
 
         bf->aphy = aphy;
-        bf->bf_frmlen = skb->len + FCS_LEN;
-        /* Remove the padding size from bf_frmlen, if any */
-        padpos = ath9k_cmn_padpos(hdr->frame_control);
-        padsize = padpos & 3;
-        if (padsize && skb->len>padpos+padsize) {
-                bf->bf_frmlen -= padsize;
-        }
-
-        if (!txctl->paprd && conf_is_ht(&hw->conf)) {
-                bf->bf_state.bf_type |= BUF_HT;
-                if (tx_info->flags & IEEE80211_TX_CTL_LDPC)
-                        use_ldpc = true;
-        }
-
-        bf->bf_state.bfs_paprd = txctl->paprd;
-        if (txctl->paprd)
-                bf->bf_state.bfs_paprd_timestamp = jiffies;
-        bf->bf_flags = setup_tx_flags(skb, use_ldpc);
-
-        bf->bf_keytype = ath9k_cmn_get_hw_crypto_keytype(skb);
-        if (bf->bf_keytype != ATH9K_KEY_TYPE_CLEAR) {
-                bf->bf_frmlen += tx_info->control.hw_key->icv_len;
-                bf->bf_keyix = tx_info->control.hw_key->hw_key_idx;
-        } else {
-                bf->bf_keyix = ATH9K_TXKEYIX_INVALID;
-        }
-
-        if (ieee80211_is_data_qos(fc) && bf_isht(bf) &&
-            (sc->sc_flags & SC_OP_TXAGGR))
-                assign_aggr_tid_seqno(skb, bf);
-
+        bf->bf_flags = setup_tx_flags(skb);
         bf->bf_mpdu = skb;
 
         bf->bf_buf_addr = dma_map_single(sc->dev, skb->data,
@@ -1652,40 +1646,17 @@ static int ath_tx_setup_buffer(struct ieee80211_hw *hw, struct ath_buf *bf,
                 bf->bf_buf_addr = 0;
                 ath_print(ath9k_hw_common(sc->sc_ah), ATH_DBG_FATAL,
                           "dma_mapping_error() on TX\n");
-                return -ENOMEM;
+                ath_tx_return_buffer(sc, bf);
+                return NULL;
         }
 
-        bf->bf_tx_aborted = false;
-
-        return 0;
-}
-
-/* FIXME: tx power */
-static void ath_tx_start_dma(struct ath_softc *sc, struct ath_buf *bf,
-                             struct ath_tx_control *txctl)
-{
-        struct sk_buff *skb = bf->bf_mpdu;
-        struct ieee80211_tx_info *tx_info =  IEEE80211_SKB_CB(skb);
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
-        struct ath_node *an = NULL;
-        struct list_head bf_head;
-        struct ath_desc *ds;
-        struct ath_atx_tid *tid;
-        struct ath_hw *ah = sc->sc_ah;
-        int frm_type;
-        __le16 fc;
-
         frm_type = get_hw_packet_type(skb);
-        fc = hdr->frame_control;
-
-        INIT_LIST_HEAD(&bf_head);
-        list_add_tail(&bf->list, &bf_head);
 
         ds = bf->bf_desc;
         ath9k_hw_set_desc_link(ah, ds, 0);
 
-        ath9k_hw_set11n_txdesc(ah, ds, bf->bf_frmlen, frm_type, MAX_RATE_POWER,
-                               bf->bf_keyix, bf->bf_keytype, bf->bf_flags);
+        ath9k_hw_set11n_txdesc(ah, ds, fi->framelen, frm_type, MAX_RATE_POWER,
+                               fi->keyix, fi->keytype, bf->bf_flags);
 
         ath9k_hw_filltxdesc(ah, ds,
                             skb->len,   /* segment length */
@@ -1693,42 +1664,50 @@ static void ath_tx_start_dma(struct ath_softc *sc, struct ath_buf *bf,
                             true,       /* last segment */
                             ds,         /* first descriptor */
                             bf->bf_buf_addr,
-                            txctl->txq->axq_qnum);
+                            txq->axq_qnum);
 
-        if (bf->bf_state.bfs_paprd)
-                ar9003_hw_set_paprd_txdesc(ah, ds, bf->bf_state.bfs_paprd);
 
-        spin_lock_bh(&txctl->txq->axq_lock);
+        return bf;
+}
 
-        if (bf_isht(bf) && (sc->sc_flags & SC_OP_TXAGGR) &&
-            tx_info->control.sta) {
-                an = (struct ath_node *)tx_info->control.sta->drv_priv;
-                tid = ATH_AN_2_TID(an, bf->bf_tidno);
+/* FIXME: tx power */
+static void ath_tx_start_dma(struct ath_softc *sc, struct ath_buf *bf,
+                             struct ath_tx_control *txctl)
+{
+        struct sk_buff *skb = bf->bf_mpdu;
+        struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        struct list_head bf_head;
+        struct ath_atx_tid *tid;
+        u8 tidno;
 
-                if (!ieee80211_is_data_qos(fc)) {
-                        ath_tx_send_normal(sc, txctl->txq, &bf_head);
-                        goto tx_done;
-                }
+        spin_lock_bh(&txctl->txq->axq_lock);
 
-                if (tx_info->flags & IEEE80211_TX_CTL_AMPDU) {
-                        /*
-                         * Try aggregation if it's a unicast data frame
-                         * and the destination is HT capable.
-                         */
-                        ath_tx_send_ampdu(sc, tid, &bf_head, txctl);
-                } else {
-                        /*
-                         * Send this frame as regular when ADDBA
-                         * exchange is neither complete nor pending.
-                         */
-                        ath_tx_send_ht_normal(sc, txctl->txq,
-                                              tid, &bf_head);
-                }
+        if ((tx_info->flags & IEEE80211_TX_CTL_AMPDU) && txctl->an) {
+                tidno = ieee80211_get_qos_ctl(hdr)[0] &
+                        IEEE80211_QOS_CTL_TID_MASK;
+                tid = ATH_AN_2_TID(txctl->an, tidno);
+
+                WARN_ON(tid->ac->txq != txctl->txq);
+                /*
+                 * Try aggregation if it's a unicast data frame
+                 * and the destination is HT capable.
+                 */
+                ath_tx_send_ampdu(sc, tid, bf, txctl);
         } else {
-                ath_tx_send_normal(sc, txctl->txq, &bf_head);
+                INIT_LIST_HEAD(&bf_head);
+                list_add_tail(&bf->list, &bf_head);
+
+                bf->bf_state.bfs_ftype = txctl->frame_type;
+                bf->bf_state.bfs_paprd = txctl->paprd;
+
+                if (bf->bf_state.bfs_paprd)
+                        ar9003_hw_set_paprd_txdesc(sc->sc_ah, bf->bf_desc,
+                                                   bf->bf_state.bfs_paprd);
+
+                ath_tx_send_normal(sc, txctl->txq, NULL, &bf_head);
         }
 
-tx_done:
         spin_unlock_bh(&txctl->txq->axq_lock);
 }
 
@@ -1736,66 +1715,20 @@ tx_done:
 int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
                  struct ath_tx_control *txctl)
 {
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct ieee80211_sta *sta = info->control.sta;
         struct ath_wiphy *aphy = hw->priv;
         struct ath_softc *sc = aphy->sc;
-        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ath_txq *txq = txctl->txq;
         struct ath_buf *bf;
-        int q, r;
-
-        bf = ath_tx_get_buffer(sc);
-        if (!bf) {
-                ath_print(common, ATH_DBG_XMIT, "TX buffers are full\n");
-                return -1;
-        }
-
-        r = ath_tx_setup_buffer(hw, bf, skb, txctl);
-        if (unlikely(r)) {
-                ath_print(common, ATH_DBG_FATAL, "TX mem alloc failure\n");
-
-                /* upon ath_tx_processq() this TX queue will be resumed, we
-                 * guarantee this will happen by knowing beforehand that
-                 * we will at least have to run TX completionon one buffer
-                 * on the queue */
-                spin_lock_bh(&txq->axq_lock);
-                if (!txq->stopped && txq->axq_depth > 1) {
-                        ath_mac80211_stop_queue(sc, skb_get_queue_mapping(skb));
-                        txq->stopped = 1;
-                }
-                spin_unlock_bh(&txq->axq_lock);
-
-                ath_tx_return_buffer(sc, bf);
-
-                return r;
-        }
-
-        q = skb_get_queue_mapping(skb);
-        if (q >= 4)
-                q = 0;
-
-        spin_lock_bh(&txq->axq_lock);
-        if (++sc->tx.pending_frames[q] > ATH_MAX_QDEPTH && !txq->stopped) {
-                ath_mac80211_stop_queue(sc, skb_get_queue_mapping(skb));
-                txq->stopped = 1;
-        }
-        spin_unlock_bh(&txq->axq_lock);
-
-        ath_tx_start_dma(sc, bf, txctl);
-
-        return 0;
-}
-
-void ath_tx_cabq(struct ieee80211_hw *hw, struct sk_buff *skb)
-{
-        struct ath_wiphy *aphy = hw->priv;
-        struct ath_softc *sc = aphy->sc;
-        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
         int padpos, padsize;
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        struct ath_tx_control txctl;
+        int frmlen = skb->len + FCS_LEN;
+        int q;
 
-        memset(&txctl, 0, sizeof(struct ath_tx_control));
+        txctl->an = (struct ath_node *)sta->drv_priv;
+        if (info->control.hw_key)
+                frmlen += info->control.hw_key->icv_len;
 
         /*
          * As a temporary workaround, assign seq# here; this will likely need
@@ -1812,30 +1745,37 @@ void ath_tx_cabq(struct ieee80211_hw *hw, struct sk_buff *skb)
         /* Add the padding after the header if this is not already done */
         padpos = ath9k_cmn_padpos(hdr->frame_control);
         padsize = padpos & 3;
-        if (padsize && skb->len>padpos) {
-                if (skb_headroom(skb) < padsize) {
-                        ath_print(common, ATH_DBG_XMIT,
-                                  "TX CABQ padding failed\n");
-                        dev_kfree_skb_any(skb);
-                        return;
-                }
+        if (padsize && skb->len > padpos) {
+                if (skb_headroom(skb) < padsize)
+                        return -ENOMEM;
+
                 skb_push(skb, padsize);
                 memmove(skb->data, skb->data + padsize, padpos);
         }
 
-        txctl.txq = sc->beacon.cabq;
+        setup_frame_info(hw, skb, frmlen);
+
+        /*
+         * At this point, the vif, hw_key and sta pointers in the tx control
+         * info are no longer valid (overwritten by the ath_frame_info data.
+         */
 
-        ath_print(common, ATH_DBG_XMIT,
-                  "transmitting CABQ packet, skb: %p\n", skb);
+        bf = ath_tx_setup_buffer(hw, txctl->txq, skb);
+        if (unlikely(!bf))
+                return -ENOMEM;
 
-        if (ath_tx_start(hw, skb, &txctl) != 0) {
-                ath_print(common, ATH_DBG_XMIT, "CABQ TX failed\n");
-                goto exit;
+        q = skb_get_queue_mapping(skb);
+        spin_lock_bh(&txq->axq_lock);
+        if (txq == sc->tx.txq_map[q] &&
+            ++txq->pending_frames > ATH_MAX_QDEPTH && !txq->stopped) {
+                ath_mac80211_stop_queue(sc, q);
+                txq->stopped = 1;
         }
+        spin_unlock_bh(&txq->axq_lock);
+
+        ath_tx_start_dma(sc, bf, txctl);
 
-        return;
-exit:
-        dev_kfree_skb_any(skb);
+        return 0;
 }
 
 /*****************/
@@ -1843,7 +1783,8 @@ exit:
 /*****************/
 
 static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
-                            struct ath_wiphy *aphy, int tx_flags)
+                            struct ath_wiphy *aphy, int tx_flags, int ftype,
+                            struct ath_txq *txq)
 {
         struct ieee80211_hw *hw = sc->hw;
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
@@ -1886,15 +1827,16 @@ static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
                                         PS_WAIT_FOR_TX_ACK));
         }
 
-        if (unlikely(tx_info->pad[0] & ATH_TX_INFO_FRAME_TYPE_INTERNAL))
-                ath9k_tx_status(hw, skb);
+        if (unlikely(ftype))
+                ath9k_tx_status(hw, skb, ftype);
         else {
                 q = skb_get_queue_mapping(skb);
-                if (q >= 4)
-                        q = 0;
-
-                if (--sc->tx.pending_frames[q] < 0)
-                        sc->tx.pending_frames[q] = 0;
+                if (txq == sc->tx.txq_map[q]) {
+                        spin_lock_bh(&txq->axq_lock);
+                        if (WARN_ON(--txq->pending_frames < 0))
+                                txq->pending_frames = 0;
+                        spin_unlock_bh(&txq->axq_lock);
+                }
 
                 ieee80211_tx_status(hw, skb);
         }
@@ -1922,15 +1864,14 @@ static void ath_tx_complete_buf(struct ath_softc *sc, struct ath_buf *bf,
         bf->bf_buf_addr = 0;
 
         if (bf->bf_state.bfs_paprd) {
-                if (time_after(jiffies,
-                               bf->bf_state.bfs_paprd_timestamp +
-                               msecs_to_jiffies(ATH_PAPRD_TIMEOUT)))
+                if (!sc->paprd_pending)
                         dev_kfree_skb_any(skb);
                 else
                         complete(&sc->paprd_complete);
         } else {
-                ath_debug_stat_tx(sc, txq, bf, ts);
-                ath_tx_complete(sc, skb, bf->aphy, tx_flags);
+                ath_debug_stat_tx(sc, bf, ts);
+                ath_tx_complete(sc, skb, bf->aphy, tx_flags,
+                                bf->bf_state.bfs_ftype, txq);
         }
         /* At this point, skb (bf->bf_mpdu) is consumed...make sure we don't
          * accidentally reference it later.
@@ -1945,42 +1886,15 @@ static void ath_tx_complete_buf(struct ath_softc *sc, struct ath_buf *bf,
         spin_unlock_irqrestore(&sc->tx.txbuflock, flags);
 }
 
-static int ath_tx_num_badfrms(struct ath_softc *sc, struct ath_buf *bf,
-                              struct ath_tx_status *ts, int txok)
-{
-        u16 seq_st = 0;
-        u32 ba[WME_BA_BMP_SIZE >> 5];
-        int ba_index;
-        int nbad = 0;
-        int isaggr = 0;
-
-        if (bf->bf_lastbf->bf_tx_aborted)
-                return 0;
-
-        isaggr = bf_isaggr(bf);
-        if (isaggr) {
-                seq_st = ts->ts_seqnum;
-                memcpy(ba, &ts->ba_low, WME_BA_BMP_SIZE >> 3);
-        }
-
-        while (bf) {
-                ba_index = ATH_BA_INDEX(seq_st, bf->bf_seqno);
-                if (!txok || (isaggr && !ATH_BA_ISSET(ba, ba_index)))
-                        nbad++;
-
-                bf = bf->bf_next;
-        }
-
-        return nbad;
-}
-
 static void ath_tx_rc_status(struct ath_buf *bf, struct ath_tx_status *ts,
-                             int nbad, int txok, bool update_rc)
+                             int nframes, int nbad, int txok, bool update_rc)
 {
         struct sk_buff *skb = bf->bf_mpdu;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
         struct ieee80211_hw *hw = bf->aphy->hw;
+        struct ath_softc *sc = bf->aphy->sc;
+        struct ath_hw *ah = sc->sc_ah;
         u8 i, tx_rateindex;
 
         if (txok)
@@ -1994,22 +1908,32 @@ static void ath_tx_rc_status(struct ath_buf *bf, struct ath_tx_status *ts,
         if ((tx_info->flags & IEEE80211_TX_CTL_AMPDU) && update_rc) {
                 tx_info->flags |= IEEE80211_TX_STAT_AMPDU;
 
-                BUG_ON(nbad > bf->bf_nframes);
+                BUG_ON(nbad > nframes);
 
-                tx_info->status.ampdu_len = bf->bf_nframes;
-                tx_info->status.ampdu_ack_len = bf->bf_nframes - nbad;
+                tx_info->status.ampdu_len = nframes;
+                tx_info->status.ampdu_ack_len = nframes - nbad;
         }
 
         if ((ts->ts_status & ATH9K_TXERR_FILT) == 0 &&
             (bf->bf_flags & ATH9K_TXDESC_NOACK) == 0 && update_rc) {
-                if (ieee80211_is_data(hdr->frame_control)) {
-                        if (ts->ts_flags &
-                            (ATH9K_TX_DATA_UNDERRUN | ATH9K_TX_DELIM_UNDERRUN))
-                                tx_info->pad[0] |= ATH_TX_INFO_UNDERRUN;
-                        if ((ts->ts_status & ATH9K_TXERR_XRETRY) ||
-                            (ts->ts_status & ATH9K_TXERR_FIFO))
-                                tx_info->pad[0] |= ATH_TX_INFO_XRETRY;
-                }
+                /*
+                 * If an underrun error is seen assume it as an excessive
+                 * retry only if max frame trigger level has been reached
+                 * (2 KB for single stream, and 4 KB for dual stream).
+                 * Adjust the long retry as if the frame was tried
+                 * hw->max_rate_tries times to affect how rate control updates
+                 * PER for the failed rate.
+                 * In case of congestion on the bus penalizing this type of
+                 * underruns should help hardware actually transmit new frames
+                 * successfully by eventually preferring slower rates.
+                 * This itself should also alleviate congestion on the bus.
+                 */
+                if (ieee80211_is_data(hdr->frame_control) &&
+                    (ts->ts_flags & (ATH9K_TX_DATA_UNDERRUN |
+                                     ATH9K_TX_DELIM_UNDERRUN)) &&
+                    ah->tx_trig_level >= sc->sc_ah->caps.tx_triglevel_max)
+                        tx_info->status.rates[tx_rateindex].count =
+                                hw->max_rate_tries;
         }
 
         for (i = tx_rateindex + 1; i < hw->max_rates; i++) {
@@ -2020,16 +1944,13 @@ static void ath_tx_rc_status(struct ath_buf *bf, struct ath_tx_status *ts,
         tx_info->status.rates[tx_rateindex].count = ts->ts_longretry + 1;
 }
 
-static void ath_wake_mac80211_queue(struct ath_softc *sc, struct ath_txq *txq)
+static void ath_wake_mac80211_queue(struct ath_softc *sc, int qnum)
 {
-        int qnum;
-
-        qnum = ath_get_mac80211_qnum(txq->axq_class, sc);
-        if (qnum == -1)
-                return;
+        struct ath_txq *txq;
 
+        txq = sc->tx.txq_map[qnum];
         spin_lock_bh(&txq->axq_lock);
-        if (txq->stopped && sc->tx.pending_frames[qnum] < ATH_MAX_QDEPTH) {
+        if (txq->stopped && txq->pending_frames < ATH_MAX_QDEPTH) {
                 if (ath_mac80211_start_queue(sc, qnum))
                         txq->stopped = 0;
         }
@@ -2046,6 +1967,7 @@ static void ath_tx_processq(struct ath_softc *sc, struct ath_txq *txq)
         struct ath_tx_status ts;
         int txok;
         int status;
+        int qnum;
 
         ath_print(common, ATH_DBG_QUEUE, "tx queue %d (%x), link %p\n",
                   txq->axq_qnum, ath9k_hw_gettxbuf(sc->sc_ah, txq->axq_qnum),
@@ -2118,15 +2040,19 @@ static void ath_tx_processq(struct ath_softc *sc, struct ath_txq *txq)
                          */
                         if (ts.ts_status & ATH9K_TXERR_XRETRY)
                                 bf->bf_state.bf_type |= BUF_XRETRY;
-                        ath_tx_rc_status(bf, &ts, txok ? 0 : 1, txok, true);
+                        ath_tx_rc_status(bf, &ts, 1, txok ? 0 : 1, txok, true);
                 }
 
+                qnum = skb_get_queue_mapping(bf->bf_mpdu);
+
                 if (bf_isampdu(bf))
-                        ath_tx_complete_aggr(sc, txq, bf, &bf_head, &ts, txok);
+                        ath_tx_complete_aggr(sc, txq, bf, &bf_head, &ts, txok,
+                                             true);
                 else
                         ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, txok, 0);
 
-                ath_wake_mac80211_queue(sc, txq);
+                if (txq == sc->tx.txq_map[qnum])
+                        ath_wake_mac80211_queue(sc, qnum);
 
                 spin_lock_bh(&txq->axq_lock);
                 if (sc->sc_flags & SC_OP_TXAGGR)
@@ -2196,6 +2122,7 @@ void ath_tx_edma_tasklet(struct ath_softc *sc)
         struct list_head bf_head;
         int status;
         int txok;
+        int qnum;
 
         for (;;) {
                 status = ath9k_hw_txprocdesc(ah, NULL, (void *)&txs);
@@ -2236,16 +2163,20 @@ void ath_tx_edma_tasklet(struct ath_softc *sc)
                 if (!bf_isampdu(bf)) {
                         if (txs.ts_status & ATH9K_TXERR_XRETRY)
                                 bf->bf_state.bf_type |= BUF_XRETRY;
-                        ath_tx_rc_status(bf, &txs, txok ? 0 : 1, txok, true);
+                        ath_tx_rc_status(bf, &txs, 1, txok ? 0 : 1, txok, true);
                 }
 
+                qnum = skb_get_queue_mapping(bf->bf_mpdu);
+
                 if (bf_isampdu(bf))
-                        ath_tx_complete_aggr(sc, txq, bf, &bf_head, &txs, txok);
+                        ath_tx_complete_aggr(sc, txq, bf, &bf_head, &txs,
+                                             txok, true);
                 else
                         ath_tx_complete_buf(sc, bf, txq, &bf_head,
                                             &txs, txok, 0);
 
-                ath_wake_mac80211_queue(sc, txq);
+                if (txq == sc->tx.txq_map[qnum])
+                        ath_wake_mac80211_queue(sc, qnum);
 
                 spin_lock_bh(&txq->axq_lock);
                 if (!list_empty(&txq->txq_fifo_pending)) {
@@ -2377,7 +2308,7 @@ void ath_tx_node_init(struct ath_softc *sc, struct ath_node *an)
         for (acno = 0, ac = &an->ac[acno];
              acno < WME_NUM_AC; acno++, ac++) {
                 ac->sched    = false;
-                ac->qnum = sc->tx.hwq_map[acno];
+                ac->txq = sc->tx.txq_map[acno];
                 INIT_LIST_HEAD(&ac->tid_q);
         }
 }
@@ -2387,17 +2318,13 @@ void ath_tx_node_cleanup(struct ath_softc *sc, struct ath_node *an)
         struct ath_atx_ac *ac;
         struct ath_atx_tid *tid;
         struct ath_txq *txq;
-        int i, tidno;
+        int tidno;
 
         for (tidno = 0, tid = &an->tid[tidno];
              tidno < WME_NUM_TID; tidno++, tid++) {
-                i = tid->ac->qnum;
-
-                if (!ATH_TXQ_SETUP(sc, i))
-                        continue;
 
-                txq = &sc->tx.txq[i];
                 ac = tid->ac;
+                txq = ac->txq;
 
                 spin_lock_bh(&txq->axq_lock);
 
diff --git a/drivers/net/wireless/ath/carl9170/carl9170.h b/drivers/net/wireless/ath/carl9170/carl9170.h
index 6cf0c9ef47a..d07ff7f2fd9 100644
--- a/drivers/net/wireless/ath/carl9170/carl9170.h
+++ b/drivers/net/wireless/ath/carl9170/carl9170.h
@@ -48,7 +48,7 @@
 #include <linux/usb.h>
 #ifdef CONFIG_CARL9170_LEDS
 #include <linux/leds.h>
-#endif /* CONFIG_CARL170_LEDS */
+#endif /* CONFIG_CARL9170_LEDS */
 #ifdef CONFIG_CARL9170_WPC
 #include <linux/input.h>
 #endif /* CONFIG_CARL9170_WPC */
@@ -215,7 +215,7 @@ enum carl9170_restart_reasons {
         CARL9170_RR_TOO_MANY_FIRMWARE_ERRORS,
         CARL9170_RR_WATCHDOG,
         CARL9170_RR_STUCK_TX,
-        CARL9170_RR_SLOW_SYSTEM,
+        CARL9170_RR_UNRESPONSIVE_DEVICE,
         CARL9170_RR_COMMAND_TIMEOUT,
         CARL9170_RR_TOO_MANY_PHY_ERRORS,
         CARL9170_RR_LOST_RSP,
@@ -287,6 +287,7 @@ struct ar9170 {
 
         /* reset / stuck frames/queue detection */
         struct work_struct restart_work;
+        struct work_struct ping_work;
         unsigned int restart_counter;
         unsigned long queue_stop_timeout[__AR9170_NUM_TXQ];
         unsigned long max_queue_stop_timeout[__AR9170_NUM_TXQ];
diff --git a/drivers/net/wireless/ath/carl9170/cmd.c b/drivers/net/wireless/ath/carl9170/cmd.c
index c21f3364bfe..cdfc94c371b 100644
--- a/drivers/net/wireless/ath/carl9170/cmd.c
+++ b/drivers/net/wireless/ath/carl9170/cmd.c
@@ -41,7 +41,7 @@
 
 int carl9170_write_reg(struct ar9170 *ar, const u32 reg, const u32 val)
 {
-        __le32 buf[2] = {
+        const __le32 buf[2] = {
                 cpu_to_le32(reg),
                 cpu_to_le32(val),
         };
diff --git a/drivers/net/wireless/ath/carl9170/fwcmd.h b/drivers/net/wireless/ath/carl9170/fwcmd.h
index d552166db50..3680dfc70f4 100644
--- a/drivers/net/wireless/ath/carl9170/fwcmd.h
+++ b/drivers/net/wireless/ath/carl9170/fwcmd.h
@@ -97,13 +97,13 @@ struct carl9170_set_key_cmd {
         __le16          type;
         u8              macAddr[6];
         u32             key[4];
-} __packed;
+} __packed __aligned(4);
 #define CARL9170_SET_KEY_CMD_SIZE               28
 
 struct carl9170_disable_key_cmd {
         __le16          user;
         __le16          padding;
-} __packed;
+} __packed __aligned(4);
 #define CARL9170_DISABLE_KEY_CMD_SIZE           4
 
 struct carl9170_u32_list {
@@ -206,7 +206,7 @@ struct carl9170_cmd {
                 struct carl9170_rx_filter_cmd   rx_filter;
                 u8 data[CARL9170_MAX_CMD_PAYLOAD_LEN];
         } __packed;
-} __packed;
+} __packed __aligned(4);
 
 #define CARL9170_TX_STATUS_QUEUE        3
 #define CARL9170_TX_STATUS_QUEUE_S      0
@@ -216,6 +216,7 @@ struct carl9170_cmd {
 #define CARL9170_TX_STATUS_TRIES        (7 << CARL9170_TX_STATUS_TRIES_S)
 #define CARL9170_TX_STATUS_SUCCESS      0x80
 
+#ifdef __CARL9170FW__
 /*
  * NOTE:
  * Both structs [carl9170_tx_status and _carl9170_tx_status]
@@ -232,6 +233,8 @@ struct carl9170_tx_status {
         u8 tries:3;
         u8 success:1;
 } __packed;
+#endif /* __CARL9170FW__ */
+
 struct _carl9170_tx_status {
         /*
          * This version should be immune to all alignment bugs.
@@ -272,13 +275,15 @@ struct carl9170_rsp {
                 struct carl9170_rf_init_result  rf_init_res;
                 struct carl9170_u32_list        rreg_res;
                 struct carl9170_u32_list        echo;
+#ifdef __CARL9170FW__
                 struct carl9170_tx_status       tx_status[0];
+#endif /* __CARL9170FW__ */
                 struct _carl9170_tx_status      _tx_status[0];
                 struct carl9170_gpio            gpio;
                 struct carl9170_tsf_rsp         tsf;
                 struct carl9170_psm             psm;
                 u8 data[CARL9170_MAX_CMD_PAYLOAD_LEN];
         } __packed;
-} __packed;
+} __packed __aligned(4);
 
 #endif /* __CARL9170_SHARED_FWCMD_H */
diff --git a/drivers/net/wireless/ath/carl9170/hw.h b/drivers/net/wireless/ath/carl9170/hw.h
index 2f471b3f05a..e85df6edfed 100644
--- a/drivers/net/wireless/ath/carl9170/hw.h
+++ b/drivers/net/wireless/ath/carl9170/hw.h
@@ -712,7 +712,8 @@ struct ar9170_stream {
         __le16 tag;
 
         u8 payload[0];
-};
+} __packed __aligned(4);
+#define AR9170_STREAM_LEN                               4
 
 #define AR9170_MAX_ACKTABLE_ENTRIES                     8
 #define AR9170_MAX_VIRTUAL_MAC                          7
@@ -736,4 +737,8 @@ struct ar9170_stream {
 
 #define MOD_VAL(reg, value, newvalue)                                   \
         (((value) & ~reg) | (((newvalue) << reg##_S) & reg))
+
+#define GET_VAL(reg, value)                                             \
+        (((value) & reg) >> reg##_S)
+
 #endif  /* __CARL9170_SHARED_HW_H */
diff --git a/drivers/net/wireless/ath/carl9170/mac.c b/drivers/net/wireless/ath/carl9170/mac.c
index 2305bc27151..385cf508479 100644
--- a/drivers/net/wireless/ath/carl9170/mac.c
+++ b/drivers/net/wireless/ath/carl9170/mac.c
@@ -205,8 +205,8 @@ int carl9170_init_mac(struct ar9170 *ar)
         carl9170_regwrite(AR9170_MAC_REG_BACKOFF_PROTECT, 0x105);
 
         /* Aggregation MAX number and timeout */
-        carl9170_regwrite(AR9170_MAC_REG_AMPDU_FACTOR, 0xa);
-        carl9170_regwrite(AR9170_MAC_REG_AMPDU_DENSITY, 0x140a00);
+        carl9170_regwrite(AR9170_MAC_REG_AMPDU_FACTOR, 0x8000a);
+        carl9170_regwrite(AR9170_MAC_REG_AMPDU_DENSITY, 0x140a07);
 
         carl9170_regwrite(AR9170_MAC_REG_FRAMETYPE_FILTER,
                           AR9170_MAC_FTF_DEFAULTS);
@@ -457,8 +457,9 @@ int carl9170_set_beacon_timers(struct ar9170 *ar)
 
 int carl9170_update_beacon(struct ar9170 *ar, const bool submit)
 {
-        struct sk_buff *skb;
+        struct sk_buff *skb = NULL;
         struct carl9170_vif_info *cvif;
+        struct ieee80211_tx_info *txinfo;
         __le32 *data, *old = NULL;
         u32 word, off, addr, len;
         int i = 0, err = 0;
@@ -487,7 +488,13 @@ found:
 
         if (!skb) {
                 err = -ENOMEM;
-                goto out_unlock;
+                goto err_free;
+        }
+
+        txinfo = IEEE80211_SKB_CB(skb);
+        if (txinfo->control.rates[0].flags & IEEE80211_TX_RC_MCS) {
+                err = -EINVAL;
+                goto err_free;
         }
 
         spin_lock_bh(&ar->beacon_lock);
@@ -504,11 +511,8 @@ found:
                         wiphy_err(ar->hw->wiphy, "beacon does not "
                                   "fit into device memory!\n");
                 }
-
-                spin_unlock_bh(&ar->beacon_lock);
-                dev_kfree_skb_any(skb);
                 err = -EINVAL;
-                goto out_unlock;
+                goto err_unlock;
         }
 
         if (len > AR9170_MAC_BCN_LENGTH_MAX) {
@@ -518,22 +522,22 @@ found:
                                  AR9170_MAC_BCN_LENGTH_MAX, len);
                 }
 
-                spin_unlock_bh(&ar->beacon_lock);
-                dev_kfree_skb_any(skb);
                 err = -EMSGSIZE;
-                goto out_unlock;
+                goto err_unlock;
         }
 
-        carl9170_async_regwrite_begin(ar);
+        i = txinfo->control.rates[0].idx;
+        if (txinfo->band != IEEE80211_BAND_2GHZ)
+                i += 4;
 
-        /* XXX: use skb->cb info */
-        if (ar->hw->conf.channel->band == IEEE80211_BAND_2GHZ) {
-                carl9170_async_regwrite(AR9170_MAC_REG_BCN_PLCP,
-                                ((skb->len + FCS_LEN) << (3 + 16)) + 0x0400);
-        } else {
-                carl9170_async_regwrite(AR9170_MAC_REG_BCN_PLCP,
-                                ((skb->len + FCS_LEN) << 16) + 0x001b);
-        }
+        word = __carl9170_ratetable[i].hw_value & 0xf;
+        if (i < 4)
+                word |= ((skb->len + FCS_LEN) << (3 + 16)) + 0x0400;
+        else
+                word |= ((skb->len + FCS_LEN) << 16) + 0x0010;
+
+        carl9170_async_regwrite_begin(ar);
+        carl9170_async_regwrite(AR9170_MAC_REG_BCN_PLCP, word);
 
         for (i = 0; i < DIV_ROUND_UP(skb->len, 4); i++) {
                 /*
@@ -557,7 +561,7 @@ found:
                 cvif->beacon = skb;
         spin_unlock_bh(&ar->beacon_lock);
         if (err)
-                goto out_unlock;
+                goto err_free;
 
         if (submit) {
                 err = carl9170_bcn_ctrl(ar, cvif->id,
@@ -565,10 +569,18 @@ found:
                                         addr, skb->len + FCS_LEN);
 
                 if (err)
-                        goto out_unlock;
+                        goto err_free;
         }
 out_unlock:
         rcu_read_unlock();
+        return 0;
+
+err_unlock:
+        spin_unlock_bh(&ar->beacon_lock);
+
+err_free:
+        rcu_read_unlock();
+        dev_kfree_skb_any(skb);
         return err;
 }
 
diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c
index dc7b30b170d..870df8c4262 100644
--- a/drivers/net/wireless/ath/carl9170/main.c
+++ b/drivers/net/wireless/ath/carl9170/main.c
@@ -428,6 +428,7 @@ static void carl9170_cancel_worker(struct ar9170 *ar)
         cancel_delayed_work_sync(&ar->led_work);
 #endif /* CONFIG_CARL9170_LEDS */
         cancel_work_sync(&ar->ps_work);
+        cancel_work_sync(&ar->ping_work);
         cancel_work_sync(&ar->ampdu_work);
 }
 
@@ -533,6 +534,21 @@ void carl9170_restart(struct ar9170 *ar, const enum carl9170_restart_reasons r)
          */
 }
 
+static void carl9170_ping_work(struct work_struct *work)
+{
+        struct ar9170 *ar = container_of(work, struct ar9170, ping_work);
+        int err;
+
+        if (!IS_STARTED(ar))
+                return;
+
+        mutex_lock(&ar->mutex);
+        err = carl9170_echo_test(ar, 0xdeadbeef);
+        if (err)
+                carl9170_restart(ar, CARL9170_RR_UNRESPONSIVE_DEVICE);
+        mutex_unlock(&ar->mutex);
+}
+
 static int carl9170_init_interface(struct ar9170 *ar,
                                    struct ieee80211_vif *vif)
 {
@@ -1614,6 +1630,7 @@ void *carl9170_alloc(size_t priv_size)
                 skb_queue_head_init(&ar->tx_pending[i]);
         }
         INIT_WORK(&ar->ps_work, carl9170_ps_work);
+        INIT_WORK(&ar->ping_work, carl9170_ping_work);
         INIT_WORK(&ar->restart_work, carl9170_restart_work);
         INIT_WORK(&ar->ampdu_work, carl9170_ampdu_work);
         INIT_DELAYED_WORK(&ar->tx_janitor, carl9170_tx_janitor);
@@ -1829,7 +1846,7 @@ int carl9170_register(struct ar9170 *ar)
         err = carl9170_led_register(ar);
         if (err)
                 goto err_unreg;
-#endif /* CONFIG_CAR9L170_LEDS */
+#endif /* CONFIG_CARL9170_LEDS */
 
 #ifdef CONFIG_CARL9170_WPC
         err = carl9170_register_wps_button(ar);
diff --git a/drivers/net/wireless/ath/carl9170/phy.c b/drivers/net/wireless/ath/carl9170/phy.c
index 89deca37a98..82bc81c4c93 100644
--- a/drivers/net/wireless/ath/carl9170/phy.c
+++ b/drivers/net/wireless/ath/carl9170/phy.c
@@ -1554,15 +1554,6 @@ static int carl9170_set_power_cal(struct ar9170 *ar, u32 freq,
         return carl9170_regwrite_result();
 }
 
-/* TODO: replace this with sign_extend32(noise, 8) */
-static int carl9170_calc_noise_dbm(u32 raw_noise)
-{
-        if (raw_noise & 0x100)
-                return ~0x1ff | raw_noise;
-        else
-                return raw_noise;
-}
-
 int carl9170_get_noisefloor(struct ar9170 *ar)
 {
         static const u32 phy_regs[] = {
@@ -1578,11 +1569,11 @@ int carl9170_get_noisefloor(struct ar9170 *ar)
                 return err;
 
         for (i = 0; i < 2; i++) {
-                ar->noise[i] = carl9170_calc_noise_dbm(
-                        (phy_res[i] >> 19) & 0x1ff);
+                ar->noise[i] = sign_extend32(GET_VAL(
+                        AR9170_PHY_CCA_MIN_PWR, phy_res[i]), 8);
 
-                ar->noise[i + 2] = carl9170_calc_noise_dbm(
-                        (phy_res[i + 2] >> 23) & 0x1ff);
+                ar->noise[i + 2] = sign_extend32(GET_VAL(
+                        AR9170_PHY_EXT_CCA_MIN_PWR, phy_res[i + 2]), 8);
         }
 
         return 0;
diff --git a/drivers/net/wireless/ath/carl9170/phy.h b/drivers/net/wireless/ath/carl9170/phy.h
index 02c34eb4ebd..024fb42bc78 100644
--- a/drivers/net/wireless/ath/carl9170/phy.h
+++ b/drivers/net/wireless/ath/carl9170/phy.h
@@ -139,8 +139,8 @@
 #define         AR9170_PHY_AGC_CONTROL_NO_UPDATE_NF     0x00020000
 
 #define AR9170_PHY_REG_CCA                      (AR9170_PHY_REG_BASE + 0x0064)
-#define         AR9170_PHY_CCA_MINCCA_PWR               0x0ff80000
-#define         AR9170_PHY_CCA_MINCCA_PWR_S             19
+#define         AR9170_PHY_CCA_MIN_PWR                  0x0ff80000
+#define         AR9170_PHY_CCA_MIN_PWR_S                19
 #define         AR9170_PHY_CCA_THRESH62                 0x0007f000
 #define         AR9170_PHY_CCA_THRESH62_S               12
 
@@ -338,8 +338,8 @@
 #define         AR9170_PHY_EXT_CCA_CYCPWR_THR1_S        9
 #define         AR9170_PHY_EXT_CCA_THRESH62             0x007f0000
 #define         AR9170_PHY_EXT_CCA_THRESH62_S           16
-#define         AR9170_PHY_EXT_MINCCA_PWR               0xff800000
-#define         AR9170_PHY_EXT_MINCCA_PWR_S             23
+#define         AR9170_PHY_EXT_CCA_MIN_PWR              0xff800000
+#define         AR9170_PHY_EXT_CCA_MIN_PWR_S            23
 
 #define AR9170_PHY_REG_SFCORR_EXT               (AR9170_PHY_REG_BASE + 0x01c0)
 #define         AR9170_PHY_SFCORR_EXT_M1_THRESH         0x0000007f
@@ -546,19 +546,19 @@
 #define         AR9170_PHY_FORCE_XPA_CFG_S              0
 
 #define AR9170_PHY_REG_CH1_CCA                  (AR9170_PHY_REG_BASE + 0x1064)
-#define         AR9170_PHY_CH1_MINCCA_PWR               0x0ff80000
-#define         AR9170_PHY_CH1_MINCCA_PWR_S             19
+#define         AR9170_PHY_CH1_CCA_MIN_PWR              0x0ff80000
+#define         AR9170_PHY_CH1_CCA_MIN_PWR_S            19
 
 #define AR9170_PHY_REG_CH2_CCA                  (AR9170_PHY_REG_BASE + 0x2064)
-#define         AR9170_PHY_CH2_MINCCA_PWR               0x0ff80000
-#define         AR9170_PHY_CH2_MINCCA_PWR_S             19
+#define         AR9170_PHY_CH2_CCA_MIN_PWR              0x0ff80000
+#define         AR9170_PHY_CH2_CCA_MIN_PWR_S            19
 
 #define AR9170_PHY_REG_CH1_EXT_CCA              (AR9170_PHY_REG_BASE + 0x11bc)
-#define         AR9170_PHY_CH1_EXT_MINCCA_PWR           0xff800000
-#define         AR9170_PHY_CH1_EXT_MINCCA_PWR_S         23
+#define         AR9170_PHY_CH1_EXT_CCA_MIN_PWR          0xff800000
+#define         AR9170_PHY_CH1_EXT_CCA_MIN_PWR_S        23
 
 #define AR9170_PHY_REG_CH2_EXT_CCA              (AR9170_PHY_REG_BASE + 0x21bc)
-#define         AR9170_PHY_CH2_EXT_MINCCA_PWR           0xff800000
-#define         AR9170_PHY_CH2_EXT_MINCCA_PWR_S         23
+#define         AR9170_PHY_CH2_EXT_CCA_MIN_PWR          0xff800000
+#define         AR9170_PHY_CH2_EXT_CCA_MIN_PWR_S        23
 
 #endif  /* __CARL9170_SHARED_PHY_H */
diff --git a/drivers/net/wireless/ath/carl9170/tx.c b/drivers/net/wireless/ath/carl9170/tx.c
index 7e6506a77bb..6cc58e052d1 100644
--- a/drivers/net/wireless/ath/carl9170/tx.c
+++ b/drivers/net/wireless/ath/carl9170/tx.c
@@ -242,9 +242,11 @@ static void carl9170_tx_release(struct kref *ref)
                         ar->tx_ampdu_schedule = true;
 
                 if (txinfo->flags & IEEE80211_TX_STAT_AMPDU) {
-                        txinfo->status.ampdu_len = txinfo->pad[0];
-                        txinfo->status.ampdu_ack_len = txinfo->pad[1];
-                        txinfo->pad[0] = txinfo->pad[1] = 0;
+                        struct _carl9170_tx_superframe *super;
+
+                        super = (void *)skb->data;
+                        txinfo->status.ampdu_len = super->s.rix;
+                        txinfo->status.ampdu_ack_len = super->s.cnt;
                 } else if (txinfo->flags & IEEE80211_TX_STAT_ACK) {
                         /*
                          * drop redundant tx_status reports:
@@ -337,7 +339,8 @@ static void carl9170_tx_status_process_ampdu(struct ar9170 *ar,
         u8 tid;
 
         if (!(txinfo->flags & IEEE80211_TX_CTL_AMPDU) ||
-            txinfo->flags & IEEE80211_TX_CTL_INJECTED)
+            txinfo->flags & IEEE80211_TX_CTL_INJECTED ||
+           (!(super->f.mac_control & cpu_to_le16(AR9170_TX_MAC_AGGR))))
                 return;
 
         tx_info = IEEE80211_SKB_CB(skb);
@@ -389,8 +392,8 @@ static void carl9170_tx_status_process_ampdu(struct ar9170 *ar,
                 sta_info->stats[tid].ampdu_ack_len++;
 
         if (super->f.mac_control & cpu_to_le16(AR9170_TX_MAC_IMM_BA)) {
-                txinfo->pad[0] = sta_info->stats[tid].ampdu_len;
-                txinfo->pad[1] = sta_info->stats[tid].ampdu_ack_len;
+                super->s.rix = sta_info->stats[tid].ampdu_len;
+                super->s.cnt = sta_info->stats[tid].ampdu_ack_len;
                 txinfo->flags |= IEEE80211_TX_STAT_AMPDU;
                 sta_info->stats[tid].clear = true;
         }
@@ -524,6 +527,59 @@ next:
         }
 }
 
+static void carl9170_tx_ampdu_timeout(struct ar9170 *ar)
+{
+        struct carl9170_sta_tid *iter;
+        struct sk_buff *skb;
+        struct ieee80211_tx_info *txinfo;
+        struct carl9170_tx_info *arinfo;
+        struct _carl9170_tx_superframe *super;
+        struct ieee80211_sta *sta;
+        struct ieee80211_vif *vif;
+        struct ieee80211_hdr *hdr;
+        unsigned int vif_id;
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(iter, &ar->tx_ampdu_list, list) {
+                if (iter->state < CARL9170_TID_STATE_IDLE)
+                        continue;
+
+                spin_lock_bh(&iter->lock);
+                skb = skb_peek(&iter->queue);
+                if (!skb)
+                        goto unlock;
+
+                txinfo = IEEE80211_SKB_CB(skb);
+                arinfo = (void *)txinfo->rate_driver_data;
+                if (time_is_after_jiffies(arinfo->timeout +
+                    msecs_to_jiffies(CARL9170_QUEUE_TIMEOUT)))
+                        goto unlock;
+
+                super = (void *) skb->data;
+                hdr = (void *) super->frame_data;
+
+                vif_id = (super->s.misc & CARL9170_TX_SUPER_MISC_VIF_ID) >>
+                         CARL9170_TX_SUPER_MISC_VIF_ID_S;
+
+                if (WARN_ON(vif_id >= AR9170_MAX_VIRTUAL_MAC))
+                        goto unlock;
+
+                vif = rcu_dereference(ar->vif_priv[vif_id].vif);
+                if (WARN_ON(!vif))
+                        goto unlock;
+
+                sta = ieee80211_find_sta(vif, hdr->addr1);
+                if (WARN_ON(!sta))
+                        goto unlock;
+
+                ieee80211_stop_tx_ba_session(sta, iter->tid);
+unlock:
+                spin_unlock_bh(&iter->lock);
+
+        }
+        rcu_read_unlock();
+}
+
 void carl9170_tx_janitor(struct work_struct *work)
 {
         struct ar9170 *ar = container_of(work, struct ar9170,
@@ -534,6 +590,7 @@ void carl9170_tx_janitor(struct work_struct *work)
         ar->tx_janitor_last_run = jiffies;
 
         carl9170_check_queue_stop_timeout(ar);
+        carl9170_tx_ampdu_timeout(ar);
 
         if (!atomic_read(&ar->tx_total_queued))
                 return;
@@ -842,10 +899,8 @@ static int carl9170_tx_prepare(struct ar9170 *ar, struct sk_buff *skb)
                 if (unlikely(!sta || !cvif))
                         goto err_out;
 
-                factor = min_t(unsigned int, 1u,
-                         info->control.sta->ht_cap.ampdu_factor);
-
-                density = info->control.sta->ht_cap.ampdu_density;
+                factor = min_t(unsigned int, 1u, sta->ht_cap.ampdu_factor);
+                density = sta->ht_cap.ampdu_density;
 
                 if (density) {
                         /*
@@ -1206,6 +1261,7 @@ static void carl9170_tx(struct ar9170 *ar)
 static bool carl9170_tx_ampdu_queue(struct ar9170 *ar,
         struct ieee80211_sta *sta, struct sk_buff *skb)
 {
+        struct _carl9170_tx_superframe *super = (void *) skb->data;
         struct carl9170_sta_info *sta_info;
         struct carl9170_sta_tid *agg;
         struct sk_buff *iter;
@@ -1274,6 +1330,7 @@ err_unlock:
 
 err_unlock_rcu:
         rcu_read_unlock();
+        super->f.mac_control &= ~cpu_to_le16(AR9170_TX_MAC_AGGR);
         carl9170_tx_status(ar, skb, false);
         ar->tx_dropped++;
         return false;
@@ -1302,9 +1359,6 @@ int carl9170_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
          */
 
         if (info->flags & IEEE80211_TX_CTL_AMPDU) {
-                if (WARN_ON_ONCE(!sta))
-                        goto err_free;
-
                 run = carl9170_tx_ampdu_queue(ar, sta, skb);
                 if (run)
                         carl9170_tx_ampdu(ar);
diff --git a/drivers/net/wireless/ath/carl9170/usb.c b/drivers/net/wireless/ath/carl9170/usb.c
index 7504ed14c72..a268053e18e 100644
--- a/drivers/net/wireless/ath/carl9170/usb.c
+++ b/drivers/net/wireless/ath/carl9170/usb.c
@@ -433,7 +433,7 @@ static void carl9170_usb_rx_complete(struct urb *urb)
                          * device.
                          */
 
-                        carl9170_restart(ar, CARL9170_RR_SLOW_SYSTEM);
+                        ieee80211_queue_work(ar->hw, &ar->ping_work);
                 }
         } else {
                 /*
diff --git a/drivers/net/wireless/ath/carl9170/version.h b/drivers/net/wireless/ath/carl9170/version.h
index ff53f078a0b..ee0f84f2a2f 100644
--- a/drivers/net/wireless/ath/carl9170/version.h
+++ b/drivers/net/wireless/ath/carl9170/version.h
@@ -1,7 +1,7 @@
 #ifndef __CARL9170_SHARED_VERSION_H
 #define __CARL9170_SHARED_VERSION_H
 #define CARL9170FW_VERSION_YEAR 10
-#define CARL9170FW_VERSION_MONTH 9
-#define CARL9170FW_VERSION_DAY 28
-#define CARL9170FW_VERSION_GIT "1.8.8.3"
+#define CARL9170FW_VERSION_MONTH 10
+#define CARL9170FW_VERSION_DAY 29
+#define CARL9170FW_VERSION_GIT "1.9.0"
 #endif /* __CARL9170_SHARED_VERSION_H */
diff --git a/drivers/net/wireless/ath/debug.c b/drivers/net/wireless/ath/debug.c
index dacfb234f49..a9600ba8cea 100644
--- a/drivers/net/wireless/ath/debug.c
+++ b/drivers/net/wireless/ath/debug.c
@@ -19,14 +19,19 @@
 
 void ath_print(struct ath_common *common, int dbg_mask, const char *fmt, ...)
 {
+        struct va_format vaf;
         va_list args;
 
         if (likely(!(common->debug_mask & dbg_mask)))
                 return;
 
         va_start(args, fmt);
-        printk(KERN_DEBUG "ath: ");
-        vprintk(fmt, args);
+
+        vaf.fmt = fmt;
+        vaf.va = &args;
+
+        printk(KERN_DEBUG "ath: %pV", &vaf);
+
         va_end(args);
 }
 EXPORT_SYMBOL(ath_print);
diff --git a/drivers/net/wireless/ath/debug.h b/drivers/net/wireless/ath/debug.h
index 64e4af2c288..f207007ee39 100644
--- a/drivers/net/wireless/ath/debug.h
+++ b/drivers/net/wireless/ath/debug.h
@@ -70,11 +70,13 @@ enum ATH_DEBUG {
 #ifdef CONFIG_ATH_DEBUG
 void ath_print(struct ath_common *common, int dbg_mask, const char *fmt, ...)
         __attribute__ ((format (printf, 3, 4)));
+#define ATH_DBG_WARN(foo, arg...) WARN(foo, arg)
 #else
 static inline void __attribute__ ((format (printf, 3, 4)))
 ath_print(struct ath_common *common, int dbg_mask, const char *fmt, ...)
 {
 }
+#define ATH_DBG_WARN(foo, arg)
 #endif /* CONFIG_ATH_DEBUG */
 
 /** Returns string describing opmode, or NULL if unknown mode. */
diff --git a/drivers/net/wireless/ath/key.c b/drivers/net/wireless/ath/key.c
index bd21a4d8208..62e3dac8f92 100644
--- a/drivers/net/wireless/ath/key.c
+++ b/drivers/net/wireless/ath/key.c
@@ -67,7 +67,8 @@ bool ath_hw_keyreset(struct ath_common *common, u16 entry)
 }
 EXPORT_SYMBOL(ath_hw_keyreset);
 
-bool ath_hw_keysetmac(struct ath_common *common, u16 entry, const u8 *mac)
+static bool ath_hw_keysetmac(struct ath_common *common,
+                             u16 entry, const u8 *mac)
 {
         u32 macHi, macLo;
         u32 unicast_flag = AR_KEYTABLE_VALID;
@@ -107,9 +108,9 @@ bool ath_hw_keysetmac(struct ath_common *common, u16 entry, const u8 *mac)
         return true;
 }
 
-bool ath_hw_set_keycache_entry(struct ath_common *common, u16 entry,
-                                 const struct ath_keyval *k,
-                                 const u8 *mac)
+static bool ath_hw_set_keycache_entry(struct ath_common *common, u16 entry,
+                                      const struct ath_keyval *k,
+                                      const u8 *mac)
 {
         void *ah = common->ah;
         u32 key0, key1, key2, key3, key4;
diff --git a/drivers/net/wireless/atmel.c b/drivers/net/wireless/atmel.c
index c8f7090b27d..46e382ed46a 100644
--- a/drivers/net/wireless/atmel.c
+++ b/drivers/net/wireless/atmel.c
@@ -1161,7 +1161,7 @@ static irqreturn_t service_interrupt(int irq, void *dev_id)
         struct atmel_private *priv = netdev_priv(dev);
         u8 isr;
         int i = -1;
-        static u8 irq_order[] = {
+        static const u8 irq_order[] = {
                 ISR_OUT_OF_RANGE,
                 ISR_RxCOMPLETE,
                 ISR_TxCOMPLETE,
@@ -3771,7 +3771,9 @@ static int probe_atmel_card(struct net_device *dev)
 
         if (rc) {
                 if (dev->dev_addr[0] == 0xFF) {
-                        u8 default_mac[] = {0x00, 0x04, 0x25, 0x00, 0x00, 0x00};
+                        static const u8 default_mac[] = {
+                                0x00, 0x04, 0x25, 0x00, 0x00, 0x00
+                        };
                         printk(KERN_ALERT "%s: *** Invalid MAC address. UPGRADE Firmware ****\n", dev->name);
                         memcpy(dev->dev_addr, default_mac, 6);
                 }
diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h
index 72821c456b0..9aad2ca3c11 100644
--- a/drivers/net/wireless/b43/b43.h
+++ b/drivers/net/wireless/b43/b43.h
@@ -153,6 +153,19 @@
 #define B43_BFH_FEM_BT                  0x0040  /* has FEM and switch to share antenna
                                                  * with bluetooth */
 
+/* SPROM boardflags2_lo values */
+#define B43_BFL2_RXBB_INT_REG_DIS       0x0001  /* external RX BB regulator present */
+#define B43_BFL2_APLL_WAR               0x0002  /* alternative A-band PLL settings implemented */
+#define B43_BFL2_TXPWRCTRL_EN           0x0004  /* permits enabling TX Power Control */
+#define B43_BFL2_2X4_DIV                0x0008  /* 2x4 diversity switch */
+#define B43_BFL2_5G_PWRGAIN             0x0010  /* supports 5G band power gain */
+#define B43_BFL2_PCIEWAR_OVR            0x0020  /* overrides ASPM and Clkreq settings */
+#define B43_BFL2_CAESERS_BRD            0x0040  /* is Caesers board (unused) */
+#define B43_BFL2_BTC3WIRE               0x0080  /* used 3-wire bluetooth coexist */
+#define B43_BFL2_SKWRKFEM_BRD           0x0100  /* 4321mcm93 uses Skyworks FEM */
+#define B43_BFL2_SPUR_WAR               0x0200  /* has a workaround for clock-harmonic spurs */
+#define B43_BFL2_GPLL_WAR               0x0400  /* altenative G-band PLL settings implemented */
+
 /* GPIO register offset, in both ChipCommon and PCI core. */
 #define B43_GPIO_CONTROL                0x6c
 
diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
index 10d0aaf754c..3d5566e7af0 100644
--- a/drivers/net/wireless/b43/dma.c
+++ b/drivers/net/wireless/b43/dma.c
@@ -415,11 +415,6 @@ static int alloc_ringmemory(struct b43_dmaring *ring)
 
 static void free_ringmemory(struct b43_dmaring *ring)
 {
-        gfp_t flags = GFP_KERNEL;
-
-        if (ring->type == B43_DMA_64BIT)
-                flags |= GFP_DMA;
-
         dma_free_coherent(ring->dev->dev->dma_dev, B43_DMA_RINGMEMSIZE,
                           ring->descbase, ring->dmabase);
 }
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index a1186525c70..fa488036658 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -322,59 +322,83 @@ static int b43_ratelimit(struct b43_wl *wl)
 
 void b43info(struct b43_wl *wl, const char *fmt, ...)
 {
+        struct va_format vaf;
         va_list args;
 
         if (b43_modparam_verbose < B43_VERBOSITY_INFO)
                 return;
         if (!b43_ratelimit(wl))
                 return;
+
         va_start(args, fmt);
-        printk(KERN_INFO "b43-%s: ",
-               (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
-        vprintk(fmt, args);
+
+        vaf.fmt = fmt;
+        vaf.va = &args;
+
+        printk(KERN_INFO "b43-%s: %pV",
+               (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
+
         va_end(args);
 }
 
 void b43err(struct b43_wl *wl, const char *fmt, ...)
 {
+        struct va_format vaf;
         va_list args;
 
         if (b43_modparam_verbose < B43_VERBOSITY_ERROR)
                 return;
         if (!b43_ratelimit(wl))
                 return;
+
         va_start(args, fmt);
-        printk(KERN_ERR "b43-%s ERROR: ",
-               (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
-        vprintk(fmt, args);
+
+        vaf.fmt = fmt;
+        vaf.va = &args;
+
+        printk(KERN_ERR "b43-%s ERROR: %pV",
+               (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
+
         va_end(args);
 }
 
 void b43warn(struct b43_wl *wl, const char *fmt, ...)
 {
+        struct va_format vaf;
         va_list args;
 
         if (b43_modparam_verbose < B43_VERBOSITY_WARN)
                 return;
         if (!b43_ratelimit(wl))
                 return;
+
         va_start(args, fmt);
-        printk(KERN_WARNING "b43-%s warning: ",
-               (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
-        vprintk(fmt, args);
+
+        vaf.fmt = fmt;
+        vaf.va = &args;
+
+        printk(KERN_WARNING "b43-%s warning: %pV",
+               (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
+
         va_end(args);
 }
 
 void b43dbg(struct b43_wl *wl, const char *fmt, ...)
 {
+        struct va_format vaf;
         va_list args;
 
         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
                 return;
+
         va_start(args, fmt);
-        printk(KERN_DEBUG "b43-%s debug: ",
-               (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
-        vprintk(fmt, args);
+
+        vaf.fmt = fmt;
+        vaf.va = &args;
+
+        printk(KERN_DEBUG "b43-%s debug: %pV",
+               (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
+
         va_end(args);
 }
 
diff --git a/drivers/net/wireless/b43/phy_common.c b/drivers/net/wireless/b43/phy_common.c
index 7b2ea678145..fa7f83fc8db 100644
--- a/drivers/net/wireless/b43/phy_common.c
+++ b/drivers/net/wireless/b43/phy_common.c
@@ -427,9 +427,11 @@ void b43_phyop_switch_analog_generic(struct b43_wldev *dev, bool on)
 /* http://bcm-v4.sipsolutions.net/802.11/PHY/Cordic */
 struct b43_c32 b43_cordic(int theta)
 {
-        u32 arctg[] = { 2949120, 1740967, 919879, 466945, 234379, 117304,
-                      58666, 29335, 14668, 7334, 3667, 1833, 917, 458,
-                      229, 115, 57, 29, };
+        static const u32 arctg[] = {
+                2949120, 1740967, 919879, 466945, 234379, 117304,
+                  58666,   29335,  14668,   7334,   3667,   1833,
+                    917,     458,    229,    115,     57,     29,
+        };
         u8 i;
         s32 tmp;
         s8 signx = 1;
diff --git a/drivers/net/wireless/b43/phy_n.c b/drivers/net/wireless/b43/phy_n.c
index e0f2d122e12..9769483156e 100644
--- a/drivers/net/wireless/b43/phy_n.c
+++ b/drivers/net/wireless/b43/phy_n.c
@@ -191,7 +191,8 @@ static void b43_radio_init2055_post(struct b43_wldev *dev)
                                 binfo->type != 0x46D ||
                                 binfo->rev < 0x41);
         else
-                workaround = ((sprom->boardflags_hi & B43_BFH_NOPA) == 0);
+                workaround =
+                        !(sprom->boardflags2_lo & B43_BFL2_RXBB_INT_REG_DIS);
 
         b43_radio_mask(dev, B2055_MASTER1, 0xFFF3);
         if (workaround) {
@@ -240,10 +241,13 @@ static void b43_radio_init2055_post(struct b43_wldev *dev)
 static void b43_radio_init2055(struct b43_wldev *dev)
 {
         b43_radio_init2055_pre(dev);
-        if (b43_status(dev) < B43_STAT_INITIALIZED)
-                b2055_upload_inittab(dev, 0, 1);
-        else
-                b2055_upload_inittab(dev, 0/*FIXME on 5ghz band*/, 0);
+        if (b43_status(dev) < B43_STAT_INITIALIZED) {
+                /* Follow wl, not specs. Do not force uploading all regs */
+                b2055_upload_inittab(dev, 0, 0);
+        } else {
+                bool ghz5 = b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ;
+                b2055_upload_inittab(dev, ghz5, 0);
+        }
         b43_radio_init2055_post(dev);
 }
 
@@ -569,7 +573,6 @@ static void b43_nphy_calc_rx_iq_comp(struct b43_wldev *dev, u8 mask)
                         ii = est.i1_pwr;
                         qq = est.q1_pwr;
                 } else {
-                        B43_WARN_ON(1);
                         continue;
                 }
 
@@ -651,7 +654,8 @@ static void b43_nphy_tx_iq_workaround(struct b43_wldev *dev)
 }
 
 /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/clip-detection */
-static void b43_nphy_write_clip_detection(struct b43_wldev *dev, u16 *clip_st)
+static void b43_nphy_write_clip_detection(struct b43_wldev *dev,
+                                          const u16 *clip_st)
 {
         b43_phy_write(dev, B43_NPHY_C1_CLIP1THRES, clip_st[0]);
         b43_phy_write(dev, B43_NPHY_C2_CLIP1THRES, clip_st[1]);
@@ -727,7 +731,7 @@ static void b43_nphy_stay_in_carrier_search(struct b43_wldev *dev, bool enable)
         struct b43_phy_n *nphy = phy->n;
 
         if (enable) {
-                u16 clip[] = { 0xFFFF, 0xFFFF };
+                static const u16 clip[] = { 0xFFFF, 0xFFFF };
                 if (nphy->deaf_count++ == 0) {
                         nphy->classifier_state = b43_nphy_classifier(dev, 0, 0);
                         b43_nphy_classifier(dev, 0x7, 0);
@@ -839,7 +843,7 @@ static void b43_nphy_adjust_lna_gain_table(struct b43_wldev *dev)
         u16 data[4];
         s16 gain[2];
         u16 minmax[2];
-        u16 lna_gain[4] = { -2, 10, 19, 25 };
+        static const u16 lna_gain[4] = { -2, 10, 19, 25 };
 
         if (nphy->hang_avoid)
                 b43_nphy_stay_in_carrier_search(dev, 1);
@@ -871,7 +875,7 @@ static void b43_nphy_adjust_lna_gain_table(struct b43_wldev *dev)
                         data[2] = lna_gain[2] + gain[i];
                         data[3] = lna_gain[3] + gain[i];
                 }
-                b43_ntab_write_bulk(dev, B43_NTAB16(10, 8), 4, data);
+                b43_ntab_write_bulk(dev, B43_NTAB16(i, 8), 4, data);
 
                 minmax[i] = 23 + gain[i];
         }
@@ -891,6 +895,7 @@ static void b43_nphy_gain_ctrl_workarounds(struct b43_wldev *dev)
         struct b43_phy_n *nphy = dev->phy.n;
         u8 i, j;
         u8 code;
+        u16 tmp;
 
         /* TODO: for PHY >= 3
         s8 *lna1_gain, *lna2_gain;
@@ -913,15 +918,15 @@ static void b43_nphy_gain_ctrl_workarounds(struct b43_wldev *dev)
                                 B43_NPHY_C2_CGAINI_CL2DETECT);
 
                 /* Set narrowband clip threshold */
-                b43_phy_set(dev, B43_NPHY_C1_NBCLIPTHRES, 0x84);
-                b43_phy_set(dev, B43_NPHY_C2_NBCLIPTHRES, 0x84);
+                b43_phy_write(dev, B43_NPHY_C1_NBCLIPTHRES, 0x84);
+                b43_phy_write(dev, B43_NPHY_C2_NBCLIPTHRES, 0x84);
 
                 if (!dev->phy.is_40mhz) {
                         /* Set dwell lengths */
-                        b43_phy_set(dev, B43_NPHY_CLIP1_NBDWELL_LEN, 0x002B);
-                        b43_phy_set(dev, B43_NPHY_CLIP2_NBDWELL_LEN, 0x002B);
-                        b43_phy_set(dev, B43_NPHY_W1CLIP1_DWELL_LEN, 0x0009);
-                        b43_phy_set(dev, B43_NPHY_W1CLIP2_DWELL_LEN, 0x0009);
+                        b43_phy_write(dev, B43_NPHY_CLIP1_NBDWELL_LEN, 0x002B);
+                        b43_phy_write(dev, B43_NPHY_CLIP2_NBDWELL_LEN, 0x002B);
+                        b43_phy_write(dev, B43_NPHY_W1CLIP1_DWELL_LEN, 0x0009);
+                        b43_phy_write(dev, B43_NPHY_W1CLIP2_DWELL_LEN, 0x0009);
                 }
 
                 /* Set wideband clip 2 threshold */
@@ -943,7 +948,7 @@ static void b43_nphy_gain_ctrl_workarounds(struct b43_wldev *dev)
                                 ~B43_NPHY_C2_CCK_CGAINI_GAINBKOFF, 0x1);
                 }
 
-                b43_phy_set(dev, B43_NPHY_CCK_SHIFTB_REF, 0x809C);
+                b43_phy_write(dev, B43_NPHY_CCK_SHIFTB_REF, 0x809C);
 
                 if (nphy->gain_boost) {
                         if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ &&
@@ -964,10 +969,10 @@ static void b43_nphy_gain_ctrl_workarounds(struct b43_wldev *dev)
                                 code << B43_NPHY_C2_INITGAIN_HPVGA2_SHIFT);
 
                 b43_phy_write(dev, B43_NPHY_TABLE_ADDR, 0x1D06);
-                b43_phy_write(dev, B43_NPHY_TABLE_DATALO,
-                                        (code << 8 | 0x7C));
-                b43_phy_write(dev, B43_NPHY_TABLE_DATALO,
-                                        (code << 8 | 0x7C));
+                /* specs say about 2 loops, but wl does 4 */
+                for (i = 0; i < 4; i++)
+                        b43_phy_write(dev, B43_NPHY_TABLE_DATALO,
+                                                        (code << 8 | 0x7C));
 
                 b43_nphy_adjust_lna_gain_table(dev);
 
@@ -985,19 +990,21 @@ static void b43_nphy_gain_ctrl_workarounds(struct b43_wldev *dev)
                         b43_phy_write(dev, B43_NPHY_TABLE_DATALO, 0x1);
 
                         b43_phy_write(dev, B43_NPHY_TABLE_ADDR, 0x1D06);
-                        b43_phy_write(dev, B43_NPHY_TABLE_DATALO,
-                                        (code << 8 | 0x74));
-                        b43_phy_write(dev, B43_NPHY_TABLE_DATALO,
-                                        (code << 8 | 0x74));
+                        /* specs say about 2 loops, but wl does 4 */
+                        for (i = 0; i < 4; i++)
+                                b43_phy_write(dev, B43_NPHY_TABLE_DATALO,
+                                                        (code << 8 | 0x74));
                 }
 
                 if (dev->phy.rev == 2) {
                         for (i = 0; i < 4; i++) {
                                 b43_phy_write(dev, B43_NPHY_TABLE_ADDR,
                                                 (0x0400 * i) + 0x0020);
-                                for (j = 0; j < 21; j++)
+                                for (j = 0; j < 21; j++) {
+                                        tmp = j * (i < 2 ? 3 : 1);
                                         b43_phy_write(dev,
-                                                B43_NPHY_TABLE_DATALO, 3 * j);
+                                                B43_NPHY_TABLE_DATALO, tmp);
+                                }
                         }
 
                         b43_nphy_set_rf_sequence(dev, 5,
@@ -1026,7 +1033,7 @@ static void b43_nphy_workarounds(struct b43_wldev *dev)
         u8 events2[7] = { 0x0, 0x3, 0x5, 0x4, 0x2, 0x1, 0x8 };
         u8 delays2[7] = { 0x8, 0x6, 0x2, 0x4, 0x4, 0x6, 0x1 };
 
-        if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ)
+        if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ)
                 b43_nphy_classifier(dev, 1, 0);
         else
                 b43_nphy_classifier(dev, 1, 1);
@@ -1565,19 +1572,20 @@ static void b43_nphy_rf_control_intc_override(struct b43_wldev *dev, u8 field,
         }
 }
 
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/BPHYInit */
 static void b43_nphy_bphy_init(struct b43_wldev *dev)
 {
         unsigned int i;
         u16 val;
 
         val = 0x1E1F;
-        for (i = 0; i < 14; i++) {
+        for (i = 0; i < 16; i++) {
                 b43_phy_write(dev, B43_PHY_N_BMODE(0x88 + i), val);
                 val -= 0x202;
         }
         val = 0x3E3F;
         for (i = 0; i < 16; i++) {
-                b43_phy_write(dev, B43_PHY_N_BMODE(0x97 + i), val);
+                b43_phy_write(dev, B43_PHY_N_BMODE(0x98 + i), val);
                 val -= 0x202;
         }
         b43_phy_write(dev, B43_PHY_N_BMODE(0x38), 0x668);
@@ -1837,6 +1845,14 @@ static int b43_nphy_poll_rssi(struct b43_wldev *dev, u8 type, s32 *buf,
                 save_regs_phy[5] = b43_phy_read(dev, B43_NPHY_AFECTL_OVER);
                 save_regs_phy[6] = b43_phy_read(dev, B43_NPHY_TXF_40CO_B1S0);
                 save_regs_phy[7] = b43_phy_read(dev, B43_NPHY_TXF_40CO_B32S1);
+        } else if (dev->phy.rev == 2) {
+                save_regs_phy[0] = b43_phy_read(dev, B43_NPHY_AFECTL_C1);
+                save_regs_phy[1] = b43_phy_read(dev, B43_NPHY_AFECTL_C2);
+                save_regs_phy[2] = b43_phy_read(dev, B43_NPHY_AFECTL_OVER);
+                save_regs_phy[3] = b43_phy_read(dev, B43_NPHY_RFCTL_CMD);
+                save_regs_phy[4] = b43_phy_read(dev, B43_NPHY_RFCTL_OVER);
+                save_regs_phy[5] = b43_phy_read(dev, B43_NPHY_RFCTL_RSSIO1);
+                save_regs_phy[6] = b43_phy_read(dev, B43_NPHY_RFCTL_RSSIO2);
         }
 
         b43_nphy_rssi_select(dev, 5, type);
@@ -1880,6 +1896,14 @@ static int b43_nphy_poll_rssi(struct b43_wldev *dev, u8 type, s32 *buf,
                 b43_phy_write(dev, B43_NPHY_AFECTL_OVER, save_regs_phy[5]);
                 b43_phy_write(dev, B43_NPHY_TXF_40CO_B1S0, save_regs_phy[6]);
                 b43_phy_write(dev, B43_NPHY_TXF_40CO_B32S1, save_regs_phy[7]);
+        } else if (dev->phy.rev == 2) {
+                b43_phy_write(dev, B43_NPHY_AFECTL_C1, save_regs_phy[0]);
+                b43_phy_write(dev, B43_NPHY_AFECTL_C2, save_regs_phy[1]);
+                b43_phy_write(dev, B43_NPHY_AFECTL_OVER, save_regs_phy[2]);
+                b43_phy_write(dev, B43_NPHY_RFCTL_CMD, save_regs_phy[3]);
+                b43_phy_write(dev, B43_NPHY_RFCTL_OVER, save_regs_phy[4]);
+                b43_phy_write(dev, B43_NPHY_RFCTL_RSSIO1, save_regs_phy[5]);
+                b43_phy_write(dev, B43_NPHY_RFCTL_RSSIO2, save_regs_phy[6]);
         }
 
         return out;
@@ -2004,7 +2028,7 @@ static void b43_nphy_rev2_rssi_cal(struct b43_wldev *dev, u8 type)
         }
 
         b43_radio_maskset(dev, B2055_C1_PD_RSSIMISC, 0xF8, state[0]);
-        b43_radio_maskset(dev, B2055_C1_PD_RSSIMISC, 0xF8, state[1]);
+        b43_radio_maskset(dev, B2055_C2_PD_RSSIMISC, 0xF8, state[1]);
 
         switch (state[2]) {
         case 1:
@@ -2295,7 +2319,7 @@ static void b43_nphy_int_pa_set_tx_dig_filters(struct b43_wldev *dev)
 {
         int i, j;
         /* B43_NPHY_TXF_20CO_S0A1, B43_NPHY_TXF_40CO_S0A1, unknown */
-        u16 offset[] = { 0x186, 0x195, 0x2C5 };
+        static const u16 offset[] = { 0x186, 0x195, 0x2C5 };
 
         for (i = 0; i < 3; i++)
                 for (j = 0; j < 15; j++)
@@ -3088,7 +3112,7 @@ static void b43_nphy_set_rx_core_state(struct b43_wldev *dev, u8 mask)
 {
         struct b43_phy *phy = &dev->phy;
         struct b43_phy_n *nphy = phy->n;
-        u16 buf[16];
+        /* u16 buf[16]; it's rev3+ */
 
         nphy->phyrxchain = mask;
 
@@ -3232,6 +3256,9 @@ int b43_phy_initn(struct b43_wldev *dev)
 
         b43_nphy_classifier(dev, 0, 0);
         b43_nphy_read_clip_detection(dev, clip);
+        if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ)
+                b43_nphy_bphy_init(dev);
+
         tx_pwr_state = nphy->txpwrctrl;
         /* TODO N PHY TX power control with argument 0
                 (turning off power control) */
@@ -3381,7 +3408,6 @@ static int b43_nphy_set_channel(struct b43_wldev *dev,
                                 enum nl80211_channel_type channel_type)
 {
         struct b43_phy *phy = &dev->phy;
-        struct b43_phy_n *nphy = dev->phy.n;
 
         const struct b43_nphy_channeltab_entry_rev2 *tabent_r2;
         const struct b43_nphy_channeltab_entry_rev3 *tabent_r3;
@@ -3451,7 +3477,9 @@ static void b43_nphy_op_prepare_structs(struct b43_wldev *dev)
 
         memset(nphy, 0, sizeof(*nphy));
 
-        //TODO init struct b43_phy_n
+        nphy->gain_boost = true; /* this way we follow wl, assume it is true */
+        nphy->txrx_chain = 2; /* sth different than 0 and 1 for now */
+        nphy->phyrxchain = 3; /* to avoid b43_nphy_set_rx_core_state like wl */
 }
 
 static void b43_nphy_op_free(struct b43_wldev *dev)
@@ -3524,8 +3552,6 @@ static void b43_nphy_op_radio_write(struct b43_wldev *dev, u16 reg, u16 value)
 static void b43_nphy_op_software_rfkill(struct b43_wldev *dev,
                                         bool blocked)
 {
-        struct b43_phy_n *nphy = dev->phy.n;
-
         if (b43_read32(dev, B43_MMIO_MACCTL) & B43_MACCTL_ENABLED)
                 b43err(dev->wl, "MAC not suspended\n");
 
diff --git a/drivers/net/wireless/b43/radio_2055.c b/drivers/net/wireless/b43/radio_2055.c
index 1b5316586cb..10910dc4184 100644
--- a/drivers/net/wireless/b43/radio_2055.c
+++ b/drivers/net/wireless/b43/radio_2055.c
@@ -244,7 +244,7 @@ static const struct b2055_inittab_entry b2055_inittab [] = {
   [0xCB]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
   [0xCC]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
   [B2055_C1_LNA_GAINBST]        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [0xCE]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [0xCE]                        = { .ghz5 = 0x0006, .ghz2 = 0x0006, NOUPLOAD, },
   [0xCF]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
   [0xD0]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
   [0xD1]                        = { .ghz5 = 0x0018, .ghz2 = 0x0018, NOUPLOAD, },
@@ -256,7 +256,7 @@ static const struct b2055_inittab_entry b2055_inittab [] = {
   [0xD7]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
   [0xD8]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
   [B2055_C2_LNA_GAINBST]        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
-  [0xDA]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
+  [0xDA]                        = { .ghz5 = 0x0006, .ghz2 = 0x0006, NOUPLOAD, },
   [0xDB]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
   [0xDC]                        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
   [0xDD]                        = { .ghz5 = 0x0018, .ghz2 = 0x0018, NOUPLOAD, },
@@ -307,7 +307,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x01, 0xEC, 0x0F, 0xFF, 0x01, 0x04, 0x0A,
                   0x00, 0x8F, 0xFF, 0xFF, 0xFF, 0x00, 0x0F, 0x0F,
                   0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
-        PHYREGS(0xB407, 0xB007, 0xAC07, 0x1402, 0x1502, 0x1602),
+        PHYREGS(0x07B4, 0x07B0, 0x07AC, 0x0214, 0x0215, 0x0216),
   },
   {     .channel                = 186,
         .freq                   = 4930, /* MHz */
@@ -315,7 +315,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x01, 0xED, 0x0F, 0xFF, 0x01, 0x04, 0x0A,
                   0x00, 0x8F, 0xFF, 0xFF, 0xFF, 0x00, 0x0F, 0x0F,
                   0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
-        PHYREGS(0xB807, 0xB407, 0xB007, 0x1302, 0x1402, 0x1502),
+        PHYREGS(0x07B8, 0x07B4, 0x07B0, 0x0213, 0x0214, 0x0215),
   },
   {     .channel                = 188,
         .freq                   = 4940, /* MHz */
@@ -323,7 +323,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x01, 0xEE, 0x0F, 0xFF, 0x01, 0x04, 0x0A,
                   0x00, 0x8F, 0xEE, 0xEE, 0xFF, 0x00, 0x0F, 0x0F,
                   0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
-        PHYREGS(0xBC07, 0xB807, 0xB407, 0x1202, 0x1302, 0x1402),
+        PHYREGS(0x07BC, 0x07B8, 0x07B4, 0x0212, 0x0213, 0x0214),
   },
   {     .channel                = 190,
         .freq                   = 4950, /* MHz */
@@ -331,7 +331,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x01, 0xEF, 0x0F, 0xFF, 0x01, 0x04, 0x0A,
                   0x00, 0x8F, 0xEE, 0xEE, 0xFF, 0x00, 0x0F, 0x0F,
                   0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
-        PHYREGS(0xC007, 0xBC07, 0xB807, 0x1102, 0x1202, 0x1302),
+        PHYREGS(0x07C0, 0x07BC, 0x07B8, 0x0211, 0x0212, 0x0213),
   },
   {     .channel                = 192,
         .freq                   = 4960, /* MHz */
@@ -339,7 +339,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x01, 0xF0, 0x0F, 0xFF, 0x01, 0x04, 0x0A,
                   0x00, 0x8F, 0xEE, 0xEE, 0xFF, 0x00, 0x0F, 0x0F,
                   0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
-        PHYREGS(0xC407, 0xC007, 0xBC07, 0x0F02, 0x1102, 0x1202),
+        PHYREGS(0x07C4, 0x07C0, 0x07BC, 0x020F, 0x0211, 0x0212),
   },
   {     .channel                = 194,
         .freq                   = 4970, /* MHz */
@@ -347,7 +347,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x01, 0xF1, 0x0F, 0xFF, 0x01, 0x04, 0x0A,
                   0x00, 0x8F, 0xEE, 0xEE, 0xFF, 0x00, 0x0F, 0x0F,
                   0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
-        PHYREGS(0xC807, 0xC407, 0xC007, 0x0E02, 0x0F02, 0x1102),
+        PHYREGS(0x07C8, 0x07C4, 0x07C0, 0x020E, 0x020F, 0x0211),
   },
   {     .channel                = 196,
         .freq                   = 4980, /* MHz */
@@ -355,7 +355,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x01, 0xF2, 0x0E, 0xFF, 0x01, 0x04, 0x0A,
                   0x00, 0x8F, 0xDD, 0xDD, 0xFF, 0x00, 0x0F, 0x0F,
                   0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
-        PHYREGS(0xCC07, 0xC807, 0xC407, 0x0D02, 0x0E02, 0x0F02),
+        PHYREGS(0x07CC, 0x07C8, 0x07C4, 0x020D, 0x020E, 0x020F),
   },
   {     .channel                = 198,
         .freq                   = 4990, /* MHz */
@@ -363,7 +363,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x01, 0xF3, 0x0E, 0xFF, 0x01, 0x04, 0x0A,
                   0x00, 0x8F, 0xDD, 0xDD, 0xFF, 0x00, 0x0F, 0x0F,
                   0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
-        PHYREGS(0xD007, 0xCC07, 0xC807, 0x0C02, 0x0D02, 0x0E02),
+        PHYREGS(0x07D0, 0x07CC, 0x07C8, 0x020C, 0x020D, 0x020E),
   },
   {     .channel                = 200,
         .freq                   = 5000, /* MHz */
@@ -371,7 +371,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x01, 0xF4, 0x0E, 0xFF, 0x01, 0x04, 0x0A,
                   0x00, 0x8F, 0xDD, 0xDD, 0xFF, 0x00, 0x0F, 0x0F,
                   0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
-        PHYREGS(0xD407, 0xD007, 0xCC07, 0x0B02, 0x0C02, 0x0D02),
+        PHYREGS(0x07D4, 0x07D0, 0x07CC, 0x020B, 0x020C, 0x020D),
   },
   {     .channel                = 202,
         .freq                   = 5010, /* MHz */
@@ -379,7 +379,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x01, 0xF5, 0x0E, 0xFF, 0x01, 0x04, 0x0A,
                   0x00, 0x8F, 0xDD, 0xDD, 0xFF, 0x00, 0x0F, 0x0F,
                   0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
-        PHYREGS(0xD807, 0xD407, 0xD007, 0x0A02, 0x0B02, 0x0C02),
+        PHYREGS(0x07D8, 0x07D4, 0x07D0, 0x020A, 0x020B, 0x020C),
   },
   {     .channel                = 204,
         .freq                   = 5020, /* MHz */
@@ -387,7 +387,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x01, 0xF6, 0x0E, 0xF7, 0x01, 0x04, 0x0A,
                   0x00, 0x8F, 0xCC, 0xCC, 0xFF, 0x00, 0x0F, 0x0F,
                   0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
-        PHYREGS(0xDC07, 0xD807, 0xD407, 0x0902, 0x0A02, 0x0B02),
+        PHYREGS(0x07DC, 0x07D8, 0x07D4, 0x0209, 0x020A, 0x020B),
   },
   {     .channel                = 206,
         .freq                   = 5030, /* MHz */
@@ -395,7 +395,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x01, 0xF7, 0x0E, 0xF7, 0x01, 0x04, 0x0A,
                   0x00, 0x8F, 0xCC, 0xCC, 0xFF, 0x00, 0x0F, 0x0F,
                   0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
-        PHYREGS(0xE007, 0xDC07, 0xD807, 0x0802, 0x0902, 0x0A02),
+        PHYREGS(0x07E0, 0x07DC, 0x07D8, 0x0208, 0x0209, 0x020A),
   },
   {     .channel                = 208,
         .freq                   = 5040, /* MHz */
@@ -403,7 +403,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x01, 0xF8, 0x0D, 0xEF, 0x01, 0x04, 0x0A,
                   0x00, 0x8F, 0xCC, 0xCC, 0xFF, 0x00, 0x0F, 0x0F,
                   0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
-        PHYREGS(0xE407, 0xE007, 0xDC07, 0x0702, 0x0802, 0x0902),
+        PHYREGS(0x07E4, 0x07E0, 0x07DC, 0x0207, 0x0208, 0x0209),
   },
   {     .channel                = 210,
         .freq                   = 5050, /* MHz */
@@ -411,7 +411,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x01, 0xF9, 0x0D, 0xEF, 0x01, 0x04, 0x0A,
                   0x00, 0x8F, 0xCC, 0xCC, 0xFF, 0x00, 0x0F, 0x0F,
                   0x8F, 0xFF, 0x00, 0x0F, 0x0F, 0x8F),
-        PHYREGS(0xE807, 0xE407, 0xE007, 0x0602, 0x0702, 0x0802),
+        PHYREGS(0x07E8, 0x07E4, 0x07E0, 0x0206, 0x0207, 0x0208),
   },
   {     .channel                = 212,
         .freq                   = 5060, /* MHz */
@@ -419,7 +419,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x01, 0xFA, 0x0D, 0xE6, 0x01, 0x04, 0x0A,
                   0x00, 0x8F, 0xBB, 0xBB, 0xFF, 0x00, 0x0E, 0x0F,
                   0x8E, 0xFF, 0x00, 0x0E, 0x0F, 0x8E),
-        PHYREGS(0xEC07, 0xE807, 0xE407, 0x0502, 0x0602, 0x0702),
+        PHYREGS(0x07EC, 0x07E8, 0x07E4, 0x0205, 0x0206, 0x0207),
   },
   {     .channel                = 214,
         .freq                   = 5070, /* MHz */
@@ -427,7 +427,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x01, 0xFB, 0x0D, 0xE6, 0x01, 0x04, 0x0A,
                   0x00, 0x8F, 0xBB, 0xBB, 0xFF, 0x00, 0x0E, 0x0F,
                   0x8E, 0xFF, 0x00, 0x0E, 0x0F, 0x8E),
-        PHYREGS(0xF007, 0xEC07, 0xE807, 0x0402, 0x0502, 0x0602),
+        PHYREGS(0x07F0, 0x07EC, 0x07E8, 0x0204, 0x0205, 0x0206),
   },
   {     .channel                = 216,
         .freq                   = 5080, /* MHz */
@@ -435,7 +435,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x01, 0xFC, 0x0D, 0xDE, 0x01, 0x04, 0x0A,
                   0x00, 0x8E, 0xBB, 0xBB, 0xEE, 0x00, 0x0E, 0x0F,
                   0x8D, 0xEE, 0x00, 0x0E, 0x0F, 0x8D),
-        PHYREGS(0xF407, 0xF007, 0xEC07, 0x0302, 0x0402, 0x0502),
+        PHYREGS(0x07F4, 0x07F0, 0x07EC, 0x0203, 0x0204, 0x0205),
   },
   {     .channel                = 218,
         .freq                   = 5090, /* MHz */
@@ -443,7 +443,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x01, 0xFD, 0x0D, 0xDE, 0x01, 0x04, 0x0A,
                   0x00, 0x8E, 0xBB, 0xBB, 0xEE, 0x00, 0x0E, 0x0F,
                   0x8D, 0xEE, 0x00, 0x0E, 0x0F, 0x8D),
-        PHYREGS(0xF807, 0xF407, 0xF007, 0x0202, 0x0302, 0x0402),
+        PHYREGS(0x07F8, 0x07F4, 0x07F0, 0x0202, 0x0203, 0x0204),
   },
   {     .channel                = 220,
         .freq                   = 5100, /* MHz */
@@ -451,7 +451,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x01, 0xFE, 0x0C, 0xD6, 0x01, 0x04, 0x0A,
                   0x00, 0x8E, 0xAA, 0xAA, 0xEE, 0x00, 0x0D, 0x0F,
                   0x8D, 0xEE, 0x00, 0x0D, 0x0F, 0x8D),
-        PHYREGS(0xFC07, 0xF807, 0xF407, 0x0102, 0x0202, 0x0302),
+        PHYREGS(0x07FC, 0x07F8, 0x07F4, 0x0201, 0x0202, 0x0203),
   },
   {     .channel                = 222,
         .freq                   = 5110, /* MHz */
@@ -459,7 +459,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x01, 0xFF, 0x0C, 0xD6, 0x01, 0x04, 0x0A,
                   0x00, 0x8E, 0xAA, 0xAA, 0xEE, 0x00, 0x0D, 0x0F,
                   0x8D, 0xEE, 0x00, 0x0D, 0x0F, 0x8D),
-        PHYREGS(0x0008, 0xFC07, 0xF807, 0x0002, 0x0102, 0x0202),
+        PHYREGS(0x0800, 0x07FC, 0x07F8, 0x0200, 0x0201, 0x0202),
   },
   {     .channel                = 224,
         .freq                   = 5120, /* MHz */
@@ -467,7 +467,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x00, 0x0C, 0xCE, 0x01, 0x04, 0x0A,
                   0x00, 0x8D, 0xAA, 0xAA, 0xDD, 0x00, 0x0D, 0x0F,
                   0x8C, 0xDD, 0x00, 0x0D, 0x0F, 0x8C),
-        PHYREGS(0x0408, 0x0008, 0xFC07, 0xFF01, 0x0002, 0x0102),
+        PHYREGS(0x0804, 0x0800, 0x07FC, 0x01FF, 0x0200, 0x0201),
   },
   {     .channel                = 226,
         .freq                   = 5130, /* MHz */
@@ -475,7 +475,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x01, 0x0C, 0xCE, 0x01, 0x04, 0x0A,
                   0x00, 0x8D, 0xAA, 0xAA, 0xDD, 0x00, 0x0D, 0x0F,
                   0x8C, 0xDD, 0x00, 0x0D, 0x0F, 0x8C),
-        PHYREGS(0x0808, 0x0408, 0x0008, 0xFE01, 0xFF01, 0x0002),
+        PHYREGS(0x0808, 0x0804, 0x0800, 0x01FE, 0x01FF, 0x0200),
   },
   {     .channel                = 228,
         .freq                   = 5140, /* MHz */
@@ -483,7 +483,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x02, 0x0C, 0xC6, 0x01, 0x04, 0x0A,
                   0x00, 0x8D, 0x99, 0x99, 0xDD, 0x00, 0x0C, 0x0E,
                   0x8B, 0xDD, 0x00, 0x0C, 0x0E, 0x8B),
-        PHYREGS(0x0C08, 0x0808, 0x0408, 0xFD01, 0xFE01, 0xFF01),
+        PHYREGS(0x080C, 0x0808, 0x0804, 0x01FD, 0x01FE, 0x01FF),
   },
   {     .channel                = 32,
         .freq                   = 5160, /* MHz */
@@ -491,7 +491,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x04, 0x0B, 0xBE, 0x01, 0x04, 0x0A,
                   0x00, 0x8C, 0x99, 0x99, 0xCC, 0x00, 0x0B, 0x0D,
                   0x8A, 0xCC, 0x00, 0x0B, 0x0D, 0x8A),
-        PHYREGS(0x1408, 0x1008, 0x0C08, 0xFB01, 0xFC01, 0xFD01),
+        PHYREGS(0x0814, 0x0810, 0x080C, 0x01FB, 0x01FC, 0x01FD),
   },
   {     .channel                = 34,
         .freq                   = 5170, /* MHz */
@@ -499,7 +499,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x05, 0x0B, 0xBE, 0x01, 0x04, 0x0A,
                   0x00, 0x8C, 0x99, 0x99, 0xCC, 0x00, 0x0B, 0x0D,
                   0x8A, 0xCC, 0x00, 0x0B, 0x0D, 0x8A),
-        PHYREGS(0x1808, 0x1408, 0x1008, 0xFA01, 0xFB01, 0xFC01),
+        PHYREGS(0x0818, 0x0814, 0x0810, 0x01FA, 0x01FB, 0x01FC),
   },
   {     .channel                = 36,
         .freq                   = 5180, /* MHz */
@@ -507,7 +507,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x06, 0x0B, 0xB6, 0x01, 0x04, 0x0A,
                   0x00, 0x8C, 0x88, 0x88, 0xCC, 0x00, 0x0B, 0x0C,
                   0x89, 0xCC, 0x00, 0x0B, 0x0C, 0x89),
-        PHYREGS(0x1C08, 0x1808, 0x1408, 0xF901, 0xFA01, 0xFB01),
+        PHYREGS(0x081C, 0x0818, 0x0814, 0x01F9, 0x01FA, 0x01FB),
   },
   {     .channel                = 38,
         .freq                   = 5190, /* MHz */
@@ -515,7 +515,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x07, 0x0B, 0xB6, 0x01, 0x04, 0x0A,
                   0x00, 0x8C, 0x88, 0x88, 0xCC, 0x00, 0x0B, 0x0C,
                   0x89, 0xCC, 0x00, 0x0B, 0x0C, 0x89),
-        PHYREGS(0x2008, 0x1C08, 0x1808, 0xF801, 0xF901, 0xFA01),
+        PHYREGS(0x0820, 0x081C, 0x0818, 0x01F8, 0x01F9, 0x01FA),
   },
   {     .channel                = 40,
         .freq                   = 5200, /* MHz */
@@ -523,7 +523,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x08, 0x0B, 0xAF, 0x01, 0x04, 0x0A,
                   0x00, 0x8B, 0x88, 0x88, 0xBB, 0x00, 0x0A, 0x0B,
                   0x89, 0xBB, 0x00, 0x0A, 0x0B, 0x89),
-        PHYREGS(0x2408, 0x2008, 0x1C08, 0xF701, 0xF801, 0xF901),
+        PHYREGS(0x0824, 0x0820, 0x081C, 0x01F7, 0x01F8, 0x01F9),
   },
   {     .channel                = 42,
         .freq                   = 5210, /* MHz */
@@ -531,7 +531,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x09, 0x0B, 0xAF, 0x01, 0x04, 0x0A,
                   0x00, 0x8B, 0x88, 0x88, 0xBB, 0x00, 0x0A, 0x0B,
                   0x89, 0xBB, 0x00, 0x0A, 0x0B, 0x89),
-        PHYREGS(0x2808, 0x2408, 0x2008, 0xF601, 0xF701, 0xF801),
+        PHYREGS(0x0828, 0x0824, 0x0820, 0x01F6, 0x01F7, 0x01F8),
   },
   {     .channel                = 44,
         .freq                   = 5220, /* MHz */
@@ -539,7 +539,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x0A, 0x0A, 0xA7, 0x01, 0x04, 0x0A,
                   0x00, 0x8B, 0x77, 0x77, 0xBB, 0x00, 0x09, 0x0A,
                   0x88, 0xBB, 0x00, 0x09, 0x0A, 0x88),
-        PHYREGS(0x2C08, 0x2808, 0x2408, 0xF501, 0xF601, 0xF701),
+        PHYREGS(0x082C, 0x0828, 0x0824, 0x01F5, 0x01F6, 0x01F7),
   },
   {     .channel                = 46,
         .freq                   = 5230, /* MHz */
@@ -547,7 +547,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x0B, 0x0A, 0xA7, 0x01, 0x04, 0x0A,
                   0x00, 0x8B, 0x77, 0x77, 0xBB, 0x00, 0x09, 0x0A,
                   0x88, 0xBB, 0x00, 0x09, 0x0A, 0x88),
-        PHYREGS(0x3008, 0x2C08, 0x2808, 0xF401, 0xF501, 0xF601),
+        PHYREGS(0x0830, 0x082C, 0x0828, 0x01F4, 0x01F5, 0x01F6),
   },
   {     .channel                = 48,
         .freq                   = 5240, /* MHz */
@@ -555,7 +555,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x0C, 0x0A, 0xA0, 0x01, 0x04, 0x0A,
                   0x00, 0x8A, 0x77, 0x77, 0xAA, 0x00, 0x09, 0x0A,
                   0x87, 0xAA, 0x00, 0x09, 0x0A, 0x87),
-        PHYREGS(0x3408, 0x3008, 0x2C08, 0xF301, 0xF401, 0xF501),
+        PHYREGS(0x0834, 0x0830, 0x082C, 0x01F3, 0x01F4, 0x01F5),
   },
   {     .channel                = 50,
         .freq                   = 5250, /* MHz */
@@ -563,7 +563,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x0D, 0x0A, 0xA0, 0x01, 0x04, 0x0A,
                   0x00, 0x8A, 0x77, 0x77, 0xAA, 0x00, 0x09, 0x0A,
                   0x87, 0xAA, 0x00, 0x09, 0x0A, 0x87),
-        PHYREGS(0x3808, 0x3408, 0x3008, 0xF201, 0xF301, 0xF401),
+        PHYREGS(0x0838, 0x0834, 0x0830, 0x01F2, 0x01F3, 0x01F4),
   },
   {     .channel                = 52,
         .freq                   = 5260, /* MHz */
@@ -571,7 +571,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x0E, 0x0A, 0x98, 0x01, 0x04, 0x0A,
                   0x00, 0x8A, 0x66, 0x66, 0xAA, 0x00, 0x08, 0x09,
                   0x87, 0xAA, 0x00, 0x08, 0x09, 0x87),
-        PHYREGS(0x3C08, 0x3808, 0x3408, 0xF101, 0xF201, 0xF301),
+        PHYREGS(0x083C, 0x0838, 0x0834, 0x01F1, 0x01F2, 0x01F3),
   },
   {     .channel                = 54,
         .freq                   = 5270, /* MHz */
@@ -579,7 +579,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x0F, 0x0A, 0x98, 0x01, 0x04, 0x0A,
                   0x00, 0x8A, 0x66, 0x66, 0xAA, 0x00, 0x08, 0x09,
                   0x87, 0xAA, 0x00, 0x08, 0x09, 0x87),
-        PHYREGS(0x4008, 0x3C08, 0x3808, 0xF001, 0xF101, 0xF201),
+        PHYREGS(0x0840, 0x083C, 0x0838, 0x01F0, 0x01F1, 0x01F2),
   },
   {     .channel                = 56,
         .freq                   = 5280, /* MHz */
@@ -587,7 +587,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x10, 0x09, 0x91, 0x01, 0x04, 0x0A,
                   0x00, 0x89, 0x66, 0x66, 0x99, 0x00, 0x08, 0x08,
                   0x86, 0x99, 0x00, 0x08, 0x08, 0x86),
-        PHYREGS(0x4408, 0x4008, 0x3C08, 0xF001, 0xF001, 0xF101),
+        PHYREGS(0x0844, 0x0840, 0x083C, 0x01F0, 0x01F0, 0x01F1),
   },
   {     .channel                = 58,
         .freq                   = 5290, /* MHz */
@@ -595,7 +595,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x11, 0x09, 0x91, 0x01, 0x04, 0x0A,
                   0x00, 0x89, 0x66, 0x66, 0x99, 0x00, 0x08, 0x08,
                   0x86, 0x99, 0x00, 0x08, 0x08, 0x86),
-        PHYREGS(0x4808, 0x4408, 0x4008, 0xEF01, 0xF001, 0xF001),
+        PHYREGS(0x0848, 0x0844, 0x0840, 0x01EF, 0x01F0, 0x01F0),
   },
   {     .channel                = 60,
         .freq                   = 5300, /* MHz */
@@ -603,7 +603,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x12, 0x09, 0x8A, 0x01, 0x04, 0x0A,
                   0x00, 0x89, 0x55, 0x55, 0x99, 0x00, 0x08, 0x07,
                   0x85, 0x99, 0x00, 0x08, 0x07, 0x85),
-        PHYREGS(0x4C08, 0x4808, 0x4408, 0xEE01, 0xEF01, 0xF001),
+        PHYREGS(0x084C, 0x0848, 0x0844, 0x01EE, 0x01EF, 0x01F0),
   },
   {     .channel                = 62,
         .freq                   = 5310, /* MHz */
@@ -611,7 +611,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x13, 0x09, 0x8A, 0x01, 0x04, 0x0A,
                   0x00, 0x89, 0x55, 0x55, 0x99, 0x00, 0x08, 0x07,
                   0x85, 0x99, 0x00, 0x08, 0x07, 0x85),
-        PHYREGS(0x5008, 0x4C08, 0x4808, 0xED01, 0xEE01, 0xEF01),
+        PHYREGS(0x0850, 0x084C, 0x0848, 0x01ED, 0x01EE, 0x01EF),
   },
   {     .channel                = 64,
         .freq                   = 5320, /* MHz */
@@ -619,7 +619,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x14, 0x09, 0x83, 0x01, 0x04, 0x0A,
                   0x00, 0x88, 0x55, 0x55, 0x88, 0x00, 0x07, 0x07,
                   0x84, 0x88, 0x00, 0x07, 0x07, 0x84),
-        PHYREGS(0x5408, 0x5008, 0x4C08, 0xEC01, 0xED01, 0xEE01),
+        PHYREGS(0x0854, 0x0850, 0x084C, 0x01EC, 0x01ED, 0x01EE),
   },
   {     .channel                = 66,
         .freq                   = 5330, /* MHz */
@@ -627,7 +627,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x15, 0x09, 0x83, 0x01, 0x04, 0x0A,
                   0x00, 0x88, 0x55, 0x55, 0x88, 0x00, 0x07, 0x07,
                   0x84, 0x88, 0x00, 0x07, 0x07, 0x84),
-        PHYREGS(0x5808, 0x5408, 0x5008, 0xEB01, 0xEC01, 0xED01),
+        PHYREGS(0x0858, 0x0854, 0x0850, 0x01EB, 0x01EC, 0x01ED),
   },
   {     .channel                = 68,
         .freq                   = 5340, /* MHz */
@@ -635,7 +635,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x16, 0x08, 0x7C, 0x01, 0x04, 0x0A,
                   0x00, 0x88, 0x44, 0x44, 0x88, 0x00, 0x07, 0x06,
                   0x84, 0x88, 0x00, 0x07, 0x06, 0x84),
-        PHYREGS(0x5C08, 0x5808, 0x5408, 0xEA01, 0xEB01, 0xEC01),
+        PHYREGS(0x085C, 0x0858, 0x0854, 0x01EA, 0x01EB, 0x01EC),
   },
   {     .channel                = 70,
         .freq                   = 5350, /* MHz */
@@ -643,7 +643,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x17, 0x08, 0x7C, 0x01, 0x04, 0x0A,
                   0x00, 0x88, 0x44, 0x44, 0x88, 0x00, 0x07, 0x06,
                   0x84, 0x88, 0x00, 0x07, 0x06, 0x84),
-        PHYREGS(0x6008, 0x5C08, 0x5808, 0xE901, 0xEA01, 0xEB01),
+        PHYREGS(0x0860, 0x085C, 0x0858, 0x01E9, 0x01EA, 0x01EB),
   },
   {     .channel                = 72,
         .freq                   = 5360, /* MHz */
@@ -651,7 +651,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x18, 0x08, 0x75, 0x01, 0x04, 0x0A,
                   0x00, 0x87, 0x44, 0x44, 0x77, 0x00, 0x06, 0x05,
                   0x83, 0x77, 0x00, 0x06, 0x05, 0x83),
-        PHYREGS(0x6408, 0x6008, 0x5C08, 0xE801, 0xE901, 0xEA01),
+        PHYREGS(0x0864, 0x0860, 0x085C, 0x01E8, 0x01E9, 0x01EA),
   },
   {     .channel                = 74,
         .freq                   = 5370, /* MHz */
@@ -659,7 +659,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x19, 0x08, 0x75, 0x01, 0x04, 0x0A,
                   0x00, 0x87, 0x44, 0x44, 0x77, 0x00, 0x06, 0x05,
                   0x83, 0x77, 0x00, 0x06, 0x05, 0x83),
-        PHYREGS(0x6808, 0x6408, 0x6008, 0xE701, 0xE801, 0xE901),
+        PHYREGS(0x0868, 0x0864, 0x0860, 0x01E7, 0x01E8, 0x01E9),
   },
   {     .channel                = 76,
         .freq                   = 5380, /* MHz */
@@ -667,7 +667,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x1A, 0x08, 0x6E, 0x01, 0x04, 0x0A,
                   0x00, 0x87, 0x33, 0x33, 0x77, 0x00, 0x06, 0x04,
                   0x82, 0x77, 0x00, 0x06, 0x04, 0x82),
-        PHYREGS(0x6C08, 0x6808, 0x6408, 0xE601, 0xE701, 0xE801),
+        PHYREGS(0x086C, 0x0868, 0x0864, 0x01E6, 0x01E7, 0x01E8),
   },
   {     .channel                = 78,
         .freq                   = 5390, /* MHz */
@@ -675,7 +675,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x1B, 0x08, 0x6E, 0x01, 0x04, 0x0A,
                   0x00, 0x87, 0x33, 0x33, 0x77, 0x00, 0x06, 0x04,
                   0x82, 0x77, 0x00, 0x06, 0x04, 0x82),
-        PHYREGS(0x7008, 0x6C08, 0x6808, 0xE501, 0xE601, 0xE701),
+        PHYREGS(0x0870, 0x086C, 0x0868, 0x01E5, 0x01E6, 0x01E7),
   },
   {     .channel                = 80,
         .freq                   = 5400, /* MHz */
@@ -683,7 +683,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x1C, 0x07, 0x67, 0x01, 0x04, 0x0A,
                   0x00, 0x86, 0x33, 0x33, 0x66, 0x00, 0x05, 0x04,
                   0x81, 0x66, 0x00, 0x05, 0x04, 0x81),
-        PHYREGS(0x7408, 0x7008, 0x6C08, 0xE501, 0xE501, 0xE601),
+        PHYREGS(0x0874, 0x0870, 0x086C, 0x01E5, 0x01E5, 0x01E6),
   },
   {     .channel                = 82,
         .freq                   = 5410, /* MHz */
@@ -691,7 +691,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x1D, 0x07, 0x67, 0x01, 0x04, 0x0A,
                   0x00, 0x86, 0x33, 0x33, 0x66, 0x00, 0x05, 0x04,
                   0x81, 0x66, 0x00, 0x05, 0x04, 0x81),
-        PHYREGS(0x7808, 0x7408, 0x7008, 0xE401, 0xE501, 0xE501),
+        PHYREGS(0x0878, 0x0874, 0x0870, 0x01E4, 0x01E5, 0x01E5),
   },
   {     .channel                = 84,
         .freq                   = 5420, /* MHz */
@@ -699,7 +699,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x1E, 0x07, 0x61, 0x01, 0x04, 0x0A,
                   0x00, 0x86, 0x22, 0x22, 0x66, 0x00, 0x05, 0x03,
                   0x80, 0x66, 0x00, 0x05, 0x03, 0x80),
-        PHYREGS(0x7C08, 0x7808, 0x7408, 0xE301, 0xE401, 0xE501),
+        PHYREGS(0x087C, 0x0878, 0x0874, 0x01E3, 0x01E4, 0x01E5),
   },
   {     .channel                = 86,
         .freq                   = 5430, /* MHz */
@@ -707,7 +707,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x1F, 0x07, 0x61, 0x01, 0x04, 0x0A,
                   0x00, 0x86, 0x22, 0x22, 0x66, 0x00, 0x05, 0x03,
                   0x80, 0x66, 0x00, 0x05, 0x03, 0x80),
-        PHYREGS(0x8008, 0x7C08, 0x7808, 0xE201, 0xE301, 0xE401),
+        PHYREGS(0x0880, 0x087C, 0x0878, 0x01E2, 0x01E3, 0x01E4),
   },
   {     .channel                = 88,
         .freq                   = 5440, /* MHz */
@@ -715,7 +715,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x20, 0x07, 0x5A, 0x01, 0x04, 0x0A,
                   0x00, 0x85, 0x22, 0x22, 0x55, 0x00, 0x04, 0x02,
                   0x80, 0x55, 0x00, 0x04, 0x02, 0x80),
-        PHYREGS(0x8408, 0x8008, 0x7C08, 0xE101, 0xE201, 0xE301),
+        PHYREGS(0x0884, 0x0880, 0x087C, 0x01E1, 0x01E2, 0x01E3),
   },
   {     .channel                = 90,
         .freq                   = 5450, /* MHz */
@@ -723,7 +723,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x21, 0x07, 0x5A, 0x01, 0x04, 0x0A,
                   0x00, 0x85, 0x22, 0x22, 0x55, 0x00, 0x04, 0x02,
                   0x80, 0x55, 0x00, 0x04, 0x02, 0x80),
-        PHYREGS(0x8808, 0x8408, 0x8008, 0xE001, 0xE101, 0xE201),
+        PHYREGS(0x0888, 0x0884, 0x0880, 0x01E0, 0x01E1, 0x01E2),
   },
   {     .channel                = 92,
         .freq                   = 5460, /* MHz */
@@ -731,7 +731,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x22, 0x06, 0x53, 0x01, 0x04, 0x0A,
                   0x00, 0x85, 0x11, 0x11, 0x55, 0x00, 0x04, 0x01,
                   0x80, 0x55, 0x00, 0x04, 0x01, 0x80),
-        PHYREGS(0x8C08, 0x8808, 0x8408, 0xDF01, 0xE001, 0xE101),
+        PHYREGS(0x088C, 0x0888, 0x0884, 0x01DF, 0x01E0, 0x01E1),
   },
   {     .channel                = 94,
         .freq                   = 5470, /* MHz */
@@ -739,7 +739,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x23, 0x06, 0x53, 0x01, 0x04, 0x0A,
                   0x00, 0x85, 0x11, 0x11, 0x55, 0x00, 0x04, 0x01,
                   0x80, 0x55, 0x00, 0x04, 0x01, 0x80),
-        PHYREGS(0x9008, 0x8C08, 0x8808, 0xDE01, 0xDF01, 0xE001),
+        PHYREGS(0x0890, 0x088C, 0x0888, 0x01DE, 0x01DF, 0x01E0),
   },
   {     .channel                = 96,
         .freq                   = 5480, /* MHz */
@@ -747,7 +747,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x24, 0x06, 0x4D, 0x01, 0x04, 0x0A,
                   0x00, 0x84, 0x11, 0x11, 0x44, 0x00, 0x03, 0x00,
                   0x80, 0x44, 0x00, 0x03, 0x00, 0x80),
-        PHYREGS(0x9408, 0x9008, 0x8C08, 0xDD01, 0xDE01, 0xDF01),
+        PHYREGS(0x0894, 0x0890, 0x088C, 0x01DD, 0x01DE, 0x01DF),
   },
   {     .channel                = 98,
         .freq                   = 5490, /* MHz */
@@ -755,7 +755,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x25, 0x06, 0x4D, 0x01, 0x04, 0x0A,
                   0x00, 0x84, 0x11, 0x11, 0x44, 0x00, 0x03, 0x00,
                   0x80, 0x44, 0x00, 0x03, 0x00, 0x80),
-        PHYREGS(0x9808, 0x9408, 0x9008, 0xDD01, 0xDD01, 0xDE01),
+        PHYREGS(0x0898, 0x0894, 0x0890, 0x01DD, 0x01DD, 0x01DE),
   },
   {     .channel                = 100,
         .freq                   = 5500, /* MHz */
@@ -763,7 +763,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x26, 0x06, 0x47, 0x01, 0x04, 0x0A,
                   0x00, 0x84, 0x00, 0x00, 0x44, 0x00, 0x03, 0x00,
                   0x80, 0x44, 0x00, 0x03, 0x00, 0x80),
-        PHYREGS(0x9C08, 0x9808, 0x9408, 0xDC01, 0xDD01, 0xDD01),
+        PHYREGS(0x089C, 0x0898, 0x0894, 0x01DC, 0x01DD, 0x01DD),
   },
   {     .channel                = 102,
         .freq                   = 5510, /* MHz */
@@ -771,7 +771,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x27, 0x06, 0x47, 0x01, 0x04, 0x0A,
                   0x00, 0x84, 0x00, 0x00, 0x44, 0x00, 0x03, 0x00,
                   0x80, 0x44, 0x00, 0x03, 0x00, 0x80),
-        PHYREGS(0xA008, 0x9C08, 0x9808, 0xDB01, 0xDC01, 0xDD01),
+        PHYREGS(0x08A0, 0x089C, 0x0898, 0x01DB, 0x01DC, 0x01DD),
   },
   {     .channel                = 104,
         .freq                   = 5520, /* MHz */
@@ -779,7 +779,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x28, 0x05, 0x40, 0x01, 0x04, 0x0A,
                   0x00, 0x83, 0x00, 0x00, 0x33, 0x00, 0x02, 0x00,
                   0x80, 0x33, 0x00, 0x02, 0x00, 0x80),
-        PHYREGS(0xA408, 0xA008, 0x9C08, 0xDA01, 0xDB01, 0xDC01),
+        PHYREGS(0x08A4, 0x08A0, 0x089C, 0x01DA, 0x01DB, 0x01DC),
   },
   {     .channel                = 106,
         .freq                   = 5530, /* MHz */
@@ -787,7 +787,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x29, 0x05, 0x40, 0x01, 0x04, 0x0A,
                   0x00, 0x83, 0x00, 0x00, 0x33, 0x00, 0x02, 0x00,
                   0x80, 0x33, 0x00, 0x02, 0x00, 0x80),
-        PHYREGS(0xA808, 0xA408, 0xA008, 0xD901, 0xDA01, 0xDB01),
+        PHYREGS(0x08A8, 0x08A4, 0x08A0, 0x01D9, 0x01DA, 0x01DB),
   },
   {     .channel                = 108,
         .freq                   = 5540, /* MHz */
@@ -795,7 +795,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x2A, 0x05, 0x3A, 0x01, 0x04, 0x0A,
                   0x00, 0x83, 0x00, 0x00, 0x33, 0x00, 0x02, 0x00,
                   0x80, 0x33, 0x00, 0x02, 0x00, 0x80),
-        PHYREGS(0xAC08, 0xA808, 0xA408, 0xD801, 0xD901, 0xDA01),
+        PHYREGS(0x08AC, 0x08A8, 0x08A4, 0x01D8, 0x01D9, 0x01DA),
   },
   {     .channel                = 110,
         .freq                   = 5550, /* MHz */
@@ -803,7 +803,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x2B, 0x05, 0x3A, 0x01, 0x04, 0x0A,
                   0x00, 0x83, 0x00, 0x00, 0x33, 0x00, 0x02, 0x00,
                   0x80, 0x33, 0x00, 0x02, 0x00, 0x80),
-        PHYREGS(0xB008, 0xAC08, 0xA808, 0xD701, 0xD801, 0xD901),
+        PHYREGS(0x08B0, 0x08AC, 0x08A8, 0x01D7, 0x01D8, 0x01D9),
   },
   {     .channel                = 112,
         .freq                   = 5560, /* MHz */
@@ -811,7 +811,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x2C, 0x05, 0x34, 0x01, 0x04, 0x0A,
                   0x00, 0x82, 0x00, 0x00, 0x22, 0x00, 0x01, 0x00,
                   0x80, 0x22, 0x00, 0x01, 0x00, 0x80),
-        PHYREGS(0xB408, 0xB008, 0xAC08, 0xD701, 0xD701, 0xD801),
+        PHYREGS(0x08B4, 0x08B0, 0x08AC, 0x01D7, 0x01D7, 0x01D8),
   },
   {     .channel                = 114,
         .freq                   = 5570, /* MHz */
@@ -819,7 +819,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x2D, 0x05, 0x34, 0x01, 0x04, 0x0A,
                   0x00, 0x82, 0x00, 0x00, 0x22, 0x00, 0x01, 0x00,
                   0x80, 0x22, 0x00, 0x01, 0x00, 0x80),
-        PHYREGS(0xB808, 0xB408, 0xB008, 0xD601, 0xD701, 0xD701),
+        PHYREGS(0x08B8, 0x08B4, 0x08B0, 0x01D6, 0x01D7, 0x01D7),
   },
   {     .channel                = 116,
         .freq                   = 5580, /* MHz */
@@ -827,7 +827,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x2E, 0x04, 0x2E, 0x01, 0x04, 0x0A,
                   0x00, 0x82, 0x00, 0x00, 0x22, 0x00, 0x01, 0x00,
                   0x80, 0x22, 0x00, 0x01, 0x00, 0x80),
-        PHYREGS(0xBC08, 0xB808, 0xB408, 0xD501, 0xD601, 0xD701),
+        PHYREGS(0x08BC, 0x08B8, 0x08B4, 0x01D5, 0x01D6, 0x01D7),
   },
   {     .channel                = 118,
         .freq                   = 5590, /* MHz */
@@ -835,7 +835,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x2F, 0x04, 0x2E, 0x01, 0x04, 0x0A,
                   0x00, 0x82, 0x00, 0x00, 0x22, 0x00, 0x01, 0x00,
                   0x80, 0x22, 0x00, 0x01, 0x00, 0x80),
-        PHYREGS(0xC008, 0xBC08, 0xB808, 0xD401, 0xD501, 0xD601),
+        PHYREGS(0x08C0, 0x08BC, 0x08B8, 0x01D4, 0x01D5, 0x01D6),
   },
   {     .channel                = 120,
         .freq                   = 5600, /* MHz */
@@ -843,7 +843,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x30, 0x04, 0x28, 0x01, 0x04, 0x0A,
                   0x00, 0x81, 0x00, 0x00, 0x11, 0x00, 0x01, 0x00,
                   0x80, 0x11, 0x00, 0x01, 0x00, 0x80),
-        PHYREGS(0xC408, 0xC008, 0xBC08, 0xD301, 0xD401, 0xD501),
+        PHYREGS(0x08C4, 0x08C0, 0x08BC, 0x01D3, 0x01D4, 0x01D5),
   },
   {     .channel                = 122,
         .freq                   = 5610, /* MHz */
@@ -851,7 +851,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x31, 0x04, 0x28, 0x01, 0x04, 0x0A,
                   0x00, 0x81, 0x00, 0x00, 0x11, 0x00, 0x01, 0x00,
                   0x80, 0x11, 0x00, 0x01, 0x00, 0x80),
-        PHYREGS(0xC808, 0xC408, 0xC008, 0xD201, 0xD301, 0xD401),
+        PHYREGS(0x08C8, 0x08C4, 0x08C0, 0x01D2, 0x01D3, 0x01D4),
   },
   {     .channel                = 124,
         .freq                   = 5620, /* MHz */
@@ -859,7 +859,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x32, 0x04, 0x21, 0x01, 0x04, 0x0A,
                   0x00, 0x81, 0x00, 0x00, 0x11, 0x00, 0x00, 0x00,
                   0x80, 0x11, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0xCC08, 0xC808, 0xC408, 0xD201, 0xD201, 0xD301),
+        PHYREGS(0x08CC, 0x08C8, 0x08C4, 0x01D2, 0x01D2, 0x01D3),
   },
   {     .channel                = 126,
         .freq                   = 5630, /* MHz */
@@ -867,7 +867,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x33, 0x04, 0x21, 0x01, 0x04, 0x0A,
                   0x00, 0x81, 0x00, 0x00, 0x11, 0x00, 0x00, 0x00,
                   0x80, 0x11, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0xD008, 0xCC08, 0xC808, 0xD101, 0xD201, 0xD201),
+        PHYREGS(0x08D0, 0x08CC, 0x08C8, 0x01D1, 0x01D2, 0x01D2),
   },
   {     .channel                = 128,
         .freq                   = 5640, /* MHz */
@@ -875,7 +875,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x34, 0x03, 0x1C, 0x01, 0x04, 0x0A,
                   0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                   0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0xD408, 0xD008, 0xCC08, 0xD001, 0xD101, 0xD201),
+        PHYREGS(0x08D4, 0x08D0, 0x08CC, 0x01D0, 0x01D1, 0x01D2),
   },
   {     .channel                = 130,
         .freq                   = 5650, /* MHz */
@@ -883,7 +883,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x35, 0x03, 0x1C, 0x01, 0x04, 0x0A,
                   0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                   0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0xD808, 0xD408, 0xD008, 0xCF01, 0xD001, 0xD101),
+        PHYREGS(0x08D8, 0x08D4, 0x08D0, 0x01CF, 0x01D0, 0x01D1),
   },
   {     .channel                = 132,
         .freq                   = 5660, /* MHz */
@@ -891,7 +891,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x36, 0x03, 0x16, 0x01, 0x04, 0x0A,
                   0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                   0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0xDC08, 0xD808, 0xD408, 0xCE01, 0xCF01, 0xD001),
+        PHYREGS(0x08DC, 0x08D8, 0x08D4, 0x01CE, 0x01CF, 0x01D0),
   },
   {     .channel                = 134,
         .freq                   = 5670, /* MHz */
@@ -899,7 +899,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x37, 0x03, 0x16, 0x01, 0x04, 0x0A,
                   0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                   0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0xE008, 0xDC08, 0xD808, 0xCE01, 0xCE01, 0xCF01),
+        PHYREGS(0x08E0, 0x08DC, 0x08D8, 0x01CE, 0x01CE, 0x01CF),
   },
   {     .channel                = 136,
         .freq                   = 5680, /* MHz */
@@ -907,7 +907,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x38, 0x03, 0x10, 0x01, 0x04, 0x0A,
                   0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                   0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0xE408, 0xE008, 0xDC08, 0xCD01, 0xCE01, 0xCE01),
+        PHYREGS(0x08E4, 0x08E0, 0x08DC, 0x01CD, 0x01CE, 0x01CE),
   },
   {     .channel                = 138,
         .freq                   = 5690, /* MHz */
@@ -915,7 +915,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x39, 0x03, 0x10, 0x01, 0x04, 0x0A,
                   0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                   0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0xE808, 0xE408, 0xE008, 0xCC01, 0xCD01, 0xCE01),
+        PHYREGS(0x08E8, 0x08E4, 0x08E0, 0x01CC, 0x01CD, 0x01CE),
   },
   {     .channel                = 140,
         .freq                   = 5700, /* MHz */
@@ -923,7 +923,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x3A, 0x02, 0x0A, 0x01, 0x04, 0x0A,
                   0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                   0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0xEC08, 0xE808, 0xE408, 0xCB01, 0xCC01, 0xCD01),
+        PHYREGS(0x08EC, 0x08E8, 0x08E4, 0x01CB, 0x01CC, 0x01CD),
   },
   {     .channel                = 142,
         .freq                   = 5710, /* MHz */
@@ -931,7 +931,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x3B, 0x02, 0x0A, 0x01, 0x04, 0x0A,
                   0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                   0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0xF008, 0xEC08, 0xE808, 0xCA01, 0xCB01, 0xCC01),
+        PHYREGS(0x08F0, 0x08EC, 0x08E8, 0x01CA, 0x01CB, 0x01CC),
   },
   {     .channel                = 144,
         .freq                   = 5720, /* MHz */
@@ -939,7 +939,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x3C, 0x02, 0x0A, 0x01, 0x04, 0x0A,
                   0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                   0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0xF408, 0xF008, 0xEC08, 0xC901, 0xCA01, 0xCB01),
+        PHYREGS(0x08F4, 0x08F0, 0x08EC, 0x01C9, 0x01CA, 0x01CB),
   },
   {     .channel                = 145,
         .freq                   = 5725, /* MHz */
@@ -947,7 +947,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x72, 0x04, 0x79, 0x02, 0x03, 0x01, 0x03, 0x14,
                   0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                   0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0xF608, 0xF208, 0xEE08, 0xC901, 0xCA01, 0xCB01),
+        PHYREGS(0x08F6, 0x08F2, 0x08EE, 0x01C9, 0x01CA, 0x01CB),
   },
   {     .channel                = 146,
         .freq                   = 5730, /* MHz */
@@ -955,7 +955,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x3D, 0x02, 0x0A, 0x01, 0x04, 0x0A,
                   0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                   0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0xF808, 0xF408, 0xF008, 0xC901, 0xC901, 0xCA01),
+        PHYREGS(0x08F8, 0x08F4, 0x08F0, 0x01C9, 0x01C9, 0x01CA),
   },
   {     .channel                = 147,
         .freq                   = 5735, /* MHz */
@@ -963,7 +963,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x72, 0x04, 0x7B, 0x02, 0x03, 0x01, 0x03, 0x14,
                   0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                   0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0xFA08, 0xF608, 0xF208, 0xC801, 0xC901, 0xCA01),
+        PHYREGS(0x08FA, 0x08F6, 0x08F2, 0x01C8, 0x01C9, 0x01CA),
   },
   {     .channel                = 148,
         .freq                   = 5740, /* MHz */
@@ -971,7 +971,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x3E, 0x02, 0x0A, 0x01, 0x04, 0x0A,
                   0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                   0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0xFC08, 0xF808, 0xF408, 0xC801, 0xC901, 0xC901),
+        PHYREGS(0x08FC, 0x08F8, 0x08F4, 0x01C8, 0x01C9, 0x01C9),
   },
   {     .channel                = 149,
         .freq                   = 5745, /* MHz */
@@ -979,7 +979,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x72, 0x04, 0x7D, 0x02, 0xFE, 0x00, 0x03, 0x14,
                   0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                   0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0xFE08, 0xFA08, 0xF608, 0xC801, 0xC801, 0xC901),
+        PHYREGS(0x08FE, 0x08FA, 0x08F6, 0x01C8, 0x01C8, 0x01C9),
   },
   {     .channel                = 150,
         .freq                   = 5750, /* MHz */
@@ -987,7 +987,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x3F, 0x02, 0x0A, 0x01, 0x04, 0x0A,
                   0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                   0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x0009, 0xFC08, 0xF808, 0xC701, 0xC801, 0xC901),
+        PHYREGS(0x0900, 0x08FC, 0x08F8, 0x01C7, 0x01C8, 0x01C9),
   },
   {     .channel                = 151,
         .freq                   = 5755, /* MHz */
@@ -995,7 +995,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x72, 0x04, 0x7F, 0x02, 0xFE, 0x00, 0x03, 0x14,
                   0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                   0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x0209, 0xFE08, 0xFA08, 0xC701, 0xC801, 0xC801),
+        PHYREGS(0x0902, 0x08FE, 0x08FA, 0x01C7, 0x01C8, 0x01C8),
   },
   {     .channel                = 152,
         .freq                   = 5760, /* MHz */
@@ -1003,7 +1003,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x40, 0x02, 0x0A, 0x01, 0x04, 0x0A,
                   0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                   0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x0409, 0x0009, 0xFC08, 0xC601, 0xC701, 0xC801),
+        PHYREGS(0x0904, 0x0900, 0x08FC, 0x01C6, 0x01C7, 0x01C8),
   },
   {     .channel                = 153,
         .freq                   = 5765, /* MHz */
@@ -1011,7 +1011,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x72, 0x04, 0x81, 0x02, 0xF8, 0x00, 0x03, 0x14,
                   0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                   0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x0609, 0x0209, 0xFE08, 0xC601, 0xC701, 0xC801),
+        PHYREGS(0x0906, 0x0902, 0x08FE, 0x01C6, 0x01C7, 0x01C8),
   },
   {     .channel                = 154,
         .freq                   = 5770, /* MHz */
@@ -1019,7 +1019,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x41, 0x02, 0x0A, 0x01, 0x04, 0x0A,
                   0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                   0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x0809, 0x0409, 0x0009, 0xC601, 0xC601, 0xC701),
+        PHYREGS(0x0908, 0x0904, 0x0900, 0x01C6, 0x01C6, 0x01C7),
   },
   {     .channel                = 155,
         .freq                   = 5775, /* MHz */
@@ -1027,7 +1027,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x72, 0x04, 0x83, 0x02, 0xF8, 0x00, 0x03, 0x14,
                   0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                   0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x0A09, 0x0609, 0x0209, 0xC501, 0xC601, 0xC701),
+        PHYREGS(0x090A, 0x0906, 0x0902, 0x01C5, 0x01C6, 0x01C7),
   },
   {     .channel                = 156,
         .freq                   = 5780, /* MHz */
@@ -1035,7 +1035,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x42, 0x02, 0x0A, 0x01, 0x04, 0x0A,
                   0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                   0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x0C09, 0x0809, 0x0409, 0xC501, 0xC601, 0xC601),
+        PHYREGS(0x090C, 0x0908, 0x0904, 0x01C5, 0x01C6, 0x01C6),
   },
   {     .channel                = 157,
         .freq                   = 5785, /* MHz */
@@ -1043,7 +1043,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x72, 0x04, 0x85, 0x02, 0xF2, 0x00, 0x03, 0x14,
                   0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                   0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x0E09, 0x0A09, 0x0609, 0xC401, 0xC501, 0xC601),
+        PHYREGS(0x090E, 0x090A, 0x0906, 0x01C4, 0x01C5, 0x01C6),
   },
   {     .channel                = 158,
         .freq                   = 5790, /* MHz */
@@ -1051,7 +1051,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x43, 0x02, 0x0A, 0x01, 0x04, 0x0A,
                   0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                   0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x1009, 0x0C09, 0x0809, 0xC401, 0xC501, 0xC601),
+        PHYREGS(0x0910, 0x090C, 0x0908, 0x01C4, 0x01C5, 0x01C6),
   },
   {     .channel                = 159,
         .freq                   = 5795, /* MHz */
@@ -1059,7 +1059,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x72, 0x04, 0x87, 0x02, 0xF2, 0x00, 0x03, 0x14,
                   0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                   0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x1209, 0x0E09, 0x0A09, 0xC401, 0xC401, 0xC501),
+        PHYREGS(0x0912, 0x090E, 0x090A, 0x01C4, 0x01C4, 0x01C5),
   },
   {     .channel                = 160,
         .freq                   = 5800, /* MHz */
@@ -1067,7 +1067,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x44, 0x01, 0x0A, 0x01, 0x04, 0x0A,
                   0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                   0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x1409, 0x1009, 0x0C09, 0xC301, 0xC401, 0xC501),
+        PHYREGS(0x0914, 0x0910, 0x090C, 0x01C3, 0x01C4, 0x01C5),
   },
   {     .channel                = 161,
         .freq                   = 5805, /* MHz */
@@ -1075,7 +1075,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x72, 0x04, 0x89, 0x01, 0xED, 0x00, 0x03, 0x14,
                   0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                   0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x1609, 0x1209, 0x0E09, 0xC301, 0xC401, 0xC401),
+        PHYREGS(0x0916, 0x0912, 0x090E, 0x01C3, 0x01C4, 0x01C4),
   },
   {     .channel                = 162,
         .freq                   = 5810, /* MHz */
@@ -1083,7 +1083,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x45, 0x01, 0x0A, 0x01, 0x04, 0x0A,
                   0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                   0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x1809, 0x1409, 0x1009, 0xC201, 0xC301, 0xC401),
+        PHYREGS(0x0918, 0x0914, 0x0910, 0x01C2, 0x01C3, 0x01C4),
   },
   {     .channel                = 163,
         .freq                   = 5815, /* MHz */
@@ -1091,7 +1091,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x72, 0x04, 0x8B, 0x01, 0xED, 0x00, 0x03, 0x14,
                   0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                   0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x1A09, 0x1609, 0x1209, 0xC201, 0xC301, 0xC401),
+        PHYREGS(0x091A, 0x0916, 0x0912, 0x01C2, 0x01C3, 0x01C4),
   },
   {     .channel                = 164,
         .freq                   = 5820, /* MHz */
@@ -1099,7 +1099,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x46, 0x01, 0x0A, 0x01, 0x04, 0x0A,
                   0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                   0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x1C09, 0x1809, 0x1409, 0xC201, 0xC201, 0xC301),
+        PHYREGS(0x091C, 0x0918, 0x0914, 0x01C2, 0x01C2, 0x01C3),
   },
   {     .channel                = 165,
         .freq                   = 5825, /* MHz */
@@ -1107,7 +1107,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x72, 0x04, 0x8D, 0x01, 0xED, 0x00, 0x03, 0x14,
                   0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                   0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x1E09, 0x1A09, 0x1609, 0xC101, 0xC201, 0xC301),
+        PHYREGS(0x091E, 0x091A, 0x0916, 0x01C1, 0x01C2, 0x01C3),
   },
   {     .channel                = 166,
         .freq                   = 5830, /* MHz */
@@ -1115,7 +1115,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x47, 0x01, 0x0A, 0x01, 0x04, 0x0A,
                   0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                   0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x2009, 0x1C09, 0x1809, 0xC101, 0xC201, 0xC201),
+        PHYREGS(0x0920, 0x091C, 0x0918, 0x01C1, 0x01C2, 0x01C2),
   },
   {     .channel                = 168,
         .freq                   = 5840, /* MHz */
@@ -1123,7 +1123,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x48, 0x01, 0x0A, 0x01, 0x04, 0x0A,
                   0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                   0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x2409, 0x2009, 0x1C09, 0xC001, 0xC101, 0xC201),
+        PHYREGS(0x0924, 0x0920, 0x091C, 0x01C0, 0x01C1, 0x01C2),
   },
   {     .channel                = 170,
         .freq                   = 5850, /* MHz */
@@ -1131,7 +1131,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x49, 0x01, 0xE0, 0x00, 0x04, 0x0A,
                   0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                   0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x2809, 0x2409, 0x2009, 0xBF01, 0xC001, 0xC101),
+        PHYREGS(0x0928, 0x0924, 0x0920, 0x01BF, 0x01C0, 0x01C1),
   },
   {     .channel                = 172,
         .freq                   = 5860, /* MHz */
@@ -1139,7 +1139,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x4A, 0x01, 0xDE, 0x00, 0x04, 0x0A,
                   0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                   0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x2C09, 0x2809, 0x2409, 0xBF01, 0xBF01, 0xC001),
+        PHYREGS(0x092C, 0x0928, 0x0924, 0x01BF, 0x01BF, 0x01C0),
   },
   {     .channel                = 174,
         .freq                   = 5870, /* MHz */
@@ -1147,7 +1147,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x4B, 0x00, 0xDB, 0x00, 0x04, 0x0A,
                   0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                   0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x3009, 0x2C09, 0x2809, 0xBE01, 0xBF01, 0xBF01),
+        PHYREGS(0x0930, 0x092C, 0x0928, 0x01BE, 0x01BF, 0x01BF),
   },
   {     .channel                = 176,
         .freq                   = 5880, /* MHz */
@@ -1155,7 +1155,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x4C, 0x00, 0xD8, 0x00, 0x04, 0x0A,
                   0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                   0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x3409, 0x3009, 0x2C09, 0xBD01, 0xBE01, 0xBF01),
+        PHYREGS(0x0934, 0x0930, 0x092C, 0x01BD, 0x01BE, 0x01BF),
   },
   {     .channel                = 178,
         .freq                   = 5890, /* MHz */
@@ -1163,7 +1163,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x4D, 0x00, 0xD6, 0x00, 0x04, 0x0A,
                   0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                   0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x3809, 0x3409, 0x3009, 0xBC01, 0xBD01, 0xBE01),
+        PHYREGS(0x0938, 0x0934, 0x0930, 0x01BC, 0x01BD, 0x01BE),
   },
   {     .channel                = 180,
         .freq                   = 5900, /* MHz */
@@ -1171,7 +1171,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x4E, 0x00, 0xD3, 0x00, 0x04, 0x0A,
                   0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                   0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x3C09, 0x3809, 0x3409, 0xBC01, 0xBC01, 0xBD01),
+        PHYREGS(0x093C, 0x0938, 0x0934, 0x01BC, 0x01BC, 0x01BD),
   },
   {     .channel                = 182,
         .freq                   = 5910, /* MHz */
@@ -1179,7 +1179,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x71, 0x02, 0x4F, 0x00, 0xD6, 0x00, 0x04, 0x0A,
                   0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                   0x80, 0x00, 0x00, 0x00, 0x00, 0x80),
-        PHYREGS(0x4009, 0x3C09, 0x3809, 0xBB01, 0xBC01, 0xBC01),
+        PHYREGS(0x0940, 0x093C, 0x0938, 0x01BB, 0x01BC, 0x01BC),
   },
   {     .channel                = 1,
         .freq                   = 2412, /* MHz */
@@ -1187,7 +1187,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x73, 0x09, 0x6C, 0x0F, 0x00, 0x01, 0x07, 0x15,
                   0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x0D, 0x0C,
                   0x80, 0xFF, 0x88, 0x0D, 0x0C, 0x80),
-        PHYREGS(0xC903, 0xC503, 0xC103, 0x3A04, 0x3F04, 0x4304),
+        PHYREGS(0x03C9, 0x03C5, 0x03C1, 0x043A, 0x043F, 0x0443),
   },
   {     .channel                = 2,
         .freq                   = 2417, /* MHz */
@@ -1195,7 +1195,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x73, 0x09, 0x71, 0x0F, 0x00, 0x01, 0x07, 0x15,
                   0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x0C, 0x0B,
                   0x80, 0xFF, 0x88, 0x0C, 0x0B, 0x80),
-        PHYREGS(0xCB03, 0xC703, 0xC303, 0x3804, 0x3D04, 0x4104),
+        PHYREGS(0x03CB, 0x03C7, 0x03C3, 0x0438, 0x043D, 0x0441),
   },
   {     .channel                = 3,
         .freq                   = 2422, /* MHz */
@@ -1203,7 +1203,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x73, 0x09, 0x76, 0x0F, 0x00, 0x01, 0x07, 0x15,
                   0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x0C, 0x0A,
                   0x80, 0xFF, 0x88, 0x0C, 0x0A, 0x80),
-        PHYREGS(0xCD03, 0xC903, 0xC503, 0x3604, 0x3A04, 0x3F04),
+        PHYREGS(0x03CD, 0x03C9, 0x03C5, 0x0436, 0x043A, 0x043F),
   },
   {     .channel                = 4,
         .freq                   = 2427, /* MHz */
@@ -1211,7 +1211,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x73, 0x09, 0x7B, 0x0F, 0x00, 0x01, 0x07, 0x15,
                   0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x0C, 0x0A,
                   0x80, 0xFF, 0x88, 0x0C, 0x0A, 0x80),
-        PHYREGS(0xCF03, 0xCB03, 0xC703, 0x3404, 0x3804, 0x3D04),
+        PHYREGS(0x03CF, 0x03CB, 0x03C7, 0x0434, 0x0438, 0x043D),
   },
   {     .channel                = 5,
         .freq                   = 2432, /* MHz */
@@ -1219,7 +1219,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x73, 0x09, 0x80, 0x0F, 0x00, 0x01, 0x07, 0x15,
                   0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x0C, 0x09,
                   0x80, 0xFF, 0x88, 0x0C, 0x09, 0x80),
-        PHYREGS(0xD103, 0xCD03, 0xC903, 0x3104, 0x3604, 0x3A04),
+        PHYREGS(0x03D1, 0x03CD, 0x03C9, 0x0431, 0x0436, 0x043A),
   },
   {     .channel                = 6,
         .freq                   = 2437, /* MHz */
@@ -1227,7 +1227,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x73, 0x09, 0x85, 0x0F, 0x00, 0x01, 0x07, 0x15,
                   0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x0B, 0x08,
                   0x80, 0xFF, 0x88, 0x0B, 0x08, 0x80),
-        PHYREGS(0xD303, 0xCF03, 0xCB03, 0x2F04, 0x3404, 0x3804),
+        PHYREGS(0x03D3, 0x03CF, 0x03CB, 0x042F, 0x0434, 0x0438),
   },
   {     .channel                = 7,
         .freq                   = 2442, /* MHz */
@@ -1235,7 +1235,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x73, 0x09, 0x8A, 0x0F, 0x00, 0x01, 0x07, 0x15,
                   0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x0A, 0x07,
                   0x80, 0xFF, 0x88, 0x0A, 0x07, 0x80),
-        PHYREGS(0xD503, 0xD103, 0xCD03, 0x2D04, 0x3104, 0x3604),
+        PHYREGS(0x03D5, 0x03D1, 0x03CD, 0x042D, 0x0431, 0x0436),
   },
   {     .channel                = 8,
         .freq                   = 2447, /* MHz */
@@ -1243,7 +1243,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x73, 0x09, 0x8F, 0x0F, 0x00, 0x01, 0x07, 0x15,
                   0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x0A, 0x06,
                   0x80, 0xFF, 0x88, 0x0A, 0x06, 0x80),
-        PHYREGS(0xD703, 0xD303, 0xCF03, 0x2B04, 0x2F04, 0x3404),
+        PHYREGS(0x03D7, 0x03D3, 0x03CF, 0x042B, 0x042F, 0x0434),
   },
   {     .channel                = 9,
         .freq                   = 2452, /* MHz */
@@ -1251,7 +1251,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x73, 0x09, 0x94, 0x0F, 0x00, 0x01, 0x07, 0x15,
                   0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x09, 0x06,
                   0x80, 0xFF, 0x88, 0x09, 0x06, 0x80),
-        PHYREGS(0xD903, 0xD503, 0xD103, 0x2904, 0x2D04, 0x3104),
+        PHYREGS(0x03D9, 0x03D5, 0x03D1, 0x0429, 0x042D, 0x0431),
   },
   {     .channel                = 10,
         .freq                   = 2457, /* MHz */
@@ -1259,7 +1259,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x73, 0x09, 0x99, 0x0F, 0x00, 0x01, 0x07, 0x15,
                   0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x08, 0x05,
                   0x80, 0xFF, 0x88, 0x08, 0x05, 0x80),
-        PHYREGS(0xDB03, 0xD703, 0xD303, 0x2704, 0x2B04, 0x2F04),
+        PHYREGS(0x03DB, 0x03D7, 0x03D3, 0x0427, 0x042B, 0x042F),
   },
   {     .channel                = 11,
         .freq                   = 2462, /* MHz */
@@ -1267,7 +1267,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x73, 0x09, 0x9E, 0x0F, 0x00, 0x01, 0x07, 0x15,
                   0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x08, 0x04,
                   0x80, 0xFF, 0x88, 0x08, 0x04, 0x80),
-        PHYREGS(0xDD03, 0xD903, 0xD503, 0x2404, 0x2904, 0x2D04),
+        PHYREGS(0x03DD, 0x03D9, 0x03D5, 0x0424, 0x0429, 0x042D),
   },
   {     .channel                = 12,
         .freq                   = 2467, /* MHz */
@@ -1275,7 +1275,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x73, 0x09, 0xA3, 0x0F, 0x00, 0x01, 0x07, 0x15,
                   0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x08, 0x03,
                   0x80, 0xFF, 0x88, 0x08, 0x03, 0x80),
-        PHYREGS(0xDF03, 0xDB03, 0xD703, 0x2204, 0x2704, 0x2B04),
+        PHYREGS(0x03DF, 0x03DB, 0x03D7, 0x0422, 0x0427, 0x042B),
   },
   {     .channel                = 13,
         .freq                   = 2472, /* MHz */
@@ -1283,7 +1283,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x73, 0x09, 0xA8, 0x0F, 0x00, 0x01, 0x07, 0x15,
                   0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x07, 0x03,
                   0x80, 0xFF, 0x88, 0x07, 0x03, 0x80),
-        PHYREGS(0xE103, 0xDD03, 0xD903, 0x2004, 0x2404, 0x2904),
+        PHYREGS(0x03E1, 0x03DD, 0x03D9, 0x0420, 0x0424, 0x0429),
   },
   {     .channel                = 14,
         .freq                   = 2484, /* MHz */
@@ -1291,7 +1291,7 @@ static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab_rev2[] =
         RADIOREGS(0x73, 0x09, 0xB4, 0x0F, 0xFF, 0x01, 0x07, 0x15,
                   0x01, 0x8F, 0xFF, 0xFF, 0xFF, 0x88, 0x07, 0x01,
                   0x80, 0xFF, 0x88, 0x07, 0x01, 0x80),
-        PHYREGS(0xE603, 0xE203, 0xDE03, 0x1B04, 0x1F04, 0x2404),
+        PHYREGS(0x03E6, 0x03E2, 0x03DE, 0x041B, 0x041F, 0x0424),
   },
 };
 
@@ -1299,7 +1299,7 @@ void b2055_upload_inittab(struct b43_wldev *dev,
                           bool ghz5, bool ignore_uploadflag)
 {
         const struct b2055_inittab_entry *e;
-        unsigned int i;
+        unsigned int i, writes = 0;
         u16 value;
 
         for (i = 0; i < ARRAY_SIZE(b2055_inittab); i++) {
@@ -1312,6 +1312,8 @@ void b2055_upload_inittab(struct b43_wldev *dev,
                         else
                                 value = e->ghz2;
                         b43_radio_write16(dev, i, value);
+                        if (++writes % 4 == 0)
+                                b43_read32(dev, B43_MMIO_MACCTL); /* flush */
                 }
         }
 }
diff --git a/drivers/net/wireless/b43/radio_2056.c b/drivers/net/wireless/b43/radio_2056.c
index d8563192ce5..0cdf6a46ba4 100644
--- a/drivers/net/wireless/b43/radio_2056.c
+++ b/drivers/net/wireless/b43/radio_2056.c
@@ -24,9 +24,6028 @@
 #include "radio_2056.h"
 #include "phy_common.h"
 
+#define RADIOREGS3(r00, r01, r02, r03, r04, r05, r06, r07, r08, r09, \
+                   r10, r11, r12, r13, r14, r15, r16, r17, r18, r19, \
+                   r20, r21, r22, r23, r24, r25, r26, r27, r28, r29, \
+                   r30, r31, r32, r33, r34, r35, r36) \
+        .radio_syn_pll_vcocal1          = r00,  \
+        .radio_syn_pll_vcocal2          = r01,  \
+        .radio_syn_pll_refdiv           = r02,  \
+        .radio_syn_pll_mmd2             = r03,  \
+        .radio_syn_pll_mmd1             = r04,  \
+        .radio_syn_pll_loopfilter1      = r05,  \
+        .radio_syn_pll_loopfilter2      = r06,  \
+        .radio_syn_pll_loopfilter3      = r07,  \
+        .radio_syn_pll_loopfilter4      = r08,  \
+        .radio_syn_pll_loopfilter5      = r09,  \
+        .radio_syn_reserved_addr27      = r10,  \
+        .radio_syn_reserved_addr28      = r11,  \
+        .radio_syn_reserved_addr29      = r12,  \
+        .radio_syn_logen_vcobuf1        = r13,  \
+        .radio_syn_logen_mixer2         = r14,  \
+        .radio_syn_logen_buf3           = r15,  \
+        .radio_syn_logen_buf4           = r16,  \
+        .radio_rx0_lnaa_tune            = r17,  \
+        .radio_rx0_lnag_tune            = r18,  \
+        .radio_tx0_intpaa_boost_tune    = r19,  \
+        .radio_tx0_intpag_boost_tune    = r20,  \
+        .radio_tx0_pada_boost_tune      = r21,  \
+        .radio_tx0_padg_boost_tune      = r22,  \
+        .radio_tx0_pgaa_boost_tune      = r23,  \
+        .radio_tx0_pgag_boost_tune      = r24,  \
+        .radio_tx0_mixa_boost_tune      = r25,  \
+        .radio_tx0_mixg_boost_tune      = r26,  \
+        .radio_rx1_lnaa_tune            = r27,  \
+        .radio_rx1_lnag_tune            = r28,  \
+        .radio_tx1_intpaa_boost_tune    = r29,  \
+        .radio_tx1_intpag_boost_tune    = r30,  \
+        .radio_tx1_pada_boost_tune      = r31,  \
+        .radio_tx1_padg_boost_tune      = r32,  \
+        .radio_tx1_pgaa_boost_tune      = r33,  \
+        .radio_tx1_pgag_boost_tune      = r34,  \
+        .radio_tx1_mixa_boost_tune      = r35,  \
+        .radio_tx1_mixg_boost_tune      = r36
+
+#define PHYREGS(r0, r1, r2, r3, r4, r5) \
+        .phy_regs.phy_bw1a      = r0,   \
+        .phy_regs.phy_bw2       = r1,   \
+        .phy_regs.phy_bw3       = r2,   \
+        .phy_regs.phy_bw4       = r3,   \
+        .phy_regs.phy_bw5       = r4,   \
+        .phy_regs.phy_bw6       = r5
+
+/* http://bcm-v4.sipsolutions.net/802.11/Radio/2056/ChannelTable */
 static const struct b43_nphy_channeltab_entry_rev3 b43_nphy_channeltab_rev3[] = {
+  {     .freq                   = 4920,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xec, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x00, 0x00, 0x00, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x08, 0x00, 0x7f, 0x00, 0x0b,
+                   0x00, 0xff, 0x00, 0xff, 0x00, 0x08, 0x00, 0x7f,
+                   0x00, 0x0b, 0x00, 0xff, 0x00),
+        PHYREGS(0x07b4, 0x07b0, 0x07ac, 0x0214, 0x0215, 0x0216),
+  },
+  {     .freq                   = 4930,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xed, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x00, 0x00, 0x00, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x08, 0x00, 0x7f, 0x00, 0x0b,
+                   0x00, 0xff, 0x00, 0xff, 0x00, 0x08, 0x00, 0x7f,
+                   0x00, 0x0b, 0x00, 0xff, 0x00),
+        PHYREGS(0x07b8, 0x07b4, 0x07b0, 0x0213, 0x0214, 0x0215),
+  },
+  {     .freq                   = 4940,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xee, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x00, 0x00, 0x00, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x08, 0x00, 0x7f, 0x00, 0x0b,
+                   0x00, 0xff, 0x00, 0xff, 0x00, 0x08, 0x00, 0x7f,
+                   0x00, 0x0b, 0x00, 0xff, 0x00),
+        PHYREGS(0x07bc, 0x07b8, 0x07b4, 0x0212, 0x0213, 0x0214),
+  },
+  {     .freq                   = 4950,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xef, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x00, 0x00, 0x00, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x08, 0x00, 0x7f, 0x00, 0x0b,
+                   0x00, 0xff, 0x00, 0xff, 0x00, 0x08, 0x00, 0x7f,
+                   0x00, 0x0b, 0x00, 0xff, 0x00),
+        PHYREGS(0x07c0, 0x07bc, 0x07b8, 0x0211, 0x0212, 0x0213),
+  },
+  {     .freq                   = 4960,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf0, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x08, 0x00, 0x7f, 0x00, 0x0b,
+                   0x00, 0xff, 0x00, 0xff, 0x00, 0x08, 0x00, 0x7f,
+                   0x00, 0x0b, 0x00, 0xff, 0x00),
+        PHYREGS(0x07c4, 0x07c0, 0x07bc, 0x020f, 0x0211, 0x0212),
+  },
+  {     .freq                   = 4970,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf1, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x08, 0x00, 0x7f, 0x00, 0x0b,
+                   0x00, 0xff, 0x00, 0xff, 0x00, 0x08, 0x00, 0x7f,
+                   0x00, 0x0b, 0x00, 0xff, 0x00),
+        PHYREGS(0x07c8, 0x07c4, 0x07c0, 0x020e, 0x020f, 0x0211),
+  },
+  {     .freq                   = 4980,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf2, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x08, 0x00, 0x7f, 0x00, 0x0b,
+                   0x00, 0xff, 0x00, 0xff, 0x00, 0x08, 0x00, 0x7f,
+                   0x00, 0x0b, 0x00, 0xff, 0x00),
+        PHYREGS(0x07cc, 0x07c8, 0x07c4, 0x020d, 0x020e, 0x020f),
+  },
+  {     .freq                   = 4990,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf3, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x08, 0x00, 0x7f, 0x00, 0x0b,
+                   0x00, 0xff, 0x00, 0xff, 0x00, 0x08, 0x00, 0x7f,
+                   0x00, 0x0b, 0x00, 0xff, 0x00),
+        PHYREGS(0x07d0, 0x07cc, 0x07c8, 0x020c, 0x020d, 0x020e),
+  },
+  {     .freq                   = 5000,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf4, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x07, 0x00, 0x7f, 0x00, 0x0b,
+                   0x00, 0xff, 0x00, 0xff, 0x00, 0x07, 0x00, 0x7f,
+                   0x00, 0x0b, 0x00, 0xff, 0x00),
+        PHYREGS(0x07d4, 0x07d0, 0x07cc, 0x020b, 0x020c, 0x020d),
+  },
+  {     .freq                   = 5010,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf5, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x07, 0x00, 0x7f, 0x00, 0x0b,
+                   0x00, 0xff, 0x00, 0xff, 0x00, 0x07, 0x00, 0x7f,
+                   0x00, 0x0b, 0x00, 0xff, 0x00),
+        PHYREGS(0x07d8, 0x07d4, 0x07d0, 0x020a, 0x020b, 0x020c),
+  },
+  {     .freq                   = 5020,
+        RADIOREGS3(0xf7, 0x01, 0x01, 0x01, 0xf6, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x07, 0x00, 0x7f, 0x00, 0x0b,
+                   0x00, 0xff, 0x00, 0xff, 0x00, 0x07, 0x00, 0x7f,
+                   0x00, 0x0b, 0x00, 0xff, 0x00),
+        PHYREGS(0x07dc, 0x07d8, 0x07d4, 0x0209, 0x020a, 0x020b),
+  },
+  {     .freq                   = 5030,
+        RADIOREGS3(0xf7, 0x01, 0x01, 0x01, 0xf7, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x07, 0x00, 0x7f, 0x00, 0x0b,
+                   0x00, 0xff, 0x00, 0xff, 0x00, 0x07, 0x00, 0x7f,
+                   0x00, 0x0b, 0x00, 0xff, 0x00),
+        PHYREGS(0x07e0, 0x07dc, 0x07d8, 0x0208, 0x0209, 0x020a),
+  },
+  {     .freq                   = 5040,
+        RADIOREGS3(0xef, 0x01, 0x01, 0x01, 0xf8, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x07, 0x00, 0x7f, 0x00, 0x0b,
+                   0x00, 0xff, 0x00, 0xff, 0x00, 0x07, 0x00, 0x7f,
+                   0x00, 0x0b, 0x00, 0xff, 0x00),
+        PHYREGS(0x07e4, 0x07e0, 0x07dc, 0x0207, 0x0208, 0x0209),
+  },
+  {     .freq                   = 5050,
+        RADIOREGS3(0xef, 0x01, 0x01, 0x01, 0xf9, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x07, 0x00, 0x7f, 0x00, 0x0b,
+                   0x00, 0xff, 0x00, 0xff, 0x00, 0x07, 0x00, 0x7f,
+                   0x00, 0x0b, 0x00, 0xff, 0x00),
+        PHYREGS(0x07e8, 0x07e4, 0x07e0, 0x0206, 0x0207, 0x0208),
+  },
+  {     .freq                   = 5060,
+        RADIOREGS3(0xe6, 0x01, 0x01, 0x01, 0xfa, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x07, 0x00, 0x7f, 0x00, 0x0b,
+                   0x00, 0xff, 0x00, 0xff, 0x00, 0x07, 0x00, 0x7f,
+                   0x00, 0x0b, 0x00, 0xff, 0x00),
+        PHYREGS(0x07ec, 0x07e8, 0x07e4, 0x0205, 0x0206, 0x0207),
+  },
+  {     .freq                   = 5070,
+        RADIOREGS3(0xe6, 0x01, 0x01, 0x01, 0xfb, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x07, 0x00, 0x7f, 0x00, 0x0b,
+                   0x00, 0xff, 0x00, 0xff, 0x00, 0x07, 0x00, 0x7f,
+                   0x00, 0x0b, 0x00, 0xff, 0x00),
+        PHYREGS(0x07f0, 0x07ec, 0x07e8, 0x0204, 0x0205, 0x0206),
+  },
+  {     .freq                   = 5080,
+        RADIOREGS3(0xde, 0x01, 0x01, 0x01, 0xfc, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x07, 0x00, 0x7f, 0x00, 0x0b,
+                   0x00, 0xff, 0x00, 0xff, 0x00, 0x07, 0x00, 0x7f,
+                   0x00, 0x0b, 0x00, 0xff, 0x00),
+        PHYREGS(0x07f4, 0x07f0, 0x07ec, 0x0203, 0x0204, 0x0205),
+  },
+  {     .freq                   = 5090,
+        RADIOREGS3(0xde, 0x01, 0x01, 0x01, 0xfd, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x07, 0x00, 0x7f, 0x00, 0x0b,
+                   0x00, 0xff, 0x00, 0xff, 0x00, 0x07, 0x00, 0x7f,
+                   0x00, 0x0b, 0x00, 0xff, 0x00),
+        PHYREGS(0x07f8, 0x07f4, 0x07f0, 0x0202, 0x0203, 0x0204),
+  },
+  {     .freq                   = 5100,
+        RADIOREGS3(0xd6, 0x01, 0x01, 0x01, 0xfe, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x07, 0x00, 0x7f, 0x00, 0x0b,
+                   0x00, 0xff, 0x00, 0xff, 0x00, 0x07, 0x00, 0x7f,
+                   0x00, 0x0b, 0x00, 0xff, 0x00),
+        PHYREGS(0x07fc, 0x07f8, 0x07f4, 0x0201, 0x0202, 0x0203),
+  },
+  {     .freq                   = 5110,
+        RADIOREGS3(0xd6, 0x01, 0x01, 0x01, 0xff, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x07, 0x00, 0x7f, 0x00, 0x0b,
+                   0x00, 0xfc, 0x00, 0xff, 0x00, 0x07, 0x00, 0x7f,
+                   0x00, 0x0b, 0x00, 0xfc, 0x00),
+        PHYREGS(0x0800, 0x07fc, 0x07f8, 0x0200, 0x0201, 0x0202),
+  },
+  {     .freq                   = 5120,
+        RADIOREGS3(0xce, 0x01, 0x01, 0x02, 0x00, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x07, 0x00, 0x7f, 0x00, 0x0b,
+                   0x00, 0xfc, 0x00, 0xff, 0x00, 0x07, 0x00, 0x7f,
+                   0x00, 0x0b, 0x00, 0xfc, 0x00),
+        PHYREGS(0x0804, 0x0800, 0x07fc, 0x01ff, 0x0200, 0x0201),
+  },
+  {     .freq                   = 5130,
+        RADIOREGS3(0xce, 0x01, 0x01, 0x02, 0x01, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x07, 0x00, 0x7f, 0x00, 0x0b,
+                   0x00, 0xfc, 0x00, 0xff, 0x00, 0x07, 0x00, 0x7f,
+                   0x00, 0x0b, 0x00, 0xfc, 0x00),
+        PHYREGS(0x0808, 0x0804, 0x0800, 0x01fe, 0x01ff, 0x0200),
+  },
+  {     .freq                   = 5140,
+        RADIOREGS3(0xc6, 0x01, 0x01, 0x02, 0x02, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x07, 0x00, 0x7f, 0x00, 0x0b,
+                   0x00, 0xfc, 0x00, 0xff, 0x00, 0x07, 0x00, 0x7f,
+                   0x00, 0x0b, 0x00, 0xfc, 0x00),
+        PHYREGS(0x080c, 0x0808, 0x0804, 0x01fd, 0x01fe, 0x01ff),
+  },
+  {     .freq                   = 5160,
+        RADIOREGS3(0xbe, 0x01, 0x01, 0x02, 0x04, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x07, 0x00, 0x7f, 0x00, 0x0b,
+                   0x00, 0xfc, 0x00, 0xff, 0x00, 0x07, 0x00, 0x7f,
+                   0x00, 0x0b, 0x00, 0xfc, 0x00),
+        PHYREGS(0x0814, 0x0810, 0x080c, 0x01fb, 0x01fc, 0x01fd),
+  },
+  {     .freq                   = 5170,
+        RADIOREGS3(0xbe, 0x01, 0x01, 0x02, 0x05, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x07, 0x00, 0x7f, 0x00, 0x0b,
+                   0x00, 0xfc, 0x00, 0xff, 0x00, 0x07, 0x00, 0x7f,
+                   0x00, 0x0b, 0x00, 0xfc, 0x00),
+        PHYREGS(0x0818, 0x0814, 0x0810, 0x01fa, 0x01fb, 0x01fc),
+  },
+  {     .freq                   = 5180,
+        RADIOREGS3(0xb6, 0x01, 0x01, 0x02, 0x06, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xef, 0x00, 0x07, 0x00, 0x7f, 0x00, 0x0b,
+                   0x00, 0xfc, 0x00, 0xef, 0x00, 0x07, 0x00, 0x7f,
+                   0x00, 0x0b, 0x00, 0xfc, 0x00),
+        PHYREGS(0x081c, 0x0818, 0x0814, 0x01f9, 0x01fa, 0x01fb),
+  },
+  {     .freq                   = 5190,
+        RADIOREGS3(0xb6, 0x01, 0x01, 0x02, 0x07, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xef, 0x00, 0x07, 0x00, 0x7f, 0x00, 0x0b,
+                   0x00, 0xfc, 0x00, 0xef, 0x00, 0x07, 0x00, 0x7f,
+                   0x00, 0x0b, 0x00, 0xfc, 0x00),
+        PHYREGS(0x0820, 0x081c, 0x0818, 0x01f8, 0x01f9, 0x01fa),
+  },
+  {     .freq                   = 5200,
+        RADIOREGS3(0xaf, 0x01, 0x01, 0x02, 0x08, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xef, 0x00, 0x06, 0x00, 0x7f, 0x00, 0x0a,
+                   0x00, 0xfc, 0x00, 0xef, 0x00, 0x06, 0x00, 0x7f,
+                   0x00, 0x0a, 0x00, 0xfc, 0x00),
+        PHYREGS(0x0824, 0x0820, 0x081c, 0x01f7, 0x01f8, 0x01f9),
+  },
+  {     .freq                   = 5210,
+        RADIOREGS3(0xaf, 0x01, 0x01, 0x02, 0x09, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xdf, 0x00, 0x06, 0x00, 0x7f, 0x00, 0x0a,
+                   0x00, 0xfc, 0x00, 0xdf, 0x00, 0x06, 0x00, 0x7f,
+                   0x00, 0x0a, 0x00, 0xfc, 0x00),
+        PHYREGS(0x0828, 0x0824, 0x0820, 0x01f6, 0x01f7, 0x01f8),
+  },
+  {     .freq                   = 5220,
+        RADIOREGS3(0xa7, 0x01, 0x01, 0x02, 0x0a, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xdf, 0x00, 0x06, 0x00, 0x7f, 0x00, 0x0a,
+                   0x00, 0xfc, 0x00, 0xdf, 0x00, 0x06, 0x00, 0x7f,
+                   0x00, 0x0a, 0x00, 0xfc, 0x00),
+        PHYREGS(0x082c, 0x0828, 0x0824, 0x01f5, 0x01f6, 0x01f7),
+  },
+  {     .freq                   = 5230,
+        RADIOREGS3(0xa7, 0x01, 0x01, 0x02, 0x0b, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xdf, 0x00, 0x06, 0x00, 0x7f, 0x00, 0x0a,
+                   0x00, 0xfc, 0x00, 0xdf, 0x00, 0x06, 0x00, 0x7f,
+                   0x00, 0x0a, 0x00, 0xfc, 0x00),
+        PHYREGS(0x0830, 0x082c, 0x0828, 0x01f4, 0x01f5, 0x01f6),
+  },
+  {     .freq                   = 5240,
+        RADIOREGS3(0xa0, 0x01, 0x01, 0x02, 0x0c, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xcf, 0x00, 0x06, 0x00, 0x7f, 0x00, 0x0a,
+                   0x00, 0xfc, 0x00, 0xcf, 0x00, 0x06, 0x00, 0x7f,
+                   0x00, 0x0a, 0x00, 0xfc, 0x00),
+        PHYREGS(0x0834, 0x0830, 0x082c, 0x01f3, 0x01f4, 0x01f5),
+  },
+  {     .freq                   = 5250,
+        RADIOREGS3(0xa0, 0x01, 0x01, 0x02, 0x0d, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xcf, 0x00, 0x06, 0x00, 0x7f, 0x00, 0x0a,
+                   0x00, 0xfc, 0x00, 0xcf, 0x00, 0x06, 0x00, 0x7f,
+                   0x00, 0x0a, 0x00, 0xfc, 0x00),
+        PHYREGS(0x0838, 0x0834, 0x0830, 0x01f2, 0x01f3, 0x01f4),
+  },
+  {     .freq                   = 5260,
+        RADIOREGS3(0x98, 0x01, 0x01, 0x02, 0x0e, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xcf, 0x00, 0x06, 0x00, 0x7f, 0x00, 0x0a,
+                   0x00, 0xfc, 0x00, 0xcf, 0x00, 0x06, 0x00, 0x7f,
+                   0x00, 0x0a, 0x00, 0xfc, 0x00),
+        PHYREGS(0x083c, 0x0838, 0x0834, 0x01f1, 0x01f2, 0x01f3),
+  },
+  {     .freq                   = 5270,
+        RADIOREGS3(0x98, 0x01, 0x01, 0x02, 0x0f, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8f, 0x0f, 0x00,
+                   0xff, 0xcf, 0x00, 0x06, 0x00, 0x7f, 0x00, 0x0a,
+                   0x00, 0xfc, 0x00, 0xcf, 0x00, 0x06, 0x00, 0x7f,
+                   0x00, 0x0a, 0x00, 0xfc, 0x00),
+        PHYREGS(0x0840, 0x083c, 0x0838, 0x01f0, 0x01f1, 0x01f2),
+  },
+  {     .freq                   = 5280,
+        RADIOREGS3(0x91, 0x01, 0x01, 0x02, 0x10, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8f, 0x0f, 0x00,
+                   0xff, 0xbf, 0x00, 0x06, 0x00, 0x7f, 0x00, 0x0a,
+                   0x00, 0xfc, 0x00, 0xbf, 0x00, 0x06, 0x00, 0x7f,
+                   0x00, 0x0a, 0x00, 0xfc, 0x00),
+        PHYREGS(0x0844, 0x0840, 0x083c, 0x01f0, 0x01f0, 0x01f1),
+  },
+  {     .freq                   = 5290,
+        RADIOREGS3(0x91, 0x01, 0x01, 0x02, 0x11, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8f, 0x0f, 0x00,
+                   0xff, 0xbf, 0x00, 0x06, 0x00, 0x7f, 0x00, 0x0a,
+                   0x00, 0xfc, 0x00, 0xbf, 0x00, 0x06, 0x00, 0x7f,
+                   0x00, 0x0a, 0x00, 0xfc, 0x00),
+        PHYREGS(0x0848, 0x0844, 0x0840, 0x01ef, 0x01f0, 0x01f0),
+  },
+  {     .freq                   = 5300,
+        RADIOREGS3(0x8a, 0x01, 0x01, 0x02, 0x12, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8f, 0x0e, 0x00,
+                   0xff, 0xbf, 0x00, 0x05, 0x00, 0x7f, 0x00, 0x09,
+                   0x00, 0xfc, 0x00, 0xbf, 0x00, 0x05, 0x00, 0x7f,
+                   0x00, 0x09, 0x00, 0xfc, 0x00),
+        PHYREGS(0x084c, 0x0848, 0x0844, 0x01ee, 0x01ef, 0x01f0),
+  },
+  {     .freq                   = 5310,
+        RADIOREGS3(0x8a, 0x01, 0x01, 0x02, 0x13, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8f, 0x0e, 0x00,
+                   0xff, 0xbf, 0x00, 0x05, 0x00, 0x7f, 0x00, 0x09,
+                   0x00, 0xfa, 0x00, 0xbf, 0x00, 0x05, 0x00, 0x7f,
+                   0x00, 0x09, 0x00, 0xfa, 0x00),
+        PHYREGS(0x0850, 0x084c, 0x0848, 0x01ed, 0x01ee, 0x01ef),
+  },
+  {     .freq                   = 5320,
+        RADIOREGS3(0x83, 0x01, 0x01, 0x02, 0x14, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8f, 0x0e, 0x00,
+                   0xff, 0xbf, 0x00, 0x05, 0x00, 0x7f, 0x00, 0x09,
+                   0x00, 0xfa, 0x00, 0xbf, 0x00, 0x05, 0x00, 0x7f,
+                   0x00, 0x09, 0x00, 0xfa, 0x00),
+        PHYREGS(0x0854, 0x0850, 0x084c, 0x01ec, 0x01ed, 0x01ee),
+  },
+  {     .freq                   = 5330,
+        RADIOREGS3(0x83, 0x01, 0x01, 0x02, 0x15, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8f, 0x0e, 0x00,
+                   0xff, 0xaf, 0x00, 0x05, 0x00, 0x7f, 0x00, 0x09,
+                   0x00, 0xfa, 0x00, 0xaf, 0x00, 0x05, 0x00, 0x7f,
+                   0x00, 0x09, 0x00, 0xfa, 0x00),
+        PHYREGS(0x0858, 0x0854, 0x0850, 0x01eb, 0x01ec, 0x01ed),
+  },
+  {     .freq                   = 5340,
+        RADIOREGS3(0x7c, 0x01, 0x01, 0x02, 0x16, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8f, 0x0e, 0x00,
+                   0xff, 0xaf, 0x00, 0x05, 0x00, 0x7f, 0x00, 0x09,
+                   0x00, 0xfa, 0x00, 0xaf, 0x00, 0x05, 0x00, 0x7f,
+                   0x00, 0x09, 0x00, 0xfa, 0x00),
+        PHYREGS(0x085c, 0x0858, 0x0854, 0x01ea, 0x01eb, 0x01ec),
+  },
+  {     .freq                   = 5350,
+        RADIOREGS3(0x7c, 0x01, 0x01, 0x02, 0x17, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8f, 0x0e, 0x00,
+                   0xff, 0x9f, 0x00, 0x05, 0x00, 0x7f, 0x00, 0x09,
+                   0x00, 0xfa, 0x00, 0x9f, 0x00, 0x05, 0x00, 0x7f,
+                   0x00, 0x09, 0x00, 0xfa, 0x00),
+        PHYREGS(0x0860, 0x085c, 0x0858, 0x01e9, 0x01ea, 0x01eb),
+  },
+  {     .freq                   = 5360,
+        RADIOREGS3(0x75, 0x01, 0x01, 0x02, 0x18, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8f, 0x0e, 0x00,
+                   0xff, 0x9f, 0x00, 0x05, 0x00, 0x7f, 0x00, 0x09,
+                   0x00, 0xfa, 0x00, 0x9f, 0x00, 0x05, 0x00, 0x7f,
+                   0x00, 0x09, 0x00, 0xfa, 0x00),
+        PHYREGS(0x0864, 0x0860, 0x085c, 0x01e8, 0x01e9, 0x01ea),
+  },
+  {     .freq                   = 5370,
+        RADIOREGS3(0x75, 0x01, 0x01, 0x02, 0x19, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8f, 0x0e, 0x00,
+                   0xff, 0x9f, 0x00, 0x05, 0x00, 0x7f, 0x00, 0x09,
+                   0x00, 0xfa, 0x00, 0x9f, 0x00, 0x05, 0x00, 0x7f,
+                   0x00, 0x09, 0x00, 0xfa, 0x00),
+        PHYREGS(0x0868, 0x0864, 0x0860, 0x01e7, 0x01e8, 0x01e9),
+  },
+  {     .freq                   = 5380,
+        RADIOREGS3(0x6e, 0x01, 0x01, 0x02, 0x1a, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8f, 0x0e, 0x00,
+                   0xff, 0x9f, 0x00, 0x05, 0x00, 0x7f, 0x00, 0x09,
+                   0x00, 0xfa, 0x00, 0x9f, 0x00, 0x05, 0x00, 0x7f,
+                   0x00, 0x09, 0x00, 0xfa, 0x00),
+        PHYREGS(0x086c, 0x0868, 0x0864, 0x01e6, 0x01e7, 0x01e8),
+  },
+  {     .freq                   = 5390,
+        RADIOREGS3(0x6e, 0x01, 0x01, 0x02, 0x1b, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8f, 0x0e, 0x00,
+                   0xff, 0x8f, 0x00, 0x05, 0x00, 0x7f, 0x00, 0x09,
+                   0x00, 0xfa, 0x00, 0x8f, 0x00, 0x05, 0x00, 0x7f,
+                   0x00, 0x09, 0x00, 0xfa, 0x00),
+        PHYREGS(0x0870, 0x086c, 0x0868, 0x01e5, 0x01e6, 0x01e7),
+  },
+  {     .freq                   = 5400,
+        RADIOREGS3(0x67, 0x01, 0x01, 0x02, 0x1c, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0d, 0x00,
+                   0xc8, 0x8f, 0x00, 0x04, 0x00, 0x7f, 0x00, 0x08,
+                   0x00, 0xfa, 0x00, 0x8f, 0x00, 0x04, 0x00, 0x7f,
+                   0x00, 0x08, 0x00, 0xfa, 0x00),
+        PHYREGS(0x0874, 0x0870, 0x086c, 0x01e5, 0x01e5, 0x01e6),
+  },
+  {     .freq                   = 5410,
+        RADIOREGS3(0x67, 0x01, 0x01, 0x02, 0x1d, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0d, 0x00,
+                   0xc8, 0x8f, 0x00, 0x04, 0x00, 0x7f, 0x00, 0x08,
+                   0x00, 0xfa, 0x00, 0x8f, 0x00, 0x04, 0x00, 0x7f,
+                   0x00, 0x08, 0x00, 0xfa, 0x00),
+        PHYREGS(0x0878, 0x0874, 0x0870, 0x01e4, 0x01e5, 0x01e5),
+  },
+  {     .freq                   = 5420,
+        RADIOREGS3(0x61, 0x01, 0x01, 0x02, 0x1e, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0d, 0x00,
+                   0xc8, 0x8e, 0x00, 0x04, 0x00, 0x7f, 0x00, 0x08,
+                   0x00, 0xfa, 0x00, 0x8e, 0x00, 0x04, 0x00, 0x7f,
+                   0x00, 0x08, 0x00, 0xfa, 0x00),
+        PHYREGS(0x087c, 0x0878, 0x0874, 0x01e3, 0x01e4, 0x01e5),
+  },
+  {     .freq                   = 5430,
+        RADIOREGS3(0x61, 0x01, 0x01, 0x02, 0x1f, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0d, 0x00,
+                   0xc8, 0x8e, 0x00, 0x04, 0x00, 0x7f, 0x00, 0x08,
+                   0x00, 0xfa, 0x00, 0x8e, 0x00, 0x04, 0x00, 0x7f,
+                   0x00, 0x08, 0x00, 0xfa, 0x00),
+        PHYREGS(0x0880, 0x087c, 0x0878, 0x01e2, 0x01e3, 0x01e4),
+  },
+  {     .freq                   = 5440,
+        RADIOREGS3(0x5a, 0x01, 0x01, 0x02, 0x20, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0d, 0x00,
+                   0xc8, 0x7e, 0x00, 0x04, 0x00, 0x7f, 0x00, 0x08,
+                   0x00, 0xfa, 0x00, 0x7e, 0x00, 0x04, 0x00, 0x7f,
+                   0x00, 0x08, 0x00, 0xfa, 0x00),
+        PHYREGS(0x0884, 0x0880, 0x087c, 0x01e1, 0x01e2, 0x01e3),
+  },
+  {     .freq                   = 5450,
+        RADIOREGS3(0x5a, 0x01, 0x01, 0x02, 0x21, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0d, 0x00,
+                   0xc8, 0x7d, 0x00, 0x04, 0x00, 0x7f, 0x00, 0x08,
+                   0x00, 0xfa, 0x00, 0x7d, 0x00, 0x04, 0x00, 0x7f,
+                   0x00, 0x08, 0x00, 0xfa, 0x00),
+        PHYREGS(0x0888, 0x0884, 0x0880, 0x01e0, 0x01e1, 0x01e2),
+  },
+  {     .freq                   = 5460,
+        RADIOREGS3(0x53, 0x01, 0x01, 0x02, 0x22, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0d, 0x00,
+                   0xc8, 0x6d, 0x00, 0x04, 0x00, 0x7f, 0x00, 0x08,
+                   0x00, 0xf8, 0x00, 0x6d, 0x00, 0x04, 0x00, 0x7f,
+                   0x00, 0x08, 0x00, 0xf8, 0x00),
+        PHYREGS(0x088c, 0x0888, 0x0884, 0x01df, 0x01e0, 0x01e1),
+  },
+  {     .freq                   = 5470,
+        RADIOREGS3(0x53, 0x01, 0x01, 0x02, 0x23, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0d, 0x00,
+                   0xc8, 0x6d, 0x00, 0x04, 0x00, 0x7f, 0x00, 0x08,
+                   0x00, 0xf8, 0x00, 0x6d, 0x00, 0x04, 0x00, 0x7f,
+                   0x00, 0x08, 0x00, 0xf8, 0x00),
+        PHYREGS(0x0890, 0x088c, 0x0888, 0x01de, 0x01df, 0x01e0),
+  },
+  {     .freq                   = 5480,
+        RADIOREGS3(0x4d, 0x01, 0x01, 0x02, 0x24, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0d, 0x00,
+                   0xc8, 0x5d, 0x00, 0x04, 0x00, 0x7f, 0x00, 0x08,
+                   0x00, 0xf8, 0x00, 0x5d, 0x00, 0x04, 0x00, 0x7f,
+                   0x00, 0x08, 0x00, 0xf8, 0x00),
+        PHYREGS(0x0894, 0x0890, 0x088c, 0x01dd, 0x01de, 0x01df),
+  },
+  {     .freq                   = 5490,
+        RADIOREGS3(0x4d, 0x01, 0x01, 0x02, 0x25, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0d, 0x00,
+                   0xc8, 0x5c, 0x00, 0x04, 0x00, 0x7f, 0x00, 0x08,
+                   0x00, 0xf8, 0x00, 0x5c, 0x00, 0x04, 0x00, 0x7f,
+                   0x00, 0x08, 0x00, 0xf8, 0x00),
+        PHYREGS(0x0898, 0x0894, 0x0890, 0x01dd, 0x01dd, 0x01de),
+  },
+  {     .freq                   = 5500,
+        RADIOREGS3(0x47, 0x01, 0x01, 0x02, 0x26, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0b, 0x00,
+                   0x84, 0x5c, 0x00, 0x03, 0x00, 0x7f, 0x00, 0x07,
+                   0x00, 0xf8, 0x00, 0x5c, 0x00, 0x03, 0x00, 0x7f,
+                   0x00, 0x07, 0x00, 0xf8, 0x00),
+        PHYREGS(0x089c, 0x0898, 0x0894, 0x01dc, 0x01dd, 0x01dd),
+  },
+  {     .freq                   = 5510,
+        RADIOREGS3(0x47, 0x01, 0x01, 0x02, 0x27, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0b, 0x00,
+                   0x84, 0x4c, 0x00, 0x03, 0x00, 0x7f, 0x00, 0x07,
+                   0x00, 0xf8, 0x00, 0x4c, 0x00, 0x03, 0x00, 0x7f,
+                   0x00, 0x07, 0x00, 0xf8, 0x00),
+        PHYREGS(0x08a0, 0x089c, 0x0898, 0x01db, 0x01dc, 0x01dd),
+  },
+  {     .freq                   = 5520,
+        RADIOREGS3(0x40, 0x01, 0x01, 0x02, 0x28, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0b, 0x00,
+                   0x84, 0x4c, 0x00, 0x03, 0x00, 0x7f, 0x00, 0x07,
+                   0x00, 0xf8, 0x00, 0x4c, 0x00, 0x03, 0x00, 0x7f,
+                   0x00, 0x07, 0x00, 0xf8, 0x00),
+        PHYREGS(0x08a4, 0x08a0, 0x089c, 0x01da, 0x01db, 0x01dc),
+  },
+  {     .freq                   = 5530,
+        RADIOREGS3(0x40, 0x01, 0x01, 0x02, 0x29, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0b, 0x00,
+                   0x84, 0x3b, 0x00, 0x03, 0x00, 0x7f, 0x00, 0x07,
+                   0x00, 0xf8, 0x00, 0x3b, 0x00, 0x03, 0x00, 0x7f,
+                   0x00, 0x07, 0x00, 0xf8, 0x00),
+        PHYREGS(0x08a8, 0x08a4, 0x08a0, 0x01d9, 0x01da, 0x01db),
+  },
+  {     .freq                   = 5540,
+        RADIOREGS3(0x3a, 0x01, 0x01, 0x02, 0x2a, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0b, 0x00,
+                   0x84, 0x3b, 0x00, 0x03, 0x00, 0x7f, 0x00, 0x07,
+                   0x00, 0xf8, 0x00, 0x3b, 0x00, 0x03, 0x00, 0x7f,
+                   0x00, 0x07, 0x00, 0xf8, 0x00),
+        PHYREGS(0x08ac, 0x08a8, 0x08a4, 0x01d8, 0x01d9, 0x01da),
+  },
+  {     .freq                   = 5550,
+        RADIOREGS3(0x3a, 0x01, 0x01, 0x02, 0x2b, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0b, 0x00,
+                   0x84, 0x3b, 0x00, 0x03, 0x00, 0x7f, 0x00, 0x07,
+                   0x00, 0xf8, 0x00, 0x3b, 0x00, 0x03, 0x00, 0x7f,
+                   0x00, 0x07, 0x00, 0xf8, 0x00),
+        PHYREGS(0x08b0, 0x08ac, 0x08a8, 0x01d7, 0x01d8, 0x01d9),
+  },
+  {     .freq                   = 5560,
+        RADIOREGS3(0x34, 0x01, 0x01, 0x02, 0x2c, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0b, 0x00,
+                   0x84, 0x2b, 0x00, 0x03, 0x00, 0x7f, 0x00, 0x07,
+                   0x00, 0xf8, 0x00, 0x2b, 0x00, 0x03, 0x00, 0x7f,
+                   0x00, 0x07, 0x00, 0xf8, 0x00),
+        PHYREGS(0x08b4, 0x08b0, 0x08ac, 0x01d7, 0x01d7, 0x01d8),
+  },
+  {     .freq                   = 5570,
+        RADIOREGS3(0x34, 0x01, 0x01, 0x02, 0x2d, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0b, 0x00,
+                   0x84, 0x2a, 0x00, 0x03, 0x00, 0x7f, 0x00, 0x07,
+                   0x00, 0xf8, 0x00, 0x2a, 0x00, 0x03, 0x00, 0x7f,
+                   0x00, 0x07, 0x00, 0xf8, 0x00),
+        PHYREGS(0x08b8, 0x08b4, 0x08b0, 0x01d6, 0x01d7, 0x01d7),
+  },
+  {     .freq                   = 5580,
+        RADIOREGS3(0x2e, 0x01, 0x01, 0x02, 0x2e, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0b, 0x00,
+                   0x84, 0x1a, 0x00, 0x03, 0x00, 0x7f, 0x00, 0x07,
+                   0x00, 0xf8, 0x00, 0x1a, 0x00, 0x03, 0x00, 0x7f,
+                   0x00, 0x07, 0x00, 0xf8, 0x00),
+        PHYREGS(0x08bc, 0x08b8, 0x08b4, 0x01d5, 0x01d6, 0x01d7),
+  },
+  {     .freq                   = 5590,
+        RADIOREGS3(0x2e, 0x01, 0x01, 0x02, 0x2f, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0b, 0x00,
+                   0x84, 0x1a, 0x00, 0x03, 0x00, 0x7f, 0x00, 0x07,
+                   0x00, 0xf8, 0x00, 0x1a, 0x00, 0x03, 0x00, 0x7f,
+                   0x00, 0x07, 0x00, 0xf8, 0x00),
+        PHYREGS(0x08c0, 0x08bc, 0x08b8, 0x01d4, 0x01d5, 0x01d6),
+  },
+  {     .freq                   = 5600,
+        RADIOREGS3(0x28, 0x01, 0x01, 0x02, 0x30, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8b, 0x09, 0x00,
+                   0x70, 0x1a, 0x00, 0x03, 0x00, 0x7f, 0x00, 0x07,
+                   0x00, 0xf8, 0x00, 0x1a, 0x00, 0x03, 0x00, 0x7f,
+                   0x00, 0x07, 0x00, 0xf8, 0x00),
+        PHYREGS(0x08c4, 0x08c0, 0x08bc, 0x01d3, 0x01d4, 0x01d5),
+  },
+  {     .freq                   = 5610,
+        RADIOREGS3(0x28, 0x01, 0x01, 0x02, 0x31, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8b, 0x09, 0x00,
+                   0x70, 0x19, 0x00, 0x03, 0x00, 0x7f, 0x00, 0x07,
+                   0x00, 0xf8, 0x00, 0x19, 0x00, 0x03, 0x00, 0x7f,
+                   0x00, 0x07, 0x00, 0xf8, 0x00),
+        PHYREGS(0x08c8, 0x08c4, 0x08c0, 0x01d2, 0x01d3, 0x01d4),
+  },
+  {     .freq                   = 5620,
+        RADIOREGS3(0x21, 0x01, 0x01, 0x02, 0x32, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8b, 0x09, 0x00,
+                   0x70, 0x19, 0x00, 0x03, 0x00, 0x7f, 0x00, 0x07,
+                   0x00, 0xf8, 0x00, 0x19, 0x00, 0x03, 0x00, 0x7f,
+                   0x00, 0x07, 0x00, 0xf8, 0x00),
+        PHYREGS(0x08cc, 0x08c8, 0x08c4, 0x01d2, 0x01d2, 0x01d3),
+  },
+  {     .freq                   = 5630,
+        RADIOREGS3(0x21, 0x01, 0x01, 0x02, 0x33, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8b, 0x09, 0x00,
+                   0x70, 0x09, 0x00, 0x03, 0x00, 0x7f, 0x00, 0x07,
+                   0x00, 0xf8, 0x00, 0x09, 0x00, 0x03, 0x00, 0x7f,
+                   0x00, 0x07, 0x00, 0xf8, 0x00),
+        PHYREGS(0x08d0, 0x08cc, 0x08c8, 0x01d1, 0x01d2, 0x01d2),
+  },
+  {     .freq                   = 5640,
+        RADIOREGS3(0x1c, 0x01, 0x01, 0x02, 0x34, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8b, 0x09, 0x00,
+                   0x70, 0x09, 0x00, 0x03, 0x00, 0x7f, 0x00, 0x07,
+                   0x00, 0xf8, 0x00, 0x09, 0x00, 0x03, 0x00, 0x7f,
+                   0x00, 0x07, 0x00, 0xf8, 0x00),
+        PHYREGS(0x08d4, 0x08d0, 0x08cc, 0x01d0, 0x01d1, 0x01d2),
+  },
+  {     .freq                   = 5650,
+        RADIOREGS3(0x1c, 0x01, 0x01, 0x02, 0x35, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8b, 0x09, 0x00,
+                   0x70, 0x08, 0x00, 0x03, 0x00, 0x7f, 0x00, 0x07,
+                   0x00, 0xf8, 0x00, 0x08, 0x00, 0x03, 0x00, 0x7f,
+                   0x00, 0x07, 0x00, 0xf8, 0x00),
+        PHYREGS(0x08d8, 0x08d4, 0x08d0, 0x01cf, 0x01d0, 0x01d1),
+  },
+  {     .freq                   = 5660,
+        RADIOREGS3(0x16, 0x01, 0x01, 0x02, 0x36, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8b, 0x09, 0x00,
+                   0x70, 0x08, 0x00, 0x03, 0x00, 0x7f, 0x00, 0x07,
+                   0x00, 0xf6, 0x00, 0x08, 0x00, 0x03, 0x00, 0x7f,
+                   0x00, 0x07, 0x00, 0xf6, 0x00),
+        PHYREGS(0x08dc, 0x08d8, 0x08d4, 0x01ce, 0x01cf, 0x01d0),
+  },
+  {     .freq                   = 5670,
+        RADIOREGS3(0x16, 0x01, 0x01, 0x02, 0x37, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8b, 0x09, 0x00,
+                   0x70, 0x08, 0x00, 0x03, 0x00, 0x7f, 0x00, 0x07,
+                   0x00, 0xf6, 0x00, 0x08, 0x00, 0x03, 0x00, 0x7f,
+                   0x00, 0x07, 0x00, 0xf6, 0x00),
+        PHYREGS(0x08e0, 0x08dc, 0x08d8, 0x01ce, 0x01ce, 0x01cf),
+  },
+  {     .freq                   = 5680,
+        RADIOREGS3(0x10, 0x01, 0x01, 0x02, 0x38, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8b, 0x09, 0x00,
+                   0x70, 0x08, 0x00, 0x03, 0x00, 0x7f, 0x00, 0x07,
+                   0x00, 0xf6, 0x00, 0x08, 0x00, 0x03, 0x00, 0x7f,
+                   0x00, 0x07, 0x00, 0xf6, 0x00),
+        PHYREGS(0x08e4, 0x08e0, 0x08dc, 0x01cd, 0x01ce, 0x01ce),
+  },
+  {     .freq                   = 5690,
+        RADIOREGS3(0x10, 0x01, 0x01, 0x02, 0x39, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8b, 0x09, 0x00,
+                   0x70, 0x07, 0x00, 0x03, 0x00, 0x7f, 0x00, 0x07,
+                   0x00, 0xf6, 0x00, 0x07, 0x00, 0x03, 0x00, 0x7f,
+                   0x00, 0x07, 0x00, 0xf6, 0x00),
+        PHYREGS(0x08e8, 0x08e4, 0x08e0, 0x01cc, 0x01cd, 0x01ce),
+  },
+  {     .freq                   = 5700,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3a, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x07, 0x00, 0x02, 0x00, 0x7f, 0x00, 0x06,
+                   0x00, 0xf6, 0x00, 0x07, 0x00, 0x02, 0x00, 0x7f,
+                   0x00, 0x06, 0x00, 0xf6, 0x00),
+        PHYREGS(0x08ec, 0x08e8, 0x08e4, 0x01cb, 0x01cc, 0x01cd),
+  },
+  {     .freq                   = 5710,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3b, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x07, 0x00, 0x02, 0x00, 0x7f, 0x00, 0x06,
+                   0x00, 0xf4, 0x00, 0x07, 0x00, 0x02, 0x00, 0x7f,
+                   0x00, 0x06, 0x00, 0xf4, 0x00),
+        PHYREGS(0x08f0, 0x08ec, 0x08e8, 0x01ca, 0x01cb, 0x01cc),
+  },
+  {     .freq                   = 5720,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3c, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x07, 0x00, 0x02, 0x00, 0x7f, 0x00, 0x06,
+                   0x00, 0xf4, 0x00, 0x07, 0x00, 0x02, 0x00, 0x7f,
+                   0x00, 0x06, 0x00, 0xf4, 0x00),
+        PHYREGS(0x08f4, 0x08f0, 0x08ec, 0x01c9, 0x01ca, 0x01cb),
+  },
+  {     .freq                   = 5725,
+        RADIOREGS3(0x03, 0x01, 0x02, 0x04, 0x79, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x06, 0x00, 0x02, 0x00, 0x7f, 0x00, 0x06,
+                   0x00, 0xf4, 0x00, 0x06, 0x00, 0x02, 0x00, 0x7f,
+                   0x00, 0x06, 0x00, 0xf4, 0x00),
+        PHYREGS(0x08f6, 0x08f2, 0x08ee, 0x01c9, 0x01ca, 0x01cb),
+  },
+  {     .freq                   = 5730,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3d, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x06, 0x00, 0x02, 0x00, 0x7f, 0x00, 0x06,
+                   0x00, 0xf4, 0x00, 0x06, 0x00, 0x02, 0x00, 0x7f,
+                   0x00, 0x06, 0x00, 0xf4, 0x00),
+        PHYREGS(0x08f8, 0x08f4, 0x08f0, 0x01c9, 0x01c9, 0x01ca),
+  },
+  {     .freq                   = 5735,
+        RADIOREGS3(0x03, 0x01, 0x02, 0x04, 0x7b, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x06, 0x00, 0x02, 0x00, 0x7f, 0x00, 0x06,
+                   0x00, 0xf4, 0x00, 0x06, 0x00, 0x02, 0x00, 0x7f,
+                   0x00, 0x06, 0x00, 0xf4, 0x00),
+        PHYREGS(0x08fa, 0x08f6, 0x08f2, 0x01c8, 0x01c9, 0x01ca),
+  },
+  {     .freq                   = 5740,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3e, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x06, 0x00, 0x02, 0x00, 0x7f, 0x00, 0x06,
+                   0x00, 0xf4, 0x00, 0x06, 0x00, 0x02, 0x00, 0x7f,
+                   0x00, 0x06, 0x00, 0xf4, 0x00),
+        PHYREGS(0x08fc, 0x08f8, 0x08f4, 0x01c8, 0x01c9, 0x01c9),
+  },
+  {     .freq                   = 5745,
+        RADIOREGS3(0xfe, 0x00, 0x02, 0x04, 0x7d, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x06, 0x00, 0x02, 0x00, 0x7f, 0x00, 0x06,
+                   0x00, 0xf4, 0x00, 0x06, 0x00, 0x02, 0x00, 0x7f,
+                   0x00, 0x06, 0x00, 0xf4, 0x00),
+        PHYREGS(0x08fe, 0x08fa, 0x08f6, 0x01c8, 0x01c8, 0x01c9),
+  },
+  {     .freq                   = 5750,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3f, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x06, 0x00, 0x02, 0x00, 0x7f, 0x00, 0x06,
+                   0x00, 0xf4, 0x00, 0x06, 0x00, 0x02, 0x00, 0x7f,
+                   0x00, 0x06, 0x00, 0xf4, 0x00),
+        PHYREGS(0x0900, 0x08fc, 0x08f8, 0x01c7, 0x01c8, 0x01c9),
+  },
+  {     .freq                   = 5755,
+        RADIOREGS3(0xfe, 0x00, 0x02, 0x04, 0x7f, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x05, 0x00, 0x02, 0x00, 0x7f, 0x00, 0x06,
+                   0x00, 0xf4, 0x00, 0x05, 0x00, 0x02, 0x00, 0x7f,
+                   0x00, 0x06, 0x00, 0xf4, 0x00),
+        PHYREGS(0x0902, 0x08fe, 0x08fa, 0x01c7, 0x01c8, 0x01c8),
+  },
+  {     .freq                   = 5760,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x40, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x05, 0x00, 0x02, 0x00, 0x7f, 0x00, 0x06,
+                   0x00, 0xf4, 0x00, 0x05, 0x00, 0x02, 0x00, 0x7f,
+                   0x00, 0x06, 0x00, 0xf4, 0x00),
+        PHYREGS(0x0904, 0x0900, 0x08fc, 0x01c6, 0x01c7, 0x01c8),
+  },
+  {     .freq                   = 5765,
+        RADIOREGS3(0xf8, 0x00, 0x02, 0x04, 0x81, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x05, 0x00, 0x02, 0x00, 0x7f, 0x00, 0x06,
+                   0x00, 0xf4, 0x00, 0x05, 0x00, 0x02, 0x00, 0x7f,
+                   0x00, 0x06, 0x00, 0xf4, 0x00),
+        PHYREGS(0x0906, 0x0902, 0x08fe, 0x01c6, 0x01c7, 0x01c8),
+  },
+  {     .freq                   = 5770,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x41, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x05, 0x00, 0x02, 0x00, 0x7f, 0x00, 0x06,
+                   0x00, 0xf4, 0x00, 0x05, 0x00, 0x02, 0x00, 0x7f,
+                   0x00, 0x06, 0x00, 0xf4, 0x00),
+        PHYREGS(0x0908, 0x0904, 0x0900, 0x01c6, 0x01c6, 0x01c7),
+  },
+  {     .freq                   = 5775,
+        RADIOREGS3(0xf8, 0x00, 0x02, 0x04, 0x83, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x05, 0x00, 0x02, 0x00, 0x7f, 0x00, 0x06,
+                   0x00, 0xf4, 0x00, 0x05, 0x00, 0x02, 0x00, 0x7f,
+                   0x00, 0x06, 0x00, 0xf4, 0x00),
+        PHYREGS(0x090a, 0x0906, 0x0902, 0x01c5, 0x01c6, 0x01c7),
+  },
+  {     .freq                   = 5780,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x42, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x05, 0x00, 0x02, 0x00, 0x7f, 0x00, 0x06,
+                   0x00, 0xf4, 0x00, 0x05, 0x00, 0x02, 0x00, 0x7f,
+                   0x00, 0x06, 0x00, 0xf4, 0x00),
+        PHYREGS(0x090c, 0x0908, 0x0904, 0x01c5, 0x01c6, 0x01c6),
+  },
+  {     .freq                   = 5785,
+        RADIOREGS3(0xf2, 0x00, 0x02, 0x04, 0x85, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x06, 0x06, 0x06, 0x8a, 0x06, 0x00,
+                   0x40, 0x04, 0x00, 0x02, 0x00, 0x7f, 0x00, 0x06,
+                   0x00, 0xf4, 0x00, 0x04, 0x00, 0x02, 0x00, 0x7f,
+                   0x00, 0x06, 0x00, 0xf4, 0x00),
+        PHYREGS(0x090e, 0x090a, 0x0906, 0x01c4, 0x01c5, 0x01c6),
+  },
+  {     .freq                   = 5790,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x43, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x8a, 0x06, 0x00,
+                   0x40, 0x04, 0x00, 0x02, 0x00, 0x7f, 0x00, 0x06,
+                   0x00, 0xf4, 0x00, 0x04, 0x00, 0x02, 0x00, 0x7f,
+                   0x00, 0x06, 0x00, 0xf4, 0x00),
+        PHYREGS(0x0910, 0x090c, 0x0908, 0x01c4, 0x01c5, 0x01c6),
+  },
+  {     .freq                   = 5795,
+        RADIOREGS3(0xf2, 0x00, 0x02, 0x04, 0x87, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x06, 0x06, 0x06, 0x8a, 0x06, 0x00,
+                   0x40, 0x04, 0x00, 0x02, 0x00, 0x7f, 0x00, 0x06,
+                   0x00, 0xf4, 0x00, 0x04, 0x00, 0x02, 0x00, 0x7f,
+                   0x00, 0x06, 0x00, 0xf4, 0x00),
+        PHYREGS(0x0912, 0x090e, 0x090a, 0x01c4, 0x01c4, 0x01c5),
+  },
+  {     .freq                   = 5800,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x44, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x88, 0x04, 0x00,
+                   0x20, 0x04, 0x00, 0x00, 0x00, 0x7f, 0x00, 0x06,
+                   0x00, 0xf4, 0x00, 0x04, 0x00, 0x00, 0x00, 0x7f,
+                   0x00, 0x06, 0x00, 0xf4, 0x00),
+        PHYREGS(0x0914, 0x0910, 0x090c, 0x01c3, 0x01c4, 0x01c5),
+  },
+  {     .freq                   = 5805,
+        RADIOREGS3(0xed, 0x00, 0x02, 0x04, 0x89, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x06, 0x06, 0x06, 0x88, 0x04, 0x00,
+                   0x20, 0x04, 0x00, 0x00, 0x00, 0x7f, 0x00, 0x06,
+                   0x00, 0xf4, 0x00, 0x04, 0x00, 0x00, 0x00, 0x7f,
+                   0x00, 0x06, 0x00, 0xf4, 0x00),
+        PHYREGS(0x0916, 0x0912, 0x090e, 0x01c3, 0x01c4, 0x01c4),
+  },
+  {     .freq                   = 5810,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x45, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x88, 0x04, 0x00,
+                   0x20, 0x04, 0x00, 0x00, 0x00, 0x7f, 0x00, 0x06,
+                   0x00, 0xf4, 0x00, 0x04, 0x00, 0x00, 0x00, 0x7f,
+                   0x00, 0x06, 0x00, 0xf4, 0x00),
+        PHYREGS(0x0918, 0x0914, 0x0910, 0x01c2, 0x01c3, 0x01c4),
+  },
+  {     .freq                   = 5815,
+        RADIOREGS3(0xed, 0x00, 0x02, 0x04, 0x8b, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x06, 0x06, 0x06, 0x88, 0x04, 0x00,
+                   0x20, 0x04, 0x00, 0x00, 0x00, 0x7f, 0x00, 0x06,
+                   0x00, 0xf4, 0x00, 0x04, 0x00, 0x00, 0x00, 0x7f,
+                   0x00, 0x06, 0x00, 0xf4, 0x00),
+        PHYREGS(0x091a, 0x0916, 0x0912, 0x01c2, 0x01c3, 0x01c4),
+  },
+  {     .freq                   = 5820,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x46, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x88, 0x04, 0x00,
+                   0x20, 0x03, 0x00, 0x00, 0x00, 0x7f, 0x00, 0x06,
+                   0x00, 0xf4, 0x00, 0x03, 0x00, 0x00, 0x00, 0x7f,
+                   0x00, 0x06, 0x00, 0xf4, 0x00),
+        PHYREGS(0x091c, 0x0918, 0x0914, 0x01c2, 0x01c2, 0x01c3),
+  },
+  {     .freq                   = 5825,
+        RADIOREGS3(0xed, 0x00, 0x02, 0x04, 0x8d, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x06, 0x06, 0x06, 0x88, 0x04, 0x00,
+                   0x20, 0x03, 0x00, 0x00, 0x00, 0x7f, 0x00, 0x06,
+                   0x00, 0xf4, 0x00, 0x03, 0x00, 0x00, 0x00, 0x7f,
+                   0x00, 0x06, 0x00, 0xf4, 0x00),
+        PHYREGS(0x091e, 0x091a, 0x0916, 0x01c1, 0x01c2, 0x01c3),
+  },
+  {     .freq                   = 5830,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x47, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x88, 0x04, 0x00,
+                   0x20, 0x03, 0x00, 0x00, 0x00, 0x7f, 0x00, 0x06,
+                   0x00, 0xf4, 0x00, 0x03, 0x00, 0x00, 0x00, 0x7f,
+                   0x00, 0x06, 0x00, 0xf4, 0x00),
+        PHYREGS(0x0920, 0x091c, 0x0918, 0x01c1, 0x01c2, 0x01c2),
+  },
+  {     .freq                   = 5840,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x48, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x88, 0x04, 0x00,
+                   0x20, 0x03, 0x00, 0x00, 0x00, 0x7f, 0x00, 0x06,
+                   0x00, 0xf4, 0x00, 0x03, 0x00, 0x00, 0x00, 0x7f,
+                   0x00, 0x06, 0x00, 0xf4, 0x00),
+        PHYREGS(0x0924, 0x0920, 0x091c, 0x01c0, 0x01c1, 0x01c2),
+  },
+  {     .freq                   = 5850,
+        RADIOREGS3(0xe0, 0x00, 0x01, 0x02, 0x49, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x88, 0x04, 0x00,
+                   0x20, 0x03, 0x00, 0x00, 0x00, 0x7f, 0x00, 0x06,
+                   0x00, 0xf4, 0x00, 0x03, 0x00, 0x00, 0x00, 0x7f,
+                   0x00, 0x06, 0x00, 0xf4, 0x00),
+        PHYREGS(0x0928, 0x0924, 0x0920, 0x01bf, 0x01c0, 0x01c1),
+  },
+  {     .freq                   = 5860,
+        RADIOREGS3(0xde, 0x00, 0x01, 0x02, 0x4a, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x88, 0x04, 0x00,
+                   0x20, 0x03, 0x00, 0x00, 0x00, 0x7f, 0x00, 0x06,
+                   0x00, 0xf2, 0x00, 0x03, 0x00, 0x00, 0x00, 0x7f,
+                   0x00, 0x06, 0x00, 0xf2, 0x00),
+        PHYREGS(0x092c, 0x0928, 0x0924, 0x01bf, 0x01bf, 0x01c0),
+  },
+  {     .freq                   = 5870,
+        RADIOREGS3(0xdb, 0x00, 0x01, 0x02, 0x4b, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x88, 0x04, 0x00,
+                   0x20, 0x02, 0x00, 0x00, 0x00, 0x7f, 0x00, 0x06,
+                   0x00, 0xf2, 0x00, 0x02, 0x00, 0x00, 0x00, 0x7f,
+                   0x00, 0x06, 0x00, 0xf2, 0x00),
+        PHYREGS(0x0930, 0x092c, 0x0928, 0x01be, 0x01bf, 0x01bf),
+  },
+  {     .freq                   = 5880,
+        RADIOREGS3(0xd8, 0x00, 0x01, 0x02, 0x4c, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x88, 0x04, 0x00,
+                   0x20, 0x02, 0x00, 0x00, 0x00, 0x7f, 0x00, 0x06,
+                   0x00, 0xf2, 0x00, 0x02, 0x00, 0x00, 0x00, 0x7f,
+                   0x00, 0x06, 0x00, 0xf2, 0x00),
+        PHYREGS(0x0934, 0x0930, 0x092c, 0x01bd, 0x01be, 0x01bf),
+  },
+  {     .freq                   = 5890,
+        RADIOREGS3(0xd6, 0x00, 0x01, 0x02, 0x4d, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x88, 0x04, 0x00,
+                   0x20, 0x02, 0x00, 0x00, 0x00, 0x7f, 0x00, 0x06,
+                   0x00, 0xf2, 0x00, 0x02, 0x00, 0x00, 0x00, 0x7f,
+                   0x00, 0x06, 0x00, 0xf2, 0x00),
+        PHYREGS(0x0938, 0x0934, 0x0930, 0x01bc, 0x01bd, 0x01be),
+  },
+  {     .freq                   = 5900,
+        RADIOREGS3(0xd3, 0x00, 0x01, 0x02, 0x4e, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x87, 0x03, 0x00,
+                   0x00, 0x02, 0x00, 0x00, 0x00, 0x7f, 0x00, 0x05,
+                   0x00, 0xf2, 0x00, 0x02, 0x00, 0x00, 0x00, 0x7f,
+                   0x00, 0x05, 0x00, 0xf2, 0x00),
+        PHYREGS(0x093c, 0x0938, 0x0934, 0x01bc, 0x01bc, 0x01bd),
+  },
+  {     .freq                   = 5910,
+        RADIOREGS3(0xd6, 0x00, 0x01, 0x02, 0x4f, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x87, 0x03, 0x00,
+                   0x00, 0x01, 0x00, 0x00, 0x00, 0x7f, 0x00, 0x05,
+                   0x00, 0xf2, 0x00, 0x01, 0x00, 0x00, 0x00, 0x7f,
+                   0x00, 0x05, 0x00, 0xf2, 0x00),
+        PHYREGS(0x0940, 0x093c, 0x0938, 0x01bb, 0x01bc, 0x01bc),
+  },
+  {     .freq                   = 2412,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x6c, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x04, 0x04, 0x04, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0xff, 0x00, 0x05, 0x00, 0x70, 0x00,
+                   0x0f, 0x00, 0x0f, 0x00, 0xff, 0x00, 0x05, 0x00,
+                   0x70, 0x00, 0x0f, 0x00, 0x0f),
+        PHYREGS(0x03c9, 0x03c5, 0x03c1, 0x043a, 0x043f, 0x0443),
+  },
+  {     .freq                   = 2417,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x71, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0xff, 0x00, 0x05, 0x00, 0x70, 0x00,
+                   0x0f, 0x00, 0x0f, 0x00, 0xff, 0x00, 0x05, 0x00,
+                   0x70, 0x00, 0x0f, 0x00, 0x0f),
+        PHYREGS(0x03cb, 0x03c7, 0x03c3, 0x0438, 0x043d, 0x0441),
+  },
+  {     .freq                   = 2422,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x76, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0xff, 0x00, 0x05, 0x00, 0x70, 0x00,
+                   0x0f, 0x00, 0x0f, 0x00, 0xff, 0x00, 0x05, 0x00,
+                   0x70, 0x00, 0x0f, 0x00, 0x0f),
+        PHYREGS(0x03cd, 0x03c9, 0x03c5, 0x0436, 0x043a, 0x043f),
+  },
+  {     .freq                   = 2427,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x7b, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0xfd, 0x00, 0x05, 0x00, 0x70, 0x00,
+                   0x0f, 0x00, 0x0f, 0x00, 0xfd, 0x00, 0x05, 0x00,
+                   0x70, 0x00, 0x0f, 0x00, 0x0f),
+        PHYREGS(0x03cf, 0x03cb, 0x03c7, 0x0434, 0x0438, 0x043d),
+  },
+  {     .freq                   = 2432,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x80, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0xfb, 0x00, 0x05, 0x00, 0x70, 0x00,
+                   0x0f, 0x00, 0x0f, 0x00, 0xfb, 0x00, 0x05, 0x00,
+                   0x70, 0x00, 0x0f, 0x00, 0x0f),
+        PHYREGS(0x03d1, 0x03cd, 0x03c9, 0x0431, 0x0436, 0x043a),
+  },
+  {     .freq                   = 2437,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x85, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0xfa, 0x00, 0x05, 0x00, 0x70, 0x00,
+                   0x0f, 0x00, 0x0f, 0x00, 0xfa, 0x00, 0x05, 0x00,
+                   0x70, 0x00, 0x0f, 0x00, 0x0f),
+        PHYREGS(0x03d3, 0x03cf, 0x03cb, 0x042f, 0x0434, 0x0438),
+  },
+  {     .freq                   = 2442,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x8a, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0xf8, 0x00, 0x05, 0x00, 0x70, 0x00,
+                   0x0f, 0x00, 0x0f, 0x00, 0xf8, 0x00, 0x05, 0x00,
+                   0x70, 0x00, 0x0f, 0x00, 0x0f),
+        PHYREGS(0x03d5, 0x03d1, 0x03cd, 0x042d, 0x0431, 0x0436),
+  },
+  {     .freq                   = 2447,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x8f, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x06, 0x06, 0x06, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0xf7, 0x00, 0x05, 0x00, 0x70, 0x00,
+                   0x0f, 0x00, 0x0f, 0x00, 0xf7, 0x00, 0x05, 0x00,
+                   0x70, 0x00, 0x0f, 0x00, 0x0f),
+        PHYREGS(0x03d7, 0x03d3, 0x03cf, 0x042b, 0x042f, 0x0434),
+  },
+  {     .freq                   = 2452,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x94, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x06, 0x06, 0x06, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0xf6, 0x00, 0x05, 0x00, 0x70, 0x00,
+                   0x0f, 0x00, 0x0f, 0x00, 0xf6, 0x00, 0x05, 0x00,
+                   0x70, 0x00, 0x0f, 0x00, 0x0f),
+        PHYREGS(0x03d9, 0x03d5, 0x03d1, 0x0429, 0x042d, 0x0431),
+  },
+  {     .freq                   = 2457,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x99, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x06, 0x06, 0x06, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0xf5, 0x00, 0x05, 0x00, 0x70, 0x00,
+                   0x0f, 0x00, 0x0d, 0x00, 0xf5, 0x00, 0x05, 0x00,
+                   0x70, 0x00, 0x0f, 0x00, 0x0d),
+        PHYREGS(0x03db, 0x03d7, 0x03d3, 0x0427, 0x042b, 0x042f),
+  },
+  {     .freq                   = 2462,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x9e, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x06, 0x06, 0x06, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0xf4, 0x00, 0x05, 0x00, 0x70, 0x00,
+                   0x0f, 0x00, 0x0d, 0x00, 0xf4, 0x00, 0x05, 0x00,
+                   0x70, 0x00, 0x0f, 0x00, 0x0d),
+        PHYREGS(0x03dd, 0x03d9, 0x03d5, 0x0424, 0x0429, 0x042d),
+  },
+  {     .freq                   = 2467,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0xa3, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x06, 0x06, 0x06, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0xf3, 0x00, 0x05, 0x00, 0x70, 0x00,
+                   0x0f, 0x00, 0x0d, 0x00, 0xf3, 0x00, 0x05, 0x00,
+                   0x70, 0x00, 0x0f, 0x00, 0x0d),
+        PHYREGS(0x03df, 0x03db, 0x03d7, 0x0422, 0x0427, 0x042b),
+  },
+  {     .freq                   = 2472,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0xa8, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x07, 0x07, 0x07, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0xf2, 0x00, 0x05, 0x00, 0x70, 0x00,
+                   0x0f, 0x00, 0x0d, 0x00, 0xf2, 0x00, 0x05, 0x00,
+                   0x70, 0x00, 0x0f, 0x00, 0x0d),
+        PHYREGS(0x03e1, 0x03dd, 0x03d9, 0x0420, 0x0424, 0x0429),
+  },
+  {     .freq                   = 2484,
+        RADIOREGS3(0xff, 0x01, 0x03, 0x09, 0xb4, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x07, 0x07, 0x07, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0xf0, 0x00, 0x05, 0x00, 0x70, 0x00,
+                   0x0f, 0x00, 0x0d, 0x00, 0xf0, 0x00, 0x05, 0x00,
+                   0x70, 0x00, 0x0f, 0x00, 0x0d),
+        PHYREGS(0x03e6, 0x03e2, 0x03de, 0x041b, 0x041f, 0x0424),
+  },
+};
+
+static const struct b43_nphy_channeltab_entry_rev3 b43_nphy_channeltab_rev4[] = {
+  {     .freq                   = 4920,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xec, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x00, 0x00, 0x00, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0e, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xff, 0x00, 0xff, 0x00, 0x0e, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xff, 0x00),
+        PHYREGS(0x07b4, 0x07b0, 0x07ac, 0x0214, 0x0215, 0x0216),
+  },
+  {     .freq                   = 4930,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xed, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x00, 0x00, 0x00, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0e, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xff, 0x00, 0xff, 0x00, 0x0e, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xff, 0x00),
+        PHYREGS(0x07b8, 0x07b4, 0x07b0, 0x0213, 0x0214, 0x0215),
+  },
+  {     .freq                   = 4940,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xee, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x00, 0x00, 0x00, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0e, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xff, 0x00, 0xff, 0x00, 0x0e, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xff, 0x00),
+        PHYREGS(0x07bc, 0x07b8, 0x07b4, 0x0212, 0x0213, 0x0214),
+  },
+  {     .freq                   = 4950,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xef, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x00, 0x00, 0x00, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0e, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xff, 0x00, 0xff, 0x00, 0x0e, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xff, 0x00),
+        PHYREGS(0x07c0, 0x07bc, 0x07b8, 0x0211, 0x0212, 0x0213),
+  },
+  {     .freq                   = 4960,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf0, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0e, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xff, 0x00, 0xff, 0x00, 0x0e, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xff, 0x00),
+        PHYREGS(0x07c4, 0x07c0, 0x07bc, 0x020f, 0x0211, 0x0212),
+  },
+  {     .freq                   = 4970,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf1, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0e, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xff, 0x00, 0xff, 0x00, 0x0e, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xff, 0x00),
+        PHYREGS(0x07c8, 0x07c4, 0x07c0, 0x020e, 0x020f, 0x0211),
+  },
+  {     .freq                   = 4980,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf2, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0e, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xff, 0x00, 0xff, 0x00, 0x0e, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xff, 0x00),
+        PHYREGS(0x07cc, 0x07c8, 0x07c4, 0x020d, 0x020e, 0x020f),
+  },
+  {     .freq                   = 4990,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf3, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0e, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xff, 0x00, 0xff, 0x00, 0x0e, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xff, 0x00),
+        PHYREGS(0x07d0, 0x07cc, 0x07c8, 0x020c, 0x020d, 0x020e),
+  },
+  {     .freq                   = 5000,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf4, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0d, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xff, 0x00, 0xff, 0x00, 0x0d, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xff, 0x00),
+        PHYREGS(0x07d4, 0x07d0, 0x07cc, 0x020b, 0x020c, 0x020d),
+  },
+  {     .freq                   = 5010,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf5, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0d, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xff, 0x00, 0xff, 0x00, 0x0d, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xff, 0x00),
+        PHYREGS(0x07d8, 0x07d4, 0x07d0, 0x020a, 0x020b, 0x020c),
+  },
+  {     .freq                   = 5020,
+        RADIOREGS3(0xf7, 0x01, 0x01, 0x01, 0xf6, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0d, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xff, 0x00, 0xff, 0x00, 0x0d, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xff, 0x00),
+        PHYREGS(0x07dc, 0x07d8, 0x07d4, 0x0209, 0x020a, 0x020b),
+  },
+  {     .freq                   = 5030,
+        RADIOREGS3(0xf7, 0x01, 0x01, 0x01, 0xf7, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0d, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xff, 0x00, 0xff, 0x00, 0x0d, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xff, 0x00),
+        PHYREGS(0x07e0, 0x07dc, 0x07d8, 0x0208, 0x0209, 0x020a),
+  },
+  {     .freq                   = 5040,
+        RADIOREGS3(0xef, 0x01, 0x01, 0x01, 0xf8, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0d, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xff, 0x00, 0xff, 0x00, 0x0d, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xff, 0x00),
+        PHYREGS(0x07e4, 0x07e0, 0x07dc, 0x0207, 0x0208, 0x0209),
+  },
+  {     .freq                   = 5050,
+        RADIOREGS3(0xef, 0x01, 0x01, 0x01, 0xf9, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0d, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xff, 0x00, 0xff, 0x00, 0x0d, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xff, 0x00),
+        PHYREGS(0x07e8, 0x07e4, 0x07e0, 0x0206, 0x0207, 0x0208),
+  },
+  {     .freq                   = 5060,
+        RADIOREGS3(0xe6, 0x01, 0x01, 0x01, 0xfa, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0d, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xff, 0x00, 0xff, 0x00, 0x0d, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xff, 0x00),
+        PHYREGS(0x07ec, 0x07e8, 0x07e4, 0x0205, 0x0206, 0x0207),
+  },
+  {     .freq                   = 5070,
+        RADIOREGS3(0xe6, 0x01, 0x01, 0x01, 0xfb, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0d, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xff, 0x00, 0xff, 0x00, 0x0d, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xff, 0x00),
+        PHYREGS(0x07f0, 0x07ec, 0x07e8, 0x0204, 0x0205, 0x0206),
+  },
+  {     .freq                   = 5080,
+        RADIOREGS3(0xde, 0x01, 0x01, 0x01, 0xfc, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0d, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xff, 0x00, 0xff, 0x00, 0x0d, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xff, 0x00),
+        PHYREGS(0x07f4, 0x07f0, 0x07ec, 0x0203, 0x0204, 0x0205),
+  },
+  {     .freq                   = 5090,
+        RADIOREGS3(0xde, 0x01, 0x01, 0x01, 0xfd, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0d, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xff, 0x00, 0xff, 0x00, 0x0d, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xff, 0x00),
+        PHYREGS(0x07f8, 0x07f4, 0x07f0, 0x0202, 0x0203, 0x0204),
+  },
+  {     .freq                   = 5100,
+        RADIOREGS3(0xd6, 0x01, 0x01, 0x01, 0xfe, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0c, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xfe, 0x00, 0xff, 0x00, 0x0c, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xfe, 0x00),
+        PHYREGS(0x07fc, 0x07f8, 0x07f4, 0x0201, 0x0202, 0x0203),
+  },
+  {     .freq                   = 5110,
+        RADIOREGS3(0xd6, 0x01, 0x01, 0x01, 0xff, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0c, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xfe, 0x00, 0xff, 0x00, 0x0c, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xfe, 0x00),
+        PHYREGS(0x0800, 0x07fc, 0x07f8, 0x0200, 0x0201, 0x0202),
+  },
+  {     .freq                   = 5120,
+        RADIOREGS3(0xce, 0x01, 0x01, 0x02, 0x00, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0c, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xfe, 0x00, 0xff, 0x00, 0x0c, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xfe, 0x00),
+        PHYREGS(0x0804, 0x0800, 0x07fc, 0x01ff, 0x0200, 0x0201),
+  },
+  {     .freq                   = 5130,
+        RADIOREGS3(0xce, 0x01, 0x01, 0x02, 0x01, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0c, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xfe, 0x00, 0xff, 0x00, 0x0c, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xfe, 0x00),
+        PHYREGS(0x0808, 0x0804, 0x0800, 0x01fe, 0x01ff, 0x0200),
+  },
+  {     .freq                   = 5140,
+        RADIOREGS3(0xc6, 0x01, 0x01, 0x02, 0x02, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0c, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xfe, 0x00, 0xff, 0x00, 0x0c, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xfe, 0x00),
+        PHYREGS(0x080c, 0x0808, 0x0804, 0x01fd, 0x01fe, 0x01ff),
+  },
+  {     .freq                   = 5160,
+        RADIOREGS3(0xbe, 0x01, 0x01, 0x02, 0x04, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0c, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xfe, 0x00, 0xff, 0x00, 0x0c, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xfe, 0x00),
+        PHYREGS(0x0814, 0x0810, 0x080c, 0x01fb, 0x01fc, 0x01fd),
+  },
+  {     .freq                   = 5170,
+        RADIOREGS3(0xbe, 0x01, 0x01, 0x02, 0x05, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0c, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xfe, 0x00, 0xff, 0x00, 0x0c, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xfe, 0x00),
+        PHYREGS(0x0818, 0x0814, 0x0810, 0x01fa, 0x01fb, 0x01fc),
+  },
+  {     .freq                   = 5180,
+        RADIOREGS3(0xb6, 0x01, 0x01, 0x02, 0x06, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xef, 0x00, 0x0c, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xfe, 0x00, 0xef, 0x00, 0x0c, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xfe, 0x00),
+        PHYREGS(0x081c, 0x0818, 0x0814, 0x01f9, 0x01fa, 0x01fb),
+  },
+  {     .freq                   = 5190,
+        RADIOREGS3(0xb6, 0x01, 0x01, 0x02, 0x07, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xef, 0x00, 0x0c, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xfe, 0x00, 0xef, 0x00, 0x0c, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xfe, 0x00),
+        PHYREGS(0x0820, 0x081c, 0x0818, 0x01f8, 0x01f9, 0x01fa),
+  },
+  {     .freq                   = 5200,
+        RADIOREGS3(0xaf, 0x01, 0x01, 0x02, 0x08, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xef, 0x00, 0x0a, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xfc, 0x00, 0xef, 0x00, 0x0a, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xfc, 0x00),
+        PHYREGS(0x0824, 0x0820, 0x081c, 0x01f7, 0x01f8, 0x01f9),
+  },
+  {     .freq                   = 5210,
+        RADIOREGS3(0xaf, 0x01, 0x01, 0x02, 0x09, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xdf, 0x00, 0x0a, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xfc, 0x00, 0xdf, 0x00, 0x0a, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xfc, 0x00),
+        PHYREGS(0x0828, 0x0824, 0x0820, 0x01f6, 0x01f7, 0x01f8),
+  },
+  {     .freq                   = 5220,
+        RADIOREGS3(0xa7, 0x01, 0x01, 0x02, 0x0a, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xdf, 0x00, 0x0a, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xfc, 0x00, 0xdf, 0x00, 0x0a, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xfc, 0x00),
+        PHYREGS(0x082c, 0x0828, 0x0824, 0x01f5, 0x01f6, 0x01f7),
+  },
+  {     .freq                   = 5230,
+        RADIOREGS3(0xa7, 0x01, 0x01, 0x02, 0x0b, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xdf, 0x00, 0x0a, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xfc, 0x00, 0xdf, 0x00, 0x0a, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xfc, 0x00),
+        PHYREGS(0x0830, 0x082c, 0x0828, 0x01f4, 0x01f5, 0x01f6),
+  },
+  {     .freq                   = 5240,
+        RADIOREGS3(0xa0, 0x01, 0x01, 0x02, 0x0c, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xcf, 0x00, 0x0a, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xfc, 0x00, 0xcf, 0x00, 0x0a, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xfc, 0x00),
+        PHYREGS(0x0834, 0x0830, 0x082c, 0x01f3, 0x01f4, 0x01f5),
+  },
+  {     .freq                   = 5250,
+        RADIOREGS3(0xa0, 0x01, 0x01, 0x02, 0x0d, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xcf, 0x00, 0x0a, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xfc, 0x00, 0xcf, 0x00, 0x0a, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xfc, 0x00),
+        PHYREGS(0x0838, 0x0834, 0x0830, 0x01f2, 0x01f3, 0x01f4),
+  },
+  {     .freq                   = 5260,
+        RADIOREGS3(0x98, 0x01, 0x01, 0x02, 0x0e, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xcf, 0x00, 0x0a, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xfc, 0x00, 0xcf, 0x00, 0x0a, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xfc, 0x00),
+        PHYREGS(0x083c, 0x0838, 0x0834, 0x01f1, 0x01f2, 0x01f3),
+  },
+  {     .freq                   = 5270,
+        RADIOREGS3(0x98, 0x01, 0x01, 0x02, 0x0f, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8f, 0x0f, 0x00,
+                   0xff, 0xcf, 0x00, 0x0a, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xfc, 0x00, 0xcf, 0x00, 0x0a, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xfc, 0x00),
+        PHYREGS(0x0840, 0x083c, 0x0838, 0x01f0, 0x01f1, 0x01f2),
+  },
+  {     .freq                   = 5280,
+        RADIOREGS3(0x91, 0x01, 0x01, 0x02, 0x10, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8f, 0x0f, 0x00,
+                   0xff, 0xbf, 0x00, 0x0a, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xfc, 0x00, 0xbf, 0x00, 0x0a, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xfc, 0x00),
+        PHYREGS(0x0844, 0x0840, 0x083c, 0x01f0, 0x01f0, 0x01f1),
+  },
+  {     .freq                   = 5290,
+        RADIOREGS3(0x91, 0x01, 0x01, 0x02, 0x11, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8f, 0x0f, 0x00,
+                   0xff, 0xbf, 0x00, 0x0a, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xfc, 0x00, 0xbf, 0x00, 0x0a, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xfc, 0x00),
+        PHYREGS(0x0848, 0x0844, 0x0840, 0x01ef, 0x01f0, 0x01f0),
+  },
+  {     .freq                   = 5300,
+        RADIOREGS3(0x8a, 0x01, 0x01, 0x02, 0x12, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8f, 0x0e, 0x00,
+                   0xff, 0xbf, 0x00, 0x08, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xfa, 0x00, 0xbf, 0x00, 0x08, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xfa, 0x00),
+        PHYREGS(0x084c, 0x0848, 0x0844, 0x01ee, 0x01ef, 0x01f0),
+  },
+  {     .freq                   = 5310,
+        RADIOREGS3(0x8a, 0x01, 0x01, 0x02, 0x13, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8f, 0x0e, 0x00,
+                   0xff, 0xbf, 0x00, 0x08, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xfa, 0x00, 0xbf, 0x00, 0x08, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xfa, 0x00),
+        PHYREGS(0x0850, 0x084c, 0x0848, 0x01ed, 0x01ee, 0x01ef),
+  },
+  {     .freq                   = 5320,
+        RADIOREGS3(0x83, 0x01, 0x01, 0x02, 0x14, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8f, 0x0e, 0x00,
+                   0xff, 0xbf, 0x00, 0x08, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xfa, 0x00, 0xbf, 0x00, 0x08, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xfa, 0x00),
+        PHYREGS(0x0854, 0x0850, 0x084c, 0x01ec, 0x01ed, 0x01ee),
+  },
+  {     .freq                   = 5330,
+        RADIOREGS3(0x83, 0x01, 0x01, 0x02, 0x15, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8f, 0x0e, 0x00,
+                   0xff, 0xaf, 0x00, 0x08, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xfa, 0x00, 0xaf, 0x00, 0x08, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xfa, 0x00),
+        PHYREGS(0x0858, 0x0854, 0x0850, 0x01eb, 0x01ec, 0x01ed),
+  },
+  {     .freq                   = 5340,
+        RADIOREGS3(0x7c, 0x01, 0x01, 0x02, 0x16, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8f, 0x0e, 0x00,
+                   0xff, 0xaf, 0x00, 0x08, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xfa, 0x00, 0xaf, 0x00, 0x08, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xfa, 0x00),
+        PHYREGS(0x085c, 0x0858, 0x0854, 0x01ea, 0x01eb, 0x01ec),
+  },
+  {     .freq                   = 5350,
+        RADIOREGS3(0x7c, 0x01, 0x01, 0x02, 0x17, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8f, 0x0e, 0x00,
+                   0xff, 0x9f, 0x00, 0x08, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xfa, 0x00, 0x9f, 0x00, 0x08, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xfa, 0x00),
+        PHYREGS(0x0860, 0x085c, 0x0858, 0x01e9, 0x01ea, 0x01eb),
+  },
+  {     .freq                   = 5360,
+        RADIOREGS3(0x75, 0x01, 0x01, 0x02, 0x18, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8f, 0x0e, 0x00,
+                   0xff, 0x9f, 0x00, 0x08, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xfa, 0x00, 0x9f, 0x00, 0x08, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xfa, 0x00),
+        PHYREGS(0x0864, 0x0860, 0x085c, 0x01e8, 0x01e9, 0x01ea),
+  },
+  {     .freq                   = 5370,
+        RADIOREGS3(0x75, 0x01, 0x01, 0x02, 0x19, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8f, 0x0e, 0x00,
+                   0xff, 0x9f, 0x00, 0x08, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xfa, 0x00, 0x9f, 0x00, 0x08, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xfa, 0x00),
+        PHYREGS(0x0868, 0x0864, 0x0860, 0x01e7, 0x01e8, 0x01e9),
+  },
+  {     .freq                   = 5380,
+        RADIOREGS3(0x6e, 0x01, 0x01, 0x02, 0x1a, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8f, 0x0e, 0x00,
+                   0xff, 0x9f, 0x00, 0x08, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xfa, 0x00, 0x9f, 0x00, 0x08, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xfa, 0x00),
+        PHYREGS(0x086c, 0x0868, 0x0864, 0x01e6, 0x01e7, 0x01e8),
+  },
+  {     .freq                   = 5390,
+        RADIOREGS3(0x6e, 0x01, 0x01, 0x02, 0x1b, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8f, 0x0e, 0x00,
+                   0xff, 0x8f, 0x00, 0x08, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xfa, 0x00, 0x8f, 0x00, 0x08, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xfa, 0x00),
+        PHYREGS(0x0870, 0x086c, 0x0868, 0x01e5, 0x01e6, 0x01e7),
+  },
+  {     .freq                   = 5400,
+        RADIOREGS3(0x67, 0x01, 0x01, 0x02, 0x1c, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0d, 0x00,
+                   0xc8, 0x8f, 0x00, 0x07, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xf8, 0x00, 0x8f, 0x00, 0x07, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xf8, 0x00),
+        PHYREGS(0x0874, 0x0870, 0x086c, 0x01e5, 0x01e5, 0x01e6),
+  },
+  {     .freq                   = 5410,
+        RADIOREGS3(0x67, 0x01, 0x01, 0x02, 0x1d, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0d, 0x00,
+                   0xc8, 0x8f, 0x00, 0x07, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xf8, 0x00, 0x8f, 0x00, 0x07, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xf8, 0x00),
+        PHYREGS(0x0878, 0x0874, 0x0870, 0x01e4, 0x01e5, 0x01e5),
+  },
+  {     .freq                   = 5420,
+        RADIOREGS3(0x61, 0x01, 0x01, 0x02, 0x1e, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0d, 0x00,
+                   0xc8, 0x8e, 0x00, 0x07, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xf8, 0x00, 0x8e, 0x00, 0x07, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xf8, 0x00),
+        PHYREGS(0x087c, 0x0878, 0x0874, 0x01e3, 0x01e4, 0x01e5),
+  },
+  {     .freq                   = 5430,
+        RADIOREGS3(0x61, 0x01, 0x01, 0x02, 0x1f, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0d, 0x00,
+                   0xc8, 0x8e, 0x00, 0x07, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xf8, 0x00, 0x8e, 0x00, 0x07, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xf8, 0x00),
+        PHYREGS(0x0880, 0x087c, 0x0878, 0x01e2, 0x01e3, 0x01e4),
+  },
+  {     .freq                   = 5440,
+        RADIOREGS3(0x5a, 0x01, 0x01, 0x02, 0x20, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0d, 0x00,
+                   0xc8, 0x7e, 0x00, 0x07, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xf8, 0x00, 0x7e, 0x00, 0x07, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xf8, 0x00),
+        PHYREGS(0x0884, 0x0880, 0x087c, 0x01e1, 0x01e2, 0x01e3),
+  },
+  {     .freq                   = 5450,
+        RADIOREGS3(0x5a, 0x01, 0x01, 0x02, 0x21, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0d, 0x00,
+                   0xc8, 0x7d, 0x00, 0x07, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xf8, 0x00, 0x7d, 0x00, 0x07, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xf8, 0x00),
+        PHYREGS(0x0888, 0x0884, 0x0880, 0x01e0, 0x01e1, 0x01e2),
+  },
+  {     .freq                   = 5460,
+        RADIOREGS3(0x53, 0x01, 0x01, 0x02, 0x22, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0d, 0x00,
+                   0xc8, 0x6d, 0x00, 0x07, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xf8, 0x00, 0x6d, 0x00, 0x07, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xf8, 0x00),
+        PHYREGS(0x088c, 0x0888, 0x0884, 0x01df, 0x01e0, 0x01e1),
+  },
+  {     .freq                   = 5470,
+        RADIOREGS3(0x53, 0x01, 0x01, 0x02, 0x23, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0d, 0x00,
+                   0xc8, 0x6d, 0x00, 0x07, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xf8, 0x00, 0x6d, 0x00, 0x07, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xf8, 0x00),
+        PHYREGS(0x0890, 0x088c, 0x0888, 0x01de, 0x01df, 0x01e0),
+  },
+  {     .freq                   = 5480,
+        RADIOREGS3(0x4d, 0x01, 0x01, 0x02, 0x24, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0d, 0x00,
+                   0xc8, 0x5d, 0x00, 0x07, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xf8, 0x00, 0x5d, 0x00, 0x07, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xf8, 0x00),
+        PHYREGS(0x0894, 0x0890, 0x088c, 0x01dd, 0x01de, 0x01df),
+  },
+  {     .freq                   = 5490,
+        RADIOREGS3(0x4d, 0x01, 0x01, 0x02, 0x25, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0d, 0x00,
+                   0xc8, 0x5c, 0x00, 0x07, 0x00, 0x7f, 0x00, 0x0f,
+                   0x00, 0xf8, 0x00, 0x5c, 0x00, 0x07, 0x00, 0x7f,
+                   0x00, 0x0f, 0x00, 0xf8, 0x00),
+        PHYREGS(0x0898, 0x0894, 0x0890, 0x01dd, 0x01dd, 0x01de),
+  },
+  {     .freq                   = 5500,
+        RADIOREGS3(0x47, 0x01, 0x01, 0x02, 0x26, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0b, 0x00,
+                   0x84, 0x5c, 0x00, 0x06, 0x00, 0x7f, 0x00, 0x0d,
+                   0x00, 0xf6, 0x00, 0x5c, 0x00, 0x06, 0x00, 0x7f,
+                   0x00, 0x0d, 0x00, 0xf6, 0x00),
+        PHYREGS(0x089c, 0x0898, 0x0894, 0x01dc, 0x01dd, 0x01dd),
+  },
+  {     .freq                   = 5510,
+        RADIOREGS3(0x47, 0x01, 0x01, 0x02, 0x27, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0b, 0x00,
+                   0x84, 0x4c, 0x00, 0x06, 0x00, 0x7f, 0x00, 0x0d,
+                   0x00, 0xf6, 0x00, 0x4c, 0x00, 0x06, 0x00, 0x7f,
+                   0x00, 0x0d, 0x00, 0xf6, 0x00),
+        PHYREGS(0x08a0, 0x089c, 0x0898, 0x01db, 0x01dc, 0x01dd),
+  },
+  {     .freq                   = 5520,
+        RADIOREGS3(0x40, 0x01, 0x01, 0x02, 0x28, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0b, 0x00,
+                   0x84, 0x4c, 0x00, 0x06, 0x00, 0x7f, 0x00, 0x0d,
+                   0x00, 0xf6, 0x00, 0x4c, 0x00, 0x06, 0x00, 0x7f,
+                   0x00, 0x0d, 0x00, 0xf6, 0x00),
+        PHYREGS(0x08a4, 0x08a0, 0x089c, 0x01da, 0x01db, 0x01dc),
+  },
+  {     .freq                   = 5530,
+        RADIOREGS3(0x40, 0x01, 0x01, 0x02, 0x29, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0b, 0x00,
+                   0x84, 0x3b, 0x00, 0x06, 0x00, 0x7f, 0x00, 0x0d,
+                   0x00, 0xf6, 0x00, 0x3b, 0x00, 0x06, 0x00, 0x7f,
+                   0x00, 0x0d, 0x00, 0xf6, 0x00),
+        PHYREGS(0x08a8, 0x08a4, 0x08a0, 0x01d9, 0x01da, 0x01db),
+  },
+  {     .freq                   = 5540,
+        RADIOREGS3(0x3a, 0x01, 0x01, 0x02, 0x2a, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0b, 0x00,
+                   0x84, 0x3b, 0x00, 0x06, 0x00, 0x7f, 0x00, 0x0d,
+                   0x00, 0xf6, 0x00, 0x3b, 0x00, 0x06, 0x00, 0x7f,
+                   0x00, 0x0d, 0x00, 0xf6, 0x00),
+        PHYREGS(0x08ac, 0x08a8, 0x08a4, 0x01d8, 0x01d9, 0x01da),
+  },
+  {     .freq                   = 5550,
+        RADIOREGS3(0x3a, 0x01, 0x01, 0x02, 0x2b, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0b, 0x00,
+                   0x84, 0x3b, 0x00, 0x06, 0x00, 0x7f, 0x00, 0x0d,
+                   0x00, 0xf6, 0x00, 0x3b, 0x00, 0x06, 0x00, 0x7f,
+                   0x00, 0x0d, 0x00, 0xf6, 0x00),
+        PHYREGS(0x08b0, 0x08ac, 0x08a8, 0x01d7, 0x01d8, 0x01d9),
+  },
+  {     .freq                   = 5560,
+        RADIOREGS3(0x34, 0x01, 0x01, 0x02, 0x2c, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0b, 0x00,
+                   0x84, 0x2b, 0x00, 0x06, 0x00, 0x7f, 0x00, 0x0d,
+                   0x00, 0xf6, 0x00, 0x2b, 0x00, 0x06, 0x00, 0x7f,
+                   0x00, 0x0d, 0x00, 0xf6, 0x00),
+        PHYREGS(0x08b4, 0x08b0, 0x08ac, 0x01d7, 0x01d7, 0x01d8),
+  },
+  {     .freq                   = 5570,
+        RADIOREGS3(0x34, 0x01, 0x01, 0x02, 0x2d, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0b, 0x00,
+                   0x84, 0x2a, 0x00, 0x06, 0x00, 0x7f, 0x00, 0x0d,
+                   0x00, 0xf6, 0x00, 0x2a, 0x00, 0x06, 0x00, 0x7f,
+                   0x00, 0x0d, 0x00, 0xf6, 0x00),
+        PHYREGS(0x08b8, 0x08b4, 0x08b0, 0x01d6, 0x01d7, 0x01d7),
+  },
+  {     .freq                   = 5580,
+        RADIOREGS3(0x2e, 0x01, 0x01, 0x02, 0x2e, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0b, 0x00,
+                   0x84, 0x1a, 0x00, 0x06, 0x00, 0x7f, 0x00, 0x0d,
+                   0x00, 0xf6, 0x00, 0x1a, 0x00, 0x06, 0x00, 0x7f,
+                   0x00, 0x0d, 0x00, 0xf6, 0x00),
+        PHYREGS(0x08bc, 0x08b8, 0x08b4, 0x01d5, 0x01d6, 0x01d7),
+  },
+  {     .freq                   = 5590,
+        RADIOREGS3(0x2e, 0x01, 0x01, 0x02, 0x2f, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0b, 0x00,
+                   0x84, 0x1a, 0x00, 0x06, 0x00, 0x7f, 0x00, 0x0d,
+                   0x00, 0xf6, 0x00, 0x1a, 0x00, 0x06, 0x00, 0x7f,
+                   0x00, 0x0d, 0x00, 0xf6, 0x00),
+        PHYREGS(0x08c0, 0x08bc, 0x08b8, 0x01d4, 0x01d5, 0x01d6),
+  },
+  {     .freq                   = 5600,
+        RADIOREGS3(0x28, 0x01, 0x01, 0x02, 0x30, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8b, 0x09, 0x00,
+                   0x70, 0x1a, 0x00, 0x04, 0x00, 0x7f, 0x00, 0x0b,
+                   0x00, 0xf4, 0x00, 0x1a, 0x00, 0x04, 0x00, 0x7f,
+                   0x00, 0x0b, 0x00, 0xf4, 0x00),
+        PHYREGS(0x08c4, 0x08c0, 0x08bc, 0x01d3, 0x01d4, 0x01d5),
+  },
+  {     .freq                   = 5610,
+        RADIOREGS3(0x28, 0x01, 0x01, 0x02, 0x31, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8b, 0x09, 0x00,
+                   0x70, 0x19, 0x00, 0x04, 0x00, 0x7f, 0x00, 0x0b,
+                   0x00, 0xf4, 0x00, 0x19, 0x00, 0x04, 0x00, 0x7f,
+                   0x00, 0x0b, 0x00, 0xf4, 0x00),
+        PHYREGS(0x08c8, 0x08c4, 0x08c0, 0x01d2, 0x01d3, 0x01d4),
+  },
+  {     .freq                   = 5620,
+        RADIOREGS3(0x21, 0x01, 0x01, 0x02, 0x32, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8b, 0x09, 0x00,
+                   0x70, 0x19, 0x00, 0x04, 0x00, 0x7f, 0x00, 0x0b,
+                   0x00, 0xf4, 0x00, 0x19, 0x00, 0x04, 0x00, 0x7f,
+                   0x00, 0x0b, 0x00, 0xf4, 0x00),
+        PHYREGS(0x08cc, 0x08c8, 0x08c4, 0x01d2, 0x01d2, 0x01d3),
+  },
+  {     .freq                   = 5630,
+        RADIOREGS3(0x21, 0x01, 0x01, 0x02, 0x33, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8b, 0x09, 0x00,
+                   0x70, 0x09, 0x00, 0x04, 0x00, 0x7f, 0x00, 0x0b,
+                   0x00, 0xf4, 0x00, 0x09, 0x00, 0x04, 0x00, 0x7f,
+                   0x00, 0x0b, 0x00, 0xf4, 0x00),
+        PHYREGS(0x08d0, 0x08cc, 0x08c8, 0x01d1, 0x01d2, 0x01d2),
+  },
+  {     .freq                   = 5640,
+        RADIOREGS3(0x1c, 0x01, 0x01, 0x02, 0x34, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8b, 0x09, 0x00,
+                   0x70, 0x09, 0x00, 0x04, 0x00, 0x7f, 0x00, 0x0b,
+                   0x00, 0xf4, 0x00, 0x09, 0x00, 0x04, 0x00, 0x7f,
+                   0x00, 0x0b, 0x00, 0xf4, 0x00),
+        PHYREGS(0x08d4, 0x08d0, 0x08cc, 0x01d0, 0x01d1, 0x01d2),
+  },
+  {     .freq                   = 5650,
+        RADIOREGS3(0x1c, 0x01, 0x01, 0x02, 0x35, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8b, 0x09, 0x00,
+                   0x70, 0x08, 0x00, 0x04, 0x00, 0x7f, 0x00, 0x0b,
+                   0x00, 0xf4, 0x00, 0x08, 0x00, 0x04, 0x00, 0x7f,
+                   0x00, 0x0b, 0x00, 0xf4, 0x00),
+        PHYREGS(0x08d8, 0x08d4, 0x08d0, 0x01cf, 0x01d0, 0x01d1),
+  },
+  {     .freq                   = 5660,
+        RADIOREGS3(0x16, 0x01, 0x01, 0x02, 0x36, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8b, 0x09, 0x00,
+                   0x70, 0x08, 0x00, 0x04, 0x00, 0x7f, 0x00, 0x0b,
+                   0x00, 0xf4, 0x00, 0x08, 0x00, 0x04, 0x00, 0x7f,
+                   0x00, 0x0b, 0x00, 0xf4, 0x00),
+        PHYREGS(0x08dc, 0x08d8, 0x08d4, 0x01ce, 0x01cf, 0x01d0),
+  },
+  {     .freq                   = 5670,
+        RADIOREGS3(0x16, 0x01, 0x01, 0x02, 0x37, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8b, 0x09, 0x00,
+                   0x70, 0x08, 0x00, 0x04, 0x00, 0x7f, 0x00, 0x0b,
+                   0x00, 0xf4, 0x00, 0x08, 0x00, 0x04, 0x00, 0x7f,
+                   0x00, 0x0b, 0x00, 0xf4, 0x00),
+        PHYREGS(0x08e0, 0x08dc, 0x08d8, 0x01ce, 0x01ce, 0x01cf),
+  },
+  {     .freq                   = 5680,
+        RADIOREGS3(0x10, 0x01, 0x01, 0x02, 0x38, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8b, 0x09, 0x00,
+                   0x70, 0x08, 0x00, 0x04, 0x00, 0x7f, 0x00, 0x0b,
+                   0x00, 0xf4, 0x00, 0x08, 0x00, 0x04, 0x00, 0x7f,
+                   0x00, 0x0b, 0x00, 0xf4, 0x00),
+        PHYREGS(0x08e4, 0x08e0, 0x08dc, 0x01cd, 0x01ce, 0x01ce),
+  },
+  {     .freq                   = 5690,
+        RADIOREGS3(0x10, 0x01, 0x01, 0x02, 0x39, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8b, 0x09, 0x00,
+                   0x70, 0x07, 0x00, 0x04, 0x00, 0x7f, 0x00, 0x0b,
+                   0x00, 0xf4, 0x00, 0x07, 0x00, 0x04, 0x00, 0x7f,
+                   0x00, 0x0b, 0x00, 0xf4, 0x00),
+        PHYREGS(0x08e8, 0x08e4, 0x08e0, 0x01cc, 0x01cd, 0x01ce),
+  },
+  {     .freq                   = 5700,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3a, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x07, 0x00, 0x03, 0x00, 0x7f, 0x00, 0x0a,
+                   0x00, 0xf2, 0x00, 0x07, 0x00, 0x03, 0x00, 0x7f,
+                   0x00, 0x0a, 0x00, 0xf2, 0x00),
+        PHYREGS(0x08ec, 0x08e8, 0x08e4, 0x01cb, 0x01cc, 0x01cd),
+  },
+  {     .freq                   = 5710,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3b, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x07, 0x00, 0x03, 0x00, 0x7f, 0x00, 0x0a,
+                   0x00, 0xf2, 0x00, 0x07, 0x00, 0x03, 0x00, 0x7f,
+                   0x00, 0x0a, 0x00, 0xf2, 0x00),
+        PHYREGS(0x08f0, 0x08ec, 0x08e8, 0x01ca, 0x01cb, 0x01cc),
+  },
+  {     .freq                   = 5720,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3c, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x07, 0x00, 0x03, 0x00, 0x7f, 0x00, 0x0a,
+                   0x00, 0xf2, 0x00, 0x07, 0x00, 0x03, 0x00, 0x7f,
+                   0x00, 0x0a, 0x00, 0xf2, 0x00),
+        PHYREGS(0x08f4, 0x08f0, 0x08ec, 0x01c9, 0x01ca, 0x01cb),
+  },
+  {     .freq                   = 5725,
+        RADIOREGS3(0x03, 0x01, 0x02, 0x04, 0x79, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x06, 0x00, 0x03, 0x00, 0x7f, 0x00, 0x0a,
+                   0x00, 0xf2, 0x00, 0x06, 0x00, 0x03, 0x00, 0x7f,
+                   0x00, 0x0a, 0x00, 0xf2, 0x00),
+        PHYREGS(0x08f6, 0x08f2, 0x08ee, 0x01c9, 0x01ca, 0x01cb),
+  },
+  {     .freq                   = 5730,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3d, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x06, 0x00, 0x03, 0x00, 0x7f, 0x00, 0x0a,
+                   0x00, 0xf2, 0x00, 0x06, 0x00, 0x03, 0x00, 0x7f,
+                   0x00, 0x0a, 0x00, 0xf2, 0x00),
+        PHYREGS(0x08f8, 0x08f4, 0x08f0, 0x01c9, 0x01c9, 0x01ca),
+  },
+  {     .freq                   = 5735,
+        RADIOREGS3(0x03, 0x01, 0x02, 0x04, 0x7b, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x06, 0x00, 0x03, 0x00, 0x7f, 0x00, 0x0a,
+                   0x00, 0xf2, 0x00, 0x06, 0x00, 0x03, 0x00, 0x7f,
+                   0x00, 0x0a, 0x00, 0xf2, 0x00),
+        PHYREGS(0x08fa, 0x08f6, 0x08f2, 0x01c8, 0x01c9, 0x01ca),
+  },
+  {     .freq                   = 5740,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3e, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x06, 0x00, 0x03, 0x00, 0x7f, 0x00, 0x0a,
+                   0x00, 0xf2, 0x00, 0x06, 0x00, 0x03, 0x00, 0x7f,
+                   0x00, 0x0a, 0x00, 0xf2, 0x00),
+        PHYREGS(0x08fc, 0x08f8, 0x08f4, 0x01c8, 0x01c9, 0x01c9),
+  },
+  {     .freq                   = 5745,
+        RADIOREGS3(0xfe, 0x00, 0x02, 0x04, 0x7d, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x06, 0x00, 0x03, 0x00, 0x7f, 0x00, 0x0a,
+                   0x00, 0xf2, 0x00, 0x06, 0x00, 0x03, 0x00, 0x7f,
+                   0x00, 0x0a, 0x00, 0xf2, 0x00),
+        PHYREGS(0x08fe, 0x08fa, 0x08f6, 0x01c8, 0x01c8, 0x01c9),
+  },
+  {     .freq                   = 5750,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3f, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x06, 0x00, 0x03, 0x00, 0x7f, 0x00, 0x0a,
+                   0x00, 0xf2, 0x00, 0x06, 0x00, 0x03, 0x00, 0x7f,
+                   0x00, 0x0a, 0x00, 0xf2, 0x00),
+        PHYREGS(0x0900, 0x08fc, 0x08f8, 0x01c7, 0x01c8, 0x01c9),
+  },
+  {     .freq                   = 5755,
+        RADIOREGS3(0xfe, 0x00, 0x02, 0x04, 0x7f, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x05, 0x00, 0x03, 0x00, 0x7f, 0x00, 0x0a,
+                   0x00, 0xf2, 0x00, 0x05, 0x00, 0x03, 0x00, 0x7f,
+                   0x00, 0x0a, 0x00, 0xf2, 0x00),
+        PHYREGS(0x0902, 0x08fe, 0x08fa, 0x01c7, 0x01c8, 0x01c8),
+  },
+  {     .freq                   = 5760,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x40, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x05, 0x00, 0x03, 0x00, 0x7f, 0x00, 0x0a,
+                   0x00, 0xf2, 0x00, 0x05, 0x00, 0x03, 0x00, 0x7f,
+                   0x00, 0x0a, 0x00, 0xf2, 0x00),
+        PHYREGS(0x0904, 0x0900, 0x08fc, 0x01c6, 0x01c7, 0x01c8),
+  },
+  {     .freq                   = 5765,
+        RADIOREGS3(0xf8, 0x00, 0x02, 0x04, 0x81, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x05, 0x00, 0x03, 0x00, 0x7f, 0x00, 0x0a,
+                   0x00, 0xf2, 0x00, 0x05, 0x00, 0x03, 0x00, 0x7f,
+                   0x00, 0x0a, 0x00, 0xf2, 0x00),
+        PHYREGS(0x0906, 0x0902, 0x08fe, 0x01c6, 0x01c7, 0x01c8),
+  },
+  {     .freq                   = 5770,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x41, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x05, 0x00, 0x03, 0x00, 0x7f, 0x00, 0x0a,
+                   0x00, 0xf2, 0x00, 0x05, 0x00, 0x03, 0x00, 0x7f,
+                   0x00, 0x0a, 0x00, 0xf2, 0x00),
+        PHYREGS(0x0908, 0x0904, 0x0900, 0x01c6, 0x01c6, 0x01c7),
+  },
+  {     .freq                   = 5775,
+        RADIOREGS3(0xf8, 0x00, 0x02, 0x04, 0x83, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x05, 0x00, 0x03, 0x00, 0x7f, 0x00, 0x0a,
+                   0x00, 0xf2, 0x00, 0x05, 0x00, 0x03, 0x00, 0x7f,
+                   0x00, 0x0a, 0x00, 0xf2, 0x00),
+        PHYREGS(0x090a, 0x0906, 0x0902, 0x01c5, 0x01c6, 0x01c7),
+  },
+  {     .freq                   = 5780,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x42, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x05, 0x00, 0x03, 0x00, 0x7f, 0x00, 0x0a,
+                   0x00, 0xf2, 0x00, 0x05, 0x00, 0x03, 0x00, 0x7f,
+                   0x00, 0x0a, 0x00, 0xf2, 0x00),
+        PHYREGS(0x090c, 0x0908, 0x0904, 0x01c5, 0x01c6, 0x01c6),
+  },
+  {     .freq                   = 5785,
+        RADIOREGS3(0xf2, 0x00, 0x02, 0x04, 0x85, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x06, 0x06, 0x06, 0x8a, 0x06, 0x00,
+                   0x40, 0x04, 0x00, 0x03, 0x00, 0x7f, 0x00, 0x0a,
+                   0x00, 0xf2, 0x00, 0x04, 0x00, 0x03, 0x00, 0x7f,
+                   0x00, 0x0a, 0x00, 0xf2, 0x00),
+        PHYREGS(0x090e, 0x090a, 0x0906, 0x01c4, 0x01c5, 0x01c6),
+  },
+  {     .freq                   = 5790,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x43, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x8a, 0x06, 0x00,
+                   0x40, 0x04, 0x00, 0x03, 0x00, 0x7f, 0x00, 0x0a,
+                   0x00, 0xf2, 0x00, 0x04, 0x00, 0x03, 0x00, 0x7f,
+                   0x00, 0x0a, 0x00, 0xf2, 0x00),
+        PHYREGS(0x0910, 0x090c, 0x0908, 0x01c4, 0x01c5, 0x01c6),
+  },
+  {     .freq                   = 5795,
+        RADIOREGS3(0xf2, 0x00, 0x02, 0x04, 0x87, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x06, 0x06, 0x06, 0x8a, 0x06, 0x00,
+                   0x40, 0x04, 0x00, 0x03, 0x00, 0x7f, 0x00, 0x0a,
+                   0x00, 0xf2, 0x00, 0x04, 0x00, 0x03, 0x00, 0x7f,
+                   0x00, 0x0a, 0x00, 0xf2, 0x00),
+        PHYREGS(0x0912, 0x090e, 0x090a, 0x01c4, 0x01c4, 0x01c5),
+  },
+  {     .freq                   = 5800,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x44, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x88, 0x04, 0x00,
+                   0x20, 0x04, 0x00, 0x02, 0x00, 0x7f, 0x00, 0x09,
+                   0x00, 0xf0, 0x00, 0x04, 0x00, 0x02, 0x00, 0x7f,
+                   0x00, 0x09, 0x00, 0xf0, 0x00),
+        PHYREGS(0x0914, 0x0910, 0x090c, 0x01c3, 0x01c4, 0x01c5),
+  },
+  {     .freq                   = 5805,
+        RADIOREGS3(0xed, 0x00, 0x02, 0x04, 0x89, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x06, 0x06, 0x06, 0x88, 0x04, 0x00,
+                   0x20, 0x04, 0x00, 0x02, 0x00, 0x7f, 0x00, 0x09,
+                   0x00, 0xf0, 0x00, 0x04, 0x00, 0x02, 0x00, 0x7f,
+                   0x00, 0x09, 0x00, 0xf0, 0x00),
+        PHYREGS(0x0916, 0x0912, 0x090e, 0x01c3, 0x01c4, 0x01c4),
+  },
+  {     .freq                   = 5810,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x45, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x88, 0x04, 0x00,
+                   0x20, 0x04, 0x00, 0x02, 0x00, 0x7f, 0x00, 0x09,
+                   0x00, 0xf0, 0x00, 0x04, 0x00, 0x02, 0x00, 0x7f,
+                   0x00, 0x09, 0x00, 0xf0, 0x00),
+        PHYREGS(0x0918, 0x0914, 0x0910, 0x01c2, 0x01c3, 0x01c4),
+  },
+  {     .freq                   = 5815,
+        RADIOREGS3(0xed, 0x00, 0x02, 0x04, 0x8b, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x06, 0x06, 0x06, 0x88, 0x04, 0x00,
+                   0x20, 0x04, 0x00, 0x02, 0x00, 0x7f, 0x00, 0x09,
+                   0x00, 0xf0, 0x00, 0x04, 0x00, 0x02, 0x00, 0x7f,
+                   0x00, 0x09, 0x00, 0xf0, 0x00),
+        PHYREGS(0x091a, 0x0916, 0x0912, 0x01c2, 0x01c3, 0x01c4),
+  },
+  {     .freq                   = 5820,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x46, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x88, 0x04, 0x00,
+                   0x20, 0x03, 0x00, 0x02, 0x00, 0x7f, 0x00, 0x09,
+                   0x00, 0xf0, 0x00, 0x03, 0x00, 0x02, 0x00, 0x7f,
+                   0x00, 0x09, 0x00, 0xf0, 0x00),
+        PHYREGS(0x091c, 0x0918, 0x0914, 0x01c2, 0x01c2, 0x01c3),
+  },
+  {     .freq                   = 5825,
+        RADIOREGS3(0xed, 0x00, 0x02, 0x04, 0x8d, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x06, 0x06, 0x06, 0x88, 0x04, 0x00,
+                   0x20, 0x03, 0x00, 0x02, 0x00, 0x7f, 0x00, 0x09,
+                   0x00, 0xf0, 0x00, 0x03, 0x00, 0x02, 0x00, 0x7f,
+                   0x00, 0x09, 0x00, 0xf0, 0x00),
+        PHYREGS(0x091e, 0x091a, 0x0916, 0x01c1, 0x01c2, 0x01c3),
+  },
+  {     .freq                   = 5830,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x47, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x88, 0x04, 0x00,
+                   0x20, 0x03, 0x00, 0x02, 0x00, 0x7f, 0x00, 0x09,
+                   0x00, 0xf0, 0x00, 0x03, 0x00, 0x02, 0x00, 0x7f,
+                   0x00, 0x09, 0x00, 0xf0, 0x00),
+        PHYREGS(0x0920, 0x091c, 0x0918, 0x01c1, 0x01c2, 0x01c2),
+  },
+  {     .freq                   = 5840,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x48, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x88, 0x04, 0x00,
+                   0x20, 0x03, 0x00, 0x02, 0x00, 0x7f, 0x00, 0x09,
+                   0x00, 0xf0, 0x00, 0x03, 0x00, 0x02, 0x00, 0x7f,
+                   0x00, 0x09, 0x00, 0xf0, 0x00),
+        PHYREGS(0x0924, 0x0920, 0x091c, 0x01c0, 0x01c1, 0x01c2),
+  },
+  {     .freq                   = 5850,
+        RADIOREGS3(0xe0, 0x00, 0x01, 0x02, 0x49, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x88, 0x04, 0x00,
+                   0x20, 0x03, 0x00, 0x02, 0x00, 0x7f, 0x00, 0x09,
+                   0x00, 0xf0, 0x00, 0x03, 0x00, 0x02, 0x00, 0x7f,
+                   0x00, 0x09, 0x00, 0xf0, 0x00),
+        PHYREGS(0x0928, 0x0924, 0x0920, 0x01bf, 0x01c0, 0x01c1),
+  },
+  {     .freq                   = 5860,
+        RADIOREGS3(0xde, 0x00, 0x01, 0x02, 0x4a, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x88, 0x04, 0x00,
+                   0x20, 0x03, 0x00, 0x02, 0x00, 0x7f, 0x00, 0x09,
+                   0x00, 0xf0, 0x00, 0x03, 0x00, 0x02, 0x00, 0x7f,
+                   0x00, 0x09, 0x00, 0xf0, 0x00),
+        PHYREGS(0x092c, 0x0928, 0x0924, 0x01bf, 0x01bf, 0x01c0),
+  },
+  {     .freq                   = 5870,
+        RADIOREGS3(0xdb, 0x00, 0x01, 0x02, 0x4b, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x88, 0x04, 0x00,
+                   0x20, 0x02, 0x00, 0x02, 0x00, 0x7f, 0x00, 0x09,
+                   0x00, 0xf0, 0x00, 0x02, 0x00, 0x02, 0x00, 0x7f,
+                   0x00, 0x09, 0x00, 0xf0, 0x00),
+        PHYREGS(0x0930, 0x092c, 0x0928, 0x01be, 0x01bf, 0x01bf),
+  },
+  {     .freq                   = 5880,
+        RADIOREGS3(0xd8, 0x00, 0x01, 0x02, 0x4c, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x88, 0x04, 0x00,
+                   0x20, 0x02, 0x00, 0x02, 0x00, 0x7f, 0x00, 0x09,
+                   0x00, 0xf0, 0x00, 0x02, 0x00, 0x02, 0x00, 0x7f,
+                   0x00, 0x09, 0x00, 0xf0, 0x00),
+        PHYREGS(0x0934, 0x0930, 0x092c, 0x01bd, 0x01be, 0x01bf),
+  },
+  {     .freq                   = 5890,
+        RADIOREGS3(0xd6, 0x00, 0x01, 0x02, 0x4d, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x88, 0x04, 0x00,
+                   0x20, 0x02, 0x00, 0x02, 0x00, 0x7f, 0x00, 0x09,
+                   0x00, 0xf0, 0x00, 0x02, 0x00, 0x02, 0x00, 0x7f,
+                   0x00, 0x09, 0x00, 0xf0, 0x00),
+        PHYREGS(0x0938, 0x0934, 0x0930, 0x01bc, 0x01bd, 0x01be),
+  },
+  {     .freq                   = 5900,
+        RADIOREGS3(0xd3, 0x00, 0x01, 0x02, 0x4e, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x87, 0x03, 0x00,
+                   0x00, 0x02, 0x00, 0x00, 0x00, 0x7f, 0x00, 0x07,
+                   0x00, 0xf0, 0x00, 0x02, 0x00, 0x00, 0x00, 0x7f,
+                   0x00, 0x07, 0x00, 0xf0, 0x00),
+        PHYREGS(0x093c, 0x0938, 0x0934, 0x01bc, 0x01bc, 0x01bd),
+  },
+  {     .freq                   = 5910,
+        RADIOREGS3(0xd6, 0x00, 0x01, 0x02, 0x4f, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x87, 0x03, 0x00,
+                   0x00, 0x01, 0x00, 0x00, 0x00, 0x7f, 0x00, 0x07,
+                   0x00, 0xf0, 0x00, 0x01, 0x00, 0x00, 0x00, 0x7f,
+                   0x00, 0x07, 0x00, 0xf0, 0x00),
+        PHYREGS(0x0940, 0x093c, 0x0938, 0x01bb, 0x01bc, 0x01bc),
+  },
+  {     .freq                   = 2412,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x6c, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x04, 0x04, 0x04, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0xff, 0x00, 0x04, 0x00, 0x70, 0x00,
+                   0x0f, 0x00, 0x0e, 0x00, 0xff, 0x00, 0x04, 0x00,
+                   0x70, 0x00, 0x0f, 0x00, 0x0e),
+        PHYREGS(0x03c9, 0x03c5, 0x03c1, 0x043a, 0x043f, 0x0443),
+  },
+  {     .freq                   = 2417,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x71, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0xff, 0x00, 0x04, 0x00, 0x70, 0x00,
+                   0x0f, 0x00, 0x0e, 0x00, 0xff, 0x00, 0x04, 0x00,
+                   0x70, 0x00, 0x0f, 0x00, 0x0e),
+        PHYREGS(0x03cb, 0x03c7, 0x03c3, 0x0438, 0x043d, 0x0441),
+  },
+  {     .freq                   = 2422,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x76, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0xff, 0x00, 0x04, 0x00, 0x70, 0x00,
+                   0x0f, 0x00, 0x0e, 0x00, 0xff, 0x00, 0x04, 0x00,
+                   0x70, 0x00, 0x0f, 0x00, 0x0e),
+        PHYREGS(0x03cd, 0x03c9, 0x03c5, 0x0436, 0x043a, 0x043f),
+  },
+  {     .freq                   = 2427,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x7b, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0xfd, 0x00, 0x04, 0x00, 0x70, 0x00,
+                   0x0f, 0x00, 0x0e, 0x00, 0xfd, 0x00, 0x04, 0x00,
+                   0x70, 0x00, 0x0f, 0x00, 0x0e),
+        PHYREGS(0x03cf, 0x03cb, 0x03c7, 0x0434, 0x0438, 0x043d),
+  },
+  {     .freq                   = 2432,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x80, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0xfb, 0x00, 0x04, 0x00, 0x70, 0x00,
+                   0x0f, 0x00, 0x0e, 0x00, 0xfb, 0x00, 0x04, 0x00,
+                   0x70, 0x00, 0x0f, 0x00, 0x0e),
+        PHYREGS(0x03d1, 0x03cd, 0x03c9, 0x0431, 0x0436, 0x043a),
+  },
+  {     .freq                   = 2437,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x85, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0xfa, 0x00, 0x04, 0x00, 0x70, 0x00,
+                   0x0f, 0x00, 0x0e, 0x00, 0xfa, 0x00, 0x04, 0x00,
+                   0x70, 0x00, 0x0f, 0x00, 0x0e),
+        PHYREGS(0x03d3, 0x03cf, 0x03cb, 0x042f, 0x0434, 0x0438),
+  },
+  {     .freq                   = 2442,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x8a, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0xf8, 0x00, 0x04, 0x00, 0x70, 0x00,
+                   0x0f, 0x00, 0x0e, 0x00, 0xf8, 0x00, 0x04, 0x00,
+                   0x70, 0x00, 0x0f, 0x00, 0x0e),
+        PHYREGS(0x03d5, 0x03d1, 0x03cd, 0x042d, 0x0431, 0x0436),
+  },
+  {     .freq                   = 2447,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x8f, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x06, 0x06, 0x06, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0xf7, 0x00, 0x04, 0x00, 0x70, 0x00,
+                   0x0f, 0x00, 0x0e, 0x00, 0xf7, 0x00, 0x04, 0x00,
+                   0x70, 0x00, 0x0f, 0x00, 0x0e),
+        PHYREGS(0x03d7, 0x03d3, 0x03cf, 0x042b, 0x042f, 0x0434),
+  },
+  {     .freq                   = 2452,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x94, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x06, 0x06, 0x06, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0xf6, 0x00, 0x04, 0x00, 0x70, 0x00,
+                   0x0f, 0x00, 0x0e, 0x00, 0xf6, 0x00, 0x04, 0x00,
+                   0x70, 0x00, 0x0f, 0x00, 0x0e),
+        PHYREGS(0x03d9, 0x03d5, 0x03d1, 0x0429, 0x042d, 0x0431),
+  },
+  {     .freq                   = 2457,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x99, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x06, 0x06, 0x06, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0xf5, 0x00, 0x04, 0x00, 0x70, 0x00,
+                   0x0f, 0x00, 0x0e, 0x00, 0xf5, 0x00, 0x04, 0x00,
+                   0x70, 0x00, 0x0f, 0x00, 0x0e),
+        PHYREGS(0x03db, 0x03d7, 0x03d3, 0x0427, 0x042b, 0x042f),
+  },
+  {     .freq                   = 2462,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x9e, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x06, 0x06, 0x06, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0xf4, 0x00, 0x04, 0x00, 0x70, 0x00,
+                   0x0f, 0x00, 0x0e, 0x00, 0xf4, 0x00, 0x04, 0x00,
+                   0x70, 0x00, 0x0f, 0x00, 0x0e),
+        PHYREGS(0x03dd, 0x03d9, 0x03d5, 0x0424, 0x0429, 0x042d),
+  },
+  {     .freq                   = 2467,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0xa3, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x06, 0x06, 0x06, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0xf3, 0x00, 0x04, 0x00, 0x70, 0x00,
+                   0x0f, 0x00, 0x0e, 0x00, 0xf3, 0x00, 0x04, 0x00,
+                   0x70, 0x00, 0x0f, 0x00, 0x0e),
+        PHYREGS(0x03df, 0x03db, 0x03d7, 0x0422, 0x0427, 0x042b),
+  },
+  {     .freq                   = 2472,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0xa8, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x07, 0x07, 0x07, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0xf2, 0x00, 0x04, 0x00, 0x70, 0x00,
+                   0x0f, 0x00, 0x0e, 0x00, 0xf2, 0x00, 0x04, 0x00,
+                   0x70, 0x00, 0x0f, 0x00, 0x0e),
+        PHYREGS(0x03e1, 0x03dd, 0x03d9, 0x0420, 0x0424, 0x0429),
+  },
+  {     .freq                   = 2484,
+        RADIOREGS3(0xff, 0x01, 0x03, 0x09, 0xb4, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x07, 0x07, 0x07, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0xf0, 0x00, 0x04, 0x00, 0x70, 0x00,
+                   0x0f, 0x00, 0x0e, 0x00, 0xf0, 0x00, 0x04, 0x00,
+                   0x70, 0x00, 0x0f, 0x00, 0x0e),
+        PHYREGS(0x03e6, 0x03e2, 0x03de, 0x041b, 0x041f, 0x0424),
+  },
+};
+
+static const struct b43_nphy_channeltab_entry_rev3 b43_nphy_channeltab_rev5[] = {
+  {     .freq                   = 4920,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xec, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x00, 0x00, 0x00, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0b, 0x00, 0x70, 0x00, 0x0f,
+                   0x00, 0x9f, 0x00, 0xff, 0x00, 0x0b, 0x00, 0x70,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07b4, 0x07b0, 0x07ac, 0x0214, 0x0215, 0x0216),
+  },
+  {     .freq                   = 4930,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xed, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x00, 0x00, 0x00, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0b, 0x00, 0x70, 0x00, 0x0e,
+                   0x00, 0x9f, 0x00, 0xff, 0x00, 0x0b, 0x00, 0x70,
+                   0x00, 0x0e, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07b8, 0x07b4, 0x07b0, 0x0213, 0x0214, 0x0215),
+  },
+  {     .freq                   = 4940,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xee, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x00, 0x00, 0x00, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0b, 0x00, 0x70, 0x00, 0x0e,
+                   0x00, 0x9f, 0x00, 0xff, 0x00, 0x0b, 0x00, 0x70,
+                   0x00, 0x0e, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07bc, 0x07b8, 0x07b4, 0x0212, 0x0213, 0x0214),
+  },
+  {     .freq                   = 4950,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xef, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x00, 0x00, 0x00, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0b, 0x00, 0x70, 0x00, 0x0e,
+                   0x00, 0x9f, 0x00, 0xff, 0x00, 0x0b, 0x00, 0x70,
+                   0x00, 0x0e, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07c0, 0x07bc, 0x07b8, 0x0211, 0x0212, 0x0213),
+  },
+  {     .freq                   = 4960,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf0, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0a, 0x00, 0x70, 0x00, 0x0e,
+                   0x00, 0x9f, 0x00, 0xff, 0x00, 0x0a, 0x00, 0x70,
+                   0x00, 0x0e, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07c4, 0x07c0, 0x07bc, 0x020f, 0x0211, 0x0212),
+  },
+  {     .freq                   = 4970,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf1, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0a, 0x00, 0x70, 0x00, 0x0d,
+                   0x00, 0x9f, 0x00, 0xff, 0x00, 0x0a, 0x00, 0x70,
+                   0x00, 0x0d, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07c8, 0x07c4, 0x07c0, 0x020e, 0x020f, 0x0211),
+  },
+  {     .freq                   = 4980,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf2, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0a, 0x00, 0x70, 0x00, 0x0d,
+                   0x00, 0x9f, 0x00, 0xff, 0x00, 0x0a, 0x00, 0x70,
+                   0x00, 0x0d, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07cc, 0x07c8, 0x07c4, 0x020d, 0x020e, 0x020f),
+  },
+  {     .freq                   = 4990,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf3, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0a, 0x00, 0x70, 0x00, 0x0d,
+                   0x00, 0x9f, 0x00, 0xff, 0x00, 0x0a, 0x00, 0x70,
+                   0x00, 0x0d, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07d0, 0x07cc, 0x07c8, 0x020c, 0x020d, 0x020e),
+  },
+  {     .freq                   = 5000,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf4, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0a, 0x00, 0x70, 0x00, 0x0d,
+                   0x00, 0x9f, 0x00, 0xff, 0x00, 0x0a, 0x00, 0x70,
+                   0x00, 0x0d, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07d4, 0x07d0, 0x07cc, 0x020b, 0x020c, 0x020d),
+  },
+  {     .freq                   = 5010,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf5, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0a, 0x00, 0x70, 0x00, 0x0d,
+                   0x00, 0x9f, 0x00, 0xff, 0x00, 0x0a, 0x00, 0x70,
+                   0x00, 0x0d, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07d8, 0x07d4, 0x07d0, 0x020a, 0x020b, 0x020c),
+  },
+  {     .freq                   = 5020,
+        RADIOREGS3(0xf7, 0x01, 0x01, 0x01, 0xf6, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x09, 0x00, 0x70, 0x00, 0x0d,
+                   0x00, 0x9f, 0x00, 0xff, 0x00, 0x09, 0x00, 0x70,
+                   0x00, 0x0d, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07dc, 0x07d8, 0x07d4, 0x0209, 0x020a, 0x020b),
+  },
+  {     .freq                   = 5030,
+        RADIOREGS3(0xf7, 0x01, 0x01, 0x01, 0xf7, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x09, 0x00, 0x70, 0x00, 0x0c,
+                   0x00, 0x9f, 0x00, 0xff, 0x00, 0x09, 0x00, 0x70,
+                   0x00, 0x0c, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07e0, 0x07dc, 0x07d8, 0x0208, 0x0209, 0x020a),
+  },
+  {     .freq                   = 5040,
+        RADIOREGS3(0xef, 0x01, 0x01, 0x01, 0xf8, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfe, 0x00, 0x09, 0x00, 0x70, 0x00, 0x0c,
+                   0x00, 0x9f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x70,
+                   0x00, 0x0c, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07e4, 0x07e0, 0x07dc, 0x0207, 0x0208, 0x0209),
+  },
+  {     .freq                   = 5050,
+        RADIOREGS3(0xef, 0x01, 0x01, 0x01, 0xf9, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfe, 0x00, 0x09, 0x00, 0x70, 0x00, 0x0c,
+                   0x00, 0x9f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x70,
+                   0x00, 0x0c, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07e8, 0x07e4, 0x07e0, 0x0206, 0x0207, 0x0208),
+  },
+  {     .freq                   = 5060,
+        RADIOREGS3(0xe6, 0x01, 0x01, 0x01, 0xfa, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfd, 0x00, 0x09, 0x00, 0x70, 0x00, 0x0c,
+                   0x00, 0x9f, 0x00, 0xfd, 0x00, 0x09, 0x00, 0x70,
+                   0x00, 0x0c, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07ec, 0x07e8, 0x07e4, 0x0205, 0x0206, 0x0207),
+  },
+  {     .freq                   = 5070,
+        RADIOREGS3(0xe6, 0x01, 0x01, 0x01, 0xfb, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfd, 0x00, 0x08, 0x00, 0x70, 0x00, 0x0b,
+                   0x00, 0x9f, 0x00, 0xfd, 0x00, 0x08, 0x00, 0x70,
+                   0x00, 0x0b, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07f0, 0x07ec, 0x07e8, 0x0204, 0x0205, 0x0206),
+  },
+  {     .freq                   = 5080,
+        RADIOREGS3(0xde, 0x01, 0x01, 0x01, 0xfc, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfc, 0x00, 0x08, 0x00, 0x70, 0x00, 0x0b,
+                   0x00, 0x9f, 0x00, 0xfc, 0x00, 0x08, 0x00, 0x70,
+                   0x00, 0x0b, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07f4, 0x07f0, 0x07ec, 0x0203, 0x0204, 0x0205),
+  },
+  {     .freq                   = 5090,
+        RADIOREGS3(0xde, 0x01, 0x01, 0x01, 0xfd, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfc, 0x00, 0x08, 0x00, 0x70, 0x00, 0x0b,
+                   0x00, 0x9f, 0x00, 0xfc, 0x00, 0x08, 0x00, 0x70,
+                   0x00, 0x0b, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07f8, 0x07f4, 0x07f0, 0x0202, 0x0203, 0x0204),
+  },
+  {     .freq                   = 5100,
+        RADIOREGS3(0xd6, 0x01, 0x01, 0x01, 0xfe, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfc, 0x00, 0x08, 0x00, 0x70, 0x00, 0x0b,
+                   0x00, 0x9f, 0x00, 0xfc, 0x00, 0x08, 0x00, 0x70,
+                   0x00, 0x0b, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07fc, 0x07f8, 0x07f4, 0x0201, 0x0202, 0x0203),
+  },
+  {     .freq                   = 5110,
+        RADIOREGS3(0xd6, 0x01, 0x01, 0x01, 0xff, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfc, 0x00, 0x08, 0x00, 0x70, 0x00, 0x0b,
+                   0x00, 0x9f, 0x00, 0xfc, 0x00, 0x08, 0x00, 0x70,
+                   0x00, 0x0b, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0800, 0x07fc, 0x07f8, 0x0200, 0x0201, 0x0202),
+  },
+  {     .freq                   = 5120,
+        RADIOREGS3(0xce, 0x01, 0x01, 0x02, 0x00, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfc, 0x00, 0x08, 0x00, 0x70, 0x00, 0x0b,
+                   0x00, 0x9f, 0x00, 0xfc, 0x00, 0x08, 0x00, 0x70,
+                   0x00, 0x0b, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0804, 0x0800, 0x07fc, 0x01ff, 0x0200, 0x0201),
+  },
+  {     .freq                   = 5130,
+        RADIOREGS3(0xce, 0x01, 0x01, 0x02, 0x01, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfb, 0x00, 0x08, 0x00, 0x70, 0x00, 0x0a,
+                   0x00, 0x9f, 0x00, 0xfb, 0x00, 0x08, 0x00, 0x70,
+                   0x00, 0x0a, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0808, 0x0804, 0x0800, 0x01fe, 0x01ff, 0x0200),
+  },
+  {     .freq                   = 5140,
+        RADIOREGS3(0xc6, 0x01, 0x01, 0x02, 0x02, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfb, 0x00, 0x07, 0x00, 0x70, 0x00, 0x0a,
+                   0x00, 0x9f, 0x00, 0xfb, 0x00, 0x07, 0x00, 0x70,
+                   0x00, 0x0a, 0x00, 0x6f, 0x00),
+        PHYREGS(0x080c, 0x0808, 0x0804, 0x01fd, 0x01fe, 0x01ff),
+  },
+  {     .freq                   = 5160,
+        RADIOREGS3(0xbe, 0x01, 0x01, 0x02, 0x04, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfb, 0x00, 0x07, 0x00, 0x70, 0x00, 0x09,
+                   0x00, 0x9e, 0x00, 0xfb, 0x00, 0x07, 0x00, 0x70,
+                   0x00, 0x09, 0x00, 0x6e, 0x00),
+        PHYREGS(0x0814, 0x0810, 0x080c, 0x01fb, 0x01fc, 0x01fd),
+  },
+  {     .freq                   = 5170,
+        RADIOREGS3(0xbe, 0x01, 0x01, 0x02, 0x05, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfb, 0x00, 0x06, 0x00, 0x70, 0x00, 0x09,
+                   0x00, 0x9e, 0x00, 0xfb, 0x00, 0x06, 0x00, 0x70,
+                   0x00, 0x09, 0x00, 0x6e, 0x00),
+        PHYREGS(0x0818, 0x0814, 0x0810, 0x01fa, 0x01fb, 0x01fc),
+  },
+  {     .freq                   = 5180,
+        RADIOREGS3(0xb6, 0x01, 0x01, 0x02, 0x06, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfa, 0x00, 0x06, 0x00, 0x70, 0x00, 0x09,
+                   0x00, 0x9e, 0x00, 0xfa, 0x00, 0x06, 0x00, 0x70,
+                   0x00, 0x09, 0x00, 0x6e, 0x00),
+        PHYREGS(0x081c, 0x0818, 0x0814, 0x01f9, 0x01fa, 0x01fb),
+  },
+  {     .freq                   = 5190,
+        RADIOREGS3(0xb6, 0x01, 0x01, 0x02, 0x07, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfa, 0x00, 0x06, 0x00, 0x70, 0x00, 0x09,
+                   0x00, 0x9e, 0x00, 0xfa, 0x00, 0x06, 0x00, 0x70,
+                   0x00, 0x09, 0x00, 0x6e, 0x00),
+        PHYREGS(0x0820, 0x081c, 0x0818, 0x01f8, 0x01f9, 0x01fa),
+  },
+  {     .freq                   = 5200,
+        RADIOREGS3(0xaf, 0x01, 0x01, 0x02, 0x08, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfa, 0x00, 0x06, 0x00, 0x70, 0x00, 0x09,
+                   0x00, 0x9e, 0x00, 0xfa, 0x00, 0x06, 0x00, 0x70,
+                   0x00, 0x09, 0x00, 0x6e, 0x00),
+        PHYREGS(0x0824, 0x0820, 0x081c, 0x01f7, 0x01f8, 0x01f9),
+  },
+  {     .freq                   = 5210,
+        RADIOREGS3(0xaf, 0x01, 0x01, 0x02, 0x09, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfa, 0x00, 0x06, 0x00, 0x70, 0x00, 0x09,
+                   0x00, 0x9e, 0x00, 0xfa, 0x00, 0x06, 0x00, 0x70,
+                   0x00, 0x09, 0x00, 0x6e, 0x00),
+        PHYREGS(0x0828, 0x0824, 0x0820, 0x01f6, 0x01f7, 0x01f8),
+  },
+  {     .freq                   = 5220,
+        RADIOREGS3(0xa7, 0x01, 0x01, 0x02, 0x0a, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfa, 0x00, 0x06, 0x00, 0x70, 0x00, 0x09,
+                   0x00, 0x9e, 0x00, 0xfa, 0x00, 0x06, 0x00, 0x70,
+                   0x00, 0x09, 0x00, 0x6e, 0x00),
+        PHYREGS(0x082c, 0x0828, 0x0824, 0x01f5, 0x01f6, 0x01f7),
+  },
+  {     .freq                   = 5230,
+        RADIOREGS3(0xa7, 0x01, 0x01, 0x02, 0x0b, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xea, 0x00, 0x06, 0x00, 0x70, 0x00, 0x08,
+                   0x00, 0x9e, 0x00, 0xea, 0x00, 0x06, 0x00, 0x70,
+                   0x00, 0x08, 0x00, 0x6e, 0x00),
+        PHYREGS(0x0830, 0x082c, 0x0828, 0x01f4, 0x01f5, 0x01f6),
+  },
+  {     .freq                   = 5240,
+        RADIOREGS3(0xa0, 0x01, 0x01, 0x02, 0x0c, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xe9, 0x00, 0x05, 0x00, 0x70, 0x00, 0x08,
+                   0x00, 0x9d, 0x00, 0xe9, 0x00, 0x05, 0x00, 0x70,
+                   0x00, 0x08, 0x00, 0x6d, 0x00),
+        PHYREGS(0x0834, 0x0830, 0x082c, 0x01f3, 0x01f4, 0x01f5),
+  },
+  {     .freq                   = 5250,
+        RADIOREGS3(0xa0, 0x01, 0x01, 0x02, 0x0d, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xe9, 0x00, 0x05, 0x00, 0x70, 0x00, 0x08,
+                   0x00, 0x9d, 0x00, 0xe9, 0x00, 0x05, 0x00, 0x70,
+                   0x00, 0x08, 0x00, 0x6d, 0x00),
+        PHYREGS(0x0838, 0x0834, 0x0830, 0x01f2, 0x01f3, 0x01f4),
+  },
+  {     .freq                   = 5260,
+        RADIOREGS3(0x98, 0x01, 0x01, 0x02, 0x0e, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xd9, 0x00, 0x05, 0x00, 0x70, 0x00, 0x08,
+                   0x00, 0x9d, 0x00, 0xd9, 0x00, 0x05, 0x00, 0x70,
+                   0x00, 0x08, 0x00, 0x6d, 0x00),
+        PHYREGS(0x083c, 0x0838, 0x0834, 0x01f1, 0x01f2, 0x01f3),
+  },
+  {     .freq                   = 5270,
+        RADIOREGS3(0x98, 0x01, 0x01, 0x02, 0x0f, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8f, 0x0f, 0x00,
+                   0xff, 0xd8, 0x00, 0x04, 0x00, 0x70, 0x00, 0x07,
+                   0x00, 0x9c, 0x00, 0xd8, 0x00, 0x04, 0x00, 0x70,
+                   0x00, 0x07, 0x00, 0x6c, 0x00),
+        PHYREGS(0x0840, 0x083c, 0x0838, 0x01f0, 0x01f1, 0x01f2),
+  },
+  {     .freq                   = 5280,
+        RADIOREGS3(0x91, 0x01, 0x01, 0x02, 0x10, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8f, 0x0f, 0x00,
+                   0xff, 0xc8, 0x00, 0x04, 0x00, 0x70, 0x00, 0x07,
+                   0x00, 0x9c, 0x00, 0xc8, 0x00, 0x04, 0x00, 0x70,
+                   0x00, 0x07, 0x00, 0x6c, 0x00),
+        PHYREGS(0x0844, 0x0840, 0x083c, 0x01f0, 0x01f0, 0x01f1),
+  },
+  {     .freq                   = 5290,
+        RADIOREGS3(0x91, 0x01, 0x01, 0x02, 0x11, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8f, 0x0f, 0x00,
+                   0xff, 0xc8, 0x00, 0x04, 0x00, 0x70, 0x00, 0x07,
+                   0x00, 0x9c, 0x00, 0xc8, 0x00, 0x04, 0x00, 0x70,
+                   0x00, 0x07, 0x00, 0x6c, 0x00),
+        PHYREGS(0x0848, 0x0844, 0x0840, 0x01ef, 0x01f0, 0x01f0),
+  },
+  {     .freq                   = 5300,
+        RADIOREGS3(0x8a, 0x01, 0x01, 0x02, 0x12, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8f, 0x0e, 0x00,
+                   0xff, 0xc8, 0x00, 0x04, 0x00, 0x70, 0x00, 0x07,
+                   0x00, 0x9c, 0x00, 0xc8, 0x00, 0x04, 0x00, 0x70,
+                   0x00, 0x07, 0x00, 0x6c, 0x00),
+        PHYREGS(0x084c, 0x0848, 0x0844, 0x01ee, 0x01ef, 0x01f0),
+  },
+  {     .freq                   = 5310,
+        RADIOREGS3(0x8a, 0x01, 0x01, 0x02, 0x13, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8f, 0x0e, 0x00,
+                   0xff, 0xc8, 0x00, 0x04, 0x00, 0x70, 0x00, 0x07,
+                   0x00, 0x9c, 0x00, 0xc8, 0x00, 0x04, 0x00, 0x70,
+                   0x00, 0x07, 0x00, 0x6c, 0x00),
+        PHYREGS(0x0850, 0x084c, 0x0848, 0x01ed, 0x01ee, 0x01ef),
+  },
+  {     .freq                   = 5320,
+        RADIOREGS3(0x83, 0x01, 0x01, 0x02, 0x14, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8f, 0x0e, 0x00,
+                   0xff, 0xb8, 0x00, 0x04, 0x00, 0x70, 0x00, 0x07,
+                   0x00, 0x9c, 0x00, 0xb8, 0x00, 0x04, 0x00, 0x70,
+                   0x00, 0x07, 0x00, 0x6c, 0x00),
+        PHYREGS(0x0854, 0x0850, 0x084c, 0x01ec, 0x01ed, 0x01ee),
+  },
+  {     .freq                   = 5330,
+        RADIOREGS3(0x83, 0x01, 0x01, 0x02, 0x15, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8f, 0x0e, 0x00,
+                   0xff, 0xb7, 0x00, 0x04, 0x00, 0x70, 0x00, 0x07,
+                   0x00, 0x9b, 0x00, 0xb7, 0x00, 0x04, 0x00, 0x70,
+                   0x00, 0x07, 0x00, 0x6b, 0x00),
+        PHYREGS(0x0858, 0x0854, 0x0850, 0x01eb, 0x01ec, 0x01ed),
+  },
+  {     .freq                   = 5340,
+        RADIOREGS3(0x7c, 0x01, 0x01, 0x02, 0x16, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8f, 0x0e, 0x00,
+                   0xff, 0xb7, 0x00, 0x03, 0x00, 0x70, 0x00, 0x07,
+                   0x00, 0x9b, 0x00, 0xb7, 0x00, 0x03, 0x00, 0x70,
+                   0x00, 0x07, 0x00, 0x6b, 0x00),
+        PHYREGS(0x085c, 0x0858, 0x0854, 0x01ea, 0x01eb, 0x01ec),
+  },
+  {     .freq                   = 5350,
+        RADIOREGS3(0x7c, 0x01, 0x01, 0x02, 0x17, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8f, 0x0e, 0x00,
+                   0xff, 0xa7, 0x00, 0x03, 0x00, 0x70, 0x00, 0x06,
+                   0x00, 0x9b, 0x00, 0xa7, 0x00, 0x03, 0x00, 0x70,
+                   0x00, 0x06, 0x00, 0x6b, 0x00),
+        PHYREGS(0x0860, 0x085c, 0x0858, 0x01e9, 0x01ea, 0x01eb),
+  },
+  {     .freq                   = 5360,
+        RADIOREGS3(0x75, 0x01, 0x01, 0x02, 0x18, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8f, 0x0e, 0x00,
+                   0xff, 0xa6, 0x00, 0x03, 0x00, 0x70, 0x00, 0x06,
+                   0x00, 0x9b, 0x00, 0xa6, 0x00, 0x03, 0x00, 0x70,
+                   0x00, 0x06, 0x00, 0x6b, 0x00),
+        PHYREGS(0x0864, 0x0860, 0x085c, 0x01e8, 0x01e9, 0x01ea),
+  },
+  {     .freq                   = 5370,
+        RADIOREGS3(0x75, 0x01, 0x01, 0x02, 0x19, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8f, 0x0e, 0x00,
+                   0xff, 0xa6, 0x00, 0x03, 0x00, 0x70, 0x00, 0x06,
+                   0x00, 0x9b, 0x00, 0xa6, 0x00, 0x03, 0x00, 0x70,
+                   0x00, 0x06, 0x00, 0x5b, 0x00),
+        PHYREGS(0x0868, 0x0864, 0x0860, 0x01e7, 0x01e8, 0x01e9),
+  },
+  {     .freq                   = 5380,
+        RADIOREGS3(0x6e, 0x01, 0x01, 0x02, 0x1a, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8f, 0x0e, 0x00,
+                   0xff, 0x96, 0x00, 0x03, 0x00, 0x70, 0x00, 0x06,
+                   0x00, 0x9a, 0x00, 0x96, 0x00, 0x03, 0x00, 0x70,
+                   0x00, 0x06, 0x00, 0x5a, 0x00),
+        PHYREGS(0x086c, 0x0868, 0x0864, 0x01e6, 0x01e7, 0x01e8),
+  },
+  {     .freq                   = 5390,
+        RADIOREGS3(0x6e, 0x01, 0x01, 0x02, 0x1b, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8f, 0x0e, 0x00,
+                   0xff, 0x95, 0x00, 0x03, 0x00, 0x70, 0x00, 0x06,
+                   0x00, 0x9a, 0x00, 0x95, 0x00, 0x03, 0x00, 0x70,
+                   0x00, 0x06, 0x00, 0x5a, 0x00),
+        PHYREGS(0x0870, 0x086c, 0x0868, 0x01e5, 0x01e6, 0x01e7),
+  },
+  {     .freq                   = 5400,
+        RADIOREGS3(0x67, 0x01, 0x01, 0x02, 0x1c, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0d, 0x00,
+                   0xc8, 0x95, 0x00, 0x03, 0x00, 0x70, 0x00, 0x06,
+                   0x00, 0x9a, 0x00, 0x95, 0x00, 0x03, 0x00, 0x70,
+                   0x00, 0x06, 0x00, 0x5a, 0x00),
+        PHYREGS(0x0874, 0x0870, 0x086c, 0x01e5, 0x01e5, 0x01e6),
+  },
+  {     .freq                   = 5410,
+        RADIOREGS3(0x67, 0x01, 0x01, 0x02, 0x1d, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0d, 0x00,
+                   0xc8, 0x95, 0x00, 0x03, 0x00, 0x70, 0x00, 0x05,
+                   0x00, 0x9a, 0x00, 0x95, 0x00, 0x03, 0x00, 0x70,
+                   0x00, 0x05, 0x00, 0x5a, 0x00),
+        PHYREGS(0x0878, 0x0874, 0x0870, 0x01e4, 0x01e5, 0x01e5),
+  },
+  {     .freq                   = 5420,
+        RADIOREGS3(0x61, 0x01, 0x01, 0x02, 0x1e, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0d, 0x00,
+                   0xc8, 0x95, 0x00, 0x03, 0x00, 0x70, 0x00, 0x05,
+                   0x00, 0x9a, 0x00, 0x95, 0x00, 0x03, 0x00, 0x70,
+                   0x00, 0x05, 0x00, 0x5a, 0x00),
+        PHYREGS(0x087c, 0x0878, 0x0874, 0x01e3, 0x01e4, 0x01e5),
+  },
+  {     .freq                   = 5430,
+        RADIOREGS3(0x61, 0x01, 0x01, 0x02, 0x1f, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0d, 0x00,
+                   0xc8, 0x85, 0x00, 0x02, 0x00, 0x70, 0x00, 0x05,
+                   0x00, 0x99, 0x00, 0x85, 0x00, 0x02, 0x00, 0x70,
+                   0x00, 0x05, 0x00, 0x59, 0x00),
+        PHYREGS(0x0880, 0x087c, 0x0878, 0x01e2, 0x01e3, 0x01e4),
+  },
+  {     .freq                   = 5440,
+        RADIOREGS3(0x5a, 0x01, 0x01, 0x02, 0x20, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0d, 0x00,
+                   0xc8, 0x84, 0x00, 0x02, 0x00, 0x70, 0x00, 0x05,
+                   0x00, 0x99, 0x00, 0x84, 0x00, 0x02, 0x00, 0x70,
+                   0x00, 0x05, 0x00, 0x59, 0x00),
+        PHYREGS(0x0884, 0x0880, 0x087c, 0x01e1, 0x01e2, 0x01e3),
+  },
+  {     .freq                   = 5450,
+        RADIOREGS3(0x5a, 0x01, 0x01, 0x02, 0x21, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0d, 0x00,
+                   0xc8, 0x84, 0x00, 0x02, 0x00, 0x70, 0x00, 0x05,
+                   0x00, 0x99, 0x00, 0x84, 0x00, 0x02, 0x00, 0x70,
+                   0x00, 0x05, 0x00, 0x59, 0x00),
+        PHYREGS(0x0888, 0x0884, 0x0880, 0x01e0, 0x01e1, 0x01e2),
+  },
+  {     .freq                   = 5460,
+        RADIOREGS3(0x53, 0x01, 0x01, 0x02, 0x22, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0d, 0x00,
+                   0xc8, 0x84, 0x00, 0x02, 0x00, 0x70, 0x00, 0x04,
+                   0x00, 0x99, 0x00, 0x84, 0x00, 0x02, 0x00, 0x70,
+                   0x00, 0x04, 0x00, 0x69, 0x00),
+        PHYREGS(0x088c, 0x0888, 0x0884, 0x01df, 0x01e0, 0x01e1),
+  },
+  {     .freq                   = 5470,
+        RADIOREGS3(0x53, 0x01, 0x01, 0x02, 0x23, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0d, 0x00,
+                   0xc8, 0x74, 0x00, 0x01, 0x00, 0x70, 0x00, 0x04,
+                   0x00, 0x99, 0x00, 0x74, 0x00, 0x01, 0x00, 0x70,
+                   0x00, 0x04, 0x00, 0x69, 0x00),
+        PHYREGS(0x0890, 0x088c, 0x0888, 0x01de, 0x01df, 0x01e0),
+  },
+  {     .freq                   = 5480,
+        RADIOREGS3(0x4d, 0x01, 0x01, 0x02, 0x24, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0d, 0x00,
+                   0xc8, 0x73, 0x00, 0x01, 0x00, 0x70, 0x00, 0x04,
+                   0x00, 0x98, 0x00, 0x73, 0x00, 0x01, 0x00, 0x70,
+                   0x00, 0x04, 0x00, 0x68, 0x00),
+        PHYREGS(0x0894, 0x0890, 0x088c, 0x01dd, 0x01de, 0x01df),
+  },
+  {     .freq                   = 5490,
+        RADIOREGS3(0x4d, 0x01, 0x01, 0x02, 0x25, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0d, 0x00,
+                   0xc8, 0x73, 0x00, 0x01, 0x00, 0x70, 0x00, 0x04,
+                   0x00, 0x98, 0x00, 0x73, 0x00, 0x01, 0x00, 0x70,
+                   0x00, 0x04, 0x00, 0x68, 0x00),
+        PHYREGS(0x0898, 0x0894, 0x0890, 0x01dd, 0x01dd, 0x01de),
+  },
+  {     .freq                   = 5500,
+        RADIOREGS3(0x47, 0x01, 0x01, 0x02, 0x26, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0b, 0x00,
+                   0x84, 0x73, 0x00, 0x01, 0x00, 0x70, 0x00, 0x04,
+                   0x00, 0x98, 0x00, 0x73, 0x00, 0x01, 0x00, 0x70,
+                   0x00, 0x04, 0x00, 0x78, 0x00),
+        PHYREGS(0x089c, 0x0898, 0x0894, 0x01dc, 0x01dd, 0x01dd),
+  },
+  {     .freq                   = 5510,
+        RADIOREGS3(0x47, 0x01, 0x01, 0x02, 0x27, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0b, 0x00,
+                   0x84, 0x73, 0x00, 0x01, 0x00, 0x70, 0x00, 0x04,
+                   0x00, 0x98, 0x00, 0x73, 0x00, 0x01, 0x00, 0x70,
+                   0x00, 0x04, 0x00, 0x78, 0x00),
+        PHYREGS(0x08a0, 0x089c, 0x0898, 0x01db, 0x01dc, 0x01dd),
+  },
+  {     .freq                   = 5520,
+        RADIOREGS3(0x40, 0x01, 0x01, 0x02, 0x28, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0b, 0x00,
+                   0x84, 0x73, 0x00, 0x01, 0x00, 0x70, 0x00, 0x04,
+                   0x00, 0x98, 0x00, 0x73, 0x00, 0x01, 0x00, 0x70,
+                   0x00, 0x04, 0x00, 0x78, 0x00),
+        PHYREGS(0x08a4, 0x08a0, 0x089c, 0x01da, 0x01db, 0x01dc),
+  },
+  {     .freq                   = 5530,
+        RADIOREGS3(0x40, 0x01, 0x01, 0x02, 0x29, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0b, 0x00,
+                   0x84, 0x63, 0x00, 0x01, 0x00, 0x70, 0x00, 0x03,
+                   0x00, 0x98, 0x00, 0x63, 0x00, 0x01, 0x00, 0x70,
+                   0x00, 0x03, 0x00, 0x78, 0x00),
+        PHYREGS(0x08a8, 0x08a4, 0x08a0, 0x01d9, 0x01da, 0x01db),
+  },
+  {     .freq                   = 5540,
+        RADIOREGS3(0x3a, 0x01, 0x01, 0x02, 0x2a, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0b, 0x00,
+                   0x84, 0x62, 0x00, 0x00, 0x00, 0x70, 0x00, 0x03,
+                   0x00, 0x97, 0x00, 0x62, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x03, 0x00, 0x77, 0x00),
+        PHYREGS(0x08ac, 0x08a8, 0x08a4, 0x01d8, 0x01d9, 0x01da),
+  },
+  {     .freq                   = 5550,
+        RADIOREGS3(0x3a, 0x01, 0x01, 0x02, 0x2b, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0b, 0x00,
+                   0x84, 0x62, 0x00, 0x00, 0x00, 0x70, 0x00, 0x03,
+                   0x00, 0x97, 0x00, 0x62, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x03, 0x00, 0x77, 0x00),
+        PHYREGS(0x08b0, 0x08ac, 0x08a8, 0x01d7, 0x01d8, 0x01d9),
+  },
+  {     .freq                   = 5560,
+        RADIOREGS3(0x34, 0x01, 0x01, 0x02, 0x2c, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0b, 0x00,
+                   0x84, 0x62, 0x00, 0x00, 0x00, 0x70, 0x00, 0x03,
+                   0x00, 0x97, 0x00, 0x62, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x03, 0x00, 0x77, 0x00),
+        PHYREGS(0x08b4, 0x08b0, 0x08ac, 0x01d7, 0x01d7, 0x01d8),
+  },
+  {     .freq                   = 5570,
+        RADIOREGS3(0x34, 0x01, 0x01, 0x02, 0x2d, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0b, 0x00,
+                   0x84, 0x52, 0x00, 0x00, 0x00, 0x70, 0x00, 0x02,
+                   0x00, 0x96, 0x00, 0x52, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x02, 0x00, 0x76, 0x00),
+        PHYREGS(0x08b8, 0x08b4, 0x08b0, 0x01d6, 0x01d7, 0x01d7),
+  },
+  {     .freq                   = 5580,
+        RADIOREGS3(0x2e, 0x01, 0x01, 0x02, 0x2e, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0b, 0x00,
+                   0x84, 0x52, 0x00, 0x00, 0x00, 0x70, 0x00, 0x02,
+                   0x00, 0x96, 0x00, 0x52, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x02, 0x00, 0x76, 0x00),
+        PHYREGS(0x08bc, 0x08b8, 0x08b4, 0x01d5, 0x01d6, 0x01d7),
+  },
+  {     .freq                   = 5590,
+        RADIOREGS3(0x2e, 0x01, 0x01, 0x02, 0x2f, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8d, 0x0b, 0x00,
+                   0x84, 0x51, 0x00, 0x00, 0x00, 0x70, 0x00, 0x02,
+                   0x00, 0x96, 0x00, 0x51, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x02, 0x00, 0x76, 0x00),
+        PHYREGS(0x08c0, 0x08bc, 0x08b8, 0x01d4, 0x01d5, 0x01d6),
+  },
+  {     .freq                   = 5600,
+        RADIOREGS3(0x28, 0x01, 0x01, 0x02, 0x30, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8b, 0x09, 0x00,
+                   0x70, 0x51, 0x00, 0x00, 0x00, 0x70, 0x00, 0x02,
+                   0x00, 0x96, 0x00, 0x51, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x02, 0x00, 0x76, 0x00),
+        PHYREGS(0x08c4, 0x08c0, 0x08bc, 0x01d3, 0x01d4, 0x01d5),
+  },
+  {     .freq                   = 5610,
+        RADIOREGS3(0x28, 0x01, 0x01, 0x02, 0x31, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8b, 0x09, 0x00,
+                   0x70, 0x51, 0x00, 0x00, 0x00, 0x70, 0x00, 0x02,
+                   0x00, 0x96, 0x00, 0x51, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x02, 0x00, 0x76, 0x00),
+        PHYREGS(0x08c8, 0x08c4, 0x08c0, 0x01d2, 0x01d3, 0x01d4),
+  },
+  {     .freq                   = 5620,
+        RADIOREGS3(0x21, 0x01, 0x01, 0x02, 0x32, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8b, 0x09, 0x00,
+                   0x70, 0x51, 0x00, 0x00, 0x00, 0x70, 0x00, 0x02,
+                   0x00, 0x96, 0x00, 0x51, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x02, 0x00, 0x76, 0x00),
+        PHYREGS(0x08cc, 0x08c8, 0x08c4, 0x01d2, 0x01d2, 0x01d3),
+  },
+  {     .freq                   = 5630,
+        RADIOREGS3(0x21, 0x01, 0x01, 0x02, 0x33, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8b, 0x09, 0x00,
+                   0x70, 0x51, 0x00, 0x00, 0x00, 0x70, 0x00, 0x02,
+                   0x00, 0x96, 0x00, 0x51, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x02, 0x00, 0x76, 0x00),
+        PHYREGS(0x08d0, 0x08cc, 0x08c8, 0x01d1, 0x01d2, 0x01d2),
+  },
+  {     .freq                   = 5640,
+        RADIOREGS3(0x1c, 0x01, 0x01, 0x02, 0x34, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8b, 0x09, 0x00,
+                   0x70, 0x51, 0x00, 0x00, 0x00, 0x70, 0x00, 0x02,
+                   0x00, 0x95, 0x00, 0x51, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x02, 0x00, 0x75, 0x00),
+        PHYREGS(0x08d4, 0x08d0, 0x08cc, 0x01d0, 0x01d1, 0x01d2),
+  },
+  {     .freq                   = 5650,
+        RADIOREGS3(0x1c, 0x01, 0x01, 0x02, 0x35, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8b, 0x09, 0x00,
+                   0x70, 0x50, 0x00, 0x00, 0x00, 0x70, 0x00, 0x01,
+                   0x00, 0x95, 0x00, 0x50, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x01, 0x00, 0x75, 0x00),
+        PHYREGS(0x08d8, 0x08d4, 0x08d0, 0x01cf, 0x01d0, 0x01d1),
+  },
+  {     .freq                   = 5660,
+        RADIOREGS3(0x16, 0x01, 0x01, 0x02, 0x36, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8b, 0x09, 0x00,
+                   0x70, 0x50, 0x00, 0x00, 0x00, 0x70, 0x00, 0x01,
+                   0x00, 0x95, 0x00, 0x50, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x01, 0x00, 0x75, 0x00),
+        PHYREGS(0x08dc, 0x08d8, 0x08d4, 0x01ce, 0x01cf, 0x01d0),
+  },
+  {     .freq                   = 5670,
+        RADIOREGS3(0x16, 0x01, 0x01, 0x02, 0x37, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8b, 0x09, 0x00,
+                   0x70, 0x40, 0x00, 0x00, 0x00, 0x70, 0x00, 0x01,
+                   0x00, 0x94, 0x00, 0x40, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x01, 0x00, 0x74, 0x00),
+        PHYREGS(0x08e0, 0x08dc, 0x08d8, 0x01ce, 0x01ce, 0x01cf),
+  },
+  {     .freq                   = 5680,
+        RADIOREGS3(0x10, 0x01, 0x01, 0x02, 0x38, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8b, 0x09, 0x00,
+                   0x70, 0x40, 0x00, 0x00, 0x00, 0x70, 0x00, 0x01,
+                   0x00, 0x94, 0x00, 0x40, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x01, 0x00, 0x74, 0x00),
+        PHYREGS(0x08e4, 0x08e0, 0x08dc, 0x01cd, 0x01ce, 0x01ce),
+  },
+  {     .freq                   = 5690,
+        RADIOREGS3(0x10, 0x01, 0x01, 0x02, 0x39, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8b, 0x09, 0x00,
+                   0x70, 0x40, 0x00, 0x00, 0x00, 0x70, 0x00, 0x01,
+                   0x00, 0x94, 0x00, 0x40, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x01, 0x00, 0x74, 0x00),
+        PHYREGS(0x08e8, 0x08e4, 0x08e0, 0x01cc, 0x01cd, 0x01ce),
+  },
+  {     .freq                   = 5700,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3a, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x40, 0x00, 0x00, 0x00, 0x70, 0x00, 0x01,
+                   0x00, 0x94, 0x00, 0x40, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x01, 0x00, 0x74, 0x00),
+        PHYREGS(0x08ec, 0x08e8, 0x08e4, 0x01cb, 0x01cc, 0x01cd),
+  },
+  {     .freq                   = 5710,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3b, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x40, 0x00, 0x00, 0x00, 0x70, 0x00, 0x01,
+                   0x00, 0x94, 0x00, 0x40, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x01, 0x00, 0x74, 0x00),
+        PHYREGS(0x08f0, 0x08ec, 0x08e8, 0x01ca, 0x01cb, 0x01cc),
+  },
+  {     .freq                   = 5720,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3c, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x40, 0x00, 0x00, 0x00, 0x70, 0x00, 0x01,
+                   0x00, 0x94, 0x00, 0x40, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x01, 0x00, 0x74, 0x00),
+        PHYREGS(0x08f4, 0x08f0, 0x08ec, 0x01c9, 0x01ca, 0x01cb),
+  },
+  {     .freq                   = 5725,
+        RADIOREGS3(0x03, 0x01, 0x02, 0x04, 0x79, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x40, 0x00, 0x00, 0x00, 0x70, 0x00, 0x01,
+                   0x00, 0x94, 0x00, 0x40, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x01, 0x00, 0x74, 0x00),
+        PHYREGS(0x08f6, 0x08f2, 0x08ee, 0x01c9, 0x01ca, 0x01cb),
+  },
+  {     .freq                   = 5730,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3d, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x30, 0x00, 0x00, 0x00, 0x70, 0x00, 0x01,
+                   0x00, 0x94, 0x00, 0x30, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x01, 0x00, 0x84, 0x00),
+        PHYREGS(0x08f8, 0x08f4, 0x08f0, 0x01c9, 0x01c9, 0x01ca),
+  },
+  {     .freq                   = 5735,
+        RADIOREGS3(0x03, 0x01, 0x02, 0x04, 0x7b, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x30, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x93, 0x00, 0x30, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x83, 0x00),
+        PHYREGS(0x08fa, 0x08f6, 0x08f2, 0x01c8, 0x01c9, 0x01ca),
+  },
+  {     .freq                   = 5740,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3e, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x30, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x93, 0x00, 0x30, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x83, 0x00),
+        PHYREGS(0x08fc, 0x08f8, 0x08f4, 0x01c8, 0x01c9, 0x01c9),
+  },
+  {     .freq                   = 5745,
+        RADIOREGS3(0xfe, 0x00, 0x02, 0x04, 0x7d, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x30, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x93, 0x00, 0x30, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x83, 0x00),
+        PHYREGS(0x08fe, 0x08fa, 0x08f6, 0x01c8, 0x01c8, 0x01c9),
+  },
+  {     .freq                   = 5750,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3f, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x30, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x93, 0x00, 0x30, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x83, 0x00),
+        PHYREGS(0x0900, 0x08fc, 0x08f8, 0x01c7, 0x01c8, 0x01c9),
+  },
+  {     .freq                   = 5755,
+        RADIOREGS3(0xfe, 0x00, 0x02, 0x04, 0x7f, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x30, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x93, 0x00, 0x30, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x83, 0x00),
+        PHYREGS(0x0902, 0x08fe, 0x08fa, 0x01c7, 0x01c8, 0x01c8),
+  },
+  {     .freq                   = 5760,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x40, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x20, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x93, 0x00, 0x20, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x83, 0x00),
+        PHYREGS(0x0904, 0x0900, 0x08fc, 0x01c6, 0x01c7, 0x01c8),
+  },
+  {     .freq                   = 5765,
+        RADIOREGS3(0xf8, 0x00, 0x02, 0x04, 0x81, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x20, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x92, 0x00, 0x20, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x82, 0x00),
+        PHYREGS(0x0906, 0x0902, 0x08fe, 0x01c6, 0x01c7, 0x01c8),
+  },
+  {     .freq                   = 5770,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x41, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x20, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x92, 0x00, 0x20, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x82, 0x00),
+        PHYREGS(0x0908, 0x0904, 0x0900, 0x01c6, 0x01c6, 0x01c7),
+  },
+  {     .freq                   = 5775,
+        RADIOREGS3(0xf8, 0x00, 0x02, 0x04, 0x83, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x20, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x92, 0x00, 0x20, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x82, 0x00),
+        PHYREGS(0x090a, 0x0906, 0x0902, 0x01c5, 0x01c6, 0x01c7),
+  },
+  {     .freq                   = 5780,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x42, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x8a, 0x06, 0x00,
+                   0x40, 0x10, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x92, 0x00, 0x10, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x82, 0x00),
+        PHYREGS(0x090c, 0x0908, 0x0904, 0x01c5, 0x01c6, 0x01c6),
+  },
+  {     .freq                   = 5785,
+        RADIOREGS3(0xf2, 0x00, 0x02, 0x04, 0x85, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x06, 0x06, 0x06, 0x8a, 0x06, 0x00,
+                   0x40, 0x10, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x92, 0x00, 0x10, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x82, 0x00),
+        PHYREGS(0x090e, 0x090a, 0x0906, 0x01c4, 0x01c5, 0x01c6),
+  },
+  {     .freq                   = 5790,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x43, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x8a, 0x06, 0x00,
+                   0x40, 0x10, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x92, 0x00, 0x10, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x82, 0x00),
+        PHYREGS(0x0910, 0x090c, 0x0908, 0x01c4, 0x01c5, 0x01c6),
+  },
+  {     .freq                   = 5795,
+        RADIOREGS3(0xf2, 0x00, 0x02, 0x04, 0x87, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x06, 0x06, 0x06, 0x8a, 0x06, 0x00,
+                   0x40, 0x10, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x92, 0x00, 0x10, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x82, 0x00),
+        PHYREGS(0x0912, 0x090e, 0x090a, 0x01c4, 0x01c4, 0x01c5),
+  },
+  {     .freq                   = 5800,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x44, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x88, 0x04, 0x00,
+                   0x20, 0x10, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x92, 0x00, 0x10, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x82, 0x00),
+        PHYREGS(0x0914, 0x0910, 0x090c, 0x01c3, 0x01c4, 0x01c5),
+  },
+  {     .freq                   = 5805,
+        RADIOREGS3(0xed, 0x00, 0x02, 0x04, 0x89, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x06, 0x06, 0x06, 0x88, 0x04, 0x00,
+                   0x20, 0x10, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x92, 0x00, 0x10, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x82, 0x00),
+        PHYREGS(0x0916, 0x0912, 0x090e, 0x01c3, 0x01c4, 0x01c4),
+  },
+  {     .freq                   = 5810,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x45, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x88, 0x04, 0x00,
+                   0x20, 0x10, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x92, 0x00, 0x10, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x82, 0x00),
+        PHYREGS(0x0918, 0x0914, 0x0910, 0x01c2, 0x01c3, 0x01c4),
+  },
+  {     .freq                   = 5815,
+        RADIOREGS3(0xed, 0x00, 0x02, 0x04, 0x8b, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x06, 0x06, 0x06, 0x88, 0x04, 0x00,
+                   0x20, 0x10, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x92, 0x00, 0x10, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x82, 0x00),
+        PHYREGS(0x091a, 0x0916, 0x0912, 0x01c2, 0x01c3, 0x01c4),
+  },
+  {     .freq                   = 5820,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x46, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x88, 0x04, 0x00,
+                   0x20, 0x10, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x92, 0x00, 0x10, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x82, 0x00),
+        PHYREGS(0x091c, 0x0918, 0x0914, 0x01c2, 0x01c2, 0x01c3),
+  },
+  {     .freq                   = 5825,
+        RADIOREGS3(0xed, 0x00, 0x02, 0x04, 0x8d, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x06, 0x06, 0x06, 0x88, 0x04, 0x00,
+                   0x20, 0x10, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x92, 0x00, 0x10, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x82, 0x00),
+        PHYREGS(0x091e, 0x091a, 0x0916, 0x01c1, 0x01c2, 0x01c3),
+  },
+  {     .freq                   = 5830,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x47, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x88, 0x04, 0x00,
+                   0x20, 0x10, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x92, 0x00, 0x10, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x72, 0x00),
+        PHYREGS(0x0920, 0x091c, 0x0918, 0x01c1, 0x01c2, 0x01c2),
+  },
+  {     .freq                   = 5840,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x48, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x88, 0x04, 0x00,
+                   0x20, 0x10, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x92, 0x00, 0x10, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x72, 0x00),
+        PHYREGS(0x0924, 0x0920, 0x091c, 0x01c0, 0x01c1, 0x01c2),
+  },
+  {     .freq                   = 5850,
+        RADIOREGS3(0xe0, 0x00, 0x01, 0x02, 0x49, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x88, 0x04, 0x00,
+                   0x20, 0x00, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x92, 0x00, 0x00, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x72, 0x00),
+        PHYREGS(0x0928, 0x0924, 0x0920, 0x01bf, 0x01c0, 0x01c1),
+  },
+  {     .freq                   = 5860,
+        RADIOREGS3(0xde, 0x00, 0x01, 0x02, 0x4a, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x88, 0x04, 0x00,
+                   0x20, 0x00, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x92, 0x00, 0x00, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x72, 0x00),
+        PHYREGS(0x092c, 0x0928, 0x0924, 0x01bf, 0x01bf, 0x01c0),
+  },
+  {     .freq                   = 5870,
+        RADIOREGS3(0xdb, 0x00, 0x01, 0x02, 0x4b, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x88, 0x04, 0x00,
+                   0x20, 0x00, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x91, 0x00, 0x00, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x71, 0x00),
+        PHYREGS(0x0930, 0x092c, 0x0928, 0x01be, 0x01bf, 0x01bf),
+  },
+  {     .freq                   = 5880,
+        RADIOREGS3(0xd8, 0x00, 0x01, 0x02, 0x4c, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x88, 0x04, 0x00,
+                   0x20, 0x00, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x91, 0x00, 0x00, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x71, 0x00),
+        PHYREGS(0x0934, 0x0930, 0x092c, 0x01bd, 0x01be, 0x01bf),
+  },
+  {     .freq                   = 5890,
+        RADIOREGS3(0xd6, 0x00, 0x01, 0x02, 0x4d, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x88, 0x04, 0x00,
+                   0x20, 0x00, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x91, 0x00, 0x00, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x71, 0x00),
+        PHYREGS(0x0938, 0x0934, 0x0930, 0x01bc, 0x01bd, 0x01be),
+  },
+  {     .freq                   = 5900,
+        RADIOREGS3(0xd3, 0x00, 0x01, 0x02, 0x4e, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x87, 0x03, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x91, 0x00, 0x00, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x71, 0x00),
+        PHYREGS(0x093c, 0x0938, 0x0934, 0x01bc, 0x01bc, 0x01bd),
+  },
+  {     .freq                   = 5910,
+        RADIOREGS3(0xd6, 0x00, 0x01, 0x02, 0x4f, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x87, 0x03, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x91, 0x00, 0x00, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x71, 0x00),
+        PHYREGS(0x0940, 0x093c, 0x0938, 0x01bb, 0x01bc, 0x01bc),
+  },
+  {     .freq                   = 2412,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x6c, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x04, 0x04, 0x04, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x1f, 0x00, 0x03, 0x00, 0x70, 0x00,
+                   0x0f, 0x00, 0x0b, 0x00, 0x1f, 0x00, 0x03, 0x00,
+                   0x70, 0x00, 0x0f, 0x00, 0x0b),
+        PHYREGS(0x03c9, 0x03c5, 0x03c1, 0x043a, 0x043f, 0x0443),
+  },
+  {     .freq                   = 2417,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x71, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x1f, 0x00, 0x03, 0x00, 0x70, 0x00,
+                   0x0f, 0x00, 0x0a, 0x00, 0x1f, 0x00, 0x03, 0x00,
+                   0x70, 0x00, 0x0f, 0x00, 0x0a),
+        PHYREGS(0x03cb, 0x03c7, 0x03c3, 0x0438, 0x043d, 0x0441),
+  },
+  {     .freq                   = 2422,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x76, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x0e, 0x00, 0x03, 0x00, 0x70, 0x00,
+                   0x0f, 0x00, 0x0a, 0x00, 0x0e, 0x00, 0x03, 0x00,
+                   0x70, 0x00, 0x0f, 0x00, 0x0a),
+        PHYREGS(0x03cd, 0x03c9, 0x03c5, 0x0436, 0x043a, 0x043f),
+  },
+  {     .freq                   = 2427,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x7b, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x0d, 0x00, 0x03, 0x00, 0x70, 0x00,
+                   0x0e, 0x00, 0x0a, 0x00, 0x0d, 0x00, 0x03, 0x00,
+                   0x70, 0x00, 0x0e, 0x00, 0x0a),
+        PHYREGS(0x03cf, 0x03cb, 0x03c7, 0x0434, 0x0438, 0x043d),
+  },
+  {     .freq                   = 2432,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x80, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x0c, 0x00, 0x03, 0x00, 0x70, 0x00,
+                   0x0e, 0x00, 0x0a, 0x00, 0x0c, 0x00, 0x03, 0x00,
+                   0x70, 0x00, 0x0e, 0x00, 0x0a),
+        PHYREGS(0x03d1, 0x03cd, 0x03c9, 0x0431, 0x0436, 0x043a),
+  },
+  {     .freq                   = 2437,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x85, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x0b, 0x00, 0x03, 0x00, 0x70, 0x00,
+                   0x0e, 0x00, 0x0a, 0x00, 0x0b, 0x00, 0x03, 0x00,
+                   0x70, 0x00, 0x0e, 0x00, 0x0a),
+        PHYREGS(0x03d3, 0x03cf, 0x03cb, 0x042f, 0x0434, 0x0438),
+  },
+  {     .freq                   = 2442,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x8a, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x09, 0x00, 0x03, 0x00, 0x70, 0x00,
+                   0x0e, 0x00, 0x0a, 0x00, 0x09, 0x00, 0x03, 0x00,
+                   0x70, 0x00, 0x0e, 0x00, 0x0a),
+        PHYREGS(0x03d5, 0x03d1, 0x03cd, 0x042d, 0x0431, 0x0436),
+  },
+  {     .freq                   = 2447,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x8f, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x06, 0x06, 0x06, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x08, 0x00, 0x02, 0x00, 0x70, 0x00,
+                   0x0e, 0x00, 0x09, 0x00, 0x08, 0x00, 0x02, 0x00,
+                   0x70, 0x00, 0x0e, 0x00, 0x09),
+        PHYREGS(0x03d7, 0x03d3, 0x03cf, 0x042b, 0x042f, 0x0434),
+  },
+  {     .freq                   = 2452,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x94, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x06, 0x06, 0x06, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x07, 0x00, 0x02, 0x00, 0x70, 0x00,
+                   0x0e, 0x00, 0x09, 0x00, 0x07, 0x00, 0x02, 0x00,
+                   0x70, 0x00, 0x0e, 0x00, 0x09),
+        PHYREGS(0x03d9, 0x03d5, 0x03d1, 0x0429, 0x042d, 0x0431),
+  },
+  {     .freq                   = 2457,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x99, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x06, 0x06, 0x06, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x06, 0x00, 0x02, 0x00, 0x70, 0x00,
+                   0x0d, 0x00, 0x09, 0x00, 0x06, 0x00, 0x02, 0x00,
+                   0x70, 0x00, 0x0d, 0x00, 0x09),
+        PHYREGS(0x03db, 0x03d7, 0x03d3, 0x0427, 0x042b, 0x042f),
+  },
+  {     .freq                   = 2462,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x9e, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x06, 0x06, 0x06, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x05, 0x00, 0x02, 0x00, 0x70, 0x00,
+                   0x0d, 0x00, 0x09, 0x00, 0x05, 0x00, 0x02, 0x00,
+                   0x70, 0x00, 0x0d, 0x00, 0x09),
+        PHYREGS(0x03dd, 0x03d9, 0x03d5, 0x0424, 0x0429, 0x042d),
+  },
+  {     .freq                   = 2467,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0xa3, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x06, 0x06, 0x06, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x04, 0x00, 0x02, 0x00, 0x70, 0x00,
+                   0x0d, 0x00, 0x08, 0x00, 0x04, 0x00, 0x02, 0x00,
+                   0x70, 0x00, 0x0d, 0x00, 0x08),
+        PHYREGS(0x03df, 0x03db, 0x03d7, 0x0422, 0x0427, 0x042b),
+  },
+  {     .freq                   = 2472,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0xa8, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x07, 0x07, 0x07, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x03, 0x00, 0x02, 0x00, 0x70, 0x00,
+                   0x0d, 0x00, 0x08, 0x00, 0x03, 0x00, 0x02, 0x00,
+                   0x70, 0x00, 0x0d, 0x00, 0x08),
+        PHYREGS(0x03e1, 0x03dd, 0x03d9, 0x0420, 0x0424, 0x0429),
+  },
+  {     .freq                   = 2484,
+        RADIOREGS3(0xff, 0x01, 0x03, 0x09, 0xb4, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x07, 0x07, 0x07, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x70, 0x00,
+                   0x0d, 0x00, 0x08, 0x00, 0x00, 0x00, 0x02, 0x00,
+                   0x70, 0x00, 0x0d, 0x00, 0x08),
+        PHYREGS(0x03e6, 0x03e2, 0x03de, 0x041b, 0x041f, 0x0424),
+  },
+};
+
+static const struct b43_nphy_channeltab_entry_rev3 b43_nphy_channeltab_rev6[] = {
+  {     .freq                   = 4920,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xec, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x00, 0x00, 0x00, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07b4, 0x07b0, 0x07ac, 0x0214, 0x0215, 0x0216),
+  },
+  {     .freq                   = 4930,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xed, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x00, 0x00, 0x00, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07b8, 0x07b4, 0x07b0, 0x0213, 0x0214, 0x0215),
+  },
+  {     .freq                   = 4940,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xee, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x00, 0x00, 0x00, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07bc, 0x07b8, 0x07b4, 0x0212, 0x0213, 0x0214),
+  },
+  {     .freq                   = 4950,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xef, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x00, 0x00, 0x00, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07c0, 0x07bc, 0x07b8, 0x0211, 0x0212, 0x0213),
+  },
+  {     .freq                   = 4960,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf0, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07c4, 0x07c0, 0x07bc, 0x020f, 0x0211, 0x0212),
+  },
+  {     .freq                   = 4970,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf1, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07c8, 0x07c4, 0x07c0, 0x020e, 0x020f, 0x0211),
+  },
+  {     .freq                   = 4980,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf2, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07cc, 0x07c8, 0x07c4, 0x020d, 0x020e, 0x020f),
+  },
+  {     .freq                   = 4990,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf3, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07d0, 0x07cc, 0x07c8, 0x020c, 0x020d, 0x020e),
+  },
+  {     .freq                   = 5000,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf4, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07d4, 0x07d0, 0x07cc, 0x020b, 0x020c, 0x020d),
+  },
+  {     .freq                   = 5010,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf5, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07d8, 0x07d4, 0x07d0, 0x020a, 0x020b, 0x020c),
+  },
+  {     .freq                   = 5020,
+        RADIOREGS3(0xf7, 0x01, 0x01, 0x01, 0xf6, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07dc, 0x07d8, 0x07d4, 0x0209, 0x020a, 0x020b),
+  },
+  {     .freq                   = 5030,
+        RADIOREGS3(0xf7, 0x01, 0x01, 0x01, 0xf7, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07e0, 0x07dc, 0x07d8, 0x0208, 0x0209, 0x020a),
+  },
+  {     .freq                   = 5040,
+        RADIOREGS3(0xef, 0x01, 0x01, 0x01, 0xf8, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07e4, 0x07e0, 0x07dc, 0x0207, 0x0208, 0x0209),
+  },
+  {     .freq                   = 5050,
+        RADIOREGS3(0xef, 0x01, 0x01, 0x01, 0xf9, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07e8, 0x07e4, 0x07e0, 0x0206, 0x0207, 0x0208),
+  },
+  {     .freq                   = 5060,
+        RADIOREGS3(0xe6, 0x01, 0x01, 0x01, 0xfa, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07ec, 0x07e8, 0x07e4, 0x0205, 0x0206, 0x0207),
+  },
+  {     .freq                   = 5070,
+        RADIOREGS3(0xe6, 0x01, 0x01, 0x01, 0xfb, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfd, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfd, 0x00, 0x09, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07f0, 0x07ec, 0x07e8, 0x0204, 0x0205, 0x0206),
+  },
+  {     .freq                   = 5080,
+        RADIOREGS3(0xde, 0x01, 0x01, 0x01, 0xfc, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfd, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfd, 0x00, 0x09, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07f4, 0x07f0, 0x07ec, 0x0203, 0x0204, 0x0205),
+  },
+  {     .freq                   = 5090,
+        RADIOREGS3(0xde, 0x01, 0x01, 0x01, 0xfd, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfd, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfd, 0x00, 0x09, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07f8, 0x07f4, 0x07f0, 0x0202, 0x0203, 0x0204),
+  },
+  {     .freq                   = 5100,
+        RADIOREGS3(0xd6, 0x01, 0x01, 0x01, 0xfe, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfd, 0x00, 0x08, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfd, 0x00, 0x08, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07fc, 0x07f8, 0x07f4, 0x0201, 0x0202, 0x0203),
+  },
+  {     .freq                   = 5110,
+        RADIOREGS3(0xd6, 0x01, 0x01, 0x01, 0xff, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfc, 0x00, 0x08, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfc, 0x00, 0x08, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0800, 0x07fc, 0x07f8, 0x0200, 0x0201, 0x0202),
+  },
+  {     .freq                   = 5120,
+        RADIOREGS3(0xce, 0x01, 0x01, 0x02, 0x00, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfc, 0x00, 0x08, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfc, 0x00, 0x08, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0804, 0x0800, 0x07fc, 0x01ff, 0x0200, 0x0201),
+  },
+  {     .freq                   = 5130,
+        RADIOREGS3(0xce, 0x01, 0x01, 0x02, 0x01, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfc, 0x00, 0x08, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfc, 0x00, 0x08, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0808, 0x0804, 0x0800, 0x01fe, 0x01ff, 0x0200),
+  },
+  {     .freq                   = 5140,
+        RADIOREGS3(0xc6, 0x01, 0x01, 0x02, 0x02, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfb, 0x00, 0x08, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfb, 0x00, 0x08, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x080c, 0x0808, 0x0804, 0x01fd, 0x01fe, 0x01ff),
+  },
+  {     .freq                   = 5160,
+        RADIOREGS3(0xbe, 0x01, 0x01, 0x02, 0x04, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfa, 0x00, 0x07, 0x00, 0x77, 0x00, 0x0e,
+                   0x00, 0x6f, 0x00, 0xfa, 0x00, 0x07, 0x00, 0x77,
+                   0x00, 0x0e, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0814, 0x0810, 0x080c, 0x01fb, 0x01fc, 0x01fd),
+  },
+  {     .freq                   = 5170,
+        RADIOREGS3(0xbe, 0x01, 0x01, 0x02, 0x05, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfa, 0x00, 0x07, 0x00, 0x77, 0x00, 0x0e,
+                   0x00, 0x6f, 0x00, 0xfa, 0x00, 0x07, 0x00, 0x77,
+                   0x00, 0x0e, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0818, 0x0814, 0x0810, 0x01fa, 0x01fb, 0x01fc),
+  },
+  {     .freq                   = 5180,
+        RADIOREGS3(0xb6, 0x01, 0x01, 0x02, 0x06, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xf9, 0x00, 0x06, 0x00, 0x77, 0x00, 0x0e,
+                   0x00, 0x6f, 0x00, 0xf9, 0x00, 0x06, 0x00, 0x77,
+                   0x00, 0x0e, 0x00, 0x6f, 0x00),
+        PHYREGS(0x081c, 0x0818, 0x0814, 0x01f9, 0x01fa, 0x01fb),
+  },
+  {     .freq                   = 5190,
+        RADIOREGS3(0xb6, 0x01, 0x01, 0x02, 0x07, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xf9, 0x00, 0x06, 0x00, 0x77, 0x00, 0x0d,
+                   0x00, 0x6f, 0x00, 0xf9, 0x00, 0x06, 0x00, 0x77,
+                   0x00, 0x0d, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0820, 0x081c, 0x0818, 0x01f8, 0x01f9, 0x01fa),
+  },
+  {     .freq                   = 5200,
+        RADIOREGS3(0xaf, 0x01, 0x01, 0x02, 0x08, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xf9, 0x00, 0x05, 0x00, 0x77, 0x00, 0x0d,
+                   0x00, 0x6f, 0x00, 0xf9, 0x00, 0x05, 0x00, 0x77,
+                   0x00, 0x0d, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0824, 0x0820, 0x081c, 0x01f7, 0x01f8, 0x01f9),
+  },
+  {     .freq                   = 5210,
+        RADIOREGS3(0xaf, 0x01, 0x01, 0x02, 0x09, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xf9, 0x00, 0x05, 0x00, 0x77, 0x00, 0x0d,
+                   0x00, 0x6f, 0x00, 0xf9, 0x00, 0x05, 0x00, 0x77,
+                   0x00, 0x0d, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0828, 0x0824, 0x0820, 0x01f6, 0x01f7, 0x01f8),
+  },
+  {     .freq                   = 5220,
+        RADIOREGS3(0xa7, 0x01, 0x01, 0x02, 0x0a, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8e, 0x0f, 0x00,
+                   0xfe, 0xd8, 0x00, 0x05, 0x00, 0x77, 0x00, 0x0d,
+                   0x00, 0x6f, 0x00, 0xd8, 0x00, 0x05, 0x00, 0x77,
+                   0x00, 0x0d, 0x00, 0x6f, 0x00),
+        PHYREGS(0x082c, 0x0828, 0x0824, 0x01f5, 0x01f6, 0x01f7),
+  },
+  {     .freq                   = 5230,
+        RADIOREGS3(0xa7, 0x01, 0x01, 0x02, 0x0b, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8e, 0x0f, 0x00,
+                   0xee, 0xd8, 0x00, 0x05, 0x00, 0x77, 0x00, 0x0d,
+                   0x00, 0x6f, 0x00, 0xd8, 0x00, 0x05, 0x00, 0x77,
+                   0x00, 0x0d, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0830, 0x082c, 0x0828, 0x01f4, 0x01f5, 0x01f6),
+  },
+  {     .freq                   = 5240,
+        RADIOREGS3(0xa0, 0x01, 0x01, 0x02, 0x0c, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8e, 0x0f, 0x00,
+                   0xee, 0xc8, 0x00, 0x05, 0x00, 0x77, 0x00, 0x0d,
+                   0x00, 0x6f, 0x00, 0xc8, 0x00, 0x05, 0x00, 0x77,
+                   0x00, 0x0d, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0834, 0x0830, 0x082c, 0x01f3, 0x01f4, 0x01f5),
+  },
+  {     .freq                   = 5250,
+        RADIOREGS3(0xa0, 0x01, 0x01, 0x02, 0x0d, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8e, 0x0f, 0x00,
+                   0xed, 0xc7, 0x00, 0x05, 0x00, 0x77, 0x00, 0x0d,
+                   0x00, 0x6f, 0x00, 0xc7, 0x00, 0x05, 0x00, 0x77,
+                   0x00, 0x0d, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0838, 0x0834, 0x0830, 0x01f2, 0x01f3, 0x01f4),
+  },
+  {     .freq                   = 5260,
+        RADIOREGS3(0x98, 0x01, 0x01, 0x02, 0x0e, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8e, 0x0e, 0x00,
+                   0xed, 0xc7, 0x00, 0x04, 0x00, 0x77, 0x00, 0x0d,
+                   0x00, 0x6f, 0x00, 0xc7, 0x00, 0x04, 0x00, 0x77,
+                   0x00, 0x0d, 0x00, 0x6f, 0x00),
+        PHYREGS(0x083c, 0x0838, 0x0834, 0x01f1, 0x01f2, 0x01f3),
+  },
+  {     .freq                   = 5270,
+        RADIOREGS3(0x98, 0x01, 0x01, 0x02, 0x0f, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8e, 0x0e, 0x00,
+                   0xed, 0xc7, 0x00, 0x04, 0x00, 0x77, 0x00, 0x0c,
+                   0x00, 0x6f, 0x00, 0xc7, 0x00, 0x04, 0x00, 0x77,
+                   0x00, 0x0c, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0840, 0x083c, 0x0838, 0x01f0, 0x01f1, 0x01f2),
+  },
+  {     .freq                   = 5280,
+        RADIOREGS3(0x91, 0x01, 0x01, 0x02, 0x10, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0e, 0x00,
+                   0xdc, 0xb7, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0c,
+                   0x00, 0x6f, 0x00, 0xb7, 0x00, 0x03, 0x00, 0x77,
+                   0x00, 0x0c, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0844, 0x0840, 0x083c, 0x01f0, 0x01f0, 0x01f1),
+  },
+  {     .freq                   = 5290,
+        RADIOREGS3(0x91, 0x01, 0x01, 0x02, 0x11, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0e, 0x00,
+                   0xdc, 0xb7, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0c,
+                   0x00, 0x6f, 0x00, 0xb7, 0x00, 0x03, 0x00, 0x77,
+                   0x00, 0x0c, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0848, 0x0844, 0x0840, 0x01ef, 0x01f0, 0x01f0),
+  },
+  {     .freq                   = 5300,
+        RADIOREGS3(0x8a, 0x01, 0x01, 0x02, 0x12, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0e, 0x00,
+                   0xdc, 0xb7, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0c,
+                   0x00, 0x6f, 0x00, 0xb7, 0x00, 0x03, 0x00, 0x77,
+                   0x00, 0x0c, 0x00, 0x6f, 0x00),
+        PHYREGS(0x084c, 0x0848, 0x0844, 0x01ee, 0x01ef, 0x01f0),
+  },
+  {     .freq                   = 5310,
+        RADIOREGS3(0x8a, 0x01, 0x01, 0x02, 0x13, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0e, 0x00,
+                   0xdc, 0xb7, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0c,
+                   0x00, 0x6f, 0x00, 0xb7, 0x00, 0x03, 0x00, 0x77,
+                   0x00, 0x0c, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0850, 0x084c, 0x0848, 0x01ed, 0x01ee, 0x01ef),
+  },
+  {     .freq                   = 5320,
+        RADIOREGS3(0x83, 0x01, 0x01, 0x02, 0x14, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0e, 0x00,
+                   0xdb, 0xb7, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0c,
+                   0x00, 0x6f, 0x00, 0xb7, 0x00, 0x03, 0x00, 0x77,
+                   0x00, 0x0c, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0854, 0x0850, 0x084c, 0x01ec, 0x01ed, 0x01ee),
+  },
+  {     .freq                   = 5330,
+        RADIOREGS3(0x83, 0x01, 0x01, 0x02, 0x15, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0d, 0x00,
+                   0xcb, 0xa6, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0b,
+                   0x00, 0x6f, 0x00, 0xa6, 0x00, 0x03, 0x00, 0x77,
+                   0x00, 0x0b, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0858, 0x0854, 0x0850, 0x01eb, 0x01ec, 0x01ed),
+  },
+  {     .freq                   = 5340,
+        RADIOREGS3(0x7c, 0x01, 0x01, 0x02, 0x16, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0d, 0x00,
+                   0xca, 0xa6, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0b,
+                   0x00, 0x6f, 0x00, 0xa6, 0x00, 0x03, 0x00, 0x77,
+                   0x00, 0x0b, 0x00, 0x6f, 0x00),
+        PHYREGS(0x085c, 0x0858, 0x0854, 0x01ea, 0x01eb, 0x01ec),
+  },
+  {     .freq                   = 5350,
+        RADIOREGS3(0x7c, 0x01, 0x01, 0x02, 0x17, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0d, 0x00,
+                   0xca, 0xa6, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0b,
+                   0x00, 0x6f, 0x00, 0xa6, 0x00, 0x03, 0x00, 0x77,
+                   0x00, 0x0b, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0860, 0x085c, 0x0858, 0x01e9, 0x01ea, 0x01eb),
+  },
+  {     .freq                   = 5360,
+        RADIOREGS3(0x75, 0x01, 0x01, 0x02, 0x18, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0d, 0x00,
+                   0xc9, 0x95, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0a,
+                   0x00, 0x6f, 0x00, 0x95, 0x00, 0x03, 0x00, 0x77,
+                   0x00, 0x0a, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0864, 0x0860, 0x085c, 0x01e8, 0x01e9, 0x01ea),
+  },
+  {     .freq                   = 5370,
+        RADIOREGS3(0x75, 0x01, 0x01, 0x02, 0x19, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0d, 0x00,
+                   0xc9, 0x95, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0a,
+                   0x00, 0x6f, 0x00, 0x95, 0x00, 0x03, 0x00, 0x77,
+                   0x00, 0x0a, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0868, 0x0864, 0x0860, 0x01e7, 0x01e8, 0x01e9),
+  },
+  {     .freq                   = 5380,
+        RADIOREGS3(0x6e, 0x01, 0x01, 0x02, 0x1a, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0c, 0x00,
+                   0xb8, 0x95, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0a,
+                   0x00, 0x6f, 0x00, 0x95, 0x00, 0x03, 0x00, 0x77,
+                   0x00, 0x0a, 0x00, 0x6f, 0x00),
+        PHYREGS(0x086c, 0x0868, 0x0864, 0x01e6, 0x01e7, 0x01e8),
+  },
+  {     .freq                   = 5390,
+        RADIOREGS3(0x6e, 0x01, 0x01, 0x02, 0x1b, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0c, 0x00,
+                   0xb8, 0x84, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0a,
+                   0x00, 0x6f, 0x00, 0x84, 0x00, 0x03, 0x00, 0x77,
+                   0x00, 0x0a, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0870, 0x086c, 0x0868, 0x01e5, 0x01e6, 0x01e7),
+  },
+  {     .freq                   = 5400,
+        RADIOREGS3(0x67, 0x01, 0x01, 0x02, 0x1c, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0c, 0x00,
+                   0xb8, 0x84, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0a,
+                   0x00, 0x6f, 0x00, 0x84, 0x00, 0x03, 0x00, 0x77,
+                   0x00, 0x0a, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0874, 0x0870, 0x086c, 0x01e5, 0x01e5, 0x01e6),
+  },
+  {     .freq                   = 5410,
+        RADIOREGS3(0x67, 0x01, 0x01, 0x02, 0x1d, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0c, 0x00,
+                   0xb7, 0x84, 0x00, 0x02, 0x00, 0x77, 0x00, 0x0a,
+                   0x00, 0x6f, 0x00, 0x84, 0x00, 0x02, 0x00, 0x77,
+                   0x00, 0x0a, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0878, 0x0874, 0x0870, 0x01e4, 0x01e5, 0x01e5),
+  },
+  {     .freq                   = 5420,
+        RADIOREGS3(0x61, 0x01, 0x01, 0x02, 0x1e, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0c, 0x00,
+                   0xa7, 0x84, 0x00, 0x02, 0x00, 0x77, 0x00, 0x0a,
+                   0x00, 0x6f, 0x00, 0x84, 0x00, 0x02, 0x00, 0x77,
+                   0x00, 0x0a, 0x00, 0x6f, 0x00),
+        PHYREGS(0x087c, 0x0878, 0x0874, 0x01e3, 0x01e4, 0x01e5),
+  },
+  {     .freq                   = 5430,
+        RADIOREGS3(0x61, 0x01, 0x01, 0x02, 0x1f, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0b, 0x00,
+                   0xa6, 0x84, 0x00, 0x02, 0x00, 0x77, 0x00, 0x0a,
+                   0x00, 0x6f, 0x00, 0x84, 0x00, 0x02, 0x00, 0x77,
+                   0x00, 0x0a, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0880, 0x087c, 0x0878, 0x01e2, 0x01e3, 0x01e4),
+  },
+  {     .freq                   = 5440,
+        RADIOREGS3(0x5a, 0x01, 0x01, 0x02, 0x20, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8b, 0x0b, 0x00,
+                   0xa6, 0x84, 0x00, 0x02, 0x00, 0x77, 0x00, 0x09,
+                   0x00, 0x6f, 0x00, 0x84, 0x00, 0x02, 0x00, 0x77,
+                   0x00, 0x09, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0884, 0x0880, 0x087c, 0x01e1, 0x01e2, 0x01e3),
+  },
+  {     .freq                   = 5450,
+        RADIOREGS3(0x5a, 0x01, 0x01, 0x02, 0x21, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8b, 0x0b, 0x00,
+                   0x95, 0x84, 0x00, 0x01, 0x00, 0x77, 0x00, 0x09,
+                   0x00, 0x6f, 0x00, 0x84, 0x00, 0x01, 0x00, 0x77,
+                   0x00, 0x09, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0888, 0x0884, 0x0880, 0x01e0, 0x01e1, 0x01e2),
+  },
+  {     .freq                   = 5460,
+        RADIOREGS3(0x53, 0x01, 0x01, 0x02, 0x22, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8b, 0x0b, 0x00,
+                   0x95, 0x84, 0x00, 0x01, 0x00, 0x77, 0x00, 0x09,
+                   0x00, 0x6f, 0x00, 0x84, 0x00, 0x01, 0x00, 0x77,
+                   0x00, 0x09, 0x00, 0x6f, 0x00),
+        PHYREGS(0x088c, 0x0888, 0x0884, 0x01df, 0x01e0, 0x01e1),
+  },
+  {     .freq                   = 5470,
+        RADIOREGS3(0x53, 0x01, 0x01, 0x02, 0x23, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8b, 0x0b, 0x00,
+                   0x94, 0x73, 0x00, 0x01, 0x00, 0x77, 0x00, 0x09,
+                   0x00, 0x6f, 0x00, 0x73, 0x00, 0x01, 0x00, 0x77,
+                   0x00, 0x09, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0890, 0x088c, 0x0888, 0x01de, 0x01df, 0x01e0),
+  },
+  {     .freq                   = 5480,
+        RADIOREGS3(0x4d, 0x01, 0x01, 0x02, 0x24, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8a, 0x0a, 0x00,
+                   0x84, 0x73, 0x00, 0x00, 0x00, 0x77, 0x00, 0x09,
+                   0x00, 0x6f, 0x00, 0x73, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x09, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0894, 0x0890, 0x088c, 0x01dd, 0x01de, 0x01df),
+  },
+  {     .freq                   = 5490,
+        RADIOREGS3(0x4d, 0x01, 0x01, 0x02, 0x25, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8a, 0x0a, 0x00,
+                   0x83, 0x73, 0x00, 0x00, 0x00, 0x77, 0x00, 0x09,
+                   0x00, 0x6f, 0x00, 0x73, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x09, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0898, 0x0894, 0x0890, 0x01dd, 0x01dd, 0x01de),
+  },
+  {     .freq                   = 5500,
+        RADIOREGS3(0x47, 0x01, 0x01, 0x02, 0x26, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8a, 0x0a, 0x00,
+                   0x82, 0x73, 0x00, 0x00, 0x00, 0x77, 0x00, 0x09,
+                   0x00, 0x6f, 0x00, 0x73, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x09, 0x00, 0x6f, 0x00),
+        PHYREGS(0x089c, 0x0898, 0x0894, 0x01dc, 0x01dd, 0x01dd),
+  },
+  {     .freq                   = 5510,
+        RADIOREGS3(0x47, 0x01, 0x01, 0x02, 0x27, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8a, 0x0a, 0x00,
+                   0x82, 0x73, 0x00, 0x00, 0x00, 0x77, 0x00, 0x09,
+                   0x00, 0x6f, 0x00, 0x73, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x09, 0x00, 0x6f, 0x00),
+        PHYREGS(0x08a0, 0x089c, 0x0898, 0x01db, 0x01dc, 0x01dd),
+  },
+  {     .freq                   = 5520,
+        RADIOREGS3(0x40, 0x01, 0x01, 0x02, 0x28, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8a, 0x0a, 0x00,
+                   0x72, 0x73, 0x00, 0x00, 0x00, 0x77, 0x00, 0x09,
+                   0x00, 0x6f, 0x00, 0x73, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x09, 0x00, 0x6f, 0x00),
+        PHYREGS(0x08a4, 0x08a0, 0x089c, 0x01da, 0x01db, 0x01dc),
+  },
+  {     .freq                   = 5530,
+        RADIOREGS3(0x40, 0x01, 0x01, 0x02, 0x29, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8a, 0x09, 0x00,
+                   0x72, 0x73, 0x00, 0x00, 0x00, 0x77, 0x00, 0x09,
+                   0x00, 0x6f, 0x00, 0x73, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x09, 0x00, 0x6f, 0x00),
+        PHYREGS(0x08a8, 0x08a4, 0x08a0, 0x01d9, 0x01da, 0x01db),
+  },
+  {     .freq                   = 5540,
+        RADIOREGS3(0x3a, 0x01, 0x01, 0x02, 0x2a, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8a, 0x09, 0x00,
+                   0x71, 0x73, 0x00, 0x00, 0x00, 0x77, 0x00, 0x09,
+                   0x00, 0x6f, 0x00, 0x73, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x09, 0x00, 0x6f, 0x00),
+        PHYREGS(0x08ac, 0x08a8, 0x08a4, 0x01d8, 0x01d9, 0x01da),
+  },
+  {     .freq                   = 5550,
+        RADIOREGS3(0x3a, 0x01, 0x01, 0x02, 0x2b, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x89, 0x09, 0x00,
+                   0x61, 0x73, 0x00, 0x00, 0x00, 0x77, 0x00, 0x09,
+                   0x00, 0x6f, 0x00, 0x73, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x09, 0x00, 0x6f, 0x00),
+        PHYREGS(0x08b0, 0x08ac, 0x08a8, 0x01d7, 0x01d8, 0x01d9),
+  },
+  {     .freq                   = 5560,
+        RADIOREGS3(0x34, 0x01, 0x01, 0x02, 0x2c, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x89, 0x09, 0x00,
+                   0x61, 0x73, 0x00, 0x00, 0x00, 0x77, 0x00, 0x09,
+                   0x00, 0x6f, 0x00, 0x73, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x09, 0x00, 0x6f, 0x00),
+        PHYREGS(0x08b4, 0x08b0, 0x08ac, 0x01d7, 0x01d7, 0x01d8),
+  },
+  {     .freq                   = 5570,
+        RADIOREGS3(0x34, 0x01, 0x01, 0x02, 0x2d, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x89, 0x09, 0x00,
+                   0x61, 0x62, 0x00, 0x00, 0x00, 0x77, 0x00, 0x09,
+                   0x00, 0x6f, 0x00, 0x62, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x09, 0x00, 0x6f, 0x00),
+        PHYREGS(0x08b8, 0x08b4, 0x08b0, 0x01d6, 0x01d7, 0x01d7),
+  },
+  {     .freq                   = 5580,
+        RADIOREGS3(0x2e, 0x01, 0x01, 0x02, 0x2e, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x89, 0x08, 0x00,
+                   0x60, 0x62, 0x00, 0x00, 0x00, 0x77, 0x00, 0x08,
+                   0x00, 0x6f, 0x00, 0x62, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x08, 0x00, 0x6f, 0x00),
+        PHYREGS(0x08bc, 0x08b8, 0x08b4, 0x01d5, 0x01d6, 0x01d7),
+  },
+  {     .freq                   = 5590,
+        RADIOREGS3(0x2e, 0x01, 0x01, 0x02, 0x2f, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x89, 0x08, 0x00,
+                   0x50, 0x61, 0x00, 0x00, 0x00, 0x77, 0x00, 0x08,
+                   0x00, 0x6f, 0x00, 0x61, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x08, 0x00, 0x6f, 0x00),
+        PHYREGS(0x08c0, 0x08bc, 0x08b8, 0x01d4, 0x01d5, 0x01d6),
+  },
+  {     .freq                   = 5600,
+        RADIOREGS3(0x28, 0x01, 0x01, 0x02, 0x30, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x89, 0x08, 0x00,
+                   0x50, 0x51, 0x00, 0x00, 0x00, 0x77, 0x00, 0x08,
+                   0x00, 0x6f, 0x00, 0x51, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x08, 0x00, 0x6f, 0x00),
+        PHYREGS(0x08c4, 0x08c0, 0x08bc, 0x01d3, 0x01d4, 0x01d5),
+  },
+  {     .freq                   = 5610,
+        RADIOREGS3(0x28, 0x01, 0x01, 0x02, 0x31, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x89, 0x08, 0x00,
+                   0x50, 0x51, 0x00, 0x00, 0x00, 0x77, 0x00, 0x08,
+                   0x00, 0x6f, 0x00, 0x51, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x08, 0x00, 0x6f, 0x00),
+        PHYREGS(0x08c8, 0x08c4, 0x08c0, 0x01d2, 0x01d3, 0x01d4),
+  },
+  {     .freq                   = 5620,
+        RADIOREGS3(0x21, 0x01, 0x01, 0x02, 0x32, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x89, 0x08, 0x00,
+                   0x50, 0x50, 0x00, 0x00, 0x00, 0x77, 0x00, 0x07,
+                   0x00, 0x6f, 0x00, 0x50, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x07, 0x00, 0x6f, 0x00),
+        PHYREGS(0x08cc, 0x08c8, 0x08c4, 0x01d2, 0x01d2, 0x01d3),
+  },
+  {     .freq                   = 5630,
+        RADIOREGS3(0x21, 0x01, 0x01, 0x02, 0x33, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x88, 0x07, 0x00,
+                   0x50, 0x50, 0x00, 0x00, 0x00, 0x77, 0x00, 0x07,
+                   0x00, 0x6f, 0x00, 0x50, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x07, 0x00, 0x6f, 0x00),
+        PHYREGS(0x08d0, 0x08cc, 0x08c8, 0x01d1, 0x01d2, 0x01d2),
+  },
+  {     .freq                   = 5640,
+        RADIOREGS3(0x1c, 0x01, 0x01, 0x02, 0x34, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x88, 0x07, 0x00,
+                   0x40, 0x50, 0x00, 0x00, 0x00, 0x77, 0x00, 0x07,
+                   0x00, 0x6f, 0x00, 0x50, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x07, 0x00, 0x6f, 0x00),
+        PHYREGS(0x08d4, 0x08d0, 0x08cc, 0x01d0, 0x01d1, 0x01d2),
+  },
+  {     .freq                   = 5650,
+        RADIOREGS3(0x1c, 0x01, 0x01, 0x02, 0x35, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x88, 0x07, 0x00,
+                   0x40, 0x40, 0x00, 0x00, 0x00, 0x77, 0x00, 0x07,
+                   0x00, 0x6f, 0x00, 0x40, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x07, 0x00, 0x6f, 0x00),
+        PHYREGS(0x08d8, 0x08d4, 0x08d0, 0x01cf, 0x01d0, 0x01d1),
+  },
+  {     .freq                   = 5660,
+        RADIOREGS3(0x16, 0x01, 0x01, 0x02, 0x36, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x88, 0x07, 0x00,
+                   0x40, 0x40, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                   0x00, 0x6f, 0x00, 0x40, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x06, 0x00, 0x6f, 0x00),
+        PHYREGS(0x08dc, 0x08d8, 0x08d4, 0x01ce, 0x01cf, 0x01d0),
+  },
+  {     .freq                   = 5670,
+        RADIOREGS3(0x16, 0x01, 0x01, 0x02, 0x37, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x88, 0x07, 0x00,
+                   0x40, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                   0x00, 0x6f, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x06, 0x00, 0x6f, 0x00),
+        PHYREGS(0x08e0, 0x08dc, 0x08d8, 0x01ce, 0x01ce, 0x01cf),
+  },
+  {     .freq                   = 5680,
+        RADIOREGS3(0x10, 0x01, 0x01, 0x02, 0x38, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x87, 0x06, 0x00,
+                   0x30, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                   0x00, 0x6f, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x06, 0x00, 0x6f, 0x00),
+        PHYREGS(0x08e4, 0x08e0, 0x08dc, 0x01cd, 0x01ce, 0x01ce),
+  },
+  {     .freq                   = 5690,
+        RADIOREGS3(0x10, 0x01, 0x01, 0x02, 0x39, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x87, 0x06, 0x00,
+                   0x30, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                   0x00, 0x6f, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x06, 0x00, 0x6f, 0x00),
+        PHYREGS(0x08e8, 0x08e4, 0x08e0, 0x01cc, 0x01cd, 0x01ce),
+  },
+  {     .freq                   = 5700,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3a, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x87, 0x06, 0x00,
+                   0x30, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                   0x00, 0x6e, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x06, 0x00, 0x6e, 0x00),
+        PHYREGS(0x08ec, 0x08e8, 0x08e4, 0x01cb, 0x01cc, 0x01cd),
+  },
+  {     .freq                   = 5710,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3b, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x87, 0x06, 0x00,
+                   0x30, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                   0x00, 0x6e, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x06, 0x00, 0x6e, 0x00),
+        PHYREGS(0x08f0, 0x08ec, 0x08e8, 0x01ca, 0x01cb, 0x01cc),
+  },
+  {     .freq                   = 5720,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3c, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x87, 0x06, 0x00,
+                   0x30, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                   0x00, 0x6e, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x06, 0x00, 0x6e, 0x00),
+        PHYREGS(0x08f4, 0x08f0, 0x08ec, 0x01c9, 0x01ca, 0x01cb),
+  },
+  {     .freq                   = 5725,
+        RADIOREGS3(0x03, 0x01, 0x02, 0x04, 0x79, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x05, 0x05, 0x05, 0x87, 0x06, 0x00,
+                   0x30, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                   0x00, 0x6e, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x06, 0x00, 0x6e, 0x00),
+        PHYREGS(0x08f6, 0x08f2, 0x08ee, 0x01c9, 0x01ca, 0x01cb),
+  },
+  {     .freq                   = 5730,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3d, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x87, 0x05, 0x00,
+                   0x20, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                   0x00, 0x6e, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x06, 0x00, 0x6e, 0x00),
+        PHYREGS(0x08f8, 0x08f4, 0x08f0, 0x01c9, 0x01c9, 0x01ca),
+  },
+  {     .freq                   = 5735,
+        RADIOREGS3(0x03, 0x01, 0x02, 0x04, 0x7b, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x05, 0x05, 0x05, 0x87, 0x05, 0x00,
+                   0x20, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                   0x00, 0x6d, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x06, 0x00, 0x6d, 0x00),
+        PHYREGS(0x08fa, 0x08f6, 0x08f2, 0x01c8, 0x01c9, 0x01ca),
+  },
+  {     .freq                   = 5740,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3e, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x87, 0x05, 0x00,
+                   0x20, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                   0x00, 0x6d, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x06, 0x00, 0x6d, 0x00),
+        PHYREGS(0x08fc, 0x08f8, 0x08f4, 0x01c8, 0x01c9, 0x01c9),
+  },
+  {     .freq                   = 5745,
+        RADIOREGS3(0xfe, 0x00, 0x02, 0x04, 0x7d, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x05, 0x05, 0x05, 0x87, 0x05, 0x00,
+                   0x20, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                   0x00, 0x6d, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x06, 0x00, 0x6d, 0x00),
+        PHYREGS(0x08fe, 0x08fa, 0x08f6, 0x01c8, 0x01c8, 0x01c9),
+  },
+  {     .freq                   = 5750,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3f, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x87, 0x05, 0x00,
+                   0x20, 0x20, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                   0x00, 0x6d, 0x00, 0x20, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x05, 0x00, 0x6d, 0x00),
+        PHYREGS(0x0900, 0x08fc, 0x08f8, 0x01c7, 0x01c8, 0x01c9),
+  },
+  {     .freq                   = 5755,
+        RADIOREGS3(0xfe, 0x00, 0x02, 0x04, 0x7f, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x05, 0x05, 0x05, 0x87, 0x05, 0x00,
+                   0x10, 0x20, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                   0x00, 0x6c, 0x00, 0x20, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x05, 0x00, 0x6c, 0x00),
+        PHYREGS(0x0902, 0x08fe, 0x08fa, 0x01c7, 0x01c8, 0x01c8),
+  },
+  {     .freq                   = 5760,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x40, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x86, 0x05, 0x00,
+                   0x10, 0x20, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                   0x00, 0x6c, 0x00, 0x20, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x05, 0x00, 0x6c, 0x00),
+        PHYREGS(0x0904, 0x0900, 0x08fc, 0x01c6, 0x01c7, 0x01c8),
+  },
+  {     .freq                   = 5765,
+        RADIOREGS3(0xf8, 0x00, 0x02, 0x04, 0x81, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x05, 0x05, 0x05, 0x86, 0x05, 0x00,
+                   0x10, 0x10, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                   0x00, 0x6c, 0x00, 0x10, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x05, 0x00, 0x6c, 0x00),
+        PHYREGS(0x0906, 0x0902, 0x08fe, 0x01c6, 0x01c7, 0x01c8),
+  },
+  {     .freq                   = 5770,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x41, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x86, 0x04, 0x00,
+                   0x10, 0x10, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                   0x00, 0x6b, 0x00, 0x10, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x05, 0x00, 0x6b, 0x00),
+        PHYREGS(0x0908, 0x0904, 0x0900, 0x01c6, 0x01c6, 0x01c7),
+  },
+  {     .freq                   = 5775,
+        RADIOREGS3(0xf8, 0x00, 0x02, 0x04, 0x83, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x05, 0x05, 0x05, 0x86, 0x04, 0x00,
+                   0x10, 0x10, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                   0x00, 0x6b, 0x00, 0x10, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x05, 0x00, 0x6b, 0x00),
+        PHYREGS(0x090a, 0x0906, 0x0902, 0x01c5, 0x01c6, 0x01c7),
+  },
+  {     .freq                   = 5780,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x42, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x86, 0x04, 0x00,
+                   0x10, 0x10, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                   0x00, 0x6b, 0x00, 0x10, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x05, 0x00, 0x6b, 0x00),
+        PHYREGS(0x090c, 0x0908, 0x0904, 0x01c5, 0x01c6, 0x01c6),
+  },
+  {     .freq                   = 5785,
+        RADIOREGS3(0xf2, 0x00, 0x02, 0x04, 0x85, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                   0x00, 0x10, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                   0x00, 0x6b, 0x00, 0x10, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x05, 0x00, 0x6b, 0x00),
+        PHYREGS(0x090e, 0x090a, 0x0906, 0x01c4, 0x01c5, 0x01c6),
+  },
+  {     .freq                   = 5790,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x43, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                   0x00, 0x10, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                   0x00, 0x6b, 0x00, 0x10, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x05, 0x00, 0x6b, 0x00),
+        PHYREGS(0x0910, 0x090c, 0x0908, 0x01c4, 0x01c5, 0x01c6),
+  },
+  {     .freq                   = 5795,
+        RADIOREGS3(0xf2, 0x00, 0x02, 0x04, 0x87, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                   0x00, 0x6b, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x05, 0x00, 0x6b, 0x00),
+        PHYREGS(0x0912, 0x090e, 0x090a, 0x01c4, 0x01c4, 0x01c5),
+  },
+  {     .freq                   = 5800,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x44, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                   0x00, 0x6b, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x05, 0x00, 0x6b, 0x00),
+        PHYREGS(0x0914, 0x0910, 0x090c, 0x01c3, 0x01c4, 0x01c5),
+  },
+  {     .freq                   = 5805,
+        RADIOREGS3(0xed, 0x00, 0x02, 0x04, 0x89, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                   0x00, 0x6a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x05, 0x00, 0x6a, 0x00),
+        PHYREGS(0x0916, 0x0912, 0x090e, 0x01c3, 0x01c4, 0x01c4),
+  },
+  {     .freq                   = 5810,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x45, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                   0x00, 0x6a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x05, 0x00, 0x6a, 0x00),
+        PHYREGS(0x0918, 0x0914, 0x0910, 0x01c2, 0x01c3, 0x01c4),
+  },
+  {     .freq                   = 5815,
+        RADIOREGS3(0xed, 0x00, 0x02, 0x04, 0x8b, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                   0x00, 0x6a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x05, 0x00, 0x6a, 0x00),
+        PHYREGS(0x091a, 0x0916, 0x0912, 0x01c2, 0x01c3, 0x01c4),
+  },
+  {     .freq                   = 5820,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x46, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                   0x00, 0x6a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x05, 0x00, 0x6a, 0x00),
+        PHYREGS(0x091c, 0x0918, 0x0914, 0x01c2, 0x01c2, 0x01c3),
+  },
+  {     .freq                   = 5825,
+        RADIOREGS3(0xed, 0x00, 0x02, 0x04, 0x8d, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                   0x00, 0x69, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x05, 0x00, 0x69, 0x00),
+        PHYREGS(0x091e, 0x091a, 0x0916, 0x01c1, 0x01c2, 0x01c3),
+  },
+  {     .freq                   = 5830,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x47, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                   0x00, 0x69, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x05, 0x00, 0x69, 0x00),
+        PHYREGS(0x0920, 0x091c, 0x0918, 0x01c1, 0x01c2, 0x01c2),
+  },
+  {     .freq                   = 5840,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x48, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x04,
+                   0x00, 0x69, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x04, 0x00, 0x69, 0x00),
+        PHYREGS(0x0924, 0x0920, 0x091c, 0x01c0, 0x01c1, 0x01c2),
+  },
+  {     .freq                   = 5850,
+        RADIOREGS3(0xe0, 0x00, 0x01, 0x02, 0x49, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x85, 0x03, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x04,
+                   0x00, 0x69, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x04, 0x00, 0x69, 0x00),
+        PHYREGS(0x0928, 0x0924, 0x0920, 0x01bf, 0x01c0, 0x01c1),
+  },
+  {     .freq                   = 5860,
+        RADIOREGS3(0xde, 0x00, 0x01, 0x02, 0x4a, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x85, 0x03, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x04,
+                   0x00, 0x69, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x04, 0x00, 0x69, 0x00),
+        PHYREGS(0x092c, 0x0928, 0x0924, 0x01bf, 0x01bf, 0x01c0),
+  },
+  {     .freq                   = 5870,
+        RADIOREGS3(0xdb, 0x00, 0x01, 0x02, 0x4b, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x85, 0x03, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x04,
+                   0x00, 0x68, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x04, 0x00, 0x68, 0x00),
+        PHYREGS(0x0930, 0x092c, 0x0928, 0x01be, 0x01bf, 0x01bf),
+  },
+  {     .freq                   = 5880,
+        RADIOREGS3(0xd8, 0x00, 0x01, 0x02, 0x4c, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x85, 0x03, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x04,
+                   0x00, 0x68, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x04, 0x00, 0x68, 0x00),
+        PHYREGS(0x0934, 0x0930, 0x092c, 0x01bd, 0x01be, 0x01bf),
+  },
+  {     .freq                   = 5890,
+        RADIOREGS3(0xd6, 0x00, 0x01, 0x02, 0x4d, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x85, 0x03, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x04,
+                   0x00, 0x68, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x04, 0x00, 0x68, 0x00),
+        PHYREGS(0x0938, 0x0934, 0x0930, 0x01bc, 0x01bd, 0x01be),
+  },
+  {     .freq                   = 5900,
+        RADIOREGS3(0xd3, 0x00, 0x01, 0x02, 0x4e, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x85, 0x03, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x04,
+                   0x00, 0x68, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x04, 0x00, 0x68, 0x00),
+        PHYREGS(0x093c, 0x0938, 0x0934, 0x01bc, 0x01bc, 0x01bd),
+  },
+  {     .freq                   = 5910,
+        RADIOREGS3(0xd6, 0x00, 0x01, 0x02, 0x4f, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x85, 0x03, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x04,
+                   0x00, 0x68, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x04, 0x00, 0x68, 0x00),
+        PHYREGS(0x0940, 0x093c, 0x0938, 0x01bb, 0x01bc, 0x01bc),
+  },
+  {     .freq                   = 2412,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x6c, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x04, 0x04, 0x04, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x78, 0x00, 0x03, 0x00, 0x70, 0x00,
+                   0x0b, 0x00, 0x0a, 0x00, 0x78, 0x00, 0x03, 0x00,
+                   0x70, 0x00, 0x0b, 0x00, 0x0a),
+        PHYREGS(0x03c9, 0x03c5, 0x03c1, 0x043a, 0x043f, 0x0443),
+  },
+  {     .freq                   = 2417,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x71, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x78, 0x00, 0x03, 0x00, 0x70, 0x00,
+                   0x0b, 0x00, 0x0a, 0x00, 0x78, 0x00, 0x03, 0x00,
+                   0x70, 0x00, 0x0b, 0x00, 0x0a),
+        PHYREGS(0x03cb, 0x03c7, 0x03c3, 0x0438, 0x043d, 0x0441),
+  },
+  {     .freq                   = 2422,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x76, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x67, 0x00, 0x03, 0x00, 0x70, 0x00,
+                   0x0b, 0x00, 0x0a, 0x00, 0x67, 0x00, 0x03, 0x00,
+                   0x70, 0x00, 0x0b, 0x00, 0x0a),
+        PHYREGS(0x03cd, 0x03c9, 0x03c5, 0x0436, 0x043a, 0x043f),
+  },
+  {     .freq                   = 2427,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x7b, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x57, 0x00, 0x03, 0x00, 0x70, 0x00,
+                   0x0a, 0x00, 0x0a, 0x00, 0x57, 0x00, 0x03, 0x00,
+                   0x70, 0x00, 0x0a, 0x00, 0x0a),
+        PHYREGS(0x03cf, 0x03cb, 0x03c7, 0x0434, 0x0438, 0x043d),
+  },
+  {     .freq                   = 2432,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x80, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x56, 0x00, 0x03, 0x00, 0x70, 0x00,
+                   0x0a, 0x00, 0x0a, 0x00, 0x56, 0x00, 0x03, 0x00,
+                   0x70, 0x00, 0x0a, 0x00, 0x0a),
+        PHYREGS(0x03d1, 0x03cd, 0x03c9, 0x0431, 0x0436, 0x043a),
+  },
+  {     .freq                   = 2437,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x85, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x46, 0x00, 0x03, 0x00, 0x70, 0x00,
+                   0x0a, 0x00, 0x0a, 0x00, 0x46, 0x00, 0x03, 0x00,
+                   0x70, 0x00, 0x0a, 0x00, 0x0a),
+        PHYREGS(0x03d3, 0x03cf, 0x03cb, 0x042f, 0x0434, 0x0438),
+  },
+  {     .freq                   = 2442,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x8a, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x45, 0x00, 0x02, 0x00, 0x70, 0x00,
+                   0x0a, 0x00, 0x0a, 0x00, 0x45, 0x00, 0x02, 0x00,
+                   0x70, 0x00, 0x0a, 0x00, 0x0a),
+        PHYREGS(0x03d5, 0x03d1, 0x03cd, 0x042d, 0x0431, 0x0436),
+  },
+  {     .freq                   = 2447,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x8f, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x06, 0x06, 0x06, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x34, 0x00, 0x02, 0x00, 0x70, 0x00,
+                   0x0a, 0x00, 0x09, 0x00, 0x34, 0x00, 0x02, 0x00,
+                   0x70, 0x00, 0x0a, 0x00, 0x09),
+        PHYREGS(0x03d7, 0x03d3, 0x03cf, 0x042b, 0x042f, 0x0434),
+  },
+  {     .freq                   = 2452,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x94, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x06, 0x06, 0x06, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x23, 0x00, 0x02, 0x00, 0x70, 0x00,
+                   0x0a, 0x00, 0x09, 0x00, 0x23, 0x00, 0x02, 0x00,
+                   0x70, 0x00, 0x0a, 0x00, 0x09),
+        PHYREGS(0x03d9, 0x03d5, 0x03d1, 0x0429, 0x042d, 0x0431),
+  },
+  {     .freq                   = 2457,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x99, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x06, 0x06, 0x06, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x12, 0x00, 0x02, 0x00, 0x70, 0x00,
+                   0x0a, 0x00, 0x09, 0x00, 0x12, 0x00, 0x02, 0x00,
+                   0x70, 0x00, 0x0a, 0x00, 0x09),
+        PHYREGS(0x03db, 0x03d7, 0x03d3, 0x0427, 0x042b, 0x042f),
+  },
+  {     .freq                   = 2462,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x9e, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x06, 0x06, 0x06, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x02, 0x00, 0x02, 0x00, 0x70, 0x00,
+                   0x09, 0x00, 0x09, 0x00, 0x02, 0x00, 0x02, 0x00,
+                   0x70, 0x00, 0x09, 0x00, 0x09),
+        PHYREGS(0x03dd, 0x03d9, 0x03d5, 0x0424, 0x0429, 0x042d),
+  },
+  {     .freq                   = 2467,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0xa3, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x06, 0x06, 0x06, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x01, 0x00, 0x02, 0x00, 0x70, 0x00,
+                   0x09, 0x00, 0x09, 0x00, 0x01, 0x00, 0x02, 0x00,
+                   0x70, 0x00, 0x09, 0x00, 0x09),
+        PHYREGS(0x03df, 0x03db, 0x03d7, 0x0422, 0x0427, 0x042b),
+  },
+  {     .freq                   = 2472,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0xa8, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x07, 0x07, 0x07, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x01, 0x00, 0x02, 0x00, 0x70, 0x00,
+                   0x09, 0x00, 0x09, 0x00, 0x01, 0x00, 0x02, 0x00,
+                   0x70, 0x00, 0x09, 0x00, 0x09),
+        PHYREGS(0x03e1, 0x03dd, 0x03d9, 0x0420, 0x0424, 0x0429),
+  },
+  {     .freq                   = 2484,
+        RADIOREGS3(0xff, 0x01, 0x03, 0x09, 0xb4, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x07, 0x07, 0x07, 0x8f, 0x20, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x70, 0x00,
+                   0x09, 0x00, 0x09, 0x00, 0x00, 0x00, 0x02, 0x00,
+                   0x70, 0x00, 0x09, 0x00, 0x09),
+        PHYREGS(0x03e6, 0x03e2, 0x03de, 0x041b, 0x041f, 0x0424),
+  },
+};
+
+static const struct b43_nphy_channeltab_entry_rev3 b43_nphy_channeltab_rev7_9[] = {
+  {     .freq                   = 4920,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xec, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x00, 0x00, 0x00, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0b, 0x00, 0x70, 0x00, 0x0f,
+                   0x00, 0x9f, 0x00, 0xff, 0x00, 0x0b, 0x00, 0x70,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07b4, 0x07b0, 0x07ac, 0x0214, 0x0215, 0x0216),
+  },
+  {     .freq                   = 4930,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xed, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x00, 0x00, 0x00, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0b, 0x00, 0x70, 0x00, 0x0e,
+                   0x00, 0x9f, 0x00, 0xff, 0x00, 0x0b, 0x00, 0x70,
+                   0x00, 0x0e, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07b8, 0x07b4, 0x07b0, 0x0213, 0x0214, 0x0215),
+  },
+  {     .freq                   = 4940,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xee, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x00, 0x00, 0x00, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0b, 0x00, 0x70, 0x00, 0x0e,
+                   0x00, 0x9f, 0x00, 0xff, 0x00, 0x0b, 0x00, 0x70,
+                   0x00, 0x0e, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07bc, 0x07b8, 0x07b4, 0x0212, 0x0213, 0x0214),
+  },
+  {     .freq                   = 4950,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xef, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x00, 0x00, 0x00, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0b, 0x00, 0x70, 0x00, 0x0e,
+                   0x00, 0x9f, 0x00, 0xff, 0x00, 0x0b, 0x00, 0x70,
+                   0x00, 0x0e, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07c0, 0x07bc, 0x07b8, 0x0211, 0x0212, 0x0213),
+  },
+  {     .freq                   = 4960,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf0, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0a, 0x00, 0x70, 0x00, 0x0e,
+                   0x00, 0x9f, 0x00, 0xff, 0x00, 0x0a, 0x00, 0x70,
+                   0x00, 0x0e, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07c4, 0x07c0, 0x07bc, 0x020f, 0x0211, 0x0212),
+  },
+  {     .freq                   = 4970,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf1, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0a, 0x00, 0x70, 0x00, 0x0d,
+                   0x00, 0x9f, 0x00, 0xff, 0x00, 0x0a, 0x00, 0x70,
+                   0x00, 0x0d, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07c8, 0x07c4, 0x07c0, 0x020e, 0x020f, 0x0211),
+  },
+  {     .freq                   = 4980,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf2, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0a, 0x00, 0x70, 0x00, 0x0d,
+                   0x00, 0x9f, 0x00, 0xff, 0x00, 0x0a, 0x00, 0x70,
+                   0x00, 0x0d, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07cc, 0x07c8, 0x07c4, 0x020d, 0x020e, 0x020f),
+  },
+  {     .freq                   = 4990,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf3, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0a, 0x00, 0x70, 0x00, 0x0d,
+                   0x00, 0x9f, 0x00, 0xff, 0x00, 0x0a, 0x00, 0x70,
+                   0x00, 0x0d, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07d0, 0x07cc, 0x07c8, 0x020c, 0x020d, 0x020e),
+  },
+  {     .freq                   = 5000,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf4, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0a, 0x00, 0x70, 0x00, 0x0d,
+                   0x00, 0x9f, 0x00, 0xff, 0x00, 0x0a, 0x00, 0x70,
+                   0x00, 0x0d, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07d4, 0x07d0, 0x07cc, 0x020b, 0x020c, 0x020d),
+  },
+  {     .freq                   = 5010,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf5, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x0a, 0x00, 0x70, 0x00, 0x0d,
+                   0x00, 0x9f, 0x00, 0xff, 0x00, 0x0a, 0x00, 0x70,
+                   0x00, 0x0d, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07d8, 0x07d4, 0x07d0, 0x020a, 0x020b, 0x020c),
+  },
+  {     .freq                   = 5020,
+        RADIOREGS3(0xf7, 0x01, 0x01, 0x01, 0xf6, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x09, 0x00, 0x70, 0x00, 0x0d,
+                   0x00, 0x9f, 0x00, 0xff, 0x00, 0x09, 0x00, 0x70,
+                   0x00, 0x0d, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07dc, 0x07d8, 0x07d4, 0x0209, 0x020a, 0x020b),
+  },
+  {     .freq                   = 5030,
+        RADIOREGS3(0xf7, 0x01, 0x01, 0x01, 0xf7, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xff, 0x00, 0x09, 0x00, 0x70, 0x00, 0x0c,
+                   0x00, 0x9f, 0x00, 0xff, 0x00, 0x09, 0x00, 0x70,
+                   0x00, 0x0c, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07e0, 0x07dc, 0x07d8, 0x0208, 0x0209, 0x020a),
+  },
+  {     .freq                   = 5040,
+        RADIOREGS3(0xef, 0x01, 0x01, 0x01, 0xf8, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfe, 0x00, 0x09, 0x00, 0x70, 0x00, 0x0c,
+                   0x00, 0x9f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x70,
+                   0x00, 0x0c, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07e4, 0x07e0, 0x07dc, 0x0207, 0x0208, 0x0209),
+  },
+  {     .freq                   = 5050,
+        RADIOREGS3(0xef, 0x01, 0x01, 0x01, 0xf9, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfe, 0x00, 0x09, 0x00, 0x70, 0x00, 0x0c,
+                   0x00, 0x9f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x70,
+                   0x00, 0x0c, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07e8, 0x07e4, 0x07e0, 0x0206, 0x0207, 0x0208),
+  },
+  {     .freq                   = 5060,
+        RADIOREGS3(0xe6, 0x01, 0x01, 0x01, 0xfa, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfd, 0x00, 0x09, 0x00, 0x70, 0x00, 0x0c,
+                   0x00, 0x9f, 0x00, 0xfd, 0x00, 0x09, 0x00, 0x70,
+                   0x00, 0x0c, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07ec, 0x07e8, 0x07e4, 0x0205, 0x0206, 0x0207),
+  },
+  {     .freq                   = 5070,
+        RADIOREGS3(0xe6, 0x01, 0x01, 0x01, 0xfb, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfd, 0x00, 0x08, 0x00, 0x70, 0x00, 0x0b,
+                   0x00, 0x9f, 0x00, 0xfd, 0x00, 0x08, 0x00, 0x70,
+                   0x00, 0x0b, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07f0, 0x07ec, 0x07e8, 0x0204, 0x0205, 0x0206),
+  },
+  {     .freq                   = 5080,
+        RADIOREGS3(0xde, 0x01, 0x01, 0x01, 0xfc, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfc, 0x00, 0x08, 0x00, 0x70, 0x00, 0x0b,
+                   0x00, 0x9f, 0x00, 0xfc, 0x00, 0x08, 0x00, 0x70,
+                   0x00, 0x0b, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07f4, 0x07f0, 0x07ec, 0x0203, 0x0204, 0x0205),
+  },
+  {     .freq                   = 5090,
+        RADIOREGS3(0xde, 0x01, 0x01, 0x01, 0xfd, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfc, 0x00, 0x08, 0x00, 0x70, 0x00, 0x0b,
+                   0x00, 0x9f, 0x00, 0xfc, 0x00, 0x08, 0x00, 0x70,
+                   0x00, 0x0b, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07f8, 0x07f4, 0x07f0, 0x0202, 0x0203, 0x0204),
+  },
+  {     .freq                   = 5100,
+        RADIOREGS3(0xd6, 0x01, 0x01, 0x01, 0xfe, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfc, 0x00, 0x08, 0x00, 0x70, 0x00, 0x0b,
+                   0x00, 0x9f, 0x00, 0xfc, 0x00, 0x08, 0x00, 0x70,
+                   0x00, 0x0b, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07fc, 0x07f8, 0x07f4, 0x0201, 0x0202, 0x0203),
+  },
+  {     .freq                   = 5110,
+        RADIOREGS3(0xd6, 0x01, 0x01, 0x01, 0xff, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfc, 0x00, 0x08, 0x00, 0x70, 0x00, 0x0b,
+                   0x00, 0x9f, 0x00, 0xfc, 0x00, 0x08, 0x00, 0x70,
+                   0x00, 0x0b, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0800, 0x07fc, 0x07f8, 0x0200, 0x0201, 0x0202),
+  },
+  {     .freq                   = 5120,
+        RADIOREGS3(0xce, 0x01, 0x01, 0x02, 0x00, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfc, 0x00, 0x08, 0x00, 0x70, 0x00, 0x0b,
+                   0x00, 0x9f, 0x00, 0xfc, 0x00, 0x08, 0x00, 0x70,
+                   0x00, 0x0b, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0804, 0x0800, 0x07fc, 0x01ff, 0x0200, 0x0201),
+  },
+  {     .freq                   = 5130,
+        RADIOREGS3(0xce, 0x01, 0x01, 0x02, 0x01, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfb, 0x00, 0x08, 0x00, 0x70, 0x00, 0x0a,
+                   0x00, 0x9f, 0x00, 0xfb, 0x00, 0x08, 0x00, 0x70,
+                   0x00, 0x0a, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0808, 0x0804, 0x0800, 0x01fe, 0x01ff, 0x0200),
+  },
+  {     .freq                   = 5140,
+        RADIOREGS3(0xc6, 0x01, 0x01, 0x02, 0x02, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfb, 0x00, 0x07, 0x00, 0x70, 0x00, 0x0a,
+                   0x00, 0x9f, 0x00, 0xfb, 0x00, 0x07, 0x00, 0x70,
+                   0x00, 0x0a, 0x00, 0x6f, 0x00),
+        PHYREGS(0x080c, 0x0808, 0x0804, 0x01fd, 0x01fe, 0x01ff),
+  },
+  {     .freq                   = 5160,
+        RADIOREGS3(0xbe, 0x01, 0x01, 0x02, 0x04, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfb, 0x00, 0x07, 0x00, 0x70, 0x00, 0x09,
+                   0x00, 0x9e, 0x00, 0xfb, 0x00, 0x07, 0x00, 0x70,
+                   0x00, 0x09, 0x00, 0x6e, 0x00),
+        PHYREGS(0x0814, 0x0810, 0x080c, 0x01fb, 0x01fc, 0x01fd),
+  },
+  {     .freq                   = 5170,
+        RADIOREGS3(0xbe, 0x01, 0x01, 0x02, 0x05, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfb, 0x00, 0x06, 0x00, 0x70, 0x00, 0x09,
+                   0x00, 0x9e, 0x00, 0xfb, 0x00, 0x06, 0x00, 0x70,
+                   0x00, 0x09, 0x00, 0x6e, 0x00),
+        PHYREGS(0x0818, 0x0814, 0x0810, 0x01fa, 0x01fb, 0x01fc),
+  },
+  {     .freq                   = 5180,
+        RADIOREGS3(0xb6, 0x01, 0x01, 0x02, 0x06, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfa, 0x00, 0x06, 0x00, 0x70, 0x00, 0x09,
+                   0x00, 0x9e, 0x00, 0xfa, 0x00, 0x06, 0x00, 0x70,
+                   0x00, 0x09, 0x00, 0x6e, 0x00),
+        PHYREGS(0x081c, 0x0818, 0x0814, 0x01f9, 0x01fa, 0x01fb),
+  },
+  {     .freq                   = 5190,
+        RADIOREGS3(0xb6, 0x01, 0x01, 0x02, 0x07, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfa, 0x00, 0x06, 0x00, 0x70, 0x00, 0x09,
+                   0x00, 0x9e, 0x00, 0xfa, 0x00, 0x06, 0x00, 0x70,
+                   0x00, 0x09, 0x00, 0x6e, 0x00),
+        PHYREGS(0x0820, 0x081c, 0x0818, 0x01f8, 0x01f9, 0x01fa),
+  },
+  {     .freq                   = 5200,
+        RADIOREGS3(0xaf, 0x01, 0x01, 0x02, 0x08, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfa, 0x00, 0x06, 0x00, 0x70, 0x00, 0x09,
+                   0x00, 0x9e, 0x00, 0xfa, 0x00, 0x06, 0x00, 0x70,
+                   0x00, 0x09, 0x00, 0x6e, 0x00),
+        PHYREGS(0x0824, 0x0820, 0x081c, 0x01f7, 0x01f8, 0x01f9),
+  },
+  {     .freq                   = 5210,
+        RADIOREGS3(0xaf, 0x01, 0x01, 0x02, 0x09, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfa, 0x00, 0x06, 0x00, 0x70, 0x00, 0x09,
+                   0x00, 0x9e, 0x00, 0xfa, 0x00, 0x06, 0x00, 0x70,
+                   0x00, 0x09, 0x00, 0x6e, 0x00),
+        PHYREGS(0x0828, 0x0824, 0x0820, 0x01f6, 0x01f7, 0x01f8),
+  },
+  {     .freq                   = 5220,
+        RADIOREGS3(0xa7, 0x01, 0x01, 0x02, 0x0a, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8e, 0x0f, 0x00,
+                   0xfe, 0xfa, 0x00, 0x06, 0x00, 0x70, 0x00, 0x09,
+                   0x00, 0x9e, 0x00, 0xfa, 0x00, 0x06, 0x00, 0x70,
+                   0x00, 0x09, 0x00, 0x6e, 0x00),
+        PHYREGS(0x082c, 0x0828, 0x0824, 0x01f5, 0x01f6, 0x01f7),
+  },
+  {     .freq                   = 5230,
+        RADIOREGS3(0xa7, 0x01, 0x01, 0x02, 0x0b, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8e, 0x0f, 0x00,
+                   0xee, 0xea, 0x00, 0x06, 0x00, 0x70, 0x00, 0x08,
+                   0x00, 0x9e, 0x00, 0xea, 0x00, 0x06, 0x00, 0x70,
+                   0x00, 0x08, 0x00, 0x6e, 0x00),
+        PHYREGS(0x0830, 0x082c, 0x0828, 0x01f4, 0x01f5, 0x01f6),
+  },
+  {     .freq                   = 5240,
+        RADIOREGS3(0xa0, 0x01, 0x01, 0x02, 0x0c, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8e, 0x0f, 0x00,
+                   0xee, 0xe9, 0x00, 0x05, 0x00, 0x70, 0x00, 0x08,
+                   0x00, 0x9d, 0x00, 0xe9, 0x00, 0x05, 0x00, 0x70,
+                   0x00, 0x08, 0x00, 0x6d, 0x00),
+        PHYREGS(0x0834, 0x0830, 0x082c, 0x01f3, 0x01f4, 0x01f5),
+  },
+  {     .freq                   = 5250,
+        RADIOREGS3(0xa0, 0x01, 0x01, 0x02, 0x0d, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8e, 0x0f, 0x00,
+                   0xed, 0xe9, 0x00, 0x05, 0x00, 0x70, 0x00, 0x08,
+                   0x00, 0x9d, 0x00, 0xe9, 0x00, 0x05, 0x00, 0x70,
+                   0x00, 0x08, 0x00, 0x6d, 0x00),
+        PHYREGS(0x0838, 0x0834, 0x0830, 0x01f2, 0x01f3, 0x01f4),
+  },
+  {     .freq                   = 5260,
+        RADIOREGS3(0x98, 0x01, 0x01, 0x02, 0x0e, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8e, 0x0e, 0x00,
+                   0xed, 0xd9, 0x00, 0x05, 0x00, 0x70, 0x00, 0x08,
+                   0x00, 0x9d, 0x00, 0xd9, 0x00, 0x05, 0x00, 0x70,
+                   0x00, 0x08, 0x00, 0x6d, 0x00),
+        PHYREGS(0x083c, 0x0838, 0x0834, 0x01f1, 0x01f2, 0x01f3),
+  },
+  {     .freq                   = 5270,
+        RADIOREGS3(0x98, 0x01, 0x01, 0x02, 0x0f, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8e, 0x0e, 0x00,
+                   0xed, 0xd8, 0x00, 0x04, 0x00, 0x70, 0x00, 0x07,
+                   0x00, 0x9c, 0x00, 0xd8, 0x00, 0x04, 0x00, 0x70,
+                   0x00, 0x07, 0x00, 0x6c, 0x00),
+        PHYREGS(0x0840, 0x083c, 0x0838, 0x01f0, 0x01f1, 0x01f2),
+  },
+  {     .freq                   = 5280,
+        RADIOREGS3(0x91, 0x01, 0x01, 0x02, 0x10, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0e, 0x00,
+                   0xdc, 0xc8, 0x00, 0x04, 0x00, 0x70, 0x00, 0x07,
+                   0x00, 0x9c, 0x00, 0xc8, 0x00, 0x04, 0x00, 0x70,
+                   0x00, 0x07, 0x00, 0x6c, 0x00),
+        PHYREGS(0x0844, 0x0840, 0x083c, 0x01f0, 0x01f0, 0x01f1),
+  },
+  {     .freq                   = 5290,
+        RADIOREGS3(0x91, 0x01, 0x01, 0x02, 0x11, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0e, 0x00,
+                   0xdc, 0xc8, 0x00, 0x04, 0x00, 0x70, 0x00, 0x07,
+                   0x00, 0x9c, 0x00, 0xc8, 0x00, 0x04, 0x00, 0x70,
+                   0x00, 0x07, 0x00, 0x6c, 0x00),
+        PHYREGS(0x0848, 0x0844, 0x0840, 0x01ef, 0x01f0, 0x01f0),
+  },
+  {     .freq                   = 5300,
+        RADIOREGS3(0x8a, 0x01, 0x01, 0x02, 0x12, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0e, 0x00,
+                   0xdc, 0xc8, 0x00, 0x04, 0x00, 0x70, 0x00, 0x07,
+                   0x00, 0x9c, 0x00, 0xc8, 0x00, 0x04, 0x00, 0x70,
+                   0x00, 0x07, 0x00, 0x6c, 0x00),
+        PHYREGS(0x084c, 0x0848, 0x0844, 0x01ee, 0x01ef, 0x01f0),
+  },
+  {     .freq                   = 5310,
+        RADIOREGS3(0x8a, 0x01, 0x01, 0x02, 0x13, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0e, 0x00,
+                   0xdc, 0xc8, 0x00, 0x04, 0x00, 0x70, 0x00, 0x07,
+                   0x00, 0x9c, 0x00, 0xc8, 0x00, 0x04, 0x00, 0x70,
+                   0x00, 0x07, 0x00, 0x6c, 0x00),
+        PHYREGS(0x0850, 0x084c, 0x0848, 0x01ed, 0x01ee, 0x01ef),
+  },
+  {     .freq                   = 5320,
+        RADIOREGS3(0x83, 0x01, 0x01, 0x02, 0x14, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0e, 0x00,
+                   0xdb, 0xb8, 0x00, 0x04, 0x00, 0x70, 0x00, 0x07,
+                   0x00, 0x9c, 0x00, 0xb8, 0x00, 0x04, 0x00, 0x70,
+                   0x00, 0x07, 0x00, 0x6c, 0x00),
+        PHYREGS(0x0854, 0x0850, 0x084c, 0x01ec, 0x01ed, 0x01ee),
+  },
+  {     .freq                   = 5330,
+        RADIOREGS3(0x83, 0x01, 0x01, 0x02, 0x15, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0d, 0x00,
+                   0xcb, 0xb7, 0x00, 0x04, 0x00, 0x70, 0x00, 0x07,
+                   0x00, 0x9b, 0x00, 0xb7, 0x00, 0x04, 0x00, 0x70,
+                   0x00, 0x07, 0x00, 0x6b, 0x00),
+        PHYREGS(0x0858, 0x0854, 0x0850, 0x01eb, 0x01ec, 0x01ed),
+  },
+  {     .freq                   = 5340,
+        RADIOREGS3(0x7c, 0x01, 0x01, 0x02, 0x16, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0d, 0x00,
+                   0xca, 0xb7, 0x00, 0x03, 0x00, 0x70, 0x00, 0x07,
+                   0x00, 0x9b, 0x00, 0xb7, 0x00, 0x03, 0x00, 0x70,
+                   0x00, 0x07, 0x00, 0x6b, 0x00),
+        PHYREGS(0x085c, 0x0858, 0x0854, 0x01ea, 0x01eb, 0x01ec),
+  },
+  {     .freq                   = 5350,
+        RADIOREGS3(0x7c, 0x01, 0x01, 0x02, 0x17, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0d, 0x00,
+                   0xca, 0xa7, 0x00, 0x03, 0x00, 0x70, 0x00, 0x06,
+                   0x00, 0x9b, 0x00, 0xa7, 0x00, 0x03, 0x00, 0x70,
+                   0x00, 0x06, 0x00, 0x6b, 0x00),
+        PHYREGS(0x0860, 0x085c, 0x0858, 0x01e9, 0x01ea, 0x01eb),
+  },
+  {     .freq                   = 5360,
+        RADIOREGS3(0x75, 0x01, 0x01, 0x02, 0x18, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0d, 0x00,
+                   0xc9, 0xa6, 0x00, 0x03, 0x00, 0x70, 0x00, 0x06,
+                   0x00, 0x9b, 0x00, 0xa6, 0x00, 0x03, 0x00, 0x70,
+                   0x00, 0x06, 0x00, 0x6b, 0x00),
+        PHYREGS(0x0864, 0x0860, 0x085c, 0x01e8, 0x01e9, 0x01ea),
+  },
+  {     .freq                   = 5370,
+        RADIOREGS3(0x75, 0x01, 0x01, 0x02, 0x19, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0d, 0x00,
+                   0xc9, 0xa6, 0x00, 0x03, 0x00, 0x70, 0x00, 0x06,
+                   0x00, 0x9b, 0x00, 0xa6, 0x00, 0x03, 0x00, 0x70,
+                   0x00, 0x06, 0x00, 0x7b, 0x00),
+        PHYREGS(0x0868, 0x0864, 0x0860, 0x01e7, 0x01e8, 0x01e9),
+  },
+  {     .freq                   = 5380,
+        RADIOREGS3(0x6e, 0x01, 0x01, 0x02, 0x1a, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0c, 0x00,
+                   0xb8, 0x96, 0x00, 0x03, 0x00, 0x70, 0x00, 0x06,
+                   0x00, 0x9a, 0x00, 0x96, 0x00, 0x03, 0x00, 0x70,
+                   0x00, 0x06, 0x00, 0x7a, 0x00),
+        PHYREGS(0x086c, 0x0868, 0x0864, 0x01e6, 0x01e7, 0x01e8),
+  },
+  {     .freq                   = 5390,
+        RADIOREGS3(0x6e, 0x01, 0x01, 0x02, 0x1b, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0c, 0x00,
+                   0xb8, 0x95, 0x00, 0x03, 0x00, 0x70, 0x00, 0x06,
+                   0x00, 0x9a, 0x00, 0x95, 0x00, 0x03, 0x00, 0x70,
+                   0x00, 0x06, 0x00, 0x7a, 0x00),
+        PHYREGS(0x0870, 0x086c, 0x0868, 0x01e5, 0x01e6, 0x01e7),
+  },
+  {     .freq                   = 5400,
+        RADIOREGS3(0x67, 0x01, 0x01, 0x02, 0x1c, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0c, 0x00,
+                   0xb8, 0x95, 0x00, 0x03, 0x00, 0x70, 0x00, 0x06,
+                   0x00, 0x9a, 0x00, 0x95, 0x00, 0x03, 0x00, 0x70,
+                   0x00, 0x06, 0x00, 0x7a, 0x00),
+        PHYREGS(0x0874, 0x0870, 0x086c, 0x01e5, 0x01e5, 0x01e6),
+  },
+  {     .freq                   = 5410,
+        RADIOREGS3(0x67, 0x01, 0x01, 0x02, 0x1d, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0c, 0x00,
+                   0xb7, 0x95, 0x00, 0x03, 0x00, 0x70, 0x00, 0x05,
+                   0x00, 0x9a, 0x00, 0x95, 0x00, 0x03, 0x00, 0x70,
+                   0x00, 0x05, 0x00, 0x7a, 0x00),
+        PHYREGS(0x0878, 0x0874, 0x0870, 0x01e4, 0x01e5, 0x01e5),
+  },
+  {     .freq                   = 5420,
+        RADIOREGS3(0x61, 0x01, 0x01, 0x02, 0x1e, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0c, 0x00,
+                   0xa7, 0x95, 0x00, 0x03, 0x00, 0x70, 0x00, 0x05,
+                   0x00, 0x9a, 0x00, 0x95, 0x00, 0x03, 0x00, 0x70,
+                   0x00, 0x05, 0x00, 0x7a, 0x00),
+        PHYREGS(0x087c, 0x0878, 0x0874, 0x01e3, 0x01e4, 0x01e5),
+  },
+  {     .freq                   = 5430,
+        RADIOREGS3(0x61, 0x01, 0x01, 0x02, 0x1f, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0b, 0x00,
+                   0xa6, 0x85, 0x00, 0x02, 0x00, 0x70, 0x00, 0x05,
+                   0x00, 0x99, 0x00, 0x85, 0x00, 0x02, 0x00, 0x70,
+                   0x00, 0x05, 0x00, 0x79, 0x00),
+        PHYREGS(0x0880, 0x087c, 0x0878, 0x01e2, 0x01e3, 0x01e4),
+  },
+  {     .freq                   = 5440,
+        RADIOREGS3(0x5a, 0x01, 0x01, 0x02, 0x20, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8b, 0x0b, 0x00,
+                   0xa6, 0x84, 0x00, 0x02, 0x00, 0x70, 0x00, 0x05,
+                   0x00, 0x99, 0x00, 0x84, 0x00, 0x02, 0x00, 0x70,
+                   0x00, 0x05, 0x00, 0x79, 0x00),
+        PHYREGS(0x0884, 0x0880, 0x087c, 0x01e1, 0x01e2, 0x01e3),
+  },
+  {     .freq                   = 5450,
+        RADIOREGS3(0x5a, 0x01, 0x01, 0x02, 0x21, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8b, 0x0b, 0x00,
+                   0x95, 0x84, 0x00, 0x02, 0x00, 0x70, 0x00, 0x05,
+                   0x00, 0x99, 0x00, 0x84, 0x00, 0x02, 0x00, 0x70,
+                   0x00, 0x05, 0x00, 0x79, 0x00),
+        PHYREGS(0x0888, 0x0884, 0x0880, 0x01e0, 0x01e1, 0x01e2),
+  },
+  {     .freq                   = 5460,
+        RADIOREGS3(0x53, 0x01, 0x01, 0x02, 0x22, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8b, 0x0b, 0x00,
+                   0x95, 0x84, 0x00, 0x02, 0x00, 0x70, 0x00, 0x04,
+                   0x00, 0x99, 0x00, 0x84, 0x00, 0x02, 0x00, 0x70,
+                   0x00, 0x04, 0x00, 0x79, 0x00),
+        PHYREGS(0x088c, 0x0888, 0x0884, 0x01df, 0x01e0, 0x01e1),
+  },
+  {     .freq                   = 5470,
+        RADIOREGS3(0x53, 0x01, 0x01, 0x02, 0x23, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8b, 0x0b, 0x00,
+                   0x94, 0x74, 0x00, 0x01, 0x00, 0x70, 0x00, 0x04,
+                   0x00, 0x99, 0x00, 0x74, 0x00, 0x01, 0x00, 0x70,
+                   0x00, 0x04, 0x00, 0x79, 0x00),
+        PHYREGS(0x0890, 0x088c, 0x0888, 0x01de, 0x01df, 0x01e0),
+  },
+  {     .freq                   = 5480,
+        RADIOREGS3(0x4d, 0x01, 0x01, 0x02, 0x24, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8a, 0x0a, 0x00,
+                   0x84, 0x73, 0x00, 0x01, 0x00, 0x70, 0x00, 0x04,
+                   0x00, 0x98, 0x00, 0x73, 0x00, 0x01, 0x00, 0x70,
+                   0x00, 0x04, 0x00, 0x78, 0x00),
+        PHYREGS(0x0894, 0x0890, 0x088c, 0x01dd, 0x01de, 0x01df),
+  },
+  {     .freq                   = 5490,
+        RADIOREGS3(0x4d, 0x01, 0x01, 0x02, 0x25, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8a, 0x0a, 0x00,
+                   0x83, 0x73, 0x00, 0x01, 0x00, 0x70, 0x00, 0x04,
+                   0x00, 0x98, 0x00, 0x73, 0x00, 0x01, 0x00, 0x70,
+                   0x00, 0x04, 0x00, 0x78, 0x00),
+        PHYREGS(0x0898, 0x0894, 0x0890, 0x01dd, 0x01dd, 0x01de),
+  },
+  {     .freq                   = 5500,
+        RADIOREGS3(0x47, 0x01, 0x01, 0x02, 0x26, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8a, 0x0a, 0x00,
+                   0x82, 0x73, 0x00, 0x01, 0x00, 0x70, 0x00, 0x04,
+                   0x00, 0x98, 0x00, 0x73, 0x00, 0x01, 0x00, 0x70,
+                   0x00, 0x04, 0x00, 0x78, 0x00),
+        PHYREGS(0x089c, 0x0898, 0x0894, 0x01dc, 0x01dd, 0x01dd),
+  },
+  {     .freq                   = 5510,
+        RADIOREGS3(0x47, 0x01, 0x01, 0x02, 0x27, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8a, 0x0a, 0x00,
+                   0x82, 0x73, 0x00, 0x01, 0x00, 0x70, 0x00, 0x04,
+                   0x00, 0x98, 0x00, 0x73, 0x00, 0x01, 0x00, 0x70,
+                   0x00, 0x04, 0x00, 0x78, 0x00),
+        PHYREGS(0x08a0, 0x089c, 0x0898, 0x01db, 0x01dc, 0x01dd),
+  },
+  {     .freq                   = 5520,
+        RADIOREGS3(0x40, 0x01, 0x01, 0x02, 0x28, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8a, 0x0a, 0x00,
+                   0x72, 0x73, 0x00, 0x01, 0x00, 0x70, 0x00, 0x04,
+                   0x00, 0x98, 0x00, 0x73, 0x00, 0x01, 0x00, 0x70,
+                   0x00, 0x04, 0x00, 0x78, 0x00),
+        PHYREGS(0x08a4, 0x08a0, 0x089c, 0x01da, 0x01db, 0x01dc),
+  },
+  {     .freq                   = 5530,
+        RADIOREGS3(0x40, 0x01, 0x01, 0x02, 0x29, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8a, 0x09, 0x00,
+                   0x72, 0x63, 0x00, 0x01, 0x00, 0x70, 0x00, 0x03,
+                   0x00, 0x98, 0x00, 0x63, 0x00, 0x01, 0x00, 0x70,
+                   0x00, 0x03, 0x00, 0x78, 0x00),
+        PHYREGS(0x08a8, 0x08a4, 0x08a0, 0x01d9, 0x01da, 0x01db),
+  },
+  {     .freq                   = 5540,
+        RADIOREGS3(0x3a, 0x01, 0x01, 0x02, 0x2a, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8a, 0x09, 0x00,
+                   0x71, 0x62, 0x00, 0x00, 0x00, 0x70, 0x00, 0x03,
+                   0x00, 0x97, 0x00, 0x62, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x03, 0x00, 0x77, 0x00),
+        PHYREGS(0x08ac, 0x08a8, 0x08a4, 0x01d8, 0x01d9, 0x01da),
+  },
+  {     .freq                   = 5550,
+        RADIOREGS3(0x3a, 0x01, 0x01, 0x02, 0x2b, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x89, 0x09, 0x00,
+                   0x61, 0x62, 0x00, 0x00, 0x00, 0x70, 0x00, 0x03,
+                   0x00, 0x97, 0x00, 0x62, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x03, 0x00, 0x77, 0x00),
+        PHYREGS(0x08b0, 0x08ac, 0x08a8, 0x01d7, 0x01d8, 0x01d9),
+  },
+  {     .freq                   = 5560,
+        RADIOREGS3(0x34, 0x01, 0x01, 0x02, 0x2c, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x89, 0x09, 0x00,
+                   0x61, 0x62, 0x00, 0x00, 0x00, 0x70, 0x00, 0x03,
+                   0x00, 0x97, 0x00, 0x62, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x03, 0x00, 0x77, 0x00),
+        PHYREGS(0x08b4, 0x08b0, 0x08ac, 0x01d7, 0x01d7, 0x01d8),
+  },
+  {     .freq                   = 5570,
+        RADIOREGS3(0x34, 0x01, 0x01, 0x02, 0x2d, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x89, 0x09, 0x00,
+                   0x61, 0x52, 0x00, 0x00, 0x00, 0x70, 0x00, 0x02,
+                   0x00, 0x96, 0x00, 0x52, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x02, 0x00, 0x76, 0x00),
+        PHYREGS(0x08b8, 0x08b4, 0x08b0, 0x01d6, 0x01d7, 0x01d7),
+  },
+  {     .freq                   = 5580,
+        RADIOREGS3(0x2e, 0x01, 0x01, 0x02, 0x2e, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x89, 0x08, 0x00,
+                   0x60, 0x52, 0x00, 0x00, 0x00, 0x70, 0x00, 0x02,
+                   0x00, 0x96, 0x00, 0x52, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x02, 0x00, 0x86, 0x00),
+        PHYREGS(0x08bc, 0x08b8, 0x08b4, 0x01d5, 0x01d6, 0x01d7),
+  },
+  {     .freq                   = 5590,
+        RADIOREGS3(0x2e, 0x01, 0x01, 0x02, 0x2f, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x89, 0x08, 0x00,
+                   0x50, 0x51, 0x00, 0x00, 0x00, 0x70, 0x00, 0x02,
+                   0x00, 0x96, 0x00, 0x51, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x02, 0x00, 0x86, 0x00),
+        PHYREGS(0x08c0, 0x08bc, 0x08b8, 0x01d4, 0x01d5, 0x01d6),
+  },
+  {     .freq                   = 5600,
+        RADIOREGS3(0x28, 0x01, 0x01, 0x02, 0x30, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x89, 0x08, 0x00,
+                   0x50, 0x51, 0x00, 0x00, 0x00, 0x70, 0x00, 0x02,
+                   0x00, 0x96, 0x00, 0x51, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x02, 0x00, 0x86, 0x00),
+        PHYREGS(0x08c4, 0x08c0, 0x08bc, 0x01d3, 0x01d4, 0x01d5),
+  },
+  {     .freq                   = 5610,
+        RADIOREGS3(0x28, 0x01, 0x01, 0x02, 0x31, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x89, 0x08, 0x00,
+                   0x50, 0x51, 0x00, 0x00, 0x00, 0x70, 0x00, 0x02,
+                   0x00, 0x96, 0x00, 0x51, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x02, 0x00, 0x86, 0x00),
+        PHYREGS(0x08c8, 0x08c4, 0x08c0, 0x01d2, 0x01d3, 0x01d4),
+  },
+  {     .freq                   = 5620,
+        RADIOREGS3(0x21, 0x01, 0x01, 0x02, 0x32, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x89, 0x08, 0x00,
+                   0x50, 0x51, 0x00, 0x00, 0x00, 0x70, 0x00, 0x02,
+                   0x00, 0x96, 0x00, 0x51, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x02, 0x00, 0x86, 0x00),
+        PHYREGS(0x08cc, 0x08c8, 0x08c4, 0x01d2, 0x01d2, 0x01d3),
+  },
+  {     .freq                   = 5630,
+        RADIOREGS3(0x21, 0x01, 0x01, 0x02, 0x33, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x88, 0x07, 0x00,
+                   0x50, 0x51, 0x00, 0x00, 0x00, 0x70, 0x00, 0x02,
+                   0x00, 0x96, 0x00, 0x51, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x02, 0x00, 0x86, 0x00),
+        PHYREGS(0x08d0, 0x08cc, 0x08c8, 0x01d1, 0x01d2, 0x01d2),
+  },
+  {     .freq                   = 5640,
+        RADIOREGS3(0x1c, 0x01, 0x01, 0x02, 0x34, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x88, 0x07, 0x00,
+                   0x40, 0x51, 0x00, 0x00, 0x00, 0x70, 0x00, 0x02,
+                   0x00, 0x95, 0x00, 0x51, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x02, 0x00, 0x85, 0x00),
+        PHYREGS(0x08d4, 0x08d0, 0x08cc, 0x01d0, 0x01d1, 0x01d2),
+  },
+  {     .freq                   = 5650,
+        RADIOREGS3(0x1c, 0x01, 0x01, 0x02, 0x35, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x88, 0x07, 0x00,
+                   0x40, 0x50, 0x00, 0x00, 0x00, 0x70, 0x00, 0x01,
+                   0x00, 0x95, 0x00, 0x50, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x01, 0x00, 0x85, 0x00),
+        PHYREGS(0x08d8, 0x08d4, 0x08d0, 0x01cf, 0x01d0, 0x01d1),
+  },
+  {     .freq                   = 5660,
+        RADIOREGS3(0x16, 0x01, 0x01, 0x02, 0x36, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x88, 0x07, 0x00,
+                   0x40, 0x50, 0x00, 0x00, 0x00, 0x70, 0x00, 0x01,
+                   0x00, 0x95, 0x00, 0x50, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x01, 0x00, 0x85, 0x00),
+        PHYREGS(0x08dc, 0x08d8, 0x08d4, 0x01ce, 0x01cf, 0x01d0),
+  },
+  {     .freq                   = 5670,
+        RADIOREGS3(0x16, 0x01, 0x01, 0x02, 0x37, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x88, 0x07, 0x00,
+                   0x40, 0x40, 0x00, 0x00, 0x00, 0x70, 0x00, 0x01,
+                   0x00, 0x94, 0x00, 0x40, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x01, 0x00, 0x84, 0x00),
+        PHYREGS(0x08e0, 0x08dc, 0x08d8, 0x01ce, 0x01ce, 0x01cf),
+  },
+  {     .freq                   = 5680,
+        RADIOREGS3(0x10, 0x01, 0x01, 0x02, 0x38, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x87, 0x06, 0x00,
+                   0x30, 0x40, 0x00, 0x00, 0x00, 0x70, 0x00, 0x01,
+                   0x00, 0x94, 0x00, 0x40, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x01, 0x00, 0x84, 0x00),
+        PHYREGS(0x08e4, 0x08e0, 0x08dc, 0x01cd, 0x01ce, 0x01ce),
+  },
+  {     .freq                   = 5690,
+        RADIOREGS3(0x10, 0x01, 0x01, 0x02, 0x39, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x87, 0x06, 0x00,
+                   0x30, 0x40, 0x00, 0x00, 0x00, 0x70, 0x00, 0x01,
+                   0x00, 0x94, 0x00, 0x40, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x01, 0x00, 0x94, 0x00),
+        PHYREGS(0x08e8, 0x08e4, 0x08e0, 0x01cc, 0x01cd, 0x01ce),
+  },
+  {     .freq                   = 5700,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3a, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x87, 0x06, 0x00,
+                   0x30, 0x40, 0x00, 0x00, 0x00, 0x70, 0x00, 0x01,
+                   0x00, 0x94, 0x00, 0x40, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x01, 0x00, 0x94, 0x00),
+        PHYREGS(0x08ec, 0x08e8, 0x08e4, 0x01cb, 0x01cc, 0x01cd),
+  },
+  {     .freq                   = 5710,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3b, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x87, 0x06, 0x00,
+                   0x30, 0x40, 0x00, 0x00, 0x00, 0x70, 0x00, 0x01,
+                   0x00, 0x94, 0x00, 0x40, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x01, 0x00, 0x94, 0x00),
+        PHYREGS(0x08f0, 0x08ec, 0x08e8, 0x01ca, 0x01cb, 0x01cc),
+  },
+  {     .freq                   = 5720,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3c, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x87, 0x06, 0x00,
+                   0x30, 0x40, 0x00, 0x00, 0x00, 0x70, 0x00, 0x01,
+                   0x00, 0x94, 0x00, 0x40, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x01, 0x00, 0x94, 0x00),
+        PHYREGS(0x08f4, 0x08f0, 0x08ec, 0x01c9, 0x01ca, 0x01cb),
+  },
+  {     .freq                   = 5725,
+        RADIOREGS3(0x03, 0x01, 0x02, 0x04, 0x79, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x05, 0x05, 0x05, 0x87, 0x06, 0x00,
+                   0x30, 0x40, 0x00, 0x00, 0x00, 0x70, 0x00, 0x01,
+                   0x00, 0x94, 0x00, 0x40, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x01, 0x00, 0x94, 0x00),
+        PHYREGS(0x08f6, 0x08f2, 0x08ee, 0x01c9, 0x01ca, 0x01cb),
+  },
+  {     .freq                   = 5730,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3d, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x87, 0x05, 0x00,
+                   0x20, 0x30, 0x00, 0x00, 0x00, 0x70, 0x00, 0x01,
+                   0x00, 0x94, 0x00, 0x30, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x01, 0x00, 0x94, 0x00),
+        PHYREGS(0x08f8, 0x08f4, 0x08f0, 0x01c9, 0x01c9, 0x01ca),
+  },
+  {     .freq                   = 5735,
+        RADIOREGS3(0x03, 0x01, 0x02, 0x04, 0x7b, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x05, 0x05, 0x05, 0x87, 0x05, 0x00,
+                   0x20, 0x30, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x93, 0x00, 0x30, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x93, 0x00),
+        PHYREGS(0x08fa, 0x08f6, 0x08f2, 0x01c8, 0x01c9, 0x01ca),
+  },
+  {     .freq                   = 5740,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3e, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x87, 0x05, 0x00,
+                   0x20, 0x30, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x93, 0x00, 0x30, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x93, 0x00),
+        PHYREGS(0x08fc, 0x08f8, 0x08f4, 0x01c8, 0x01c9, 0x01c9),
+  },
+  {     .freq                   = 5745,
+        RADIOREGS3(0xfe, 0x00, 0x02, 0x04, 0x7d, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x05, 0x05, 0x05, 0x87, 0x05, 0x00,
+                   0x20, 0x30, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x93, 0x00, 0x30, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x93, 0x00),
+        PHYREGS(0x08fe, 0x08fa, 0x08f6, 0x01c8, 0x01c8, 0x01c9),
+  },
+  {     .freq                   = 5750,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3f, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x87, 0x05, 0x00,
+                   0x20, 0x30, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x93, 0x00, 0x30, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x93, 0x00),
+        PHYREGS(0x0900, 0x08fc, 0x08f8, 0x01c7, 0x01c8, 0x01c9),
+  },
+  {     .freq                   = 5755,
+        RADIOREGS3(0xfe, 0x00, 0x02, 0x04, 0x7f, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x05, 0x05, 0x05, 0x87, 0x05, 0x00,
+                   0x10, 0x30, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x93, 0x00, 0x30, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x93, 0x00),
+        PHYREGS(0x0902, 0x08fe, 0x08fa, 0x01c7, 0x01c8, 0x01c8),
+  },
+  {     .freq                   = 5760,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x40, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x86, 0x05, 0x00,
+                   0x10, 0x20, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x93, 0x00, 0x20, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x93, 0x00),
+        PHYREGS(0x0904, 0x0900, 0x08fc, 0x01c6, 0x01c7, 0x01c8),
+  },
+  {     .freq                   = 5765,
+        RADIOREGS3(0xf8, 0x00, 0x02, 0x04, 0x81, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x05, 0x05, 0x05, 0x86, 0x05, 0x00,
+                   0x10, 0x20, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x92, 0x00, 0x20, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x92, 0x00),
+        PHYREGS(0x0906, 0x0902, 0x08fe, 0x01c6, 0x01c7, 0x01c8),
+  },
+  {     .freq                   = 5770,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x41, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x86, 0x04, 0x00,
+                   0x10, 0x20, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x92, 0x00, 0x20, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x92, 0x00),
+        PHYREGS(0x0908, 0x0904, 0x0900, 0x01c6, 0x01c6, 0x01c7),
+  },
+  {     .freq                   = 5775,
+        RADIOREGS3(0xf8, 0x00, 0x02, 0x04, 0x83, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x05, 0x05, 0x05, 0x86, 0x04, 0x00,
+                   0x10, 0x20, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x92, 0x00, 0x20, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x92, 0x00),
+        PHYREGS(0x090a, 0x0906, 0x0902, 0x01c5, 0x01c6, 0x01c7),
+  },
+  {     .freq                   = 5780,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x42, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x86, 0x04, 0x00,
+                   0x10, 0x10, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x92, 0x00, 0x10, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x92, 0x00),
+        PHYREGS(0x090c, 0x0908, 0x0904, 0x01c5, 0x01c6, 0x01c6),
+  },
+  {     .freq                   = 5785,
+        RADIOREGS3(0xf2, 0x00, 0x02, 0x04, 0x85, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                   0x00, 0x10, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x92, 0x00, 0x10, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x92, 0x00),
+        PHYREGS(0x090e, 0x090a, 0x0906, 0x01c4, 0x01c5, 0x01c6),
+  },
+  {     .freq                   = 5790,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x43, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                   0x00, 0x10, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x92, 0x00, 0x10, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x92, 0x00),
+        PHYREGS(0x0910, 0x090c, 0x0908, 0x01c4, 0x01c5, 0x01c6),
+  },
+  {     .freq                   = 5795,
+        RADIOREGS3(0xf2, 0x00, 0x02, 0x04, 0x87, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                   0x00, 0x10, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x92, 0x00, 0x10, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x92, 0x00),
+        PHYREGS(0x0912, 0x090e, 0x090a, 0x01c4, 0x01c4, 0x01c5),
+  },
+  {     .freq                   = 5800,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x44, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                   0x00, 0x10, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x92, 0x00, 0x10, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x92, 0x00),
+        PHYREGS(0x0914, 0x0910, 0x090c, 0x01c3, 0x01c4, 0x01c5),
+  },
+  {     .freq                   = 5805,
+        RADIOREGS3(0xed, 0x00, 0x02, 0x04, 0x89, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                   0x00, 0x10, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x92, 0x00, 0x10, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x92, 0x00),
+        PHYREGS(0x0916, 0x0912, 0x090e, 0x01c3, 0x01c4, 0x01c4),
+  },
+  {     .freq                   = 5810,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x45, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                   0x00, 0x10, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x92, 0x00, 0x10, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x92, 0x00),
+        PHYREGS(0x0918, 0x0914, 0x0910, 0x01c2, 0x01c3, 0x01c4),
+  },
+  {     .freq                   = 5815,
+        RADIOREGS3(0xed, 0x00, 0x02, 0x04, 0x8b, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                   0x00, 0x10, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x92, 0x00, 0x10, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x92, 0x00),
+        PHYREGS(0x091a, 0x0916, 0x0912, 0x01c2, 0x01c3, 0x01c4),
+  },
+  {     .freq                   = 5820,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x46, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                   0x00, 0x10, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x92, 0x00, 0x10, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x92, 0x00),
+        PHYREGS(0x091c, 0x0918, 0x0914, 0x01c2, 0x01c2, 0x01c3),
+  },
+  {     .freq                   = 5825,
+        RADIOREGS3(0xed, 0x00, 0x02, 0x04, 0x8d, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                   0x00, 0x10, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x92, 0x00, 0x10, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x92, 0x00),
+        PHYREGS(0x091e, 0x091a, 0x0916, 0x01c1, 0x01c2, 0x01c3),
+  },
+  {     .freq                   = 5830,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x47, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                   0x00, 0x10, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x92, 0x00, 0x10, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x92, 0x00),
+        PHYREGS(0x0920, 0x091c, 0x0918, 0x01c1, 0x01c2, 0x01c2),
+  },
+  {     .freq                   = 5840,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x48, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                   0x00, 0x10, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x92, 0x00, 0x10, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x92, 0x00),
+        PHYREGS(0x0924, 0x0920, 0x091c, 0x01c0, 0x01c1, 0x01c2),
+  },
+  {     .freq                   = 5850,
+        RADIOREGS3(0xe0, 0x00, 0x01, 0x02, 0x49, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x85, 0x03, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x92, 0x00, 0x00, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x92, 0x00),
+        PHYREGS(0x0928, 0x0924, 0x0920, 0x01bf, 0x01c0, 0x01c1),
+  },
+  {     .freq                   = 5860,
+        RADIOREGS3(0xde, 0x00, 0x01, 0x02, 0x4a, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x85, 0x03, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x92, 0x00, 0x00, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x92, 0x00),
+        PHYREGS(0x092c, 0x0928, 0x0924, 0x01bf, 0x01bf, 0x01c0),
+  },
+  {     .freq                   = 5870,
+        RADIOREGS3(0xdb, 0x00, 0x01, 0x02, 0x4b, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x85, 0x03, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x91, 0x00, 0x00, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x91, 0x00),
+        PHYREGS(0x0930, 0x092c, 0x0928, 0x01be, 0x01bf, 0x01bf),
+  },
+  {     .freq                   = 5880,
+        RADIOREGS3(0xd8, 0x00, 0x01, 0x02, 0x4c, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x85, 0x03, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x91, 0x00, 0x00, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x91, 0x00),
+        PHYREGS(0x0934, 0x0930, 0x092c, 0x01bd, 0x01be, 0x01bf),
+  },
+  {     .freq                   = 5890,
+        RADIOREGS3(0xd6, 0x00, 0x01, 0x02, 0x4d, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x85, 0x03, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x91, 0x00, 0x00, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x91, 0x00),
+        PHYREGS(0x0938, 0x0934, 0x0930, 0x01bc, 0x01bd, 0x01be),
+  },
+  {     .freq                   = 5900,
+        RADIOREGS3(0xd3, 0x00, 0x01, 0x02, 0x4e, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x85, 0x03, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x91, 0x00, 0x00, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x91, 0x00),
+        PHYREGS(0x093c, 0x0938, 0x0934, 0x01bc, 0x01bc, 0x01bd),
+  },
+  {     .freq                   = 5910,
+        RADIOREGS3(0xd6, 0x00, 0x01, 0x02, 0x4f, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x85, 0x03, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00,
+                   0x00, 0x91, 0x00, 0x00, 0x00, 0x00, 0x00, 0x70,
+                   0x00, 0x00, 0x00, 0x91, 0x00),
+        PHYREGS(0x0940, 0x093c, 0x0938, 0x01bb, 0x01bc, 0x01bc),
+  },
+  {     .freq                   = 2412,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x6c, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x04, 0x04, 0x04, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x89, 0x00, 0x03, 0x00, 0x70, 0x00,
+                   0x0f, 0x00, 0x0b, 0x00, 0x89, 0x00, 0x03, 0x00,
+                   0x70, 0x00, 0x0f, 0x00, 0x0b),
+        PHYREGS(0x03c9, 0x03c5, 0x03c1, 0x043a, 0x043f, 0x0443),
+  },
+  {     .freq                   = 2417,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x71, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x89, 0x00, 0x03, 0x00, 0x70, 0x00,
+                   0x0f, 0x00, 0x0a, 0x00, 0x89, 0x00, 0x03, 0x00,
+                   0x70, 0x00, 0x0f, 0x00, 0x0a),
+        PHYREGS(0x03cb, 0x03c7, 0x03c3, 0x0438, 0x043d, 0x0441),
+  },
+  {     .freq                   = 2422,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x76, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x89, 0x00, 0x03, 0x00, 0x70, 0x00,
+                   0x0f, 0x00, 0x0a, 0x00, 0x89, 0x00, 0x03, 0x00,
+                   0x70, 0x00, 0x0f, 0x00, 0x0a),
+        PHYREGS(0x03cd, 0x03c9, 0x03c5, 0x0436, 0x043a, 0x043f),
+  },
+  {     .freq                   = 2427,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x7b, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x78, 0x00, 0x03, 0x00, 0x70, 0x00,
+                   0x0e, 0x00, 0x0a, 0x00, 0x78, 0x00, 0x03, 0x00,
+                   0x70, 0x00, 0x0e, 0x00, 0x0a),
+        PHYREGS(0x03cf, 0x03cb, 0x03c7, 0x0434, 0x0438, 0x043d),
+  },
+  {     .freq                   = 2432,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x80, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x77, 0x00, 0x03, 0x00, 0x70, 0x00,
+                   0x0e, 0x00, 0x0a, 0x00, 0x77, 0x00, 0x03, 0x00,
+                   0x70, 0x00, 0x0e, 0x00, 0x0a),
+        PHYREGS(0x03d1, 0x03cd, 0x03c9, 0x0431, 0x0436, 0x043a),
+  },
+  {     .freq                   = 2437,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x85, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x76, 0x00, 0x03, 0x00, 0x70, 0x00,
+                   0x0e, 0x00, 0x0a, 0x00, 0x76, 0x00, 0x03, 0x00,
+                   0x70, 0x00, 0x0e, 0x00, 0x0a),
+        PHYREGS(0x03d3, 0x03cf, 0x03cb, 0x042f, 0x0434, 0x0438),
+  },
+  {     .freq                   = 2442,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x8a, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x66, 0x00, 0x03, 0x00, 0x70, 0x00,
+                   0x0e, 0x00, 0x0a, 0x00, 0x66, 0x00, 0x03, 0x00,
+                   0x70, 0x00, 0x0e, 0x00, 0x0a),
+        PHYREGS(0x03d5, 0x03d1, 0x03cd, 0x042d, 0x0431, 0x0436),
+  },
+  {     .freq                   = 2447,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x8f, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x06, 0x06, 0x06, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x55, 0x00, 0x02, 0x00, 0x70, 0x00,
+                   0x0e, 0x00, 0x09, 0x00, 0x55, 0x00, 0x02, 0x00,
+                   0x70, 0x00, 0x0e, 0x00, 0x09),
+        PHYREGS(0x03d7, 0x03d3, 0x03cf, 0x042b, 0x042f, 0x0434),
+  },
+  {     .freq                   = 2452,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x94, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x06, 0x06, 0x06, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x45, 0x00, 0x02, 0x00, 0x70, 0x00,
+                   0x0e, 0x00, 0x09, 0x00, 0x45, 0x00, 0x02, 0x00,
+                   0x70, 0x00, 0x0e, 0x00, 0x09),
+        PHYREGS(0x03d9, 0x03d5, 0x03d1, 0x0429, 0x042d, 0x0431),
+  },
+  {     .freq                   = 2457,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x99, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x06, 0x06, 0x06, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x34, 0x00, 0x02, 0x00, 0x70, 0x00,
+                   0x0d, 0x00, 0x09, 0x00, 0x34, 0x00, 0x02, 0x00,
+                   0x70, 0x00, 0x0d, 0x00, 0x09),
+        PHYREGS(0x03db, 0x03d7, 0x03d3, 0x0427, 0x042b, 0x042f),
+  },
+  {     .freq                   = 2462,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x9e, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x06, 0x06, 0x06, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x33, 0x00, 0x02, 0x00, 0x70, 0x00,
+                   0x0d, 0x00, 0x09, 0x00, 0x33, 0x00, 0x02, 0x00,
+                   0x70, 0x00, 0x0d, 0x00, 0x09),
+        PHYREGS(0x03dd, 0x03d9, 0x03d5, 0x0424, 0x0429, 0x042d),
+  },
+  {     .freq                   = 2467,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0xa3, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x06, 0x06, 0x06, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x22, 0x00, 0x02, 0x00, 0x70, 0x00,
+                   0x0d, 0x00, 0x08, 0x00, 0x22, 0x00, 0x02, 0x00,
+                   0x70, 0x00, 0x0d, 0x00, 0x08),
+        PHYREGS(0x03df, 0x03db, 0x03d7, 0x0422, 0x0427, 0x042b),
+  },
+  {     .freq                   = 2472,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0xa8, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x07, 0x07, 0x07, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x11, 0x00, 0x02, 0x00, 0x70, 0x00,
+                   0x0d, 0x00, 0x08, 0x00, 0x11, 0x00, 0x02, 0x00,
+                   0x70, 0x00, 0x0d, 0x00, 0x08),
+        PHYREGS(0x03e1, 0x03dd, 0x03d9, 0x0420, 0x0424, 0x0429),
+  },
+  {     .freq                   = 2484,
+        RADIOREGS3(0xff, 0x01, 0x03, 0x09, 0xb4, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x07, 0x07, 0x07, 0x8f, 0x20, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x70, 0x00,
+                   0x0d, 0x00, 0x08, 0x00, 0x00, 0x00, 0x02, 0x00,
+                   0x70, 0x00, 0x0d, 0x00, 0x08),
+        PHYREGS(0x03e6, 0x03e2, 0x03de, 0x041b, 0x041f, 0x0424),
+  },
+};
+
+static const struct b43_nphy_channeltab_entry_rev3 b43_nphy_channeltab_rev8[] = {
+  {     .freq                   = 4920,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xec, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x00, 0x00, 0x00, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07b4, 0x07b0, 0x07ac, 0x0214, 0x0215, 0x0216),
+  },
+  {     .freq                   = 4930,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xed, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x00, 0x00, 0x00, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07b8, 0x07b4, 0x07b0, 0x0213, 0x0214, 0x0215),
+  },
+  {     .freq                   = 4940,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xee, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x00, 0x00, 0x00, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07bc, 0x07b8, 0x07b4, 0x0212, 0x0213, 0x0214),
+  },
+  {     .freq                   = 4950,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xef, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x00, 0x00, 0x00, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07c0, 0x07bc, 0x07b8, 0x0211, 0x0212, 0x0213),
+  },
+  {     .freq                   = 4960,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf0, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07c4, 0x07c0, 0x07bc, 0x020f, 0x0211, 0x0212),
+  },
+  {     .freq                   = 4970,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf1, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07c8, 0x07c4, 0x07c0, 0x020e, 0x020f, 0x0211),
+  },
+  {     .freq                   = 4980,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf2, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07cc, 0x07c8, 0x07c4, 0x020d, 0x020e, 0x020f),
+  },
+  {     .freq                   = 4990,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf3, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07d0, 0x07cc, 0x07c8, 0x020c, 0x020d, 0x020e),
+  },
+  {     .freq                   = 5000,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf4, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07d4, 0x07d0, 0x07cc, 0x020b, 0x020c, 0x020d),
+  },
+  {     .freq                   = 5010,
+        RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf5, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07d8, 0x07d4, 0x07d0, 0x020a, 0x020b, 0x020c),
+  },
+  {     .freq                   = 5020,
+        RADIOREGS3(0xf7, 0x01, 0x01, 0x01, 0xf6, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07dc, 0x07d8, 0x07d4, 0x0209, 0x020a, 0x020b),
+  },
+  {     .freq                   = 5030,
+        RADIOREGS3(0xf7, 0x01, 0x01, 0x01, 0xf7, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07e0, 0x07dc, 0x07d8, 0x0208, 0x0209, 0x020a),
+  },
+  {     .freq                   = 5040,
+        RADIOREGS3(0xef, 0x01, 0x01, 0x01, 0xf8, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07e4, 0x07e0, 0x07dc, 0x0207, 0x0208, 0x0209),
+  },
+  {     .freq                   = 5050,
+        RADIOREGS3(0xef, 0x01, 0x01, 0x01, 0xf9, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07e8, 0x07e4, 0x07e0, 0x0206, 0x0207, 0x0208),
+  },
+  {     .freq                   = 5060,
+        RADIOREGS3(0xe6, 0x01, 0x01, 0x01, 0xfa, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07ec, 0x07e8, 0x07e4, 0x0205, 0x0206, 0x0207),
+  },
+  {     .freq                   = 5070,
+        RADIOREGS3(0xe6, 0x01, 0x01, 0x01, 0xfb, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfd, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfd, 0x00, 0x09, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07f0, 0x07ec, 0x07e8, 0x0204, 0x0205, 0x0206),
+  },
+  {     .freq                   = 5080,
+        RADIOREGS3(0xde, 0x01, 0x01, 0x01, 0xfc, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfd, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfd, 0x00, 0x09, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07f4, 0x07f0, 0x07ec, 0x0203, 0x0204, 0x0205),
+  },
+  {     .freq                   = 5090,
+        RADIOREGS3(0xde, 0x01, 0x01, 0x01, 0xfd, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfd, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfd, 0x00, 0x09, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07f8, 0x07f4, 0x07f0, 0x0202, 0x0203, 0x0204),
+  },
+  {     .freq                   = 5100,
+        RADIOREGS3(0xd6, 0x01, 0x01, 0x01, 0xfe, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfd, 0x00, 0x08, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfd, 0x00, 0x08, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x07fc, 0x07f8, 0x07f4, 0x0201, 0x0202, 0x0203),
+  },
+  {     .freq                   = 5110,
+        RADIOREGS3(0xd6, 0x01, 0x01, 0x01, 0xff, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfc, 0x00, 0x08, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfc, 0x00, 0x08, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0800, 0x07fc, 0x07f8, 0x0200, 0x0201, 0x0202),
+  },
+  {     .freq                   = 5120,
+        RADIOREGS3(0xce, 0x01, 0x01, 0x02, 0x00, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfc, 0x00, 0x08, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfc, 0x00, 0x08, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0804, 0x0800, 0x07fc, 0x01ff, 0x0200, 0x0201),
+  },
+  {     .freq                   = 5130,
+        RADIOREGS3(0xce, 0x01, 0x01, 0x02, 0x01, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfc, 0x00, 0x08, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfc, 0x00, 0x08, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0808, 0x0804, 0x0800, 0x01fe, 0x01ff, 0x0200),
+  },
+  {     .freq                   = 5140,
+        RADIOREGS3(0xc6, 0x01, 0x01, 0x02, 0x02, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfb, 0x00, 0x08, 0x00, 0x77, 0x00, 0x0f,
+                   0x00, 0x6f, 0x00, 0xfb, 0x00, 0x08, 0x00, 0x77,
+                   0x00, 0x0f, 0x00, 0x6f, 0x00),
+        PHYREGS(0x080c, 0x0808, 0x0804, 0x01fd, 0x01fe, 0x01ff),
+  },
+  {     .freq                   = 5160,
+        RADIOREGS3(0xbe, 0x01, 0x01, 0x02, 0x04, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfa, 0x00, 0x07, 0x00, 0x77, 0x00, 0x0e,
+                   0x00, 0x6f, 0x00, 0xfa, 0x00, 0x07, 0x00, 0x77,
+                   0x00, 0x0e, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0814, 0x0810, 0x080c, 0x01fb, 0x01fc, 0x01fd),
+  },
+  {     .freq                   = 5170,
+        RADIOREGS3(0xbe, 0x01, 0x01, 0x02, 0x05, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xfa, 0x00, 0x07, 0x00, 0x77, 0x00, 0x0e,
+                   0x00, 0x6f, 0x00, 0xfa, 0x00, 0x07, 0x00, 0x77,
+                   0x00, 0x0e, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0818, 0x0814, 0x0810, 0x01fa, 0x01fb, 0x01fc),
+  },
+  {     .freq                   = 5180,
+        RADIOREGS3(0xb6, 0x01, 0x01, 0x02, 0x06, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xf9, 0x00, 0x06, 0x00, 0x77, 0x00, 0x0e,
+                   0x00, 0x6f, 0x00, 0xf9, 0x00, 0x06, 0x00, 0x77,
+                   0x00, 0x0e, 0x00, 0x6f, 0x00),
+        PHYREGS(0x081c, 0x0818, 0x0814, 0x01f9, 0x01fa, 0x01fb),
+  },
+  {     .freq                   = 5190,
+        RADIOREGS3(0xb6, 0x01, 0x01, 0x02, 0x07, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xf9, 0x00, 0x06, 0x00, 0x77, 0x00, 0x0d,
+                   0x00, 0x6f, 0x00, 0xf9, 0x00, 0x06, 0x00, 0x77,
+                   0x00, 0x0d, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0820, 0x081c, 0x0818, 0x01f8, 0x01f9, 0x01fa),
+  },
+  {     .freq                   = 5200,
+        RADIOREGS3(0xaf, 0x01, 0x01, 0x02, 0x08, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xf9, 0x00, 0x05, 0x00, 0x77, 0x00, 0x0d,
+                   0x00, 0x6f, 0x00, 0xf9, 0x00, 0x05, 0x00, 0x77,
+                   0x00, 0x0d, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0824, 0x0820, 0x081c, 0x01f7, 0x01f8, 0x01f9),
+  },
+  {     .freq                   = 5210,
+        RADIOREGS3(0xaf, 0x01, 0x01, 0x02, 0x09, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                   0xff, 0xf9, 0x00, 0x05, 0x00, 0x77, 0x00, 0x0d,
+                   0x00, 0x6f, 0x00, 0xf9, 0x00, 0x05, 0x00, 0x77,
+                   0x00, 0x0d, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0828, 0x0824, 0x0820, 0x01f6, 0x01f7, 0x01f8),
+  },
+  {     .freq                   = 5220,
+        RADIOREGS3(0xa7, 0x01, 0x01, 0x02, 0x0a, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8e, 0x0f, 0x00,
+                   0xfe, 0xd8, 0x00, 0x05, 0x00, 0x77, 0x00, 0x0d,
+                   0x00, 0x6f, 0x00, 0xd8, 0x00, 0x05, 0x00, 0x77,
+                   0x00, 0x0d, 0x00, 0x6f, 0x00),
+        PHYREGS(0x082c, 0x0828, 0x0824, 0x01f5, 0x01f6, 0x01f7),
+  },
+  {     .freq                   = 5230,
+        RADIOREGS3(0xa7, 0x01, 0x01, 0x02, 0x0b, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8e, 0x0f, 0x00,
+                   0xee, 0xd8, 0x00, 0x05, 0x00, 0x77, 0x00, 0x0d,
+                   0x00, 0x6f, 0x00, 0xd8, 0x00, 0x05, 0x00, 0x77,
+                   0x00, 0x0d, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0830, 0x082c, 0x0828, 0x01f4, 0x01f5, 0x01f6),
+  },
+  {     .freq                   = 5240,
+        RADIOREGS3(0xa0, 0x01, 0x01, 0x02, 0x0c, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8e, 0x0f, 0x00,
+                   0xee, 0xc8, 0x00, 0x05, 0x00, 0x77, 0x00, 0x0d,
+                   0x00, 0x6f, 0x00, 0xc8, 0x00, 0x05, 0x00, 0x77,
+                   0x00, 0x0d, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0834, 0x0830, 0x082c, 0x01f3, 0x01f4, 0x01f5),
+  },
+  {     .freq                   = 5250,
+        RADIOREGS3(0xa0, 0x01, 0x01, 0x02, 0x0d, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8e, 0x0f, 0x00,
+                   0xed, 0xc7, 0x00, 0x05, 0x00, 0x77, 0x00, 0x0d,
+                   0x00, 0x6f, 0x00, 0xc7, 0x00, 0x05, 0x00, 0x77,
+                   0x00, 0x0d, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0838, 0x0834, 0x0830, 0x01f2, 0x01f3, 0x01f4),
+  },
+  {     .freq                   = 5260,
+        RADIOREGS3(0x98, 0x01, 0x01, 0x02, 0x0e, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x02, 0x02, 0x02, 0x8e, 0x0e, 0x00,
+                   0xed, 0xc7, 0x00, 0x04, 0x00, 0x77, 0x00, 0x0d,
+                   0x00, 0x6f, 0x00, 0xc7, 0x00, 0x04, 0x00, 0x77,
+                   0x00, 0x0d, 0x00, 0x6f, 0x00),
+        PHYREGS(0x083c, 0x0838, 0x0834, 0x01f1, 0x01f2, 0x01f3),
+  },
+  {     .freq                   = 5270,
+        RADIOREGS3(0x98, 0x01, 0x01, 0x02, 0x0f, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8e, 0x0e, 0x00,
+                   0xed, 0xc7, 0x00, 0x04, 0x00, 0x77, 0x00, 0x0c,
+                   0x00, 0x6f, 0x00, 0xc7, 0x00, 0x04, 0x00, 0x77,
+                   0x00, 0x0c, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0840, 0x083c, 0x0838, 0x01f0, 0x01f1, 0x01f2),
+  },
+  {     .freq                   = 5280,
+        RADIOREGS3(0x91, 0x01, 0x01, 0x02, 0x10, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0e, 0x00,
+                   0xdc, 0xb7, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0c,
+                   0x00, 0x6f, 0x00, 0xb7, 0x00, 0x03, 0x00, 0x77,
+                   0x00, 0x0c, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0844, 0x0840, 0x083c, 0x01f0, 0x01f0, 0x01f1),
+  },
+  {     .freq                   = 5290,
+        RADIOREGS3(0x91, 0x01, 0x01, 0x02, 0x11, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0e, 0x00,
+                   0xdc, 0xb7, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0c,
+                   0x00, 0x6f, 0x00, 0xb7, 0x00, 0x03, 0x00, 0x77,
+                   0x00, 0x0c, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0848, 0x0844, 0x0840, 0x01ef, 0x01f0, 0x01f0),
+  },
+  {     .freq                   = 5300,
+        RADIOREGS3(0x8a, 0x01, 0x01, 0x02, 0x12, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0e, 0x00,
+                   0xdc, 0xb7, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0c,
+                   0x00, 0x6f, 0x00, 0xb7, 0x00, 0x03, 0x00, 0x77,
+                   0x00, 0x0c, 0x00, 0x6f, 0x00),
+        PHYREGS(0x084c, 0x0848, 0x0844, 0x01ee, 0x01ef, 0x01f0),
+  },
+  {     .freq                   = 5310,
+        RADIOREGS3(0x8a, 0x01, 0x01, 0x02, 0x13, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0e, 0x00,
+                   0xdc, 0xb7, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0c,
+                   0x00, 0x6f, 0x00, 0xb7, 0x00, 0x03, 0x00, 0x77,
+                   0x00, 0x0c, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0850, 0x084c, 0x0848, 0x01ed, 0x01ee, 0x01ef),
+  },
+  {     .freq                   = 5320,
+        RADIOREGS3(0x83, 0x01, 0x01, 0x02, 0x14, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0e, 0x00,
+                   0xdb, 0xb7, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0c,
+                   0x00, 0x6f, 0x00, 0xb7, 0x00, 0x03, 0x00, 0x77,
+                   0x00, 0x0c, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0854, 0x0850, 0x084c, 0x01ec, 0x01ed, 0x01ee),
+  },
+  {     .freq                   = 5330,
+        RADIOREGS3(0x83, 0x01, 0x01, 0x02, 0x15, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0d, 0x00,
+                   0xcb, 0xa6, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0b,
+                   0x00, 0x6f, 0x00, 0xa6, 0x00, 0x03, 0x00, 0x77,
+                   0x00, 0x0b, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0858, 0x0854, 0x0850, 0x01eb, 0x01ec, 0x01ed),
+  },
+  {     .freq                   = 5340,
+        RADIOREGS3(0x7c, 0x01, 0x01, 0x02, 0x16, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0d, 0x00,
+                   0xca, 0xa6, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0b,
+                   0x00, 0x6f, 0x00, 0xa6, 0x00, 0x03, 0x00, 0x77,
+                   0x00, 0x0b, 0x00, 0x6f, 0x00),
+        PHYREGS(0x085c, 0x0858, 0x0854, 0x01ea, 0x01eb, 0x01ec),
+  },
+  {     .freq                   = 5350,
+        RADIOREGS3(0x7c, 0x01, 0x01, 0x02, 0x17, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0d, 0x00,
+                   0xca, 0xa6, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0b,
+                   0x00, 0x6f, 0x00, 0xa6, 0x00, 0x03, 0x00, 0x77,
+                   0x00, 0x0b, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0860, 0x085c, 0x0858, 0x01e9, 0x01ea, 0x01eb),
+  },
+  {     .freq                   = 5360,
+        RADIOREGS3(0x75, 0x01, 0x01, 0x02, 0x18, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0d, 0x00,
+                   0xc9, 0x95, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0a,
+                   0x00, 0x6f, 0x00, 0x95, 0x00, 0x03, 0x00, 0x77,
+                   0x00, 0x0a, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0864, 0x0860, 0x085c, 0x01e8, 0x01e9, 0x01ea),
+  },
+  {     .freq                   = 5370,
+        RADIOREGS3(0x75, 0x01, 0x01, 0x02, 0x19, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0d, 0x00,
+                   0xc9, 0x95, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0a,
+                   0x00, 0x6f, 0x00, 0x95, 0x00, 0x03, 0x00, 0x77,
+                   0x00, 0x0a, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0868, 0x0864, 0x0860, 0x01e7, 0x01e8, 0x01e9),
+  },
+  {     .freq                   = 5380,
+        RADIOREGS3(0x6e, 0x01, 0x01, 0x02, 0x1a, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0c, 0x00,
+                   0xb8, 0x95, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0a,
+                   0x00, 0x6f, 0x00, 0x95, 0x00, 0x03, 0x00, 0x77,
+                   0x00, 0x0a, 0x00, 0x6f, 0x00),
+        PHYREGS(0x086c, 0x0868, 0x0864, 0x01e6, 0x01e7, 0x01e8),
+  },
+  {     .freq                   = 5390,
+        RADIOREGS3(0x6e, 0x01, 0x01, 0x02, 0x1b, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0c, 0x00,
+                   0xb8, 0x84, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0a,
+                   0x00, 0x6f, 0x00, 0x84, 0x00, 0x03, 0x00, 0x77,
+                   0x00, 0x0a, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0870, 0x086c, 0x0868, 0x01e5, 0x01e6, 0x01e7),
+  },
+  {     .freq                   = 5400,
+        RADIOREGS3(0x67, 0x01, 0x01, 0x02, 0x1c, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0c, 0x00,
+                   0xb8, 0x84, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0a,
+                   0x00, 0x6f, 0x00, 0x84, 0x00, 0x03, 0x00, 0x77,
+                   0x00, 0x0a, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0874, 0x0870, 0x086c, 0x01e5, 0x01e5, 0x01e6),
+  },
+  {     .freq                   = 5410,
+        RADIOREGS3(0x67, 0x01, 0x01, 0x02, 0x1d, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0c, 0x00,
+                   0xb7, 0x84, 0x00, 0x02, 0x00, 0x77, 0x00, 0x0a,
+                   0x00, 0x6f, 0x00, 0x84, 0x00, 0x02, 0x00, 0x77,
+                   0x00, 0x0a, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0878, 0x0874, 0x0870, 0x01e4, 0x01e5, 0x01e5),
+  },
+  {     .freq                   = 5420,
+        RADIOREGS3(0x61, 0x01, 0x01, 0x02, 0x1e, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0c, 0x00,
+                   0xa7, 0x84, 0x00, 0x02, 0x00, 0x77, 0x00, 0x0a,
+                   0x00, 0x6f, 0x00, 0x84, 0x00, 0x02, 0x00, 0x77,
+                   0x00, 0x0a, 0x00, 0x6f, 0x00),
+        PHYREGS(0x087c, 0x0878, 0x0874, 0x01e3, 0x01e4, 0x01e5),
+  },
+  {     .freq                   = 5430,
+        RADIOREGS3(0x61, 0x01, 0x01, 0x02, 0x1f, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0b, 0x00,
+                   0xa6, 0x84, 0x00, 0x02, 0x00, 0x77, 0x00, 0x0a,
+                   0x00, 0x6f, 0x00, 0x84, 0x00, 0x02, 0x00, 0x77,
+                   0x00, 0x0a, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0880, 0x087c, 0x0878, 0x01e2, 0x01e3, 0x01e4),
+  },
+  {     .freq                   = 5440,
+        RADIOREGS3(0x5a, 0x01, 0x01, 0x02, 0x20, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8b, 0x0b, 0x00,
+                   0xa6, 0x84, 0x00, 0x02, 0x00, 0x77, 0x00, 0x09,
+                   0x00, 0x6f, 0x00, 0x84, 0x00, 0x02, 0x00, 0x77,
+                   0x00, 0x09, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0884, 0x0880, 0x087c, 0x01e1, 0x01e2, 0x01e3),
+  },
+  {     .freq                   = 5450,
+        RADIOREGS3(0x5a, 0x01, 0x01, 0x02, 0x21, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8b, 0x0b, 0x00,
+                   0x95, 0x84, 0x00, 0x01, 0x00, 0x77, 0x00, 0x09,
+                   0x00, 0x6f, 0x00, 0x84, 0x00, 0x01, 0x00, 0x77,
+                   0x00, 0x09, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0888, 0x0884, 0x0880, 0x01e0, 0x01e1, 0x01e2),
+  },
+  {     .freq                   = 5460,
+        RADIOREGS3(0x53, 0x01, 0x01, 0x02, 0x22, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8b, 0x0b, 0x00,
+                   0x95, 0x84, 0x00, 0x01, 0x00, 0x77, 0x00, 0x09,
+                   0x00, 0x6f, 0x00, 0x84, 0x00, 0x01, 0x00, 0x77,
+                   0x00, 0x09, 0x00, 0x6f, 0x00),
+        PHYREGS(0x088c, 0x0888, 0x0884, 0x01df, 0x01e0, 0x01e1),
+  },
+  {     .freq                   = 5470,
+        RADIOREGS3(0x53, 0x01, 0x01, 0x02, 0x23, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8b, 0x0b, 0x00,
+                   0x94, 0x73, 0x00, 0x01, 0x00, 0x77, 0x00, 0x09,
+                   0x00, 0x6f, 0x00, 0x73, 0x00, 0x01, 0x00, 0x77,
+                   0x00, 0x09, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0890, 0x088c, 0x0888, 0x01de, 0x01df, 0x01e0),
+  },
+  {     .freq                   = 5480,
+        RADIOREGS3(0x4d, 0x01, 0x01, 0x02, 0x24, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8a, 0x0a, 0x00,
+                   0x84, 0x73, 0x00, 0x00, 0x00, 0x77, 0x00, 0x09,
+                   0x00, 0x6f, 0x00, 0x73, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x09, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0894, 0x0890, 0x088c, 0x01dd, 0x01de, 0x01df),
+  },
+  {     .freq                   = 5490,
+        RADIOREGS3(0x4d, 0x01, 0x01, 0x02, 0x25, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8a, 0x0a, 0x00,
+                   0x83, 0x73, 0x00, 0x00, 0x00, 0x77, 0x00, 0x09,
+                   0x00, 0x6f, 0x00, 0x73, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x09, 0x00, 0x6f, 0x00),
+        PHYREGS(0x0898, 0x0894, 0x0890, 0x01dd, 0x01dd, 0x01de),
+  },
+  {     .freq                   = 5500,
+        RADIOREGS3(0x47, 0x01, 0x01, 0x02, 0x26, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8a, 0x0a, 0x00,
+                   0x82, 0x73, 0x00, 0x00, 0x00, 0x77, 0x00, 0x09,
+                   0x00, 0x6f, 0x00, 0x73, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x09, 0x00, 0x6f, 0x00),
+        PHYREGS(0x089c, 0x0898, 0x0894, 0x01dc, 0x01dd, 0x01dd),
+  },
+  {     .freq                   = 5510,
+        RADIOREGS3(0x47, 0x01, 0x01, 0x02, 0x27, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8a, 0x0a, 0x00,
+                   0x82, 0x73, 0x00, 0x00, 0x00, 0x77, 0x00, 0x09,
+                   0x00, 0x6f, 0x00, 0x73, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x09, 0x00, 0x6f, 0x00),
+        PHYREGS(0x08a0, 0x089c, 0x0898, 0x01db, 0x01dc, 0x01dd),
+  },
+  {     .freq                   = 5520,
+        RADIOREGS3(0x40, 0x01, 0x01, 0x02, 0x28, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8a, 0x0a, 0x00,
+                   0x72, 0x73, 0x00, 0x00, 0x00, 0x77, 0x00, 0x09,
+                   0x00, 0x6f, 0x00, 0x73, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x09, 0x00, 0x6f, 0x00),
+        PHYREGS(0x08a4, 0x08a0, 0x089c, 0x01da, 0x01db, 0x01dc),
+  },
+  {     .freq                   = 5530,
+        RADIOREGS3(0x40, 0x01, 0x01, 0x02, 0x29, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8a, 0x09, 0x00,
+                   0x72, 0x73, 0x00, 0x00, 0x00, 0x77, 0x00, 0x09,
+                   0x00, 0x6f, 0x00, 0x73, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x09, 0x00, 0x6f, 0x00),
+        PHYREGS(0x08a8, 0x08a4, 0x08a0, 0x01d9, 0x01da, 0x01db),
+  },
+  {     .freq                   = 5540,
+        RADIOREGS3(0x3a, 0x01, 0x01, 0x02, 0x2a, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x8a, 0x09, 0x00,
+                   0x71, 0x73, 0x00, 0x00, 0x00, 0x77, 0x00, 0x09,
+                   0x00, 0x6f, 0x00, 0x73, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x09, 0x00, 0x6f, 0x00),
+        PHYREGS(0x08ac, 0x08a8, 0x08a4, 0x01d8, 0x01d9, 0x01da),
+  },
+  {     .freq                   = 5550,
+        RADIOREGS3(0x3a, 0x01, 0x01, 0x02, 0x2b, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x89, 0x09, 0x00,
+                   0x61, 0x73, 0x00, 0x00, 0x00, 0x77, 0x00, 0x09,
+                   0x00, 0x6f, 0x00, 0x73, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x09, 0x00, 0x6f, 0x00),
+        PHYREGS(0x08b0, 0x08ac, 0x08a8, 0x01d7, 0x01d8, 0x01d9),
+  },
+  {     .freq                   = 5560,
+        RADIOREGS3(0x34, 0x01, 0x01, 0x02, 0x2c, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x89, 0x09, 0x00,
+                   0x61, 0x73, 0x00, 0x00, 0x00, 0x77, 0x00, 0x09,
+                   0x00, 0x6f, 0x00, 0x73, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x09, 0x00, 0x6f, 0x00),
+        PHYREGS(0x08b4, 0x08b0, 0x08ac, 0x01d7, 0x01d7, 0x01d8),
+  },
+  {     .freq                   = 5570,
+        RADIOREGS3(0x34, 0x01, 0x01, 0x02, 0x2d, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x89, 0x09, 0x00,
+                   0x61, 0x62, 0x00, 0x00, 0x00, 0x77, 0x00, 0x09,
+                   0x00, 0x6f, 0x00, 0x62, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x09, 0x00, 0x6f, 0x00),
+        PHYREGS(0x08b8, 0x08b4, 0x08b0, 0x01d6, 0x01d7, 0x01d7),
+  },
+  {     .freq                   = 5580,
+        RADIOREGS3(0x2e, 0x01, 0x01, 0x02, 0x2e, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x89, 0x08, 0x00,
+                   0x60, 0x62, 0x00, 0x00, 0x00, 0x77, 0x00, 0x08,
+                   0x00, 0x6f, 0x00, 0x62, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x08, 0x00, 0x6f, 0x00),
+        PHYREGS(0x08bc, 0x08b8, 0x08b4, 0x01d5, 0x01d6, 0x01d7),
+  },
+  {     .freq                   = 5590,
+        RADIOREGS3(0x2e, 0x01, 0x01, 0x02, 0x2f, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x04, 0x04, 0x04, 0x89, 0x08, 0x00,
+                   0x50, 0x61, 0x00, 0x00, 0x00, 0x77, 0x00, 0x08,
+                   0x00, 0x6f, 0x00, 0x61, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x08, 0x00, 0x6f, 0x00),
+        PHYREGS(0x08c0, 0x08bc, 0x08b8, 0x01d4, 0x01d5, 0x01d6),
+  },
+  {     .freq                   = 5600,
+        RADIOREGS3(0x28, 0x01, 0x01, 0x02, 0x30, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x89, 0x08, 0x00,
+                   0x50, 0x51, 0x00, 0x00, 0x00, 0x77, 0x00, 0x08,
+                   0x00, 0x6f, 0x00, 0x51, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x08, 0x00, 0x6f, 0x00),
+        PHYREGS(0x08c4, 0x08c0, 0x08bc, 0x01d3, 0x01d4, 0x01d5),
+  },
+  {     .freq                   = 5610,
+        RADIOREGS3(0x28, 0x01, 0x01, 0x02, 0x31, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x89, 0x08, 0x00,
+                   0x50, 0x51, 0x00, 0x00, 0x00, 0x77, 0x00, 0x08,
+                   0x00, 0x6f, 0x00, 0x51, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x08, 0x00, 0x6f, 0x00),
+        PHYREGS(0x08c8, 0x08c4, 0x08c0, 0x01d2, 0x01d3, 0x01d4),
+  },
+  {     .freq                   = 5620,
+        RADIOREGS3(0x21, 0x01, 0x01, 0x02, 0x32, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x89, 0x08, 0x00,
+                   0x50, 0x50, 0x00, 0x00, 0x00, 0x77, 0x00, 0x07,
+                   0x00, 0x6f, 0x00, 0x50, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x07, 0x00, 0x6f, 0x00),
+        PHYREGS(0x08cc, 0x08c8, 0x08c4, 0x01d2, 0x01d2, 0x01d3),
+  },
+  {     .freq                   = 5630,
+        RADIOREGS3(0x21, 0x01, 0x01, 0x02, 0x33, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x88, 0x07, 0x00,
+                   0x50, 0x50, 0x00, 0x00, 0x00, 0x77, 0x00, 0x07,
+                   0x00, 0x6f, 0x00, 0x50, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x07, 0x00, 0x6f, 0x00),
+        PHYREGS(0x08d0, 0x08cc, 0x08c8, 0x01d1, 0x01d2, 0x01d2),
+  },
+  {     .freq                   = 5640,
+        RADIOREGS3(0x1c, 0x01, 0x01, 0x02, 0x34, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x88, 0x07, 0x00,
+                   0x40, 0x50, 0x00, 0x00, 0x00, 0x77, 0x00, 0x07,
+                   0x00, 0x6f, 0x00, 0x50, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x07, 0x00, 0x6f, 0x00),
+        PHYREGS(0x08d4, 0x08d0, 0x08cc, 0x01d0, 0x01d1, 0x01d2),
+  },
+  {     .freq                   = 5650,
+        RADIOREGS3(0x1c, 0x01, 0x01, 0x02, 0x35, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x88, 0x07, 0x00,
+                   0x40, 0x40, 0x00, 0x00, 0x00, 0x77, 0x00, 0x07,
+                   0x00, 0x6f, 0x00, 0x40, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x07, 0x00, 0x6f, 0x00),
+        PHYREGS(0x08d8, 0x08d4, 0x08d0, 0x01cf, 0x01d0, 0x01d1),
+  },
+  {     .freq                   = 5660,
+        RADIOREGS3(0x16, 0x01, 0x01, 0x02, 0x36, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x88, 0x07, 0x00,
+                   0x40, 0x40, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                   0x00, 0x6f, 0x00, 0x40, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x06, 0x00, 0x6f, 0x00),
+        PHYREGS(0x08dc, 0x08d8, 0x08d4, 0x01ce, 0x01cf, 0x01d0),
+  },
+  {     .freq                   = 5670,
+        RADIOREGS3(0x16, 0x01, 0x01, 0x02, 0x37, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x88, 0x07, 0x00,
+                   0x40, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                   0x00, 0x6f, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x06, 0x00, 0x6f, 0x00),
+        PHYREGS(0x08e0, 0x08dc, 0x08d8, 0x01ce, 0x01ce, 0x01cf),
+  },
+  {     .freq                   = 5680,
+        RADIOREGS3(0x10, 0x01, 0x01, 0x02, 0x38, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x87, 0x06, 0x00,
+                   0x30, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                   0x00, 0x6f, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x06, 0x00, 0x6f, 0x00),
+        PHYREGS(0x08e4, 0x08e0, 0x08dc, 0x01cd, 0x01ce, 0x01ce),
+  },
+  {     .freq                   = 5690,
+        RADIOREGS3(0x10, 0x01, 0x01, 0x02, 0x39, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x87, 0x06, 0x00,
+                   0x30, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                   0x00, 0x6f, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x06, 0x00, 0x6f, 0x00),
+        PHYREGS(0x08e8, 0x08e4, 0x08e0, 0x01cc, 0x01cd, 0x01ce),
+  },
+  {     .freq                   = 5700,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3a, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x87, 0x06, 0x00,
+                   0x30, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                   0x00, 0x6e, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x06, 0x00, 0x6e, 0x00),
+        PHYREGS(0x08ec, 0x08e8, 0x08e4, 0x01cb, 0x01cc, 0x01cd),
+  },
+  {     .freq                   = 5710,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3b, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x87, 0x06, 0x00,
+                   0x30, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                   0x00, 0x6e, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x06, 0x00, 0x6e, 0x00),
+        PHYREGS(0x08f0, 0x08ec, 0x08e8, 0x01ca, 0x01cb, 0x01cc),
+  },
+  {     .freq                   = 5720,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3c, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x87, 0x06, 0x00,
+                   0x30, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                   0x00, 0x6e, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x06, 0x00, 0x6e, 0x00),
+        PHYREGS(0x08f4, 0x08f0, 0x08ec, 0x01c9, 0x01ca, 0x01cb),
+  },
+  {     .freq                   = 5725,
+        RADIOREGS3(0x03, 0x01, 0x02, 0x04, 0x79, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x05, 0x05, 0x05, 0x87, 0x06, 0x00,
+                   0x30, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                   0x00, 0x6e, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x06, 0x00, 0x6e, 0x00),
+        PHYREGS(0x08f6, 0x08f2, 0x08ee, 0x01c9, 0x01ca, 0x01cb),
+  },
+  {     .freq                   = 5730,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3d, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x87, 0x05, 0x00,
+                   0x20, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                   0x00, 0x6e, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x06, 0x00, 0x6e, 0x00),
+        PHYREGS(0x08f8, 0x08f4, 0x08f0, 0x01c9, 0x01c9, 0x01ca),
+  },
+  {     .freq                   = 5735,
+        RADIOREGS3(0x03, 0x01, 0x02, 0x04, 0x7b, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x05, 0x05, 0x05, 0x87, 0x05, 0x00,
+                   0x20, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                   0x00, 0x6d, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x06, 0x00, 0x6d, 0x00),
+        PHYREGS(0x08fa, 0x08f6, 0x08f2, 0x01c8, 0x01c9, 0x01ca),
+  },
+  {     .freq                   = 5740,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3e, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x87, 0x05, 0x00,
+                   0x20, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                   0x00, 0x6d, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x06, 0x00, 0x6d, 0x00),
+        PHYREGS(0x08fc, 0x08f8, 0x08f4, 0x01c8, 0x01c9, 0x01c9),
+  },
+  {     .freq                   = 5745,
+        RADIOREGS3(0xfe, 0x00, 0x02, 0x04, 0x7d, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x05, 0x05, 0x05, 0x87, 0x05, 0x00,
+                   0x20, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                   0x00, 0x6d, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x06, 0x00, 0x6d, 0x00),
+        PHYREGS(0x08fe, 0x08fa, 0x08f6, 0x01c8, 0x01c8, 0x01c9),
+  },
+  {     .freq                   = 5750,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3f, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x87, 0x05, 0x00,
+                   0x20, 0x20, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                   0x00, 0x6d, 0x00, 0x20, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x05, 0x00, 0x6d, 0x00),
+        PHYREGS(0x0900, 0x08fc, 0x08f8, 0x01c7, 0x01c8, 0x01c9),
+  },
+  {     .freq                   = 5755,
+        RADIOREGS3(0xfe, 0x00, 0x02, 0x04, 0x7f, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x05, 0x05, 0x05, 0x87, 0x05, 0x00,
+                   0x10, 0x20, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                   0x00, 0x6c, 0x00, 0x20, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x05, 0x00, 0x6c, 0x00),
+        PHYREGS(0x0902, 0x08fe, 0x08fa, 0x01c7, 0x01c8, 0x01c8),
+  },
+  {     .freq                   = 5760,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x40, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x86, 0x05, 0x00,
+                   0x10, 0x20, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                   0x00, 0x6c, 0x00, 0x20, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x05, 0x00, 0x6c, 0x00),
+        PHYREGS(0x0904, 0x0900, 0x08fc, 0x01c6, 0x01c7, 0x01c8),
+  },
+  {     .freq                   = 5765,
+        RADIOREGS3(0xf8, 0x00, 0x02, 0x04, 0x81, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x05, 0x05, 0x05, 0x86, 0x05, 0x00,
+                   0x10, 0x10, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                   0x00, 0x6c, 0x00, 0x10, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x05, 0x00, 0x6c, 0x00),
+        PHYREGS(0x0906, 0x0902, 0x08fe, 0x01c6, 0x01c7, 0x01c8),
+  },
+  {     .freq                   = 5770,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x41, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x86, 0x04, 0x00,
+                   0x10, 0x10, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                   0x00, 0x6b, 0x00, 0x10, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x05, 0x00, 0x6b, 0x00),
+        PHYREGS(0x0908, 0x0904, 0x0900, 0x01c6, 0x01c6, 0x01c7),
+  },
+  {     .freq                   = 5775,
+        RADIOREGS3(0xf8, 0x00, 0x02, 0x04, 0x83, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x05, 0x05, 0x05, 0x86, 0x04, 0x00,
+                   0x10, 0x10, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                   0x00, 0x6b, 0x00, 0x10, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x05, 0x00, 0x6b, 0x00),
+        PHYREGS(0x090a, 0x0906, 0x0902, 0x01c5, 0x01c6, 0x01c7),
+  },
+  {     .freq                   = 5780,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x42, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x05, 0x05, 0x05, 0x86, 0x04, 0x00,
+                   0x10, 0x10, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                   0x00, 0x6b, 0x00, 0x10, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x05, 0x00, 0x6b, 0x00),
+        PHYREGS(0x090c, 0x0908, 0x0904, 0x01c5, 0x01c6, 0x01c6),
+  },
+  {     .freq                   = 5785,
+        RADIOREGS3(0xf2, 0x00, 0x02, 0x04, 0x85, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                   0x00, 0x10, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                   0x00, 0x6b, 0x00, 0x10, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x05, 0x00, 0x6b, 0x00),
+        PHYREGS(0x090e, 0x090a, 0x0906, 0x01c4, 0x01c5, 0x01c6),
+  },
+  {     .freq                   = 5790,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x43, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                   0x00, 0x10, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                   0x00, 0x6b, 0x00, 0x10, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x05, 0x00, 0x6b, 0x00),
+        PHYREGS(0x0910, 0x090c, 0x0908, 0x01c4, 0x01c5, 0x01c6),
+  },
+  {     .freq                   = 5795,
+        RADIOREGS3(0xf2, 0x00, 0x02, 0x04, 0x87, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                   0x00, 0x6b, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x05, 0x00, 0x6b, 0x00),
+        PHYREGS(0x0912, 0x090e, 0x090a, 0x01c4, 0x01c4, 0x01c5),
+  },
+  {     .freq                   = 5800,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x44, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                   0x00, 0x6b, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x05, 0x00, 0x6b, 0x00),
+        PHYREGS(0x0914, 0x0910, 0x090c, 0x01c3, 0x01c4, 0x01c5),
+  },
+  {     .freq                   = 5805,
+        RADIOREGS3(0xed, 0x00, 0x02, 0x04, 0x89, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                   0x00, 0x6a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x05, 0x00, 0x6a, 0x00),
+        PHYREGS(0x0916, 0x0912, 0x090e, 0x01c3, 0x01c4, 0x01c4),
+  },
+  {     .freq                   = 5810,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x45, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                   0x00, 0x6a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x05, 0x00, 0x6a, 0x00),
+        PHYREGS(0x0918, 0x0914, 0x0910, 0x01c2, 0x01c3, 0x01c4),
+  },
+  {     .freq                   = 5815,
+        RADIOREGS3(0xed, 0x00, 0x02, 0x04, 0x8b, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                   0x00, 0x6a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x05, 0x00, 0x6a, 0x00),
+        PHYREGS(0x091a, 0x0916, 0x0912, 0x01c2, 0x01c3, 0x01c4),
+  },
+  {     .freq                   = 5820,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x46, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                   0x00, 0x6a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x05, 0x00, 0x6a, 0x00),
+        PHYREGS(0x091c, 0x0918, 0x0914, 0x01c2, 0x01c2, 0x01c3),
+  },
+  {     .freq                   = 5825,
+        RADIOREGS3(0xed, 0x00, 0x02, 0x04, 0x8d, 0x07, 0x07, 0x04,
+                   0x10, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                   0x00, 0x69, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x05, 0x00, 0x69, 0x00),
+        PHYREGS(0x091e, 0x091a, 0x0916, 0x01c1, 0x01c2, 0x01c3),
+  },
+  {     .freq                   = 5830,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x47, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                   0x00, 0x69, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x05, 0x00, 0x69, 0x00),
+        PHYREGS(0x0920, 0x091c, 0x0918, 0x01c1, 0x01c2, 0x01c2),
+  },
+  {     .freq                   = 5840,
+        RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x48, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x04,
+                   0x00, 0x69, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x04, 0x00, 0x69, 0x00),
+        PHYREGS(0x0924, 0x0920, 0x091c, 0x01c0, 0x01c1, 0x01c2),
+  },
+  {     .freq                   = 5850,
+        RADIOREGS3(0xe0, 0x00, 0x01, 0x02, 0x49, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x85, 0x03, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x04,
+                   0x00, 0x69, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x04, 0x00, 0x69, 0x00),
+        PHYREGS(0x0928, 0x0924, 0x0920, 0x01bf, 0x01c0, 0x01c1),
+  },
+  {     .freq                   = 5860,
+        RADIOREGS3(0xde, 0x00, 0x01, 0x02, 0x4a, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x85, 0x03, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x04,
+                   0x00, 0x69, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x04, 0x00, 0x69, 0x00),
+        PHYREGS(0x092c, 0x0928, 0x0924, 0x01bf, 0x01bf, 0x01c0),
+  },
+  {     .freq                   = 5870,
+        RADIOREGS3(0xdb, 0x00, 0x01, 0x02, 0x4b, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x85, 0x03, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x04,
+                   0x00, 0x68, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x04, 0x00, 0x68, 0x00),
+        PHYREGS(0x0930, 0x092c, 0x0928, 0x01be, 0x01bf, 0x01bf),
+  },
+  {     .freq                   = 5880,
+        RADIOREGS3(0xd8, 0x00, 0x01, 0x02, 0x4c, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x85, 0x03, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x04,
+                   0x00, 0x68, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x04, 0x00, 0x68, 0x00),
+        PHYREGS(0x0934, 0x0930, 0x092c, 0x01bd, 0x01be, 0x01bf),
+  },
+  {     .freq                   = 5890,
+        RADIOREGS3(0xd6, 0x00, 0x01, 0x02, 0x4d, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x85, 0x03, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x04,
+                   0x00, 0x68, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x04, 0x00, 0x68, 0x00),
+        PHYREGS(0x0938, 0x0934, 0x0930, 0x01bc, 0x01bd, 0x01be),
+  },
+  {     .freq                   = 5900,
+        RADIOREGS3(0xd3, 0x00, 0x01, 0x02, 0x4e, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x85, 0x03, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x04,
+                   0x00, 0x68, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x04, 0x00, 0x68, 0x00),
+        PHYREGS(0x093c, 0x0938, 0x0934, 0x01bc, 0x01bc, 0x01bd),
+  },
+  {     .freq                   = 5910,
+        RADIOREGS3(0xd6, 0x00, 0x01, 0x02, 0x4f, 0x05, 0x05, 0x04,
+                   0x0c, 0x01, 0x06, 0x06, 0x06, 0x85, 0x03, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x04,
+                   0x00, 0x68, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                   0x00, 0x04, 0x00, 0x68, 0x00),
+        PHYREGS(0x0940, 0x093c, 0x0938, 0x01bb, 0x01bc, 0x01bc),
+  },
+  {     .freq                   = 2412,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x6c, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x04, 0x04, 0x04, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x78, 0x00, 0x03, 0x00, 0x70, 0x00,
+                   0x0b, 0x00, 0x0a, 0x00, 0x89, 0x00, 0x03, 0x00,
+                   0x70, 0x00, 0x0b, 0x00, 0x0a),
+        PHYREGS(0x03c9, 0x03c5, 0x03c1, 0x043a, 0x043f, 0x0443),
+  },
+  {     .freq                   = 2417,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x71, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x78, 0x00, 0x03, 0x00, 0x70, 0x00,
+                   0x0b, 0x00, 0x0a, 0x00, 0x89, 0x00, 0x03, 0x00,
+                   0x70, 0x00, 0x0b, 0x00, 0x0a),
+        PHYREGS(0x03cb, 0x03c7, 0x03c3, 0x0438, 0x043d, 0x0441),
+  },
+  {     .freq                   = 2422,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x76, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x67, 0x00, 0x03, 0x00, 0x70, 0x00,
+                   0x0b, 0x00, 0x0a, 0x00, 0x89, 0x00, 0x03, 0x00,
+                   0x70, 0x00, 0x0b, 0x00, 0x0a),
+        PHYREGS(0x03cd, 0x03c9, 0x03c5, 0x0436, 0x043a, 0x043f),
+  },
+  {     .freq                   = 2427,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x7b, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x57, 0x00, 0x03, 0x00, 0x70, 0x00,
+                   0x0a, 0x00, 0x0a, 0x00, 0x78, 0x00, 0x03, 0x00,
+                   0x70, 0x00, 0x0a, 0x00, 0x0a),
+        PHYREGS(0x03cf, 0x03cb, 0x03c7, 0x0434, 0x0438, 0x043d),
+  },
+  {     .freq                   = 2432,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x80, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x56, 0x00, 0x03, 0x00, 0x70, 0x00,
+                   0x0a, 0x00, 0x0a, 0x00, 0x77, 0x00, 0x03, 0x00,
+                   0x70, 0x00, 0x0a, 0x00, 0x0a),
+        PHYREGS(0x03d1, 0x03cd, 0x03c9, 0x0431, 0x0436, 0x043a),
+  },
+  {     .freq                   = 2437,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x85, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x46, 0x00, 0x03, 0x00, 0x70, 0x00,
+                   0x0a, 0x00, 0x0a, 0x00, 0x76, 0x00, 0x03, 0x00,
+                   0x70, 0x00, 0x0a, 0x00, 0x0a),
+        PHYREGS(0x03d3, 0x03cf, 0x03cb, 0x042f, 0x0434, 0x0438),
+  },
+  {     .freq                   = 2442,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x8a, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x45, 0x00, 0x02, 0x00, 0x70, 0x00,
+                   0x0a, 0x00, 0x0a, 0x00, 0x66, 0x00, 0x02, 0x00,
+                   0x70, 0x00, 0x0a, 0x00, 0x0a),
+        PHYREGS(0x03d5, 0x03d1, 0x03cd, 0x042d, 0x0431, 0x0436),
+  },
+  {     .freq                   = 2447,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x8f, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x06, 0x06, 0x06, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x34, 0x00, 0x02, 0x00, 0x70, 0x00,
+                   0x0a, 0x00, 0x09, 0x00, 0x55, 0x00, 0x02, 0x00,
+                   0x70, 0x00, 0x0a, 0x00, 0x09),
+        PHYREGS(0x03d7, 0x03d3, 0x03cf, 0x042b, 0x042f, 0x0434),
+  },
+  {     .freq                   = 2452,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x94, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x06, 0x06, 0x06, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x23, 0x00, 0x02, 0x00, 0x70, 0x00,
+                   0x0a, 0x00, 0x09, 0x00, 0x45, 0x00, 0x02, 0x00,
+                   0x70, 0x00, 0x0a, 0x00, 0x09),
+        PHYREGS(0x03d9, 0x03d5, 0x03d1, 0x0429, 0x042d, 0x0431),
+  },
+  {     .freq                   = 2457,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x99, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x06, 0x06, 0x06, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x12, 0x00, 0x02, 0x00, 0x70, 0x00,
+                   0x0a, 0x00, 0x09, 0x00, 0x34, 0x00, 0x02, 0x00,
+                   0x70, 0x00, 0x0a, 0x00, 0x09),
+        PHYREGS(0x03db, 0x03d7, 0x03d3, 0x0427, 0x042b, 0x042f),
+  },
+  {     .freq                   = 2462,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x9e, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x06, 0x06, 0x06, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x02, 0x00, 0x02, 0x00, 0x70, 0x00,
+                   0x09, 0x00, 0x09, 0x00, 0x33, 0x00, 0x02, 0x00,
+                   0x70, 0x00, 0x09, 0x00, 0x09),
+        PHYREGS(0x03dd, 0x03d9, 0x03d5, 0x0424, 0x0429, 0x042d),
+  },
+  {     .freq                   = 2467,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0xa3, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x06, 0x06, 0x06, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x01, 0x00, 0x02, 0x00, 0x70, 0x00,
+                   0x09, 0x00, 0x09, 0x00, 0x22, 0x00, 0x02, 0x00,
+                   0x70, 0x00, 0x09, 0x00, 0x09),
+        PHYREGS(0x03df, 0x03db, 0x03d7, 0x0422, 0x0427, 0x042b),
+  },
+  {     .freq                   = 2472,
+        RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0xa8, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x07, 0x07, 0x07, 0x8f, 0x30, 0x00,
+                   0x00, 0x00, 0x01, 0x00, 0x02, 0x00, 0x70, 0x00,
+                   0x09, 0x00, 0x09, 0x00, 0x11, 0x00, 0x02, 0x00,
+                   0x70, 0x00, 0x09, 0x00, 0x09),
+        PHYREGS(0x03e1, 0x03dd, 0x03d9, 0x0420, 0x0424, 0x0429),
+  },
+  {     .freq                   = 2484,
+        RADIOREGS3(0xff, 0x01, 0x03, 0x09, 0xb4, 0x08, 0x08, 0x04,
+                   0x16, 0x01, 0x07, 0x07, 0x07, 0x8f, 0x20, 0x00,
+                   0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x70, 0x00,
+                   0x09, 0x00, 0x09, 0x00, 0x00, 0x00, 0x02, 0x00,
+                   0x70, 0x00, 0x09, 0x00, 0x09),
+        PHYREGS(0x03e6, 0x03e2, 0x03de, 0x041b, 0x041f, 0x0424),
+  },
 };
 
+/* TODO: add support for rev4+ devices by searching in rev4+ tables */
 const struct b43_nphy_channeltab_entry_rev3 *
 b43_nphy_get_chantabent_rev3(struct b43_wldev *dev, u16 freq)
 {
diff --git a/drivers/net/wireless/b43/radio_2056.h b/drivers/net/wireless/b43/radio_2056.h
index fda6dafecb8..302600c0afa 100644
--- a/drivers/net/wireless/b43/radio_2056.h
+++ b/drivers/net/wireless/b43/radio_2056.h
@@ -4,6 +4,9 @@
 
   Copyright (c) 2010 Rafał Miłecki <zajec5@gmail.com>
 
+  Some parts of the code in this file are derived from the brcm80211
+  driver  Copyright (c) 2010 Broadcom Corporation
+
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
   the Free Software Foundation; either version 2 of the License, or
@@ -28,13 +31,1085 @@
 
 #include "tables_nphy.h"
 
+#define B2056_SYN                       (0x0 << 12)
+#define B2056_TX0                       (0x2 << 12)
+#define B2056_TX1                       (0x3 << 12)
+#define B2056_RX0                       (0x6 << 12)
+#define B2056_RX1                       (0x7 << 12)
+#define B2056_ALLTX                     (0xE << 12)
+#define B2056_ALLRX                     (0xF << 12)
+
+#define B2056_SYN_RESERVED_ADDR0        0x00
+#define B2056_SYN_IDCODE                0x01
+#define B2056_SYN_RESERVED_ADDR2        0x02
+#define B2056_SYN_RESERVED_ADDR3        0x03
+#define B2056_SYN_RESERVED_ADDR4        0x04
+#define B2056_SYN_RESERVED_ADDR5        0x05
+#define B2056_SYN_RESERVED_ADDR6        0x06
+#define B2056_SYN_RESERVED_ADDR7        0x07
+#define B2056_SYN_COM_CTRL              0x08
+#define B2056_SYN_COM_PU                0x09
+#define B2056_SYN_COM_OVR               0x0A
+#define B2056_SYN_COM_RESET             0x0B
+#define B2056_SYN_COM_RCAL              0x0C
+#define B2056_SYN_COM_RC_RXLPF          0x0D
+#define B2056_SYN_COM_RC_TXLPF          0x0E
+#define B2056_SYN_COM_RC_RXHPF          0x0F
+#define B2056_SYN_RESERVED_ADDR16       0x10
+#define B2056_SYN_RESERVED_ADDR17       0x11
+#define B2056_SYN_RESERVED_ADDR18       0x12
+#define B2056_SYN_RESERVED_ADDR19       0x13
+#define B2056_SYN_RESERVED_ADDR20       0x14
+#define B2056_SYN_RESERVED_ADDR21       0x15
+#define B2056_SYN_RESERVED_ADDR22       0x16
+#define B2056_SYN_RESERVED_ADDR23       0x17
+#define B2056_SYN_RESERVED_ADDR24       0x18
+#define B2056_SYN_RESERVED_ADDR25       0x19
+#define B2056_SYN_RESERVED_ADDR26       0x1A
+#define B2056_SYN_RESERVED_ADDR27       0x1B
+#define B2056_SYN_RESERVED_ADDR28       0x1C
+#define B2056_SYN_RESERVED_ADDR29       0x1D
+#define B2056_SYN_RESERVED_ADDR30       0x1E
+#define B2056_SYN_RESERVED_ADDR31       0x1F
+#define B2056_SYN_GPIO_MASTER1          0x20
+#define B2056_SYN_GPIO_MASTER2          0x21
+#define B2056_SYN_TOPBIAS_MASTER        0x22
+#define B2056_SYN_TOPBIAS_RCAL          0x23
+#define B2056_SYN_AFEREG                0x24
+#define B2056_SYN_TEMPPROCSENSE         0x25
+#define B2056_SYN_TEMPPROCSENSEIDAC     0x26
+#define B2056_SYN_TEMPPROCSENSERCAL     0x27
+#define B2056_SYN_LPO                   0x28
+#define B2056_SYN_VDDCAL_MASTER         0x29
+#define B2056_SYN_VDDCAL_IDAC           0x2A
+#define B2056_SYN_VDDCAL_STATUS         0x2B
+#define B2056_SYN_RCAL_MASTER           0x2C
+#define B2056_SYN_RCAL_CODE_OUT         0x2D
+#define B2056_SYN_RCCAL_CTRL0           0x2E
+#define B2056_SYN_RCCAL_CTRL1           0x2F
+#define B2056_SYN_RCCAL_CTRL2           0x30
+#define B2056_SYN_RCCAL_CTRL3           0x31
+#define B2056_SYN_RCCAL_CTRL4           0x32
+#define B2056_SYN_RCCAL_CTRL5           0x33
+#define B2056_SYN_RCCAL_CTRL6           0x34
+#define B2056_SYN_RCCAL_CTRL7           0x35
+#define B2056_SYN_RCCAL_CTRL8           0x36
+#define B2056_SYN_RCCAL_CTRL9           0x37
+#define B2056_SYN_RCCAL_CTRL10          0x38
+#define B2056_SYN_RCCAL_CTRL11          0x39
+#define B2056_SYN_ZCAL_SPARE1           0x3A
+#define B2056_SYN_ZCAL_SPARE2           0x3B
+#define B2056_SYN_PLL_MAST1             0x3C
+#define B2056_SYN_PLL_MAST2             0x3D
+#define B2056_SYN_PLL_MAST3             0x3E
+#define B2056_SYN_PLL_BIAS_RESET        0x3F
+#define B2056_SYN_PLL_XTAL0             0x40
+#define B2056_SYN_PLL_XTAL1             0x41
+#define B2056_SYN_PLL_XTAL3             0x42
+#define B2056_SYN_PLL_XTAL4             0x43
+#define B2056_SYN_PLL_XTAL5             0x44
+#define B2056_SYN_PLL_XTAL6             0x45
+#define B2056_SYN_PLL_REFDIV            0x46
+#define B2056_SYN_PLL_PFD               0x47
+#define B2056_SYN_PLL_CP1               0x48
+#define B2056_SYN_PLL_CP2               0x49
+#define B2056_SYN_PLL_CP3               0x4A
+#define B2056_SYN_PLL_LOOPFILTER1       0x4B
+#define B2056_SYN_PLL_LOOPFILTER2       0x4C
+#define B2056_SYN_PLL_LOOPFILTER3       0x4D
+#define B2056_SYN_PLL_LOOPFILTER4       0x4E
+#define B2056_SYN_PLL_LOOPFILTER5       0x4F
+#define B2056_SYN_PLL_MMD1              0x50
+#define B2056_SYN_PLL_MMD2              0x51
+#define B2056_SYN_PLL_VCO1              0x52
+#define B2056_SYN_PLL_VCO2              0x53
+#define B2056_SYN_PLL_MONITOR1          0x54
+#define B2056_SYN_PLL_MONITOR2          0x55
+#define B2056_SYN_PLL_VCOCAL1           0x56
+#define B2056_SYN_PLL_VCOCAL2           0x57
+#define B2056_SYN_PLL_VCOCAL4           0x58
+#define B2056_SYN_PLL_VCOCAL5           0x59
+#define B2056_SYN_PLL_VCOCAL6           0x5A
+#define B2056_SYN_PLL_VCOCAL7           0x5B
+#define B2056_SYN_PLL_VCOCAL8           0x5C
+#define B2056_SYN_PLL_VCOCAL9           0x5D
+#define B2056_SYN_PLL_VCOCAL10          0x5E
+#define B2056_SYN_PLL_VCOCAL11          0x5F
+#define B2056_SYN_PLL_VCOCAL12          0x60
+#define B2056_SYN_PLL_VCOCAL13          0x61
+#define B2056_SYN_PLL_VREG              0x62
+#define B2056_SYN_PLL_STATUS1           0x63
+#define B2056_SYN_PLL_STATUS2           0x64
+#define B2056_SYN_PLL_STATUS3           0x65
+#define B2056_SYN_LOGEN_PU0             0x66
+#define B2056_SYN_LOGEN_PU1             0x67
+#define B2056_SYN_LOGEN_PU2             0x68
+#define B2056_SYN_LOGEN_PU3             0x69
+#define B2056_SYN_LOGEN_PU5             0x6A
+#define B2056_SYN_LOGEN_PU6             0x6B
+#define B2056_SYN_LOGEN_PU7             0x6C
+#define B2056_SYN_LOGEN_PU8             0x6D
+#define B2056_SYN_LOGEN_BIAS_RESET      0x6E
+#define B2056_SYN_LOGEN_RCCR1           0x6F
+#define B2056_SYN_LOGEN_VCOBUF1         0x70
+#define B2056_SYN_LOGEN_MIXER1          0x71
+#define B2056_SYN_LOGEN_MIXER2          0x72
+#define B2056_SYN_LOGEN_BUF1            0x73
+#define B2056_SYN_LOGENBUF2             0x74
+#define B2056_SYN_LOGEN_BUF3            0x75
+#define B2056_SYN_LOGEN_BUF4            0x76
+#define B2056_SYN_LOGEN_DIV1            0x77
+#define B2056_SYN_LOGEN_DIV2            0x78
+#define B2056_SYN_LOGEN_DIV3            0x79
+#define B2056_SYN_LOGEN_ACL1            0x7A
+#define B2056_SYN_LOGEN_ACL2            0x7B
+#define B2056_SYN_LOGEN_ACL3            0x7C
+#define B2056_SYN_LOGEN_ACL4            0x7D
+#define B2056_SYN_LOGEN_ACL5            0x7E
+#define B2056_SYN_LOGEN_ACL6            0x7F
+#define B2056_SYN_LOGEN_ACLOUT          0x80
+#define B2056_SYN_LOGEN_ACLCAL1         0x81
+#define B2056_SYN_LOGEN_ACLCAL2         0x82
+#define B2056_SYN_LOGEN_ACLCAL3         0x83
+#define B2056_SYN_CALEN                 0x84
+#define B2056_SYN_LOGEN_PEAKDET1        0x85
+#define B2056_SYN_LOGEN_CORE_ACL_OVR    0x86
+#define B2056_SYN_LOGEN_RX_DIFF_ACL_OVR 0x87
+#define B2056_SYN_LOGEN_TX_DIFF_ACL_OVR 0x88
+#define B2056_SYN_LOGEN_RX_CMOS_ACL_OVR 0x89
+#define B2056_SYN_LOGEN_TX_CMOS_ACL_OVR 0x8A
+#define B2056_SYN_LOGEN_VCOBUF2         0x8B
+#define B2056_SYN_LOGEN_MIXER3          0x8C
+#define B2056_SYN_LOGEN_BUF5            0x8D
+#define B2056_SYN_LOGEN_BUF6            0x8E
+#define B2056_SYN_LOGEN_CBUFRX1         0x8F
+#define B2056_SYN_LOGEN_CBUFRX2         0x90
+#define B2056_SYN_LOGEN_CBUFRX3         0x91
+#define B2056_SYN_LOGEN_CBUFRX4         0x92
+#define B2056_SYN_LOGEN_CBUFTX1         0x93
+#define B2056_SYN_LOGEN_CBUFTX2         0x94
+#define B2056_SYN_LOGEN_CBUFTX3         0x95
+#define B2056_SYN_LOGEN_CBUFTX4         0x96
+#define B2056_SYN_LOGEN_CMOSRX1         0x97
+#define B2056_SYN_LOGEN_CMOSRX2         0x98
+#define B2056_SYN_LOGEN_CMOSRX3         0x99
+#define B2056_SYN_LOGEN_CMOSRX4         0x9A
+#define B2056_SYN_LOGEN_CMOSTX1         0x9B
+#define B2056_SYN_LOGEN_CMOSTX2         0x9C
+#define B2056_SYN_LOGEN_CMOSTX3         0x9D
+#define B2056_SYN_LOGEN_CMOSTX4         0x9E
+#define B2056_SYN_LOGEN_VCOBUF2_OVRVAL  0x9F
+#define B2056_SYN_LOGEN_MIXER3_OVRVAL   0xA0
+#define B2056_SYN_LOGEN_BUF5_OVRVAL     0xA1
+#define B2056_SYN_LOGEN_BUF6_OVRVAL     0xA2
+#define B2056_SYN_LOGEN_CBUFRX1_OVRVAL  0xA3
+#define B2056_SYN_LOGEN_CBUFRX2_OVRVAL  0xA4
+#define B2056_SYN_LOGEN_CBUFRX3_OVRVAL  0xA5
+#define B2056_SYN_LOGEN_CBUFRX4_OVRVAL  0xA6
+#define B2056_SYN_LOGEN_CBUFTX1_OVRVAL  0xA7
+#define B2056_SYN_LOGEN_CBUFTX2_OVRVAL  0xA8
+#define B2056_SYN_LOGEN_CBUFTX3_OVRVAL  0xA9
+#define B2056_SYN_LOGEN_CBUFTX4_OVRVAL  0xAA
+#define B2056_SYN_LOGEN_CMOSRX1_OVRVAL  0xAB
+#define B2056_SYN_LOGEN_CMOSRX2_OVRVAL  0xAC
+#define B2056_SYN_LOGEN_CMOSRX3_OVRVAL  0xAD
+#define B2056_SYN_LOGEN_CMOSRX4_OVRVAL  0xAE
+#define B2056_SYN_LOGEN_CMOSTX1_OVRVAL  0xAF
+#define B2056_SYN_LOGEN_CMOSTX2_OVRVAL  0xB0
+#define B2056_SYN_LOGEN_CMOSTX3_OVRVAL  0xB1
+#define B2056_SYN_LOGEN_CMOSTX4_OVRVAL  0xB2
+#define B2056_SYN_LOGEN_ACL_WAITCNT     0xB3
+#define B2056_SYN_LOGEN_CORE_CALVALID   0xB4
+#define B2056_SYN_LOGEN_RX_CMOS_CALVALID        0xB5
+#define B2056_SYN_LOGEN_TX_CMOS_VALID   0xB6
+
+#define B2056_TX_RESERVED_ADDR0         0x00
+#define B2056_TX_IDCODE                 0x01
+#define B2056_TX_RESERVED_ADDR2         0x02
+#define B2056_TX_RESERVED_ADDR3         0x03
+#define B2056_TX_RESERVED_ADDR4         0x04
+#define B2056_TX_RESERVED_ADDR5         0x05
+#define B2056_TX_RESERVED_ADDR6         0x06
+#define B2056_TX_RESERVED_ADDR7         0x07
+#define B2056_TX_COM_CTRL               0x08
+#define B2056_TX_COM_PU                 0x09
+#define B2056_TX_COM_OVR                0x0A
+#define B2056_TX_COM_RESET              0x0B
+#define B2056_TX_COM_RCAL               0x0C
+#define B2056_TX_COM_RC_RXLPF           0x0D
+#define B2056_TX_COM_RC_TXLPF           0x0E
+#define B2056_TX_COM_RC_RXHPF           0x0F
+#define B2056_TX_RESERVED_ADDR16        0x10
+#define B2056_TX_RESERVED_ADDR17        0x11
+#define B2056_TX_RESERVED_ADDR18        0x12
+#define B2056_TX_RESERVED_ADDR19        0x13
+#define B2056_TX_RESERVED_ADDR20        0x14
+#define B2056_TX_RESERVED_ADDR21        0x15
+#define B2056_TX_RESERVED_ADDR22        0x16
+#define B2056_TX_RESERVED_ADDR23        0x17
+#define B2056_TX_RESERVED_ADDR24        0x18
+#define B2056_TX_RESERVED_ADDR25        0x19
+#define B2056_TX_RESERVED_ADDR26        0x1A
+#define B2056_TX_RESERVED_ADDR27        0x1B
+#define B2056_TX_RESERVED_ADDR28        0x1C
+#define B2056_TX_RESERVED_ADDR29        0x1D
+#define B2056_TX_RESERVED_ADDR30        0x1E
+#define B2056_TX_RESERVED_ADDR31        0x1F
+#define B2056_TX_IQCAL_GAIN_BW          0x20
+#define B2056_TX_LOFT_FINE_I            0x21
+#define B2056_TX_LOFT_FINE_Q            0x22
+#define B2056_TX_LOFT_COARSE_I          0x23
+#define B2056_TX_LOFT_COARSE_Q          0x24
+#define B2056_TX_TX_COM_MASTER1         0x25
+#define B2056_TX_TX_COM_MASTER2         0x26
+#define B2056_TX_RXIQCAL_TXMUX          0x27
+#define B2056_TX_TX_SSI_MASTER          0x28
+#define B2056_TX_IQCAL_VCM_HG           0x29
+#define B2056_TX_IQCAL_IDAC             0x2A
+#define B2056_TX_TSSI_VCM               0x2B
+#define B2056_TX_TX_AMP_DET             0x2C
+#define B2056_TX_TX_SSI_MUX             0x2D
+#define B2056_TX_TSSIA                  0x2E
+#define B2056_TX_TSSIG                  0x2F
+#define B2056_TX_TSSI_MISC1             0x30
+#define B2056_TX_TSSI_MISC2             0x31
+#define B2056_TX_TSSI_MISC3             0x32
+#define B2056_TX_PA_SPARE1              0x33
+#define B2056_TX_PA_SPARE2              0x34
+#define B2056_TX_INTPAA_MASTER          0x35
+#define B2056_TX_INTPAA_GAIN            0x36
+#define B2056_TX_INTPAA_BOOST_TUNE      0x37
+#define B2056_TX_INTPAA_IAUX_STAT       0x38
+#define B2056_TX_INTPAA_IAUX_DYN        0x39
+#define B2056_TX_INTPAA_IMAIN_STAT      0x3A
+#define B2056_TX_INTPAA_IMAIN_DYN       0x3B
+#define B2056_TX_INTPAA_CASCBIAS        0x3C
+#define B2056_TX_INTPAA_PASLOPE         0x3D
+#define B2056_TX_INTPAA_PA_MISC         0x3E
+#define B2056_TX_INTPAG_MASTER          0x3F
+#define B2056_TX_INTPAG_GAIN            0x40
+#define B2056_TX_INTPAG_BOOST_TUNE      0x41
+#define B2056_TX_INTPAG_IAUX_STAT       0x42
+#define B2056_TX_INTPAG_IAUX_DYN        0x43
+#define B2056_TX_INTPAG_IMAIN_STAT      0x44
+#define B2056_TX_INTPAG_IMAIN_DYN       0x45
+#define B2056_TX_INTPAG_CASCBIAS        0x46
+#define B2056_TX_INTPAG_PASLOPE         0x47
+#define B2056_TX_INTPAG_PA_MISC         0x48
+#define B2056_TX_PADA_MASTER            0x49
+#define B2056_TX_PADA_IDAC              0x4A
+#define B2056_TX_PADA_CASCBIAS          0x4B
+#define B2056_TX_PADA_GAIN              0x4C
+#define B2056_TX_PADA_BOOST_TUNE        0x4D
+#define B2056_TX_PADA_SLOPE             0x4E
+#define B2056_TX_PADG_MASTER            0x4F
+#define B2056_TX_PADG_IDAC              0x50
+#define B2056_TX_PADG_CASCBIAS          0x51
+#define B2056_TX_PADG_GAIN              0x52
+#define B2056_TX_PADG_BOOST_TUNE        0x53
+#define B2056_TX_PADG_SLOPE             0x54
+#define B2056_TX_PGAA_MASTER            0x55
+#define B2056_TX_PGAA_IDAC              0x56
+#define B2056_TX_PGAA_GAIN              0x57
+#define B2056_TX_PGAA_BOOST_TUNE        0x58
+#define B2056_TX_PGAA_SLOPE             0x59
+#define B2056_TX_PGAA_MISC              0x5A
+#define B2056_TX_PGAG_MASTER            0x5B
+#define B2056_TX_PGAG_IDAC              0x5C
+#define B2056_TX_PGAG_GAIN              0x5D
+#define B2056_TX_PGAG_BOOST_TUNE        0x5E
+#define B2056_TX_PGAG_SLOPE             0x5F
+#define B2056_TX_PGAG_MISC              0x60
+#define B2056_TX_MIXA_MASTER            0x61
+#define B2056_TX_MIXA_BOOST_TUNE        0x62
+#define B2056_TX_MIXG                   0x63
+#define B2056_TX_MIXG_BOOST_TUNE        0x64
+#define B2056_TX_BB_GM_MASTER           0x65
+#define B2056_TX_GMBB_GM                0x66
+#define B2056_TX_GMBB_IDAC              0x67
+#define B2056_TX_TXLPF_MASTER           0x68
+#define B2056_TX_TXLPF_RCCAL            0x69
+#define B2056_TX_TXLPF_RCCAL_OFF0       0x6A
+#define B2056_TX_TXLPF_RCCAL_OFF1       0x6B
+#define B2056_TX_TXLPF_RCCAL_OFF2       0x6C
+#define B2056_TX_TXLPF_RCCAL_OFF3       0x6D
+#define B2056_TX_TXLPF_RCCAL_OFF4       0x6E
+#define B2056_TX_TXLPF_RCCAL_OFF5       0x6F
+#define B2056_TX_TXLPF_RCCAL_OFF6       0x70
+#define B2056_TX_TXLPF_BW               0x71
+#define B2056_TX_TXLPF_GAIN             0x72
+#define B2056_TX_TXLPF_IDAC             0x73
+#define B2056_TX_TXLPF_IDAC_0           0x74
+#define B2056_TX_TXLPF_IDAC_1           0x75
+#define B2056_TX_TXLPF_IDAC_2           0x76
+#define B2056_TX_TXLPF_IDAC_3           0x77
+#define B2056_TX_TXLPF_IDAC_4           0x78
+#define B2056_TX_TXLPF_IDAC_5           0x79
+#define B2056_TX_TXLPF_IDAC_6           0x7A
+#define B2056_TX_TXLPF_OPAMP_IDAC       0x7B
+#define B2056_TX_TXLPF_MISC             0x7C
+#define B2056_TX_TXSPARE1               0x7D
+#define B2056_TX_TXSPARE2               0x7E
+#define B2056_TX_TXSPARE3               0x7F
+#define B2056_TX_TXSPARE4               0x80
+#define B2056_TX_TXSPARE5               0x81
+#define B2056_TX_TXSPARE6               0x82
+#define B2056_TX_TXSPARE7               0x83
+#define B2056_TX_TXSPARE8               0x84
+#define B2056_TX_TXSPARE9               0x85
+#define B2056_TX_TXSPARE10              0x86
+#define B2056_TX_TXSPARE11              0x87
+#define B2056_TX_TXSPARE12              0x88
+#define B2056_TX_TXSPARE13              0x89
+#define B2056_TX_TXSPARE14              0x8A
+#define B2056_TX_TXSPARE15              0x8B
+#define B2056_TX_TXSPARE16              0x8C
+#define B2056_TX_STATUS_INTPA_GAIN      0x8D
+#define B2056_TX_STATUS_PAD_GAIN        0x8E
+#define B2056_TX_STATUS_PGA_GAIN        0x8F
+#define B2056_TX_STATUS_GM_TXLPF_GAIN   0x90
+#define B2056_TX_STATUS_TXLPF_BW        0x91
+#define B2056_TX_STATUS_TXLPF_RC        0x92
+#define B2056_TX_GMBB_IDAC0             0x93
+#define B2056_TX_GMBB_IDAC1             0x94
+#define B2056_TX_GMBB_IDAC2             0x95
+#define B2056_TX_GMBB_IDAC3             0x96
+#define B2056_TX_GMBB_IDAC4             0x97
+#define B2056_TX_GMBB_IDAC5             0x98
+#define B2056_TX_GMBB_IDAC6             0x99
+#define B2056_TX_GMBB_IDAC7             0x9A
+
+#define B2056_RX_RESERVED_ADDR0         0x00
+#define B2056_RX_IDCODE                 0x01
+#define B2056_RX_RESERVED_ADDR2         0x02
+#define B2056_RX_RESERVED_ADDR3         0x03
+#define B2056_RX_RESERVED_ADDR4         0x04
+#define B2056_RX_RESERVED_ADDR5         0x05
+#define B2056_RX_RESERVED_ADDR6         0x06
+#define B2056_RX_RESERVED_ADDR7         0x07
+#define B2056_RX_COM_CTRL               0x08
+#define B2056_RX_COM_PU                 0x09
+#define B2056_RX_COM_OVR                0x0A
+#define B2056_RX_COM_RESET              0x0B
+#define B2056_RX_COM_RCAL               0x0C
+#define B2056_RX_COM_RC_RXLPF           0x0D
+#define B2056_RX_COM_RC_TXLPF           0x0E
+#define B2056_RX_COM_RC_RXHPF           0x0F
+#define B2056_RX_RESERVED_ADDR16        0x10
+#define B2056_RX_RESERVED_ADDR17        0x11
+#define B2056_RX_RESERVED_ADDR18        0x12
+#define B2056_RX_RESERVED_ADDR19        0x13
+#define B2056_RX_RESERVED_ADDR20        0x14
+#define B2056_RX_RESERVED_ADDR21        0x15
+#define B2056_RX_RESERVED_ADDR22        0x16
+#define B2056_RX_RESERVED_ADDR23        0x17
+#define B2056_RX_RESERVED_ADDR24        0x18
+#define B2056_RX_RESERVED_ADDR25        0x19
+#define B2056_RX_RESERVED_ADDR26        0x1A
+#define B2056_RX_RESERVED_ADDR27        0x1B
+#define B2056_RX_RESERVED_ADDR28        0x1C
+#define B2056_RX_RESERVED_ADDR29        0x1D
+#define B2056_RX_RESERVED_ADDR30        0x1E
+#define B2056_RX_RESERVED_ADDR31        0x1F
+#define B2056_RX_RXIQCAL_RXMUX          0x20
+#define B2056_RX_RSSI_PU                0x21
+#define B2056_RX_RSSI_SEL               0x22
+#define B2056_RX_RSSI_GAIN              0x23
+#define B2056_RX_RSSI_NB_IDAC           0x24
+#define B2056_RX_RSSI_WB2I_IDAC_1       0x25
+#define B2056_RX_RSSI_WB2I_IDAC_2       0x26
+#define B2056_RX_RSSI_WB2Q_IDAC_1       0x27
+#define B2056_RX_RSSI_WB2Q_IDAC_2       0x28
+#define B2056_RX_RSSI_POLE              0x29
+#define B2056_RX_RSSI_WB1_IDAC          0x2A
+#define B2056_RX_RSSI_MISC              0x2B
+#define B2056_RX_LNAA_MASTER            0x2C
+#define B2056_RX_LNAA_TUNE              0x2D
+#define B2056_RX_LNAA_GAIN              0x2E
+#define B2056_RX_LNA_A_SLOPE            0x2F
+#define B2056_RX_BIASPOLE_LNAA1_IDAC    0x30
+#define B2056_RX_LNAA2_IDAC             0x31
+#define B2056_RX_LNA1A_MISC             0x32
+#define B2056_RX_LNAG_MASTER            0x33
+#define B2056_RX_LNAG_TUNE              0x34
+#define B2056_RX_LNAG_GAIN              0x35
+#define B2056_RX_LNA_G_SLOPE            0x36
+#define B2056_RX_BIASPOLE_LNAG1_IDAC    0x37
+#define B2056_RX_LNAG2_IDAC             0x38
+#define B2056_RX_LNA1G_MISC             0x39
+#define B2056_RX_MIXA_MASTER            0x3A
+#define B2056_RX_MIXA_VCM               0x3B
+#define B2056_RX_MIXA_CTRLPTAT          0x3C
+#define B2056_RX_MIXA_LOB_BIAS          0x3D
+#define B2056_RX_MIXA_CORE_IDAC         0x3E
+#define B2056_RX_MIXA_CMFB_IDAC         0x3F
+#define B2056_RX_MIXA_BIAS_AUX          0x40
+#define B2056_RX_MIXA_BIAS_MAIN         0x41
+#define B2056_RX_MIXA_BIAS_MISC         0x42
+#define B2056_RX_MIXA_MAST_BIAS         0x43
+#define B2056_RX_MIXG_MASTER            0x44
+#define B2056_RX_MIXG_VCM               0x45
+#define B2056_RX_MIXG_CTRLPTAT          0x46
+#define B2056_RX_MIXG_LOB_BIAS          0x47
+#define B2056_RX_MIXG_CORE_IDAC         0x48
+#define B2056_RX_MIXG_CMFB_IDAC         0x49
+#define B2056_RX_MIXG_BIAS_AUX          0x4A
+#define B2056_RX_MIXG_BIAS_MAIN         0x4B
+#define B2056_RX_MIXG_BIAS_MISC         0x4C
+#define B2056_RX_MIXG_MAST_BIAS         0x4D
+#define B2056_RX_TIA_MASTER             0x4E
+#define B2056_RX_TIA_IOPAMP             0x4F
+#define B2056_RX_TIA_QOPAMP             0x50
+#define B2056_RX_TIA_IMISC              0x51
+#define B2056_RX_TIA_QMISC              0x52
+#define B2056_RX_TIA_GAIN               0x53
+#define B2056_RX_TIA_SPARE1             0x54
+#define B2056_RX_TIA_SPARE2             0x55
+#define B2056_RX_BB_LPF_MASTER          0x56
+#define B2056_RX_AACI_MASTER            0x57
+#define B2056_RX_RXLPF_IDAC             0x58
+#define B2056_RX_RXLPF_OPAMPBIAS_LOWQ   0x59
+#define B2056_RX_RXLPF_OPAMPBIAS_HIGHQ  0x5A
+#define B2056_RX_RXLPF_BIAS_DCCANCEL    0x5B
+#define B2056_RX_RXLPF_OUTVCM           0x5C
+#define B2056_RX_RXLPF_INVCM_BODY       0x5D
+#define B2056_RX_RXLPF_CC_OP            0x5E
+#define B2056_RX_RXLPF_GAIN             0x5F
+#define B2056_RX_RXLPF_Q_BW             0x60
+#define B2056_RX_RXLPF_HP_CORNER_BW     0x61
+#define B2056_RX_RXLPF_RCCAL_HPC        0x62
+#define B2056_RX_RXHPF_OFF0             0x63
+#define B2056_RX_RXHPF_OFF1             0x64
+#define B2056_RX_RXHPF_OFF2             0x65
+#define B2056_RX_RXHPF_OFF3             0x66
+#define B2056_RX_RXHPF_OFF4             0x67
+#define B2056_RX_RXHPF_OFF5             0x68
+#define B2056_RX_RXHPF_OFF6             0x69
+#define B2056_RX_RXHPF_OFF7             0x6A
+#define B2056_RX_RXLPF_RCCAL_LPC        0x6B
+#define B2056_RX_RXLPF_OFF_0            0x6C
+#define B2056_RX_RXLPF_OFF_1            0x6D
+#define B2056_RX_RXLPF_OFF_2            0x6E
+#define B2056_RX_RXLPF_OFF_3            0x6F
+#define B2056_RX_RXLPF_OFF_4            0x70
+#define B2056_RX_UNUSED                 0x71
+#define B2056_RX_VGA_MASTER             0x72
+#define B2056_RX_VGA_BIAS               0x73
+#define B2056_RX_VGA_BIAS_DCCANCEL      0x74
+#define B2056_RX_VGA_GAIN               0x75
+#define B2056_RX_VGA_HP_CORNER_BW       0x76
+#define B2056_RX_VGABUF_BIAS            0x77
+#define B2056_RX_VGABUF_GAIN_BW         0x78
+#define B2056_RX_TXFBMIX_A              0x79
+#define B2056_RX_TXFBMIX_G              0x7A
+#define B2056_RX_RXSPARE1               0x7B
+#define B2056_RX_RXSPARE2               0x7C
+#define B2056_RX_RXSPARE3               0x7D
+#define B2056_RX_RXSPARE4               0x7E
+#define B2056_RX_RXSPARE5               0x7F
+#define B2056_RX_RXSPARE6               0x80
+#define B2056_RX_RXSPARE7               0x81
+#define B2056_RX_RXSPARE8               0x82
+#define B2056_RX_RXSPARE9               0x83
+#define B2056_RX_RXSPARE10              0x84
+#define B2056_RX_RXSPARE11              0x85
+#define B2056_RX_RXSPARE12              0x86
+#define B2056_RX_RXSPARE13              0x87
+#define B2056_RX_RXSPARE14              0x88
+#define B2056_RX_RXSPARE15              0x89
+#define B2056_RX_RXSPARE16              0x8A
+#define B2056_RX_STATUS_LNAA_GAIN       0x8B
+#define B2056_RX_STATUS_LNAG_GAIN       0x8C
+#define B2056_RX_STATUS_MIXTIA_GAIN     0x8D
+#define B2056_RX_STATUS_RXLPF_GAIN      0x8E
+#define B2056_RX_STATUS_VGA_BUF_GAIN    0x8F
+#define B2056_RX_STATUS_RXLPF_Q         0x90
+#define B2056_RX_STATUS_RXLPF_BUF_BW    0x91
+#define B2056_RX_STATUS_RXLPF_VGA_HPC   0x92
+#define B2056_RX_STATUS_RXLPF_RC        0x93
+#define B2056_RX_STATUS_HPC_RC          0x94
+
+#define B2056_LNA1_A_PU                 0x01
+#define B2056_LNA2_A_PU                 0x02
+#define B2056_LNA1_G_PU                 0x01
+#define B2056_LNA2_G_PU                 0x02
+#define B2056_MIXA_PU_I                 0x01
+#define B2056_MIXA_PU_Q                 0x02
+#define B2056_MIXA_PU_GM                0x10
+#define B2056_MIXG_PU_I                 0x01
+#define B2056_MIXG_PU_Q                 0x02
+#define B2056_MIXG_PU_GM                0x10
+#define B2056_TIA_PU                    0x01
+#define B2056_BB_LPF_PU                 0x20
+#define B2056_W1_PU                     0x02
+#define B2056_W2_PU                     0x04
+#define B2056_NB_PU                     0x08
+#define B2056_RSSI_W1_SEL               0x02
+#define B2056_RSSI_W2_SEL               0x04
+#define B2056_RSSI_NB_SEL               0x08
+#define B2056_VCM_MASK                  0x1C
+#define B2056_RSSI_VCM_SHIFT            0x02
+
+#define B2056_SYN                       (0x0 << 12)
+#define B2056_TX0                       (0x2 << 12)
+#define B2056_TX1                       (0x3 << 12)
+#define B2056_RX0                       (0x6 << 12)
+#define B2056_RX1                       (0x7 << 12)
+#define B2056_ALLTX                     (0xE << 12)
+#define B2056_ALLRX                     (0xF << 12)
+
+#define B2056_SYN_RESERVED_ADDR0        0x00
+#define B2056_SYN_IDCODE                0x01
+#define B2056_SYN_RESERVED_ADDR2        0x02
+#define B2056_SYN_RESERVED_ADDR3        0x03
+#define B2056_SYN_RESERVED_ADDR4        0x04
+#define B2056_SYN_RESERVED_ADDR5        0x05
+#define B2056_SYN_RESERVED_ADDR6        0x06
+#define B2056_SYN_RESERVED_ADDR7        0x07
+#define B2056_SYN_COM_CTRL              0x08
+#define B2056_SYN_COM_PU                0x09
+#define B2056_SYN_COM_OVR               0x0A
+#define B2056_SYN_COM_RESET             0x0B
+#define B2056_SYN_COM_RCAL              0x0C
+#define B2056_SYN_COM_RC_RXLPF          0x0D
+#define B2056_SYN_COM_RC_TXLPF          0x0E
+#define B2056_SYN_COM_RC_RXHPF          0x0F
+#define B2056_SYN_RESERVED_ADDR16       0x10
+#define B2056_SYN_RESERVED_ADDR17       0x11
+#define B2056_SYN_RESERVED_ADDR18       0x12
+#define B2056_SYN_RESERVED_ADDR19       0x13
+#define B2056_SYN_RESERVED_ADDR20       0x14
+#define B2056_SYN_RESERVED_ADDR21       0x15
+#define B2056_SYN_RESERVED_ADDR22       0x16
+#define B2056_SYN_RESERVED_ADDR23       0x17
+#define B2056_SYN_RESERVED_ADDR24       0x18
+#define B2056_SYN_RESERVED_ADDR25       0x19
+#define B2056_SYN_RESERVED_ADDR26       0x1A
+#define B2056_SYN_RESERVED_ADDR27       0x1B
+#define B2056_SYN_RESERVED_ADDR28       0x1C
+#define B2056_SYN_RESERVED_ADDR29       0x1D
+#define B2056_SYN_RESERVED_ADDR30       0x1E
+#define B2056_SYN_RESERVED_ADDR31       0x1F
+#define B2056_SYN_GPIO_MASTER1          0x20
+#define B2056_SYN_GPIO_MASTER2          0x21
+#define B2056_SYN_TOPBIAS_MASTER        0x22
+#define B2056_SYN_TOPBIAS_RCAL          0x23
+#define B2056_SYN_AFEREG                0x24
+#define B2056_SYN_TEMPPROCSENSE         0x25
+#define B2056_SYN_TEMPPROCSENSEIDAC     0x26
+#define B2056_SYN_TEMPPROCSENSERCAL     0x27
+#define B2056_SYN_LPO                   0x28
+#define B2056_SYN_VDDCAL_MASTER         0x29
+#define B2056_SYN_VDDCAL_IDAC           0x2A
+#define B2056_SYN_VDDCAL_STATUS         0x2B
+#define B2056_SYN_RCAL_MASTER           0x2C
+#define B2056_SYN_RCAL_CODE_OUT         0x2D
+#define B2056_SYN_RCCAL_CTRL0           0x2E
+#define B2056_SYN_RCCAL_CTRL1           0x2F
+#define B2056_SYN_RCCAL_CTRL2           0x30
+#define B2056_SYN_RCCAL_CTRL3           0x31
+#define B2056_SYN_RCCAL_CTRL4           0x32
+#define B2056_SYN_RCCAL_CTRL5           0x33
+#define B2056_SYN_RCCAL_CTRL6           0x34
+#define B2056_SYN_RCCAL_CTRL7           0x35
+#define B2056_SYN_RCCAL_CTRL8           0x36
+#define B2056_SYN_RCCAL_CTRL9           0x37
+#define B2056_SYN_RCCAL_CTRL10          0x38
+#define B2056_SYN_RCCAL_CTRL11          0x39
+#define B2056_SYN_ZCAL_SPARE1           0x3A
+#define B2056_SYN_ZCAL_SPARE2           0x3B
+#define B2056_SYN_PLL_MAST1             0x3C
+#define B2056_SYN_PLL_MAST2             0x3D
+#define B2056_SYN_PLL_MAST3             0x3E
+#define B2056_SYN_PLL_BIAS_RESET        0x3F
+#define B2056_SYN_PLL_XTAL0             0x40
+#define B2056_SYN_PLL_XTAL1             0x41
+#define B2056_SYN_PLL_XTAL3             0x42
+#define B2056_SYN_PLL_XTAL4             0x43
+#define B2056_SYN_PLL_XTAL5             0x44
+#define B2056_SYN_PLL_XTAL6             0x45
+#define B2056_SYN_PLL_REFDIV            0x46
+#define B2056_SYN_PLL_PFD               0x47
+#define B2056_SYN_PLL_CP1               0x48
+#define B2056_SYN_PLL_CP2               0x49
+#define B2056_SYN_PLL_CP3               0x4A
+#define B2056_SYN_PLL_LOOPFILTER1       0x4B
+#define B2056_SYN_PLL_LOOPFILTER2       0x4C
+#define B2056_SYN_PLL_LOOPFILTER3       0x4D
+#define B2056_SYN_PLL_LOOPFILTER4       0x4E
+#define B2056_SYN_PLL_LOOPFILTER5       0x4F
+#define B2056_SYN_PLL_MMD1              0x50
+#define B2056_SYN_PLL_MMD2              0x51
+#define B2056_SYN_PLL_VCO1              0x52
+#define B2056_SYN_PLL_VCO2              0x53
+#define B2056_SYN_PLL_MONITOR1          0x54
+#define B2056_SYN_PLL_MONITOR2          0x55
+#define B2056_SYN_PLL_VCOCAL1           0x56
+#define B2056_SYN_PLL_VCOCAL2           0x57
+#define B2056_SYN_PLL_VCOCAL4           0x58
+#define B2056_SYN_PLL_VCOCAL5           0x59
+#define B2056_SYN_PLL_VCOCAL6           0x5A
+#define B2056_SYN_PLL_VCOCAL7           0x5B
+#define B2056_SYN_PLL_VCOCAL8           0x5C
+#define B2056_SYN_PLL_VCOCAL9           0x5D
+#define B2056_SYN_PLL_VCOCAL10          0x5E
+#define B2056_SYN_PLL_VCOCAL11          0x5F
+#define B2056_SYN_PLL_VCOCAL12          0x60
+#define B2056_SYN_PLL_VCOCAL13          0x61
+#define B2056_SYN_PLL_VREG              0x62
+#define B2056_SYN_PLL_STATUS1           0x63
+#define B2056_SYN_PLL_STATUS2           0x64
+#define B2056_SYN_PLL_STATUS3           0x65
+#define B2056_SYN_LOGEN_PU0             0x66
+#define B2056_SYN_LOGEN_PU1             0x67
+#define B2056_SYN_LOGEN_PU2             0x68
+#define B2056_SYN_LOGEN_PU3             0x69
+#define B2056_SYN_LOGEN_PU5             0x6A
+#define B2056_SYN_LOGEN_PU6             0x6B
+#define B2056_SYN_LOGEN_PU7             0x6C
+#define B2056_SYN_LOGEN_PU8             0x6D
+#define B2056_SYN_LOGEN_BIAS_RESET      0x6E
+#define B2056_SYN_LOGEN_RCCR1           0x6F
+#define B2056_SYN_LOGEN_VCOBUF1         0x70
+#define B2056_SYN_LOGEN_MIXER1          0x71
+#define B2056_SYN_LOGEN_MIXER2          0x72
+#define B2056_SYN_LOGEN_BUF1            0x73
+#define B2056_SYN_LOGENBUF2             0x74
+#define B2056_SYN_LOGEN_BUF3            0x75
+#define B2056_SYN_LOGEN_BUF4            0x76
+#define B2056_SYN_LOGEN_DIV1            0x77
+#define B2056_SYN_LOGEN_DIV2            0x78
+#define B2056_SYN_LOGEN_DIV3            0x79
+#define B2056_SYN_LOGEN_ACL1            0x7A
+#define B2056_SYN_LOGEN_ACL2            0x7B
+#define B2056_SYN_LOGEN_ACL3            0x7C
+#define B2056_SYN_LOGEN_ACL4            0x7D
+#define B2056_SYN_LOGEN_ACL5            0x7E
+#define B2056_SYN_LOGEN_ACL6            0x7F
+#define B2056_SYN_LOGEN_ACLOUT          0x80
+#define B2056_SYN_LOGEN_ACLCAL1         0x81
+#define B2056_SYN_LOGEN_ACLCAL2         0x82
+#define B2056_SYN_LOGEN_ACLCAL3         0x83
+#define B2056_SYN_CALEN                 0x84
+#define B2056_SYN_LOGEN_PEAKDET1        0x85
+#define B2056_SYN_LOGEN_CORE_ACL_OVR    0x86
+#define B2056_SYN_LOGEN_RX_DIFF_ACL_OVR 0x87
+#define B2056_SYN_LOGEN_TX_DIFF_ACL_OVR 0x88
+#define B2056_SYN_LOGEN_RX_CMOS_ACL_OVR 0x89
+#define B2056_SYN_LOGEN_TX_CMOS_ACL_OVR 0x8A
+#define B2056_SYN_LOGEN_VCOBUF2         0x8B
+#define B2056_SYN_LOGEN_MIXER3          0x8C
+#define B2056_SYN_LOGEN_BUF5            0x8D
+#define B2056_SYN_LOGEN_BUF6            0x8E
+#define B2056_SYN_LOGEN_CBUFRX1         0x8F
+#define B2056_SYN_LOGEN_CBUFRX2         0x90
+#define B2056_SYN_LOGEN_CBUFRX3         0x91
+#define B2056_SYN_LOGEN_CBUFRX4         0x92
+#define B2056_SYN_LOGEN_CBUFTX1         0x93
+#define B2056_SYN_LOGEN_CBUFTX2         0x94
+#define B2056_SYN_LOGEN_CBUFTX3         0x95
+#define B2056_SYN_LOGEN_CBUFTX4         0x96
+#define B2056_SYN_LOGEN_CMOSRX1         0x97
+#define B2056_SYN_LOGEN_CMOSRX2         0x98
+#define B2056_SYN_LOGEN_CMOSRX3         0x99
+#define B2056_SYN_LOGEN_CMOSRX4         0x9A
+#define B2056_SYN_LOGEN_CMOSTX1         0x9B
+#define B2056_SYN_LOGEN_CMOSTX2         0x9C
+#define B2056_SYN_LOGEN_CMOSTX3         0x9D
+#define B2056_SYN_LOGEN_CMOSTX4         0x9E
+#define B2056_SYN_LOGEN_VCOBUF2_OVRVAL  0x9F
+#define B2056_SYN_LOGEN_MIXER3_OVRVAL   0xA0
+#define B2056_SYN_LOGEN_BUF5_OVRVAL     0xA1
+#define B2056_SYN_LOGEN_BUF6_OVRVAL     0xA2
+#define B2056_SYN_LOGEN_CBUFRX1_OVRVAL  0xA3
+#define B2056_SYN_LOGEN_CBUFRX2_OVRVAL  0xA4
+#define B2056_SYN_LOGEN_CBUFRX3_OVRVAL  0xA5
+#define B2056_SYN_LOGEN_CBUFRX4_OVRVAL  0xA6
+#define B2056_SYN_LOGEN_CBUFTX1_OVRVAL  0xA7
+#define B2056_SYN_LOGEN_CBUFTX2_OVRVAL  0xA8
+#define B2056_SYN_LOGEN_CBUFTX3_OVRVAL  0xA9
+#define B2056_SYN_LOGEN_CBUFTX4_OVRVAL  0xAA
+#define B2056_SYN_LOGEN_CMOSRX1_OVRVAL  0xAB
+#define B2056_SYN_LOGEN_CMOSRX2_OVRVAL  0xAC
+#define B2056_SYN_LOGEN_CMOSRX3_OVRVAL  0xAD
+#define B2056_SYN_LOGEN_CMOSRX4_OVRVAL  0xAE
+#define B2056_SYN_LOGEN_CMOSTX1_OVRVAL  0xAF
+#define B2056_SYN_LOGEN_CMOSTX2_OVRVAL  0xB0
+#define B2056_SYN_LOGEN_CMOSTX3_OVRVAL  0xB1
+#define B2056_SYN_LOGEN_CMOSTX4_OVRVAL  0xB2
+#define B2056_SYN_LOGEN_ACL_WAITCNT     0xB3
+#define B2056_SYN_LOGEN_CORE_CALVALID   0xB4
+#define B2056_SYN_LOGEN_RX_CMOS_CALVALID        0xB5
+#define B2056_SYN_LOGEN_TX_CMOS_VALID   0xB6
+
+#define B2056_TX_RESERVED_ADDR0         0x00
+#define B2056_TX_IDCODE                 0x01
+#define B2056_TX_RESERVED_ADDR2         0x02
+#define B2056_TX_RESERVED_ADDR3         0x03
+#define B2056_TX_RESERVED_ADDR4         0x04
+#define B2056_TX_RESERVED_ADDR5         0x05
+#define B2056_TX_RESERVED_ADDR6         0x06
+#define B2056_TX_RESERVED_ADDR7         0x07
+#define B2056_TX_COM_CTRL               0x08
+#define B2056_TX_COM_PU                 0x09
+#define B2056_TX_COM_OVR                0x0A
+#define B2056_TX_COM_RESET              0x0B
+#define B2056_TX_COM_RCAL               0x0C
+#define B2056_TX_COM_RC_RXLPF           0x0D
+#define B2056_TX_COM_RC_TXLPF           0x0E
+#define B2056_TX_COM_RC_RXHPF           0x0F
+#define B2056_TX_RESERVED_ADDR16        0x10
+#define B2056_TX_RESERVED_ADDR17        0x11
+#define B2056_TX_RESERVED_ADDR18        0x12
+#define B2056_TX_RESERVED_ADDR19        0x13
+#define B2056_TX_RESERVED_ADDR20        0x14
+#define B2056_TX_RESERVED_ADDR21        0x15
+#define B2056_TX_RESERVED_ADDR22        0x16
+#define B2056_TX_RESERVED_ADDR23        0x17
+#define B2056_TX_RESERVED_ADDR24        0x18
+#define B2056_TX_RESERVED_ADDR25        0x19
+#define B2056_TX_RESERVED_ADDR26        0x1A
+#define B2056_TX_RESERVED_ADDR27        0x1B
+#define B2056_TX_RESERVED_ADDR28        0x1C
+#define B2056_TX_RESERVED_ADDR29        0x1D
+#define B2056_TX_RESERVED_ADDR30        0x1E
+#define B2056_TX_RESERVED_ADDR31        0x1F
+#define B2056_TX_IQCAL_GAIN_BW          0x20
+#define B2056_TX_LOFT_FINE_I            0x21
+#define B2056_TX_LOFT_FINE_Q            0x22
+#define B2056_TX_LOFT_COARSE_I          0x23
+#define B2056_TX_LOFT_COARSE_Q          0x24
+#define B2056_TX_TX_COM_MASTER1         0x25
+#define B2056_TX_TX_COM_MASTER2         0x26
+#define B2056_TX_RXIQCAL_TXMUX          0x27
+#define B2056_TX_TX_SSI_MASTER          0x28
+#define B2056_TX_IQCAL_VCM_HG           0x29
+#define B2056_TX_IQCAL_IDAC             0x2A
+#define B2056_TX_TSSI_VCM               0x2B
+#define B2056_TX_TX_AMP_DET             0x2C
+#define B2056_TX_TX_SSI_MUX             0x2D
+#define B2056_TX_TSSIA                  0x2E
+#define B2056_TX_TSSIG                  0x2F
+#define B2056_TX_TSSI_MISC1             0x30
+#define B2056_TX_TSSI_MISC2             0x31
+#define B2056_TX_TSSI_MISC3             0x32
+#define B2056_TX_PA_SPARE1              0x33
+#define B2056_TX_PA_SPARE2              0x34
+#define B2056_TX_INTPAA_MASTER          0x35
+#define B2056_TX_INTPAA_GAIN            0x36
+#define B2056_TX_INTPAA_BOOST_TUNE      0x37
+#define B2056_TX_INTPAA_IAUX_STAT       0x38
+#define B2056_TX_INTPAA_IAUX_DYN        0x39
+#define B2056_TX_INTPAA_IMAIN_STAT      0x3A
+#define B2056_TX_INTPAA_IMAIN_DYN       0x3B
+#define B2056_TX_INTPAA_CASCBIAS        0x3C
+#define B2056_TX_INTPAA_PASLOPE         0x3D
+#define B2056_TX_INTPAA_PA_MISC         0x3E
+#define B2056_TX_INTPAG_MASTER          0x3F
+#define B2056_TX_INTPAG_GAIN            0x40
+#define B2056_TX_INTPAG_BOOST_TUNE      0x41
+#define B2056_TX_INTPAG_IAUX_STAT       0x42
+#define B2056_TX_INTPAG_IAUX_DYN        0x43
+#define B2056_TX_INTPAG_IMAIN_STAT      0x44
+#define B2056_TX_INTPAG_IMAIN_DYN       0x45
+#define B2056_TX_INTPAG_CASCBIAS        0x46
+#define B2056_TX_INTPAG_PASLOPE         0x47
+#define B2056_TX_INTPAG_PA_MISC         0x48
+#define B2056_TX_PADA_MASTER            0x49
+#define B2056_TX_PADA_IDAC              0x4A
+#define B2056_TX_PADA_CASCBIAS          0x4B
+#define B2056_TX_PADA_GAIN              0x4C
+#define B2056_TX_PADA_BOOST_TUNE        0x4D
+#define B2056_TX_PADA_SLOPE             0x4E
+#define B2056_TX_PADG_MASTER            0x4F
+#define B2056_TX_PADG_IDAC              0x50
+#define B2056_TX_PADG_CASCBIAS          0x51
+#define B2056_TX_PADG_GAIN              0x52
+#define B2056_TX_PADG_BOOST_TUNE        0x53
+#define B2056_TX_PADG_SLOPE             0x54
+#define B2056_TX_PGAA_MASTER            0x55
+#define B2056_TX_PGAA_IDAC              0x56
+#define B2056_TX_PGAA_GAIN              0x57
+#define B2056_TX_PGAA_BOOST_TUNE        0x58
+#define B2056_TX_PGAA_SLOPE             0x59
+#define B2056_TX_PGAA_MISC              0x5A
+#define B2056_TX_PGAG_MASTER            0x5B
+#define B2056_TX_PGAG_IDAC              0x5C
+#define B2056_TX_PGAG_GAIN              0x5D
+#define B2056_TX_PGAG_BOOST_TUNE        0x5E
+#define B2056_TX_PGAG_SLOPE             0x5F
+#define B2056_TX_PGAG_MISC              0x60
+#define B2056_TX_MIXA_MASTER            0x61
+#define B2056_TX_MIXA_BOOST_TUNE        0x62
+#define B2056_TX_MIXG                   0x63
+#define B2056_TX_MIXG_BOOST_TUNE        0x64
+#define B2056_TX_BB_GM_MASTER           0x65
+#define B2056_TX_GMBB_GM                0x66
+#define B2056_TX_GMBB_IDAC              0x67
+#define B2056_TX_TXLPF_MASTER           0x68
+#define B2056_TX_TXLPF_RCCAL            0x69
+#define B2056_TX_TXLPF_RCCAL_OFF0       0x6A
+#define B2056_TX_TXLPF_RCCAL_OFF1       0x6B
+#define B2056_TX_TXLPF_RCCAL_OFF2       0x6C
+#define B2056_TX_TXLPF_RCCAL_OFF3       0x6D
+#define B2056_TX_TXLPF_RCCAL_OFF4       0x6E
+#define B2056_TX_TXLPF_RCCAL_OFF5       0x6F
+#define B2056_TX_TXLPF_RCCAL_OFF6       0x70
+#define B2056_TX_TXLPF_BW               0x71
+#define B2056_TX_TXLPF_GAIN             0x72
+#define B2056_TX_TXLPF_IDAC             0x73
+#define B2056_TX_TXLPF_IDAC_0           0x74
+#define B2056_TX_TXLPF_IDAC_1           0x75
+#define B2056_TX_TXLPF_IDAC_2           0x76
+#define B2056_TX_TXLPF_IDAC_3           0x77
+#define B2056_TX_TXLPF_IDAC_4           0x78
+#define B2056_TX_TXLPF_IDAC_5           0x79
+#define B2056_TX_TXLPF_IDAC_6           0x7A
+#define B2056_TX_TXLPF_OPAMP_IDAC       0x7B
+#define B2056_TX_TXLPF_MISC             0x7C
+#define B2056_TX_TXSPARE1               0x7D
+#define B2056_TX_TXSPARE2               0x7E
+#define B2056_TX_TXSPARE3               0x7F
+#define B2056_TX_TXSPARE4               0x80
+#define B2056_TX_TXSPARE5               0x81
+#define B2056_TX_TXSPARE6               0x82
+#define B2056_TX_TXSPARE7               0x83
+#define B2056_TX_TXSPARE8               0x84
+#define B2056_TX_TXSPARE9               0x85
+#define B2056_TX_TXSPARE10              0x86
+#define B2056_TX_TXSPARE11              0x87
+#define B2056_TX_TXSPARE12              0x88
+#define B2056_TX_TXSPARE13              0x89
+#define B2056_TX_TXSPARE14              0x8A
+#define B2056_TX_TXSPARE15              0x8B
+#define B2056_TX_TXSPARE16              0x8C
+#define B2056_TX_STATUS_INTPA_GAIN      0x8D
+#define B2056_TX_STATUS_PAD_GAIN        0x8E
+#define B2056_TX_STATUS_PGA_GAIN        0x8F
+#define B2056_TX_STATUS_GM_TXLPF_GAIN   0x90
+#define B2056_TX_STATUS_TXLPF_BW        0x91
+#define B2056_TX_STATUS_TXLPF_RC        0x92
+#define B2056_TX_GMBB_IDAC0             0x93
+#define B2056_TX_GMBB_IDAC1             0x94
+#define B2056_TX_GMBB_IDAC2             0x95
+#define B2056_TX_GMBB_IDAC3             0x96
+#define B2056_TX_GMBB_IDAC4             0x97
+#define B2056_TX_GMBB_IDAC5             0x98
+#define B2056_TX_GMBB_IDAC6             0x99
+#define B2056_TX_GMBB_IDAC7             0x9A
+
+#define B2056_RX_RESERVED_ADDR0         0x00
+#define B2056_RX_IDCODE                 0x01
+#define B2056_RX_RESERVED_ADDR2         0x02
+#define B2056_RX_RESERVED_ADDR3         0x03
+#define B2056_RX_RESERVED_ADDR4         0x04
+#define B2056_RX_RESERVED_ADDR5         0x05
+#define B2056_RX_RESERVED_ADDR6         0x06
+#define B2056_RX_RESERVED_ADDR7         0x07
+#define B2056_RX_COM_CTRL               0x08
+#define B2056_RX_COM_PU                 0x09
+#define B2056_RX_COM_OVR                0x0A
+#define B2056_RX_COM_RESET              0x0B
+#define B2056_RX_COM_RCAL               0x0C
+#define B2056_RX_COM_RC_RXLPF           0x0D
+#define B2056_RX_COM_RC_TXLPF           0x0E
+#define B2056_RX_COM_RC_RXHPF           0x0F
+#define B2056_RX_RESERVED_ADDR16        0x10
+#define B2056_RX_RESERVED_ADDR17        0x11
+#define B2056_RX_RESERVED_ADDR18        0x12
+#define B2056_RX_RESERVED_ADDR19        0x13
+#define B2056_RX_RESERVED_ADDR20        0x14
+#define B2056_RX_RESERVED_ADDR21        0x15
+#define B2056_RX_RESERVED_ADDR22        0x16
+#define B2056_RX_RESERVED_ADDR23        0x17
+#define B2056_RX_RESERVED_ADDR24        0x18
+#define B2056_RX_RESERVED_ADDR25        0x19
+#define B2056_RX_RESERVED_ADDR26        0x1A
+#define B2056_RX_RESERVED_ADDR27        0x1B
+#define B2056_RX_RESERVED_ADDR28        0x1C
+#define B2056_RX_RESERVED_ADDR29        0x1D
+#define B2056_RX_RESERVED_ADDR30        0x1E
+#define B2056_RX_RESERVED_ADDR31        0x1F
+#define B2056_RX_RXIQCAL_RXMUX          0x20
+#define B2056_RX_RSSI_PU                0x21
+#define B2056_RX_RSSI_SEL               0x22
+#define B2056_RX_RSSI_GAIN              0x23
+#define B2056_RX_RSSI_NB_IDAC           0x24
+#define B2056_RX_RSSI_WB2I_IDAC_1       0x25
+#define B2056_RX_RSSI_WB2I_IDAC_2       0x26
+#define B2056_RX_RSSI_WB2Q_IDAC_1       0x27
+#define B2056_RX_RSSI_WB2Q_IDAC_2       0x28
+#define B2056_RX_RSSI_POLE              0x29
+#define B2056_RX_RSSI_WB1_IDAC          0x2A
+#define B2056_RX_RSSI_MISC              0x2B
+#define B2056_RX_LNAA_MASTER            0x2C
+#define B2056_RX_LNAA_TUNE              0x2D
+#define B2056_RX_LNAA_GAIN              0x2E
+#define B2056_RX_LNA_A_SLOPE            0x2F
+#define B2056_RX_BIASPOLE_LNAA1_IDAC    0x30
+#define B2056_RX_LNAA2_IDAC             0x31
+#define B2056_RX_LNA1A_MISC             0x32
+#define B2056_RX_LNAG_MASTER            0x33
+#define B2056_RX_LNAG_TUNE              0x34
+#define B2056_RX_LNAG_GAIN              0x35
+#define B2056_RX_LNA_G_SLOPE            0x36
+#define B2056_RX_BIASPOLE_LNAG1_IDAC    0x37
+#define B2056_RX_LNAG2_IDAC             0x38
+#define B2056_RX_LNA1G_MISC             0x39
+#define B2056_RX_MIXA_MASTER            0x3A
+#define B2056_RX_MIXA_VCM               0x3B
+#define B2056_RX_MIXA_CTRLPTAT          0x3C
+#define B2056_RX_MIXA_LOB_BIAS          0x3D
+#define B2056_RX_MIXA_CORE_IDAC         0x3E
+#define B2056_RX_MIXA_CMFB_IDAC         0x3F
+#define B2056_RX_MIXA_BIAS_AUX          0x40
+#define B2056_RX_MIXA_BIAS_MAIN         0x41
+#define B2056_RX_MIXA_BIAS_MISC         0x42
+#define B2056_RX_MIXA_MAST_BIAS         0x43
+#define B2056_RX_MIXG_MASTER            0x44
+#define B2056_RX_MIXG_VCM               0x45
+#define B2056_RX_MIXG_CTRLPTAT          0x46
+#define B2056_RX_MIXG_LOB_BIAS          0x47
+#define B2056_RX_MIXG_CORE_IDAC         0x48
+#define B2056_RX_MIXG_CMFB_IDAC         0x49
+#define B2056_RX_MIXG_BIAS_AUX          0x4A
+#define B2056_RX_MIXG_BIAS_MAIN         0x4B
+#define B2056_RX_MIXG_BIAS_MISC         0x4C
+#define B2056_RX_MIXG_MAST_BIAS         0x4D
+#define B2056_RX_TIA_MASTER             0x4E
+#define B2056_RX_TIA_IOPAMP             0x4F
+#define B2056_RX_TIA_QOPAMP             0x50
+#define B2056_RX_TIA_IMISC              0x51
+#define B2056_RX_TIA_QMISC              0x52
+#define B2056_RX_TIA_GAIN               0x53
+#define B2056_RX_TIA_SPARE1             0x54
+#define B2056_RX_TIA_SPARE2             0x55
+#define B2056_RX_BB_LPF_MASTER          0x56
+#define B2056_RX_AACI_MASTER            0x57
+#define B2056_RX_RXLPF_IDAC             0x58
+#define B2056_RX_RXLPF_OPAMPBIAS_LOWQ   0x59
+#define B2056_RX_RXLPF_OPAMPBIAS_HIGHQ  0x5A
+#define B2056_RX_RXLPF_BIAS_DCCANCEL    0x5B
+#define B2056_RX_RXLPF_OUTVCM           0x5C
+#define B2056_RX_RXLPF_INVCM_BODY       0x5D
+#define B2056_RX_RXLPF_CC_OP            0x5E
+#define B2056_RX_RXLPF_GAIN             0x5F
+#define B2056_RX_RXLPF_Q_BW             0x60
+#define B2056_RX_RXLPF_HP_CORNER_BW     0x61
+#define B2056_RX_RXLPF_RCCAL_HPC        0x62
+#define B2056_RX_RXHPF_OFF0             0x63
+#define B2056_RX_RXHPF_OFF1             0x64
+#define B2056_RX_RXHPF_OFF2             0x65
+#define B2056_RX_RXHPF_OFF3             0x66
+#define B2056_RX_RXHPF_OFF4             0x67
+#define B2056_RX_RXHPF_OFF5             0x68
+#define B2056_RX_RXHPF_OFF6             0x69
+#define B2056_RX_RXHPF_OFF7             0x6A
+#define B2056_RX_RXLPF_RCCAL_LPC        0x6B
+#define B2056_RX_RXLPF_OFF_0            0x6C
+#define B2056_RX_RXLPF_OFF_1            0x6D
+#define B2056_RX_RXLPF_OFF_2            0x6E
+#define B2056_RX_RXLPF_OFF_3            0x6F
+#define B2056_RX_RXLPF_OFF_4            0x70
+#define B2056_RX_UNUSED                 0x71
+#define B2056_RX_VGA_MASTER             0x72
+#define B2056_RX_VGA_BIAS               0x73
+#define B2056_RX_VGA_BIAS_DCCANCEL      0x74
+#define B2056_RX_VGA_GAIN               0x75
+#define B2056_RX_VGA_HP_CORNER_BW       0x76
+#define B2056_RX_VGABUF_BIAS            0x77
+#define B2056_RX_VGABUF_GAIN_BW         0x78
+#define B2056_RX_TXFBMIX_A              0x79
+#define B2056_RX_TXFBMIX_G              0x7A
+#define B2056_RX_RXSPARE1               0x7B
+#define B2056_RX_RXSPARE2               0x7C
+#define B2056_RX_RXSPARE3               0x7D
+#define B2056_RX_RXSPARE4               0x7E
+#define B2056_RX_RXSPARE5               0x7F
+#define B2056_RX_RXSPARE6               0x80
+#define B2056_RX_RXSPARE7               0x81
+#define B2056_RX_RXSPARE8               0x82
+#define B2056_RX_RXSPARE9               0x83
+#define B2056_RX_RXSPARE10              0x84
+#define B2056_RX_RXSPARE11              0x85
+#define B2056_RX_RXSPARE12              0x86
+#define B2056_RX_RXSPARE13              0x87
+#define B2056_RX_RXSPARE14              0x88
+#define B2056_RX_RXSPARE15              0x89
+#define B2056_RX_RXSPARE16              0x8A
+#define B2056_RX_STATUS_LNAA_GAIN       0x8B
+#define B2056_RX_STATUS_LNAG_GAIN       0x8C
+#define B2056_RX_STATUS_MIXTIA_GAIN     0x8D
+#define B2056_RX_STATUS_RXLPF_GAIN      0x8E
+#define B2056_RX_STATUS_VGA_BUF_GAIN    0x8F
+#define B2056_RX_STATUS_RXLPF_Q         0x90
+#define B2056_RX_STATUS_RXLPF_BUF_BW    0x91
+#define B2056_RX_STATUS_RXLPF_VGA_HPC   0x92
+#define B2056_RX_STATUS_RXLPF_RC        0x93
+#define B2056_RX_STATUS_HPC_RC          0x94
+
+#define B2056_LNA1_A_PU                 0x01
+#define B2056_LNA2_A_PU                 0x02
+#define B2056_LNA1_G_PU                 0x01
+#define B2056_LNA2_G_PU                 0x02
+#define B2056_MIXA_PU_I                 0x01
+#define B2056_MIXA_PU_Q                 0x02
+#define B2056_MIXA_PU_GM                0x10
+#define B2056_MIXG_PU_I                 0x01
+#define B2056_MIXG_PU_Q                 0x02
+#define B2056_MIXG_PU_GM                0x10
+#define B2056_TIA_PU                    0x01
+#define B2056_BB_LPF_PU                 0x20
+#define B2056_W1_PU                     0x02
+#define B2056_W2_PU                     0x04
+#define B2056_NB_PU                     0x08
+#define B2056_RSSI_W1_SEL               0x02
+#define B2056_RSSI_W2_SEL               0x04
+#define B2056_RSSI_NB_SEL               0x08
+#define B2056_VCM_MASK                  0x1C
+#define B2056_RSSI_VCM_SHIFT            0x02
+
 struct b43_nphy_channeltab_entry_rev3 {
-        /* The channel number */
-        u8 channel;
         /* The channel frequency in MHz */
         u16 freq;
         /* Radio register values on channelswitch */
-        /* TODO */
+        u8 radio_syn_pll_vcocal1;
+        u8 radio_syn_pll_vcocal2;
+        u8 radio_syn_pll_refdiv;
+        u8 radio_syn_pll_mmd2;
+        u8 radio_syn_pll_mmd1;
+        u8 radio_syn_pll_loopfilter1;
+        u8 radio_syn_pll_loopfilter2;
+        u8 radio_syn_pll_loopfilter3;
+        u8 radio_syn_pll_loopfilter4;
+        u8 radio_syn_pll_loopfilter5;
+        u8 radio_syn_reserved_addr27;
+        u8 radio_syn_reserved_addr28;
+        u8 radio_syn_reserved_addr29;
+        u8 radio_syn_logen_vcobuf1;
+        u8 radio_syn_logen_mixer2;
+        u8 radio_syn_logen_buf3;
+        u8 radio_syn_logen_buf4;
+        u8 radio_rx0_lnaa_tune;
+        u8 radio_rx0_lnag_tune;
+        u8 radio_tx0_intpaa_boost_tune;
+        u8 radio_tx0_intpag_boost_tune;
+        u8 radio_tx0_pada_boost_tune;
+        u8 radio_tx0_padg_boost_tune;
+        u8 radio_tx0_pgaa_boost_tune;
+        u8 radio_tx0_pgag_boost_tune;
+        u8 radio_tx0_mixa_boost_tune;
+        u8 radio_tx0_mixg_boost_tune;
+        u8 radio_rx1_lnaa_tune;
+        u8 radio_rx1_lnag_tune;
+        u8 radio_tx1_intpaa_boost_tune;
+        u8 radio_tx1_intpag_boost_tune;
+        u8 radio_tx1_pada_boost_tune;
+        u8 radio_tx1_padg_boost_tune;
+        u8 radio_tx1_pgaa_boost_tune;
+        u8 radio_tx1_pgag_boost_tune;
+        u8 radio_tx1_mixa_boost_tune;
+        u8 radio_tx1_mixg_boost_tune;
         /* PHY register values on channelswitch */
         struct b43_phy_n_sfo_cfg phy_regs;
 };
diff --git a/drivers/net/wireless/b43/rfkill.c b/drivers/net/wireless/b43/rfkill.c
index 78016ae21c5..86bc0a0f735 100644
--- a/drivers/net/wireless/b43/rfkill.c
+++ b/drivers/net/wireless/b43/rfkill.c
@@ -28,23 +28,8 @@
 /* Returns TRUE, if the radio is enabled in hardware. */
 bool b43_is_hw_radio_enabled(struct b43_wldev *dev)
 {
-        if (dev->phy.rev >= 3 || dev->phy.type == B43_PHYTYPE_LP) {
-                if (!(b43_read32(dev, B43_MMIO_RADIO_HWENABLED_HI)
-                      & B43_MMIO_RADIO_HWENABLED_HI_MASK))
-                        return 1;
-        } else {
-                /* To prevent CPU fault on PPC, do not read a register
-                 * unless the interface is started; however, on resume
-                 * for hibernation, this routine is entered early. When
-                 * that happens, unconditionally return TRUE.
-                 */
-                if (b43_status(dev) < B43_STAT_STARTED)
-                        return 1;
-                if (b43_read16(dev, B43_MMIO_RADIO_HWENABLED_LO)
-                    & B43_MMIO_RADIO_HWENABLED_LO_MASK)
-                        return 1;
-        }
-        return 0;
+        return !(b43_read32(dev, B43_MMIO_RADIO_HWENABLED_HI)
+                & B43_MMIO_RADIO_HWENABLED_HI_MASK);
 }
 
 /* The poll callback for the hardware button. */
diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
index 67f18ecdb3b..1f11e1670bf 100644
--- a/drivers/net/wireless/b43legacy/main.c
+++ b/drivers/net/wireless/b43legacy/main.c
@@ -181,52 +181,75 @@ static int b43legacy_ratelimit(struct b43legacy_wl *wl)
 
 void b43legacyinfo(struct b43legacy_wl *wl, const char *fmt, ...)
 {
+        struct va_format vaf;
         va_list args;
 
         if (!b43legacy_ratelimit(wl))
                 return;
+
         va_start(args, fmt);
-        printk(KERN_INFO "b43legacy-%s: ",
-               (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
-        vprintk(fmt, args);
+
+        vaf.fmt = fmt;
+        vaf.va = &args;
+
+        printk(KERN_INFO "b43legacy-%s: %pV",
+               (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
+
         va_end(args);
 }
 
 void b43legacyerr(struct b43legacy_wl *wl, const char *fmt, ...)
 {
+        struct va_format vaf;
         va_list args;
 
         if (!b43legacy_ratelimit(wl))
                 return;
+
         va_start(args, fmt);
-        printk(KERN_ERR "b43legacy-%s ERROR: ",
-               (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
-        vprintk(fmt, args);
+
+        vaf.fmt = fmt;
+        vaf.va = &args;
+
+        printk(KERN_ERR "b43legacy-%s ERROR: %pV",
+               (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
+
         va_end(args);
 }
 
 void b43legacywarn(struct b43legacy_wl *wl, const char *fmt, ...)
 {
+        struct va_format vaf;
         va_list args;
 
         if (!b43legacy_ratelimit(wl))
                 return;
+
         va_start(args, fmt);
-        printk(KERN_WARNING "b43legacy-%s warning: ",
-               (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
-        vprintk(fmt, args);
+
+        vaf.fmt = fmt;
+        vaf.va = &args;
+
+        printk(KERN_WARNING "b43legacy-%s warning: %pV",
+               (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
+
         va_end(args);
 }
 
 #if B43legacy_DEBUG
 void b43legacydbg(struct b43legacy_wl *wl, const char *fmt, ...)
 {
+        struct va_format vaf;
         va_list args;
 
         va_start(args, fmt);
-        printk(KERN_DEBUG "b43legacy-%s debug: ",
-               (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
-        vprintk(fmt, args);
+
+        vaf.fmt = fmt;
+        vaf.va = &args;
+
+        printk(KERN_DEBUG "b43legacy-%s debug: %pV",
+               (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
+
         va_end(args);
 }
 #endif /* DEBUG */
diff --git a/drivers/net/wireless/b43legacy/rfkill.c b/drivers/net/wireless/b43legacy/rfkill.c
index d579df72b78..b90f223fb31 100644
--- a/drivers/net/wireless/b43legacy/rfkill.c
+++ b/drivers/net/wireless/b43legacy/rfkill.c
@@ -29,7 +29,7 @@
 /* Returns TRUE, if the radio is enabled in hardware. */
 bool b43legacy_is_hw_radio_enabled(struct b43legacy_wldev *dev)
 {
-        if (dev->phy.rev >= 3) {
+        if (dev->dev->id.revision >= 3) {
                 if (!(b43legacy_read32(dev, B43legacy_MMIO_RADIO_HWENABLED_HI)
                       & B43legacy_MMIO_RADIO_HWENABLED_HI_MASK))
                         return 1;
diff --git a/drivers/net/wireless/iwlwifi/Kconfig b/drivers/net/wireless/iwlwifi/Kconfig
index b82364258dc..ed424574160 100644
--- a/drivers/net/wireless/iwlwifi/Kconfig
+++ b/drivers/net/wireless/iwlwifi/Kconfig
@@ -106,6 +106,9 @@ config IWL5000
                 Intel WiFi Link 1000BGN
                 Intel Wireless WiFi 5150AGN
                 Intel Wireless WiFi 5100AGN, 5300AGN, and 5350AGN
+                Intel 6000 Gen 2 Series Wi-Fi Adapters (6000G2A and 6000G2B)
+                Intel WIreless WiFi Link 6050BGN Gen 2 Adapter
+                Intel 100 Series Wi-Fi Adapters (100BGN and 130BGN)
 
 config IWL3945
         tristate "Intel PRO/Wireless 3945ABG/BG Network Connection (iwl3945)"
diff --git a/drivers/net/wireless/iwlwifi/Makefile b/drivers/net/wireless/iwlwifi/Makefile
index 63edbe2e557..93380f97835 100644
--- a/drivers/net/wireless/iwlwifi/Makefile
+++ b/drivers/net/wireless/iwlwifi/Makefile
@@ -2,20 +2,27 @@ obj-$(CONFIG_IWLWIFI)	+= iwlcore.o
 iwlcore-objs            := iwl-core.o iwl-eeprom.o iwl-hcmd.o iwl-power.o
 iwlcore-objs            += iwl-rx.o iwl-tx.o iwl-sta.o
 iwlcore-objs            += iwl-scan.o iwl-led.o
+iwlcore-$(CONFIG_IWL3945) += iwl-legacy.o
+iwlcore-$(CONFIG_IWL4965) += iwl-legacy.o
 iwlcore-$(CONFIG_IWLWIFI_DEBUGFS) += iwl-debugfs.o
 iwlcore-$(CONFIG_IWLWIFI_DEVICE_TRACING) += iwl-devtrace.o
 
+# If 3945 is selected only, iwl-legacy.o will be added
+# to iwlcore-m above, but it needs to be built in.
+iwlcore-objs += $(iwlcore-m)
+
 CFLAGS_iwl-devtrace.o := -I$(src)
 
 # AGN
 obj-$(CONFIG_IWLAGN)    += iwlagn.o
-iwlagn-objs             := iwl-agn.o iwl-agn-rs.o iwl-agn-led.o iwl-agn-ict.o
-iwlagn-objs             += iwl-agn-ucode.o iwl-agn-hcmd.o iwl-agn-tx.o
+iwlagn-objs             := iwl-agn.o iwl-agn-rs.o iwl-agn-led.o
+iwlagn-objs             += iwl-agn-ucode.o iwl-agn-tx.o
 iwlagn-objs             += iwl-agn-lib.o iwl-agn-rx.o iwl-agn-calib.o
 iwlagn-objs             += iwl-agn-tt.o iwl-agn-sta.o iwl-agn-eeprom.o
 iwlagn-$(CONFIG_IWLWIFI_DEBUGFS) += iwl-agn-debugfs.o
 
 iwlagn-$(CONFIG_IWL4965) += iwl-4965.o
+iwlagn-$(CONFIG_IWL5000) += iwl-agn-rxon.o iwl-agn-hcmd.o iwl-agn-ict.o
 iwlagn-$(CONFIG_IWL5000) += iwl-5000.o
 iwlagn-$(CONFIG_IWL5000) += iwl-6000.o
 iwlagn-$(CONFIG_IWL5000) += iwl-1000.o
diff --git a/drivers/net/wireless/iwlwifi/iwl-1000.c b/drivers/net/wireless/iwlwifi/iwl-1000.c
index db540910b11..3100a72b9b4 100644
--- a/drivers/net/wireless/iwlwifi/iwl-1000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
@@ -211,14 +211,16 @@ static struct iwl_lib_ops iwl1000_lib = {
                 .calib_version  = iwlagn_eeprom_calib_version,
                 .query_addr = iwlagn_eeprom_query_addr,
         },
-        .post_associate = iwl_post_associate,
-        .isr = iwl_isr_ict,
-        .config_ap = iwl_config_ap,
+        .isr_ops = {
+                .isr = iwl_isr_ict,
+                .free = iwl_free_isr_ict,
+                .alloc = iwl_alloc_isr_ict,
+                .reset = iwl_reset_ict,
+                .disable = iwl_disable_ict,
+        },
         .temp_ops = {
                 .temperature = iwlagn_temperature,
          },
-        .manage_ibss_station = iwlagn_manage_ibss_station,
-        .update_bcast_stations = iwl_update_bcast_stations,
         .debugfs_ops = {
                 .rx_stats_read = iwl_ucode_rx_stats_read,
                 .tx_stats_read = iwl_ucode_tx_stats_read,
@@ -243,6 +245,7 @@ static const struct iwl_ops iwl1000_ops = {
         .hcmd = &iwlagn_hcmd,
         .utils = &iwlagn_hcmd_utils,
         .led = &iwlagn_led_ops,
+        .ieee80211_ops = &iwlagn_hw_ops,
 };
 
 static struct iwl_base_params iwl1000_base_params = {
@@ -275,7 +278,6 @@ struct iwl_cfg iwl1000_bgn_cfg = {
         .fw_name_pre = IWL1000_FW_PRE,
         .ucode_api_max = IWL1000_UCODE_API_MAX,
         .ucode_api_min = IWL1000_UCODE_API_MIN,
-        .sku = IWL_SKU_G|IWL_SKU_N,
         .valid_tx_ant = ANT_A,
         .valid_rx_ant = ANT_AB,
         .eeprom_ver = EEPROM_1000_EEPROM_VERSION,
@@ -284,6 +286,7 @@ struct iwl_cfg iwl1000_bgn_cfg = {
         .mod_params = &iwlagn_mod_params,
         .base_params = &iwl1000_base_params,
         .ht_params = &iwl1000_ht_params,
+        .led_mode = IWL_LED_BLINK,
 };
 
 struct iwl_cfg iwl1000_bg_cfg = {
@@ -291,7 +294,6 @@ struct iwl_cfg iwl1000_bg_cfg = {
         .fw_name_pre = IWL1000_FW_PRE,
         .ucode_api_max = IWL1000_UCODE_API_MAX,
         .ucode_api_min = IWL1000_UCODE_API_MIN,
-        .sku = IWL_SKU_G,
         .valid_tx_ant = ANT_A,
         .valid_rx_ant = ANT_AB,
         .eeprom_ver = EEPROM_1000_EEPROM_VERSION,
@@ -299,6 +301,7 @@ struct iwl_cfg iwl1000_bg_cfg = {
         .ops = &iwl1000_ops,
         .mod_params = &iwlagn_mod_params,
         .base_params = &iwl1000_base_params,
+        .led_mode = IWL_LED_BLINK,
 };
 
 struct iwl_cfg iwl100_bgn_cfg = {
@@ -306,7 +309,6 @@ struct iwl_cfg iwl100_bgn_cfg = {
         .fw_name_pre = IWL100_FW_PRE,
         .ucode_api_max = IWL100_UCODE_API_MAX,
         .ucode_api_min = IWL100_UCODE_API_MIN,
-        .sku = IWL_SKU_G|IWL_SKU_N,
         .valid_tx_ant = ANT_A,
         .valid_rx_ant = ANT_A,
         .eeprom_ver = EEPROM_1000_EEPROM_VERSION,
@@ -315,6 +317,7 @@ struct iwl_cfg iwl100_bgn_cfg = {
         .mod_params = &iwlagn_mod_params,
         .base_params = &iwl1000_base_params,
         .ht_params = &iwl1000_ht_params,
+        .led_mode = IWL_LED_RF_STATE,
 };
 
 struct iwl_cfg iwl100_bg_cfg = {
@@ -322,7 +325,6 @@ struct iwl_cfg iwl100_bg_cfg = {
         .fw_name_pre = IWL100_FW_PRE,
         .ucode_api_max = IWL100_UCODE_API_MAX,
         .ucode_api_min = IWL100_UCODE_API_MIN,
-        .sku = IWL_SKU_G,
         .valid_tx_ant = ANT_A,
         .valid_rx_ant = ANT_A,
         .eeprom_ver = EEPROM_1000_EEPROM_VERSION,
@@ -330,6 +332,7 @@ struct iwl_cfg iwl100_bg_cfg = {
         .ops = &iwl1000_ops,
         .mod_params = &iwlagn_mod_params,
         .base_params = &iwl1000_base_params,
+        .led_mode = IWL_LED_RF_STATE,
 };
 
 MODULE_FIRMWARE(IWL1000_MODULE_FIRMWARE(IWL1000_UCODE_API_MAX));
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
index 176e5257767..d39f449a9bb 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
@@ -51,6 +51,7 @@
 #include "iwl-led.h"
 #include "iwl-3945-led.h"
 #include "iwl-3945-debugfs.h"
+#include "iwl-legacy.h"
 
 #define IWL_DECLARE_RATE_INFO(r, ip, in, rp, rn, pp, np)    \
         [IWL_RATE_##r##M_INDEX] = { IWL_RATE_##r##M_PLCP,   \
@@ -115,7 +116,7 @@ void iwl3945_disable_events(struct iwl_priv *priv)
         u32 base;               /* SRAM address of event log header */
         u32 disable_ptr;        /* SRAM address of event-disable bitmap array */
         u32 array_size;         /* # of u32 entries in array */
-        u32 evt_disable[IWL_EVT_DISABLE_SIZE] = {
+        static const u32 evt_disable[IWL_EVT_DISABLE_SIZE] = {
                 0x00000000,     /*   31 -    0  Event id numbers */
                 0x00000000,     /*   63 -   32 */
                 0x00000000,     /*   95 -   64 */
@@ -296,7 +297,7 @@ static void iwl3945_tx_queue_reclaim(struct iwl_priv *priv,
         if (iwl_queue_space(q) > q->low_mark && (txq_id >= 0) &&
                         (txq_id != IWL39_CMD_QUEUE_NUM) &&
                         priv->mac80211_registered)
-                iwl_wake_queue(priv, txq_id);
+                iwl_wake_queue(priv, txq);
 }
 
 /**
@@ -1451,6 +1452,10 @@ static int iwl3945_send_tx_power(struct iwl_priv *priv)
         };
         u16 chan;
 
+        if (WARN_ONCE(test_bit(STATUS_SCAN_HW, &priv->status),
+                      "TX Power requested while scanning!\n"))
+                return -EAGAIN;
+
         chan = le16_to_cpu(priv->contexts[IWL_RXON_CTX_BSS].active.channel);
 
         txpower.band = (priv->band == IEEE80211_BAND_5GHZ) ? 0 : 1;
@@ -2722,10 +2727,9 @@ static struct iwl_lib_ops iwl3945_lib = {
         },
         .send_tx_power  = iwl3945_send_tx_power,
         .is_valid_rtc_data_addr = iwl3945_hw_valid_rtc_data_addr,
-        .post_associate = iwl3945_post_associate,
-        .isr = iwl_isr_legacy,
-        .config_ap = iwl3945_config_ap,
-        .manage_ibss_station = iwl3945_manage_ibss_station,
+        .isr_ops = {
+                .isr = iwl_isr_legacy,
+        },
         .recover_from_tx_stall = iwl_bg_monitor_recover,
         .check_plcp_health = iwl3945_good_plcp_health,
 
@@ -2736,10 +2740,16 @@ static struct iwl_lib_ops iwl3945_lib = {
         },
 };
 
+static const struct iwl_legacy_ops iwl3945_legacy_ops = {
+        .post_associate = iwl3945_post_associate,
+        .config_ap = iwl3945_config_ap,
+        .manage_ibss_station = iwl3945_manage_ibss_station,
+};
+
 static struct iwl_hcmd_utils_ops iwl3945_hcmd_utils = {
         .get_hcmd_size = iwl3945_get_hcmd_size,
         .build_addsta_hcmd = iwl3945_build_addsta_hcmd,
-        .tx_cmd_protection = iwlcore_tx_cmd_protection,
+        .tx_cmd_protection = iwl_legacy_tx_cmd_protection,
         .request_scan = iwl3945_request_scan,
         .post_scan = iwl3945_post_scan,
 };
@@ -2749,6 +2759,8 @@ static const struct iwl_ops iwl3945_ops = {
         .hcmd = &iwl3945_hcmd,
         .utils = &iwl3945_hcmd_utils,
         .led = &iwl3945_led_ops,
+        .legacy = &iwl3945_legacy_ops,
+        .ieee80211_ops = &iwl3945_hw_ops,
 };
 
 static struct iwl_base_params iwl3945_base_params = {
@@ -2776,6 +2788,7 @@ static struct iwl_cfg iwl3945_bg_cfg = {
         .ops = &iwl3945_ops,
         .mod_params = &iwl3945_mod_params,
         .base_params = &iwl3945_base_params,
+        .led_mode = IWL_LED_BLINK,
 };
 
 static struct iwl_cfg iwl3945_abg_cfg = {
@@ -2788,6 +2801,7 @@ static struct iwl_cfg iwl3945_abg_cfg = {
         .ops = &iwl3945_ops,
         .mod_params = &iwl3945_mod_params,
         .base_params = &iwl3945_base_params,
+        .led_mode = IWL_LED_BLINK,
 };
 
 DEFINE_PCI_DEVICE_TABLE(iwl3945_hw_card_ids) = {
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.h b/drivers/net/wireless/iwlwifi/iwl-3945.h
index 09391f0ee61..3eef1eb74a7 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.h
@@ -264,10 +264,8 @@ void iwl3945_reply_statistics(struct iwl_priv *priv,
                               struct iwl_rx_mem_buffer *rxb);
 extern void iwl3945_disable_events(struct iwl_priv *priv);
 extern int iwl4965_get_temperature(const struct iwl_priv *priv);
-extern void iwl3945_post_associate(struct iwl_priv *priv,
-                                   struct ieee80211_vif *vif);
-extern void iwl3945_config_ap(struct iwl_priv *priv,
-                              struct ieee80211_vif *vif);
+extern void iwl3945_post_associate(struct iwl_priv *priv);
+extern void iwl3945_config_ap(struct iwl_priv *priv);
 
 extern int iwl3945_commit_rxon(struct iwl_priv *priv,
                                struct iwl_rxon_context *ctx);
@@ -282,6 +280,8 @@ extern int iwl3945_commit_rxon(struct iwl_priv *priv,
  */
 extern u8 iwl3945_hw_find_station(struct iwl_priv *priv, const u8 *bssid);
 
+extern struct ieee80211_ops iwl3945_hw_ops;
+
 /*
  * Forward declare iwl-3945.c functions for iwl-base.c
  */
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
index b207e3e9299..6788ceb3768 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
+++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
@@ -48,6 +48,7 @@
 #include "iwl-agn-led.h"
 #include "iwl-agn.h"
 #include "iwl-agn-debugfs.h"
+#include "iwl-legacy.h"
 
 static int iwl4965_send_tx_power(struct iwl_priv *priv);
 static int iwl4965_hw_get_temperature(struct iwl_priv *priv);
@@ -1377,13 +1378,9 @@ static int iwl4965_send_tx_power(struct iwl_priv *priv)
         u8 ctrl_chan_high = 0;
         struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
 
-        if (test_bit(STATUS_SCANNING, &priv->status)) {
-                /* If this gets hit a lot, switch it to a BUG() and catch
-                 * the stack trace to find out who is calling this during
-                 * a scan. */
-                IWL_WARN(priv, "TX Power requested while scanning!\n");
+        if (WARN_ONCE(test_bit(STATUS_SCAN_HW, &priv->status),
+                      "TX Power requested while scanning!\n"))
                 return -EAGAIN;
-        }
 
         band = priv->band == IEEE80211_BAND_2GHZ;
 
@@ -1447,6 +1444,142 @@ static int iwl4965_send_rxon_assoc(struct iwl_priv *priv,
         return ret;
 }
 
+static int iwl4965_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
+{
+        /* cast away the const for active_rxon in this function */
+        struct iwl_rxon_cmd *active_rxon = (void *)&ctx->active;
+        int ret;
+        bool new_assoc =
+                !!(ctx->staging.filter_flags & RXON_FILTER_ASSOC_MSK);
+
+        if (!iwl_is_alive(priv))
+                return -EBUSY;
+
+        if (!ctx->is_active)
+                return 0;
+
+        /* always get timestamp with Rx frame */
+        ctx->staging.flags |= RXON_FLG_TSF2HOST_MSK;
+
+        ret = iwl_check_rxon_cmd(priv, ctx);
+        if (ret) {
+                IWL_ERR(priv, "Invalid RXON configuration.  Not committing.\n");
+                return -EINVAL;
+        }
+
+        /*
+         * receive commit_rxon request
+         * abort any previous channel switch if still in process
+         */
+        if (priv->switch_rxon.switch_in_progress &&
+            (priv->switch_rxon.channel != ctx->staging.channel)) {
+                IWL_DEBUG_11H(priv, "abort channel switch on %d\n",
+                      le16_to_cpu(priv->switch_rxon.channel));
+                iwl_chswitch_done(priv, false);
+        }
+
+        /* If we don't need to send a full RXON, we can use
+         * iwl_rxon_assoc_cmd which is used to reconfigure filter
+         * and other flags for the current radio configuration. */
+        if (!iwl_full_rxon_required(priv, ctx)) {
+                ret = iwl_send_rxon_assoc(priv, ctx);
+                if (ret) {
+                        IWL_ERR(priv, "Error setting RXON_ASSOC (%d)\n", ret);
+                        return ret;
+                }
+
+                memcpy(active_rxon, &ctx->staging, sizeof(*active_rxon));
+                iwl_print_rx_config_cmd(priv, ctx);
+                return 0;
+        }
+
+        /* If we are currently associated and the new config requires
+         * an RXON_ASSOC and the new config wants the associated mask enabled,
+         * we must clear the associated from the active configuration
+         * before we apply the new config */
+        if (iwl_is_associated_ctx(ctx) && new_assoc) {
+                IWL_DEBUG_INFO(priv, "Toggling associated bit on current RXON\n");
+                active_rxon->filter_flags &= ~RXON_FILTER_ASSOC_MSK;
+
+                ret = iwl_send_cmd_pdu(priv, ctx->rxon_cmd,
+                                       sizeof(struct iwl_rxon_cmd),
+                                       active_rxon);
+
+                /* If the mask clearing failed then we set
+                 * active_rxon back to what it was previously */
+                if (ret) {
+                        active_rxon->filter_flags |= RXON_FILTER_ASSOC_MSK;
+                        IWL_ERR(priv, "Error clearing ASSOC_MSK (%d)\n", ret);
+                        return ret;
+                }
+                iwl_clear_ucode_stations(priv, ctx);
+                iwl_restore_stations(priv, ctx);
+                ret = iwl_restore_default_wep_keys(priv, ctx);
+                if (ret) {
+                        IWL_ERR(priv, "Failed to restore WEP keys (%d)\n", ret);
+                        return ret;
+                }
+        }
+
+        IWL_DEBUG_INFO(priv, "Sending RXON\n"
+                       "* with%s RXON_FILTER_ASSOC_MSK\n"
+                       "* channel = %d\n"
+                       "* bssid = %pM\n",
+                       (new_assoc ? "" : "out"),
+                       le16_to_cpu(ctx->staging.channel),
+                       ctx->staging.bssid_addr);
+
+        iwl_set_rxon_hwcrypto(priv, ctx, !priv->cfg->mod_params->sw_crypto);
+
+        /* Apply the new configuration
+         * RXON unassoc clears the station table in uCode so restoration of
+         * stations is needed after it (the RXON command) completes
+         */
+        if (!new_assoc) {
+                ret = iwl_send_cmd_pdu(priv, ctx->rxon_cmd,
+                              sizeof(struct iwl_rxon_cmd), &ctx->staging);
+                if (ret) {
+                        IWL_ERR(priv, "Error setting new RXON (%d)\n", ret);
+                        return ret;
+                }
+                IWL_DEBUG_INFO(priv, "Return from !new_assoc RXON.\n");
+                memcpy(active_rxon, &ctx->staging, sizeof(*active_rxon));
+                iwl_clear_ucode_stations(priv, ctx);
+                iwl_restore_stations(priv, ctx);
+                ret = iwl_restore_default_wep_keys(priv, ctx);
+                if (ret) {
+                        IWL_ERR(priv, "Failed to restore WEP keys (%d)\n", ret);
+                        return ret;
+                }
+        }
+        if (new_assoc) {
+                priv->start_calib = 0;
+                /* Apply the new configuration
+                 * RXON assoc doesn't clear the station table in uCode,
+                 */
+                ret = iwl_send_cmd_pdu(priv, ctx->rxon_cmd,
+                              sizeof(struct iwl_rxon_cmd), &ctx->staging);
+                if (ret) {
+                        IWL_ERR(priv, "Error setting new RXON (%d)\n", ret);
+                        return ret;
+                }
+                memcpy(active_rxon, &ctx->staging, sizeof(*active_rxon));
+        }
+        iwl_print_rx_config_cmd(priv, ctx);
+
+        iwl_init_sensitivity(priv);
+
+        /* If we issue a new RXON command which required a tune then we must
+         * send a new TXPOWER command or we won't be able to Tx any frames */
+        ret = iwl_set_tx_power(priv, priv->tx_power_user_lmt, true);
+        if (ret) {
+                IWL_ERR(priv, "Error sending TX power (%d)\n", ret);
+                return ret;
+        }
+
+        return 0;
+}
+
 static int iwl4965_hw_channel_switch(struct iwl_priv *priv,
                                      struct ieee80211_channel_switch *ch_switch)
 {
@@ -1554,22 +1687,6 @@ static void iwl4965_txq_update_byte_cnt_tbl(struct iwl_priv *priv,
 }
 
 /**
- * sign_extend - Sign extend a value using specified bit as sign-bit
- *
- * Example: sign_extend(9, 3) would return -7 as bit3 of 1001b is 1
- * and bit0..2 is 001b which when sign extended to 1111111111111001b is -7.
- *
- * @param oper value to sign extend
- * @param index 0 based bit index (0<=index<32) to sign bit
- */
-static s32 sign_extend(u32 oper, int index)
-{
-        u8 shift = 31 - index;
-
-        return (s32)(oper << shift) >> shift;
-}
-
-/**
  * iwl4965_hw_get_temperature - return the calibrated temperature (in Kelvin)
  * @statistics: Provides the temperature reading from the uCode
  *
@@ -1606,9 +1723,9 @@ static int iwl4965_hw_get_temperature(struct iwl_priv *priv)
          * "initialize" ALIVE response.
          */
         if (!test_bit(STATUS_TEMPERATURE, &priv->status))
-                vt = sign_extend(R4, 23);
+                vt = sign_extend32(R4, 23);
         else
-                vt = sign_extend(le32_to_cpu(priv->_agn.statistics.
+                vt = sign_extend32(le32_to_cpu(priv->_agn.statistics.
                                  general.common.temperature), 23);
 
         IWL_DEBUG_TEMP(priv, "Calib values R[1-3]: %d %d %d R4: %d\n", R1, R2, R3, vt);
@@ -2121,12 +2238,8 @@ static void iwl4965_rx_reply_tx(struct iwl_priv *priv,
 
                         if (priv->mac80211_registered &&
                             (iwl_queue_space(&txq->q) > txq->q.low_mark) &&
-                            (agg->state != IWL_EMPTYING_HW_QUEUE_DELBA)) {
-                                if (agg->state == IWL_AGG_OFF)
-                                        iwl_wake_queue(priv, txq_id);
-                                else
-                                        iwl_wake_queue(priv, txq->swq_id);
-                        }
+                            (agg->state != IWL_EMPTYING_HW_QUEUE_DELBA))
+                                iwl_wake_queue(priv, txq);
                 }
         } else {
                 info->status.rates[0].count = tx_resp->failure_frame + 1;
@@ -2150,7 +2263,7 @@ static void iwl4965_rx_reply_tx(struct iwl_priv *priv,
 
                 if (priv->mac80211_registered &&
                     (iwl_queue_space(&txq->q) > txq->q.low_mark))
-                        iwl_wake_queue(priv, txq_id);
+                        iwl_wake_queue(priv, txq);
         }
         if (qc && likely(sta_id != IWL_INVALID_STATION))
                 iwlagn_txq_check_empty(priv, sta_id, tid, txq_id);
@@ -2216,7 +2329,7 @@ static void iwl4965_cancel_deferred_work(struct iwl_priv *priv)
 
 static struct iwl_hcmd_ops iwl4965_hcmd = {
         .rxon_assoc = iwl4965_send_rxon_assoc,
-        .commit_rxon = iwlagn_commit_rxon,
+        .commit_rxon = iwl4965_commit_rxon,
         .set_rxon_chain = iwlagn_set_rxon_chain,
         .send_bt_config = iwl_send_bt_config,
 };
@@ -2233,12 +2346,155 @@ static void iwl4965_post_scan(struct iwl_priv *priv)
                 iwlcore_commit_rxon(priv, ctx);
 }
 
+static void iwl4965_post_associate(struct iwl_priv *priv)
+{
+        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
+        struct ieee80211_vif *vif = ctx->vif;
+        struct ieee80211_conf *conf = NULL;
+        int ret = 0;
+
+        if (!vif || !priv->is_open)
+                return;
+
+        if (vif->type == NL80211_IFTYPE_AP) {
+                IWL_ERR(priv, "%s Should not be called in AP mode\n", __func__);
+                return;
+        }
+
+        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+                return;
+
+        iwl_scan_cancel_timeout(priv, 200);
+
+        conf = ieee80211_get_hw_conf(priv->hw);
+
+        ctx->staging.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
+        iwlcore_commit_rxon(priv, ctx);
+
+        ret = iwl_send_rxon_timing(priv, ctx);
+        if (ret)
+                IWL_WARN(priv, "RXON timing - "
+                            "Attempting to continue.\n");
+
+        ctx->staging.filter_flags |= RXON_FILTER_ASSOC_MSK;
+
+        iwl_set_rxon_ht(priv, &priv->current_ht_config);
+
+        if (priv->cfg->ops->hcmd->set_rxon_chain)
+                priv->cfg->ops->hcmd->set_rxon_chain(priv, ctx);
+
+        ctx->staging.assoc_id = cpu_to_le16(vif->bss_conf.aid);
+
+        IWL_DEBUG_ASSOC(priv, "assoc id %d beacon interval %d\n",
+                        vif->bss_conf.aid, vif->bss_conf.beacon_int);
+
+        if (vif->bss_conf.use_short_preamble)
+                ctx->staging.flags |= RXON_FLG_SHORT_PREAMBLE_MSK;
+        else
+                ctx->staging.flags &= ~RXON_FLG_SHORT_PREAMBLE_MSK;
+
+        if (ctx->staging.flags & RXON_FLG_BAND_24G_MSK) {
+                if (vif->bss_conf.use_short_slot)
+                        ctx->staging.flags |= RXON_FLG_SHORT_SLOT_MSK;
+                else
+                        ctx->staging.flags &= ~RXON_FLG_SHORT_SLOT_MSK;
+        }
+
+        iwlcore_commit_rxon(priv, ctx);
+
+        IWL_DEBUG_ASSOC(priv, "Associated as %d to: %pM\n",
+                        vif->bss_conf.aid, ctx->active.bssid_addr);
+
+        switch (vif->type) {
+        case NL80211_IFTYPE_STATION:
+                break;
+        case NL80211_IFTYPE_ADHOC:
+                iwlagn_send_beacon_cmd(priv);
+                break;
+        default:
+                IWL_ERR(priv, "%s Should not be called in %d mode\n",
+                          __func__, vif->type);
+                break;
+        }
+
+        /* the chain noise calibration will enabled PM upon completion
+         * If chain noise has already been run, then we need to enable
+         * power management here */
+        if (priv->chain_noise_data.state == IWL_CHAIN_NOISE_DONE)
+                iwl_power_update_mode(priv, false);
+
+        /* Enable Rx differential gain and sensitivity calibrations */
+        iwl_chain_noise_reset(priv);
+        priv->start_calib = 1;
+}
+
+static void iwl4965_config_ap(struct iwl_priv *priv)
+{
+        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
+        struct ieee80211_vif *vif = ctx->vif;
+        int ret = 0;
+
+        lockdep_assert_held(&priv->mutex);
+
+        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+                return;
+
+        /* The following should be done only at AP bring up */
+        if (!iwl_is_associated_ctx(ctx)) {
+
+                /* RXON - unassoc (to set timing command) */
+                ctx->staging.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
+                iwlcore_commit_rxon(priv, ctx);
+
+                /* RXON Timing */
+                ret = iwl_send_rxon_timing(priv, ctx);
+                if (ret)
+                        IWL_WARN(priv, "RXON timing failed - "
+                                        "Attempting to continue.\n");
+
+                /* AP has all antennas */
+                priv->chain_noise_data.active_chains =
+                        priv->hw_params.valid_rx_ant;
+                iwl_set_rxon_ht(priv, &priv->current_ht_config);
+                if (priv->cfg->ops->hcmd->set_rxon_chain)
+                        priv->cfg->ops->hcmd->set_rxon_chain(priv, ctx);
+
+                ctx->staging.assoc_id = 0;
+
+                if (vif->bss_conf.use_short_preamble)
+                        ctx->staging.flags |=
+                                RXON_FLG_SHORT_PREAMBLE_MSK;
+                else
+                        ctx->staging.flags &=
+                                ~RXON_FLG_SHORT_PREAMBLE_MSK;
+
+                if (ctx->staging.flags & RXON_FLG_BAND_24G_MSK) {
+                        if (vif->bss_conf.use_short_slot)
+                                ctx->staging.flags |=
+                                        RXON_FLG_SHORT_SLOT_MSK;
+                        else
+                                ctx->staging.flags &=
+                                        ~RXON_FLG_SHORT_SLOT_MSK;
+                }
+                /* need to send beacon cmd before committing assoc RXON! */
+                iwlagn_send_beacon_cmd(priv);
+                /* restore RXON assoc */
+                ctx->staging.filter_flags |= RXON_FILTER_ASSOC_MSK;
+                iwlcore_commit_rxon(priv, ctx);
+        }
+        iwlagn_send_beacon_cmd(priv);
+
+        /* FIXME - we need to add code here to detect a totally new
+         * configuration, reset the AP, unassoc, rxon timing, assoc,
+         * clear sta table, add BCAST sta... */
+}
+
 static struct iwl_hcmd_utils_ops iwl4965_hcmd_utils = {
         .get_hcmd_size = iwl4965_get_hcmd_size,
         .build_addsta_hcmd = iwl4965_build_addsta_hcmd,
         .chain_noise_reset = iwl4965_chain_noise_reset,
         .gain_computation = iwl4965_gain_computation,
-        .tx_cmd_protection = iwlcore_tx_cmd_protection,
+        .tx_cmd_protection = iwl_legacy_tx_cmd_protection,
         .calc_rssi = iwl4965_calc_rssi,
         .request_scan = iwlagn_request_scan,
         .post_scan = iwl4965_post_scan,
@@ -2285,14 +2541,12 @@ static struct iwl_lib_ops iwl4965_lib = {
         },
         .send_tx_power  = iwl4965_send_tx_power,
         .update_chain_flags = iwl_update_chain_flags,
-        .post_associate = iwl_post_associate,
-        .config_ap = iwl_config_ap,
-        .isr = iwl_isr_legacy,
+        .isr_ops = {
+                .isr = iwl_isr_legacy,
+        },
         .temp_ops = {
                 .temperature = iwl4965_temperature_calib,
         },
-        .manage_ibss_station = iwlagn_manage_ibss_station,
-        .update_bcast_stations = iwl_update_bcast_stations,
         .debugfs_ops = {
                 .rx_stats_read = iwl_ucode_rx_stats_read,
                 .tx_stats_read = iwl_ucode_tx_stats_read,
@@ -2304,11 +2558,43 @@ static struct iwl_lib_ops iwl4965_lib = {
         .check_plcp_health = iwl_good_plcp_health,
 };
 
+static const struct iwl_legacy_ops iwl4965_legacy_ops = {
+        .post_associate = iwl4965_post_associate,
+        .config_ap = iwl4965_config_ap,
+        .manage_ibss_station = iwlagn_manage_ibss_station,
+        .update_bcast_stations = iwl_update_bcast_stations,
+};
+
+struct ieee80211_ops iwl4965_hw_ops = {
+        .tx = iwlagn_mac_tx,
+        .start = iwlagn_mac_start,
+        .stop = iwlagn_mac_stop,
+        .add_interface = iwl_mac_add_interface,
+        .remove_interface = iwl_mac_remove_interface,
+        .change_interface = iwl_mac_change_interface,
+        .config = iwl_legacy_mac_config,
+        .configure_filter = iwlagn_configure_filter,
+        .set_key = iwlagn_mac_set_key,
+        .update_tkip_key = iwlagn_mac_update_tkip_key,
+        .conf_tx = iwl_mac_conf_tx,
+        .reset_tsf = iwl_legacy_mac_reset_tsf,
+        .bss_info_changed = iwl_legacy_mac_bss_info_changed,
+        .ampdu_action = iwlagn_mac_ampdu_action,
+        .hw_scan = iwl_mac_hw_scan,
+        .sta_add = iwlagn_mac_sta_add,
+        .sta_remove = iwl_mac_sta_remove,
+        .channel_switch = iwlagn_mac_channel_switch,
+        .flush = iwlagn_mac_flush,
+        .tx_last_beacon = iwl_mac_tx_last_beacon,
+};
+
 static const struct iwl_ops iwl4965_ops = {
         .lib = &iwl4965_lib,
         .hcmd = &iwl4965_hcmd,
         .utils = &iwl4965_hcmd_utils,
         .led = &iwlagn_led_ops,
+        .legacy = &iwl4965_legacy_ops,
+        .ieee80211_ops = &iwl4965_hw_ops,
 };
 
 static struct iwl_base_params iwl4965_base_params = {
@@ -2330,6 +2616,7 @@ static struct iwl_base_params iwl4965_base_params = {
         .ucode_tracing = true,
         .sensitivity_calib_by_driver = true,
         .chain_noise_calib_by_driver = true,
+        .no_agg_framecnt_info = true,
 };
 
 struct iwl_cfg iwl4965_agn_cfg = {
@@ -2337,7 +2624,6 @@ struct iwl_cfg iwl4965_agn_cfg = {
         .fw_name_pre = IWL4965_FW_PRE,
         .ucode_api_max = IWL4965_UCODE_API_MAX,
         .ucode_api_min = IWL4965_UCODE_API_MIN,
-        .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
         .valid_tx_ant = ANT_AB,
         .valid_rx_ant = ANT_ABC,
         .eeprom_ver = EEPROM_4965_EEPROM_VERSION,
@@ -2345,6 +2631,7 @@ struct iwl_cfg iwl4965_agn_cfg = {
         .ops = &iwl4965_ops,
         .mod_params = &iwlagn_mod_params,
         .base_params = &iwl4965_base_params,
+        .led_mode = IWL_LED_BLINK,
         /*
          * Force use of chains B and C for scan RX on 5 GHz band
          * because the device has off-channel reception on chain A.
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index fd9fbc93ea1..3ee0f7c035c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -385,14 +385,16 @@ static struct iwl_lib_ops iwl5000_lib = {
                 .calib_version  = iwlagn_eeprom_calib_version,
                 .query_addr = iwlagn_eeprom_query_addr,
         },
-        .post_associate = iwl_post_associate,
-        .isr = iwl_isr_ict,
-        .config_ap = iwl_config_ap,
+        .isr_ops = {
+                .isr = iwl_isr_ict,
+                .free = iwl_free_isr_ict,
+                .alloc = iwl_alloc_isr_ict,
+                .reset = iwl_reset_ict,
+                .disable = iwl_disable_ict,
+        },
         .temp_ops = {
                 .temperature = iwlagn_temperature,
          },
-        .manage_ibss_station = iwlagn_manage_ibss_station,
-        .update_bcast_stations = iwl_update_bcast_stations,
         .debugfs_ops = {
                 .rx_stats_read = iwl_ucode_rx_stats_read,
                 .tx_stats_read = iwl_ucode_tx_stats_read,
@@ -453,14 +455,16 @@ static struct iwl_lib_ops iwl5150_lib = {
                 .calib_version  = iwlagn_eeprom_calib_version,
                 .query_addr = iwlagn_eeprom_query_addr,
         },
-        .post_associate = iwl_post_associate,
-        .isr = iwl_isr_ict,
-        .config_ap = iwl_config_ap,
+        .isr_ops = {
+                .isr = iwl_isr_ict,
+                .free = iwl_free_isr_ict,
+                .alloc = iwl_alloc_isr_ict,
+                .reset = iwl_reset_ict,
+                .disable = iwl_disable_ict,
+        },
         .temp_ops = {
                 .temperature = iwl5150_temperature,
          },
-        .manage_ibss_station = iwlagn_manage_ibss_station,
-        .update_bcast_stations = iwl_update_bcast_stations,
         .debugfs_ops = {
                 .rx_stats_read = iwl_ucode_rx_stats_read,
                 .tx_stats_read = iwl_ucode_tx_stats_read,
@@ -485,6 +489,7 @@ static const struct iwl_ops iwl5000_ops = {
         .hcmd = &iwlagn_hcmd,
         .utils = &iwlagn_hcmd_utils,
         .led = &iwlagn_led_ops,
+        .ieee80211_ops = &iwlagn_hw_ops,
 };
 
 static const struct iwl_ops iwl5150_ops = {
@@ -492,6 +497,7 @@ static const struct iwl_ops iwl5150_ops = {
         .hcmd = &iwlagn_hcmd,
         .utils = &iwlagn_hcmd_utils,
         .led = &iwlagn_led_ops,
+        .ieee80211_ops = &iwlagn_hw_ops,
 };
 
 static struct iwl_base_params iwl5000_base_params = {
@@ -521,7 +527,6 @@ struct iwl_cfg iwl5300_agn_cfg = {
         .fw_name_pre = IWL5000_FW_PRE,
         .ucode_api_max = IWL5000_UCODE_API_MAX,
         .ucode_api_min = IWL5000_UCODE_API_MIN,
-        .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
         .valid_tx_ant = ANT_ABC,
         .valid_rx_ant = ANT_ABC,
         .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
@@ -530,6 +535,7 @@ struct iwl_cfg iwl5300_agn_cfg = {
         .mod_params = &iwlagn_mod_params,
         .base_params = &iwl5000_base_params,
         .ht_params = &iwl5000_ht_params,
+        .led_mode = IWL_LED_BLINK,
 };
 
 struct iwl_cfg iwl5100_bgn_cfg = {
@@ -537,7 +543,6 @@ struct iwl_cfg iwl5100_bgn_cfg = {
         .fw_name_pre = IWL5000_FW_PRE,
         .ucode_api_max = IWL5000_UCODE_API_MAX,
         .ucode_api_min = IWL5000_UCODE_API_MIN,
-        .sku = IWL_SKU_G|IWL_SKU_N,
         .valid_tx_ant = ANT_B,
         .valid_rx_ant = ANT_AB,
         .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
@@ -546,6 +551,7 @@ struct iwl_cfg iwl5100_bgn_cfg = {
         .mod_params = &iwlagn_mod_params,
         .base_params = &iwl5000_base_params,
         .ht_params = &iwl5000_ht_params,
+        .led_mode = IWL_LED_BLINK,
 };
 
 struct iwl_cfg iwl5100_abg_cfg = {
@@ -553,7 +559,6 @@ struct iwl_cfg iwl5100_abg_cfg = {
         .fw_name_pre = IWL5000_FW_PRE,
         .ucode_api_max = IWL5000_UCODE_API_MAX,
         .ucode_api_min = IWL5000_UCODE_API_MIN,
-        .sku = IWL_SKU_A|IWL_SKU_G,
         .valid_tx_ant = ANT_B,
         .valid_rx_ant = ANT_AB,
         .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
@@ -561,6 +566,7 @@ struct iwl_cfg iwl5100_abg_cfg = {
         .ops = &iwl5000_ops,
         .mod_params = &iwlagn_mod_params,
         .base_params = &iwl5000_base_params,
+        .led_mode = IWL_LED_BLINK,
 };
 
 struct iwl_cfg iwl5100_agn_cfg = {
@@ -568,7 +574,6 @@ struct iwl_cfg iwl5100_agn_cfg = {
         .fw_name_pre = IWL5000_FW_PRE,
         .ucode_api_max = IWL5000_UCODE_API_MAX,
         .ucode_api_min = IWL5000_UCODE_API_MIN,
-        .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
         .valid_tx_ant = ANT_B,
         .valid_rx_ant = ANT_AB,
         .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
@@ -577,6 +582,7 @@ struct iwl_cfg iwl5100_agn_cfg = {
         .mod_params = &iwlagn_mod_params,
         .base_params = &iwl5000_base_params,
         .ht_params = &iwl5000_ht_params,
+        .led_mode = IWL_LED_BLINK,
 };
 
 struct iwl_cfg iwl5350_agn_cfg = {
@@ -584,7 +590,6 @@ struct iwl_cfg iwl5350_agn_cfg = {
         .fw_name_pre = IWL5000_FW_PRE,
         .ucode_api_max = IWL5000_UCODE_API_MAX,
         .ucode_api_min = IWL5000_UCODE_API_MIN,
-        .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
         .valid_tx_ant = ANT_ABC,
         .valid_rx_ant = ANT_ABC,
         .eeprom_ver = EEPROM_5050_EEPROM_VERSION,
@@ -593,6 +598,7 @@ struct iwl_cfg iwl5350_agn_cfg = {
         .mod_params = &iwlagn_mod_params,
         .base_params = &iwl5000_base_params,
         .ht_params = &iwl5000_ht_params,
+        .led_mode = IWL_LED_BLINK,
 };
 
 struct iwl_cfg iwl5150_agn_cfg = {
@@ -600,7 +606,6 @@ struct iwl_cfg iwl5150_agn_cfg = {
         .fw_name_pre = IWL5150_FW_PRE,
         .ucode_api_max = IWL5150_UCODE_API_MAX,
         .ucode_api_min = IWL5150_UCODE_API_MIN,
-        .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
         .valid_tx_ant = ANT_A,
         .valid_rx_ant = ANT_AB,
         .eeprom_ver = EEPROM_5050_EEPROM_VERSION,
@@ -610,6 +615,7 @@ struct iwl_cfg iwl5150_agn_cfg = {
         .base_params = &iwl5000_base_params,
         .ht_params = &iwl5000_ht_params,
         .need_dc_calib = true,
+        .led_mode = IWL_LED_BLINK,
 };
 
 struct iwl_cfg iwl5150_abg_cfg = {
@@ -617,7 +623,6 @@ struct iwl_cfg iwl5150_abg_cfg = {
         .fw_name_pre = IWL5150_FW_PRE,
         .ucode_api_max = IWL5150_UCODE_API_MAX,
         .ucode_api_min = IWL5150_UCODE_API_MIN,
-        .sku = IWL_SKU_A|IWL_SKU_G,
         .valid_tx_ant = ANT_A,
         .valid_rx_ant = ANT_AB,
         .eeprom_ver = EEPROM_5050_EEPROM_VERSION,
@@ -626,6 +631,7 @@ struct iwl_cfg iwl5150_abg_cfg = {
         .mod_params = &iwlagn_mod_params,
         .base_params = &iwl5000_base_params,
         .need_dc_calib = true,
+        .led_mode = IWL_LED_BLINK,
 };
 
 MODULE_FIRMWARE(IWL5000_MODULE_FIRMWARE(IWL5000_UCODE_API_MAX));
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index 11e6532fc57..93e3fe92f38 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -53,13 +53,11 @@
 #define IWL6000_UCODE_API_MAX 4
 #define IWL6050_UCODE_API_MAX 5
 #define IWL6000G2_UCODE_API_MAX 5
-#define IWL130_UCODE_API_MAX 5
 
 /* Lowest firmware API version supported */
 #define IWL6000_UCODE_API_MIN 4
 #define IWL6050_UCODE_API_MIN 4
 #define IWL6000G2_UCODE_API_MIN 4
-#define IWL130_UCODE_API_MIN 5
 
 #define IWL6000_FW_PRE "iwlwifi-6000-"
 #define _IWL6000_MODULE_FIRMWARE(api) IWL6000_FW_PRE #api ".ucode"
@@ -77,10 +75,6 @@
 #define _IWL6000G2B_MODULE_FIRMWARE(api) IWL6000G2B_FW_PRE #api ".ucode"
 #define IWL6000G2B_MODULE_FIRMWARE(api) _IWL6000G2B_MODULE_FIRMWARE(api)
 
-#define IWL130_FW_PRE "iwlwifi-130-"
-#define _IWL130_MODULE_FIRMWARE(api) IWL130_FW_PRE #api ".ucode"
-#define IWL130_MODULE_FIRMWARE(api) _IWL130_MODULE_FIRMWARE(api)
-
 static void iwl6000_set_ct_threshold(struct iwl_priv *priv)
 {
         /* want Celsius */
@@ -328,14 +322,16 @@ static struct iwl_lib_ops iwl6000_lib = {
                 .query_addr = iwlagn_eeprom_query_addr,
                 .update_enhanced_txpower = iwlcore_eeprom_enhanced_txpower,
         },
-        .post_associate = iwl_post_associate,
-        .isr = iwl_isr_ict,
-        .config_ap = iwl_config_ap,
+        .isr_ops = {
+                .isr = iwl_isr_ict,
+                .free = iwl_free_isr_ict,
+                .alloc = iwl_alloc_isr_ict,
+                .reset = iwl_reset_ict,
+                .disable = iwl_disable_ict,
+        },
         .temp_ops = {
                 .temperature = iwlagn_temperature,
          },
-        .manage_ibss_station = iwlagn_manage_ibss_station,
-        .update_bcast_stations = iwl_update_bcast_stations,
         .debugfs_ops = {
                 .rx_stats_read = iwl_ucode_rx_stats_read,
                 .tx_stats_read = iwl_ucode_tx_stats_read,
@@ -399,14 +395,16 @@ static struct iwl_lib_ops iwl6000g2b_lib = {
                 .query_addr = iwlagn_eeprom_query_addr,
                 .update_enhanced_txpower = iwlcore_eeprom_enhanced_txpower,
         },
-        .post_associate = iwl_post_associate,
-        .isr = iwl_isr_ict,
-        .config_ap = iwl_config_ap,
+        .isr_ops = {
+                .isr = iwl_isr_ict,
+                .free = iwl_free_isr_ict,
+                .alloc = iwl_alloc_isr_ict,
+                .reset = iwl_reset_ict,
+                .disable = iwl_disable_ict,
+        },
         .temp_ops = {
                 .temperature = iwlagn_temperature,
          },
-        .manage_ibss_station = iwlagn_manage_ibss_station,
-        .update_bcast_stations = iwl_update_bcast_stations,
         .debugfs_ops = {
                 .rx_stats_read = iwl_ucode_rx_stats_read,
                 .tx_stats_read = iwl_ucode_tx_stats_read,
@@ -439,6 +437,7 @@ static const struct iwl_ops iwl6000_ops = {
         .hcmd = &iwlagn_hcmd,
         .utils = &iwlagn_hcmd_utils,
         .led = &iwlagn_led_ops,
+        .ieee80211_ops = &iwlagn_hw_ops,
 };
 
 static const struct iwl_ops iwl6050_ops = {
@@ -447,6 +446,7 @@ static const struct iwl_ops iwl6050_ops = {
         .utils = &iwlagn_hcmd_utils,
         .led = &iwlagn_led_ops,
         .nic = &iwl6050_nic_ops,
+        .ieee80211_ops = &iwlagn_hw_ops,
 };
 
 static const struct iwl_ops iwl6050g2_ops = {
@@ -455,6 +455,7 @@ static const struct iwl_ops iwl6050g2_ops = {
         .utils = &iwlagn_hcmd_utils,
         .led = &iwlagn_led_ops,
         .nic = &iwl6050g2_nic_ops,
+        .ieee80211_ops = &iwlagn_hw_ops,
 };
 
 static const struct iwl_ops iwl6000g2b_ops = {
@@ -462,6 +463,7 @@ static const struct iwl_ops iwl6000g2b_ops = {
         .hcmd = &iwlagn_bt_hcmd,
         .utils = &iwlagn_hcmd_utils,
         .led = &iwlagn_led_ops,
+        .ieee80211_ops = &iwlagn_hw_ops,
 };
 
 static struct iwl_base_params iwl6000_base_params = {
@@ -485,6 +487,7 @@ static struct iwl_base_params iwl6000_base_params = {
         .ucode_tracing = true,
         .sensitivity_calib_by_driver = true,
         .chain_noise_calib_by_driver = true,
+        .shadow_reg_enable = true,
 };
 
 static struct iwl_base_params iwl6050_base_params = {
@@ -508,6 +511,7 @@ static struct iwl_base_params iwl6050_base_params = {
         .ucode_tracing = true,
         .sensitivity_calib_by_driver = true,
         .chain_noise_calib_by_driver = true,
+        .shadow_reg_enable = true,
 };
 static struct iwl_base_params iwl6000_coex_base_params = {
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
@@ -530,6 +534,7 @@ static struct iwl_base_params iwl6000_coex_base_params = {
         .ucode_tracing = true,
         .sensitivity_calib_by_driver = true,
         .chain_noise_calib_by_driver = true,
+        .shadow_reg_enable = true,
 };
 
 static struct iwl_ht_params iwl6000_ht_params = {
@@ -541,8 +546,10 @@ static struct iwl_bt_params iwl6000_bt_params = {
         .bt_statistics = true,
         /* Due to bluetooth, we transmit 2.4 GHz probes only on antenna A */
         .advanced_bt_coexist = true,
+        .agg_time_limit = BT_AGG_THRESHOLD_DEF,
         .bt_init_traffic_load = IWL_BT_COEX_TRAFFIC_LOAD_NONE,
         .bt_prio_boost = IWLAGN_BT_PRIO_BOOST_DEFAULT,
+        .bt_sco_disable = true,
 };
 
 struct iwl_cfg iwl6000g2a_2agn_cfg = {
@@ -550,7 +557,6 @@ struct iwl_cfg iwl6000g2a_2agn_cfg = {
         .fw_name_pre = IWL6000G2A_FW_PRE,
         .ucode_api_max = IWL6000G2_UCODE_API_MAX,
         .ucode_api_min = IWL6000G2_UCODE_API_MIN,
-        .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
         .valid_tx_ant = ANT_AB,
         .valid_rx_ant = ANT_AB,
         .eeprom_ver = EEPROM_6000G2_EEPROM_VERSION,
@@ -561,6 +567,7 @@ struct iwl_cfg iwl6000g2a_2agn_cfg = {
         .ht_params = &iwl6000_ht_params,
         .need_dc_calib = true,
         .need_temp_offset_calib = true,
+        .led_mode = IWL_LED_RF_STATE,
 };
 
 struct iwl_cfg iwl6000g2a_2abg_cfg = {
@@ -568,7 +575,6 @@ struct iwl_cfg iwl6000g2a_2abg_cfg = {
         .fw_name_pre = IWL6000G2A_FW_PRE,
         .ucode_api_max = IWL6000G2_UCODE_API_MAX,
         .ucode_api_min = IWL6000G2_UCODE_API_MIN,
-        .sku = IWL_SKU_A|IWL_SKU_G,
         .valid_tx_ant = ANT_AB,
         .valid_rx_ant = ANT_AB,
         .eeprom_ver = EEPROM_6000G2_EEPROM_VERSION,
@@ -578,6 +584,7 @@ struct iwl_cfg iwl6000g2a_2abg_cfg = {
         .base_params = &iwl6000_base_params,
         .need_dc_calib = true,
         .need_temp_offset_calib = true,
+        .led_mode = IWL_LED_RF_STATE,
 };
 
 struct iwl_cfg iwl6000g2a_2bg_cfg = {
@@ -585,7 +592,6 @@ struct iwl_cfg iwl6000g2a_2bg_cfg = {
         .fw_name_pre = IWL6000G2A_FW_PRE,
         .ucode_api_max = IWL6000G2_UCODE_API_MAX,
         .ucode_api_min = IWL6000G2_UCODE_API_MIN,
-        .sku = IWL_SKU_G,
         .valid_tx_ant = ANT_AB,
         .valid_rx_ant = ANT_AB,
         .eeprom_ver = EEPROM_6000G2_EEPROM_VERSION,
@@ -595,6 +601,7 @@ struct iwl_cfg iwl6000g2a_2bg_cfg = {
         .base_params = &iwl6000_base_params,
         .need_dc_calib = true,
         .need_temp_offset_calib = true,
+        .led_mode = IWL_LED_RF_STATE,
 };
 
 struct iwl_cfg iwl6000g2b_2agn_cfg = {
@@ -602,7 +609,6 @@ struct iwl_cfg iwl6000g2b_2agn_cfg = {
         .fw_name_pre = IWL6000G2B_FW_PRE,
         .ucode_api_max = IWL6000G2_UCODE_API_MAX,
         .ucode_api_min = IWL6000G2_UCODE_API_MIN,
-        .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
         .valid_tx_ant = ANT_AB,
         .valid_rx_ant = ANT_AB,
         .eeprom_ver = EEPROM_6000G2_EEPROM_VERSION,
@@ -614,6 +620,8 @@ struct iwl_cfg iwl6000g2b_2agn_cfg = {
         .ht_params = &iwl6000_ht_params,
         .need_dc_calib = true,
         .need_temp_offset_calib = true,
+        .led_mode = IWL_LED_RF_STATE,
+        .adv_pm = true,
         /* Due to bluetooth, we transmit 2.4 GHz probes only on antenna A */
         .scan_tx_antennas[IEEE80211_BAND_2GHZ] = ANT_A,
 };
@@ -623,7 +631,6 @@ struct iwl_cfg iwl6000g2b_2abg_cfg = {
         .fw_name_pre = IWL6000G2B_FW_PRE,
         .ucode_api_max = IWL6000G2_UCODE_API_MAX,
         .ucode_api_min = IWL6000G2_UCODE_API_MIN,
-        .sku = IWL_SKU_A|IWL_SKU_G,
         .valid_tx_ant = ANT_AB,
         .valid_rx_ant = ANT_AB,
         .eeprom_ver = EEPROM_6000G2_EEPROM_VERSION,
@@ -634,6 +641,8 @@ struct iwl_cfg iwl6000g2b_2abg_cfg = {
         .bt_params = &iwl6000_bt_params,
         .need_dc_calib = true,
         .need_temp_offset_calib = true,
+        .led_mode = IWL_LED_RF_STATE,
+        .adv_pm = true,
         /* Due to bluetooth, we transmit 2.4 GHz probes only on antenna A */
         .scan_tx_antennas[IEEE80211_BAND_2GHZ] = ANT_A,
 };
@@ -643,7 +652,6 @@ struct iwl_cfg iwl6000g2b_2bgn_cfg = {
         .fw_name_pre = IWL6000G2B_FW_PRE,
         .ucode_api_max = IWL6000G2_UCODE_API_MAX,
         .ucode_api_min = IWL6000G2_UCODE_API_MIN,
-        .sku = IWL_SKU_G|IWL_SKU_N,
         .valid_tx_ant = ANT_AB,
         .valid_rx_ant = ANT_AB,
         .eeprom_ver = EEPROM_6000G2_EEPROM_VERSION,
@@ -655,6 +663,8 @@ struct iwl_cfg iwl6000g2b_2bgn_cfg = {
         .ht_params = &iwl6000_ht_params,
         .need_dc_calib = true,
         .need_temp_offset_calib = true,
+        .led_mode = IWL_LED_RF_STATE,
+        .adv_pm = true,
         /* Due to bluetooth, we transmit 2.4 GHz probes only on antenna A */
         .scan_tx_antennas[IEEE80211_BAND_2GHZ] = ANT_A,
 };
@@ -664,7 +674,6 @@ struct iwl_cfg iwl6000g2b_2bg_cfg = {
         .fw_name_pre = IWL6000G2B_FW_PRE,
         .ucode_api_max = IWL6000G2_UCODE_API_MAX,
         .ucode_api_min = IWL6000G2_UCODE_API_MIN,
-        .sku = IWL_SKU_G,
         .valid_tx_ant = ANT_AB,
         .valid_rx_ant = ANT_AB,
         .eeprom_ver = EEPROM_6000G2_EEPROM_VERSION,
@@ -675,6 +684,8 @@ struct iwl_cfg iwl6000g2b_2bg_cfg = {
         .bt_params = &iwl6000_bt_params,
         .need_dc_calib = true,
         .need_temp_offset_calib = true,
+        .led_mode = IWL_LED_RF_STATE,
+        .adv_pm = true,
         /* Due to bluetooth, we transmit 2.4 GHz probes only on antenna A */
         .scan_tx_antennas[IEEE80211_BAND_2GHZ] = ANT_A,
 };
@@ -684,7 +695,6 @@ struct iwl_cfg iwl6000g2b_bgn_cfg = {
         .fw_name_pre = IWL6000G2B_FW_PRE,
         .ucode_api_max = IWL6000G2_UCODE_API_MAX,
         .ucode_api_min = IWL6000G2_UCODE_API_MIN,
-        .sku = IWL_SKU_G|IWL_SKU_N,
         .valid_tx_ant = ANT_A,
         .valid_rx_ant = ANT_AB,
         .eeprom_ver = EEPROM_6000G2_EEPROM_VERSION,
@@ -696,6 +706,8 @@ struct iwl_cfg iwl6000g2b_bgn_cfg = {
         .ht_params = &iwl6000_ht_params,
         .need_dc_calib = true,
         .need_temp_offset_calib = true,
+        .led_mode = IWL_LED_RF_STATE,
+        .adv_pm = true,
         /* Due to bluetooth, we transmit 2.4 GHz probes only on antenna A */
         .scan_tx_antennas[IEEE80211_BAND_2GHZ] = ANT_A,
 };
@@ -705,7 +717,6 @@ struct iwl_cfg iwl6000g2b_bg_cfg = {
         .fw_name_pre = IWL6000G2B_FW_PRE,
         .ucode_api_max = IWL6000G2_UCODE_API_MAX,
         .ucode_api_min = IWL6000G2_UCODE_API_MIN,
-        .sku = IWL_SKU_G,
         .valid_tx_ant = ANT_A,
         .valid_rx_ant = ANT_AB,
         .eeprom_ver = EEPROM_6000G2_EEPROM_VERSION,
@@ -716,6 +727,8 @@ struct iwl_cfg iwl6000g2b_bg_cfg = {
         .bt_params = &iwl6000_bt_params,
         .need_dc_calib = true,
         .need_temp_offset_calib = true,
+        .led_mode = IWL_LED_RF_STATE,
+        .adv_pm = true,
         /* Due to bluetooth, we transmit 2.4 GHz probes only on antenna A */
         .scan_tx_antennas[IEEE80211_BAND_2GHZ] = ANT_A,
 };
@@ -728,7 +741,6 @@ struct iwl_cfg iwl6000i_2agn_cfg = {
         .fw_name_pre = IWL6000_FW_PRE,
         .ucode_api_max = IWL6000_UCODE_API_MAX,
         .ucode_api_min = IWL6000_UCODE_API_MIN,
-        .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
         .valid_tx_ant = ANT_BC,
         .valid_rx_ant = ANT_BC,
         .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
@@ -738,6 +750,7 @@ struct iwl_cfg iwl6000i_2agn_cfg = {
         .base_params = &iwl6000_base_params,
         .ht_params = &iwl6000_ht_params,
         .pa_type = IWL_PA_INTERNAL,
+        .led_mode = IWL_LED_BLINK,
 };
 
 struct iwl_cfg iwl6000i_2abg_cfg = {
@@ -745,7 +758,6 @@ struct iwl_cfg iwl6000i_2abg_cfg = {
         .fw_name_pre = IWL6000_FW_PRE,
         .ucode_api_max = IWL6000_UCODE_API_MAX,
         .ucode_api_min = IWL6000_UCODE_API_MIN,
-        .sku = IWL_SKU_A|IWL_SKU_G,
         .valid_tx_ant = ANT_BC,
         .valid_rx_ant = ANT_BC,
         .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
@@ -754,6 +766,7 @@ struct iwl_cfg iwl6000i_2abg_cfg = {
         .mod_params = &iwlagn_mod_params,
         .base_params = &iwl6000_base_params,
         .pa_type = IWL_PA_INTERNAL,
+        .led_mode = IWL_LED_BLINK,
 };
 
 struct iwl_cfg iwl6000i_2bg_cfg = {
@@ -761,7 +774,6 @@ struct iwl_cfg iwl6000i_2bg_cfg = {
         .fw_name_pre = IWL6000_FW_PRE,
         .ucode_api_max = IWL6000_UCODE_API_MAX,
         .ucode_api_min = IWL6000_UCODE_API_MIN,
-        .sku = IWL_SKU_G,
         .valid_tx_ant = ANT_BC,
         .valid_rx_ant = ANT_BC,
         .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
@@ -770,6 +782,7 @@ struct iwl_cfg iwl6000i_2bg_cfg = {
         .mod_params = &iwlagn_mod_params,
         .base_params = &iwl6000_base_params,
         .pa_type = IWL_PA_INTERNAL,
+        .led_mode = IWL_LED_BLINK,
 };
 
 struct iwl_cfg iwl6050_2agn_cfg = {
@@ -777,7 +790,6 @@ struct iwl_cfg iwl6050_2agn_cfg = {
         .fw_name_pre = IWL6050_FW_PRE,
         .ucode_api_max = IWL6050_UCODE_API_MAX,
         .ucode_api_min = IWL6050_UCODE_API_MIN,
-        .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
         .valid_tx_ant = ANT_AB,
         .valid_rx_ant = ANT_AB,
         .ops = &iwl6050_ops,
@@ -787,6 +799,7 @@ struct iwl_cfg iwl6050_2agn_cfg = {
         .base_params = &iwl6050_base_params,
         .ht_params = &iwl6000_ht_params,
         .need_dc_calib = true,
+        .led_mode = IWL_LED_BLINK,
 };
 
 struct iwl_cfg iwl6050g2_bgn_cfg = {
@@ -794,7 +807,6 @@ struct iwl_cfg iwl6050g2_bgn_cfg = {
         .fw_name_pre = IWL6050_FW_PRE,
         .ucode_api_max = IWL6050_UCODE_API_MAX,
         .ucode_api_min = IWL6050_UCODE_API_MIN,
-        .sku = IWL_SKU_G|IWL_SKU_N,
         .valid_tx_ant = ANT_A,
         .valid_rx_ant = ANT_AB,
         .eeprom_ver = EEPROM_6050G2_EEPROM_VERSION,
@@ -804,6 +816,7 @@ struct iwl_cfg iwl6050g2_bgn_cfg = {
         .base_params = &iwl6050_base_params,
         .ht_params = &iwl6000_ht_params,
         .need_dc_calib = true,
+        .led_mode = IWL_LED_RF_STATE,
 };
 
 struct iwl_cfg iwl6050_2abg_cfg = {
@@ -811,7 +824,6 @@ struct iwl_cfg iwl6050_2abg_cfg = {
         .fw_name_pre = IWL6050_FW_PRE,
         .ucode_api_max = IWL6050_UCODE_API_MAX,
         .ucode_api_min = IWL6050_UCODE_API_MIN,
-        .sku = IWL_SKU_A|IWL_SKU_G,
         .valid_tx_ant = ANT_AB,
         .valid_rx_ant = ANT_AB,
         .eeprom_ver = EEPROM_6050_EEPROM_VERSION,
@@ -820,6 +832,7 @@ struct iwl_cfg iwl6050_2abg_cfg = {
         .mod_params = &iwlagn_mod_params,
         .base_params = &iwl6050_base_params,
         .need_dc_calib = true,
+        .led_mode = IWL_LED_BLINK,
 };
 
 struct iwl_cfg iwl6000_3agn_cfg = {
@@ -827,7 +840,6 @@ struct iwl_cfg iwl6000_3agn_cfg = {
         .fw_name_pre = IWL6000_FW_PRE,
         .ucode_api_max = IWL6000_UCODE_API_MAX,
         .ucode_api_min = IWL6000_UCODE_API_MIN,
-        .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
         .valid_tx_ant = ANT_ABC,
         .valid_rx_ant = ANT_ABC,
         .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
@@ -837,14 +849,14 @@ struct iwl_cfg iwl6000_3agn_cfg = {
         .base_params = &iwl6000_base_params,
         .ht_params = &iwl6000_ht_params,
         .need_dc_calib = true,
+        .led_mode = IWL_LED_BLINK,
 };
 
 struct iwl_cfg iwl130_bgn_cfg = {
         .name = "Intel(R) 130 Series 1x1 BGN",
         .fw_name_pre = IWL6000G2B_FW_PRE,
-        .ucode_api_max = IWL130_UCODE_API_MAX,
-        .ucode_api_min = IWL130_UCODE_API_MIN,
-        .sku = IWL_SKU_G|IWL_SKU_N,
+        .ucode_api_max = IWL6000G2_UCODE_API_MAX,
+        .ucode_api_min = IWL6000G2_UCODE_API_MIN,
         .valid_tx_ant = ANT_A,
         .valid_rx_ant = ANT_A,
         .eeprom_ver = EEPROM_6000G2_EEPROM_VERSION,
@@ -855,6 +867,8 @@ struct iwl_cfg iwl130_bgn_cfg = {
         .bt_params = &iwl6000_bt_params,
         .ht_params = &iwl6000_ht_params,
         .need_dc_calib = true,
+        .led_mode = IWL_LED_RF_STATE,
+        .adv_pm = true,
         /* Due to bluetooth, we transmit 2.4 GHz probes only on antenna A */
         .scan_tx_antennas[IEEE80211_BAND_2GHZ] = ANT_A,
 };
@@ -862,9 +876,8 @@ struct iwl_cfg iwl130_bgn_cfg = {
 struct iwl_cfg iwl130_bg_cfg = {
         .name = "Intel(R) 130 Series 1x2 BG",
         .fw_name_pre = IWL6000G2B_FW_PRE,
-        .ucode_api_max = IWL130_UCODE_API_MAX,
-        .ucode_api_min = IWL130_UCODE_API_MIN,
-        .sku = IWL_SKU_G,
+        .ucode_api_max = IWL6000G2_UCODE_API_MAX,
+        .ucode_api_min = IWL6000G2_UCODE_API_MIN,
         .valid_tx_ant = ANT_A,
         .valid_rx_ant = ANT_A,
         .eeprom_ver = EEPROM_6000G2_EEPROM_VERSION,
@@ -874,6 +887,8 @@ struct iwl_cfg iwl130_bg_cfg = {
         .base_params = &iwl6000_coex_base_params,
         .bt_params = &iwl6000_bt_params,
         .need_dc_calib = true,
+        .led_mode = IWL_LED_RF_STATE,
+        .adv_pm = true,
         /* Due to bluetooth, we transmit 2.4 GHz probes only on antenna A */
         .scan_tx_antennas[IEEE80211_BAND_2GHZ] = ANT_A,
 };
@@ -882,4 +897,3 @@ MODULE_FIRMWARE(IWL6000_MODULE_FIRMWARE(IWL6000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL6050_MODULE_FIRMWARE(IWL6050_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL6000G2A_MODULE_FIRMWARE(IWL6000G2_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL6000G2B_MODULE_FIRMWARE(IWL6000G2_UCODE_API_MAX));
-MODULE_FIRMWARE(IWL130_MODULE_FIRMWARE(IWL130_UCODE_API_MAX));
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-calib.c b/drivers/net/wireless/iwlwifi/iwl-agn-calib.c
index e2019e75693..d16bb5ede01 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-calib.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-calib.c
@@ -732,8 +732,122 @@ static inline u8 find_first_chain(u8 mask)
         return CHAIN_C;
 }
 
+/**
+ * Run disconnected antenna algorithm to find out which antennas are
+ * disconnected.
+ */
+static void iwl_find_disconn_antenna(struct iwl_priv *priv, u32* average_sig,
+                                     struct iwl_chain_noise_data *data)
+{
+        u32 active_chains = 0;
+        u32 max_average_sig;
+        u16 max_average_sig_antenna_i;
+        u8 num_tx_chains;
+        u8 first_chain;
+        u16 i = 0;
+
+        average_sig[0] = data->chain_signal_a /
+                         priv->cfg->base_params->chain_noise_num_beacons;
+        average_sig[1] = data->chain_signal_b /
+                         priv->cfg->base_params->chain_noise_num_beacons;
+        average_sig[2] = data->chain_signal_c /
+                         priv->cfg->base_params->chain_noise_num_beacons;
+
+        if (average_sig[0] >= average_sig[1]) {
+                max_average_sig = average_sig[0];
+                max_average_sig_antenna_i = 0;
+                active_chains = (1 << max_average_sig_antenna_i);
+        } else {
+                max_average_sig = average_sig[1];
+                max_average_sig_antenna_i = 1;
+                active_chains = (1 << max_average_sig_antenna_i);
+        }
+
+        if (average_sig[2] >= max_average_sig) {
+                max_average_sig = average_sig[2];
+                max_average_sig_antenna_i = 2;
+                active_chains = (1 << max_average_sig_antenna_i);
+        }
+
+        IWL_DEBUG_CALIB(priv, "average_sig: a %d b %d c %d\n",
+                     average_sig[0], average_sig[1], average_sig[2]);
+        IWL_DEBUG_CALIB(priv, "max_average_sig = %d, antenna %d\n",
+                     max_average_sig, max_average_sig_antenna_i);
+
+        /* Compare signal strengths for all 3 receivers. */
+        for (i = 0; i < NUM_RX_CHAINS; i++) {
+                if (i != max_average_sig_antenna_i) {
+                        s32 rssi_delta = (max_average_sig - average_sig[i]);
+
+                        /* If signal is very weak, compared with
+                         * strongest, mark it as disconnected. */
+                        if (rssi_delta > MAXIMUM_ALLOWED_PATHLOSS)
+                                data->disconn_array[i] = 1;
+                        else
+                                active_chains |= (1 << i);
+                        IWL_DEBUG_CALIB(priv, "i = %d  rssiDelta = %d  "
+                             "disconn_array[i] = %d\n",
+                             i, rssi_delta, data->disconn_array[i]);
+                }
+        }
+
+        /*
+         * The above algorithm sometimes fails when the ucode
+         * reports 0 for all chains. It's not clear why that
+         * happens to start with, but it is then causing trouble
+         * because this can make us enable more chains than the
+         * hardware really has.
+         *
+         * To be safe, simply mask out any chains that we know
+         * are not on the device.
+         */
+        active_chains &= priv->hw_params.valid_rx_ant;
+
+        num_tx_chains = 0;
+        for (i = 0; i < NUM_RX_CHAINS; i++) {
+                /* loops on all the bits of
+                 * priv->hw_setting.valid_tx_ant */
+                u8 ant_msk = (1 << i);
+                if (!(priv->hw_params.valid_tx_ant & ant_msk))
+                        continue;
+
+                num_tx_chains++;
+                if (data->disconn_array[i] == 0)
+                        /* there is a Tx antenna connected */
+                        break;
+                if (num_tx_chains == priv->hw_params.tx_chains_num &&
+                    data->disconn_array[i]) {
+                        /*
+                         * If all chains are disconnected
+                         * connect the first valid tx chain
+                         */
+                        first_chain =
+                                find_first_chain(priv->cfg->valid_tx_ant);
+                        data->disconn_array[first_chain] = 0;
+                        active_chains |= BIT(first_chain);
+                        IWL_DEBUG_CALIB(priv, "All Tx chains are disconnected \
+                                        W/A - declare %d as connected\n",
+                                        first_chain);
+                        break;
+                }
+        }
+
+        if (active_chains != priv->hw_params.valid_rx_ant &&
+            active_chains != priv->chain_noise_data.active_chains)
+                IWL_DEBUG_CALIB(priv,
+                                "Detected that not all antennas are connected! "
+                                "Connected: %#x, valid: %#x.\n",
+                                active_chains, priv->hw_params.valid_rx_ant);
+
+        /* Save for use within RXON, TX, SCAN commands, etc. */
+        data->active_chains = active_chains;
+        IWL_DEBUG_CALIB(priv, "active_chains (bitwise) = 0x%x\n",
+                        active_chains);
+}
+
+
 /*
- * Accumulate 20 beacons of signal and noise statistics for each of
+ * Accumulate 16 beacons of signal and noise statistics for each of
  *   3 receivers/antennas/rx-chains, then figure out:
  * 1)  Which antennas are connected.
  * 2)  Differential rx gain settings to balance the 3 receivers.
@@ -750,8 +864,6 @@ void iwl_chain_noise_calibration(struct iwl_priv *priv, void *stat_resp)
         u32 chain_sig_c;
         u32 average_sig[NUM_RX_CHAINS] = {INITIALIZATION_VALUE};
         u32 average_noise[NUM_RX_CHAINS] = {INITIALIZATION_VALUE};
-        u32 max_average_sig;
-        u16 max_average_sig_antenna_i;
         u32 min_average_noise = MIN_AVERAGE_NOISE_MAX_VALUE;
         u16 min_average_noise_antenna_i = INITIALIZATION_VALUE;
         u16 i = 0;
@@ -759,11 +871,9 @@ void iwl_chain_noise_calibration(struct iwl_priv *priv, void *stat_resp)
         u16 stat_chnum = INITIALIZATION_VALUE;
         u8 rxon_band24;
         u8 stat_band24;
-        u32 active_chains = 0;
-        u8 num_tx_chains;
         unsigned long flags;
         struct statistics_rx_non_phy *rx_info;
-        u8 first_chain;
+
         /*
          * MULTI-FIXME:
          * When we support multiple interfaces on different channels,
@@ -869,108 +979,16 @@ void iwl_chain_noise_calibration(struct iwl_priv *priv, void *stat_resp)
                 return;
 
         /* Analyze signal for disconnected antenna */
-        average_sig[0] = data->chain_signal_a /
-                         priv->cfg->base_params->chain_noise_num_beacons;
-        average_sig[1] = data->chain_signal_b /
-                         priv->cfg->base_params->chain_noise_num_beacons;
-        average_sig[2] = data->chain_signal_c /
-                         priv->cfg->base_params->chain_noise_num_beacons;
-
-        if (average_sig[0] >= average_sig[1]) {
-                max_average_sig = average_sig[0];
-                max_average_sig_antenna_i = 0;
-                active_chains = (1 << max_average_sig_antenna_i);
-        } else {
-                max_average_sig = average_sig[1];
-                max_average_sig_antenna_i = 1;
-                active_chains = (1 << max_average_sig_antenna_i);
-        }
-
-        if (average_sig[2] >= max_average_sig) {
-                max_average_sig = average_sig[2];
-                max_average_sig_antenna_i = 2;
-                active_chains = (1 << max_average_sig_antenna_i);
-        }
-
-        IWL_DEBUG_CALIB(priv, "average_sig: a %d b %d c %d\n",
-                     average_sig[0], average_sig[1], average_sig[2]);
-        IWL_DEBUG_CALIB(priv, "max_average_sig = %d, antenna %d\n",
-                     max_average_sig, max_average_sig_antenna_i);
-
-        /* Compare signal strengths for all 3 receivers. */
-        for (i = 0; i < NUM_RX_CHAINS; i++) {
-                if (i != max_average_sig_antenna_i) {
-                        s32 rssi_delta = (max_average_sig - average_sig[i]);
-
-                        /* If signal is very weak, compared with
-                         * strongest, mark it as disconnected. */
-                        if (rssi_delta > MAXIMUM_ALLOWED_PATHLOSS)
-                                data->disconn_array[i] = 1;
-                        else
-                                active_chains |= (1 << i);
-                        IWL_DEBUG_CALIB(priv, "i = %d  rssiDelta = %d  "
-                             "disconn_array[i] = %d\n",
-                             i, rssi_delta, data->disconn_array[i]);
-                }
-        }
-
-        /*
-         * The above algorithm sometimes fails when the ucode
-         * reports 0 for all chains. It's not clear why that
-         * happens to start with, but it is then causing trouble
-         * because this can make us enable more chains than the
-         * hardware really has.
-         *
-         * To be safe, simply mask out any chains that we know
-         * are not on the device.
-         */
         if (priv->cfg->bt_params &&
-            priv->cfg->bt_params->advanced_bt_coexist &&
-            priv->bt_full_concurrent) {
-                /* operated as 1x1 in full concurrency mode */
-                active_chains &= first_antenna(priv->hw_params.valid_rx_ant);
+            priv->cfg->bt_params->advanced_bt_coexist) {
+                /* Disable disconnected antenna algorithm for advanced
+                   bt coex, assuming valid antennas are connected */
+                data->active_chains = priv->hw_params.valid_rx_ant;
+                for (i = 0; i < NUM_RX_CHAINS; i++)
+                        if (!(data->active_chains & (1<<i)))
+                                data->disconn_array[i] = 1;
         } else
-                active_chains &= priv->hw_params.valid_rx_ant;
-
-        num_tx_chains = 0;
-        for (i = 0; i < NUM_RX_CHAINS; i++) {
-                /* loops on all the bits of
-                 * priv->hw_setting.valid_tx_ant */
-                u8 ant_msk = (1 << i);
-                if (!(priv->hw_params.valid_tx_ant & ant_msk))
-                        continue;
-
-                num_tx_chains++;
-                if (data->disconn_array[i] == 0)
-                        /* there is a Tx antenna connected */
-                        break;
-                if (num_tx_chains == priv->hw_params.tx_chains_num &&
-                    data->disconn_array[i]) {
-                        /*
-                         * If all chains are disconnected
-                         * connect the first valid tx chain
-                         */
-                        first_chain =
-                                find_first_chain(priv->cfg->valid_tx_ant);
-                        data->disconn_array[first_chain] = 0;
-                        active_chains |= BIT(first_chain);
-                        IWL_DEBUG_CALIB(priv, "All Tx chains are disconnected W/A - declare %d as connected\n",
-                                        first_chain);
-                        break;
-                }
-        }
-
-        if (active_chains != priv->hw_params.valid_rx_ant &&
-            active_chains != priv->chain_noise_data.active_chains)
-                IWL_DEBUG_CALIB(priv,
-                                "Detected that not all antennas are connected! "
-                                "Connected: %#x, valid: %#x.\n",
-                                active_chains, priv->hw_params.valid_rx_ant);
-
-        /* Save for use within RXON, TX, SCAN commands, etc. */
-        priv->chain_noise_data.active_chains = active_chains;
-        IWL_DEBUG_CALIB(priv, "active_chains (bitwise) = 0x%x\n",
-                        active_chains);
+                iwl_find_disconn_antenna(priv, average_sig, data);
 
         /* Analyze noise for rx balance */
         average_noise[0] = data->chain_noise_a /
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-eeprom.c b/drivers/net/wireless/iwlwifi/iwl-agn-eeprom.c
index a650baba080..8a4d3acb9b7 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-eeprom.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-eeprom.c
@@ -248,6 +248,27 @@ err:
 
 }
 
+int iwl_eeprom_check_sku(struct iwl_priv *priv)
+{
+        u16 eeprom_sku;
+
+        eeprom_sku = iwl_eeprom_query16(priv, EEPROM_SKU_CAP);
+
+        priv->cfg->sku = ((eeprom_sku & EEPROM_SKU_CAP_BAND_SELECTION) >>
+                        EEPROM_SKU_CAP_BAND_POS);
+        if (eeprom_sku & EEPROM_SKU_CAP_11N_ENABLE)
+                priv->cfg->sku |= IWL_SKU_N;
+
+        if (!priv->cfg->sku) {
+                IWL_ERR(priv, "Invalid device sku\n");
+                return -EINVAL;
+        }
+
+        IWL_INFO(priv, "Device SKU: 0X%x\n", priv->cfg->sku);
+
+        return 0;
+}
+
 void iwl_eeprom_get_mac(const struct iwl_priv *priv, u8 *mac)
 {
         const u8 *addr = priv->cfg->ops->lib->eeprom_ops.query_addr(priv,
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c b/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c
index ffb2f4111ad..366340f3fb0 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c
@@ -307,6 +307,7 @@ static int iwlagn_set_pan_params(struct iwl_priv *priv)
 
         if (ctx_bss->vif && ctx_pan->vif) {
                 int bcnint = ctx_pan->vif->bss_conf.beacon_int;
+                int dtim = ctx_pan->vif->bss_conf.dtim_period ?: 1;
 
                 /* should be set, but seems unused?? */
                 cmd.flags |= cpu_to_le16(IWL_WIPAN_PARAMS_FLG_SLOTTED_MODE);
@@ -329,10 +330,10 @@ static int iwlagn_set_pan_params(struct iwl_priv *priv)
                 if (test_bit(STATUS_SCAN_HW, &priv->status) ||
                     (!ctx_bss->vif->bss_conf.idle &&
                      !ctx_bss->vif->bss_conf.assoc)) {
-                        slot0 = bcnint * 3 - 20;
+                        slot0 = dtim * bcnint * 3 - 20;
                         slot1 = 20;
                 } else if (!ctx_pan->vif->bss_conf.idle &&
-                           !ctx_pan->vif->bss_conf.assoc) {
+                           !ctx_pan->vif->bss_conf.assoc) {
                         slot1 = bcnint * 3 - 20;
                         slot0 = 20;
                 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
index b555edd5335..f8fe5f44e19 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
@@ -445,22 +445,17 @@ static void iwlagn_rx_reply_tx(struct iwl_priv *priv,
 
                         if (priv->mac80211_registered &&
                             (iwl_queue_space(&txq->q) > txq->q.low_mark) &&
-                            (agg->state != IWL_EMPTYING_HW_QUEUE_DELBA)) {
-                                if (agg->state == IWL_AGG_OFF)
-                                        iwl_wake_queue(priv, txq_id);
-                                else
-                                        iwl_wake_queue(priv, txq->swq_id);
-                        }
+                            (agg->state != IWL_EMPTYING_HW_QUEUE_DELBA))
+                                iwl_wake_queue(priv, txq);
                 }
         } else {
-                BUG_ON(txq_id != txq->swq_id);
                 iwlagn_set_tx_status(priv, info, tx_resp, txq_id, false);
                 freed = iwlagn_tx_queue_reclaim(priv, txq_id, index);
                 iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
 
                 if (priv->mac80211_registered &&
                     (iwl_queue_space(&txq->q) > txq->q.low_mark))
-                        iwl_wake_queue(priv, txq_id);
+                        iwl_wake_queue(priv, txq);
         }
 
         iwlagn_txq_check_empty(priv, sta_id, tid, txq_id);
@@ -496,6 +491,10 @@ int iwlagn_send_tx_power(struct iwl_priv *priv)
         struct iwlagn_tx_power_dbm_cmd tx_power_cmd;
         u8 tx_ant_cfg_cmd;
 
+        if (WARN_ONCE(test_bit(STATUS_SCAN_HW, &priv->status),
+                      "TX Power requested while scanning!\n"))
+                return -EAGAIN;
+
         /* half dBm need to multiply */
         tx_power_cmd.global_lmt = (s8)(2 * priv->tx_power_user_lmt);
 
@@ -522,9 +521,8 @@ int iwlagn_send_tx_power(struct iwl_priv *priv)
         else
                 tx_ant_cfg_cmd = REPLY_TX_POWER_DBM_CMD;
 
-        return  iwl_send_cmd_pdu_async(priv, tx_ant_cfg_cmd,
-                                       sizeof(tx_power_cmd), &tx_power_cmd,
-                                       NULL);
+        return iwl_send_cmd_pdu(priv, tx_ant_cfg_cmd, sizeof(tx_power_cmd),
+                                &tx_power_cmd);
 }
 
 void iwlagn_temperature(struct iwl_priv *priv)
@@ -750,6 +748,12 @@ int iwlagn_hw_nic_init(struct iwl_priv *priv)
         } else
                 iwlagn_txq_ctx_reset(priv);
 
+        if (priv->cfg->base_params->shadow_reg_enable) {
+                /* enable shadow regs in HW */
+                iwl_set_bit(priv, CSR_MAC_SHADOW_REG_CTRL,
+                        0x800FFFFF);
+        }
+
         set_bit(STATUS_INIT, &priv->status);
 
         return 0;
@@ -1584,22 +1588,6 @@ int iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
         return ret;
 }
 
-void iwlagn_post_scan(struct iwl_priv *priv)
-{
-        struct iwl_rxon_context *ctx;
-
-        /*
-         * Since setting the RXON may have been deferred while
-         * performing the scan, fire one off if needed
-         */
-        for_each_context(priv, ctx)
-                if (memcmp(&ctx->staging, &ctx->active, sizeof(ctx->staging)))
-                        iwlagn_commit_rxon(priv, ctx);
-
-        if (priv->cfg->ops->hcmd->set_pan_params)
-                priv->cfg->ops->hcmd->set_pan_params(priv);
-}
-
 int iwlagn_manage_ibss_station(struct iwl_priv *priv,
                                struct ieee80211_vif *vif, bool add)
 {
@@ -1841,6 +1829,10 @@ void iwlagn_send_advance_bt_config(struct iwl_priv *priv)
         } else {
                 bt_cmd.flags = IWLAGN_BT_FLAG_COEX_MODE_3W <<
                                         IWLAGN_BT_FLAG_COEX_MODE_SHIFT;
+                if (priv->cfg->bt_params &&
+                    priv->cfg->bt_params->bt_sco_disable)
+                        bt_cmd.flags |= IWLAGN_BT_FLAG_SYNC_2_BT_DISABLE;
+
                 if (priv->bt_ch_announce)
                         bt_cmd.flags |= IWLAGN_BT_FLAG_CHANNEL_INHIBITION;
                 IWL_DEBUG_INFO(priv, "BT coex flag: 0X%x\n", bt_cmd.flags);
@@ -1884,12 +1876,20 @@ static void iwlagn_bt_traffic_change_work(struct work_struct *work)
         struct iwl_rxon_context *ctx;
         int smps_request = -1;
 
+        /*
+         * Note: bt_traffic_load can be overridden by scan complete and
+         * coex profile notifications. Ignore that since only bad consequence
+         * can be not matching debug print with actual state.
+         */
         IWL_DEBUG_INFO(priv, "BT traffic load changes: %d\n",
                        priv->bt_traffic_load);
 
         switch (priv->bt_traffic_load) {
         case IWL_BT_COEX_TRAFFIC_LOAD_NONE:
-                smps_request = IEEE80211_SMPS_AUTOMATIC;
+                if (priv->bt_status)
+                        smps_request = IEEE80211_SMPS_DYNAMIC;
+                else
+                        smps_request = IEEE80211_SMPS_AUTOMATIC;
                 break;
         case IWL_BT_COEX_TRAFFIC_LOAD_LOW:
                 smps_request = IEEE80211_SMPS_DYNAMIC;
@@ -1906,6 +1906,16 @@ static void iwlagn_bt_traffic_change_work(struct work_struct *work)
 
         mutex_lock(&priv->mutex);
 
+        /*
+         * We can not send command to firmware while scanning. When the scan
+         * complete we will schedule this work again. We do check with mutex
+         * locked to prevent new scan request to arrive. We do not check
+         * STATUS_SCANNING to avoid race when queue_work two times from
+         * different notifications, but quit and not perform any work at all.
+         */
+        if (test_bit(STATUS_SCAN_HW, &priv->status))
+                goto out;
+
         if (priv->cfg->ops->lib->update_chain_flags)
                 priv->cfg->ops->lib->update_chain_flags(priv);
 
@@ -1915,7 +1925,7 @@ static void iwlagn_bt_traffic_change_work(struct work_struct *work)
                                 ieee80211_request_smps(ctx->vif, smps_request);
                 }
         }
-
+out:
         mutex_unlock(&priv->mutex);
 }
 
@@ -1990,7 +2000,7 @@ static void iwlagn_set_kill_ack_msk(struct iwl_priv *priv,
                                      struct iwl_bt_uart_msg *uart_msg)
 {
         u8 kill_ack_msk;
-        __le32 bt_kill_ack_msg[2] = {
+        static const __le32 bt_kill_ack_msg[2] = {
                         cpu_to_le32(0xFFFFFFF), cpu_to_le32(0xFFFFFC00) };
 
         kill_ack_msk = (((BT_UART_MSG_FRAME3A2DP_MSK |
@@ -2014,7 +2024,6 @@ void iwlagn_bt_coex_profile_notif(struct iwl_priv *priv,
         struct iwl_bt_coex_profile_notif *coex = &pkt->u.bt_coex_profile_notif;
         struct iwlagn_bt_sco_cmd sco_cmd = { .flags = 0 };
         struct iwl_bt_uart_msg *uart_msg = &coex->last_bt_uart_msg;
-        u8 last_traffic_load;
 
         IWL_DEBUG_NOTIF(priv, "BT Coex notification:\n");
         IWL_DEBUG_NOTIF(priv, "    status: %d\n", coex->bt_status);
@@ -2023,11 +2032,10 @@ void iwlagn_bt_coex_profile_notif(struct iwl_priv *priv,
                         coex->bt_ci_compliance);
         iwlagn_print_uartmsg(priv, uart_msg);
 
-        last_traffic_load = priv->notif_bt_traffic_load;
-        priv->notif_bt_traffic_load = coex->bt_traffic_load;
+        priv->last_bt_traffic_load = priv->bt_traffic_load;
         if (priv->iw_mode != NL80211_IFTYPE_ADHOC) {
                 if (priv->bt_status != coex->bt_status ||
-                    last_traffic_load != coex->bt_traffic_load) {
+                    priv->last_bt_traffic_load != coex->bt_traffic_load) {
                         if (coex->bt_status) {
                                 /* BT on */
                                 if (!priv->bt_ch_announce)
@@ -2276,7 +2284,7 @@ static const char *get_csr_string(int cmd)
 void iwl_dump_csr(struct iwl_priv *priv)
 {
         int i;
-        u32 csr_tbl[] = {
+        static const u32 csr_tbl[] = {
                 CSR_HW_IF_CONFIG_REG,
                 CSR_INT_COALESCING,
                 CSR_INT,
@@ -2335,7 +2343,7 @@ int iwl_dump_fh(struct iwl_priv *priv, char **buf, bool display)
         int pos = 0;
         size_t bufsz = 0;
 #endif
-        u32 fh_tbl[] = {
+        static const u32 fh_tbl[] = {
                 FH_RSCSR_CHNL0_STTS_WPTR_REG,
                 FH_RSCSR_CHNL0_RBDCB_BASE_REG,
                 FH_RSCSR_CHNL0_WPTR,
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
index 065553629de..f450adc7236 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
@@ -833,17 +833,23 @@ static void rs_bt_update_lq(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
                             struct iwl_lq_sta *lq_sta)
 {
         struct iwl_scale_tbl_info *tbl;
-        bool full_concurrent;
+        bool full_concurrent = priv->bt_full_concurrent;
         unsigned long flags;
 
-        spin_lock_irqsave(&priv->lock, flags);
-        if (priv->bt_ci_compliance && priv->bt_ant_couple_ok)
-                full_concurrent = true;
-        else
-                full_concurrent = false;
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        if (priv->bt_full_concurrent != full_concurrent) {
+        if (priv->bt_ant_couple_ok) {
+                /*
+                 * Is there a need to switch between
+                 * full concurrency and 3-wire?
+                 */
+                spin_lock_irqsave(&priv->lock, flags);
+                if (priv->bt_ci_compliance && priv->bt_ant_couple_ok)
+                        full_concurrent = true;
+                else
+                        full_concurrent = false;
+                spin_unlock_irqrestore(&priv->lock, flags);
+        }
+        if ((priv->bt_traffic_load != priv->last_bt_traffic_load) ||
+            (priv->bt_full_concurrent != full_concurrent)) {
                 priv->bt_full_concurrent = full_concurrent;
 
                 /* Update uCode's rate table. */
@@ -1040,8 +1046,7 @@ done:
         if (sta && sta->supp_rates[sband->band])
                 rs_rate_scale_perform(priv, skb, sta, lq_sta);
 
-        /* Is there a need to switch between full concurrency and 3-wire? */
-        if (priv->bt_ant_couple_ok)
+        if (priv->cfg->bt_params && priv->cfg->bt_params->advanced_bt_coexist)
                 rs_bt_update_lq(priv, ctx, lq_sta);
 }
 
@@ -3010,10 +3015,7 @@ static void rs_fill_link_cmd(struct iwl_priv *priv,
          */
         if (priv && priv->cfg->bt_params &&
             priv->cfg->bt_params->agg_time_limit &&
-            priv->cfg->bt_params->agg_time_limit >=
-                LINK_QUAL_AGG_TIME_LIMIT_MIN &&
-            priv->cfg->bt_params->agg_time_limit <=
-                 LINK_QUAL_AGG_TIME_LIMIT_MAX)
+            priv->bt_traffic_load >= IWL_BT_COEX_TRAFFIC_LOAD_HIGH)
                 lq_cmd->agg_params.agg_time_limit =
                         cpu_to_le16(priv->cfg->bt_params->agg_time_limit);
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c b/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
new file mode 100644
index 00000000000..203ee60a82b
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
@@ -0,0 +1,632 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2003 - 2010 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ * The full GNU General Public License is included in this distribution in the
+ * file called LICENSE.
+ *
+ * Contact Information:
+ * Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ *****************************************************************************/
+
+#include "iwl-dev.h"
+#include "iwl-agn.h"
+#include "iwl-sta.h"
+#include "iwl-core.h"
+#include "iwl-agn-calib.h"
+
+static int iwlagn_disable_bss(struct iwl_priv *priv,
+                              struct iwl_rxon_context *ctx,
+                              struct iwl_rxon_cmd *send)
+{
+        __le32 old_filter = send->filter_flags;
+        int ret;
+
+        send->filter_flags &= ~RXON_FILTER_ASSOC_MSK;
+        ret = iwl_send_cmd_pdu(priv, ctx->rxon_cmd, sizeof(*send), send);
+
+        send->filter_flags = old_filter;
+
+        if (ret)
+                IWL_ERR(priv, "Error clearing ASSOC_MSK on BSS (%d)\n", ret);
+
+        return ret;
+}
+
+static int iwlagn_disable_pan(struct iwl_priv *priv,
+                              struct iwl_rxon_context *ctx,
+                              struct iwl_rxon_cmd *send)
+{
+        __le32 old_filter = send->filter_flags;
+        u8 old_dev_type = send->dev_type;
+        int ret;
+
+        send->filter_flags &= ~RXON_FILTER_ASSOC_MSK;
+        send->dev_type = RXON_DEV_TYPE_P2P;
+        ret = iwl_send_cmd_pdu(priv, ctx->rxon_cmd, sizeof(*send), send);
+
+        send->filter_flags = old_filter;
+        send->dev_type = old_dev_type;
+
+        if (ret)
+                IWL_ERR(priv, "Error disabling PAN (%d)\n", ret);
+
+        /* FIXME: WAIT FOR PAN DISABLE */
+        msleep(300);
+
+        return ret;
+}
+
+static void iwlagn_update_qos(struct iwl_priv *priv,
+                              struct iwl_rxon_context *ctx)
+{
+        int ret;
+
+        if (!ctx->is_active)
+                return;
+
+        ctx->qos_data.def_qos_parm.qos_flags = 0;
+
+        if (ctx->qos_data.qos_active)
+                ctx->qos_data.def_qos_parm.qos_flags |=
+                        QOS_PARAM_FLG_UPDATE_EDCA_MSK;
+
+        if (ctx->ht.enabled)
+                ctx->qos_data.def_qos_parm.qos_flags |= QOS_PARAM_FLG_TGN_MSK;
+
+        IWL_DEBUG_QOS(priv, "send QoS cmd with Qos active=%d FLAGS=0x%X\n",
+                      ctx->qos_data.qos_active,
+                      ctx->qos_data.def_qos_parm.qos_flags);
+
+        ret = iwl_send_cmd_pdu(priv, ctx->qos_cmd,
+                               sizeof(struct iwl_qosparam_cmd),
+                               &ctx->qos_data.def_qos_parm);
+        if (ret)
+                IWL_ERR(priv, "Failed to update QoS\n");
+}
+
+static int iwlagn_update_beacon(struct iwl_priv *priv,
+                                struct ieee80211_vif *vif)
+{
+        lockdep_assert_held(&priv->mutex);
+
+        dev_kfree_skb(priv->beacon_skb);
+        priv->beacon_skb = ieee80211_beacon_get(priv->hw, vif);
+        if (!priv->beacon_skb)
+                return -ENOMEM;
+        return iwlagn_send_beacon_cmd(priv);
+}
+
+/**
+ * iwlagn_commit_rxon - commit staging_rxon to hardware
+ *
+ * The RXON command in staging_rxon is committed to the hardware and
+ * the active_rxon structure is updated with the new data.  This
+ * function correctly transitions out of the RXON_ASSOC_MSK state if
+ * a HW tune is required based on the RXON structure changes.
+ */
+int iwlagn_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
+{
+        /* cast away the const for active_rxon in this function */
+        struct iwl_rxon_cmd *active = (void *)&ctx->active;
+        bool new_assoc = !!(ctx->staging.filter_flags & RXON_FILTER_ASSOC_MSK);
+        bool old_assoc = !!(ctx->active.filter_flags & RXON_FILTER_ASSOC_MSK);
+        int ret;
+
+        lockdep_assert_held(&priv->mutex);
+
+        if (!iwl_is_alive(priv))
+                return -EBUSY;
+
+        /* This function hardcodes a bunch of dual-mode assumptions */
+        BUILD_BUG_ON(NUM_IWL_RXON_CTX != 2);
+
+        if (!ctx->is_active)
+                return 0;
+
+        /* always get timestamp with Rx frame */
+        ctx->staging.flags |= RXON_FLG_TSF2HOST_MSK;
+
+        if ((ctx->vif && ctx->vif->bss_conf.use_short_slot) ||
+            !(ctx->staging.flags & RXON_FLG_BAND_24G_MSK))
+                ctx->staging.flags |= RXON_FLG_SHORT_SLOT_MSK;
+        else
+                ctx->staging.flags &= ~RXON_FLG_SHORT_SLOT_MSK;
+
+        ret = iwl_check_rxon_cmd(priv, ctx);
+        if (ret) {
+                IWL_ERR(priv, "Invalid RXON configuration. Not committing.\n");
+                return -EINVAL;
+        }
+
+        /*
+         * receive commit_rxon request
+         * abort any previous channel switch if still in process
+         */
+        if (priv->switch_rxon.switch_in_progress &&
+            (priv->switch_rxon.channel != ctx->staging.channel)) {
+                IWL_DEBUG_11H(priv, "abort channel switch on %d\n",
+                      le16_to_cpu(priv->switch_rxon.channel));
+                iwl_chswitch_done(priv, false);
+        }
+
+        /*
+         * If we don't need to send a full RXON, we can use
+         * iwl_rxon_assoc_cmd which is used to reconfigure filter
+         * and other flags for the current radio configuration.
+         */
+        if (!iwl_full_rxon_required(priv, ctx)) {
+                ret = iwl_send_rxon_assoc(priv, ctx);
+                if (ret) {
+                        IWL_ERR(priv, "Error setting RXON_ASSOC (%d)\n", ret);
+                        return ret;
+                }
+
+                memcpy(active, &ctx->staging, sizeof(*active));
+                iwl_print_rx_config_cmd(priv, ctx);
+                return 0;
+        }
+
+        if (priv->cfg->ops->hcmd->set_pan_params) {
+                ret = priv->cfg->ops->hcmd->set_pan_params(priv);
+                if (ret)
+                        return ret;
+        }
+
+        iwl_set_rxon_hwcrypto(priv, ctx, !priv->cfg->mod_params->sw_crypto);
+
+        IWL_DEBUG_INFO(priv,
+                       "Going to commit RXON\n"
+                       "  * with%s RXON_FILTER_ASSOC_MSK\n"
+                       "  * channel = %d\n"
+                       "  * bssid = %pM\n",
+                       (new_assoc ? "" : "out"),
+                       le16_to_cpu(ctx->staging.channel),
+                       ctx->staging.bssid_addr);
+
+        /*
+         * Always clear associated first, but with the correct config.
+         * This is required as for example station addition for the
+         * AP station must be done after the BSSID is set to correctly
+         * set up filters in the device.
+         */
+        if ((old_assoc && new_assoc) || !new_assoc) {
+                if (ctx->ctxid == IWL_RXON_CTX_BSS)
+                        ret = iwlagn_disable_bss(priv, ctx, &ctx->staging);
+                else
+                        ret = iwlagn_disable_pan(priv, ctx, &ctx->staging);
+                if (ret)
+                        return ret;
+
+                memcpy(active, &ctx->staging, sizeof(*active));
+
+                /*
+                 * Un-assoc RXON clears the station table and WEP
+                 * keys, so we have to restore those afterwards.
+                 */
+                iwl_clear_ucode_stations(priv, ctx);
+                iwl_restore_stations(priv, ctx);
+                ret = iwl_restore_default_wep_keys(priv, ctx);
+                if (ret) {
+                        IWL_ERR(priv, "Failed to restore WEP keys (%d)\n", ret);
+                        return ret;
+                }
+        }
+
+        /* RXON timing must be before associated RXON */
+        ret = iwl_send_rxon_timing(priv, ctx);
+        if (ret) {
+                IWL_ERR(priv, "Failed to send timing (%d)!\n", ret);
+                return ret;
+        }
+
+        if (new_assoc) {
+                /* QoS info may be cleared by previous un-assoc RXON */
+                iwlagn_update_qos(priv, ctx);
+
+                /*
+                 * We'll run into this code path when beaconing is
+                 * enabled, but then we also need to send the beacon
+                 * to the device.
+                 */
+                if (ctx->vif && (ctx->vif->type == NL80211_IFTYPE_AP)) {
+                        ret = iwlagn_update_beacon(priv, ctx->vif);
+                        if (ret) {
+                                IWL_ERR(priv,
+                                        "Error sending required beacon (%d)!\n",
+                                        ret);
+                                return ret;
+                        }
+                }
+
+                priv->start_calib = 0;
+                /*
+                 * Apply the new configuration.
+                 *
+                 * Associated RXON doesn't clear the station table in uCode,
+                 * so we don't need to restore stations etc. after this.
+                 */
+                ret = iwl_send_cmd_pdu(priv, ctx->rxon_cmd,
+                              sizeof(struct iwl_rxon_cmd), &ctx->staging);
+                if (ret) {
+                        IWL_ERR(priv, "Error setting new RXON (%d)\n", ret);
+                        return ret;
+                }
+                memcpy(active, &ctx->staging, sizeof(*active));
+
+                iwl_reprogram_ap_sta(priv, ctx);
+
+                /* IBSS beacon needs to be sent after setting assoc */
+                if (ctx->vif && (ctx->vif->type == NL80211_IFTYPE_ADHOC))
+                        if (iwlagn_update_beacon(priv, ctx->vif))
+                                IWL_ERR(priv, "Error sending IBSS beacon\n");
+        }
+
+        iwl_print_rx_config_cmd(priv, ctx);
+
+        iwl_init_sensitivity(priv);
+
+        /*
+         * If we issue a new RXON command which required a tune then we must
+         * send a new TXPOWER command or we won't be able to Tx any frames.
+         *
+         * FIXME: which RXON requires a tune? Can we optimise this out in
+         *        some cases?
+         */
+        ret = iwl_set_tx_power(priv, priv->tx_power_user_lmt, true);
+        if (ret) {
+                IWL_ERR(priv, "Error sending TX power (%d)\n", ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+int iwlagn_mac_config(struct ieee80211_hw *hw, u32 changed)
+{
+        struct iwl_priv *priv = hw->priv;
+        struct iwl_rxon_context *ctx;
+        struct ieee80211_conf *conf = &hw->conf;
+        struct ieee80211_channel *channel = conf->channel;
+        const struct iwl_channel_info *ch_info;
+        int ret = 0;
+        bool ht_changed[NUM_IWL_RXON_CTX] = {};
+
+        IWL_DEBUG_MAC80211(priv, "changed %#x", changed);
+
+        mutex_lock(&priv->mutex);
+
+        if (unlikely(test_bit(STATUS_SCANNING, &priv->status))) {
+                IWL_DEBUG_MAC80211(priv, "leave - scanning\n");
+                goto out;
+        }
+
+        if (!iwl_is_ready(priv)) {
+                IWL_DEBUG_MAC80211(priv, "leave - not ready\n");
+                goto out;
+        }
+
+        if (changed & (IEEE80211_CONF_CHANGE_SMPS |
+                       IEEE80211_CONF_CHANGE_CHANNEL)) {
+                /* mac80211 uses static for non-HT which is what we want */
+                priv->current_ht_config.smps = conf->smps_mode;
+
+                /*
+                 * Recalculate chain counts.
+                 *
+                 * If monitor mode is enabled then mac80211 will
+                 * set up the SM PS mode to OFF if an HT channel is
+                 * configured.
+                 */
+                if (priv->cfg->ops->hcmd->set_rxon_chain)
+                        for_each_context(priv, ctx)
+                                priv->cfg->ops->hcmd->set_rxon_chain(priv, ctx);
+        }
+
+        if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
+                unsigned long flags;
+
+                ch_info = iwl_get_channel_info(priv, channel->band,
+                                               channel->hw_value);
+                if (!is_channel_valid(ch_info)) {
+                        IWL_DEBUG_MAC80211(priv, "leave - invalid channel\n");
+                        ret = -EINVAL;
+                        goto out;
+                }
+
+                spin_lock_irqsave(&priv->lock, flags);
+
+                for_each_context(priv, ctx) {
+                        /* Configure HT40 channels */
+                        if (ctx->ht.enabled != conf_is_ht(conf)) {
+                                ctx->ht.enabled = conf_is_ht(conf);
+                                ht_changed[ctx->ctxid] = true;
+                        }
+
+                        if (ctx->ht.enabled) {
+                                if (conf_is_ht40_minus(conf)) {
+                                        ctx->ht.extension_chan_offset =
+                                                IEEE80211_HT_PARAM_CHA_SEC_BELOW;
+                                        ctx->ht.is_40mhz = true;
+                                } else if (conf_is_ht40_plus(conf)) {
+                                        ctx->ht.extension_chan_offset =
+                                                IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
+                                        ctx->ht.is_40mhz = true;
+                                } else {
+                                        ctx->ht.extension_chan_offset =
+                                                IEEE80211_HT_PARAM_CHA_SEC_NONE;
+                                        ctx->ht.is_40mhz = false;
+                                }
+                        } else
+                                ctx->ht.is_40mhz = false;
+
+                        /*
+                         * Default to no protection. Protection mode will
+                         * later be set from BSS config in iwl_ht_conf
+                         */
+                        ctx->ht.protection = IEEE80211_HT_OP_MODE_PROTECTION_NONE;
+
+                        /* if we are switching from ht to 2.4 clear flags
+                         * from any ht related info since 2.4 does not
+                         * support ht */
+                        if (le16_to_cpu(ctx->staging.channel) !=
+                            channel->hw_value)
+                                ctx->staging.flags = 0;
+
+                        iwl_set_rxon_channel(priv, channel, ctx);
+                        iwl_set_rxon_ht(priv, &priv->current_ht_config);
+
+                        iwl_set_flags_for_band(priv, ctx, channel->band,
+                                               ctx->vif);
+                }
+
+                spin_unlock_irqrestore(&priv->lock, flags);
+
+                iwl_update_bcast_stations(priv);
+
+                /*
+                 * The list of supported rates and rate mask can be different
+                 * for each band; since the band may have changed, reset
+                 * the rate mask to what mac80211 lists.
+                 */
+                iwl_set_rate(priv);
+        }
+
+        if (changed & (IEEE80211_CONF_CHANGE_PS |
+                        IEEE80211_CONF_CHANGE_IDLE)) {
+                ret = iwl_power_update_mode(priv, false);
+                if (ret)
+                        IWL_DEBUG_MAC80211(priv, "Error setting sleep level\n");
+        }
+
+        if (changed & IEEE80211_CONF_CHANGE_POWER) {
+                IWL_DEBUG_MAC80211(priv, "TX Power old=%d new=%d\n",
+                        priv->tx_power_user_lmt, conf->power_level);
+
+                iwl_set_tx_power(priv, conf->power_level, false);
+        }
+
+        for_each_context(priv, ctx) {
+                if (!memcmp(&ctx->staging, &ctx->active, sizeof(ctx->staging)))
+                        continue;
+                iwlagn_commit_rxon(priv, ctx);
+                if (ht_changed[ctx->ctxid])
+                        iwlagn_update_qos(priv, ctx);
+        }
+ out:
+        mutex_unlock(&priv->mutex);
+        return ret;
+}
+
+static void iwlagn_check_needed_chains(struct iwl_priv *priv,
+                                       struct iwl_rxon_context *ctx,
+                                       struct ieee80211_bss_conf *bss_conf)
+{
+        struct ieee80211_vif *vif = ctx->vif;
+        struct iwl_rxon_context *tmp;
+        struct ieee80211_sta *sta;
+        struct iwl_ht_config *ht_conf = &priv->current_ht_config;
+        bool need_multiple;
+
+        lockdep_assert_held(&priv->mutex);
+
+        switch (vif->type) {
+        case NL80211_IFTYPE_STATION:
+                rcu_read_lock();
+                sta = ieee80211_find_sta(vif, bss_conf->bssid);
+                if (sta) {
+                        struct ieee80211_sta_ht_cap *ht_cap = &sta->ht_cap;
+                        int maxstreams;
+
+                        maxstreams = (ht_cap->mcs.tx_params &
+                                      IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK)
+                                        >> IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT;
+                        maxstreams += 1;
+
+                        need_multiple = true;
+
+                        if ((ht_cap->mcs.rx_mask[1] == 0) &&
+                            (ht_cap->mcs.rx_mask[2] == 0))
+                                need_multiple = false;
+                        if (maxstreams <= 1)
+                                need_multiple = false;
+                } else {
+                        /*
+                         * If at all, this can only happen through a race
+                         * when the AP disconnects us while we're still
+                         * setting up the connection, in that case mac80211
+                         * will soon tell us about that.
+                         */
+                        need_multiple = false;
+                }
+                rcu_read_unlock();
+                break;
+        case NL80211_IFTYPE_ADHOC:
+                /* currently */
+                need_multiple = false;
+                break;
+        default:
+                /* only AP really */
+                need_multiple = true;
+                break;
+        }
+
+        ctx->ht_need_multiple_chains = need_multiple;
+
+        if (!need_multiple) {
+                /* check all contexts */
+                for_each_context(priv, tmp) {
+                        if (!tmp->vif)
+                                continue;
+                        if (tmp->ht_need_multiple_chains) {
+                                need_multiple = true;
+                                break;
+                        }
+                }
+        }
+
+        ht_conf->single_chain_sufficient = !need_multiple;
+}
+
+void iwlagn_bss_info_changed(struct ieee80211_hw *hw,
+                             struct ieee80211_vif *vif,
+                             struct ieee80211_bss_conf *bss_conf,
+                             u32 changes)
+{
+        struct iwl_priv *priv = hw->priv;
+        struct iwl_rxon_context *ctx = iwl_rxon_ctx_from_vif(vif);
+        int ret;
+        bool force = false;
+
+        mutex_lock(&priv->mutex);
+
+        if (WARN_ON(!ctx->vif)) {
+                mutex_unlock(&priv->mutex);
+                return;
+        }
+
+        if (changes & BSS_CHANGED_BEACON_INT)
+                force = true;
+
+        if (changes & BSS_CHANGED_QOS) {
+                ctx->qos_data.qos_active = bss_conf->qos;
+                iwlagn_update_qos(priv, ctx);
+        }
+
+        ctx->staging.assoc_id = cpu_to_le16(vif->bss_conf.aid);
+        if (vif->bss_conf.use_short_preamble)
+                ctx->staging.flags |= RXON_FLG_SHORT_PREAMBLE_MSK;
+        else
+                ctx->staging.flags &= ~RXON_FLG_SHORT_PREAMBLE_MSK;
+
+        if (changes & BSS_CHANGED_ASSOC) {
+                if (bss_conf->assoc) {
+                        iwl_led_associate(priv);
+                        priv->timestamp = bss_conf->timestamp;
+                        ctx->staging.filter_flags |= RXON_FILTER_ASSOC_MSK;
+                } else {
+                        ctx->staging.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
+                        iwl_led_disassociate(priv);
+                }
+        }
+
+        if (ctx->ht.enabled) {
+                ctx->ht.protection = bss_conf->ht_operation_mode &
+                                        IEEE80211_HT_OP_MODE_PROTECTION;
+                ctx->ht.non_gf_sta_present = !!(bss_conf->ht_operation_mode &
+                                        IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT);
+                iwlagn_check_needed_chains(priv, ctx, bss_conf);
+                iwl_set_rxon_ht(priv, &priv->current_ht_config);
+        }
+
+        if (priv->cfg->ops->hcmd->set_rxon_chain)
+                priv->cfg->ops->hcmd->set_rxon_chain(priv, ctx);
+
+        if (bss_conf->use_cts_prot && (priv->band != IEEE80211_BAND_5GHZ))
+                ctx->staging.flags |= RXON_FLG_TGG_PROTECT_MSK;
+        else
+                ctx->staging.flags &= ~RXON_FLG_TGG_PROTECT_MSK;
+
+        if (bss_conf->use_cts_prot)
+                ctx->staging.flags |= RXON_FLG_SELF_CTS_EN;
+        else
+                ctx->staging.flags &= ~RXON_FLG_SELF_CTS_EN;
+
+        memcpy(ctx->staging.bssid_addr, bss_conf->bssid, ETH_ALEN);
+
+        if (vif->type == NL80211_IFTYPE_AP ||
+            vif->type == NL80211_IFTYPE_ADHOC) {
+                if (vif->bss_conf.enable_beacon) {
+                        ctx->staging.filter_flags |= RXON_FILTER_ASSOC_MSK;
+                        priv->beacon_ctx = ctx;
+                } else {
+                        ctx->staging.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
+                        priv->beacon_ctx = NULL;
+                }
+        }
+
+        if (force || memcmp(&ctx->staging, &ctx->active, sizeof(ctx->staging)))
+                iwlagn_commit_rxon(priv, ctx);
+
+        if (changes & BSS_CHANGED_ASSOC && bss_conf->assoc) {
+                /*
+                 * The chain noise calibration will enable PM upon
+                 * completion. If calibration has already been run
+                 * then we need to enable power management here.
+                 */
+                if (priv->chain_noise_data.state == IWL_CHAIN_NOISE_DONE)
+                        iwl_power_update_mode(priv, false);
+
+                /* Enable RX differential gain and sensitivity calibrations */
+                iwl_chain_noise_reset(priv);
+                priv->start_calib = 1;
+        }
+
+        if (changes & BSS_CHANGED_IBSS) {
+                ret = iwlagn_manage_ibss_station(priv, vif,
+                                                 bss_conf->ibss_joined);
+                if (ret)
+                        IWL_ERR(priv, "failed to %s IBSS station %pM\n",
+                                bss_conf->ibss_joined ? "add" : "remove",
+                                bss_conf->bssid);
+        }
+
+        if (changes & BSS_CHANGED_BEACON && vif->type == NL80211_IFTYPE_ADHOC &&
+            priv->beacon_ctx) {
+                if (iwlagn_update_beacon(priv, vif))
+                        IWL_ERR(priv, "Error sending IBSS beacon\n");
+        }
+
+        mutex_unlock(&priv->mutex);
+}
+
+void iwlagn_post_scan(struct iwl_priv *priv)
+{
+        struct iwl_rxon_context *ctx;
+
+        /*
+         * Since setting the RXON may have been deferred while
+         * performing the scan, fire one off if needed
+         */
+        for_each_context(priv, ctx)
+                if (memcmp(&ctx->staging, &ctx->active, sizeof(ctx->staging)))
+                        iwlagn_commit_rxon(priv, ctx);
+
+        if (priv->cfg->ops->hcmd->set_pan_params)
+                priv->cfg->ops->hcmd->set_pan_params(priv);
+}
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-sta.c b/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
index 35a30d2e073..35f085ac336 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
@@ -684,7 +684,7 @@ int iwl_sta_rx_agg_stop(struct iwl_priv *priv, struct ieee80211_sta *sta,
         return iwl_send_add_sta(priv, &sta_cmd, CMD_SYNC);
 }
 
-void iwl_sta_modify_ps_wake(struct iwl_priv *priv, int sta_id)
+static void iwl_sta_modify_ps_wake(struct iwl_priv *priv, int sta_id)
 {
         unsigned long flags;
 
@@ -714,3 +714,33 @@ void iwl_sta_modify_sleep_tx_count(struct iwl_priv *priv, int sta_id, int cnt)
         spin_unlock_irqrestore(&priv->sta_lock, flags);
 
 }
+
+void iwlagn_mac_sta_notify(struct ieee80211_hw *hw,
+                           struct ieee80211_vif *vif,
+                           enum sta_notify_cmd cmd,
+                           struct ieee80211_sta *sta)
+{
+        struct iwl_priv *priv = hw->priv;
+        struct iwl_station_priv *sta_priv = (void *)sta->drv_priv;
+        int sta_id;
+
+        switch (cmd) {
+        case STA_NOTIFY_SLEEP:
+                WARN_ON(!sta_priv->client);
+                sta_priv->asleep = true;
+                if (atomic_read(&sta_priv->pending_frames) > 0)
+                        ieee80211_sta_block_awake(hw, sta, true);
+                break;
+        case STA_NOTIFY_AWAKE:
+                WARN_ON(!sta_priv->client);
+                if (!sta_priv->asleep)
+                        break;
+                sta_priv->asleep = false;
+                sta_id = iwl_sta_id(sta);
+                if (sta_id != IWL_INVALID_STATION)
+                        iwl_sta_modify_ps_wake(priv, sta_id);
+                break;
+        default:
+                break;
+        }
+}
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
index 2b078a99572..07bbc915529 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
@@ -518,11 +518,11 @@ int iwlagn_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         struct iwl_cmd_meta *out_meta;
         struct iwl_tx_cmd *tx_cmd;
         struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
-        int swq_id, txq_id;
+        int txq_id;
         dma_addr_t phys_addr;
         dma_addr_t txcmd_phys;
         dma_addr_t scratch_phys;
-        u16 len, len_org, firstlen, secondlen;
+        u16 len, firstlen, secondlen;
         u16 seq_number = 0;
         __le16 fc;
         u8 hdr_len;
@@ -620,7 +620,6 @@ int iwlagn_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         }
 
         txq = &priv->txq[txq_id];
-        swq_id = txq->swq_id;
         q = &txq->q;
 
         if (unlikely(iwl_queue_space(q) < q->high_mark)) {
@@ -687,30 +686,23 @@ int iwlagn_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
          */
         len = sizeof(struct iwl_tx_cmd) +
                 sizeof(struct iwl_cmd_header) + hdr_len;
-
-        len_org = len;
-        firstlen = len = (len + 3) & ~3;
-
-        if (len_org != len)
-                len_org = 1;
-        else
-                len_org = 0;
+        firstlen = (len + 3) & ~3;
 
         /* Tell NIC about any 2-byte padding after MAC header */
-        if (len_org)
+        if (firstlen != len)
                 tx_cmd->tx_flags |= TX_CMD_FLG_MH_PAD_MSK;
 
         /* Physical address of this Tx command's header (not MAC header!),
          * within command buffer array. */
         txcmd_phys = pci_map_single(priv->pci_dev,
-                                    &out_cmd->hdr, len,
+                                    &out_cmd->hdr, firstlen,
                                     PCI_DMA_BIDIRECTIONAL);
         dma_unmap_addr_set(out_meta, mapping, txcmd_phys);
-        dma_unmap_len_set(out_meta, len, len);
+        dma_unmap_len_set(out_meta, len, firstlen);
         /* Add buffer containing Tx command and MAC(!) header to TFD's
          * first entry */
         priv->cfg->ops->lib->txq_attach_buf_to_tfd(priv, txq,
-                                                   txcmd_phys, len, 1, 0);
+                                                   txcmd_phys, firstlen, 1, 0);
 
         if (!ieee80211_has_morefrags(hdr->frame_control)) {
                 txq->need_update = 1;
@@ -721,23 +713,21 @@ int iwlagn_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
 
         /* Set up TFD's 2nd entry to point directly to remainder of skb,
          * if any (802.11 null frames have no payload). */
-        secondlen = len = skb->len - hdr_len;
-        if (len) {
+        secondlen = skb->len - hdr_len;
+        if (secondlen > 0) {
                 phys_addr = pci_map_single(priv->pci_dev, skb->data + hdr_len,
-                                           len, PCI_DMA_TODEVICE);
+                                           secondlen, PCI_DMA_TODEVICE);
                 priv->cfg->ops->lib->txq_attach_buf_to_tfd(priv, txq,
-                                                           phys_addr, len,
+                                                           phys_addr, secondlen,
                                                            0, 0);
         }
 
         scratch_phys = txcmd_phys + sizeof(struct iwl_cmd_header) +
                                 offsetof(struct iwl_tx_cmd, scratch);
 
-        len = sizeof(struct iwl_tx_cmd) +
-                sizeof(struct iwl_cmd_header) + hdr_len;
         /* take back ownership of DMA buffer to enable update */
         pci_dma_sync_single_for_cpu(priv->pci_dev, txcmd_phys,
-                                    len, PCI_DMA_BIDIRECTIONAL);
+                                    firstlen, PCI_DMA_BIDIRECTIONAL);
         tx_cmd->dram_lsb_ptr = cpu_to_le32(scratch_phys);
         tx_cmd->dram_msb_ptr = iwl_get_dma_hi_addr(scratch_phys);
 
@@ -753,7 +743,7 @@ int iwlagn_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
                                                      le16_to_cpu(tx_cmd->len));
 
         pci_dma_sync_single_for_device(priv->pci_dev, txcmd_phys,
-                                       len, PCI_DMA_BIDIRECTIONAL);
+                                       firstlen, PCI_DMA_BIDIRECTIONAL);
 
         trace_iwlwifi_dev_tx(priv,
                              &((struct iwl_tfd *)txq->tfds)[txq->q.write_ptr],
@@ -784,7 +774,7 @@ int iwlagn_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
                         iwl_txq_update_write_ptr(priv, txq);
                         spin_unlock_irqrestore(&priv->lock, flags);
                 } else {
-                        iwl_stop_queue(priv, txq->swq_id);
+                        iwl_stop_queue(priv, txq);
                 }
         }
 
@@ -1013,7 +1003,7 @@ int iwlagn_tx_agg_start(struct iwl_priv *priv, struct ieee80211_vif *vif,
         tid_data = &priv->stations[sta_id].tid[tid];
         *ssn = SEQ_TO_SN(tid_data->seq_number);
         tid_data->agg.txq_id = txq_id;
-        priv->txq[txq_id].swq_id = iwl_virtual_agg_queue_num(get_ac_from_tid(tid), txq_id);
+        iwl_set_swq_id(&priv->txq[txq_id], get_ac_from_tid(tid), txq_id);
         spin_unlock_irqrestore(&priv->sta_lock, flags);
 
         ret = priv->cfg->ops->lib->txq_agg_enable(priv, txq_id, tx_fifo,
@@ -1241,37 +1231,61 @@ static int iwlagn_tx_status_reply_compressed_ba(struct iwl_priv *priv,
         if (sh < 0) /* tbw something is wrong with indices */
                 sh += 0x100;
 
-        /* don't use 64-bit values for now */
-        bitmap = le64_to_cpu(ba_resp->bitmap) >> sh;
-
         if (agg->frame_count > (64 - sh)) {
                 IWL_DEBUG_TX_REPLY(priv, "more frames than bitmap size");
                 return -1;
         }
-
-        /* check for success or failure according to the
-         * transmitted bitmap and block-ack bitmap */
-        sent_bitmap = bitmap & agg->bitmap;
-
-        /* For each frame attempted in aggregation,
-         * update driver's record of tx frame's status. */
-        i = 0;
-        while (sent_bitmap) {
-                ack = sent_bitmap & 1ULL;
-                successes += ack;
-                IWL_DEBUG_TX_REPLY(priv, "%s ON i=%d idx=%d raw=%d\n",
-                        ack ? "ACK" : "NACK", i, (agg->start_idx + i) & 0xff,
-                        agg->start_idx + i);
-                sent_bitmap >>= 1;
-                ++i;
+        if (!priv->cfg->base_params->no_agg_framecnt_info && ba_resp->txed) {
+                /*
+                 * sent and ack information provided by uCode
+                 * use it instead of figure out ourself
+                 */
+                if (ba_resp->txed_2_done > ba_resp->txed) {
+                        IWL_DEBUG_TX_REPLY(priv,
+                                "bogus sent(%d) and ack(%d) count\n",
+                                ba_resp->txed, ba_resp->txed_2_done);
+                        /*
+                         * set txed_2_done = txed,
+                         * so it won't impact rate scale
+                         */
+                        ba_resp->txed = ba_resp->txed_2_done;
+                }
+                IWL_DEBUG_HT(priv, "agg frames sent:%d, acked:%d\n",
+                                ba_resp->txed, ba_resp->txed_2_done);
+        } else {
+                /* don't use 64-bit values for now */
+                bitmap = le64_to_cpu(ba_resp->bitmap) >> sh;
+
+                /* check for success or failure according to the
+                 * transmitted bitmap and block-ack bitmap */
+                sent_bitmap = bitmap & agg->bitmap;
+
+                /* For each frame attempted in aggregation,
+                 * update driver's record of tx frame's status. */
+                i = 0;
+                while (sent_bitmap) {
+                        ack = sent_bitmap & 1ULL;
+                        successes += ack;
+                        IWL_DEBUG_TX_REPLY(priv, "%s ON i=%d idx=%d raw=%d\n",
+                                ack ? "ACK" : "NACK", i,
+                                (agg->start_idx + i) & 0xff,
+                                agg->start_idx + i);
+                        sent_bitmap >>= 1;
+                        ++i;
+                }
         }
-
         info = IEEE80211_SKB_CB(priv->txq[scd_flow].txb[agg->start_idx].skb);
         memset(&info->status, 0, sizeof(info->status));
         info->flags |= IEEE80211_TX_STAT_ACK;
         info->flags |= IEEE80211_TX_STAT_AMPDU;
-        info->status.ampdu_ack_len = successes;
-        info->status.ampdu_len = agg->frame_count;
+        if (!priv->cfg->base_params->no_agg_framecnt_info && ba_resp->txed) {
+                info->status.ampdu_ack_len = ba_resp->txed_2_done;
+                info->status.ampdu_len = ba_resp->txed;
+
+        } else {
+                info->status.ampdu_ack_len = successes;
+                info->status.ampdu_len = agg->frame_count;
+        }
         iwlagn_hwrate_to_tx_control(priv, agg->rate_n_flags, info);
 
         IWL_DEBUG_TX_REPLY(priv, "Bitmap %llx\n", (unsigned long long)bitmap);
@@ -1385,7 +1399,7 @@ void iwlagn_rx_reply_compressed_ba(struct iwl_priv *priv,
                 if ((iwl_queue_space(&txq->q) > txq->q.low_mark) &&
                     priv->mac80211_registered &&
                     (agg->state != IWL_EMPTYING_HW_QUEUE_DELBA))
-                        iwl_wake_queue(priv, txq->swq_id);
+                        iwl_wake_queue(priv, txq);
 
                 iwlagn_txq_check_empty(priv, sta_id, tid, scd_flow);
         }
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c b/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c
index 703621107da..411a7a20450 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c
@@ -40,30 +40,36 @@
 #include "iwl-agn.h"
 #include "iwl-agn-calib.h"
 
-static const s8 iwlagn_default_queue_to_tx_fifo[] = {
-        IWL_TX_FIFO_VO,
-        IWL_TX_FIFO_VI,
-        IWL_TX_FIFO_BE,
-        IWL_TX_FIFO_BK,
-        IWLAGN_CMD_FIFO_NUM,
-        IWL_TX_FIFO_UNUSED,
-        IWL_TX_FIFO_UNUSED,
-        IWL_TX_FIFO_UNUSED,
-        IWL_TX_FIFO_UNUSED,
-        IWL_TX_FIFO_UNUSED,
+#define IWL_AC_UNSET -1
+
+struct queue_to_fifo_ac {
+        s8 fifo, ac;
+};
+
+static const struct queue_to_fifo_ac iwlagn_default_queue_to_tx_fifo[] = {
+        { IWL_TX_FIFO_VO, 0, },
+        { IWL_TX_FIFO_VI, 1, },
+        { IWL_TX_FIFO_BE, 2, },
+        { IWL_TX_FIFO_BK, 3, },
+        { IWLAGN_CMD_FIFO_NUM, IWL_AC_UNSET, },
+        { IWL_TX_FIFO_UNUSED, IWL_AC_UNSET, },
+        { IWL_TX_FIFO_UNUSED, IWL_AC_UNSET, },
+        { IWL_TX_FIFO_UNUSED, IWL_AC_UNSET, },
+        { IWL_TX_FIFO_UNUSED, IWL_AC_UNSET, },
+        { IWL_TX_FIFO_UNUSED, IWL_AC_UNSET, },
 };
 
-static const s8 iwlagn_ipan_queue_to_tx_fifo[] = {
-        IWL_TX_FIFO_VO,
-        IWL_TX_FIFO_VI,
-        IWL_TX_FIFO_BE,
-        IWL_TX_FIFO_BK,
-        IWL_TX_FIFO_BK_IPAN,
-        IWL_TX_FIFO_BE_IPAN,
-        IWL_TX_FIFO_VI_IPAN,
-        IWL_TX_FIFO_VO_IPAN,
-        IWL_TX_FIFO_BE_IPAN,
-        IWLAGN_CMD_FIFO_NUM,
+static const struct queue_to_fifo_ac iwlagn_ipan_queue_to_tx_fifo[] = {
+        { IWL_TX_FIFO_VO, 0, },
+        { IWL_TX_FIFO_VI, 1, },
+        { IWL_TX_FIFO_BE, 2, },
+        { IWL_TX_FIFO_BK, 3, },
+        { IWL_TX_FIFO_BK_IPAN, 3, },
+        { IWL_TX_FIFO_BE_IPAN, 2, },
+        { IWL_TX_FIFO_VI_IPAN, 1, },
+        { IWL_TX_FIFO_VO_IPAN, 0, },
+        { IWL_TX_FIFO_BE_IPAN, 2, },
+        { IWLAGN_CMD_FIFO_NUM, IWL_AC_UNSET, },
 };
 
 static struct iwl_wimax_coex_event_entry cu_priorities[COEX_NUM_OF_EVENTS] = {
@@ -429,7 +435,7 @@ void iwlagn_send_bt_env(struct iwl_priv *priv, u8 action, u8 type)
 
 int iwlagn_alive_notify(struct iwl_priv *priv)
 {
-        const s8 *queues;
+        const struct queue_to_fifo_ac *queue_to_fifo;
         u32 a;
         unsigned long flags;
         int i, chan;
@@ -492,9 +498,9 @@ int iwlagn_alive_notify(struct iwl_priv *priv)
 
         /* map queues to FIFOs */
         if (priv->valid_contexts != BIT(IWL_RXON_CTX_BSS))
-                queues = iwlagn_ipan_queue_to_tx_fifo;
+                queue_to_fifo = iwlagn_ipan_queue_to_tx_fifo;
         else
-                queues = iwlagn_default_queue_to_tx_fifo;
+                queue_to_fifo = iwlagn_default_queue_to_tx_fifo;
 
         iwlagn_set_wr_ptrs(priv, priv->cmd_queue, 0);
 
@@ -510,14 +516,17 @@ int iwlagn_alive_notify(struct iwl_priv *priv)
         BUILD_BUG_ON(ARRAY_SIZE(iwlagn_ipan_queue_to_tx_fifo) != 10);
 
         for (i = 0; i < 10; i++) {
-                int ac = queues[i];
+                int fifo = queue_to_fifo[i].fifo;
+                int ac = queue_to_fifo[i].ac;
 
                 iwl_txq_ctx_activate(priv, i);
 
-                if (ac == IWL_TX_FIFO_UNUSED)
+                if (fifo == IWL_TX_FIFO_UNUSED)
                         continue;
 
-                iwlagn_tx_queue_set_status(priv, &priv->txq[i], ac, 0);
+                if (ac != IWL_AC_UNSET)
+                        iwl_set_swq_id(&priv->txq[i], ac, i);
+                iwlagn_tx_queue_set_status(priv, &priv->txq[i], fifo, 0);
         }
 
         spin_unlock_irqrestore(&priv->lock, flags);
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index c2636a7ab9e..5b96b0d8009 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -90,170 +90,6 @@ MODULE_ALIAS("iwl4965");
 static int iwlagn_ant_coupling;
 static bool iwlagn_bt_ch_announce = 1;
 
-/**
- * iwlagn_commit_rxon - commit staging_rxon to hardware
- *
- * The RXON command in staging_rxon is committed to the hardware and
- * the active_rxon structure is updated with the new data.  This
- * function correctly transitions out of the RXON_ASSOC_MSK state if
- * a HW tune is required based on the RXON structure changes.
- */
-int iwlagn_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
-{
-        /* cast away the const for active_rxon in this function */
-        struct iwl_rxon_cmd *active_rxon = (void *)&ctx->active;
-        int ret;
-        bool new_assoc =
-                !!(ctx->staging.filter_flags & RXON_FILTER_ASSOC_MSK);
-        bool old_assoc = !!(ctx->active.filter_flags & RXON_FILTER_ASSOC_MSK);
-
-        if (!iwl_is_alive(priv))
-                return -EBUSY;
-
-        if (!ctx->is_active)
-                return 0;
-
-        /* always get timestamp with Rx frame */
-        ctx->staging.flags |= RXON_FLG_TSF2HOST_MSK;
-
-        ret = iwl_check_rxon_cmd(priv, ctx);
-        if (ret) {
-                IWL_ERR(priv, "Invalid RXON configuration.  Not committing.\n");
-                return -EINVAL;
-        }
-
-        /*
-         * receive commit_rxon request
-         * abort any previous channel switch if still in process
-         */
-        if (priv->switch_rxon.switch_in_progress &&
-            (priv->switch_rxon.channel != ctx->staging.channel)) {
-                IWL_DEBUG_11H(priv, "abort channel switch on %d\n",
-                      le16_to_cpu(priv->switch_rxon.channel));
-                iwl_chswitch_done(priv, false);
-        }
-
-        /* If we don't need to send a full RXON, we can use
-         * iwl_rxon_assoc_cmd which is used to reconfigure filter
-         * and other flags for the current radio configuration. */
-        if (!iwl_full_rxon_required(priv, ctx)) {
-                ret = iwl_send_rxon_assoc(priv, ctx);
-                if (ret) {
-                        IWL_ERR(priv, "Error setting RXON_ASSOC (%d)\n", ret);
-                        return ret;
-                }
-
-                memcpy(active_rxon, &ctx->staging, sizeof(*active_rxon));
-                iwl_print_rx_config_cmd(priv, ctx);
-                return 0;
-        }
-
-        /* If we are currently associated and the new config requires
-         * an RXON_ASSOC and the new config wants the associated mask enabled,
-         * we must clear the associated from the active configuration
-         * before we apply the new config */
-        if (iwl_is_associated_ctx(ctx) && new_assoc) {
-                IWL_DEBUG_INFO(priv, "Toggling associated bit on current RXON\n");
-                active_rxon->filter_flags &= ~RXON_FILTER_ASSOC_MSK;
-
-                ret = iwl_send_cmd_pdu(priv, ctx->rxon_cmd,
-                                       sizeof(struct iwl_rxon_cmd),
-                                       active_rxon);
-
-                /* If the mask clearing failed then we set
-                 * active_rxon back to what it was previously */
-                if (ret) {
-                        active_rxon->filter_flags |= RXON_FILTER_ASSOC_MSK;
-                        IWL_ERR(priv, "Error clearing ASSOC_MSK (%d)\n", ret);
-                        return ret;
-                }
-                iwl_clear_ucode_stations(priv, ctx);
-                iwl_restore_stations(priv, ctx);
-                ret = iwl_restore_default_wep_keys(priv, ctx);
-                if (ret) {
-                        IWL_ERR(priv, "Failed to restore WEP keys (%d)\n", ret);
-                        return ret;
-                }
-        }
-
-        IWL_DEBUG_INFO(priv, "Sending RXON\n"
-                       "* with%s RXON_FILTER_ASSOC_MSK\n"
-                       "* channel = %d\n"
-                       "* bssid = %pM\n",
-                       (new_assoc ? "" : "out"),
-                       le16_to_cpu(ctx->staging.channel),
-                       ctx->staging.bssid_addr);
-
-        iwl_set_rxon_hwcrypto(priv, ctx, !priv->cfg->mod_params->sw_crypto);
-
-        if (!old_assoc) {
-                /*
-                 * First of all, before setting associated, we need to
-                 * send RXON timing so the device knows about the DTIM
-                 * period and other timing values
-                 */
-                ret = iwl_send_rxon_timing(priv, ctx);
-                if (ret) {
-                        IWL_ERR(priv, "Error setting RXON timing!\n");
-                        return ret;
-                }
-        }
-
-        if (priv->cfg->ops->hcmd->set_pan_params) {
-                ret = priv->cfg->ops->hcmd->set_pan_params(priv);
-                if (ret)
-                        return ret;
-        }
-
-        /* Apply the new configuration
-         * RXON unassoc clears the station table in uCode so restoration of
-         * stations is needed after it (the RXON command) completes
-         */
-        if (!new_assoc) {
-                ret = iwl_send_cmd_pdu(priv, ctx->rxon_cmd,
-                              sizeof(struct iwl_rxon_cmd), &ctx->staging);
-                if (ret) {
-                        IWL_ERR(priv, "Error setting new RXON (%d)\n", ret);
-                        return ret;
-                }
-                IWL_DEBUG_INFO(priv, "Return from !new_assoc RXON.\n");
-                memcpy(active_rxon, &ctx->staging, sizeof(*active_rxon));
-                iwl_clear_ucode_stations(priv, ctx);
-                iwl_restore_stations(priv, ctx);
-                ret = iwl_restore_default_wep_keys(priv, ctx);
-                if (ret) {
-                        IWL_ERR(priv, "Failed to restore WEP keys (%d)\n", ret);
-                        return ret;
-                }
-        }
-        if (new_assoc) {
-                priv->start_calib = 0;
-                /* Apply the new configuration
-                 * RXON assoc doesn't clear the station table in uCode,
-                 */
-                ret = iwl_send_cmd_pdu(priv, ctx->rxon_cmd,
-                              sizeof(struct iwl_rxon_cmd), &ctx->staging);
-                if (ret) {
-                        IWL_ERR(priv, "Error setting new RXON (%d)\n", ret);
-                        return ret;
-                }
-                memcpy(active_rxon, &ctx->staging, sizeof(*active_rxon));
-        }
-        iwl_print_rx_config_cmd(priv, ctx);
-
-        iwl_init_sensitivity(priv);
-
-        /* If we issue a new RXON command which required a tune then we must
-         * send a new TXPOWER command or we won't be able to Tx any frames */
-        ret = iwl_set_tx_power(priv, priv->tx_power_user_lmt, true);
-        if (ret) {
-                IWL_ERR(priv, "Error sending TX power (%d)\n", ret);
-                return ret;
-        }
-
-        return 0;
-}
-
 void iwl_update_chain_flags(struct iwl_priv *priv)
 {
         struct iwl_rxon_context *ctx;
@@ -261,7 +97,8 @@ void iwl_update_chain_flags(struct iwl_priv *priv)
         if (priv->cfg->ops->hcmd->set_rxon_chain) {
                 for_each_context(priv, ctx) {
                         priv->cfg->ops->hcmd->set_rxon_chain(priv, ctx);
-                        iwlcore_commit_rxon(priv, ctx);
+                        if (ctx->active.rx_chain != ctx->staging.rx_chain)
+                                iwlcore_commit_rxon(priv, ctx);
                 }
         }
 }
@@ -411,7 +248,8 @@ static unsigned int iwl_hw_get_beacon_cmd(struct iwl_priv *priv,
 
         return sizeof(*tx_beacon_cmd) + frame_size;
 }
-static int iwl_send_beacon_cmd(struct iwl_priv *priv)
+
+int iwlagn_send_beacon_cmd(struct iwl_priv *priv)
 {
         struct iwl_frame *frame;
         unsigned int frame_size;
@@ -661,7 +499,7 @@ static void iwl_bg_beacon_update(struct work_struct *work)
 
         priv->beacon_skb = beacon;
 
-        iwl_send_beacon_cmd(priv);
+        iwlagn_send_beacon_cmd(priv);
  out:
         mutex_unlock(&priv->mutex);
 }
@@ -2879,6 +2717,8 @@ static void iwl_alive_start(struct iwl_priv *priv)
 
         iwl_reset_run_time_calib(priv);
 
+        set_bit(STATUS_READY, &priv->status);
+
         /* Configure the adapter for unassociated operation */
         iwlcore_commit_rxon(priv, ctx);
 
@@ -2888,7 +2728,6 @@ static void iwl_alive_start(struct iwl_priv *priv)
         iwl_leds_init(priv);
 
         IWL_DEBUG_INFO(priv, "ALIVE processing complete.\n");
-        set_bit(STATUS_READY, &priv->status);
         wake_up_interruptible(&priv->wait_command_queue);
 
         iwl_power_update_mode(priv, true);
@@ -2978,7 +2817,8 @@ static void __iwl_down(struct iwl_priv *priv)
                                 STATUS_EXIT_PENDING;
 
         /* device going down, Stop using ICT table */
-        iwl_disable_ict(priv);
+        if (priv->cfg->ops->lib->isr_ops.disable)
+                priv->cfg->ops->lib->isr_ops.disable(priv);
 
         iwlagn_txq_ctx_stop(priv);
         iwlagn_rxq_stop(priv);
@@ -3201,7 +3041,8 @@ static void iwl_bg_alive_start(struct work_struct *data)
                 return;
 
         /* enable dram interrupt */
-        iwl_reset_ict(priv);
+        if (priv->cfg->ops->lib->isr_ops.reset)
+                priv->cfg->ops->lib->isr_ops.reset(priv);
 
         mutex_lock(&priv->mutex);
         iwl_alive_start(priv);
@@ -3309,92 +3150,6 @@ static void iwl_bg_rx_replenish(struct work_struct *data)
         mutex_unlock(&priv->mutex);
 }
 
-#define IWL_DELAY_NEXT_SCAN (HZ*2)
-
-void iwl_post_associate(struct iwl_priv *priv, struct ieee80211_vif *vif)
-{
-        struct iwl_rxon_context *ctx;
-        struct ieee80211_conf *conf = NULL;
-        int ret = 0;
-
-        if (!vif || !priv->is_open)
-                return;
-
-        ctx = iwl_rxon_ctx_from_vif(vif);
-
-        if (vif->type == NL80211_IFTYPE_AP) {
-                IWL_ERR(priv, "%s Should not be called in AP mode\n", __func__);
-                return;
-        }
-
-        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
-                return;
-
-        iwl_scan_cancel_timeout(priv, 200);
-
-        conf = ieee80211_get_hw_conf(priv->hw);
-
-        ctx->staging.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
-        iwlcore_commit_rxon(priv, ctx);
-
-        ret = iwl_send_rxon_timing(priv, ctx);
-        if (ret)
-                IWL_WARN(priv, "RXON timing - "
-                            "Attempting to continue.\n");
-
-        ctx->staging.filter_flags |= RXON_FILTER_ASSOC_MSK;
-
-        iwl_set_rxon_ht(priv, &priv->current_ht_config);
-
-        if (priv->cfg->ops->hcmd->set_rxon_chain)
-                priv->cfg->ops->hcmd->set_rxon_chain(priv, ctx);
-
-        ctx->staging.assoc_id = cpu_to_le16(vif->bss_conf.aid);
-
-        IWL_DEBUG_ASSOC(priv, "assoc id %d beacon interval %d\n",
-                        vif->bss_conf.aid, vif->bss_conf.beacon_int);
-
-        if (vif->bss_conf.use_short_preamble)
-                ctx->staging.flags |= RXON_FLG_SHORT_PREAMBLE_MSK;
-        else
-                ctx->staging.flags &= ~RXON_FLG_SHORT_PREAMBLE_MSK;
-
-        if (ctx->staging.flags & RXON_FLG_BAND_24G_MSK) {
-                if (vif->bss_conf.use_short_slot)
-                        ctx->staging.flags |= RXON_FLG_SHORT_SLOT_MSK;
-                else
-                        ctx->staging.flags &= ~RXON_FLG_SHORT_SLOT_MSK;
-        }
-
-        iwlcore_commit_rxon(priv, ctx);
-
-        IWL_DEBUG_ASSOC(priv, "Associated as %d to: %pM\n",
-                        vif->bss_conf.aid, ctx->active.bssid_addr);
-
-        switch (vif->type) {
-        case NL80211_IFTYPE_STATION:
-                break;
-        case NL80211_IFTYPE_ADHOC:
-                iwl_send_beacon_cmd(priv);
-                break;
-        default:
-                IWL_ERR(priv, "%s Should not be called in %d mode\n",
-                          __func__, vif->type);
-                break;
-        }
-
-        /* the chain noise calibration will enabled PM upon completion
-         * If chain noise has already been run, then we need to enable
-         * power management here */
-        if (priv->chain_noise_data.state == IWL_CHAIN_NOISE_DONE)
-                iwl_power_update_mode(priv, false);
-
-        /* Enable Rx differential gain and sensitivity calibrations */
-        iwl_chain_noise_reset(priv);
-        priv->start_calib = 1;
-
-}
-
 /*****************************************************************************
  *
  * mac80211 entry point functions
@@ -3474,7 +3229,7 @@ static int iwl_mac_setup_register(struct iwl_priv *priv,
 }
 
 
-static int iwl_mac_start(struct ieee80211_hw *hw)
+int iwlagn_mac_start(struct ieee80211_hw *hw)
 {
         struct iwl_priv *priv = hw->priv;
         int ret;
@@ -3515,7 +3270,7 @@ out:
         return 0;
 }
 
-static void iwl_mac_stop(struct ieee80211_hw *hw)
+void iwlagn_mac_stop(struct ieee80211_hw *hw)
 {
         struct iwl_priv *priv = hw->priv;
 
@@ -3537,7 +3292,7 @@ static void iwl_mac_stop(struct ieee80211_hw *hw)
         IWL_DEBUG_MAC80211(priv, "leave\n");
 }
 
-static int iwl_mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
+int iwlagn_mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
 {
         struct iwl_priv *priv = hw->priv;
 
@@ -3553,73 +3308,12 @@ static int iwl_mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
         return NETDEV_TX_OK;
 }
 
-void iwl_config_ap(struct iwl_priv *priv, struct ieee80211_vif *vif)
-{
-        struct iwl_rxon_context *ctx = iwl_rxon_ctx_from_vif(vif);
-        int ret = 0;
-
-        lockdep_assert_held(&priv->mutex);
-
-        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
-                return;
-
-        /* The following should be done only at AP bring up */
-        if (!iwl_is_associated_ctx(ctx)) {
-
-                /* RXON - unassoc (to set timing command) */
-                ctx->staging.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
-                iwlcore_commit_rxon(priv, ctx);
-
-                /* RXON Timing */
-                ret = iwl_send_rxon_timing(priv, ctx);
-                if (ret)
-                        IWL_WARN(priv, "RXON timing failed - "
-                                        "Attempting to continue.\n");
-
-                /* AP has all antennas */
-                priv->chain_noise_data.active_chains =
-                        priv->hw_params.valid_rx_ant;
-                iwl_set_rxon_ht(priv, &priv->current_ht_config);
-                if (priv->cfg->ops->hcmd->set_rxon_chain)
-                        priv->cfg->ops->hcmd->set_rxon_chain(priv, ctx);
-
-                ctx->staging.assoc_id = 0;
-
-                if (vif->bss_conf.use_short_preamble)
-                        ctx->staging.flags |=
-                                RXON_FLG_SHORT_PREAMBLE_MSK;
-                else
-                        ctx->staging.flags &=
-                                ~RXON_FLG_SHORT_PREAMBLE_MSK;
-
-                if (ctx->staging.flags & RXON_FLG_BAND_24G_MSK) {
-                        if (vif->bss_conf.use_short_slot)
-                                ctx->staging.flags |=
-                                        RXON_FLG_SHORT_SLOT_MSK;
-                        else
-                                ctx->staging.flags &=
-                                        ~RXON_FLG_SHORT_SLOT_MSK;
-                }
-                /* need to send beacon cmd before committing assoc RXON! */
-                iwl_send_beacon_cmd(priv);
-                /* restore RXON assoc */
-                ctx->staging.filter_flags |= RXON_FILTER_ASSOC_MSK;
-                iwlcore_commit_rxon(priv, ctx);
-        }
-        iwl_send_beacon_cmd(priv);
-
-        /* FIXME - we need to add code here to detect a totally new
-         * configuration, reset the AP, unassoc, rxon timing, assoc,
-         * clear sta table, add BCAST sta... */
-}
-
-static void iwl_mac_update_tkip_key(struct ieee80211_hw *hw,
-                                    struct ieee80211_vif *vif,
-                                    struct ieee80211_key_conf *keyconf,
-                                    struct ieee80211_sta *sta,
-                                    u32 iv32, u16 *phase1key)
+void iwlagn_mac_update_tkip_key(struct ieee80211_hw *hw,
+                                struct ieee80211_vif *vif,
+                                struct ieee80211_key_conf *keyconf,
+                                struct ieee80211_sta *sta,
+                                u32 iv32, u16 *phase1key)
 {
-
         struct iwl_priv *priv = hw->priv;
         struct iwl_vif_priv *vif_priv = (void *)vif->drv_priv;
 
@@ -3631,10 +3325,9 @@ static void iwl_mac_update_tkip_key(struct ieee80211_hw *hw,
         IWL_DEBUG_MAC80211(priv, "leave\n");
 }
 
-static int iwl_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
-                           struct ieee80211_vif *vif,
-                           struct ieee80211_sta *sta,
-                           struct ieee80211_key_conf *key)
+int iwlagn_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+                       struct ieee80211_vif *vif, struct ieee80211_sta *sta,
+                       struct ieee80211_key_conf *key)
 {
         struct iwl_priv *priv = hw->priv;
         struct iwl_vif_priv *vif_priv = (void *)vif->drv_priv;
@@ -3701,10 +3394,10 @@ static int iwl_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
         return ret;
 }
 
-static int iwl_mac_ampdu_action(struct ieee80211_hw *hw,
-                                struct ieee80211_vif *vif,
-                                enum ieee80211_ampdu_mlme_action action,
-                                struct ieee80211_sta *sta, u16 tid, u16 *ssn)
+int iwlagn_mac_ampdu_action(struct ieee80211_hw *hw,
+                            struct ieee80211_vif *vif,
+                            enum ieee80211_ampdu_mlme_action action,
+                            struct ieee80211_sta *sta, u16 tid, u16 *ssn)
 {
         struct iwl_priv *priv = hw->priv;
         int ret = -EINVAL;
@@ -3785,39 +3478,9 @@ static int iwl_mac_ampdu_action(struct ieee80211_hw *hw,
         return ret;
 }
 
-static void iwl_mac_sta_notify(struct ieee80211_hw *hw,
-                               struct ieee80211_vif *vif,
-                               enum sta_notify_cmd cmd,
-                               struct ieee80211_sta *sta)
-{
-        struct iwl_priv *priv = hw->priv;
-        struct iwl_station_priv *sta_priv = (void *)sta->drv_priv;
-        int sta_id;
-
-        switch (cmd) {
-        case STA_NOTIFY_SLEEP:
-                WARN_ON(!sta_priv->client);
-                sta_priv->asleep = true;
-                if (atomic_read(&sta_priv->pending_frames) > 0)
-                        ieee80211_sta_block_awake(hw, sta, true);
-                break;
-        case STA_NOTIFY_AWAKE:
-                WARN_ON(!sta_priv->client);
-                if (!sta_priv->asleep)
-                        break;
-                sta_priv->asleep = false;
-                sta_id = iwl_sta_id(sta);
-                if (sta_id != IWL_INVALID_STATION)
-                        iwl_sta_modify_ps_wake(priv, sta_id);
-                break;
-        default:
-                break;
-        }
-}
-
-static int iwlagn_mac_sta_add(struct ieee80211_hw *hw,
-                              struct ieee80211_vif *vif,
-                              struct ieee80211_sta *sta)
+int iwlagn_mac_sta_add(struct ieee80211_hw *hw,
+                       struct ieee80211_vif *vif,
+                       struct ieee80211_sta *sta)
 {
         struct iwl_priv *priv = hw->priv;
         struct iwl_station_priv *sta_priv = (void *)sta->drv_priv;
@@ -3858,8 +3521,8 @@ static int iwlagn_mac_sta_add(struct ieee80211_hw *hw,
         return 0;
 }
 
-static void iwl_mac_channel_switch(struct ieee80211_hw *hw,
-                                   struct ieee80211_channel_switch *ch_switch)
+void iwlagn_mac_channel_switch(struct ieee80211_hw *hw,
+                               struct ieee80211_channel_switch *ch_switch)
 {
         struct iwl_priv *priv = hw->priv;
         const struct iwl_channel_info *ch_info;
@@ -3956,10 +3619,10 @@ out_exit:
         IWL_DEBUG_MAC80211(priv, "leave\n");
 }
 
-static void iwlagn_configure_filter(struct ieee80211_hw *hw,
-                                    unsigned int changed_flags,
-                                    unsigned int *total_flags,
-                                    u64 multicast)
+void iwlagn_configure_filter(struct ieee80211_hw *hw,
+                             unsigned int changed_flags,
+                             unsigned int *total_flags,
+                             u64 multicast)
 {
         struct iwl_priv *priv = hw->priv;
         __le32 filter_or = 0, filter_nand = 0;
@@ -3986,7 +3649,11 @@ static void iwlagn_configure_filter(struct ieee80211_hw *hw,
         for_each_context(priv, ctx) {
                 ctx->staging.filter_flags &= ~filter_nand;
                 ctx->staging.filter_flags |= filter_or;
-                iwlcore_commit_rxon(priv, ctx);
+
+                /*
+                 * Not committing directly because hardware can perform a scan,
+                 * but we'll eventually commit the filter flags change anyway.
+                 */
         }
 
         mutex_unlock(&priv->mutex);
@@ -4001,7 +3668,7 @@ static void iwlagn_configure_filter(struct ieee80211_hw *hw,
                         FIF_BCN_PRBRESP_PROMISC | FIF_CONTROL;
 }
 
-static void iwl_mac_flush(struct ieee80211_hw *hw, bool drop)
+void iwlagn_mac_flush(struct ieee80211_hw *hw, bool drop)
 {
         struct iwl_priv *priv = hw->priv;
 
@@ -4172,13 +3839,13 @@ static int iwl_init_drv(struct iwl_priv *priv)
                 priv->bt_on_thresh = BT_ON_THRESHOLD_DEF;
                 priv->bt_duration = BT_DURATION_LIMIT_DEF;
                 priv->dynamic_frag_thresh = BT_FRAG_THRESHOLD_DEF;
-                priv->dynamic_agg_thresh = BT_AGG_THRESHOLD_DEF;
         }
 
         /* Set the tx_power_user_lmt to the lowest power level
          * this value will get overwritten by channel max power avg
          * from eeprom */
         priv->tx_power_user_lmt = IWLAGN_TX_POWER_TARGET_POWER_MIN;
+        priv->tx_power_next = IWLAGN_TX_POWER_TARGET_POWER_MIN;
 
         ret = iwl_init_channel_map(priv);
         if (ret) {
@@ -4209,28 +3876,30 @@ static void iwl_uninit_drv(struct iwl_priv *priv)
         kfree(priv->scan_cmd);
 }
 
-static struct ieee80211_ops iwl_hw_ops = {
-        .tx = iwl_mac_tx,
-        .start = iwl_mac_start,
-        .stop = iwl_mac_stop,
+#ifdef CONFIG_IWL5000
+struct ieee80211_ops iwlagn_hw_ops = {
+        .tx = iwlagn_mac_tx,
+        .start = iwlagn_mac_start,
+        .stop = iwlagn_mac_stop,
         .add_interface = iwl_mac_add_interface,
         .remove_interface = iwl_mac_remove_interface,
-        .config = iwl_mac_config,
+        .change_interface = iwl_mac_change_interface,
+        .config = iwlagn_mac_config,
         .configure_filter = iwlagn_configure_filter,
-        .set_key = iwl_mac_set_key,
-        .update_tkip_key = iwl_mac_update_tkip_key,
+        .set_key = iwlagn_mac_set_key,
+        .update_tkip_key = iwlagn_mac_update_tkip_key,
         .conf_tx = iwl_mac_conf_tx,
-        .reset_tsf = iwl_mac_reset_tsf,
-        .bss_info_changed = iwl_bss_info_changed,
-        .ampdu_action = iwl_mac_ampdu_action,
+        .bss_info_changed = iwlagn_bss_info_changed,
+        .ampdu_action = iwlagn_mac_ampdu_action,
         .hw_scan = iwl_mac_hw_scan,
-        .sta_notify = iwl_mac_sta_notify,
+        .sta_notify = iwlagn_mac_sta_notify,
         .sta_add = iwlagn_mac_sta_add,
         .sta_remove = iwl_mac_sta_remove,
-        .channel_switch = iwl_mac_channel_switch,
-        .flush = iwl_mac_flush,
+        .channel_switch = iwlagn_mac_channel_switch,
+        .flush = iwlagn_mac_flush,
         .tx_last_beacon = iwl_mac_tx_last_beacon,
 };
+#endif
 
 static void iwl_hw_detect(struct iwl_priv *priv)
 {
@@ -4298,10 +3967,15 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (cfg->mod_params->disable_hw_scan) {
                 dev_printk(KERN_DEBUG, &(pdev->dev),
                         "sw scan support is deprecated\n");
-                iwl_hw_ops.hw_scan = NULL;
+#ifdef CONFIG_IWL5000
+                iwlagn_hw_ops.hw_scan = NULL;
+#endif
+#ifdef CONFIG_IWL4965
+                iwl4965_hw_ops.hw_scan = NULL;
+#endif
         }
 
-        hw = iwl_alloc_all(cfg, &iwl_hw_ops);
+        hw = iwl_alloc_all(cfg);
         if (!hw) {
                 err = -ENOMEM;
                 goto out;
@@ -4333,6 +4007,7 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 BIT(NL80211_IFTYPE_ADHOC);
         priv->contexts[IWL_RXON_CTX_BSS].interface_modes =
                 BIT(NL80211_IFTYPE_STATION);
+        priv->contexts[IWL_RXON_CTX_BSS].ap_devtype = RXON_DEV_TYPE_AP;
         priv->contexts[IWL_RXON_CTX_BSS].ibss_devtype = RXON_DEV_TYPE_IBSS;
         priv->contexts[IWL_RXON_CTX_BSS].station_devtype = RXON_DEV_TYPE_ESS;
         priv->contexts[IWL_RXON_CTX_BSS].unused_devtype = RXON_DEV_TYPE_ESS;
@@ -4461,6 +4136,10 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (err)
                 goto out_free_eeprom;
 
+        err = iwl_eeprom_check_sku(priv);
+        if (err)
+                goto out_free_eeprom;
+
         /* extract MAC Address */
         iwl_eeprom_get_mac(priv, priv->addresses[0].addr);
         IWL_DEBUG_INFO(priv, "MAC address: %pM\n", priv->addresses[0].addr);
@@ -4500,8 +4179,10 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         pci_enable_msi(priv->pci_dev);
 
-        iwl_alloc_isr_ict(priv);
-        err = request_irq(priv->pci_dev->irq, priv->cfg->ops->lib->isr,
+        if (priv->cfg->ops->lib->isr_ops.alloc)
+                priv->cfg->ops->lib->isr_ops.alloc(priv);
+
+        err = request_irq(priv->pci_dev->irq, priv->cfg->ops->lib->isr_ops.isr,
                           IRQF_SHARED, DRV_NAME, priv);
         if (err) {
                 IWL_ERR(priv, "Error allocating IRQ %d\n", priv->pci_dev->irq);
@@ -4548,7 +4229,8 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         destroy_workqueue(priv->workqueue);
         priv->workqueue = NULL;
         free_irq(priv->pci_dev->irq, priv);
-        iwl_free_isr_ict(priv);
+        if (priv->cfg->ops->lib->isr_ops.free)
+                priv->cfg->ops->lib->isr_ops.free(priv);
  out_disable_msi:
         pci_disable_msi(priv->pci_dev);
         iwl_uninit_drv(priv);
@@ -4643,7 +4325,8 @@ static void __devexit iwl_pci_remove(struct pci_dev *pdev)
 
         iwl_uninit_drv(priv);
 
-        iwl_free_isr_ict(priv);
+        if (priv->cfg->ops->lib->isr_ops.free)
+                priv->cfg->ops->lib->isr_ops.free(priv);
 
         dev_kfree_skb(priv->beacon_skb);
 
@@ -4735,13 +4418,6 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
         {IWL_PCI_DEVICE(0x4239, 0x1316, iwl6000i_2abg_cfg)},
 
 /* 6x00 Series Gen2a */
-        {IWL_PCI_DEVICE(0x0082, 0x1201, iwl6000g2a_2agn_cfg)},
-        {IWL_PCI_DEVICE(0x0085, 0x1211, iwl6000g2a_2agn_cfg)},
-        {IWL_PCI_DEVICE(0x0082, 0x1221, iwl6000g2a_2agn_cfg)},
-        {IWL_PCI_DEVICE(0x0082, 0x1206, iwl6000g2a_2abg_cfg)},
-        {IWL_PCI_DEVICE(0x0085, 0x1216, iwl6000g2a_2abg_cfg)},
-        {IWL_PCI_DEVICE(0x0082, 0x1226, iwl6000g2a_2abg_cfg)},
-        {IWL_PCI_DEVICE(0x0082, 0x1207, iwl6000g2a_2bg_cfg)},
         {IWL_PCI_DEVICE(0x0082, 0x1301, iwl6000g2a_2agn_cfg)},
         {IWL_PCI_DEVICE(0x0082, 0x1306, iwl6000g2a_2abg_cfg)},
         {IWL_PCI_DEVICE(0x0082, 0x1307, iwl6000g2a_2bg_cfg)},
@@ -4751,24 +4427,12 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
         {IWL_PCI_DEVICE(0x0085, 0x1316, iwl6000g2a_2abg_cfg)},
 
 /* 6x00 Series Gen2b */
-        {IWL_PCI_DEVICE(0x008F, 0x5105, iwl6000g2b_bgn_cfg)},
-        {IWL_PCI_DEVICE(0x0090, 0x5115, iwl6000g2b_bgn_cfg)},
-        {IWL_PCI_DEVICE(0x008F, 0x5125, iwl6000g2b_bgn_cfg)},
-        {IWL_PCI_DEVICE(0x008F, 0x5107, iwl6000g2b_bg_cfg)},
-        {IWL_PCI_DEVICE(0x008F, 0x5201, iwl6000g2b_2agn_cfg)},
-        {IWL_PCI_DEVICE(0x0090, 0x5211, iwl6000g2b_2agn_cfg)},
-        {IWL_PCI_DEVICE(0x008F, 0x5221, iwl6000g2b_2agn_cfg)},
-        {IWL_PCI_DEVICE(0x008F, 0x5206, iwl6000g2b_2abg_cfg)},
-        {IWL_PCI_DEVICE(0x0090, 0x5216, iwl6000g2b_2abg_cfg)},
-        {IWL_PCI_DEVICE(0x008F, 0x5226, iwl6000g2b_2abg_cfg)},
-        {IWL_PCI_DEVICE(0x008F, 0x5207, iwl6000g2b_2bg_cfg)},
-        {IWL_PCI_DEVICE(0x008A, 0x5301, iwl6000g2b_bgn_cfg)},
         {IWL_PCI_DEVICE(0x008A, 0x5305, iwl6000g2b_bgn_cfg)},
         {IWL_PCI_DEVICE(0x008A, 0x5307, iwl6000g2b_bg_cfg)},
-        {IWL_PCI_DEVICE(0x008A, 0x5321, iwl6000g2b_bgn_cfg)},
         {IWL_PCI_DEVICE(0x008A, 0x5325, iwl6000g2b_bgn_cfg)},
-        {IWL_PCI_DEVICE(0x008B, 0x5311, iwl6000g2b_bgn_cfg)},
+        {IWL_PCI_DEVICE(0x008A, 0x5327, iwl6000g2b_bg_cfg)},
         {IWL_PCI_DEVICE(0x008B, 0x5315, iwl6000g2b_bgn_cfg)},
+        {IWL_PCI_DEVICE(0x008B, 0x5317, iwl6000g2b_bg_cfg)},
         {IWL_PCI_DEVICE(0x0090, 0x5211, iwl6000g2b_2agn_cfg)},
         {IWL_PCI_DEVICE(0x0090, 0x5215, iwl6000g2b_2bgn_cfg)},
         {IWL_PCI_DEVICE(0x0090, 0x5216, iwl6000g2b_2abg_cfg)},
@@ -4812,10 +4476,11 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
 
 /* 100 Series WiFi */
         {IWL_PCI_DEVICE(0x08AE, 0x1005, iwl100_bgn_cfg)},
+        {IWL_PCI_DEVICE(0x08AE, 0x1007, iwl100_bg_cfg)},
         {IWL_PCI_DEVICE(0x08AF, 0x1015, iwl100_bgn_cfg)},
+        {IWL_PCI_DEVICE(0x08AF, 0x1017, iwl100_bg_cfg)},
         {IWL_PCI_DEVICE(0x08AE, 0x1025, iwl100_bgn_cfg)},
-        {IWL_PCI_DEVICE(0x08AE, 0x1007, iwl100_bg_cfg)},
-        {IWL_PCI_DEVICE(0x08AE, 0x1017, iwl100_bg_cfg)},
+        {IWL_PCI_DEVICE(0x08AE, 0x1027, iwl100_bg_cfg)},
 
 /* 130 Series WiFi */
         {IWL_PCI_DEVICE(0x0896, 0x5005, iwl130_bgn_cfg)},
@@ -4836,10 +4501,7 @@ static struct pci_driver iwl_driver = {
         .id_table = iwl_hw_card_ids,
         .probe = iwl_pci_probe,
         .remove = __devexit_p(iwl_pci_remove),
-#ifdef CONFIG_PM
-        .suspend = iwl_pci_suspend,
-        .resume = iwl_pci_resume,
-#endif
+        .driver.pm = IWL_PM_OPS,
 };
 
 static int __init iwl_init(void)
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.h b/drivers/net/wireless/iwlwifi/iwl-agn.h
index f525d55f2c0..28837a185a2 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.h
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.h
@@ -102,6 +102,9 @@ extern struct iwl_hcmd_ops iwlagn_hcmd;
 extern struct iwl_hcmd_ops iwlagn_bt_hcmd;
 extern struct iwl_hcmd_utils_ops iwlagn_hcmd_utils;
 
+extern struct ieee80211_ops iwlagn_hw_ops;
+extern struct ieee80211_ops iwl4965_hw_ops;
+
 int iwl_reset_ict(struct iwl_priv *priv);
 void iwl_disable_ict(struct iwl_priv *priv);
 int iwl_alloc_isr_ict(struct iwl_priv *priv);
@@ -132,6 +135,11 @@ void iwl_free_tfds_in_queue(struct iwl_priv *priv,
 /* RXON */
 int iwlagn_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *ctx);
 void iwlagn_set_rxon_chain(struct iwl_priv *priv, struct iwl_rxon_context *ctx);
+int iwlagn_mac_config(struct ieee80211_hw *hw, u32 changed);
+void iwlagn_bss_info_changed(struct ieee80211_hw *hw,
+                             struct ieee80211_vif *vif,
+                             struct ieee80211_bss_conf *bss_conf,
+                             u32 changes);
 
 /* uCode */
 int iwlagn_load_ucode(struct iwl_priv *priv);
@@ -249,6 +257,7 @@ int iwlagn_manage_ibss_station(struct iwl_priv *priv,
 int iwlagn_send_rxon_assoc(struct iwl_priv *priv,
                            struct iwl_rxon_context *ctx);
 int iwlagn_send_tx_ant_config(struct iwl_priv *priv, u8 valid_tx_ant);
+int iwlagn_send_beacon_cmd(struct iwl_priv *priv);
 
 /* bt coex */
 void iwlagn_send_advance_bt_config(struct iwl_priv *priv);
@@ -292,9 +301,12 @@ int iwl_sta_rx_agg_start(struct iwl_priv *priv, struct ieee80211_sta *sta,
                          int tid, u16 ssn);
 int iwl_sta_rx_agg_stop(struct iwl_priv *priv, struct ieee80211_sta *sta,
                         int tid);
-void iwl_sta_modify_ps_wake(struct iwl_priv *priv, int sta_id);
 void iwl_sta_modify_sleep_tx_count(struct iwl_priv *priv, int sta_id, int cnt);
 int iwl_update_bcast_stations(struct iwl_priv *priv);
+void iwlagn_mac_sta_notify(struct ieee80211_hw *hw,
+                           struct ieee80211_vif *vif,
+                           enum sta_notify_cmd cmd,
+                           struct ieee80211_sta *sta);
 
 /* rate */
 static inline u32 iwl_ant_idx_to_flags(u8 ant_idx)
@@ -318,4 +330,31 @@ void iwl_eeprom_get_mac(const struct iwl_priv *priv, u8 *mac);
 int iwlcore_eeprom_acquire_semaphore(struct iwl_priv *priv);
 void iwlcore_eeprom_release_semaphore(struct iwl_priv *priv);
 
+/* mac80211 handlers (for 4965) */
+int iwlagn_mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb);
+int iwlagn_mac_start(struct ieee80211_hw *hw);
+void iwlagn_mac_stop(struct ieee80211_hw *hw);
+void iwlagn_configure_filter(struct ieee80211_hw *hw,
+                             unsigned int changed_flags,
+                             unsigned int *total_flags,
+                             u64 multicast);
+int iwlagn_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+                       struct ieee80211_vif *vif, struct ieee80211_sta *sta,
+                       struct ieee80211_key_conf *key);
+void iwlagn_mac_update_tkip_key(struct ieee80211_hw *hw,
+                                struct ieee80211_vif *vif,
+                                struct ieee80211_key_conf *keyconf,
+                                struct ieee80211_sta *sta,
+                                u32 iv32, u16 *phase1key);
+int iwlagn_mac_ampdu_action(struct ieee80211_hw *hw,
+                            struct ieee80211_vif *vif,
+                            enum ieee80211_ampdu_mlme_action action,
+                            struct ieee80211_sta *sta, u16 tid, u16 *ssn);
+int iwlagn_mac_sta_add(struct ieee80211_hw *hw,
+                       struct ieee80211_vif *vif,
+                       struct ieee80211_sta *sta);
+void iwlagn_mac_channel_switch(struct ieee80211_hw *hw,
+                               struct ieee80211_channel_switch *ch_switch);
+void iwlagn_mac_flush(struct ieee80211_hw *hw, bool drop);
+
 #endif /* __iwl_agn_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-commands.h b/drivers/net/wireless/iwlwifi/iwl-commands.h
index 424801abc80..c9448cba1e2 100644
--- a/drivers/net/wireless/iwlwifi/iwl-commands.h
+++ b/drivers/net/wireless/iwlwifi/iwl-commands.h
@@ -2022,6 +2022,9 @@ struct iwl_compressed_ba_resp {
         __le64 bitmap;
         __le16 scd_flow;
         __le16 scd_ssn;
+        /* following only for 5000 series and up */
+        u8 txed;        /* number of frames sent */
+        u8 txed_2_done; /* number of frames acked */
 } __packed;
 
 /*
@@ -2407,9 +2410,9 @@ struct iwl_link_quality_cmd {
 #define BT_FRAG_THRESHOLD_MAX   0
 #define BT_FRAG_THRESHOLD_MIN   0
 
-#define BT_AGG_THRESHOLD_DEF    0
-#define BT_AGG_THRESHOLD_MAX    0
-#define BT_AGG_THRESHOLD_MIN    0
+#define BT_AGG_THRESHOLD_DEF    1200
+#define BT_AGG_THRESHOLD_MAX    8000
+#define BT_AGG_THRESHOLD_MIN    400
 
 /*
  * REPLY_BT_CONFIG = 0x9b (command, has simple generic response)
@@ -2436,8 +2439,9 @@ struct iwl_bt_cmd {
 #define IWLAGN_BT_FLAG_COEX_MODE_3W             2
 #define IWLAGN_BT_FLAG_COEX_MODE_4W             3
 
-#define IWLAGN_BT_FLAG_UCODE_DEFAULT    BIT(6)
-#define IWLAGN_BT_FLAG_NOCOEX_NOTIF     BIT(7)
+#define IWLAGN_BT_FLAG_UCODE_DEFAULT            BIT(6)
+/* Disable Sync PSPoll on SCO/eSCO */
+#define IWLAGN_BT_FLAG_SYNC_2_BT_DISABLE        BIT(7)
 
 #define IWLAGN_BT_PRIO_BOOST_MAX        0xFF
 #define IWLAGN_BT_PRIO_BOOST_MIN        0x00
@@ -2447,8 +2451,8 @@ struct iwl_bt_cmd {
 
 #define IWLAGN_BT3_T7_DEFAULT           1
 
-#define IWLAGN_BT_KILL_ACK_MASK_DEFAULT cpu_to_le32(0xffffffff)
-#define IWLAGN_BT_KILL_CTS_MASK_DEFAULT cpu_to_le32(0xffffffff)
+#define IWLAGN_BT_KILL_ACK_MASK_DEFAULT cpu_to_le32(0xffff0000)
+#define IWLAGN_BT_KILL_CTS_MASK_DEFAULT cpu_to_le32(0xffff0000)
 
 #define IWLAGN_BT3_PRIO_SAMPLE_DEFAULT  2
 
@@ -2664,9 +2668,16 @@ struct iwl_spectrum_notification {
 #define IWL_POWER_VEC_SIZE 5
 
 #define IWL_POWER_DRIVER_ALLOW_SLEEP_MSK        cpu_to_le16(BIT(0))
+#define IWL_POWER_POWER_SAVE_ENA_MSK            cpu_to_le16(BIT(0))
+#define IWL_POWER_POWER_MANAGEMENT_ENA_MSK      cpu_to_le16(BIT(1))
 #define IWL_POWER_SLEEP_OVER_DTIM_MSK           cpu_to_le16(BIT(2))
 #define IWL_POWER_PCI_PM_MSK                    cpu_to_le16(BIT(3))
 #define IWL_POWER_FAST_PD                       cpu_to_le16(BIT(4))
+#define IWL_POWER_BEACON_FILTERING              cpu_to_le16(BIT(5))
+#define IWL_POWER_SHADOW_REG_ENA                cpu_to_le16(BIT(6))
+#define IWL_POWER_CT_KILL_SET                   cpu_to_le16(BIT(7))
+#define IWL_POWER_BT_SCO_ENA                    cpu_to_le16(BIT(8))
+#define IWL_POWER_ADVANCE_PM_ENA_MSK            cpu_to_le16(BIT(9))
 
 struct iwl3945_powertable_cmd {
         __le16 flags;
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 25fb3912342..c41f5a87821 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -77,15 +77,15 @@ EXPORT_SYMBOL(iwl_bcast_addr);
 
 
 /* This function both allocates and initializes hw and priv. */
-struct ieee80211_hw *iwl_alloc_all(struct iwl_cfg *cfg,
-                struct ieee80211_ops *hw_ops)
+struct ieee80211_hw *iwl_alloc_all(struct iwl_cfg *cfg)
 {
         struct iwl_priv *priv;
-
         /* mac80211 allocates memory for this device instance, including
          *   space for this driver's private structure */
-        struct ieee80211_hw *hw =
-                ieee80211_alloc_hw(sizeof(struct iwl_priv), hw_ops);
+        struct ieee80211_hw *hw;
+
+        hw = ieee80211_alloc_hw(sizeof(struct iwl_priv),
+                                cfg->ops->ieee80211_ops);
         if (hw == NULL) {
                 pr_err("%s: Can not allocate network device\n",
                        cfg->name);
@@ -100,35 +100,6 @@ out:
 }
 EXPORT_SYMBOL(iwl_alloc_all);
 
-/*
- * QoS  support
-*/
-static void iwl_update_qos(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
-{
-        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
-                return;
-
-        if (!ctx->is_active)
-                return;
-
-        ctx->qos_data.def_qos_parm.qos_flags = 0;
-
-        if (ctx->qos_data.qos_active)
-                ctx->qos_data.def_qos_parm.qos_flags |=
-                        QOS_PARAM_FLG_UPDATE_EDCA_MSK;
-
-        if (ctx->ht.enabled)
-                ctx->qos_data.def_qos_parm.qos_flags |= QOS_PARAM_FLG_TGN_MSK;
-
-        IWL_DEBUG_QOS(priv, "send QoS cmd with Qos active=%d FLAGS=0x%X\n",
-                      ctx->qos_data.qos_active,
-                      ctx->qos_data.def_qos_parm.qos_flags);
-
-        iwl_send_cmd_pdu_async(priv, ctx->qos_cmd,
-                               sizeof(struct iwl_qosparam_cmd),
-                               &ctx->qos_data.def_qos_parm, NULL);
-}
-
 #define MAX_BIT_RATE_40_MHZ 150 /* Mbps */
 #define MAX_BIT_RATE_20_MHZ 72 /* Mbps */
 static void iwlcore_init_ht_hw_capab(const struct iwl_priv *priv,
@@ -317,40 +288,6 @@ void iwlcore_free_geos(struct iwl_priv *priv)
 }
 EXPORT_SYMBOL(iwlcore_free_geos);
 
-/*
- *  iwlcore_tx_cmd_protection: Set rts/cts. 3945 and 4965 only share this
- *  function.
- */
-void iwlcore_tx_cmd_protection(struct iwl_priv *priv,
-                               struct ieee80211_tx_info *info,
-                               __le16 fc, __le32 *tx_flags)
-{
-        if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS) {
-                *tx_flags |= TX_CMD_FLG_RTS_MSK;
-                *tx_flags &= ~TX_CMD_FLG_CTS_MSK;
-                *tx_flags |= TX_CMD_FLG_FULL_TXOP_PROT_MSK;
-
-                if (!ieee80211_is_mgmt(fc))
-                        return;
-
-                switch (fc & cpu_to_le16(IEEE80211_FCTL_STYPE)) {
-                case cpu_to_le16(IEEE80211_STYPE_AUTH):
-                case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
-                case cpu_to_le16(IEEE80211_STYPE_ASSOC_REQ):
-                case cpu_to_le16(IEEE80211_STYPE_REASSOC_REQ):
-                        *tx_flags &= ~TX_CMD_FLG_RTS_MSK;
-                        *tx_flags |= TX_CMD_FLG_CTS_MSK;
-                        break;
-                }
-        } else if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT) {
-                *tx_flags &= ~TX_CMD_FLG_RTS_MSK;
-                *tx_flags |= TX_CMD_FLG_CTS_MSK;
-                *tx_flags |= TX_CMD_FLG_FULL_TXOP_PROT_MSK;
-        }
-}
-EXPORT_SYMBOL(iwlcore_tx_cmd_protection);
-
-
 static bool iwl_is_channel_extension(struct iwl_priv *priv,
                                      enum ieee80211_band band,
                                      u16 channel, u8 extension_chan_offset)
@@ -1206,8 +1143,16 @@ EXPORT_SYMBOL(iwl_apm_init);
 
 int iwl_set_tx_power(struct iwl_priv *priv, s8 tx_power, bool force)
 {
-        int ret = 0;
-        s8 prev_tx_power = priv->tx_power_user_lmt;
+        int ret;
+        s8 prev_tx_power;
+
+        lockdep_assert_held(&priv->mutex);
+
+        if (priv->tx_power_user_lmt == tx_power && !force)
+                return 0;
+
+        if (!priv->cfg->ops->lib->send_tx_power)
+                return -EOPNOTSUPP;
 
         if (tx_power < IWLAGN_TX_POWER_TARGET_POWER_MIN) {
                 IWL_WARN(priv,
@@ -1224,93 +1169,29 @@ int iwl_set_tx_power(struct iwl_priv *priv, s8 tx_power, bool force)
                 return -EINVAL;
         }
 
-        if (priv->tx_power_user_lmt != tx_power)
-                force = true;
+        if (!iwl_is_ready_rf(priv))
+                return -EIO;
 
-        /* if nic is not up don't send command */
-        if (iwl_is_ready_rf(priv)) {
-                priv->tx_power_user_lmt = tx_power;
-                if (force && priv->cfg->ops->lib->send_tx_power)
-                        ret = priv->cfg->ops->lib->send_tx_power(priv);
-                else if (!priv->cfg->ops->lib->send_tx_power)
-                        ret = -EOPNOTSUPP;
-                /*
-                 * if fail to set tx_power, restore the orig. tx power
-                 */
-                if (ret)
-                        priv->tx_power_user_lmt = prev_tx_power;
+        /* scan complete use tx_power_next, need to be updated */
+        priv->tx_power_next = tx_power;
+        if (test_bit(STATUS_SCANNING, &priv->status) && !force) {
+                IWL_DEBUG_INFO(priv, "Deferring tx power set while scanning\n");
+                return 0;
         }
 
-        /*
-         * Even this is an async host command, the command
-         * will always report success from uCode
-         * So once driver can placing the command into the queue
-         * successfully, driver can use priv->tx_power_user_lmt
-         * to reflect the current tx power
-         */
-        return ret;
-}
-EXPORT_SYMBOL(iwl_set_tx_power);
-
-irqreturn_t iwl_isr_legacy(int irq, void *data)
-{
-        struct iwl_priv *priv = data;
-        u32 inta, inta_mask;
-        u32 inta_fh;
-        unsigned long flags;
-        if (!priv)
-                return IRQ_NONE;
+        prev_tx_power = priv->tx_power_user_lmt;
+        priv->tx_power_user_lmt = tx_power;
 
-        spin_lock_irqsave(&priv->lock, flags);
+        ret = priv->cfg->ops->lib->send_tx_power(priv);
 
-        /* Disable (but don't clear!) interrupts here to avoid
-         *    back-to-back ISRs and sporadic interrupts from our NIC.
-         * If we have something to service, the tasklet will re-enable ints.
-         * If we *don't* have something, we'll re-enable before leaving here. */
-        inta_mask = iwl_read32(priv, CSR_INT_MASK);  /* just for debug */
-        iwl_write32(priv, CSR_INT_MASK, 0x00000000);
-
-        /* Discover which interrupts are active/pending */
-        inta = iwl_read32(priv, CSR_INT);
-        inta_fh = iwl_read32(priv, CSR_FH_INT_STATUS);
-
-        /* Ignore interrupt if there's nothing in NIC to service.
-         * This may be due to IRQ shared with another device,
-         * or due to sporadic interrupts thrown from our NIC. */
-        if (!inta && !inta_fh) {
-                IWL_DEBUG_ISR(priv, "Ignore interrupt, inta == 0, inta_fh == 0\n");
-                goto none;
+        /* if fail to set tx_power, restore the orig. tx power */
+        if (ret) {
+                priv->tx_power_user_lmt = prev_tx_power;
+                priv->tx_power_next = prev_tx_power;
         }
-
-        if ((inta == 0xFFFFFFFF) || ((inta & 0xFFFFFFF0) == 0xa5a5a5a0)) {
-                /* Hardware disappeared. It might have already raised
-                 * an interrupt */
-                IWL_WARN(priv, "HARDWARE GONE?? INTA == 0x%08x\n", inta);
-                goto unplugged;
-        }
-
-        IWL_DEBUG_ISR(priv, "ISR inta 0x%08x, enabled 0x%08x, fh 0x%08x\n",
-                      inta, inta_mask, inta_fh);
-
-        inta &= ~CSR_INT_BIT_SCD;
-
-        /* iwl_irq_tasklet() will service interrupts and re-enable them */
-        if (likely(inta || inta_fh))
-                tasklet_schedule(&priv->irq_tasklet);
-
- unplugged:
-        spin_unlock_irqrestore(&priv->lock, flags);
-        return IRQ_HANDLED;
-
- none:
-        /* re-enable interrupts here since we don't have anything to service. */
-        /* only Re-enable if diabled by irq */
-        if (test_bit(STATUS_INT_ENABLED, &priv->status))
-                iwl_enable_interrupts(priv);
-        spin_unlock_irqrestore(&priv->lock, flags);
-        return IRQ_NONE;
+        return ret;
 }
-EXPORT_SYMBOL(iwl_isr_legacy);
+EXPORT_SYMBOL(iwl_set_tx_power);
 
 void iwl_send_bt_config(struct iwl_priv *priv)
 {
@@ -1452,318 +1333,51 @@ int iwl_mac_tx_last_beacon(struct ieee80211_hw *hw)
 }
 EXPORT_SYMBOL_GPL(iwl_mac_tx_last_beacon);
 
-static void iwl_ht_conf(struct iwl_priv *priv,
-                        struct ieee80211_vif *vif)
+static int iwl_set_mode(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
 {
-        struct iwl_ht_config *ht_conf = &priv->current_ht_config;
-        struct ieee80211_sta *sta;
-        struct ieee80211_bss_conf *bss_conf = &vif->bss_conf;
-        struct iwl_rxon_context *ctx = iwl_rxon_ctx_from_vif(vif);
-
-        IWL_DEBUG_MAC80211(priv, "enter:\n");
-
-        if (!ctx->ht.enabled)
-                return;
-
-        ctx->ht.protection =
-                bss_conf->ht_operation_mode & IEEE80211_HT_OP_MODE_PROTECTION;
-        ctx->ht.non_gf_sta_present =
-                !!(bss_conf->ht_operation_mode & IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT);
-
-        ht_conf->single_chain_sufficient = false;
-
-        switch (vif->type) {
-        case NL80211_IFTYPE_STATION:
-                rcu_read_lock();
-                sta = ieee80211_find_sta(vif, bss_conf->bssid);
-                if (sta) {
-                        struct ieee80211_sta_ht_cap *ht_cap = &sta->ht_cap;
-                        int maxstreams;
-
-                        maxstreams = (ht_cap->mcs.tx_params &
-                                      IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK)
-                                        >> IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT;
-                        maxstreams += 1;
-
-                        if ((ht_cap->mcs.rx_mask[1] == 0) &&
-                            (ht_cap->mcs.rx_mask[2] == 0))
-                                ht_conf->single_chain_sufficient = true;
-                        if (maxstreams <= 1)
-                                ht_conf->single_chain_sufficient = true;
-                } else {
-                        /*
-                         * If at all, this can only happen through a race
-                         * when the AP disconnects us while we're still
-                         * setting up the connection, in that case mac80211
-                         * will soon tell us about that.
-                         */
-                        ht_conf->single_chain_sufficient = true;
-                }
-                rcu_read_unlock();
-                break;
-        case NL80211_IFTYPE_ADHOC:
-                ht_conf->single_chain_sufficient = true;
-                break;
-        default:
-                break;
-        }
-
-        IWL_DEBUG_MAC80211(priv, "leave\n");
-}
+        iwl_connection_init_rx_config(priv, ctx);
 
-static inline void iwl_set_no_assoc(struct iwl_priv *priv,
-                                    struct ieee80211_vif *vif)
-{
-        struct iwl_rxon_context *ctx = iwl_rxon_ctx_from_vif(vif);
+        if (priv->cfg->ops->hcmd->set_rxon_chain)
+                priv->cfg->ops->hcmd->set_rxon_chain(priv, ctx);
 
-        iwl_led_disassociate(priv);
-        /*
-         * inform the ucode that there is no longer an
-         * association and that no more packets should be
-         * sent
-         */
-        ctx->staging.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
-        ctx->staging.assoc_id = 0;
-        iwlcore_commit_rxon(priv, ctx);
+        return iwlcore_commit_rxon(priv, ctx);
 }
 
-static void iwlcore_beacon_update(struct ieee80211_hw *hw,
-                                  struct ieee80211_vif *vif)
+static int iwl_setup_interface(struct iwl_priv *priv,
+                               struct iwl_rxon_context *ctx)
 {
-        struct iwl_priv *priv = hw->priv;
-        unsigned long flags;
-        __le64 timestamp;
-        struct sk_buff *skb = ieee80211_beacon_get(hw, vif);
-
-        if (!skb)
-                return;
-
-        IWL_DEBUG_ASSOC(priv, "enter\n");
+        struct ieee80211_vif *vif = ctx->vif;
+        int err;
 
         lockdep_assert_held(&priv->mutex);
 
-        if (!priv->beacon_ctx) {
-                IWL_ERR(priv, "update beacon but no beacon context!\n");
-                dev_kfree_skb(skb);
-                return;
-        }
-
-        spin_lock_irqsave(&priv->lock, flags);
-
-        if (priv->beacon_skb)
-                dev_kfree_skb(priv->beacon_skb);
-
-        priv->beacon_skb = skb;
-
-        timestamp = ((struct ieee80211_mgmt *)skb->data)->u.beacon.timestamp;
-        priv->timestamp = le64_to_cpu(timestamp);
-
-        IWL_DEBUG_ASSOC(priv, "leave\n");
-
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        if (!iwl_is_ready_rf(priv)) {
-                IWL_DEBUG_MAC80211(priv, "leave - RF not ready\n");
-                return;
-        }
-
-        priv->cfg->ops->lib->post_associate(priv, priv->beacon_ctx->vif);
-}
-
-void iwl_bss_info_changed(struct ieee80211_hw *hw,
-                          struct ieee80211_vif *vif,
-                          struct ieee80211_bss_conf *bss_conf,
-                          u32 changes)
-{
-        struct iwl_priv *priv = hw->priv;
-        struct iwl_rxon_context *ctx = iwl_rxon_ctx_from_vif(vif);
-        int ret;
-
-        IWL_DEBUG_MAC80211(priv, "changes = 0x%X\n", changes);
-
-        if (!iwl_is_alive(priv))
-                return;
-
-        mutex_lock(&priv->mutex);
-
-        if (changes & BSS_CHANGED_QOS) {
-                unsigned long flags;
-
-                spin_lock_irqsave(&priv->lock, flags);
-                ctx->qos_data.qos_active = bss_conf->qos;
-                iwl_update_qos(priv, ctx);
-                spin_unlock_irqrestore(&priv->lock, flags);
-        }
-
-        if (changes & BSS_CHANGED_BEACON_ENABLED) {
-                /*
-                 * the add_interface code must make sure we only ever
-                 * have a single interface that could be beaconing at
-                 * any time.
-                 */
-                if (vif->bss_conf.enable_beacon)
-                        priv->beacon_ctx = ctx;
-                else
-                        priv->beacon_ctx = NULL;
-        }
-
-        if (changes & BSS_CHANGED_BEACON && vif->type == NL80211_IFTYPE_AP) {
-                dev_kfree_skb(priv->beacon_skb);
-                priv->beacon_skb = ieee80211_beacon_get(hw, vif);
-        }
-
-        if (changes & BSS_CHANGED_BEACON_INT && vif->type == NL80211_IFTYPE_AP)
-                iwl_send_rxon_timing(priv, ctx);
-
-        if (changes & BSS_CHANGED_BSSID) {
-                IWL_DEBUG_MAC80211(priv, "BSSID %pM\n", bss_conf->bssid);
-
-                /*
-                 * If there is currently a HW scan going on in the
-                 * background then we need to cancel it else the RXON
-                 * below/in post_associate will fail.
-                 */
-                if (iwl_scan_cancel_timeout(priv, 100)) {
-                        IWL_WARN(priv, "Aborted scan still in progress after 100ms\n");
-                        IWL_DEBUG_MAC80211(priv, "leaving - scan abort failed.\n");
-                        mutex_unlock(&priv->mutex);
-                        return;
-                }
-
-                /* mac80211 only sets assoc when in STATION mode */
-                if (vif->type == NL80211_IFTYPE_ADHOC || bss_conf->assoc) {
-                        memcpy(ctx->staging.bssid_addr,
-                               bss_conf->bssid, ETH_ALEN);
-
-                        /* currently needed in a few places */
-                        memcpy(priv->bssid, bss_conf->bssid, ETH_ALEN);
-                } else {
-                        ctx->staging.filter_flags &=
-                                ~RXON_FILTER_ASSOC_MSK;
-                }
-
-        }
-
         /*
-         * This needs to be after setting the BSSID in case
-         * mac80211 decides to do both changes at once because
-         * it will invoke post_associate.
+         * This variable will be correct only when there's just
+         * a single context, but all code using it is for hardware
+         * that supports only one context.
          */
-        if (vif->type == NL80211_IFTYPE_ADHOC && changes & BSS_CHANGED_BEACON)
-                iwlcore_beacon_update(hw, vif);
-
-        if (changes & BSS_CHANGED_ERP_PREAMBLE) {
-                IWL_DEBUG_MAC80211(priv, "ERP_PREAMBLE %d\n",
-                                   bss_conf->use_short_preamble);
-                if (bss_conf->use_short_preamble)
-                        ctx->staging.flags |= RXON_FLG_SHORT_PREAMBLE_MSK;
-                else
-                        ctx->staging.flags &= ~RXON_FLG_SHORT_PREAMBLE_MSK;
-        }
-
-        if (changes & BSS_CHANGED_ERP_CTS_PROT) {
-                IWL_DEBUG_MAC80211(priv, "ERP_CTS %d\n", bss_conf->use_cts_prot);
-                if (bss_conf->use_cts_prot && (priv->band != IEEE80211_BAND_5GHZ))
-                        ctx->staging.flags |= RXON_FLG_TGG_PROTECT_MSK;
-                else
-                        ctx->staging.flags &= ~RXON_FLG_TGG_PROTECT_MSK;
-                if (bss_conf->use_cts_prot)
-                        ctx->staging.flags |= RXON_FLG_SELF_CTS_EN;
-                else
-                        ctx->staging.flags &= ~RXON_FLG_SELF_CTS_EN;
-        }
-
-        if (changes & BSS_CHANGED_BASIC_RATES) {
-                /* XXX use this information
-                 *
-                 * To do that, remove code from iwl_set_rate() and put something
-                 * like this here:
-                 *
-                if (A-band)
-                        ctx->staging.ofdm_basic_rates =
-                                bss_conf->basic_rates;
-                else
-                        ctx->staging.ofdm_basic_rates =
-                                bss_conf->basic_rates >> 4;
-                        ctx->staging.cck_basic_rates =
-                                bss_conf->basic_rates & 0xF;
-                 */
-        }
-
-        if (changes & BSS_CHANGED_HT) {
-                iwl_ht_conf(priv, vif);
-
-                if (priv->cfg->ops->hcmd->set_rxon_chain)
-                        priv->cfg->ops->hcmd->set_rxon_chain(priv, ctx);
-        }
-
-        if (changes & BSS_CHANGED_ASSOC) {
-                IWL_DEBUG_MAC80211(priv, "ASSOC %d\n", bss_conf->assoc);
-                if (bss_conf->assoc) {
-                        priv->timestamp = bss_conf->timestamp;
-
-                        iwl_led_associate(priv);
-
-                        if (!iwl_is_rfkill(priv))
-                                priv->cfg->ops->lib->post_associate(priv, vif);
-                } else
-                        iwl_set_no_assoc(priv, vif);
-        }
-
-        if (changes && iwl_is_associated_ctx(ctx) && bss_conf->aid) {
-                IWL_DEBUG_MAC80211(priv, "Changes (%#x) while associated\n",
-                                   changes);
-                ret = iwl_send_rxon_assoc(priv, ctx);
-                if (!ret) {
-                        /* Sync active_rxon with latest change. */
-                        memcpy((void *)&ctx->active,
-                                &ctx->staging,
-                                sizeof(struct iwl_rxon_cmd));
-                }
-        }
+        priv->iw_mode = vif->type;
 
-        if (changes & BSS_CHANGED_BEACON_ENABLED) {
-                if (vif->bss_conf.enable_beacon) {
-                        memcpy(ctx->staging.bssid_addr,
-                               bss_conf->bssid, ETH_ALEN);
-                        memcpy(priv->bssid, bss_conf->bssid, ETH_ALEN);
-                        iwl_led_associate(priv);
-                        iwlcore_config_ap(priv, vif);
-                } else
-                        iwl_set_no_assoc(priv, vif);
-        }
+        ctx->is_active = true;
 
-        if (changes & BSS_CHANGED_IBSS) {
-                ret = priv->cfg->ops->lib->manage_ibss_station(priv, vif,
-                                                        bss_conf->ibss_joined);
-                if (ret)
-                        IWL_ERR(priv, "failed to %s IBSS station %pM\n",
-                                bss_conf->ibss_joined ? "add" : "remove",
-                                bss_conf->bssid);
+        err = iwl_set_mode(priv, ctx);
+        if (err) {
+                if (!ctx->always_active)
+                        ctx->is_active = false;
+                return err;
         }
 
-        if (changes & BSS_CHANGED_IDLE &&
-            priv->cfg->ops->hcmd->set_pan_params) {
-                if (priv->cfg->ops->hcmd->set_pan_params(priv))
-                        IWL_ERR(priv, "failed to update PAN params\n");
+        if (priv->cfg->bt_params && priv->cfg->bt_params->advanced_bt_coexist &&
+            vif->type == NL80211_IFTYPE_ADHOC) {
+                /*
+                 * pretend to have high BT traffic as long as we
+                 * are operating in IBSS mode, as this will cause
+                 * the rate scaling etc. to behave as intended.
+                 */
+                priv->bt_traffic_load = IWL_BT_COEX_TRAFFIC_LOAD_HIGH;
         }
 
-        mutex_unlock(&priv->mutex);
-
-        IWL_DEBUG_MAC80211(priv, "leave\n");
-}
-EXPORT_SYMBOL(iwl_bss_info_changed);
-
-static int iwl_set_mode(struct iwl_priv *priv, struct ieee80211_vif *vif)
-{
-        struct iwl_rxon_context *ctx = iwl_rxon_ctx_from_vif(vif);
-
-        iwl_connection_init_rx_config(priv, ctx);
-
-        if (priv->cfg->ops->hcmd->set_rxon_chain)
-                priv->cfg->ops->hcmd->set_rxon_chain(priv, ctx);
-
-        return iwlcore_commit_rxon(priv, ctx);
+        return 0;
 }
 
 int iwl_mac_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
@@ -1771,7 +1385,7 @@ int iwl_mac_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
         struct iwl_priv *priv = hw->priv;
         struct iwl_vif_priv *vif_priv = (void *)vif->drv_priv;
         struct iwl_rxon_context *tmp, *ctx = NULL;
-        int err = 0;
+        int err;
 
         IWL_DEBUG_MAC80211(priv, "enter: type %d, addr %pM\n",
                            vif->type, vif->addr);
@@ -1813,36 +1427,11 @@ int iwl_mac_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
 
         vif_priv->ctx = ctx;
         ctx->vif = vif;
-        /*
-         * This variable will be correct only when there's just
-         * a single context, but all code using it is for hardware
-         * that supports only one context.
-         */
-        priv->iw_mode = vif->type;
-
-        ctx->is_active = true;
-
-        err = iwl_set_mode(priv, vif);
-        if (err) {
-                if (!ctx->always_active)
-                        ctx->is_active = false;
-                goto out_err;
-        }
-
-        if (priv->cfg->bt_params &&
-            priv->cfg->bt_params->advanced_bt_coexist &&
-            vif->type == NL80211_IFTYPE_ADHOC) {
-                /*
-                 * pretend to have high BT traffic as long as we
-                 * are operating in IBSS mode, as this will cause
-                 * the rate scaling etc. to behave as intended.
-                 */
-                priv->bt_traffic_load = IWL_BT_COEX_TRAFFIC_LOAD_HIGH;
-        }
 
-        goto out;
+        err = iwl_setup_interface(priv, ctx);
+        if (!err)
+                goto out;
 
- out_err:
         ctx->vif = NULL;
         priv->iw_mode = NL80211_IFTYPE_STATION;
  out:
@@ -1853,27 +1442,24 @@ int iwl_mac_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
 }
 EXPORT_SYMBOL(iwl_mac_add_interface);
 
-void iwl_mac_remove_interface(struct ieee80211_hw *hw,
-                              struct ieee80211_vif *vif)
+static void iwl_teardown_interface(struct iwl_priv *priv,
+                                   struct ieee80211_vif *vif,
+                                   bool mode_change)
 {
-        struct iwl_priv *priv = hw->priv;
         struct iwl_rxon_context *ctx = iwl_rxon_ctx_from_vif(vif);
 
-        IWL_DEBUG_MAC80211(priv, "enter\n");
-
-        mutex_lock(&priv->mutex);
-
-        WARN_ON(ctx->vif != vif);
-        ctx->vif = NULL;
+        lockdep_assert_held(&priv->mutex);
 
         if (priv->scan_vif == vif) {
                 iwl_scan_cancel_timeout(priv, 200);
                 iwl_force_scan_end(priv);
         }
-        iwl_set_mode(priv, vif);
 
-        if (!ctx->always_active)
-                ctx->is_active = false;
+        if (!mode_change) {
+                iwl_set_mode(priv, ctx);
+                if (!ctx->always_active)
+                        ctx->is_active = false;
+        }
 
         /*
          * When removing the IBSS interface, overwrite the
@@ -1883,211 +1469,31 @@ void iwl_mac_remove_interface(struct ieee80211_hw *hw,
          * both values are the same and zero.
          */
         if (vif->type == NL80211_IFTYPE_ADHOC)
-                priv->bt_traffic_load = priv->notif_bt_traffic_load;
-
-        memset(priv->bssid, 0, ETH_ALEN);
-        mutex_unlock(&priv->mutex);
-
-        IWL_DEBUG_MAC80211(priv, "leave\n");
-
+                priv->bt_traffic_load = priv->last_bt_traffic_load;
 }
-EXPORT_SYMBOL(iwl_mac_remove_interface);
-
-/**
- * iwl_mac_config - mac80211 config callback
- */
-int iwl_mac_config(struct ieee80211_hw *hw, u32 changed)
-{
-        struct iwl_priv *priv = hw->priv;
-        const struct iwl_channel_info *ch_info;
-        struct ieee80211_conf *conf = &hw->conf;
-        struct ieee80211_channel *channel = conf->channel;
-        struct iwl_ht_config *ht_conf = &priv->current_ht_config;
-        struct iwl_rxon_context *ctx;
-        unsigned long flags = 0;
-        int ret = 0;
-        u16 ch;
-        int scan_active = 0;
-
-        mutex_lock(&priv->mutex);
-
-        IWL_DEBUG_MAC80211(priv, "enter to channel %d changed 0x%X\n",
-                                        channel->hw_value, changed);
-
-        if (unlikely(!priv->cfg->mod_params->disable_hw_scan &&
-                        test_bit(STATUS_SCANNING, &priv->status))) {
-                scan_active = 1;
-                IWL_DEBUG_MAC80211(priv, "leave - scanning\n");
-        }
-
-        if (changed & (IEEE80211_CONF_CHANGE_SMPS |
-                       IEEE80211_CONF_CHANGE_CHANNEL)) {
-                /* mac80211 uses static for non-HT which is what we want */
-                priv->current_ht_config.smps = conf->smps_mode;
-
-                /*
-                 * Recalculate chain counts.
-                 *
-                 * If monitor mode is enabled then mac80211 will
-                 * set up the SM PS mode to OFF if an HT channel is
-                 * configured.
-                 */
-                if (priv->cfg->ops->hcmd->set_rxon_chain)
-                        for_each_context(priv, ctx)
-                                priv->cfg->ops->hcmd->set_rxon_chain(priv, ctx);
-        }
-
-        /* during scanning mac80211 will delay channel setting until
-         * scan finish with changed = 0
-         */
-        if (!changed || (changed & IEEE80211_CONF_CHANGE_CHANNEL)) {
-                if (scan_active)
-                        goto set_ch_out;
-
-                ch = channel->hw_value;
-                ch_info = iwl_get_channel_info(priv, channel->band, ch);
-                if (!is_channel_valid(ch_info)) {
-                        IWL_DEBUG_MAC80211(priv, "leave - invalid channel\n");
-                        ret = -EINVAL;
-                        goto set_ch_out;
-                }
 
-                spin_lock_irqsave(&priv->lock, flags);
-
-                for_each_context(priv, ctx) {
-                        /* Configure HT40 channels */
-                        ctx->ht.enabled = conf_is_ht(conf);
-                        if (ctx->ht.enabled) {
-                                if (conf_is_ht40_minus(conf)) {
-                                        ctx->ht.extension_chan_offset =
-                                                IEEE80211_HT_PARAM_CHA_SEC_BELOW;
-                                        ctx->ht.is_40mhz = true;
-                                } else if (conf_is_ht40_plus(conf)) {
-                                        ctx->ht.extension_chan_offset =
-                                                IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
-                                        ctx->ht.is_40mhz = true;
-                                } else {
-                                        ctx->ht.extension_chan_offset =
-                                                IEEE80211_HT_PARAM_CHA_SEC_NONE;
-                                        ctx->ht.is_40mhz = false;
-                                }
-                        } else
-                                ctx->ht.is_40mhz = false;
-
-                        /*
-                         * Default to no protection. Protection mode will
-                         * later be set from BSS config in iwl_ht_conf
-                         */
-                        ctx->ht.protection = IEEE80211_HT_OP_MODE_PROTECTION_NONE;
-
-                        /* if we are switching from ht to 2.4 clear flags
-                         * from any ht related info since 2.4 does not
-                         * support ht */
-                        if ((le16_to_cpu(ctx->staging.channel) != ch))
-                                ctx->staging.flags = 0;
-
-                        iwl_set_rxon_channel(priv, channel, ctx);
-                        iwl_set_rxon_ht(priv, ht_conf);
-
-                        iwl_set_flags_for_band(priv, ctx, channel->band,
-                                               ctx->vif);
-                }
-
-                spin_unlock_irqrestore(&priv->lock, flags);
-
-                if (priv->cfg->ops->lib->update_bcast_stations)
-                        ret = priv->cfg->ops->lib->update_bcast_stations(priv);
-
- set_ch_out:
-                /* The list of supported rates and rate mask can be different
-                 * for each band; since the band may have changed, reset
-                 * the rate mask to what mac80211 lists */
-                iwl_set_rate(priv);
-        }
-
-        if (changed & (IEEE80211_CONF_CHANGE_PS |
-                        IEEE80211_CONF_CHANGE_IDLE)) {
-                ret = iwl_power_update_mode(priv, false);
-                if (ret)
-                        IWL_DEBUG_MAC80211(priv, "Error setting sleep level\n");
-        }
-
-        if (changed & IEEE80211_CONF_CHANGE_POWER) {
-                IWL_DEBUG_MAC80211(priv, "TX Power old=%d new=%d\n",
-                        priv->tx_power_user_lmt, conf->power_level);
-
-                iwl_set_tx_power(priv, conf->power_level, false);
-        }
-
-        if (!iwl_is_ready(priv)) {
-                IWL_DEBUG_MAC80211(priv, "leave - not ready\n");
-                goto out;
-        }
-
-        if (scan_active)
-                goto out;
-
-        for_each_context(priv, ctx) {
-                if (memcmp(&ctx->active, &ctx->staging, sizeof(ctx->staging)))
-                        iwlcore_commit_rxon(priv, ctx);
-                else
-                        IWL_DEBUG_INFO(priv,
-                                "Not re-sending same RXON configuration.\n");
-        }
-
-out:
-        IWL_DEBUG_MAC80211(priv, "leave\n");
-        mutex_unlock(&priv->mutex);
-        return ret;
-}
-EXPORT_SYMBOL(iwl_mac_config);
-
-void iwl_mac_reset_tsf(struct ieee80211_hw *hw)
+void iwl_mac_remove_interface(struct ieee80211_hw *hw,
+                              struct ieee80211_vif *vif)
 {
         struct iwl_priv *priv = hw->priv;
-        unsigned long flags;
-        /* IBSS can only be the IWL_RXON_CTX_BSS context */
-        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
+        struct iwl_rxon_context *ctx = iwl_rxon_ctx_from_vif(vif);
 
-        mutex_lock(&priv->mutex);
         IWL_DEBUG_MAC80211(priv, "enter\n");
 
-        spin_lock_irqsave(&priv->lock, flags);
-        memset(&priv->current_ht_config, 0, sizeof(struct iwl_ht_config));
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        spin_lock_irqsave(&priv->lock, flags);
-
-        /* new association get rid of ibss beacon skb */
-        if (priv->beacon_skb)
-                dev_kfree_skb(priv->beacon_skb);
-
-        priv->beacon_skb = NULL;
-
-        priv->timestamp = 0;
-
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        iwl_scan_cancel_timeout(priv, 100);
-        if (!iwl_is_ready_rf(priv)) {
-                IWL_DEBUG_MAC80211(priv, "leave - not ready\n");
-                mutex_unlock(&priv->mutex);
-                return;
-        }
+        mutex_lock(&priv->mutex);
 
-        /* we are restarting association process
-         * clear RXON_FILTER_ASSOC_MSK bit
-         */
-        ctx->staging.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
-        iwlcore_commit_rxon(priv, ctx);
+        WARN_ON(ctx->vif != vif);
+        ctx->vif = NULL;
 
-        iwl_set_rate(priv);
+        iwl_teardown_interface(priv, vif, false);
 
+        memset(priv->bssid, 0, ETH_ALEN);
         mutex_unlock(&priv->mutex);
 
         IWL_DEBUG_MAC80211(priv, "leave\n");
+
 }
-EXPORT_SYMBOL(iwl_mac_reset_tsf);
+EXPORT_SYMBOL(iwl_mac_remove_interface);
 
 int iwl_alloc_txq_mem(struct iwl_priv *priv)
 {
@@ -2431,6 +1837,63 @@ int iwl_force_reset(struct iwl_priv *priv, int mode, bool external)
         return 0;
 }
 
+int iwl_mac_change_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                             enum nl80211_iftype newtype, bool newp2p)
+{
+        struct iwl_priv *priv = hw->priv;
+        struct iwl_rxon_context *ctx = iwl_rxon_ctx_from_vif(vif);
+        struct iwl_rxon_context *tmp;
+        u32 interface_modes;
+        int err;
+
+        newtype = ieee80211_iftype_p2p(newtype, newp2p);
+
+        mutex_lock(&priv->mutex);
+
+        interface_modes = ctx->interface_modes | ctx->exclusive_interface_modes;
+
+        if (!(interface_modes & BIT(newtype))) {
+                err = -EBUSY;
+                goto out;
+        }
+
+        if (ctx->exclusive_interface_modes & BIT(newtype)) {
+                for_each_context(priv, tmp) {
+                        if (ctx == tmp)
+                                continue;
+
+                        if (!tmp->vif)
+                                continue;
+
+                        /*
+                         * The current mode switch would be exclusive, but
+                         * another context is active ... refuse the switch.
+                         */
+                        err = -EBUSY;
+                        goto out;
+                }
+        }
+
+        /* success */
+        iwl_teardown_interface(priv, vif, true);
+        vif->type = newtype;
+        err = iwl_setup_interface(priv, ctx);
+        WARN_ON(err);
+        /*
+         * We've switched internally, but submitting to the
+         * device may have failed for some reason. Mask this
+         * error, because otherwise mac80211 will not switch
+         * (and set the interface type back) and we'll be
+         * out of sync with it.
+         */
+        err = 0;
+
+ out:
+        mutex_unlock(&priv->mutex);
+        return err;
+}
+EXPORT_SYMBOL(iwl_mac_change_interface);
+
 /**
  * iwl_bg_monitor_recover - Timer callback to check for stuck queue and recover
  *
@@ -2584,8 +2047,9 @@ EXPORT_SYMBOL(iwl_add_beacon_time);
 
 #ifdef CONFIG_PM
 
-int iwl_pci_suspend(struct pci_dev *pdev, pm_message_t state)
+int iwl_pci_suspend(struct device *device)
 {
+        struct pci_dev *pdev = to_pci_dev(device);
         struct iwl_priv *priv = pci_get_drvdata(pdev);
 
         /*
@@ -2597,18 +2061,14 @@ int iwl_pci_suspend(struct pci_dev *pdev, pm_message_t state)
          */
         iwl_apm_stop(priv);
 
-        pci_save_state(pdev);
-        pci_disable_device(pdev);
-        pci_set_power_state(pdev, PCI_D3hot);
-
         return 0;
 }
 EXPORT_SYMBOL(iwl_pci_suspend);
 
-int iwl_pci_resume(struct pci_dev *pdev)
+int iwl_pci_resume(struct device *device)
 {
+        struct pci_dev *pdev = to_pci_dev(device);
         struct iwl_priv *priv = pci_get_drvdata(pdev);
-        int ret;
         bool hw_rfkill = false;
 
         /*
@@ -2617,11 +2077,6 @@ int iwl_pci_resume(struct pci_dev *pdev)
          */
         pci_write_config_byte(pdev, PCI_CFG_RETRY_TIMEOUT, 0x00);
 
-        pci_set_power_state(pdev, PCI_D0);
-        ret = pci_enable_device(pdev);
-        if (ret)
-                return ret;
-        pci_restore_state(pdev);
         iwl_enable_interrupts(priv);
 
         if (!(iwl_read32(priv, CSR_GP_CNTRL) &
@@ -2639,4 +2094,14 @@ int iwl_pci_resume(struct pci_dev *pdev)
 }
 EXPORT_SYMBOL(iwl_pci_resume);
 
+const struct dev_pm_ops iwl_pm_ops = {
+        .suspend = iwl_pci_suspend,
+        .resume = iwl_pci_resume,
+        .freeze = iwl_pci_suspend,
+        .thaw = iwl_pci_resume,
+        .poweroff = iwl_pci_suspend,
+        .restore = iwl_pci_resume,
+};
+EXPORT_SYMBOL(iwl_pm_ops);
+
 #endif /* CONFIG_PM */
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
index 64527def059..808be731ecb 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.h
+++ b/drivers/net/wireless/iwlwifi/iwl-core.h
@@ -120,6 +120,14 @@ struct iwl_apm_ops {
         void (*config)(struct iwl_priv *priv);
 };
 
+struct iwl_isr_ops {
+        irqreturn_t (*isr) (int irq, void *data);
+        void (*free)(struct iwl_priv *priv);
+        int (*alloc)(struct iwl_priv *priv);
+        int (*reset)(struct iwl_priv *priv);
+        void (*disable)(struct iwl_priv *priv);
+};
+
 struct iwl_debugfs_ops {
         ssize_t (*rx_stats_read)(struct file *file, char __user *user_buf,
                                  size_t count, loff_t *ppos);
@@ -193,20 +201,15 @@ struct iwl_lib_ops {
         /* power */
         int (*send_tx_power) (struct iwl_priv *priv);
         void (*update_chain_flags)(struct iwl_priv *priv);
-        void (*post_associate)(struct iwl_priv *priv,
-                               struct ieee80211_vif *vif);
-        void (*config_ap)(struct iwl_priv *priv, struct ieee80211_vif *vif);
-        irqreturn_t (*isr) (int irq, void *data);
+
+        /* isr */
+        struct iwl_isr_ops isr_ops;
 
         /* eeprom operations (as defined in iwl-eeprom.h) */
         struct iwl_eeprom_ops eeprom_ops;
 
         /* temperature */
         struct iwl_temp_ops temp_ops;
-        /* station management */
-        int (*manage_ibss_station)(struct iwl_priv *priv,
-                                   struct ieee80211_vif *vif, bool add);
-        int (*update_bcast_stations)(struct iwl_priv *priv);
         /* recover from tx queue stall */
         void (*recover_from_tx_stall)(unsigned long data);
         /* check for plcp health */
@@ -235,12 +238,23 @@ struct iwl_nic_ops {
         void (*additional_nic_config)(struct iwl_priv *priv);
 };
 
+struct iwl_legacy_ops {
+        void (*post_associate)(struct iwl_priv *priv);
+        void (*config_ap)(struct iwl_priv *priv);
+        /* station management */
+        int (*update_bcast_stations)(struct iwl_priv *priv);
+        int (*manage_ibss_station)(struct iwl_priv *priv,
+                                   struct ieee80211_vif *vif, bool add);
+};
+
 struct iwl_ops {
         const struct iwl_lib_ops *lib;
         const struct iwl_hcmd_ops *hcmd;
         const struct iwl_hcmd_utils_ops *utils;
         const struct iwl_led_ops *led;
         const struct iwl_nic_ops *nic;
+        const struct iwl_legacy_ops *legacy;
+        const struct ieee80211_ops *ieee80211_ops;
 };
 
 struct iwl_mod_params {
@@ -276,7 +290,10 @@ struct iwl_mod_params {
  *      sensitivity calibration operation
  * @chain_noise_calib_by_driver: driver has the capability to perform
  *      chain noise calibration operation
-*/
+ * @shadow_reg_enable: HW shadhow register bit
+ * @no_agg_framecnt_info: uCode do not provide aggregation frame count
+ *      information
+ */
 struct iwl_base_params {
         int eeprom_size;
         int num_of_queues;      /* def: HW dependent */
@@ -306,6 +323,8 @@ struct iwl_base_params {
         const bool ucode_tracing;
         const bool sensitivity_calib_by_driver;
         const bool chain_noise_calib_by_driver;
+        const bool shadow_reg_enable;
+        const bool no_agg_framecnt_info;
 };
 /*
  * @advanced_bt_coexist: support advanced bt coexist
@@ -315,6 +334,7 @@ struct iwl_base_params {
  * @agg_time_limit: maximum number of uSec in aggregation
  * @ampdu_factor: Maximum A-MPDU length factor
  * @ampdu_density: Minimum A-MPDU spacing
+ * @bt_sco_disable: uCode should not response to BT in SCO/ESCO mode
 */
 struct iwl_bt_params {
         bool advanced_bt_coexist;
@@ -324,6 +344,7 @@ struct iwl_bt_params {
         u16 agg_time_limit;
         u8 ampdu_factor;
         u8 ampdu_density;
+        bool bt_sco_disable;
 };
 /*
  * @use_rts_for_aggregation: use rts/cts protection for HT traffic
@@ -344,6 +365,8 @@ struct iwl_ht_params {
  * @need_dc_calib: need to perform init dc calibration
  * @need_temp_offset_calib: need to perform temperature offset calibration
  * @scan_antennas: available antenna for scan operation
+ * @led_mode: 0=blinking, 1=On(RF On)/Off(RF Off)
+ * @adv_pm: advance power management
  *
  * We enable the driver to be backward compatible wrt API version. The
  * driver specifies which APIs it supports (with @ucode_api_max being the
@@ -390,14 +413,15 @@ struct iwl_cfg {
         const bool need_temp_offset_calib; /* if used set to true */
         u8 scan_rx_antennas[IEEE80211_NUM_BANDS];
         u8 scan_tx_antennas[IEEE80211_NUM_BANDS];
+        enum iwl_led_mode led_mode;
+        const bool adv_pm;
 };
 
 /***************************
  *   L i b                 *
  ***************************/
 
-struct ieee80211_hw *iwl_alloc_all(struct iwl_cfg *cfg,
-                struct ieee80211_ops *hw_ops);
+struct ieee80211_hw *iwl_alloc_all(struct iwl_cfg *cfg);
 int iwl_mac_conf_tx(struct ieee80211_hw *hw, u16 queue,
                     const struct ieee80211_tx_queue_params *params);
 int iwl_mac_tx_last_beacon(struct ieee80211_hw *hw);
@@ -425,23 +449,16 @@ int iwl_set_decrypted_flag(struct iwl_priv *priv,
                            u32 decrypt_res,
                            struct ieee80211_rx_status *stats);
 void iwl_irq_handle_error(struct iwl_priv *priv);
-void iwl_post_associate(struct iwl_priv *priv, struct ieee80211_vif *vif);
-void iwl_bss_info_changed(struct ieee80211_hw *hw,
-                                     struct ieee80211_vif *vif,
-                                     struct ieee80211_bss_conf *bss_conf,
-                                     u32 changes);
 int iwl_mac_add_interface(struct ieee80211_hw *hw,
                           struct ieee80211_vif *vif);
 void iwl_mac_remove_interface(struct ieee80211_hw *hw,
                               struct ieee80211_vif *vif);
-int iwl_mac_config(struct ieee80211_hw *hw, u32 changed);
-void iwl_config_ap(struct iwl_priv *priv, struct ieee80211_vif *vif);
-void iwl_mac_reset_tsf(struct ieee80211_hw *hw);
+int iwl_mac_change_interface(struct ieee80211_hw *hw,
+                             struct ieee80211_vif *vif,
+                             enum nl80211_iftype newtype, bool newp2p);
 int iwl_alloc_txq_mem(struct iwl_priv *priv);
 void iwl_free_txq_mem(struct iwl_priv *priv);
-void iwlcore_tx_cmd_protection(struct iwl_priv *priv,
-                               struct ieee80211_tx_info *info,
-                               __le16 fc, __le32 *tx_flags);
+
 #ifdef CONFIG_IWLWIFI_DEBUGFS
 int iwl_alloc_traffic_mem(struct iwl_priv *priv);
 void iwl_free_traffic_mem(struct iwl_priv *priv);
@@ -598,7 +615,6 @@ int iwl_enqueue_hcmd(struct iwl_priv *priv, struct iwl_host_cmd *cmd);
 /*****************************************************
  * PCI                                               *
  *****************************************************/
-irqreturn_t iwl_isr_legacy(int irq, void *data);
 
 static inline u16 iwl_pcie_link_ctl(struct iwl_priv *priv)
 {
@@ -615,9 +631,17 @@ __le32 iwl_add_beacon_time(struct iwl_priv *priv, u32 base,
                            u32 addon, u32 beacon_interval);
 
 #ifdef CONFIG_PM
-int iwl_pci_suspend(struct pci_dev *pdev, pm_message_t state);
-int iwl_pci_resume(struct pci_dev *pdev);
-#endif /* CONFIG_PM */
+int iwl_pci_suspend(struct device *device);
+int iwl_pci_resume(struct device *device);
+extern const struct dev_pm_ops iwl_pm_ops;
+
+#define IWL_PM_OPS      (&iwl_pm_ops)
+
+#else /* !CONFIG_PM */
+
+#define IWL_PM_OPS      NULL
+
+#endif /* !CONFIG_PM */
 
 /*****************************************************
 *  Error Handling Debugging
@@ -724,11 +748,6 @@ static inline int iwlcore_commit_rxon(struct iwl_priv *priv,
 {
         return priv->cfg->ops->hcmd->commit_rxon(priv, ctx);
 }
-static inline void iwlcore_config_ap(struct iwl_priv *priv,
-                                     struct ieee80211_vif *vif)
-{
-        priv->cfg->ops->lib->config_ap(priv, vif);
-}
 static inline const struct ieee80211_supported_band *iwl_get_hw_mode(
                         struct iwl_priv *priv, enum ieee80211_band band)
 {
diff --git a/drivers/net/wireless/iwlwifi/iwl-csr.h b/drivers/net/wireless/iwlwifi/iwl-csr.h
index 2aa15ab1389..b80bf7dff55 100644
--- a/drivers/net/wireless/iwlwifi/iwl-csr.h
+++ b/drivers/net/wireless/iwlwifi/iwl-csr.h
@@ -132,6 +132,8 @@
 
 #define CSR_LED_REG             (CSR_BASE+0x094)
 #define CSR_DRAM_INT_TBL_REG    (CSR_BASE+0x0A0)
+#define CSR_MAC_SHADOW_REG_CTRL (CSR_BASE+0x0A8) /* 6000 and up */
+
 
 /* GIO Chicken Bits (PCI Express bus link power management) */
 #define CSR_GIO_CHICKEN_BITS    (CSR_BASE+0x100)
diff --git a/drivers/net/wireless/iwlwifi/iwl-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
index 8fdd4efdb1d..3cc58420d44 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debugfs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
@@ -992,11 +992,8 @@ static ssize_t iwl_dbgfs_tx_queue_read(struct file *file,
                                 " swq_id=%#.2x (ac %d/hwq %d)\n",
                                 cnt, q->read_ptr, q->write_ptr,
                                 !!test_bit(cnt, priv->queue_stopped),
-                                txq->swq_id,
-                                txq->swq_id & 0x80 ? txq->swq_id & 3 :
-                                txq->swq_id,
-                                txq->swq_id & 0x80 ? (txq->swq_id >> 2) &
-                                0x1f : txq->swq_id);
+                                txq->swq_id, txq->swq_id & 3,
+                                (txq->swq_id >> 2) & 0x1f);
                 if (cnt >= 4)
                         continue;
                 /* for the ACs, display the stop count too */
@@ -1580,7 +1577,7 @@ static ssize_t iwl_dbgfs_bt_traffic_read(struct file *file,
                 priv->bt_full_concurrent ? "full concurrency" : "3-wire");
         pos += scnprintf(buf + pos, bufsz - pos, "BT status: %s, "
                          "last traffic notif: %d\n",
-                priv->bt_status ? "On" : "Off", priv->notif_bt_traffic_load);
+                priv->bt_status ? "On" : "Off", priv->last_bt_traffic_load);
         pos += scnprintf(buf + pos, bufsz - pos, "ch_announcement: %d, "
                          "sco_active: %d, kill_ack_mask: %x, "
                          "kill_cts_mask: %x\n",
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index 70e07fa4840..ea81ced1375 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -1162,6 +1162,8 @@ struct iwl_rxon_context {
          */
         bool always_active, is_active;
 
+        bool ht_need_multiple_chains;
+
         enum iwl_rxon_context_id ctxid;
 
         u32 interface_modes, exclusive_interface_modes;
@@ -1469,7 +1471,7 @@ struct iwl_priv {
 
         /* bt coex */
         u8 bt_status;
-        u8 bt_traffic_load, notif_bt_traffic_load;
+        u8 bt_traffic_load, last_bt_traffic_load;
         bool bt_ch_announce;
         bool bt_sco_active;
         bool bt_full_concurrent;
@@ -1480,7 +1482,6 @@ struct iwl_priv {
         u16 bt_on_thresh;
         u16 bt_duration;
         u16 dynamic_frag_thresh;
-        u16 dynamic_agg_thresh;
         u8 bt_ci_compliance;
         struct work_struct bt_traffic_change_work;
 
@@ -1517,6 +1518,7 @@ struct iwl_priv {
         s8 tx_power_user_lmt;
         s8 tx_power_device_lmt;
         s8 tx_power_lmt_in_half_dbm; /* max tx power in half-dBm format */
+        s8 tx_power_next;
 
 
 #ifdef CONFIG_IWLWIFI_DEBUG
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.h b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
index d9b590625ae..e87be1e551a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.h
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
@@ -110,9 +110,18 @@ enum {
 };
 
 /* SKU Capabilities */
+/* 3945 only */
 #define EEPROM_SKU_CAP_SW_RF_KILL_ENABLE                (1 << 0)
 #define EEPROM_SKU_CAP_HW_RF_KILL_ENABLE                (1 << 1)
 
+/* 5000 and up */
+#define EEPROM_SKU_CAP_BAND_POS                         (4)
+#define EEPROM_SKU_CAP_BAND_SELECTION                   \
+                (3 << EEPROM_SKU_CAP_BAND_POS)
+#define EEPROM_SKU_CAP_11N_ENABLE                       (1 << 6)
+#define EEPROM_SKU_CAP_AMT_ENABLE                       (1 << 7)
+#define EEPROM_SKU_CAP_IPAN_ENABLE                      (1 << 8)
+
 /* *regulatory* channel data format in eeprom, one for each channel.
  * There are separate entries for HT40 (40 MHz) vs. normal (20 MHz) channels. */
 struct iwl_eeprom_channel {
@@ -397,7 +406,7 @@ struct iwl_eeprom_calib_info {
 #define EEPROM_BOARD_REVISION               (2*0x35)    /* 2  bytes */
 #define EEPROM_BOARD_PBA_NUMBER             (2*0x3B+1)  /* 9  bytes */
 #define EEPROM_VERSION                      (2*0x44)    /* 2  bytes */
-#define EEPROM_SKU_CAP                      (2*0x45)    /* 1  bytes */
+#define EEPROM_SKU_CAP                      (2*0x45)    /* 2  bytes */
 #define EEPROM_OEM_MODE                     (2*0x46)    /* 2  bytes */
 #define EEPROM_WOWLAN_MODE                  (2*0x47)    /* 2  bytes */
 #define EEPROM_RADIO_CONFIG                 (2*0x48)    /* 2  bytes */
@@ -504,6 +513,7 @@ struct iwl_eeprom_ops {
 int iwl_eeprom_init(struct iwl_priv *priv);
 void iwl_eeprom_free(struct iwl_priv *priv);
 int  iwl_eeprom_check_version(struct iwl_priv *priv);
+int  iwl_eeprom_check_sku(struct iwl_priv *priv);
 const u8 *iwl_eeprom_query_addr(const struct iwl_priv *priv, size_t offset);
 int iwlcore_eeprom_verify_signature(struct iwl_priv *priv);
 u16 iwl_eeprom_query16(const struct iwl_priv *priv, size_t offset);
diff --git a/drivers/net/wireless/iwlwifi/iwl-helpers.h b/drivers/net/wireless/iwlwifi/iwl-helpers.h
index 1aaef70deae..3f5bedd8875 100644
--- a/drivers/net/wireless/iwlwifi/iwl-helpers.h
+++ b/drivers/net/wireless/iwlwifi/iwl-helpers.h
@@ -44,15 +44,6 @@ static inline struct ieee80211_conf *ieee80211_get_hw_conf(
         return &hw->conf;
 }
 
-static inline unsigned long elapsed_jiffies(unsigned long start,
-                                            unsigned long end)
-{
-        if (end >= start)
-                return end - start;
-
-        return end + (MAX_JIFFY_OFFSET - start) + 1;
-}
-
 /**
  * iwl_queue_inc_wrap - increment queue index, wrap back to beginning
  * @index -- current index
@@ -104,42 +95,36 @@ static inline int iwl_alloc_fw_desc(struct pci_dev *pci_dev,
  * | | | | | | | |
  * | | | | | | +-+-------- AC queue (0-3)
  * | | | | | |
- * | +-+-+-+-+------------ HW A-MPDU queue
+ * | +-+-+-+-+------------ HW queue ID
  * |
- * +---------------------- indicates agg queue
+ * +---------------------- unused
  */
-static inline u8 iwl_virtual_agg_queue_num(u8 ac, u8 hwq)
+static inline void iwl_set_swq_id(struct iwl_tx_queue *txq, u8 ac, u8 hwq)
 {
         BUG_ON(ac > 3);   /* only have 2 bits */
-        BUG_ON(hwq > 31); /* only have 5 bits */
+        BUG_ON(hwq > 31); /* only use 5 bits */
 
-        return 0x80 | (hwq << 2) | ac;
+        txq->swq_id = (hwq << 2) | ac;
 }
 
-static inline void iwl_wake_queue(struct iwl_priv *priv, u8 queue)
+static inline void iwl_wake_queue(struct iwl_priv *priv,
+                                  struct iwl_tx_queue *txq)
 {
-        u8 ac = queue;
-        u8 hwq = queue;
-
-        if (queue & 0x80) {
-                ac = queue & 3;
-                hwq = (queue >> 2) & 0x1f;
-        }
+        u8 queue = txq->swq_id;
+        u8 ac = queue & 3;
+        u8 hwq = (queue >> 2) & 0x1f;
 
         if (test_and_clear_bit(hwq, priv->queue_stopped))
                 if (atomic_dec_return(&priv->queue_stop_count[ac]) <= 0)
                         ieee80211_wake_queue(priv->hw, ac);
 }
 
-static inline void iwl_stop_queue(struct iwl_priv *priv, u8 queue)
+static inline void iwl_stop_queue(struct iwl_priv *priv,
+                                  struct iwl_tx_queue *txq)
 {
-        u8 ac = queue;
-        u8 hwq = queue;
-
-        if (queue & 0x80) {
-                ac = queue & 3;
-                hwq = (queue >> 2) & 0x1f;
-        }
+        u8 queue = txq->swq_id;
+        u8 ac = queue & 3;
+        u8 hwq = (queue >> 2) & 0x1f;
 
         if (!test_and_set_bit(hwq, priv->queue_stopped))
                 if (atomic_inc_return(&priv->queue_stop_count[ac]) > 0)
diff --git a/drivers/net/wireless/iwlwifi/iwl-led.c b/drivers/net/wireless/iwlwifi/iwl-led.c
index 86c2b6fed0c..516e5577ed2 100644
--- a/drivers/net/wireless/iwlwifi/iwl-led.c
+++ b/drivers/net/wireless/iwlwifi/iwl-led.c
@@ -45,9 +45,8 @@
 /* default: IWL_LED_BLINK(0) using blinking index table */
 static int led_mode;
 module_param(led_mode, int, S_IRUGO);
-MODULE_PARM_DESC(led_mode, "led mode: 0=blinking, 1=On(RF On)/Off(RF Off), "
-                           "(default 0)");
-
+MODULE_PARM_DESC(led_mode, "led mode: 0=system default, "
+                "1=On(RF On)/Off(RF Off), 2=blinking");
 
 static const struct {
         u16 tpt;        /* Mb/s */
@@ -128,12 +127,13 @@ EXPORT_SYMBOL(iwl_led_start);
 int iwl_led_associate(struct iwl_priv *priv)
 {
         IWL_DEBUG_LED(priv, "Associated\n");
-        if (led_mode == IWL_LED_BLINK)
+        if (priv->cfg->led_mode == IWL_LED_BLINK)
                 priv->allow_blinking = 1;
         priv->last_blink_time = jiffies;
 
         return 0;
 }
+EXPORT_SYMBOL(iwl_led_associate);
 
 int iwl_led_disassociate(struct iwl_priv *priv)
 {
@@ -141,6 +141,7 @@ int iwl_led_disassociate(struct iwl_priv *priv)
 
         return 0;
 }
+EXPORT_SYMBOL(iwl_led_disassociate);
 
 /*
  * calculate blink rate according to last second Tx/Rx activities
@@ -221,5 +222,8 @@ void iwl_leds_init(struct iwl_priv *priv)
         priv->last_blink_rate = 0;
         priv->last_blink_time = 0;
         priv->allow_blinking = 0;
+        if (led_mode != IWL_LED_DEFAULT &&
+            led_mode != priv->cfg->led_mode)
+                priv->cfg->led_mode = led_mode;
 }
 EXPORT_SYMBOL(iwl_leds_init);
diff --git a/drivers/net/wireless/iwlwifi/iwl-led.h b/drivers/net/wireless/iwlwifi/iwl-led.h
index 49a70baa3fb..9079b33486e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-led.h
+++ b/drivers/net/wireless/iwlwifi/iwl-led.h
@@ -47,14 +47,16 @@ enum led_type {
 
 /*
  * LED mode
- *    IWL_LED_BLINK:    adjust led blink rate based on blink table
+ *    IWL_LED_DEFAULT:  use system default
  *    IWL_LED_RF_STATE: turn LED on/off based on RF state
  *                      LED ON  = RF ON
  *                      LED OFF = RF OFF
+ *    IWL_LED_BLINK:    adjust led blink rate based on blink table
  */
 enum iwl_led_mode {
-        IWL_LED_BLINK,
+        IWL_LED_DEFAULT,
         IWL_LED_RF_STATE,
+        IWL_LED_BLINK,
 };
 
 void iwl_leds_init(struct iwl_priv *priv);
diff --git a/drivers/net/wireless/iwlwifi/iwl-legacy.c b/drivers/net/wireless/iwlwifi/iwl-legacy.c
new file mode 100644
index 00000000000..a08b4e56e6b
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-legacy.c
@@ -0,0 +1,662 @@
+/******************************************************************************
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called LICENSE.GPL.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *****************************************************************************/
+
+#include <linux/kernel.h>
+#include <net/mac80211.h>
+
+#include "iwl-dev.h"
+#include "iwl-core.h"
+#include "iwl-helpers.h"
+#include "iwl-legacy.h"
+
+static void iwl_update_qos(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
+{
+        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+                return;
+
+        if (!ctx->is_active)
+                return;
+
+        ctx->qos_data.def_qos_parm.qos_flags = 0;
+
+        if (ctx->qos_data.qos_active)
+                ctx->qos_data.def_qos_parm.qos_flags |=
+                        QOS_PARAM_FLG_UPDATE_EDCA_MSK;
+
+        if (ctx->ht.enabled)
+                ctx->qos_data.def_qos_parm.qos_flags |= QOS_PARAM_FLG_TGN_MSK;
+
+        IWL_DEBUG_QOS(priv, "send QoS cmd with Qos active=%d FLAGS=0x%X\n",
+                      ctx->qos_data.qos_active,
+                      ctx->qos_data.def_qos_parm.qos_flags);
+
+        iwl_send_cmd_pdu_async(priv, ctx->qos_cmd,
+                               sizeof(struct iwl_qosparam_cmd),
+                               &ctx->qos_data.def_qos_parm, NULL);
+}
+
+/**
+ * iwl_legacy_mac_config - mac80211 config callback
+ */
+int iwl_legacy_mac_config(struct ieee80211_hw *hw, u32 changed)
+{
+        struct iwl_priv *priv = hw->priv;
+        const struct iwl_channel_info *ch_info;
+        struct ieee80211_conf *conf = &hw->conf;
+        struct ieee80211_channel *channel = conf->channel;
+        struct iwl_ht_config *ht_conf = &priv->current_ht_config;
+        struct iwl_rxon_context *ctx;
+        unsigned long flags = 0;
+        int ret = 0;
+        u16 ch;
+        int scan_active = 0;
+        bool ht_changed[NUM_IWL_RXON_CTX] = {};
+
+        if (WARN_ON(!priv->cfg->ops->legacy))
+                return -EOPNOTSUPP;
+
+        mutex_lock(&priv->mutex);
+
+        IWL_DEBUG_MAC80211(priv, "enter to channel %d changed 0x%X\n",
+                                        channel->hw_value, changed);
+
+        if (unlikely(!priv->cfg->mod_params->disable_hw_scan &&
+                        test_bit(STATUS_SCANNING, &priv->status))) {
+                scan_active = 1;
+                IWL_DEBUG_MAC80211(priv, "leave - scanning\n");
+        }
+
+        if (changed & (IEEE80211_CONF_CHANGE_SMPS |
+                       IEEE80211_CONF_CHANGE_CHANNEL)) {
+                /* mac80211 uses static for non-HT which is what we want */
+                priv->current_ht_config.smps = conf->smps_mode;
+
+                /*
+                 * Recalculate chain counts.
+                 *
+                 * If monitor mode is enabled then mac80211 will
+                 * set up the SM PS mode to OFF if an HT channel is
+                 * configured.
+                 */
+                if (priv->cfg->ops->hcmd->set_rxon_chain)
+                        for_each_context(priv, ctx)
+                                priv->cfg->ops->hcmd->set_rxon_chain(priv, ctx);
+        }
+
+        /* during scanning mac80211 will delay channel setting until
+         * scan finish with changed = 0
+         */
+        if (!changed || (changed & IEEE80211_CONF_CHANGE_CHANNEL)) {
+                if (scan_active)
+                        goto set_ch_out;
+
+                ch = channel->hw_value;
+                ch_info = iwl_get_channel_info(priv, channel->band, ch);
+                if (!is_channel_valid(ch_info)) {
+                        IWL_DEBUG_MAC80211(priv, "leave - invalid channel\n");
+                        ret = -EINVAL;
+                        goto set_ch_out;
+                }
+
+                spin_lock_irqsave(&priv->lock, flags);
+
+                for_each_context(priv, ctx) {
+                        /* Configure HT40 channels */
+                        if (ctx->ht.enabled != conf_is_ht(conf)) {
+                                ctx->ht.enabled = conf_is_ht(conf);
+                                ht_changed[ctx->ctxid] = true;
+                        }
+                        if (ctx->ht.enabled) {
+                                if (conf_is_ht40_minus(conf)) {
+                                        ctx->ht.extension_chan_offset =
+                                                IEEE80211_HT_PARAM_CHA_SEC_BELOW;
+                                        ctx->ht.is_40mhz = true;
+                                } else if (conf_is_ht40_plus(conf)) {
+                                        ctx->ht.extension_chan_offset =
+                                                IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
+                                        ctx->ht.is_40mhz = true;
+                                } else {
+                                        ctx->ht.extension_chan_offset =
+                                                IEEE80211_HT_PARAM_CHA_SEC_NONE;
+                                        ctx->ht.is_40mhz = false;
+                                }
+                        } else
+                                ctx->ht.is_40mhz = false;
+
+                        /*
+                         * Default to no protection. Protection mode will
+                         * later be set from BSS config in iwl_ht_conf
+                         */
+                        ctx->ht.protection = IEEE80211_HT_OP_MODE_PROTECTION_NONE;
+
+                        /* if we are switching from ht to 2.4 clear flags
+                         * from any ht related info since 2.4 does not
+                         * support ht */
+                        if ((le16_to_cpu(ctx->staging.channel) != ch))
+                                ctx->staging.flags = 0;
+
+                        iwl_set_rxon_channel(priv, channel, ctx);
+                        iwl_set_rxon_ht(priv, ht_conf);
+
+                        iwl_set_flags_for_band(priv, ctx, channel->band,
+                                               ctx->vif);
+                }
+
+                spin_unlock_irqrestore(&priv->lock, flags);
+
+                if (priv->cfg->ops->legacy->update_bcast_stations)
+                        ret = priv->cfg->ops->legacy->update_bcast_stations(priv);
+
+ set_ch_out:
+                /* The list of supported rates and rate mask can be different
+                 * for each band; since the band may have changed, reset
+                 * the rate mask to what mac80211 lists */
+                iwl_set_rate(priv);
+        }
+
+        if (changed & (IEEE80211_CONF_CHANGE_PS |
+                        IEEE80211_CONF_CHANGE_IDLE)) {
+                ret = iwl_power_update_mode(priv, false);
+                if (ret)
+                        IWL_DEBUG_MAC80211(priv, "Error setting sleep level\n");
+        }
+
+        if (changed & IEEE80211_CONF_CHANGE_POWER) {
+                IWL_DEBUG_MAC80211(priv, "TX Power old=%d new=%d\n",
+                        priv->tx_power_user_lmt, conf->power_level);
+
+                iwl_set_tx_power(priv, conf->power_level, false);
+        }
+
+        if (!iwl_is_ready(priv)) {
+                IWL_DEBUG_MAC80211(priv, "leave - not ready\n");
+                goto out;
+        }
+
+        if (scan_active)
+                goto out;
+
+        for_each_context(priv, ctx) {
+                if (memcmp(&ctx->active, &ctx->staging, sizeof(ctx->staging)))
+                        iwlcore_commit_rxon(priv, ctx);
+                else
+                        IWL_DEBUG_INFO(priv,
+                                "Not re-sending same RXON configuration.\n");
+                if (ht_changed[ctx->ctxid])
+                        iwl_update_qos(priv, ctx);
+        }
+
+out:
+        IWL_DEBUG_MAC80211(priv, "leave\n");
+        mutex_unlock(&priv->mutex);
+        return ret;
+}
+EXPORT_SYMBOL(iwl_legacy_mac_config);
+
+void iwl_legacy_mac_reset_tsf(struct ieee80211_hw *hw)
+{
+        struct iwl_priv *priv = hw->priv;
+        unsigned long flags;
+        /* IBSS can only be the IWL_RXON_CTX_BSS context */
+        struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
+
+        if (WARN_ON(!priv->cfg->ops->legacy))
+                return;
+
+        mutex_lock(&priv->mutex);
+        IWL_DEBUG_MAC80211(priv, "enter\n");
+
+        spin_lock_irqsave(&priv->lock, flags);
+        memset(&priv->current_ht_config, 0, sizeof(struct iwl_ht_config));
+        spin_unlock_irqrestore(&priv->lock, flags);
+
+        spin_lock_irqsave(&priv->lock, flags);
+
+        /* new association get rid of ibss beacon skb */
+        if (priv->beacon_skb)
+                dev_kfree_skb(priv->beacon_skb);
+
+        priv->beacon_skb = NULL;
+
+        priv->timestamp = 0;
+
+        spin_unlock_irqrestore(&priv->lock, flags);
+
+        iwl_scan_cancel_timeout(priv, 100);
+        if (!iwl_is_ready_rf(priv)) {
+                IWL_DEBUG_MAC80211(priv, "leave - not ready\n");
+                mutex_unlock(&priv->mutex);
+                return;
+        }
+
+        /* we are restarting association process
+         * clear RXON_FILTER_ASSOC_MSK bit
+         */
+        ctx->staging.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
+        iwlcore_commit_rxon(priv, ctx);
+
+        iwl_set_rate(priv);
+
+        mutex_unlock(&priv->mutex);
+
+        IWL_DEBUG_MAC80211(priv, "leave\n");
+}
+EXPORT_SYMBOL(iwl_legacy_mac_reset_tsf);
+
+static void iwl_ht_conf(struct iwl_priv *priv,
+                        struct ieee80211_vif *vif)
+{
+        struct iwl_ht_config *ht_conf = &priv->current_ht_config;
+        struct ieee80211_sta *sta;
+        struct ieee80211_bss_conf *bss_conf = &vif->bss_conf;
+        struct iwl_rxon_context *ctx = iwl_rxon_ctx_from_vif(vif);
+
+        IWL_DEBUG_ASSOC(priv, "enter:\n");
+
+        if (!ctx->ht.enabled)
+                return;
+
+        ctx->ht.protection =
+                bss_conf->ht_operation_mode & IEEE80211_HT_OP_MODE_PROTECTION;
+        ctx->ht.non_gf_sta_present =
+                !!(bss_conf->ht_operation_mode & IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT);
+
+        ht_conf->single_chain_sufficient = false;
+
+        switch (vif->type) {
+        case NL80211_IFTYPE_STATION:
+                rcu_read_lock();
+                sta = ieee80211_find_sta(vif, bss_conf->bssid);
+                if (sta) {
+                        struct ieee80211_sta_ht_cap *ht_cap = &sta->ht_cap;
+                        int maxstreams;
+
+                        maxstreams = (ht_cap->mcs.tx_params &
+                                      IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK)
+                                        >> IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT;
+                        maxstreams += 1;
+
+                        if ((ht_cap->mcs.rx_mask[1] == 0) &&
+                            (ht_cap->mcs.rx_mask[2] == 0))
+                                ht_conf->single_chain_sufficient = true;
+                        if (maxstreams <= 1)
+                                ht_conf->single_chain_sufficient = true;
+                } else {
+                        /*
+                         * If at all, this can only happen through a race
+                         * when the AP disconnects us while we're still
+                         * setting up the connection, in that case mac80211
+                         * will soon tell us about that.
+                         */
+                        ht_conf->single_chain_sufficient = true;
+                }
+                rcu_read_unlock();
+                break;
+        case NL80211_IFTYPE_ADHOC:
+                ht_conf->single_chain_sufficient = true;
+                break;
+        default:
+                break;
+        }
+
+        IWL_DEBUG_ASSOC(priv, "leave\n");
+}
+
+static inline void iwl_set_no_assoc(struct iwl_priv *priv,
+                                    struct ieee80211_vif *vif)
+{
+        struct iwl_rxon_context *ctx = iwl_rxon_ctx_from_vif(vif);
+
+        iwl_led_disassociate(priv);
+        /*
+         * inform the ucode that there is no longer an
+         * association and that no more packets should be
+         * sent
+         */
+        ctx->staging.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
+        ctx->staging.assoc_id = 0;
+        iwlcore_commit_rxon(priv, ctx);
+}
+
+static void iwlcore_beacon_update(struct ieee80211_hw *hw,
+                                  struct ieee80211_vif *vif)
+{
+        struct iwl_priv *priv = hw->priv;
+        unsigned long flags;
+        __le64 timestamp;
+        struct sk_buff *skb = ieee80211_beacon_get(hw, vif);
+
+        if (!skb)
+                return;
+
+        IWL_DEBUG_MAC80211(priv, "enter\n");
+
+        lockdep_assert_held(&priv->mutex);
+
+        if (!priv->beacon_ctx) {
+                IWL_ERR(priv, "update beacon but no beacon context!\n");
+                dev_kfree_skb(skb);
+                return;
+        }
+
+        spin_lock_irqsave(&priv->lock, flags);
+
+        if (priv->beacon_skb)
+                dev_kfree_skb(priv->beacon_skb);
+
+        priv->beacon_skb = skb;
+
+        timestamp = ((struct ieee80211_mgmt *)skb->data)->u.beacon.timestamp;
+        priv->timestamp = le64_to_cpu(timestamp);
+
+        IWL_DEBUG_MAC80211(priv, "leave\n");
+        spin_unlock_irqrestore(&priv->lock, flags);
+
+        if (!iwl_is_ready_rf(priv)) {
+                IWL_DEBUG_MAC80211(priv, "leave - RF not ready\n");
+                return;
+        }
+
+        priv->cfg->ops->legacy->post_associate(priv);
+}
+
+void iwl_legacy_mac_bss_info_changed(struct ieee80211_hw *hw,
+                                     struct ieee80211_vif *vif,
+                                     struct ieee80211_bss_conf *bss_conf,
+                                     u32 changes)
+{
+        struct iwl_priv *priv = hw->priv;
+        struct iwl_rxon_context *ctx = iwl_rxon_ctx_from_vif(vif);
+        int ret;
+
+        if (WARN_ON(!priv->cfg->ops->legacy))
+                return;
+
+        IWL_DEBUG_MAC80211(priv, "changes = 0x%X\n", changes);
+
+        if (!iwl_is_alive(priv))
+                return;
+
+        mutex_lock(&priv->mutex);
+
+        if (changes & BSS_CHANGED_QOS) {
+                unsigned long flags;
+
+                spin_lock_irqsave(&priv->lock, flags);
+                ctx->qos_data.qos_active = bss_conf->qos;
+                iwl_update_qos(priv, ctx);
+                spin_unlock_irqrestore(&priv->lock, flags);
+        }
+
+        if (changes & BSS_CHANGED_BEACON_ENABLED) {
+                /*
+                 * the add_interface code must make sure we only ever
+                 * have a single interface that could be beaconing at
+                 * any time.
+                 */
+                if (vif->bss_conf.enable_beacon)
+                        priv->beacon_ctx = ctx;
+                else
+                        priv->beacon_ctx = NULL;
+        }
+
+        if (changes & BSS_CHANGED_BEACON && vif->type == NL80211_IFTYPE_AP) {
+                dev_kfree_skb(priv->beacon_skb);
+                priv->beacon_skb = ieee80211_beacon_get(hw, vif);
+        }
+
+        if (changes & BSS_CHANGED_BEACON_INT && vif->type == NL80211_IFTYPE_AP)
+                iwl_send_rxon_timing(priv, ctx);
+
+        if (changes & BSS_CHANGED_BSSID) {
+                IWL_DEBUG_MAC80211(priv, "BSSID %pM\n", bss_conf->bssid);
+
+                /*
+                 * If there is currently a HW scan going on in the
+                 * background then we need to cancel it else the RXON
+                 * below/in post_associate will fail.
+                 */
+                if (iwl_scan_cancel_timeout(priv, 100)) {
+                        IWL_WARN(priv, "Aborted scan still in progress after 100ms\n");
+                        IWL_DEBUG_MAC80211(priv, "leaving - scan abort failed.\n");
+                        mutex_unlock(&priv->mutex);
+                        return;
+                }
+
+                /* mac80211 only sets assoc when in STATION mode */
+                if (vif->type == NL80211_IFTYPE_ADHOC || bss_conf->assoc) {
+                        memcpy(ctx->staging.bssid_addr,
+                               bss_conf->bssid, ETH_ALEN);
+
+                        /* currently needed in a few places */
+                        memcpy(priv->bssid, bss_conf->bssid, ETH_ALEN);
+                } else {
+                        ctx->staging.filter_flags &=
+                                ~RXON_FILTER_ASSOC_MSK;
+                }
+
+        }
+
+        /*
+         * This needs to be after setting the BSSID in case
+         * mac80211 decides to do both changes at once because
+         * it will invoke post_associate.
+         */
+        if (vif->type == NL80211_IFTYPE_ADHOC && changes & BSS_CHANGED_BEACON)
+                iwlcore_beacon_update(hw, vif);
+
+        if (changes & BSS_CHANGED_ERP_PREAMBLE) {
+                IWL_DEBUG_MAC80211(priv, "ERP_PREAMBLE %d\n",
+                                   bss_conf->use_short_preamble);
+                if (bss_conf->use_short_preamble)
+                        ctx->staging.flags |= RXON_FLG_SHORT_PREAMBLE_MSK;
+                else
+                        ctx->staging.flags &= ~RXON_FLG_SHORT_PREAMBLE_MSK;
+        }
+
+        if (changes & BSS_CHANGED_ERP_CTS_PROT) {
+                IWL_DEBUG_MAC80211(priv, "ERP_CTS %d\n", bss_conf->use_cts_prot);
+                if (bss_conf->use_cts_prot && (priv->band != IEEE80211_BAND_5GHZ))
+                        ctx->staging.flags |= RXON_FLG_TGG_PROTECT_MSK;
+                else
+                        ctx->staging.flags &= ~RXON_FLG_TGG_PROTECT_MSK;
+                if (bss_conf->use_cts_prot)
+                        ctx->staging.flags |= RXON_FLG_SELF_CTS_EN;
+                else
+                        ctx->staging.flags &= ~RXON_FLG_SELF_CTS_EN;
+        }
+
+        if (changes & BSS_CHANGED_BASIC_RATES) {
+                /* XXX use this information
+                 *
+                 * To do that, remove code from iwl_set_rate() and put something
+                 * like this here:
+                 *
+                if (A-band)
+                        ctx->staging.ofdm_basic_rates =
+                                bss_conf->basic_rates;
+                else
+                        ctx->staging.ofdm_basic_rates =
+                                bss_conf->basic_rates >> 4;
+                        ctx->staging.cck_basic_rates =
+                                bss_conf->basic_rates & 0xF;
+                 */
+        }
+
+        if (changes & BSS_CHANGED_HT) {
+                iwl_ht_conf(priv, vif);
+
+                if (priv->cfg->ops->hcmd->set_rxon_chain)
+                        priv->cfg->ops->hcmd->set_rxon_chain(priv, ctx);
+        }
+
+        if (changes & BSS_CHANGED_ASSOC) {
+                IWL_DEBUG_MAC80211(priv, "ASSOC %d\n", bss_conf->assoc);
+                if (bss_conf->assoc) {
+                        priv->timestamp = bss_conf->timestamp;
+
+                        iwl_led_associate(priv);
+
+                        if (!iwl_is_rfkill(priv))
+                                priv->cfg->ops->legacy->post_associate(priv);
+                } else
+                        iwl_set_no_assoc(priv, vif);
+        }
+
+        if (changes && iwl_is_associated_ctx(ctx) && bss_conf->aid) {
+                IWL_DEBUG_MAC80211(priv, "Changes (%#x) while associated\n",
+                                   changes);
+                ret = iwl_send_rxon_assoc(priv, ctx);
+                if (!ret) {
+                        /* Sync active_rxon with latest change. */
+                        memcpy((void *)&ctx->active,
+                                &ctx->staging,
+                                sizeof(struct iwl_rxon_cmd));
+                }
+        }
+
+        if (changes & BSS_CHANGED_BEACON_ENABLED) {
+                if (vif->bss_conf.enable_beacon) {
+                        memcpy(ctx->staging.bssid_addr,
+                               bss_conf->bssid, ETH_ALEN);
+                        memcpy(priv->bssid, bss_conf->bssid, ETH_ALEN);
+                        iwl_led_associate(priv);
+                        priv->cfg->ops->legacy->config_ap(priv);
+                } else
+                        iwl_set_no_assoc(priv, vif);
+        }
+
+        if (changes & BSS_CHANGED_IBSS) {
+                ret = priv->cfg->ops->legacy->manage_ibss_station(priv, vif,
+                                                        bss_conf->ibss_joined);
+                if (ret)
+                        IWL_ERR(priv, "failed to %s IBSS station %pM\n",
+                                bss_conf->ibss_joined ? "add" : "remove",
+                                bss_conf->bssid);
+        }
+
+        mutex_unlock(&priv->mutex);
+
+        IWL_DEBUG_MAC80211(priv, "leave\n");
+}
+EXPORT_SYMBOL(iwl_legacy_mac_bss_info_changed);
+
+irqreturn_t iwl_isr_legacy(int irq, void *data)
+{
+        struct iwl_priv *priv = data;
+        u32 inta, inta_mask;
+        u32 inta_fh;
+        unsigned long flags;
+        if (!priv)
+                return IRQ_NONE;
+
+        spin_lock_irqsave(&priv->lock, flags);
+
+        /* Disable (but don't clear!) interrupts here to avoid
+         *    back-to-back ISRs and sporadic interrupts from our NIC.
+         * If we have something to service, the tasklet will re-enable ints.
+         * If we *don't* have something, we'll re-enable before leaving here. */
+        inta_mask = iwl_read32(priv, CSR_INT_MASK);  /* just for debug */
+        iwl_write32(priv, CSR_INT_MASK, 0x00000000);
+
+        /* Discover which interrupts are active/pending */
+        inta = iwl_read32(priv, CSR_INT);
+        inta_fh = iwl_read32(priv, CSR_FH_INT_STATUS);
+
+        /* Ignore interrupt if there's nothing in NIC to service.
+         * This may be due to IRQ shared with another device,
+         * or due to sporadic interrupts thrown from our NIC. */
+        if (!inta && !inta_fh) {
+                IWL_DEBUG_ISR(priv,
+                        "Ignore interrupt, inta == 0, inta_fh == 0\n");
+                goto none;
+        }
+
+        if ((inta == 0xFFFFFFFF) || ((inta & 0xFFFFFFF0) == 0xa5a5a5a0)) {
+                /* Hardware disappeared. It might have already raised
+                 * an interrupt */
+                IWL_WARN(priv, "HARDWARE GONE?? INTA == 0x%08x\n", inta);
+                goto unplugged;
+        }
+
+        IWL_DEBUG_ISR(priv, "ISR inta 0x%08x, enabled 0x%08x, fh 0x%08x\n",
+                      inta, inta_mask, inta_fh);
+
+        inta &= ~CSR_INT_BIT_SCD;
+
+        /* iwl_irq_tasklet() will service interrupts and re-enable them */
+        if (likely(inta || inta_fh))
+                tasklet_schedule(&priv->irq_tasklet);
+
+unplugged:
+        spin_unlock_irqrestore(&priv->lock, flags);
+        return IRQ_HANDLED;
+
+none:
+        /* re-enable interrupts here since we don't have anything to service. */
+        /* only Re-enable if diabled by irq */
+        if (test_bit(STATUS_INT_ENABLED, &priv->status))
+                iwl_enable_interrupts(priv);
+        spin_unlock_irqrestore(&priv->lock, flags);
+        return IRQ_NONE;
+}
+EXPORT_SYMBOL(iwl_isr_legacy);
+
+/*
+ *  iwl_legacy_tx_cmd_protection: Set rts/cts. 3945 and 4965 only share this
+ *  function.
+ */
+void iwl_legacy_tx_cmd_protection(struct iwl_priv *priv,
+                               struct ieee80211_tx_info *info,
+                               __le16 fc, __le32 *tx_flags)
+{
+        if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS) {
+                *tx_flags |= TX_CMD_FLG_RTS_MSK;
+                *tx_flags &= ~TX_CMD_FLG_CTS_MSK;
+                *tx_flags |= TX_CMD_FLG_FULL_TXOP_PROT_MSK;
+
+                if (!ieee80211_is_mgmt(fc))
+                        return;
+
+                switch (fc & cpu_to_le16(IEEE80211_FCTL_STYPE)) {
+                case cpu_to_le16(IEEE80211_STYPE_AUTH):
+                case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
+                case cpu_to_le16(IEEE80211_STYPE_ASSOC_REQ):
+                case cpu_to_le16(IEEE80211_STYPE_REASSOC_REQ):
+                        *tx_flags &= ~TX_CMD_FLG_RTS_MSK;
+                        *tx_flags |= TX_CMD_FLG_CTS_MSK;
+                        break;
+                }
+        } else if (info->control.rates[0].flags &
+                   IEEE80211_TX_RC_USE_CTS_PROTECT) {
+                *tx_flags &= ~TX_CMD_FLG_RTS_MSK;
+                *tx_flags |= TX_CMD_FLG_CTS_MSK;
+                *tx_flags |= TX_CMD_FLG_FULL_TXOP_PROT_MSK;
+        }
+}
+EXPORT_SYMBOL(iwl_legacy_tx_cmd_protection);
diff --git a/drivers/net/wireless/iwlwifi/iwl-legacy.h b/drivers/net/wireless/iwlwifi/iwl-legacy.h
new file mode 100644
index 00000000000..9f7b2f93596
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-legacy.h
@@ -0,0 +1,79 @@
+/******************************************************************************
+ *
+ * This file is provided under a dual BSD/GPLv2 license.  When using or
+ * redistributing this file, you may do so under either license.
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called LICENSE.GPL.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ * BSD LICENSE
+ *
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *****************************************************************************/
+
+#ifndef __iwl_legacy_h__
+#define __iwl_legacy_h__
+
+/* mac80211 handlers */
+int iwl_legacy_mac_config(struct ieee80211_hw *hw, u32 changed);
+void iwl_legacy_mac_reset_tsf(struct ieee80211_hw *hw);
+void iwl_legacy_mac_bss_info_changed(struct ieee80211_hw *hw,
+                                     struct ieee80211_vif *vif,
+                                     struct ieee80211_bss_conf *bss_conf,
+                                     u32 changes);
+void iwl_legacy_tx_cmd_protection(struct iwl_priv *priv,
+                                struct ieee80211_tx_info *info,
+                                __le16 fc, __le32 *tx_flags);
+
+irqreturn_t iwl_isr_legacy(int irq, void *data);
+
+#endif /* __iwl_legacy_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-power.c b/drivers/net/wireless/iwlwifi/iwl-power.c
index 49d7788937a..1eec18d909d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-power.c
+++ b/drivers/net/wireless/iwlwifi/iwl-power.c
@@ -75,6 +75,10 @@ struct iwl_power_vec_entry {
 
 #define NOSLP cpu_to_le16(0), 0, 0
 #define SLP IWL_POWER_DRIVER_ALLOW_SLEEP_MSK, 0, 0
+#define ASLP (IWL_POWER_POWER_SAVE_ENA_MSK |    \
+                IWL_POWER_POWER_MANAGEMENT_ENA_MSK | \
+                IWL_POWER_ADVANCE_PM_ENA_MSK)
+#define ASLP_TOUT(T) cpu_to_le32(T)
 #define TU_TO_USEC 1024
 #define SLP_TOUT(T) cpu_to_le32((T) * TU_TO_USEC)
 #define SLP_VEC(X0, X1, X2, X3, X4) {cpu_to_le32(X0), \
@@ -114,6 +118,52 @@ static const struct iwl_power_vec_entry range_2[IWL_POWER_NUM] = {
         {{SLP, SLP_TOUT(25), SLP_TOUT(25), SLP_VEC(4, 7, 10, 10, 0xFF)}, 0}
 };
 
+/* advance power management */
+/* DTIM 0 - 2 */
+static const struct iwl_power_vec_entry apm_range_0[IWL_POWER_NUM] = {
+        {{ASLP, 0, 0, ASLP_TOUT(50), ASLP_TOUT(50),
+                SLP_VEC(1, 2, 4, 6, 0xFF), 0}, 0},
+        {{ASLP, 0, 0, ASLP_TOUT(50), ASLP_TOUT(50),
+                SLP_VEC(1, 2, 4, 6, 0xFF), 0}, 0},
+        {{ASLP, 0, 0, ASLP_TOUT(50), ASLP_TOUT(50),
+                SLP_VEC(1, 2, 4, 6, 0xFF), 0}, 0},
+        {{ASLP, 0, 0, ASLP_TOUT(50), ASLP_TOUT(50),
+                SLP_VEC(1, 2, 4, 6, 0xFF), 0}, 0},
+        {{ASLP, 0, 0, ASLP_TOUT(50), ASLP_TOUT(50),
+                SLP_VEC(1, 2, 6, 8, 0xFF), ASLP_TOUT(2)}, 2}
+};
+
+
+/* for DTIM period IWL_DTIM_RANGE_0_MAX + 1 through IWL_DTIM_RANGE_1_MAX */
+/* DTIM 3 - 10 */
+static const struct iwl_power_vec_entry apm_range_1[IWL_POWER_NUM] = {
+        {{ASLP, 0, 0, ASLP_TOUT(50), ASLP_TOUT(50),
+                SLP_VEC(1, 2, 4, 6, 0xFF), 0}, 0},
+        {{ASLP, 0, 0, ASLP_TOUT(50), ASLP_TOUT(50),
+                SLP_VEC(1, 2, 4, 6, 0xFF), 0}, 0},
+        {{ASLP, 0, 0, ASLP_TOUT(50), ASLP_TOUT(50),
+                SLP_VEC(1, 2, 4, 6, 0xFF), 0}, 0},
+        {{ASLP, 0, 0, ASLP_TOUT(50), ASLP_TOUT(50),
+                SLP_VEC(1, 2, 4, 6, 0xFF), 0}, 0},
+        {{ASLP, 0, 0, ASLP_TOUT(50), ASLP_TOUT(50),
+                SLP_VEC(1, 2, 6, 8, 0xFF), 0}, 2}
+};
+
+/* for DTIM period > IWL_DTIM_RANGE_1_MAX */
+/* DTIM 11 - */
+static const struct iwl_power_vec_entry apm_range_2[IWL_POWER_NUM] = {
+        {{ASLP, 0, 0, ASLP_TOUT(50), ASLP_TOUT(50),
+                SLP_VEC(1, 2, 4, 6, 0xFF), 0}, 0},
+        {{ASLP, 0, 0, ASLP_TOUT(50), ASLP_TOUT(50),
+                SLP_VEC(1, 2, 4, 6, 0xFF), 0}, 0},
+        {{ASLP, 0, 0, ASLP_TOUT(50), ASLP_TOUT(50),
+                SLP_VEC(1, 2, 4, 6, 0xFF), 0}, 0},
+        {{ASLP, 0, 0, ASLP_TOUT(50), ASLP_TOUT(50),
+                SLP_VEC(1, 2, 4, 6, 0xFF), 0}, 0},
+        {{ASLP, 0, 0, ASLP_TOUT(50), ASLP_TOUT(50),
+                SLP_VEC(1, 2, 6, 8, 0xFF), ASLP_TOUT(2)}, 2}
+};
+
 static void iwl_static_sleep_cmd(struct iwl_priv *priv,
                                  struct iwl_powertable_cmd *cmd,
                                  enum iwl_power_level lvl, int period)
@@ -124,11 +174,19 @@ static void iwl_static_sleep_cmd(struct iwl_priv *priv,
         u8 skip;
         u32 slp_itrvl;
 
-        table = range_2;
-        if (period <= IWL_DTIM_RANGE_1_MAX)
-                table = range_1;
-        if (period <= IWL_DTIM_RANGE_0_MAX)
-                table = range_0;
+        if (priv->cfg->adv_pm) {
+                table = apm_range_2;
+                if (period <= IWL_DTIM_RANGE_1_MAX)
+                        table = apm_range_1;
+                if (period <= IWL_DTIM_RANGE_0_MAX)
+                        table = apm_range_0;
+        } else {
+                table = range_2;
+                if (period <= IWL_DTIM_RANGE_1_MAX)
+                        table = range_1;
+                if (period <= IWL_DTIM_RANGE_0_MAX)
+                        table = range_0;
+        }
 
         BUG_ON(lvl < 0 || lvl >= IWL_POWER_NUM);
 
@@ -163,6 +221,20 @@ static void iwl_static_sleep_cmd(struct iwl_priv *priv,
         else
                 cmd->flags &= ~IWL_POWER_SLEEP_OVER_DTIM_MSK;
 
+        if (priv->cfg->base_params->shadow_reg_enable)
+                cmd->flags |= IWL_POWER_SHADOW_REG_ENA;
+        else
+                cmd->flags &= ~IWL_POWER_SHADOW_REG_ENA;
+
+        if (priv->cfg->bt_params &&
+            priv->cfg->bt_params->advanced_bt_coexist) {
+                if (!priv->cfg->bt_params->bt_sco_disable)
+                        cmd->flags |= IWL_POWER_BT_SCO_ENA;
+                else
+                        cmd->flags &= ~IWL_POWER_BT_SCO_ENA;
+        }
+
+
         slp_itrvl = le32_to_cpu(cmd->sleep_interval[IWL_POWER_VEC_SIZE - 1]);
         if (slp_itrvl > IWL_CONN_MAX_LISTEN_INTERVAL)
                 cmd->sleep_interval[IWL_POWER_VEC_SIZE - 1] =
@@ -236,6 +308,19 @@ static void iwl_power_fill_sleep_cmd(struct iwl_priv *priv,
         if (priv->power_data.pci_pm)
                 cmd->flags |= IWL_POWER_PCI_PM_MSK;
 
+        if (priv->cfg->base_params->shadow_reg_enable)
+                cmd->flags |= IWL_POWER_SHADOW_REG_ENA;
+        else
+                cmd->flags &= ~IWL_POWER_SHADOW_REG_ENA;
+
+        if (priv->cfg->bt_params &&
+            priv->cfg->bt_params->advanced_bt_coexist) {
+                if (!priv->cfg->bt_params->bt_sco_disable)
+                        cmd->flags |= IWL_POWER_BT_SCO_ENA;
+                else
+                        cmd->flags &= ~IWL_POWER_BT_SCO_ENA;
+        }
+
         cmd->rx_data_timeout = cpu_to_le32(1000 * dynps_ms);
         cmd->tx_data_timeout = cpu_to_le32(1000 * dynps_ms);
 
@@ -263,70 +348,95 @@ static int iwl_set_power(struct iwl_priv *priv, struct iwl_powertable_cmd *cmd)
                                 sizeof(struct iwl_powertable_cmd), cmd);
 }
 
-/* priv->mutex must be held */
-int iwl_power_update_mode(struct iwl_priv *priv, bool force)
+static void iwl_power_build_cmd(struct iwl_priv *priv,
+                                struct iwl_powertable_cmd *cmd)
 {
-        int ret = 0;
         bool enabled = priv->hw->conf.flags & IEEE80211_CONF_PS;
-        bool update_chains;
-        struct iwl_powertable_cmd cmd;
         int dtimper;
 
-        /* Don't update the RX chain when chain noise calibration is running */
-        update_chains = priv->chain_noise_data.state == IWL_CHAIN_NOISE_DONE ||
-                        priv->chain_noise_data.state == IWL_CHAIN_NOISE_ALIVE;
-
         dtimper = priv->hw->conf.ps_dtim_period ?: 1;
 
         if (priv->cfg->base_params->broken_powersave)
-                iwl_power_sleep_cam_cmd(priv, &cmd);
+                iwl_power_sleep_cam_cmd(priv, cmd);
         else if (priv->cfg->base_params->supports_idle &&
                  priv->hw->conf.flags & IEEE80211_CONF_IDLE)
-                iwl_static_sleep_cmd(priv, &cmd, IWL_POWER_INDEX_5, 20);
+                iwl_static_sleep_cmd(priv, cmd, IWL_POWER_INDEX_5, 20);
         else if (priv->cfg->ops->lib->tt_ops.lower_power_detection &&
                  priv->cfg->ops->lib->tt_ops.tt_power_mode &&
                  priv->cfg->ops->lib->tt_ops.lower_power_detection(priv)) {
                 /* in thermal throttling low power state */
-                iwl_static_sleep_cmd(priv, &cmd,
+                iwl_static_sleep_cmd(priv, cmd,
                     priv->cfg->ops->lib->tt_ops.tt_power_mode(priv), dtimper);
         } else if (!enabled)
-                iwl_power_sleep_cam_cmd(priv, &cmd);
+                iwl_power_sleep_cam_cmd(priv, cmd);
         else if (priv->power_data.debug_sleep_level_override >= 0)
-                iwl_static_sleep_cmd(priv, &cmd,
+                iwl_static_sleep_cmd(priv, cmd,
                                      priv->power_data.debug_sleep_level_override,
                                      dtimper);
         else if (no_sleep_autoadjust)
-                iwl_static_sleep_cmd(priv, &cmd, IWL_POWER_INDEX_1, dtimper);
+                iwl_static_sleep_cmd(priv, cmd, IWL_POWER_INDEX_1, dtimper);
         else
-                iwl_power_fill_sleep_cmd(priv, &cmd,
+                iwl_power_fill_sleep_cmd(priv, cmd,
                                          priv->hw->conf.dynamic_ps_timeout,
                                          priv->hw->conf.max_sleep_period);
+}
+
+int iwl_power_set_mode(struct iwl_priv *priv, struct iwl_powertable_cmd *cmd,
+                       bool force)
+{
+        int ret;
+        bool update_chains;
+
+        lockdep_assert_held(&priv->mutex);
+
+        /* Don't update the RX chain when chain noise calibration is running */
+        update_chains = priv->chain_noise_data.state == IWL_CHAIN_NOISE_DONE ||
+                        priv->chain_noise_data.state == IWL_CHAIN_NOISE_ALIVE;
+
+        if (!memcmp(&priv->power_data.sleep_cmd, cmd, sizeof(*cmd)) && !force)
+                return 0;
+
+        if (!iwl_is_ready_rf(priv))
+                return -EIO;
 
-        if (iwl_is_ready_rf(priv) &&
-            (memcmp(&priv->power_data.sleep_cmd, &cmd, sizeof(cmd)) || force)) {
-                if (cmd.flags & IWL_POWER_DRIVER_ALLOW_SLEEP_MSK)
-                        set_bit(STATUS_POWER_PMI, &priv->status);
-
-                ret = iwl_set_power(priv, &cmd);
-                if (!ret) {
-                        if (!(cmd.flags & IWL_POWER_DRIVER_ALLOW_SLEEP_MSK))
-                                clear_bit(STATUS_POWER_PMI, &priv->status);
-
-                        if (priv->cfg->ops->lib->update_chain_flags &&
-                            update_chains)
-                                priv->cfg->ops->lib->update_chain_flags(priv);
-                        else if (priv->cfg->ops->lib->update_chain_flags)
-                                IWL_DEBUG_POWER(priv,
+        /* scan complete use sleep_power_next, need to be updated */
+        memcpy(&priv->power_data.sleep_cmd_next, cmd, sizeof(*cmd));
+        if (test_bit(STATUS_SCANNING, &priv->status) && !force) {
+                IWL_DEBUG_INFO(priv, "Defer power set mode while scanning\n");
+                return 0;
+        }
+
+        if (cmd->flags & IWL_POWER_DRIVER_ALLOW_SLEEP_MSK)
+                set_bit(STATUS_POWER_PMI, &priv->status);
+
+        ret = iwl_set_power(priv, cmd);
+        if (!ret) {
+                if (!(cmd->flags & IWL_POWER_DRIVER_ALLOW_SLEEP_MSK))
+                        clear_bit(STATUS_POWER_PMI, &priv->status);
+
+                if (priv->cfg->ops->lib->update_chain_flags && update_chains)
+                        priv->cfg->ops->lib->update_chain_flags(priv);
+                else if (priv->cfg->ops->lib->update_chain_flags)
+                        IWL_DEBUG_POWER(priv,
                                         "Cannot update the power, chain noise "
                                         "calibration running: %d\n",
                                         priv->chain_noise_data.state);
-                        memcpy(&priv->power_data.sleep_cmd, &cmd, sizeof(cmd));
-                } else
-                        IWL_ERR(priv, "set power fail, ret = %d", ret);
-        }
+
+                memcpy(&priv->power_data.sleep_cmd, cmd, sizeof(*cmd));
+        } else
+                IWL_ERR(priv, "set power fail, ret = %d", ret);
 
         return ret;
 }
+EXPORT_SYMBOL(iwl_power_set_mode);
+
+int iwl_power_update_mode(struct iwl_priv *priv, bool force)
+{
+        struct iwl_powertable_cmd cmd;
+
+        iwl_power_build_cmd(priv, &cmd);
+        return iwl_power_set_mode(priv, &cmd, force);
+}
 EXPORT_SYMBOL(iwl_power_update_mode);
 
 /* initialize to default */
diff --git a/drivers/net/wireless/iwlwifi/iwl-power.h b/drivers/net/wireless/iwlwifi/iwl-power.h
index df81565a7cc..fe012032c28 100644
--- a/drivers/net/wireless/iwlwifi/iwl-power.h
+++ b/drivers/net/wireless/iwlwifi/iwl-power.h
@@ -41,10 +41,13 @@ enum iwl_power_level {
 
 struct iwl_power_mgr {
         struct iwl_powertable_cmd sleep_cmd;
+        struct iwl_powertable_cmd sleep_cmd_next;
         int debug_sleep_level_override;
         bool pci_pm;
 };
 
+int iwl_power_set_mode(struct iwl_priv *priv, struct iwl_powertable_cmd *cmd,
+                       bool force);
 int iwl_power_update_mode(struct iwl_priv *priv, bool force);
 void iwl_power_initialize(struct iwl_priv *priv);
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-rx.c b/drivers/net/wireless/iwlwifi/iwl-rx.c
index f436270ca39..87a6fd84d4d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-rx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-rx.c
@@ -134,28 +134,37 @@ void iwl_rx_queue_update_write_ptr(struct iwl_priv *priv, struct iwl_rx_queue *q
         if (q->need_update == 0)
                 goto exit_unlock;
 
-        /* If power-saving is in use, make sure device is awake */
-        if (test_bit(STATUS_POWER_PMI, &priv->status)) {
-                reg = iwl_read32(priv, CSR_UCODE_DRV_GP1);
+        if (priv->cfg->base_params->shadow_reg_enable) {
+                /* shadow register enabled */
+                /* Device expects a multiple of 8 */
+                q->write_actual = (q->write & ~0x7);
+                iwl_write32(priv, rx_wrt_ptr_reg, q->write_actual);
+        } else {
+                /* If power-saving is in use, make sure device is awake */
+                if (test_bit(STATUS_POWER_PMI, &priv->status)) {
+                        reg = iwl_read32(priv, CSR_UCODE_DRV_GP1);
 
-                if (reg & CSR_UCODE_DRV_GP1_BIT_MAC_SLEEP) {
-                        IWL_DEBUG_INFO(priv, "Rx queue requesting wakeup, GP1 = 0x%x\n",
-                                      reg);
-                        iwl_set_bit(priv, CSR_GP_CNTRL,
-                                    CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
-                        goto exit_unlock;
-                }
+                        if (reg & CSR_UCODE_DRV_GP1_BIT_MAC_SLEEP) {
+                                IWL_DEBUG_INFO(priv,
+                                        "Rx queue requesting wakeup,"
+                                        " GP1 = 0x%x\n", reg);
+                                iwl_set_bit(priv, CSR_GP_CNTRL,
+                                        CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
+                                goto exit_unlock;
+                        }
 
-                q->write_actual = (q->write & ~0x7);
-                iwl_write_direct32(priv, rx_wrt_ptr_reg, q->write_actual);
+                        q->write_actual = (q->write & ~0x7);
+                        iwl_write_direct32(priv, rx_wrt_ptr_reg,
+                                        q->write_actual);
 
-        /* Else device is assumed to be awake */
-        } else {
-                /* Device expects a multiple of 8 */
-                q->write_actual = (q->write & ~0x7);
-                iwl_write_direct32(priv, rx_wrt_ptr_reg, q->write_actual);
+                /* Else device is assumed to be awake */
+                } else {
+                        /* Device expects a multiple of 8 */
+                        q->write_actual = (q->write & ~0x7);
+                        iwl_write_direct32(priv, rx_wrt_ptr_reg,
+                                q->write_actual);
+                }
         }
-
         q->need_update = 0;
 
  exit_unlock:
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index 67da3129578..12d9363d0af 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -252,8 +252,7 @@ static void iwl_rx_scan_complete_notif(struct iwl_priv *priv,
 
         IWL_DEBUG_SCAN(priv, "Scan on %sGHz took %dms\n",
                        (priv->scan_band == IEEE80211_BAND_2GHZ) ? "2.4" : "5.2",
-                       jiffies_to_msecs(elapsed_jiffies
-                                        (priv->scan_start, jiffies)));
+                       jiffies_to_msecs(jiffies - priv->scan_start));
 
         queue_work(priv->workqueue, &priv->scan_completed);
 
@@ -603,13 +602,16 @@ out_settings:
         if (!iwl_is_ready_rf(priv))
                 goto out;
 
-        /* Since setting the TXPOWER may have been deferred while
-         * performing the scan, fire one off */
-        iwl_set_tx_power(priv, priv->tx_power_user_lmt, true);
+        /*
+         * We do not commit power settings while scan is pending,
+         * do it now if the settings changed.
+         */
+        iwl_power_set_mode(priv, &priv->power_data.sleep_cmd_next, false);
+        iwl_set_tx_power(priv, priv->tx_power_next, false);
 
         priv->cfg->ops->utils->post_scan(priv);
 
- out:
+out:
         mutex_unlock(&priv->mutex);
 }
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index 7c7f7dcb1b1..0a67b2fa52a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -400,7 +400,8 @@ static void iwl_sta_ucode_deactivate(struct iwl_priv *priv, u8 sta_id)
 }
 
 static int iwl_send_remove_station(struct iwl_priv *priv,
-                                   const u8 *addr, int sta_id)
+                                   const u8 *addr, int sta_id,
+                                   bool temporary)
 {
         struct iwl_rx_packet *pkt;
         int ret;
@@ -436,9 +437,11 @@ static int iwl_send_remove_station(struct iwl_priv *priv,
         if (!ret) {
                 switch (pkt->u.rem_sta.status) {
                 case REM_STA_SUCCESS_MSK:
-                        spin_lock_irqsave(&priv->sta_lock, flags_spin);
-                        iwl_sta_ucode_deactivate(priv, sta_id);
-                        spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
+                        if (!temporary) {
+                                spin_lock_irqsave(&priv->sta_lock, flags_spin);
+                                iwl_sta_ucode_deactivate(priv, sta_id);
+                                spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
+                        }
                         IWL_DEBUG_ASSOC(priv, "REPLY_REMOVE_STA PASSED\n");
                         break;
                 default:
@@ -505,7 +508,7 @@ int iwl_remove_station(struct iwl_priv *priv, const u8 sta_id,
 
         spin_unlock_irqrestore(&priv->sta_lock, flags);
 
-        return iwl_send_remove_station(priv, addr, sta_id);
+        return iwl_send_remove_station(priv, addr, sta_id, false);
 out_err:
         spin_unlock_irqrestore(&priv->sta_lock, flags);
         return -EINVAL;
@@ -624,6 +627,44 @@ void iwl_restore_stations(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
 }
 EXPORT_SYMBOL(iwl_restore_stations);
 
+void iwl_reprogram_ap_sta(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
+{
+        unsigned long flags;
+        int sta_id = ctx->ap_sta_id;
+        int ret;
+        struct iwl_addsta_cmd sta_cmd;
+        struct iwl_link_quality_cmd lq;
+        bool active;
+
+        spin_lock_irqsave(&priv->sta_lock, flags);
+        if (!(priv->stations[sta_id].used & IWL_STA_DRIVER_ACTIVE)) {
+                spin_unlock_irqrestore(&priv->sta_lock, flags);
+                return;
+        }
+
+        memcpy(&sta_cmd, &priv->stations[sta_id].sta, sizeof(sta_cmd));
+        sta_cmd.mode = 0;
+        memcpy(&lq, priv->stations[sta_id].lq, sizeof(lq));
+
+        active = priv->stations[sta_id].used & IWL_STA_UCODE_ACTIVE;
+        spin_unlock_irqrestore(&priv->sta_lock, flags);
+
+        if (active) {
+                ret = iwl_send_remove_station(
+                        priv, priv->stations[sta_id].sta.sta.addr,
+                        sta_id, true);
+                if (ret)
+                        IWL_ERR(priv, "failed to remove STA %pM (%d)\n",
+                                priv->stations[sta_id].sta.sta.addr, ret);
+        }
+        ret = iwl_send_add_sta(priv, &sta_cmd, CMD_SYNC);
+        if (ret)
+                IWL_ERR(priv, "failed to re-add STA %pM (%d)\n",
+                        priv->stations[sta_id].sta.sta.addr, ret);
+        iwl_send_lq_cmd(priv, ctx, &lq, CMD_SYNC, true);
+}
+EXPORT_SYMBOL(iwl_reprogram_ap_sta);
+
 int iwl_get_free_ucode_key_index(struct iwl_priv *priv)
 {
         int i;
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.h b/drivers/net/wireless/iwlwifi/iwl-sta.h
index 06475872eee..206f1e1a0ca 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.h
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.h
@@ -63,6 +63,7 @@ u8 iwl_prep_station(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
 
 int iwl_send_lq_cmd(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
                     struct iwl_link_quality_cmd *lq, u8 flags, bool init);
+void iwl_reprogram_ap_sta(struct iwl_priv *priv, struct iwl_rxon_context *ctx);
 
 /**
  * iwl_clear_driver_stations - clear knowledge of all stations from driver
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index 7261ee49f28..90659bcf580 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -49,30 +49,39 @@ void iwl_txq_update_write_ptr(struct iwl_priv *priv, struct iwl_tx_queue *txq)
         if (txq->need_update == 0)
                 return;
 
-        /* if we're trying to save power */
-        if (test_bit(STATUS_POWER_PMI, &priv->status)) {
-                /* wake up nic if it's powered down ...
-                 * uCode will wake up, and interrupt us again, so next
-                 * time we'll skip this part. */
-                reg = iwl_read32(priv, CSR_UCODE_DRV_GP1);
-
-                if (reg & CSR_UCODE_DRV_GP1_BIT_MAC_SLEEP) {
-                        IWL_DEBUG_INFO(priv, "Tx queue %d requesting wakeup, GP1 = 0x%x\n",
-                                      txq_id, reg);
-                        iwl_set_bit(priv, CSR_GP_CNTRL,
-                                    CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
-                        return;
-                }
-
-                iwl_write_direct32(priv, HBUS_TARG_WRPTR,
-                                     txq->q.write_ptr | (txq_id << 8));
-
-        /* else not in power-save mode, uCode will never sleep when we're
-         * trying to tx (during RFKILL, we're not trying to tx). */
-        } else
+        if (priv->cfg->base_params->shadow_reg_enable) {
+                /* shadow register enabled */
                 iwl_write32(priv, HBUS_TARG_WRPTR,
                             txq->q.write_ptr | (txq_id << 8));
+        } else {
+                /* if we're trying to save power */
+                if (test_bit(STATUS_POWER_PMI, &priv->status)) {
+                        /* wake up nic if it's powered down ...
+                         * uCode will wake up, and interrupt us again, so next
+                         * time we'll skip this part. */
+                        reg = iwl_read32(priv, CSR_UCODE_DRV_GP1);
+
+                        if (reg & CSR_UCODE_DRV_GP1_BIT_MAC_SLEEP) {
+                                IWL_DEBUG_INFO(priv,
+                                        "Tx queue %d requesting wakeup,"
+                                        " GP1 = 0x%x\n", txq_id, reg);
+                                iwl_set_bit(priv, CSR_GP_CNTRL,
+                                        CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
+                                return;
+                        }
+
+                        iwl_write_direct32(priv, HBUS_TARG_WRPTR,
+                                     txq->q.write_ptr | (txq_id << 8));
 
+                /*
+                 * else not in power-save mode,
+                 * uCode will never sleep when we're
+                 * trying to tx (during RFKILL, we're not trying to tx).
+                 */
+                } else
+                        iwl_write32(priv, HBUS_TARG_WRPTR,
+                                    txq->q.write_ptr | (txq_id << 8));
+        }
         txq->need_update = 0;
 }
 EXPORT_SYMBOL(iwl_txq_update_write_ptr);
@@ -350,13 +359,12 @@ int iwl_tx_queue_init(struct iwl_priv *priv, struct iwl_tx_queue *txq,
         txq->need_update = 0;
 
         /*
-         * Aggregation TX queues will get their ID when aggregation begins;
-         * they overwrite the setting done here. The command FIFO doesn't
-         * need an swq_id so don't set one to catch errors, all others can
-         * be set up to the identity mapping.
+         * For the default queues 0-3, set up the swq_id
+         * already -- all others need to get one later
+         * (if they need one at all).
          */
-        if (txq_id != priv->cmd_queue)
-                txq->swq_id = txq_id;
+        if (txq_id < 4)
+                iwl_set_swq_id(txq, txq_id, txq_id);
 
         /* TFD_QUEUE_SIZE_MAX must be power-of-two size, otherwise
          * iwl_queue_inc_wrap and iwl_queue_dec_wrap are broken. */
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 7edf8c2fb8c..8eb1393506b 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -61,6 +61,7 @@
 #include "iwl-helpers.h"
 #include "iwl-dev.h"
 #include "iwl-spectrum.h"
+#include "iwl-legacy.h"
 
 /*
  * module name, copyright, version, etc.
@@ -474,7 +475,7 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         dma_addr_t phys_addr;
         dma_addr_t txcmd_phys;
         int txq_id = skb_get_queue_mapping(skb);
-        u16 len, idx, len_org, hdr_len; /* TODO: len_org is not used */
+        u16 len, idx, hdr_len;
         u8 id;
         u8 unicast;
         u8 sta_id;
@@ -611,15 +612,8 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
          */
         len = sizeof(struct iwl3945_tx_cmd) +
                         sizeof(struct iwl_cmd_header) + hdr_len;
-
-        len_org = len;
         len = (len + 3) & ~3;
 
-        if (len_org != len)
-                len_org = 1;
-        else
-                len_org = 0;
-
         /* Physical address of this Tx command's header (not MAC header!),
          * within command buffer array. */
         txcmd_phys = pci_map_single(priv->pci_dev, &out_cmd->hdr,
@@ -661,7 +655,7 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
                         spin_unlock_irqrestore(&priv->lock, flags);
                 }
 
-                iwl_stop_queue(priv, skb_get_queue_mapping(skb));
+                iwl_stop_queue(priv, txq);
         }
 
         return 0;
@@ -3057,22 +3051,22 @@ static void iwl3945_bg_rx_replenish(struct work_struct *data)
         mutex_unlock(&priv->mutex);
 }
 
-void iwl3945_post_associate(struct iwl_priv *priv, struct ieee80211_vif *vif)
+void iwl3945_post_associate(struct iwl_priv *priv)
 {
         int rc = 0;
         struct ieee80211_conf *conf = NULL;
         struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
 
-        if (!vif || !priv->is_open)
+        if (!ctx->vif || !priv->is_open)
                 return;
 
-        if (vif->type == NL80211_IFTYPE_AP) {
+        if (ctx->vif->type == NL80211_IFTYPE_AP) {
                 IWL_ERR(priv, "%s Should not be called in AP mode\n", __func__);
                 return;
         }
 
         IWL_DEBUG_ASSOC(priv, "Associated as %d to: %pM\n",
-                        vif->bss_conf.aid, ctx->active.bssid_addr);
+                        ctx->vif->bss_conf.aid, ctx->active.bssid_addr);
 
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                 return;
@@ -3091,18 +3085,18 @@ void iwl3945_post_associate(struct iwl_priv *priv, struct ieee80211_vif *vif)
 
         ctx->staging.filter_flags |= RXON_FILTER_ASSOC_MSK;
 
-        ctx->staging.assoc_id = cpu_to_le16(vif->bss_conf.aid);
+        ctx->staging.assoc_id = cpu_to_le16(ctx->vif->bss_conf.aid);
 
         IWL_DEBUG_ASSOC(priv, "assoc id %d beacon interval %d\n",
-                        vif->bss_conf.aid, vif->bss_conf.beacon_int);
+                        ctx->vif->bss_conf.aid, ctx->vif->bss_conf.beacon_int);
 
-        if (vif->bss_conf.use_short_preamble)
+        if (ctx->vif->bss_conf.use_short_preamble)
                 ctx->staging.flags |= RXON_FLG_SHORT_PREAMBLE_MSK;
         else
                 ctx->staging.flags &= ~RXON_FLG_SHORT_PREAMBLE_MSK;
 
         if (ctx->staging.flags & RXON_FLG_BAND_24G_MSK) {
-                if (vif->bss_conf.use_short_slot)
+                if (ctx->vif->bss_conf.use_short_slot)
                         ctx->staging.flags |= RXON_FLG_SHORT_SLOT_MSK;
                 else
                         ctx->staging.flags &= ~RXON_FLG_SHORT_SLOT_MSK;
@@ -3110,7 +3104,7 @@ void iwl3945_post_associate(struct iwl_priv *priv, struct ieee80211_vif *vif)
 
         iwl3945_commit_rxon(priv, ctx);
 
-        switch (vif->type) {
+        switch (ctx->vif->type) {
         case NL80211_IFTYPE_STATION:
                 iwl3945_rate_scale_init(priv->hw, IWL_AP_ID);
                 break;
@@ -3119,7 +3113,7 @@ void iwl3945_post_associate(struct iwl_priv *priv, struct ieee80211_vif *vif)
                 break;
         default:
                 IWL_ERR(priv, "%s Should not be called in %d mode\n",
-                        __func__, vif->type);
+                        __func__, ctx->vif->type);
                 break;
         }
 }
@@ -3234,9 +3228,10 @@ static int iwl3945_mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
         return NETDEV_TX_OK;
 }
 
-void iwl3945_config_ap(struct iwl_priv *priv, struct ieee80211_vif *vif)
+void iwl3945_config_ap(struct iwl_priv *priv)
 {
         struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
+        struct ieee80211_vif *vif = ctx->vif;
         int rc = 0;
 
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
@@ -3407,9 +3402,9 @@ static void iwl3945_configure_filter(struct ieee80211_hw *hw,
         ctx->staging.filter_flags |= filter_or;
 
         /*
-         * Committing directly here breaks for some reason,
-         * but we'll eventually commit the filter flags
-         * change anyway.
+         * Not committing directly because hardware can perform a scan,
+         * but even if hw is ready, committing here breaks for some reason,
+         * we'll eventually commit the filter flags change anyway.
          */
 
         mutex_unlock(&priv->mutex);
@@ -3824,18 +3819,19 @@ static struct attribute_group iwl3945_attribute_group = {
         .attrs = iwl3945_sysfs_entries,
 };
 
-static struct ieee80211_ops iwl3945_hw_ops = {
+struct ieee80211_ops iwl3945_hw_ops = {
         .tx = iwl3945_mac_tx,
         .start = iwl3945_mac_start,
         .stop = iwl3945_mac_stop,
         .add_interface = iwl_mac_add_interface,
         .remove_interface = iwl_mac_remove_interface,
-        .config = iwl_mac_config,
+        .change_interface = iwl_mac_change_interface,
+        .config = iwl_legacy_mac_config,
         .configure_filter = iwl3945_configure_filter,
         .set_key = iwl3945_mac_set_key,
         .conf_tx = iwl_mac_conf_tx,
-        .reset_tsf = iwl_mac_reset_tsf,
-        .bss_info_changed = iwl_bss_info_changed,
+        .reset_tsf = iwl_legacy_mac_reset_tsf,
+        .bss_info_changed = iwl_legacy_mac_bss_info_changed,
         .hw_scan = iwl_mac_hw_scan,
         .sta_add = iwl3945_mac_sta_add,
         .sta_remove = iwl_mac_sta_remove,
@@ -3866,6 +3862,7 @@ static int iwl3945_init_drv(struct iwl_priv *priv)
         priv->missed_beacon_threshold = IWL_MISSED_BEACON_THRESHOLD_DEF;
 
         priv->tx_power_user_lmt = IWL_DEFAULT_TX_POWER;
+        priv->tx_power_next = IWL_DEFAULT_TX_POWER;
 
         if (eeprom->version < EEPROM_3945_EEPROM_VERSION) {
                 IWL_WARN(priv, "Unsupported EEPROM version: 0x%04X\n",
@@ -3965,7 +3962,7 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
 
         /* mac80211 allocates memory for this device instance, including
          *   space for this driver's private structure */
-        hw = iwl_alloc_all(cfg, &iwl3945_hw_ops);
+        hw = iwl_alloc_all(cfg);
         if (hw == NULL) {
                 pr_err("Can not allocate network device\n");
                 err = -ENOMEM;
@@ -4117,7 +4114,7 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
 
         pci_enable_msi(priv->pci_dev);
 
-        err = request_irq(priv->pci_dev->irq, priv->cfg->ops->lib->isr,
+        err = request_irq(priv->pci_dev->irq, priv->cfg->ops->lib->isr_ops.isr,
                           IRQF_SHARED, DRV_NAME, priv);
         if (err) {
                 IWL_ERR(priv, "Error allocating IRQ %d\n", priv->pci_dev->irq);
@@ -4275,10 +4272,7 @@ static struct pci_driver iwl3945_driver = {
         .id_table = iwl3945_hw_card_ids,
         .probe = iwl3945_pci_probe,
         .remove = __devexit_p(iwl3945_pci_remove),
-#ifdef CONFIG_PM
-        .suspend = iwl_pci_suspend,
-        .resume = iwl_pci_resume,
-#endif
+        .driver.pm = IWL_PM_OPS,
 };
 
 static int __init iwl3945_init(void)
diff --git a/drivers/net/wireless/iwmc3200wifi/commands.c b/drivers/net/wireless/iwmc3200wifi/commands.c
index 330c7d9cf10..50dee6a0a5c 100644
--- a/drivers/net/wireless/iwmc3200wifi/commands.c
+++ b/drivers/net/wireless/iwmc3200wifi/commands.c
@@ -908,7 +908,7 @@ int iwm_scan_ssids(struct iwm_priv *iwm, struct cfg80211_ssid *ssids,
                 return ret;
         }
 
-        iwm->scan_id = iwm->scan_id++ % IWM_SCAN_ID_MAX;
+        iwm->scan_id = (iwm->scan_id + 1) % IWM_SCAN_ID_MAX;
 
         return 0;
 }
diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c
index 373930afc26..dee32d3681a 100644
--- a/drivers/net/wireless/libertas/cfg.c
+++ b/drivers/net/wireless/libertas/cfg.c
@@ -9,8 +9,6 @@
 #include <linux/sched.h>
 #include <linux/wait.h>
 #include <linux/slab.h>
-#include <linux/sched.h>
-#include <linux/wait.h>
 #include <linux/ieee80211.h>
 #include <net/cfg80211.h>
 #include <asm/unaligned.h>
@@ -2062,7 +2060,7 @@ static void lbs_cfg_set_regulatory_hint(struct lbs_private *priv)
         };
 
         /* Section 5.17.2 */
-        static struct region_code_mapping regmap[] = {
+        static const struct region_code_mapping regmap[] = {
                 {"US ", 0x10}, /* US FCC */
                 {"CA ", 0x20}, /* Canada */
                 {"EU ", 0x30}, /* ETSI   */
diff --git a/drivers/net/wireless/libertas/cmd.c b/drivers/net/wireless/libertas/cmd.c
index 70745928f3f..78c4da150a7 100644
--- a/drivers/net/wireless/libertas/cmd.c
+++ b/drivers/net/wireless/libertas/cmd.c
@@ -177,6 +177,14 @@ int lbs_host_sleep_cfg(struct lbs_private *priv, uint32_t criteria,
         struct cmd_ds_host_sleep cmd_config;
         int ret;
 
+        /*
+         * Certain firmware versions do not support EHS_REMOVE_WAKEUP command
+         * and the card will return a failure.  Since we need to be
+         * able to reset the mask, in those cases we set a 0 mask instead.
+         */
+        if (criteria == EHS_REMOVE_WAKEUP && !priv->ehs_remove_supported)
+                criteria = 0;
+
         cmd_config.hdr.size = cpu_to_le16(sizeof(cmd_config));
         cmd_config.criteria = cpu_to_le32(criteria);
         cmd_config.gpio = priv->wol_gpio;
diff --git a/drivers/net/wireless/libertas/dev.h b/drivers/net/wireless/libertas/dev.h
index cb14c38caf3..18dd9a02c45 100644
--- a/drivers/net/wireless/libertas/dev.h
+++ b/drivers/net/wireless/libertas/dev.h
@@ -138,6 +138,7 @@ struct lbs_private {
         uint32_t wol_criteria;
         uint8_t wol_gpio;
         uint8_t wol_gap;
+        bool ehs_remove_supported;
 
         /* Transmitting */
         int tx_pending_len;             /* -1 while building packet */
diff --git a/drivers/net/wireless/libertas/if_usb.c b/drivers/net/wireless/libertas/if_usb.c
index efaf8503220..6524c70363d 100644
--- a/drivers/net/wireless/libertas/if_usb.c
+++ b/drivers/net/wireless/libertas/if_usb.c
@@ -345,6 +345,13 @@ static int if_usb_probe(struct usb_interface *intf,
         if (device_create_file(&priv->dev->dev, &dev_attr_lbs_flash_boot2))
                 lbs_pr_err("cannot register lbs_flash_boot2 attribute\n");
 
+        /*
+         * EHS_REMOVE_WAKEUP is not supported on all versions of the firmware.
+         */
+        priv->wol_criteria = EHS_REMOVE_WAKEUP;
+        if (lbs_host_sleep_cfg(priv, priv->wol_criteria, NULL))
+                priv->ehs_remove_supported = false;
+
         return 0;
 
 err_start_card:
@@ -1090,12 +1097,6 @@ static int if_usb_suspend(struct usb_interface *intf, pm_message_t message)
         if (priv->psstate != PS_STATE_FULL_POWER)
                 return -1;
 
-        if (priv->wol_criteria == EHS_REMOVE_WAKEUP) {
-                lbs_pr_info("Suspend attempt without "
-                                                "configuring wake params!\n");
-                return -ENOSYS;
-        }
-
         ret = lbs_suspend(priv);
         if (ret)
                 goto out;
diff --git a/drivers/net/wireless/libertas/main.c b/drivers/net/wireless/libertas/main.c
index fcd1bbfc632..6836a6dd985 100644
--- a/drivers/net/wireless/libertas/main.c
+++ b/drivers/net/wireless/libertas/main.c
@@ -851,9 +851,10 @@ struct lbs_private *lbs_add_card(void *card, struct device *dmdev)
         priv->work_thread = create_singlethread_workqueue("lbs_worker");
         INIT_WORK(&priv->mcast_work, lbs_set_mcast_worker);
 
-        priv->wol_criteria = 0xffffffff;
+        priv->wol_criteria = EHS_REMOVE_WAKEUP;
         priv->wol_gpio = 0xff;
         priv->wol_gap = 20;
+        priv->ehs_remove_supported = true;
 
         goto done;
 
diff --git a/drivers/net/wireless/libertas/rx.c b/drivers/net/wireless/libertas/rx.c
index a4d0bca9ef2..a2b1df21d28 100644
--- a/drivers/net/wireless/libertas/rx.c
+++ b/drivers/net/wireless/libertas/rx.c
@@ -55,7 +55,9 @@ int lbs_process_rxed_packet(struct lbs_private *priv, struct sk_buff *skb)
         struct rxpd *p_rx_pd;
         int hdrchop;
         struct ethhdr *p_ethhdr;
-        const u8 rfc1042_eth_hdr[] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
+        static const u8 rfc1042_eth_hdr[] = {
+                0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00
+        };
 
         lbs_deb_enter(LBS_DEB_RX);
 
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 7eaaa3bab54..454f045ddff 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -309,6 +309,8 @@ struct mac80211_hwsim_data {
          */
         u64 group;
         struct dentry *debugfs_group;
+
+        int power_level;
 };
 
 
@@ -497,7 +499,7 @@ static bool mac80211_hwsim_tx_frame(struct ieee80211_hw *hw,
         rx_status.band = data->channel->band;
         rx_status.rate_idx = info->control.rates[0].idx;
         /* TODO: simulate real signal strength (and optional packet loss) */
-        rx_status.signal = -50;
+        rx_status.signal = data->power_level - 50;
 
         if (data->ps != PS_DISABLED)
                 hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
@@ -698,6 +700,7 @@ static int mac80211_hwsim_config(struct ieee80211_hw *hw, u32 changed)
         data->idle = !!(conf->flags & IEEE80211_CONF_IDLE);
 
         data->channel = conf->channel;
+        data->power_level = conf->power_level;
         if (!data->started || !data->beacon_int)
                 del_timer(&data->beacon_timer);
         else
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index f152a25be59..9ecf8407cb1 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -29,6 +29,12 @@
 #define MWL8K_NAME      KBUILD_MODNAME
 #define MWL8K_VERSION   "0.12"
 
+/* Module parameters */
+static unsigned ap_mode_default;
+module_param(ap_mode_default, bool, 0);
+MODULE_PARM_DESC(ap_mode_default,
+                 "Set to 1 to make ap mode the default instead of sta mode");
+
 /* Register definitions */
 #define MWL8K_HIU_GEN_PTR                       0x00000c10
 #define  MWL8K_MODE_STA                          0x0000005a
@@ -92,8 +98,10 @@ struct rxd_ops {
 struct mwl8k_device_info {
         char *part_name;
         char *helper_image;
-        char *fw_image;
+        char *fw_image_sta;
+        char *fw_image_ap;
         struct rxd_ops *ap_rxd_ops;
+        u32 fw_api_ap;
 };
 
 struct mwl8k_rx_queue {
@@ -136,8 +144,8 @@ struct mwl8k_priv {
         void __iomem *regs;
 
         /* firmware */
-        struct firmware *fw_helper;
-        struct firmware *fw_ucode;
+        const struct firmware *fw_helper;
+        const struct firmware *fw_ucode;
 
         /* hardware/firmware parameters */
         bool ap_fw;
@@ -210,6 +218,18 @@ struct mwl8k_priv {
 
         /* Most recently reported noise in dBm */
         s8 noise;
+
+        /*
+         * preserve the queue configurations so they can be restored if/when
+         * the firmware image is swapped.
+         */
+        struct ieee80211_tx_queue_params wmm_params[MWL8K_TX_QUEUES];
+
+        /* async firmware loading state */
+        unsigned fw_state;
+        char *fw_pref;
+        char *fw_alt;
+        struct completion firmware_loading_complete;
 };
 
 /* Per interface specific private data */
@@ -285,8 +305,9 @@ static const struct ieee80211_rate mwl8k_rates_50[] = {
 };
 
 /* Set or get info from Firmware */
-#define MWL8K_CMD_SET                   0x0001
 #define MWL8K_CMD_GET                   0x0000
+#define MWL8K_CMD_SET                   0x0001
+#define MWL8K_CMD_SET_LIST              0x0002
 
 /* Firmware command codes */
 #define MWL8K_CMD_CODE_DNLD             0x0001
@@ -296,6 +317,7 @@ static const struct ieee80211_rate mwl8k_rates_50[] = {
 #define MWL8K_CMD_GET_STAT              0x0014
 #define MWL8K_CMD_RADIO_CONTROL         0x001c
 #define MWL8K_CMD_RF_TX_POWER           0x001e
+#define MWL8K_CMD_TX_POWER              0x001f
 #define MWL8K_CMD_RF_ANTENNA            0x0020
 #define MWL8K_CMD_SET_BEACON            0x0100          /* per-vif */
 #define MWL8K_CMD_SET_PRE_SCAN          0x0107
@@ -333,6 +355,7 @@ static const char *mwl8k_cmd_name(__le16 cmd, char *buf, int bufsize)
                 MWL8K_CMDNAME(GET_STAT);
                 MWL8K_CMDNAME(RADIO_CONTROL);
                 MWL8K_CMDNAME(RF_TX_POWER);
+                MWL8K_CMDNAME(TX_POWER);
                 MWL8K_CMDNAME(RF_ANTENNA);
                 MWL8K_CMDNAME(SET_BEACON);
                 MWL8K_CMDNAME(SET_PRE_SCAN);
@@ -372,7 +395,7 @@ static void mwl8k_hw_reset(struct mwl8k_priv *priv)
 }
 
 /* Release fw image */
-static void mwl8k_release_fw(struct firmware **fw)
+static void mwl8k_release_fw(const struct firmware **fw)
 {
         if (*fw == NULL)
                 return;
@@ -386,37 +409,68 @@ static void mwl8k_release_firmware(struct mwl8k_priv *priv)
         mwl8k_release_fw(&priv->fw_helper);
 }
 
+/* states for asynchronous f/w loading */
+static void mwl8k_fw_state_machine(const struct firmware *fw, void *context);
+enum {
+        FW_STATE_INIT = 0,
+        FW_STATE_LOADING_PREF,
+        FW_STATE_LOADING_ALT,
+        FW_STATE_ERROR,
+};
+
 /* Request fw image */
 static int mwl8k_request_fw(struct mwl8k_priv *priv,
-                            const char *fname, struct firmware **fw)
+                            const char *fname, const struct firmware **fw,
+                            bool nowait)
 {
         /* release current image */
         if (*fw != NULL)
                 mwl8k_release_fw(fw);
 
-        return request_firmware((const struct firmware **)fw,
-                                fname, &priv->pdev->dev);
+        if (nowait)
+                return request_firmware_nowait(THIS_MODULE, 1, fname,
+                                               &priv->pdev->dev, GFP_KERNEL,
+                                               priv, mwl8k_fw_state_machine);
+        else
+                return request_firmware(fw, fname, &priv->pdev->dev);
 }
 
-static int mwl8k_request_firmware(struct mwl8k_priv *priv)
+static int mwl8k_request_firmware(struct mwl8k_priv *priv, char *fw_image,
+                                  bool nowait)
 {
         struct mwl8k_device_info *di = priv->device_info;
         int rc;
 
         if (di->helper_image != NULL) {
-                rc = mwl8k_request_fw(priv, di->helper_image, &priv->fw_helper);
-                if (rc) {
-                        printk(KERN_ERR "%s: Error requesting helper "
-                               "firmware file %s\n", pci_name(priv->pdev),
-                               di->helper_image);
+                if (nowait)
+                        rc = mwl8k_request_fw(priv, di->helper_image,
+                                              &priv->fw_helper, true);
+                else
+                        rc = mwl8k_request_fw(priv, di->helper_image,
+                                              &priv->fw_helper, false);
+                if (rc)
+                        printk(KERN_ERR "%s: Error requesting helper fw %s\n",
+                               pci_name(priv->pdev), di->helper_image);
+
+                if (rc || nowait)
                         return rc;
-                }
         }
 
-        rc = mwl8k_request_fw(priv, di->fw_image, &priv->fw_ucode);
+        if (nowait) {
+                /*
+                 * if we get here, no helper image is needed.  Skip the
+                 * FW_STATE_INIT state.
+                 */
+                priv->fw_state = FW_STATE_LOADING_PREF;
+                rc = mwl8k_request_fw(priv, fw_image,
+                                      &priv->fw_ucode,
+                                      true);
+        } else
+                rc = mwl8k_request_fw(priv, fw_image,
+                                      &priv->fw_ucode, false);
         if (rc) {
                 printk(KERN_ERR "%s: Error requesting firmware file %s\n",
-                       pci_name(priv->pdev), di->fw_image);
+                       pci_name(priv->pdev), fw_image);
                 mwl8k_release_fw(&priv->fw_helper);
                 return rc;
         }
@@ -577,12 +631,12 @@ static int mwl8k_feed_fw_image(struct mwl8k_priv *priv,
 static int mwl8k_load_firmware(struct ieee80211_hw *hw)
 {
         struct mwl8k_priv *priv = hw->priv;
-        struct firmware *fw = priv->fw_ucode;
+        const struct firmware *fw = priv->fw_ucode;
         int rc;
         int loops;
 
         if (!memcmp(fw->data, "\x01\x00\x00\x00", 4)) {
-                struct firmware *helper = priv->fw_helper;
+                const struct firmware *helper = priv->fw_helper;
 
                 if (helper == NULL) {
                         printk(KERN_ERR "%s: helper image needed but none "
@@ -1811,6 +1865,7 @@ struct mwl8k_cmd_get_hw_spec_ap {
         __le32 wcbbase1;
         __le32 wcbbase2;
         __le32 wcbbase3;
+        __le32 fw_api_version;
 } __packed;
 
 static int mwl8k_cmd_get_hw_spec_ap(struct ieee80211_hw *hw)
@@ -1818,6 +1873,7 @@ static int mwl8k_cmd_get_hw_spec_ap(struct ieee80211_hw *hw)
         struct mwl8k_priv *priv = hw->priv;
         struct mwl8k_cmd_get_hw_spec_ap *cmd;
         int rc;
+        u32 api_version;
 
         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
         if (cmd == NULL)
@@ -1834,6 +1890,16 @@ static int mwl8k_cmd_get_hw_spec_ap(struct ieee80211_hw *hw)
         if (!rc) {
                 int off;
 
+                api_version = le32_to_cpu(cmd->fw_api_version);
+                if (priv->device_info->fw_api_ap != api_version) {
+                        printk(KERN_ERR "%s: Unsupported fw API version for %s."
+                               "  Expected %d got %d.\n", MWL8K_NAME,
+                               priv->device_info->part_name,
+                               priv->device_info->fw_api_ap,
+                               api_version);
+                        rc = -EINVAL;
+                        goto done;
+                }
                 SET_IEEE80211_PERM_ADDR(hw, cmd->perm_addr);
                 priv->num_mcaddrs = le16_to_cpu(cmd->num_mcaddrs);
                 priv->fw_rev = le32_to_cpu(cmd->fw_rev);
@@ -1861,6 +1927,7 @@ static int mwl8k_cmd_get_hw_spec_ap(struct ieee80211_hw *hw)
                 iowrite32(priv->txq[3].txd_dma, priv->sram + off);
         }
 
+done:
         kfree(cmd);
         return rc;
 }
@@ -2084,7 +2151,7 @@ mwl8k_set_radio_preamble(struct ieee80211_hw *hw, bool short_preamble)
 /*
  * CMD_RF_TX_POWER.
  */
-#define MWL8K_TX_POWER_LEVEL_TOTAL      8
+#define MWL8K_RF_TX_POWER_LEVEL_TOTAL   8
 
 struct mwl8k_cmd_rf_tx_power {
         struct mwl8k_cmd_pkt header;
@@ -2092,7 +2159,7 @@ struct mwl8k_cmd_rf_tx_power {
         __le16 support_level;
         __le16 current_level;
         __le16 reserved;
-        __le16 power_level_list[MWL8K_TX_POWER_LEVEL_TOTAL];
+        __le16 power_level_list[MWL8K_RF_TX_POWER_LEVEL_TOTAL];
 } __packed;
 
 static int mwl8k_cmd_rf_tx_power(struct ieee80211_hw *hw, int dBm)
@@ -2116,6 +2183,65 @@ static int mwl8k_cmd_rf_tx_power(struct ieee80211_hw *hw, int dBm)
 }
 
 /*
+ * CMD_TX_POWER.
+ */
+#define MWL8K_TX_POWER_LEVEL_TOTAL      12
+
+struct mwl8k_cmd_tx_power {
+        struct mwl8k_cmd_pkt header;
+        __le16 action;
+        __le16 band;
+        __le16 channel;
+        __le16 bw;
+        __le16 sub_ch;
+        __le16 power_level_list[MWL8K_TX_POWER_LEVEL_TOTAL];
+} __attribute__((packed));
+
+static int mwl8k_cmd_tx_power(struct ieee80211_hw *hw,
+                                     struct ieee80211_conf *conf,
+                                     unsigned short pwr)
+{
+        struct ieee80211_channel *channel = conf->channel;
+        struct mwl8k_cmd_tx_power *cmd;
+        int rc;
+        int i;
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (cmd == NULL)
+                return -ENOMEM;
+
+        cmd->header.code = cpu_to_le16(MWL8K_CMD_TX_POWER);
+        cmd->header.length = cpu_to_le16(sizeof(*cmd));
+        cmd->action = cpu_to_le16(MWL8K_CMD_SET_LIST);
+
+        if (channel->band == IEEE80211_BAND_2GHZ)
+                cmd->band = cpu_to_le16(0x1);
+        else if (channel->band == IEEE80211_BAND_5GHZ)
+                cmd->band = cpu_to_le16(0x4);
+
+        cmd->channel = channel->hw_value;
+
+        if (conf->channel_type == NL80211_CHAN_NO_HT ||
+            conf->channel_type == NL80211_CHAN_HT20) {
+                cmd->bw = cpu_to_le16(0x2);
+        } else {
+                cmd->bw = cpu_to_le16(0x4);
+                if (conf->channel_type == NL80211_CHAN_HT40MINUS)
+                        cmd->sub_ch = cpu_to_le16(0x3);
+                else if (conf->channel_type == NL80211_CHAN_HT40PLUS)
+                        cmd->sub_ch = cpu_to_le16(0x1);
+        }
+
+        for (i = 0; i < MWL8K_TX_POWER_LEVEL_TOTAL; i++)
+                cmd->power_level_list[i] = cpu_to_le16(pwr);
+
+        rc = mwl8k_post_cmd(hw, &cmd->header);
+        kfree(cmd);
+
+        return rc;
+}
+
+/*
  * CMD_RF_ANTENNA.
  */
 struct mwl8k_cmd_rf_antenna {
@@ -3283,13 +3409,16 @@ static void mwl8k_stop(struct ieee80211_hw *hw)
                 mwl8k_txq_reclaim(hw, i, INT_MAX, 1);
 }
 
+static int mwl8k_reload_firmware(struct ieee80211_hw *hw, char *fw_image);
+
 static int mwl8k_add_interface(struct ieee80211_hw *hw,
                                struct ieee80211_vif *vif)
 {
         struct mwl8k_priv *priv = hw->priv;
         struct mwl8k_vif *mwl8k_vif;
         u32 macids_supported;
-        int macid;
+        int macid, rc;
+        struct mwl8k_device_info *di;
 
         /*
          * Reject interface creation if sniffer mode is active, as
@@ -3302,12 +3431,28 @@ static int mwl8k_add_interface(struct ieee80211_hw *hw,
                 return -EINVAL;
         }
 
-
+        di = priv->device_info;
         switch (vif->type) {
         case NL80211_IFTYPE_AP:
+                if (!priv->ap_fw && di->fw_image_ap) {
+                        /* we must load the ap fw to meet this request */
+                        if (!list_empty(&priv->vif_list))
+                                return -EBUSY;
+                        rc = mwl8k_reload_firmware(hw, di->fw_image_ap);
+                        if (rc)
+                                return rc;
+                }
                 macids_supported = priv->ap_macids_supported;
                 break;
         case NL80211_IFTYPE_STATION:
+                if (priv->ap_fw && di->fw_image_sta) {
+                        /* we must load the sta fw to meet this request */
+                        if (!list_empty(&priv->vif_list))
+                                return -EBUSY;
+                        rc = mwl8k_reload_firmware(hw, di->fw_image_sta);
+                        if (rc)
+                                return rc;
+                }
                 macids_supported = priv->sta_macids_supported;
                 break;
         default:
@@ -3377,15 +3522,19 @@ static int mwl8k_config(struct ieee80211_hw *hw, u32 changed)
 
         if (conf->power_level > 18)
                 conf->power_level = 18;
-        rc = mwl8k_cmd_rf_tx_power(hw, conf->power_level);
-        if (rc)
-                goto out;
 
         if (priv->ap_fw) {
+                rc = mwl8k_cmd_tx_power(hw, conf, conf->power_level);
+                if (rc)
+                        goto out;
+
                 rc = mwl8k_cmd_rf_antenna(hw, MWL8K_RF_ANTENNA_RX, 0x7);
                 if (!rc)
                         rc = mwl8k_cmd_rf_antenna(hw, MWL8K_RF_ANTENNA_TX, 0x7);
         } else {
+                rc = mwl8k_cmd_rf_tx_power(hw, conf->power_level);
+                if (rc)
+                        goto out;
                 rc = mwl8k_cmd_mimo_config(hw, 0x7, 0x7);
         }
 
@@ -3739,6 +3888,9 @@ static int mwl8k_conf_tx(struct ieee80211_hw *hw, u16 queue,
 
         rc = mwl8k_fw_lock(hw);
         if (!rc) {
+                BUG_ON(queue > MWL8K_TX_QUEUES - 1);
+                memcpy(&priv->wmm_params[queue], params, sizeof(*params));
+
                 if (!priv->wmm_enabled)
                         rc = mwl8k_cmd_set_wmm_mode(hw, 1);
 
@@ -3838,21 +3990,27 @@ enum {
         MWL8366,
 };
 
+#define MWL8K_8366_AP_FW_API 1
+#define _MWL8K_8366_AP_FW(api) "mwl8k/fmimage_8366_ap-" #api ".fw"
+#define MWL8K_8366_AP_FW(api) _MWL8K_8366_AP_FW(api)
+
 static struct mwl8k_device_info mwl8k_info_tbl[] __devinitdata = {
         [MWL8363] = {
                 .part_name      = "88w8363",
                 .helper_image   = "mwl8k/helper_8363.fw",
-                .fw_image       = "mwl8k/fmimage_8363.fw",
+                .fw_image_sta   = "mwl8k/fmimage_8363.fw",
         },
         [MWL8687] = {
                 .part_name      = "88w8687",
                 .helper_image   = "mwl8k/helper_8687.fw",
-                .fw_image       = "mwl8k/fmimage_8687.fw",
+                .fw_image_sta   = "mwl8k/fmimage_8687.fw",
         },
         [MWL8366] = {
                 .part_name      = "88w8366",
                 .helper_image   = "mwl8k/helper_8366.fw",
-                .fw_image       = "mwl8k/fmimage_8366.fw",
+                .fw_image_sta   = "mwl8k/fmimage_8366.fw",
+                .fw_image_ap    = MWL8K_8366_AP_FW(MWL8K_8366_AP_FW_API),
+                .fw_api_ap      = MWL8K_8366_AP_FW_API,
                 .ap_rxd_ops     = &rxd_8366_ap_ops,
         },
 };
@@ -3863,6 +4021,7 @@ MODULE_FIRMWARE("mwl8k/helper_8687.fw");
 MODULE_FIRMWARE("mwl8k/fmimage_8687.fw");
 MODULE_FIRMWARE("mwl8k/helper_8366.fw");
 MODULE_FIRMWARE("mwl8k/fmimage_8366.fw");
+MODULE_FIRMWARE(MWL8K_8366_AP_FW(MWL8K_8366_AP_FW_API));
 
 static DEFINE_PCI_DEVICE_TABLE(mwl8k_pci_id_table) = {
         { PCI_VDEVICE(MARVELL, 0x2a0a), .driver_data = MWL8363, },
@@ -3876,94 +4035,133 @@ static DEFINE_PCI_DEVICE_TABLE(mwl8k_pci_id_table) = {
 };
 MODULE_DEVICE_TABLE(pci, mwl8k_pci_id_table);
 
-static int __devinit mwl8k_probe(struct pci_dev *pdev,
-                                 const struct pci_device_id *id)
+static int mwl8k_request_alt_fw(struct mwl8k_priv *priv)
 {
-        static int printed_version = 0;
-        struct ieee80211_hw *hw;
-        struct mwl8k_priv *priv;
         int rc;
-        int i;
-
-        if (!printed_version) {
-                printk(KERN_INFO "%s version %s\n", MWL8K_DESC, MWL8K_VERSION);
-                printed_version = 1;
-        }
-
-
-        rc = pci_enable_device(pdev);
+        printk(KERN_ERR "%s: Error requesting preferred fw %s.\n"
+               "Trying alternative firmware %s\n", pci_name(priv->pdev),
+               priv->fw_pref, priv->fw_alt);
+        rc = mwl8k_request_fw(priv, priv->fw_alt, &priv->fw_ucode, true);
         if (rc) {
-                printk(KERN_ERR "%s: Cannot enable new PCI device\n",
-                       MWL8K_NAME);
+                printk(KERN_ERR "%s: Error requesting alt fw %s\n",
+                       pci_name(priv->pdev), priv->fw_alt);
                 return rc;
         }
+        return 0;
+}
 
-        rc = pci_request_regions(pdev, MWL8K_NAME);
-        if (rc) {
-                printk(KERN_ERR "%s: Cannot obtain PCI resources\n",
-                       MWL8K_NAME);
-                goto err_disable_device;
-        }
-
-        pci_set_master(pdev);
-
-
-        hw = ieee80211_alloc_hw(sizeof(*priv), &mwl8k_ops);
-        if (hw == NULL) {
-                printk(KERN_ERR "%s: ieee80211 alloc failed\n", MWL8K_NAME);
-                rc = -ENOMEM;
-                goto err_free_reg;
-        }
+static int mwl8k_firmware_load_success(struct mwl8k_priv *priv);
+static void mwl8k_fw_state_machine(const struct firmware *fw, void *context)
+{
+        struct mwl8k_priv *priv = context;
+        struct mwl8k_device_info *di = priv->device_info;
+        int rc;
 
-        SET_IEEE80211_DEV(hw, &pdev->dev);
-        pci_set_drvdata(pdev, hw);
+        switch (priv->fw_state) {
+        case FW_STATE_INIT:
+                if (!fw) {
+                        printk(KERN_ERR "%s: Error requesting helper fw %s\n",
+                               pci_name(priv->pdev), di->helper_image);
+                        goto fail;
+                }
+                priv->fw_helper = fw;
+                rc = mwl8k_request_fw(priv, priv->fw_pref, &priv->fw_ucode,
+                                      true);
+                if (rc && priv->fw_alt) {
+                        rc = mwl8k_request_alt_fw(priv);
+                        if (rc)
+                                goto fail;
+                        priv->fw_state = FW_STATE_LOADING_ALT;
+                } else if (rc)
+                        goto fail;
+                else
+                        priv->fw_state = FW_STATE_LOADING_PREF;
+                break;
 
-        priv = hw->priv;
-        priv->hw = hw;
-        priv->pdev = pdev;
-        priv->device_info = &mwl8k_info_tbl[id->driver_data];
+        case FW_STATE_LOADING_PREF:
+                if (!fw) {
+                        if (priv->fw_alt) {
+                                rc = mwl8k_request_alt_fw(priv);
+                                if (rc)
+                                        goto fail;
+                                priv->fw_state = FW_STATE_LOADING_ALT;
+                        } else
+                                goto fail;
+                } else {
+                        priv->fw_ucode = fw;
+                        rc = mwl8k_firmware_load_success(priv);
+                        if (rc)
+                                goto fail;
+                        else
+                                complete(&priv->firmware_loading_complete);
+                }
+                break;
 
+        case FW_STATE_LOADING_ALT:
+                if (!fw) {
+                        printk(KERN_ERR "%s: Error requesting alt fw %s\n",
+                               pci_name(priv->pdev), di->helper_image);
+                        goto fail;
+                }
+                priv->fw_ucode = fw;
+                rc = mwl8k_firmware_load_success(priv);
+                if (rc)
+                        goto fail;
+                else
+                        complete(&priv->firmware_loading_complete);
+                break;
 
-        priv->sram = pci_iomap(pdev, 0, 0x10000);
-        if (priv->sram == NULL) {
-                wiphy_err(hw->wiphy, "Cannot map device SRAM\n");
-                goto err_iounmap;
+        default:
+                printk(KERN_ERR "%s: Unexpected firmware loading state: %d\n",
+                       MWL8K_NAME, priv->fw_state);
+                BUG_ON(1);
         }
 
-        /*
-         * If BAR0 is a 32 bit BAR, the register BAR will be BAR1.
-         * If BAR0 is a 64 bit BAR, the register BAR will be BAR2.
-         */
-        priv->regs = pci_iomap(pdev, 1, 0x10000);
-        if (priv->regs == NULL) {
-                priv->regs = pci_iomap(pdev, 2, 0x10000);
-                if (priv->regs == NULL) {
-                        wiphy_err(hw->wiphy, "Cannot map device registers\n");
-                        goto err_iounmap;
-                }
-        }
+        return;
 
+fail:
+        priv->fw_state = FW_STATE_ERROR;
+        complete(&priv->firmware_loading_complete);
+        device_release_driver(&priv->pdev->dev);
+        mwl8k_release_firmware(priv);
+}
+
+static int mwl8k_init_firmware(struct ieee80211_hw *hw, char *fw_image,
+                               bool nowait)
+{
+        struct mwl8k_priv *priv = hw->priv;
+        int rc;
 
         /* Reset firmware and hardware */
         mwl8k_hw_reset(priv);
 
         /* Ask userland hotplug daemon for the device firmware */
-        rc = mwl8k_request_firmware(priv);
+        rc = mwl8k_request_firmware(priv, fw_image, nowait);
         if (rc) {
                 wiphy_err(hw->wiphy, "Firmware files not found\n");
-                goto err_stop_firmware;
+                return rc;
         }
 
+        if (nowait)
+                return rc;
+
         /* Load firmware into hardware */
         rc = mwl8k_load_firmware(hw);
-        if (rc) {
+        if (rc)
                 wiphy_err(hw->wiphy, "Cannot start firmware\n");
-                goto err_stop_firmware;
-        }
 
         /* Reclaim memory once firmware is successfully loaded */
         mwl8k_release_firmware(priv);
 
+        return rc;
+}
+
+/* initialize hw after successfully loading a firmware image */
+static int mwl8k_probe_hw(struct ieee80211_hw *hw)
+{
+        struct mwl8k_priv *priv = hw->priv;
+        int rc = 0;
+        int i;
 
         if (priv->ap_fw) {
                 priv->rxd_ops = priv->device_info->ap_rxd_ops;
@@ -3980,58 +4178,11 @@ static int __devinit mwl8k_probe(struct pci_dev *pdev,
         priv->wmm_enabled = false;
         priv->pending_tx_pkts = 0;
 
-
-        /*
-         * Extra headroom is the size of the required DMA header
-         * minus the size of the smallest 802.11 frame (CTS frame).
-         */
-        hw->extra_tx_headroom =
-                sizeof(struct mwl8k_dma_data) - sizeof(struct ieee80211_cts);
-
-        hw->channel_change_time = 10;
-
-        hw->queues = MWL8K_TX_QUEUES;
-
-        /* Set rssi values to dBm */
-        hw->flags |= IEEE80211_HW_SIGNAL_DBM;
-        hw->vif_data_size = sizeof(struct mwl8k_vif);
-        hw->sta_data_size = sizeof(struct mwl8k_sta);
-
-        priv->macids_used = 0;
-        INIT_LIST_HEAD(&priv->vif_list);
-
-        /* Set default radio state and preamble */
-        priv->radio_on = 0;
-        priv->radio_short_preamble = 0;
-
-        /* Finalize join worker */
-        INIT_WORK(&priv->finalize_join_worker, mwl8k_finalize_join_worker);
-
-        /* TX reclaim and RX tasklets.  */
-        tasklet_init(&priv->poll_tx_task, mwl8k_tx_poll, (unsigned long)hw);
-        tasklet_disable(&priv->poll_tx_task);
-        tasklet_init(&priv->poll_rx_task, mwl8k_rx_poll, (unsigned long)hw);
-        tasklet_disable(&priv->poll_rx_task);
-
-        /* Power management cookie */
-        priv->cookie = pci_alloc_consistent(priv->pdev, 4, &priv->cookie_dma);
-        if (priv->cookie == NULL)
-                goto err_stop_firmware;
-
         rc = mwl8k_rxq_init(hw, 0);
         if (rc)
-                goto err_free_cookie;
+                goto err_stop_firmware;
         rxq_refill(hw, 0, INT_MAX);
 
-        mutex_init(&priv->fw_mutex);
-        priv->fw_mutex_owner = NULL;
-        priv->fw_mutex_depth = 0;
-        priv->hostcmd_wait = NULL;
-
-        spin_lock_init(&priv->tx_lock);
-
-        priv->tx_wait = NULL;
-
         for (i = 0; i < MWL8K_TX_QUEUES; i++) {
                 rc = mwl8k_txq_init(hw, i);
                 if (rc)
@@ -4071,13 +4222,6 @@ static int __devinit mwl8k_probe(struct pci_dev *pdev,
                 goto err_free_irq;
         }
 
-        hw->wiphy->interface_modes = 0;
-        if (priv->ap_macids_supported)
-                hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_AP);
-        if (priv->sta_macids_supported)
-                hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_STATION);
-
-
         /* Turn radio off */
         rc = mwl8k_cmd_radio_disable(hw);
         if (rc) {
@@ -4096,12 +4240,6 @@ static int __devinit mwl8k_probe(struct pci_dev *pdev,
         iowrite32(0, priv->regs + MWL8K_HIU_A2H_INTERRUPT_MASK);
         free_irq(priv->pdev->irq, hw);
 
-        rc = ieee80211_register_hw(hw);
-        if (rc) {
-                wiphy_err(hw->wiphy, "Cannot register device\n");
-                goto err_free_queues;
-        }
-
         wiphy_info(hw->wiphy, "%s v%d, %pm, %s firmware %u.%u.%u.%u\n",
                    priv->device_info->part_name,
                    priv->hw_rev, hw->wiphy->perm_addr,
@@ -4120,14 +4258,238 @@ err_free_queues:
                 mwl8k_txq_deinit(hw, i);
         mwl8k_rxq_deinit(hw, 0);
 
+err_stop_firmware:
+        mwl8k_hw_reset(priv);
+
+        return rc;
+}
+
+/*
+ * invoke mwl8k_reload_firmware to change the firmware image after the device
+ * has already been registered
+ */
+static int mwl8k_reload_firmware(struct ieee80211_hw *hw, char *fw_image)
+{
+        int i, rc = 0;
+        struct mwl8k_priv *priv = hw->priv;
+
+        mwl8k_stop(hw);
+        mwl8k_rxq_deinit(hw, 0);
+
+        for (i = 0; i < MWL8K_TX_QUEUES; i++)
+                mwl8k_txq_deinit(hw, i);
+
+        rc = mwl8k_init_firmware(hw, fw_image, false);
+        if (rc)
+                goto fail;
+
+        rc = mwl8k_probe_hw(hw);
+        if (rc)
+                goto fail;
+
+        rc = mwl8k_start(hw);
+        if (rc)
+                goto fail;
+
+        rc = mwl8k_config(hw, ~0);
+        if (rc)
+                goto fail;
+
+        for (i = 0; i < MWL8K_TX_QUEUES; i++) {
+                rc = mwl8k_conf_tx(hw, i, &priv->wmm_params[i]);
+                if (rc)
+                        goto fail;
+        }
+
+        return rc;
+
+fail:
+        printk(KERN_WARNING "mwl8k: Failed to reload firmware image.\n");
+        return rc;
+}
+
+static int mwl8k_firmware_load_success(struct mwl8k_priv *priv)
+{
+        struct ieee80211_hw *hw = priv->hw;
+        int i, rc;
+
+        rc = mwl8k_load_firmware(hw);
+        mwl8k_release_firmware(priv);
+        if (rc) {
+                wiphy_err(hw->wiphy, "Cannot start firmware\n");
+                return rc;
+        }
+
+        /*
+         * Extra headroom is the size of the required DMA header
+         * minus the size of the smallest 802.11 frame (CTS frame).
+         */
+        hw->extra_tx_headroom =
+                sizeof(struct mwl8k_dma_data) - sizeof(struct ieee80211_cts);
+
+        hw->channel_change_time = 10;
+
+        hw->queues = MWL8K_TX_QUEUES;
+
+        /* Set rssi values to dBm */
+        hw->flags |= IEEE80211_HW_SIGNAL_DBM;
+        hw->vif_data_size = sizeof(struct mwl8k_vif);
+        hw->sta_data_size = sizeof(struct mwl8k_sta);
+
+        priv->macids_used = 0;
+        INIT_LIST_HEAD(&priv->vif_list);
+
+        /* Set default radio state and preamble */
+        priv->radio_on = 0;
+        priv->radio_short_preamble = 0;
+
+        /* Finalize join worker */
+        INIT_WORK(&priv->finalize_join_worker, mwl8k_finalize_join_worker);
+
+        /* TX reclaim and RX tasklets.  */
+        tasklet_init(&priv->poll_tx_task, mwl8k_tx_poll, (unsigned long)hw);
+        tasklet_disable(&priv->poll_tx_task);
+        tasklet_init(&priv->poll_rx_task, mwl8k_rx_poll, (unsigned long)hw);
+        tasklet_disable(&priv->poll_rx_task);
+
+        /* Power management cookie */
+        priv->cookie = pci_alloc_consistent(priv->pdev, 4, &priv->cookie_dma);
+        if (priv->cookie == NULL)
+                return -ENOMEM;
+
+        mutex_init(&priv->fw_mutex);
+        priv->fw_mutex_owner = NULL;
+        priv->fw_mutex_depth = 0;
+        priv->hostcmd_wait = NULL;
+
+        spin_lock_init(&priv->tx_lock);
+
+        priv->tx_wait = NULL;
+
+        rc = mwl8k_probe_hw(hw);
+        if (rc)
+                goto err_free_cookie;
+
+        hw->wiphy->interface_modes = 0;
+        if (priv->ap_macids_supported || priv->device_info->fw_image_ap)
+                hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_AP);
+        if (priv->sta_macids_supported || priv->device_info->fw_image_sta)
+                hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_STATION);
+
+        rc = ieee80211_register_hw(hw);
+        if (rc) {
+                wiphy_err(hw->wiphy, "Cannot register device\n");
+                goto err_unprobe_hw;
+        }
+
+        return 0;
+
+err_unprobe_hw:
+        for (i = 0; i < MWL8K_TX_QUEUES; i++)
+                mwl8k_txq_deinit(hw, i);
+        mwl8k_rxq_deinit(hw, 0);
+
 err_free_cookie:
         if (priv->cookie != NULL)
                 pci_free_consistent(priv->pdev, 4,
                                 priv->cookie, priv->cookie_dma);
 
+        return rc;
+}
+static int __devinit mwl8k_probe(struct pci_dev *pdev,
+                                 const struct pci_device_id *id)
+{
+        static int printed_version;
+        struct ieee80211_hw *hw;
+        struct mwl8k_priv *priv;
+        struct mwl8k_device_info *di;
+        int rc;
+
+        if (!printed_version) {
+                printk(KERN_INFO "%s version %s\n", MWL8K_DESC, MWL8K_VERSION);
+                printed_version = 1;
+        }
+
+
+        rc = pci_enable_device(pdev);
+        if (rc) {
+                printk(KERN_ERR "%s: Cannot enable new PCI device\n",
+                       MWL8K_NAME);
+                return rc;
+        }
+
+        rc = pci_request_regions(pdev, MWL8K_NAME);
+        if (rc) {
+                printk(KERN_ERR "%s: Cannot obtain PCI resources\n",
+                       MWL8K_NAME);
+                goto err_disable_device;
+        }
+
+        pci_set_master(pdev);
+
+
+        hw = ieee80211_alloc_hw(sizeof(*priv), &mwl8k_ops);
+        if (hw == NULL) {
+                printk(KERN_ERR "%s: ieee80211 alloc failed\n", MWL8K_NAME);
+                rc = -ENOMEM;
+                goto err_free_reg;
+        }
+
+        SET_IEEE80211_DEV(hw, &pdev->dev);
+        pci_set_drvdata(pdev, hw);
+
+        priv = hw->priv;
+        priv->hw = hw;
+        priv->pdev = pdev;
+        priv->device_info = &mwl8k_info_tbl[id->driver_data];
+
+
+        priv->sram = pci_iomap(pdev, 0, 0x10000);
+        if (priv->sram == NULL) {
+                wiphy_err(hw->wiphy, "Cannot map device SRAM\n");
+                goto err_iounmap;
+        }
+
+        /*
+         * If BAR0 is a 32 bit BAR, the register BAR will be BAR1.
+         * If BAR0 is a 64 bit BAR, the register BAR will be BAR2.
+         */
+        priv->regs = pci_iomap(pdev, 1, 0x10000);
+        if (priv->regs == NULL) {
+                priv->regs = pci_iomap(pdev, 2, 0x10000);
+                if (priv->regs == NULL) {
+                        wiphy_err(hw->wiphy, "Cannot map device registers\n");
+                        goto err_iounmap;
+                }
+        }
+
+        /*
+         * Choose the initial fw image depending on user input.  If a second
+         * image is available, make it the alternative image that will be
+         * loaded if the first one fails.
+         */
+        init_completion(&priv->firmware_loading_complete);
+        di = priv->device_info;
+        if (ap_mode_default && di->fw_image_ap) {
+                priv->fw_pref = di->fw_image_ap;
+                priv->fw_alt = di->fw_image_sta;
+        } else if (!ap_mode_default && di->fw_image_sta) {
+                priv->fw_pref = di->fw_image_sta;
+                priv->fw_alt = di->fw_image_ap;
+        } else if (ap_mode_default && !di->fw_image_ap && di->fw_image_sta) {
+                printk(KERN_WARNING "AP fw is unavailable.  Using STA fw.");
+                priv->fw_pref = di->fw_image_sta;
+        } else if (!ap_mode_default && !di->fw_image_sta && di->fw_image_ap) {
+                printk(KERN_WARNING "STA fw is unavailable.  Using AP fw.");
+                priv->fw_pref = di->fw_image_ap;
+        }
+        rc = mwl8k_init_firmware(hw, priv->fw_pref, true);
+        if (rc)
+                goto err_stop_firmware;
+        return rc;
+
 err_stop_firmware:
         mwl8k_hw_reset(priv);
-        mwl8k_release_firmware(priv);
 
 err_iounmap:
         if (priv->regs != NULL)
@@ -4163,6 +4525,13 @@ static void __devexit mwl8k_remove(struct pci_dev *pdev)
                 return;
         priv = hw->priv;
 
+        wait_for_completion(&priv->firmware_loading_complete);
+
+        if (priv->fw_state == FW_STATE_ERROR) {
+                mwl8k_hw_reset(priv);
+                goto unmap;
+        }
+
         ieee80211_stop_queues(hw);
 
         ieee80211_unregister_hw(hw);
@@ -4185,6 +4554,7 @@ static void __devexit mwl8k_remove(struct pci_dev *pdev)
 
         pci_free_consistent(priv->pdev, 4, priv->cookie, priv->cookie_dma);
 
+unmap:
         pci_iounmap(pdev, priv->regs);
         pci_iounmap(pdev, priv->sram);
         pci_set_drvdata(pdev, NULL);
diff --git a/drivers/net/wireless/ray_cs.c b/drivers/net/wireless/ray_cs.c
index 97007d9e2c1..2b1cbba90a8 100644
--- a/drivers/net/wireless/ray_cs.c
+++ b/drivers/net/wireless/ray_cs.c
@@ -2286,8 +2286,8 @@ static void untranslate(ray_dev_t *local, struct sk_buff *skb, int len)
         struct ethhdr *peth;
         UCHAR srcaddr[ADDRLEN];
         UCHAR destaddr[ADDRLEN];
-        static UCHAR org_bridge[3] = { 0, 0, 0xf8 };
-        static UCHAR org_1042[3] = { 0, 0, 0 };
+        static const UCHAR org_bridge[3] = { 0, 0, 0xf8 };
+        static const UCHAR org_1042[3] = { 0, 0, 0 };
 
         memcpy(destaddr, ieee80211_get_DA(pmac), ADDRLEN);
         memcpy(srcaddr, ieee80211_get_SA(pmac), ADDRLEN);
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index 71b5971da59..19f3d568f70 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -156,6 +156,12 @@ MODULE_PARM_DESC(workaround_interval,
 #define RNDIS_STATUS_ADAPTER_NOT_OPEN           cpu_to_le32(0xc0010012)
 
 
+/* Known device types */
+#define RNDIS_UNKNOWN   0
+#define RNDIS_BCM4320A  1
+#define RNDIS_BCM4320B  2
+
+
 /* NDIS data structures. Taken from wpa_supplicant driver_ndis.c
  * slightly modified for datatype endianess, etc
  */
@@ -478,6 +484,7 @@ struct rndis_wlan_private {
         struct ieee80211_rate rates[ARRAY_SIZE(rndis_rates)];
         u32 cipher_suites[ARRAY_SIZE(rndis_cipher_suites)];
 
+        int device_type;
         int caps;
         int multicast_size;
 
@@ -810,7 +817,8 @@ exit_unlock:
         return ret;
 }
 
-static int rndis_set_oid(struct usbnet *dev, __le32 oid, void *data, int len)
+static int rndis_set_oid(struct usbnet *dev, __le32 oid, const void *data,
+                         int len)
 {
         struct rndis_wlan_private *priv = get_rndis_wlan_priv(dev);
         union {
@@ -994,7 +1002,18 @@ static int level_to_qual(int level)
  */
 static int set_infra_mode(struct usbnet *usbdev, int mode);
 static void restore_keys(struct usbnet *usbdev);
-static int rndis_check_bssid_list(struct usbnet *usbdev);
+static int rndis_check_bssid_list(struct usbnet *usbdev, u8 *match_bssid,
+                                        bool *matched);
+
+static int rndis_start_bssid_list_scan(struct usbnet *usbdev)
+{
+        __le32 tmp;
+
+        /* Note: OID_802_11_BSSID_LIST_SCAN clears internal BSS list. */
+        tmp = cpu_to_le32(1);
+        return rndis_set_oid(usbdev, OID_802_11_BSSID_LIST_SCAN, &tmp,
+                                                        sizeof(tmp));
+}
 
 static int set_essid(struct usbnet *usbdev, struct ndis_80211_ssid *ssid)
 {
@@ -1015,7 +1034,7 @@ static int set_essid(struct usbnet *usbdev, struct ndis_80211_ssid *ssid)
         return ret;
 }
 
-static int set_bssid(struct usbnet *usbdev, u8 bssid[ETH_ALEN])
+static int set_bssid(struct usbnet *usbdev, const u8 *bssid)
 {
         int ret;
 
@@ -1031,7 +1050,9 @@ static int set_bssid(struct usbnet *usbdev, u8 bssid[ETH_ALEN])
 
 static int clear_bssid(struct usbnet *usbdev)
 {
-        u8 broadcast_mac[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+        static const u8 broadcast_mac[ETH_ALEN] = {
+                0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+        };
 
         return set_bssid(usbdev, broadcast_mac);
 }
@@ -1904,14 +1925,14 @@ static int rndis_scan(struct wiphy *wiphy, struct net_device *dev,
         struct usbnet *usbdev = netdev_priv(dev);
         struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
         int ret;
-        __le32 tmp;
+        int delay = SCAN_DELAY_JIFFIES;
 
         netdev_dbg(usbdev->net, "cfg80211.scan\n");
 
         /* Get current bssid list from device before new scan, as new scan
          * clears internal bssid list.
          */
-        rndis_check_bssid_list(usbdev);
+        rndis_check_bssid_list(usbdev, NULL, NULL);
 
         if (!request)
                 return -EINVAL;
@@ -1921,13 +1942,13 @@ static int rndis_scan(struct wiphy *wiphy, struct net_device *dev,
 
         priv->scan_request = request;
 
-        tmp = cpu_to_le32(1);
-        ret = rndis_set_oid(usbdev, OID_802_11_BSSID_LIST_SCAN, &tmp,
-                                                        sizeof(tmp));
+        ret = rndis_start_bssid_list_scan(usbdev);
         if (ret == 0) {
+                if (priv->device_type == RNDIS_BCM4320A)
+                        delay = HZ;
+
                 /* Wait before retrieving scan results from device */
-                queue_delayed_work(priv->workqueue, &priv->scan_work,
-                        SCAN_DELAY_JIFFIES);
+                queue_delayed_work(priv->workqueue, &priv->scan_work, delay);
         }
 
         return ret;
@@ -1981,7 +2002,8 @@ static struct cfg80211_bss *rndis_bss_info_update(struct usbnet *usbdev,
                 GFP_KERNEL);
 }
 
-static int rndis_check_bssid_list(struct usbnet *usbdev)
+static int rndis_check_bssid_list(struct usbnet *usbdev, u8 *match_bssid,
+                                        bool *matched)
 {
         void *buf = NULL;
         struct ndis_80211_bssid_list_ex *bssid_list;
@@ -2017,7 +2039,11 @@ resize_buf:
                    count, len);
 
         while (count && ((void *)bssid + bssid_len) <= (buf + len)) {
-                rndis_bss_info_update(usbdev, bssid);
+                if (rndis_bss_info_update(usbdev, bssid) && match_bssid &&
+                    matched) {
+                        if (compare_ether_addr(bssid->mac, match_bssid))
+                                *matched = true;
+                }
 
                 bssid = (void *)bssid + bssid_len;
                 bssid_len = le32_to_cpu(bssid->length);
@@ -2041,7 +2067,7 @@ static void rndis_get_scan_results(struct work_struct *work)
         if (!priv->scan_request)
                 return;
 
-        ret = rndis_check_bssid_list(usbdev);
+        ret = rndis_check_bssid_list(usbdev, NULL, NULL);
 
         cfg80211_scan_done(priv->scan_request, ret < 0);
 
@@ -2495,6 +2521,91 @@ static int rndis_flush_pmksa(struct wiphy *wiphy, struct net_device *netdev)
         return rndis_set_oid(usbdev, OID_802_11_PMKID, &pmkid, sizeof(pmkid));
 }
 
+static void rndis_wlan_craft_connected_bss(struct usbnet *usbdev, u8 *bssid,
+                                           struct ndis_80211_assoc_info *info)
+{
+        struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
+        struct ieee80211_channel *channel;
+        struct ndis_80211_conf config;
+        struct ndis_80211_ssid ssid;
+        s32 signal;
+        u64 timestamp;
+        u16 capability;
+        u16 beacon_interval;
+        __le32 rssi;
+        u8 ie_buf[34];
+        int len, ret, ie_len;
+
+        /* Get signal quality, in case of error use rssi=0 and ignore error. */
+        len = sizeof(rssi);
+        rssi = 0;
+        ret = rndis_query_oid(usbdev, OID_802_11_RSSI, &rssi, &len);
+        signal = level_to_qual(le32_to_cpu(rssi));
+
+        netdev_dbg(usbdev->net, "%s(): OID_802_11_RSSI -> %d, "
+                   "rssi:%d, qual: %d\n", __func__, ret, le32_to_cpu(rssi),
+                   level_to_qual(le32_to_cpu(rssi)));
+
+        /* Get AP capabilities */
+        if (info) {
+                capability = le16_to_cpu(info->resp_ie.capa);
+        } else {
+                /* Set atleast ESS/IBSS capability */
+                capability = (priv->infra_mode == NDIS_80211_INFRA_INFRA) ?
+                                WLAN_CAPABILITY_ESS : WLAN_CAPABILITY_IBSS;
+        }
+
+        /* Get channel and beacon interval */
+        len = sizeof(config);
+        ret = rndis_query_oid(usbdev, OID_802_11_CONFIGURATION, &config, &len);
+        netdev_dbg(usbdev->net, "%s(): OID_802_11_CONFIGURATION -> %d\n",
+                                __func__, ret);
+        if (ret >= 0) {
+                beacon_interval = le16_to_cpu(config.beacon_period);
+                channel = ieee80211_get_channel(priv->wdev.wiphy,
+                                KHZ_TO_MHZ(le32_to_cpu(config.ds_config)));
+                if (!channel) {
+                        netdev_warn(usbdev->net, "%s(): could not get channel."
+                                                 "\n", __func__);
+                        return;
+                }
+        } else {
+                netdev_warn(usbdev->net, "%s(): could not get configuration.\n",
+                                         __func__);
+                return;
+        }
+
+        /* Get SSID, in case of error, use zero length SSID and ignore error. */
+        len = sizeof(ssid);
+        memset(&ssid, 0, sizeof(ssid));
+        ret = rndis_query_oid(usbdev, OID_802_11_SSID, &ssid, &len);
+        netdev_dbg(usbdev->net, "%s(): OID_802_11_SSID -> %d, len: %d, ssid: "
+                                "'%.32s'\n", __func__, ret,
+                                le32_to_cpu(ssid.length), ssid.essid);
+
+        if (le32_to_cpu(ssid.length) > 32)
+                ssid.length = cpu_to_le32(32);
+
+        ie_buf[0] = WLAN_EID_SSID;
+        ie_buf[1] = le32_to_cpu(ssid.length);
+        memcpy(&ie_buf[2], ssid.essid, le32_to_cpu(ssid.length));
+
+        ie_len = le32_to_cpu(ssid.length) + 2;
+
+        /* no tsf */
+        timestamp = 0;
+
+        netdev_dbg(usbdev->net, "%s(): channel:%d(freq), bssid:[%pM], tsf:%d, "
+                "capa:%x, beacon int:%d, resp_ie(len:%d, essid:'%.32s'), "
+                "signal:%d\n", __func__, (channel ? channel->center_freq : -1),
+                bssid, (u32)timestamp, capability, beacon_interval, ie_len,
+                ssid.essid, signal);
+
+        cfg80211_inform_bss(priv->wdev.wiphy, channel, bssid,
+                timestamp, capability, beacon_interval, ie_buf, ie_len,
+                signal, GFP_KERNEL);
+}
+
 /*
  * workers, indication handlers, device poller
  */
@@ -2507,6 +2618,7 @@ static void rndis_wlan_do_link_up_work(struct usbnet *usbdev)
         u8 *req_ie, *resp_ie;
         int ret, offset;
         bool roamed = false;
+        bool match_bss;
 
         if (priv->infra_mode == NDIS_80211_INFRA_INFRA && priv->connected) {
                 /* received media connect indication while connected, either
@@ -2558,6 +2670,13 @@ static void rndis_wlan_do_link_up_work(struct usbnet *usbdev)
                                         resp_ie_len =
                                                 CONTROL_BUFFER_SIZE - offset;
                         }
+                } else {
+                        /* Since rndis_wlan_craft_connected_bss() might use info
+                         * later and expects info to contain valid data if
+                         * non-null, free info and set NULL here.
+                         */
+                        kfree(info);
+                        info = NULL;
                 }
         } else if (WARN_ON(priv->infra_mode != NDIS_80211_INFRA_ADHOC))
                 return;
@@ -2569,13 +2688,26 @@ static void rndis_wlan_do_link_up_work(struct usbnet *usbdev)
         netdev_dbg(usbdev->net, "link up work: [%pM]%s\n",
                    bssid, roamed ? " roamed" : "");
 
-        /* Internal bss list in device always contains at least the currently
+        /* Internal bss list in device should contain at least the currently
          * connected bss and we can get it to cfg80211 with
          * rndis_check_bssid_list().
-         * NOTE: This is true for Broadcom chip, but not mentioned in RNDIS
-         * spec.
+         *
+         * NDIS spec says: "If the device is associated, but the associated
+         *  BSSID is not in its BSSID scan list, then the driver must add an
+         *  entry for the BSSID at the end of the data that it returns in
+         *  response to query of OID_802_11_BSSID_LIST."
+         *
+         * NOTE: Seems to be true for BCM4320b variant, but not BCM4320a.
          */
-        rndis_check_bssid_list(usbdev);
+        match_bss = false;
+        rndis_check_bssid_list(usbdev, bssid, &match_bss);
+
+        if (!is_zero_ether_addr(bssid) && !match_bss) {
+                /* Couldn't get bss from device, we need to manually craft bss
+                 * for cfg80211.
+                 */
+                rndis_wlan_craft_connected_bss(usbdev, bssid, info);
+        }
 
         if (priv->infra_mode == NDIS_80211_INFRA_INFRA) {
                 if (!roamed)
@@ -2934,8 +3066,21 @@ static void rndis_device_poller(struct work_struct *work)
          * also polls device with rndis_command() and catches for media link
          * indications.
          */
-        if (!is_associated(usbdev))
+        if (!is_associated(usbdev)) {
+                /* Workaround bad scanning in BCM4320a devices with active
+                 * background scanning when not associated.
+                 */
+                if (priv->device_type == RNDIS_BCM4320A && priv->radio_on &&
+                    !priv->scan_request) {
+                        /* Get previous scan results */
+                        rndis_check_bssid_list(usbdev, NULL, NULL);
+
+                        /* Initiate new scan */
+                        rndis_start_bssid_list_scan(usbdev);
+                }
+
                 goto end;
+        }
 
         len = sizeof(rssi);
         ret = rndis_query_oid(usbdev, OID_802_11_RSSI, &rssi, &len);
@@ -2992,10 +3137,12 @@ end:
 /*
  * driver/device initialization
  */
-static void rndis_copy_module_params(struct usbnet *usbdev)
+static void rndis_copy_module_params(struct usbnet *usbdev, int device_type)
 {
         struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
 
+        priv->device_type = device_type;
+
         priv->param_country[0] = modparam_country[0];
         priv->param_country[1] = modparam_country[1];
         priv->param_country[2] = 0;
@@ -3038,12 +3185,25 @@ static void rndis_copy_module_params(struct usbnet *usbdev)
                 priv->param_workaround_interval = modparam_workaround_interval;
 }
 
+static int unknown_early_init(struct usbnet *usbdev)
+{
+        /* copy module parameters for unknown so that iwconfig reports txpower
+         * and workaround parameter is copied to private structure correctly.
+         */
+        rndis_copy_module_params(usbdev, RNDIS_UNKNOWN);
+
+        /* This is unknown device, so do not try set configuration parameters.
+         */
+
+        return 0;
+}
+
 static int bcm4320a_early_init(struct usbnet *usbdev)
 {
         /* copy module parameters for bcm4320a so that iwconfig reports txpower
          * and workaround parameter is copied to private structure correctly.
          */
-        rndis_copy_module_params(usbdev);
+        rndis_copy_module_params(usbdev, RNDIS_BCM4320A);
 
         /* bcm4320a doesn't handle configuration parameters well. Try
          * set any and you get partially zeroed mac and broken device.
@@ -3057,7 +3217,7 @@ static int bcm4320b_early_init(struct usbnet *usbdev)
         struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
         char buf[8];
 
-        rndis_copy_module_params(usbdev);
+        rndis_copy_module_params(usbdev, RNDIS_BCM4320B);
 
         /* Early initialization settings, setting these won't have effect
          * if called after generic_rndis_bind().
@@ -3320,7 +3480,7 @@ static const struct driver_info rndis_wlan_info = {
         .tx_fixup =     rndis_tx_fixup,
         .reset =        rndis_wlan_reset,
         .stop =         rndis_wlan_stop,
-        .early_init =   bcm4320a_early_init,
+        .early_init =   unknown_early_init,
         .indication =   rndis_wlan_indication,
 };
 
diff --git a/drivers/net/wireless/rt2x00/Kconfig b/drivers/net/wireless/rt2x00/Kconfig
index 4396d4b9bfb..6f383cd684b 100644
--- a/drivers/net/wireless/rt2x00/Kconfig
+++ b/drivers/net/wireless/rt2x00/Kconfig
@@ -53,51 +53,41 @@ config RT61PCI
 
           When compiled as a module, this driver will be called rt61pci.
 
-config RT2800PCI_PCI
-        boolean
-        depends on PCI
-        default y
-
-config RT2800PCI_SOC
-        boolean
-        depends on RALINK_RT288X || RALINK_RT305X
-        default y
-
 config RT2800PCI
-        tristate "Ralink rt28xx/rt30xx/rt35xx (PCI/PCIe/PCMCIA) support (EXPERIMENTAL)"
-        depends on (RT2800PCI_PCI || RT2800PCI_SOC) && EXPERIMENTAL
+        tristate "Ralink rt27xx/rt28xx/rt30xx (PCI/PCIe/PCMCIA) support"
+        depends on PCI || RALINK_RT288X || RALINK_RT305X
         select RT2800_LIB
-        select RT2X00_LIB_PCI if RT2800PCI_PCI
-        select RT2X00_LIB_SOC if RT2800PCI_SOC
+        select RT2X00_LIB_PCI if PCI
+        select RT2X00_LIB_SOC if RALINK_RT288X || RALINK_RT305X
         select RT2X00_LIB_HT
         select RT2X00_LIB_FIRMWARE
         select RT2X00_LIB_CRYPTO
         select CRC_CCITT
         select EEPROM_93CX6
         ---help---
-          This adds support for rt2800/rt3000/rt3500 wireless chipset family.
-          Supported chips: RT2760, RT2790, RT2860, RT2880, RT2890 & RT3052
-
-          This driver is non-functional at the moment and is intended for
-          developers.
+          This adds support for rt27xx/rt28xx/rt30xx wireless chipset family.
+          Supported chips: RT2760, RT2790, RT2860, RT2880, RT2890, RT3052,
+                           RT3090, RT3091 & RT3092
 
           When compiled as a module, this driver will be called "rt2800pci.ko".
 
 if RT2800PCI
 
-config RT2800PCI_RT30XX
-        bool "rt2800pci - Include support for rt30xx (PCI/PCIe/PCMCIA) devices"
-        default y
+config RT2800PCI_RT33XX
+        bool "rt2800pci - Include support for rt33xx devices (EXPERIMENTAL)"
+        depends on EXPERIMENTAL
+        default n
         ---help---
-          This adds support for rt30xx wireless chipset family to the
+          This adds support for rt33xx wireless chipset family to the
           rt2800pci driver.
-          Supported chips: RT3090, RT3091 & RT3092
+          Supported chips: RT3390
 
           Support for these devices is non-functional at the moment and is
           intended for testers and developers.
 
 config RT2800PCI_RT35XX
-        bool "rt2800pci - Include support for rt35xx (PCI/PCIe/PCMCIA) devices"
+        bool "rt2800pci - Include support for rt35xx devices (EXPERIMENTAL)"
+        depends on EXPERIMENTAL
         default n
         ---help---
           This adds support for rt35xx wireless chipset family to the
@@ -134,8 +124,8 @@ config RT73USB
           When compiled as a module, this driver will be called rt73usb.
 
 config RT2800USB
-        tristate "Ralink rt2800 (USB) support (EXPERIMENTAL)"
-        depends on USB && EXPERIMENTAL
+        tristate "Ralink rt27xx/rt28xx/rt30xx (USB) support"
+        depends on USB
         select RT2800_LIB
         select RT2X00_LIB_USB
         select RT2X00_LIB_HT
@@ -143,30 +133,28 @@ config RT2800USB
         select RT2X00_LIB_CRYPTO
         select CRC_CCITT
         ---help---
-          This adds experimental support for rt2800 wireless chipset family.
-          Supported chips: RT2770, RT2870 & RT3070.
-
-          Known issues:
-          - support for RT2870 chips doesn't work with 802.11n APs yet
-          - support for RT3070 chips is non-functional at the moment
+          This adds support for rt27xx/rt28xx/rt30xx wireless chipset family.
+          Supported chips: RT2770, RT2870 & RT3070, RT3071 & RT3072
 
           When compiled as a module, this driver will be called "rt2800usb.ko".
 
 if RT2800USB
 
-config RT2800USB_RT30XX
-        bool "rt2800usb - Include support for rt30xx (USB) devices"
-        default y
+config RT2800USB_RT33XX
+        bool "rt2800usb - Include support for rt33xx devices (EXPERIMENTAL)"
+        depends on EXPERIMENTAL
+        default n
         ---help---
-          This adds support for rt30xx wireless chipset family to the
+          This adds support for rt33xx wireless chipset family to the
           rt2800usb driver.
-          Supported chips: RT3070, RT3071 & RT3072
+          Supported chips: RT3370
 
           Support for these devices is non-functional at the moment and is
           intended for testers and developers.
 
 config RT2800USB_RT35XX
-        bool "rt2800usb - Include support for rt35xx (USB) devices"
+        bool "rt2800usb - Include support for rt35xx devices (EXPERIMENTAL)"
+        depends on EXPERIMENTAL
         default n
         ---help---
           This adds support for rt35xx wireless chipset family to the
@@ -180,9 +168,9 @@ config RT2800USB_UNKNOWN
         bool "rt2800usb - Include support for unknown (USB) devices"
         default n
         ---help---
-          This adds support for rt2800 family devices that are known to
-          have a rt2800 family chipset, but for which the exact chipset
-          is unknown.
+          This adds support for rt2800usb devices that are known to
+          have a rt28xx family compatible chipset, but for which the exact
+          chipset is unknown.
 
           Support status for these devices is unknown, and enabling these
           devices may or may not work.
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.c b/drivers/net/wireless/rt2x00/rt2400pci.c
index 4f420a9ec5d..9ec6691adf0 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.c
+++ b/drivers/net/wireless/rt2x00/rt2400pci.c
@@ -885,8 +885,7 @@ static void rt2400pci_toggle_rx(struct rt2x00_dev *rt2x00dev,
 
         rt2x00pci_register_read(rt2x00dev, RXCSR0, &reg);
         rt2x00_set_field32(&reg, RXCSR0_DISABLE_RX,
-                           (state == STATE_RADIO_RX_OFF) ||
-                           (state == STATE_RADIO_RX_OFF_LINK));
+                           (state == STATE_RADIO_RX_OFF));
         rt2x00pci_register_write(rt2x00dev, RXCSR0, reg);
 }
 
@@ -989,9 +988,7 @@ static int rt2400pci_set_device_state(struct rt2x00_dev *rt2x00dev,
                 rt2400pci_disable_radio(rt2x00dev);
                 break;
         case STATE_RADIO_RX_ON:
-        case STATE_RADIO_RX_ON_LINK:
         case STATE_RADIO_RX_OFF:
-        case STATE_RADIO_RX_OFF_LINK:
                 rt2400pci_toggle_rx(rt2x00dev, state);
                 break;
         case STATE_RADIO_IRQ_ON:
@@ -1612,6 +1609,7 @@ static const struct ieee80211_ops rt2400pci_mac80211_ops = {
         .get_tsf                = rt2400pci_get_tsf,
         .tx_last_beacon         = rt2400pci_tx_last_beacon,
         .rfkill_poll            = rt2x00mac_rfkill_poll,
+        .flush                  = rt2x00mac_flush,
 };
 
 static const struct rt2x00lib_ops rt2400pci_rt2x00_ops = {
@@ -1640,28 +1638,28 @@ static const struct rt2x00lib_ops rt2400pci_rt2x00_ops = {
 };
 
 static const struct data_queue_desc rt2400pci_queue_rx = {
-        .entry_num              = RX_ENTRIES,
+        .entry_num              = 24,
         .data_size              = DATA_FRAME_SIZE,
         .desc_size              = RXD_DESC_SIZE,
         .priv_size              = sizeof(struct queue_entry_priv_pci),
 };
 
 static const struct data_queue_desc rt2400pci_queue_tx = {
-        .entry_num              = TX_ENTRIES,
+        .entry_num              = 24,
         .data_size              = DATA_FRAME_SIZE,
         .desc_size              = TXD_DESC_SIZE,
         .priv_size              = sizeof(struct queue_entry_priv_pci),
 };
 
 static const struct data_queue_desc rt2400pci_queue_bcn = {
-        .entry_num              = BEACON_ENTRIES,
+        .entry_num              = 1,
         .data_size              = MGMT_FRAME_SIZE,
         .desc_size              = TXD_DESC_SIZE,
         .priv_size              = sizeof(struct queue_entry_priv_pci),
 };
 
 static const struct data_queue_desc rt2400pci_queue_atim = {
-        .entry_num              = ATIM_ENTRIES,
+        .entry_num              = 8,
         .data_size              = DATA_FRAME_SIZE,
         .desc_size              = TXD_DESC_SIZE,
         .priv_size              = sizeof(struct queue_entry_priv_pci),
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.h b/drivers/net/wireless/rt2x00/rt2400pci.h
index c048b18f413..d3a4a68cc43 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.h
+++ b/drivers/net/wireless/rt2x00/rt2400pci.h
@@ -809,8 +809,8 @@
 /*
  * DMA descriptor defines.
  */
-#define TXD_DESC_SIZE                   ( 8 * sizeof(__le32) )
-#define RXD_DESC_SIZE                   ( 8 * sizeof(__le32) )
+#define TXD_DESC_SIZE                   (8 * sizeof(__le32))
+#define RXD_DESC_SIZE                   (8 * sizeof(__le32))
 
 /*
  * TX descriptor format for TX, PRIO, ATIM and Beacon Ring.
@@ -948,6 +948,6 @@
         ((__CLAMP_TX(__txpower) - MAX_TXPOWER) + MIN_TXPOWER)
 
 #define TXPOWER_TO_DEV(__txpower) \
-        MAX_TXPOWER - (__CLAMP_TX(__txpower) - MIN_TXPOWER)
+        (MAX_TXPOWER - (__CLAMP_TX(__txpower) - MIN_TXPOWER))
 
 #endif /* RT2400PCI_H */
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index 97feb7aef80..3e7f2034624 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -1040,8 +1040,7 @@ static void rt2500pci_toggle_rx(struct rt2x00_dev *rt2x00dev,
 
         rt2x00pci_register_read(rt2x00dev, RXCSR0, &reg);
         rt2x00_set_field32(&reg, RXCSR0_DISABLE_RX,
-                           (state == STATE_RADIO_RX_OFF) ||
-                           (state == STATE_RADIO_RX_OFF_LINK));
+                           (state == STATE_RADIO_RX_OFF));
         rt2x00pci_register_write(rt2x00dev, RXCSR0, reg);
 }
 
@@ -1144,9 +1143,7 @@ static int rt2500pci_set_device_state(struct rt2x00_dev *rt2x00dev,
                 rt2500pci_disable_radio(rt2x00dev);
                 break;
         case STATE_RADIO_RX_ON:
-        case STATE_RADIO_RX_ON_LINK:
         case STATE_RADIO_RX_OFF:
-        case STATE_RADIO_RX_OFF_LINK:
                 rt2500pci_toggle_rx(rt2x00dev, state);
                 break;
         case STATE_RADIO_IRQ_ON:
@@ -1193,9 +1190,9 @@ static void rt2500pci_write_tx_desc(struct queue_entry *entry,
 
         rt2x00_desc_read(txd, 2, &word);
         rt2x00_set_field32(&word, TXD_W2_IV_OFFSET, IEEE80211_HEADER);
-        rt2x00_set_field32(&word, TXD_W2_AIFS, txdesc->aifs);
-        rt2x00_set_field32(&word, TXD_W2_CWMIN, txdesc->cw_min);
-        rt2x00_set_field32(&word, TXD_W2_CWMAX, txdesc->cw_max);
+        rt2x00_set_field32(&word, TXD_W2_AIFS, entry->queue->aifs);
+        rt2x00_set_field32(&word, TXD_W2_CWMIN, entry->queue->cw_min);
+        rt2x00_set_field32(&word, TXD_W2_CWMAX, entry->queue->cw_max);
         rt2x00_desc_write(txd, 2, word);
 
         rt2x00_desc_read(txd, 3, &word);
@@ -1909,6 +1906,7 @@ static const struct ieee80211_ops rt2500pci_mac80211_ops = {
         .get_tsf                = rt2500pci_get_tsf,
         .tx_last_beacon         = rt2500pci_tx_last_beacon,
         .rfkill_poll            = rt2x00mac_rfkill_poll,
+        .flush                  = rt2x00mac_flush,
 };
 
 static const struct rt2x00lib_ops rt2500pci_rt2x00_ops = {
@@ -1937,28 +1935,28 @@ static const struct rt2x00lib_ops rt2500pci_rt2x00_ops = {
 };
 
 static const struct data_queue_desc rt2500pci_queue_rx = {
-        .entry_num              = RX_ENTRIES,
+        .entry_num              = 32,
         .data_size              = DATA_FRAME_SIZE,
         .desc_size              = RXD_DESC_SIZE,
         .priv_size              = sizeof(struct queue_entry_priv_pci),
 };
 
 static const struct data_queue_desc rt2500pci_queue_tx = {
-        .entry_num              = TX_ENTRIES,
+        .entry_num              = 32,
         .data_size              = DATA_FRAME_SIZE,
         .desc_size              = TXD_DESC_SIZE,
         .priv_size              = sizeof(struct queue_entry_priv_pci),
 };
 
 static const struct data_queue_desc rt2500pci_queue_bcn = {
-        .entry_num              = BEACON_ENTRIES,
+        .entry_num              = 1,
         .data_size              = MGMT_FRAME_SIZE,
         .desc_size              = TXD_DESC_SIZE,
         .priv_size              = sizeof(struct queue_entry_priv_pci),
 };
 
 static const struct data_queue_desc rt2500pci_queue_atim = {
-        .entry_num              = ATIM_ENTRIES,
+        .entry_num              = 8,
         .data_size              = DATA_FRAME_SIZE,
         .desc_size              = TXD_DESC_SIZE,
         .priv_size              = sizeof(struct queue_entry_priv_pci),
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.h b/drivers/net/wireless/rt2x00/rt2500pci.h
index d708031361a..2aad7ba8a10 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.h
+++ b/drivers/net/wireless/rt2x00/rt2500pci.h
@@ -1088,8 +1088,8 @@
 /*
  * DMA descriptor defines.
  */
-#define TXD_DESC_SIZE                   ( 11 * sizeof(__le32) )
-#define RXD_DESC_SIZE                   ( 11 * sizeof(__le32) )
+#define TXD_DESC_SIZE                   (11 * sizeof(__le32))
+#define RXD_DESC_SIZE                   (11 * sizeof(__le32))
 
 /*
  * TX descriptor format for TX, PRIO, ATIM and Beacon Ring.
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index 93e44c7f3a7..8152fec3175 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -39,7 +39,7 @@
 /*
  * Allow hardware encryption to be disabled.
  */
-static int modparam_nohwcrypt = 0;
+static int modparam_nohwcrypt;
 module_param_named(nohwcrypt, modparam_nohwcrypt, bool, S_IRUGO);
 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
 
@@ -938,8 +938,7 @@ static void rt2500usb_toggle_rx(struct rt2x00_dev *rt2x00dev,
 
         rt2500usb_register_read(rt2x00dev, TXRX_CSR2, &reg);
         rt2x00_set_field16(&reg, TXRX_CSR2_DISABLE_RX,
-                           (state == STATE_RADIO_RX_OFF) ||
-                           (state == STATE_RADIO_RX_OFF_LINK));
+                           (state == STATE_RADIO_RX_OFF));
         rt2500usb_register_write(rt2x00dev, TXRX_CSR2, reg);
 }
 
@@ -1019,9 +1018,7 @@ static int rt2500usb_set_device_state(struct rt2x00_dev *rt2x00dev,
                 rt2500usb_disable_radio(rt2x00dev);
                 break;
         case STATE_RADIO_RX_ON:
-        case STATE_RADIO_RX_ON_LINK:
         case STATE_RADIO_RX_OFF:
-        case STATE_RADIO_RX_OFF_LINK:
                 rt2500usb_toggle_rx(rt2x00dev, state);
                 break;
         case STATE_RADIO_IRQ_ON:
@@ -1081,9 +1078,9 @@ static void rt2500usb_write_tx_desc(struct queue_entry *entry,
 
         rt2x00_desc_read(txd, 1, &word);
         rt2x00_set_field32(&word, TXD_W1_IV_OFFSET, txdesc->iv_offset);
-        rt2x00_set_field32(&word, TXD_W1_AIFS, txdesc->aifs);
-        rt2x00_set_field32(&word, TXD_W1_CWMIN, txdesc->cw_min);
-        rt2x00_set_field32(&word, TXD_W1_CWMAX, txdesc->cw_max);
+        rt2x00_set_field32(&word, TXD_W1_AIFS, entry->queue->aifs);
+        rt2x00_set_field32(&word, TXD_W1_CWMIN, entry->queue->cw_min);
+        rt2x00_set_field32(&word, TXD_W1_CWMAX, entry->queue->cw_max);
         rt2x00_desc_write(txd, 1, word);
 
         rt2x00_desc_read(txd, 2, &word);
@@ -1801,6 +1798,7 @@ static const struct ieee80211_ops rt2500usb_mac80211_ops = {
         .bss_info_changed       = rt2x00mac_bss_info_changed,
         .conf_tx                = rt2x00mac_conf_tx,
         .rfkill_poll            = rt2x00mac_rfkill_poll,
+        .flush                  = rt2x00mac_flush,
 };
 
 static const struct rt2x00lib_ops rt2500usb_rt2x00_ops = {
@@ -1829,28 +1827,28 @@ static const struct rt2x00lib_ops rt2500usb_rt2x00_ops = {
 };
 
 static const struct data_queue_desc rt2500usb_queue_rx = {
-        .entry_num              = RX_ENTRIES,
+        .entry_num              = 32,
         .data_size              = DATA_FRAME_SIZE,
         .desc_size              = RXD_DESC_SIZE,
         .priv_size              = sizeof(struct queue_entry_priv_usb),
 };
 
 static const struct data_queue_desc rt2500usb_queue_tx = {
-        .entry_num              = TX_ENTRIES,
+        .entry_num              = 32,
         .data_size              = DATA_FRAME_SIZE,
         .desc_size              = TXD_DESC_SIZE,
         .priv_size              = sizeof(struct queue_entry_priv_usb),
 };
 
 static const struct data_queue_desc rt2500usb_queue_bcn = {
-        .entry_num              = BEACON_ENTRIES,
+        .entry_num              = 1,
         .data_size              = MGMT_FRAME_SIZE,
         .desc_size              = TXD_DESC_SIZE,
         .priv_size              = sizeof(struct queue_entry_priv_usb_bcn),
 };
 
 static const struct data_queue_desc rt2500usb_queue_atim = {
-        .entry_num              = ATIM_ENTRIES,
+        .entry_num              = 8,
         .data_size              = DATA_FRAME_SIZE,
         .desc_size              = TXD_DESC_SIZE,
         .priv_size              = sizeof(struct queue_entry_priv_usb),
diff --git a/drivers/net/wireless/rt2x00/rt2800.h b/drivers/net/wireless/rt2x00/rt2800.h
index eb8b6cab992..a81c4371835 100644
--- a/drivers/net/wireless/rt2x00/rt2800.h
+++ b/drivers/net/wireless/rt2x00/rt2800.h
@@ -47,6 +47,7 @@
  * RF3021 2.4G 1T2R
  * RF3022 2.4G 2T2R
  * RF3052 2.4G 2T2R
+ * RF3320 2.4G 1T1R
  */
 #define RF2820                          0x0001
 #define RF2850                          0x0002
@@ -412,10 +413,22 @@
 #define BCN_OFFSET1_BCN7                FIELD32(0xff000000)
 
 /*
- * PBF registers
- * Most are for debug. Driver doesn't touch PBF register.
+ * TXRXQ_PCNT: PBF register
+ * PCNT_TX0Q: Page count for TX hardware queue 0
+ * PCNT_TX1Q: Page count for TX hardware queue 1
+ * PCNT_TX2Q: Page count for TX hardware queue 2
+ * PCNT_RX0Q: Page count for RX hardware queue
  */
 #define TXRXQ_PCNT                      0x0438
+#define TXRXQ_PCNT_TX0Q                 FIELD32(0x000000ff)
+#define TXRXQ_PCNT_TX1Q                 FIELD32(0x0000ff00)
+#define TXRXQ_PCNT_TX2Q                 FIELD32(0x00ff0000)
+#define TXRXQ_PCNT_RX0Q                 FIELD32(0xff000000)
+
+/*
+ * PBF register
+ * Debug. Driver doesn't touch PBF register.
+ */
 #define PBF_DBG                         0x043c
 
 /*
@@ -960,8 +973,31 @@
 
 /*
  * TXOP_CTRL_CFG:
+ * TIMEOUT_TRUN_EN: Enable/Disable TXOP timeout truncation
+ * AC_TRUN_EN: Enable/Disable truncation for AC change
+ * TXRATEGRP_TRUN_EN: Enable/Disable truncation for TX rate group change
+ * USER_MODE_TRUN_EN: Enable/Disable truncation for user TXOP mode
+ * MIMO_PS_TRUN_EN: Enable/Disable truncation for MIMO PS RTS/CTS
+ * RESERVED_TRUN_EN: Reserved
+ * LSIG_TXOP_EN: Enable/Disable L-SIG TXOP protection
+ * EXT_CCA_EN: Enable/Disable extension channel CCA reference (Defer 40Mhz
+ *             transmissions if extension CCA is clear).
+ * EXT_CCA_DLY: Extension CCA signal delay time (unit: us)
+ * EXT_CWMIN: CwMin for extension channel backoff
+ *            0: Disabled
+ *
  */
 #define TXOP_CTRL_CFG                   0x1340
+#define TXOP_CTRL_CFG_TIMEOUT_TRUN_EN   FIELD32(0x00000001)
+#define TXOP_CTRL_CFG_AC_TRUN_EN        FIELD32(0x00000002)
+#define TXOP_CTRL_CFG_TXRATEGRP_TRUN_EN FIELD32(0x00000004)
+#define TXOP_CTRL_CFG_USER_MODE_TRUN_EN FIELD32(0x00000008)
+#define TXOP_CTRL_CFG_MIMO_PS_TRUN_EN   FIELD32(0x00000010)
+#define TXOP_CTRL_CFG_RESERVED_TRUN_EN  FIELD32(0x00000020)
+#define TXOP_CTRL_CFG_LSIG_TXOP_EN      FIELD32(0x00000040)
+#define TXOP_CTRL_CFG_EXT_CCA_EN        FIELD32(0x00000080)
+#define TXOP_CTRL_CFG_EXT_CCA_DLY       FIELD32(0x0000ff00)
+#define TXOP_CTRL_CFG_EXT_CWMIN         FIELD32(0x000f0000)
 
 /*
  * TX_RTS_CFG:
@@ -1485,17 +1521,17 @@
 #define SHARED_KEY_MODE_BASE            0x7000
 
 #define MAC_WCID_ENTRY(__idx) \
-        ( MAC_WCID_BASE + ((__idx) * sizeof(struct mac_wcid_entry)) )
+        (MAC_WCID_BASE + ((__idx) * sizeof(struct mac_wcid_entry)))
 #define PAIRWISE_KEY_ENTRY(__idx) \
-        ( PAIRWISE_KEY_TABLE_BASE + ((__idx) * sizeof(struct hw_key_entry)) )
+        (PAIRWISE_KEY_TABLE_BASE + ((__idx) * sizeof(struct hw_key_entry)))
 #define MAC_IVEIV_ENTRY(__idx) \
-        ( MAC_IVEIV_TABLE_BASE + ((__idx) * sizeof(struct mac_iveiv_entry)) )
+        (MAC_IVEIV_TABLE_BASE + ((__idx) * sizeof(struct mac_iveiv_entry)))
 #define MAC_WCID_ATTR_ENTRY(__idx) \
-        ( MAC_WCID_ATTRIBUTE_BASE + ((__idx) * sizeof(u32)) )
+        (MAC_WCID_ATTRIBUTE_BASE + ((__idx) * sizeof(u32)))
 #define SHARED_KEY_ENTRY(__idx) \
-        ( SHARED_KEY_TABLE_BASE + ((__idx) * sizeof(struct hw_key_entry)) )
+        (SHARED_KEY_TABLE_BASE + ((__idx) * sizeof(struct hw_key_entry)))
 #define SHARED_KEY_MODE_ENTRY(__idx) \
-        ( SHARED_KEY_MODE_BASE + ((__idx) * sizeof(u32)) )
+        (SHARED_KEY_MODE_BASE + ((__idx) * sizeof(u32)))
 
 struct mac_wcid_entry {
         u8 mac[6];
@@ -1635,9 +1671,9 @@ struct mac_iveiv_entry {
 #define HW_BEACON_BASE7                 0x5bc0
 
 #define HW_BEACON_OFFSET(__index) \
-        ( ((__index) < 4) ? ( HW_BEACON_BASE0 + (__index * 0x0200) ) : \
-          (((__index) < 6) ? ( HW_BEACON_BASE4 + ((__index - 4) * 0x0200) ) : \
-          (HW_BEACON_BASE6 - ((__index - 6) * 0x0200))) )
+        (((__index) < 4) ? (HW_BEACON_BASE0 + (__index * 0x0200)) : \
+          (((__index) < 6) ? (HW_BEACON_BASE4 + ((__index - 4) * 0x0200)) : \
+          (HW_BEACON_BASE6 - ((__index - 6) * 0x0200))))
 
 /*
  * BBP registers.
@@ -1987,8 +2023,8 @@ struct mac_iveiv_entry {
 /*
  * DMA descriptor defines.
  */
-#define TXWI_DESC_SIZE                  ( 4 * sizeof(__le32) )
-#define RXWI_DESC_SIZE                  ( 4 * sizeof(__le32) )
+#define TXWI_DESC_SIZE                  (4 * sizeof(__le32))
+#define RXWI_DESC_SIZE                  (4 * sizeof(__le32))
 
 /*
  * TX WI structure
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index 5f00e00789d..75631614aba 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -277,13 +277,17 @@ int rt2800_wait_wpdma_ready(struct rt2x00_dev *rt2x00dev)
         unsigned int i;
         u32 reg;
 
+        /*
+         * Some devices are really slow to respond here. Wait a whole second
+         * before timing out.
+         */
         for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
                 rt2800_register_read(rt2x00dev, WPDMA_GLO_CFG, &reg);
                 if (!rt2x00_get_field32(reg, WPDMA_GLO_CFG_TX_DMA_BUSY) &&
                     !rt2x00_get_field32(reg, WPDMA_GLO_CFG_RX_DMA_BUSY))
                         return 0;
 
-                msleep(1);
+                msleep(10);
         }
 
         ERROR(rt2x00dev, "WPDMA TX/RX busy, aborting.\n");
@@ -483,7 +487,7 @@ void rt2800_write_tx_data(struct queue_entry *entry,
                            txdesc->key_idx : 0xff);
         rt2x00_set_field32(&word, TXWI_W1_MPDU_TOTAL_BYTE_COUNT,
                            txdesc->length);
-        rt2x00_set_field32(&word, TXWI_W1_PACKETID_QUEUE, txdesc->qid);
+        rt2x00_set_field32(&word, TXWI_W1_PACKETID_QUEUE, entry->queue->qid);
         rt2x00_set_field32(&word, TXWI_W1_PACKETID_ENTRY, (entry->entry_idx % 3) + 1);
         rt2x00_desc_write(txwi, 1, word);
 
@@ -727,7 +731,7 @@ void rt2800_txdone(struct rt2x00_dev *rt2x00dev)
          * that the TX_STA_FIFO stack has a size of 16. We stick to our
          * tx ring size for now.
          */
-        for (i = 0; i < TX_ENTRIES; i++) {
+        for (i = 0; i < rt2x00dev->ops->tx->entry_num; i++) {
                 rt2800_register_read(rt2x00dev, TX_STA_FIFO, &reg);
                 if (!rt2x00_get_field32(reg, TX_STA_FIFO_VALID))
                         break;
@@ -824,7 +828,7 @@ void rt2800_write_beacon(struct queue_entry *entry, struct txentry_desc *txdesc)
 }
 EXPORT_SYMBOL_GPL(rt2800_write_beacon);
 
-static void inline rt2800_clear_beacon(struct rt2x00_dev *rt2x00dev,
+static inline void rt2800_clear_beacon(struct rt2x00_dev *rt2x00dev,
                                        unsigned int beacon_base)
 {
         int i;
@@ -1144,6 +1148,7 @@ void rt2800_config_intf(struct rt2x00_dev *rt2x00dev, struct rt2x00_intf *intf,
                         struct rt2x00intf_conf *conf, const unsigned int flags)
 {
         u32 reg;
+        bool update_bssid = false;
 
         if (flags & CONFIG_UPDATE_TYPE) {
                 /*
@@ -1173,6 +1178,16 @@ void rt2800_config_intf(struct rt2x00_dev *rt2x00dev, struct rt2x00_intf *intf,
         }
 
         if (flags & CONFIG_UPDATE_MAC) {
+                if (flags & CONFIG_UPDATE_TYPE &&
+                    conf->sync == TSF_SYNC_AP_NONE) {
+                        /*
+                         * The BSSID register has to be set to our own mac
+                         * address in AP mode.
+                         */
+                        memcpy(conf->bssid, conf->mac, sizeof(conf->mac));
+                        update_bssid = true;
+                }
+
                 if (!is_zero_ether_addr((const u8 *)conf->mac)) {
                         reg = le32_to_cpu(conf->mac[1]);
                         rt2x00_set_field32(&reg, MAC_ADDR_DW1_UNICAST_TO_ME_MASK, 0xff);
@@ -1183,7 +1198,7 @@ void rt2800_config_intf(struct rt2x00_dev *rt2x00dev, struct rt2x00_intf *intf,
                                               conf->mac, sizeof(conf->mac));
         }
 
-        if (flags & CONFIG_UPDATE_BSSID) {
+        if ((flags & CONFIG_UPDATE_BSSID) || update_bssid) {
                 if (!is_zero_ether_addr((const u8 *)conf->bssid)) {
                         reg = le32_to_cpu(conf->bssid[1]);
                         rt2x00_set_field32(&reg, MAC_BSSID_DW1_BSS_ID_MASK, 3);
@@ -1529,7 +1544,8 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,
             rt2x00_rf(rt2x00dev, RF3020) ||
             rt2x00_rf(rt2x00dev, RF3021) ||
             rt2x00_rf(rt2x00dev, RF3022) ||
-            rt2x00_rf(rt2x00dev, RF3052))
+            rt2x00_rf(rt2x00dev, RF3052) ||
+            rt2x00_rf(rt2x00dev, RF3320))
                 rt2800_config_channel_rf3xxx(rt2x00dev, conf, rf, info);
         else
                 rt2800_config_channel_rf2xxx(rt2x00dev, conf, rf, info);
@@ -2097,7 +2113,23 @@ static int rt2800_init_registers(struct rt2x00_dev *rt2x00dev)
                 rt2800_register_write(rt2x00dev, WPDMA_GLO_CFG, reg);
         }
 
-        rt2800_register_write(rt2x00dev, TXOP_CTRL_CFG, 0x0000583f);
+        /*
+         * The legacy driver also sets TXOP_CTRL_CFG_RESERVED_TRUN_EN to 1
+         * although it is reserved.
+         */
+        rt2800_register_read(rt2x00dev, TXOP_CTRL_CFG, &reg);
+        rt2x00_set_field32(&reg, TXOP_CTRL_CFG_TIMEOUT_TRUN_EN, 1);
+        rt2x00_set_field32(&reg, TXOP_CTRL_CFG_AC_TRUN_EN, 1);
+        rt2x00_set_field32(&reg, TXOP_CTRL_CFG_TXRATEGRP_TRUN_EN, 1);
+        rt2x00_set_field32(&reg, TXOP_CTRL_CFG_USER_MODE_TRUN_EN, 1);
+        rt2x00_set_field32(&reg, TXOP_CTRL_CFG_MIMO_PS_TRUN_EN, 1);
+        rt2x00_set_field32(&reg, TXOP_CTRL_CFG_RESERVED_TRUN_EN, 1);
+        rt2x00_set_field32(&reg, TXOP_CTRL_CFG_LSIG_TXOP_EN, 0);
+        rt2x00_set_field32(&reg, TXOP_CTRL_CFG_EXT_CCA_EN, 0);
+        rt2x00_set_field32(&reg, TXOP_CTRL_CFG_EXT_CCA_DLY, 88);
+        rt2x00_set_field32(&reg, TXOP_CTRL_CFG_EXT_CWMIN, 0);
+        rt2800_register_write(rt2x00dev, TXOP_CTRL_CFG, reg);
+
         rt2800_register_write(rt2x00dev, TXOP_HLDR_ET, 0x00000002);
 
         rt2800_register_read(rt2x00dev, TX_RTS_CFG, &reg);
@@ -2134,7 +2166,7 @@ static int rt2800_init_registers(struct rt2x00_dev *rt2x00dev)
                                          SHARED_KEY_MODE_ENTRY(i), 0);
 
         for (i = 0; i < 256; i++) {
-                u32 wcid[2] = { 0xffffffff, 0x00ffffff };
+                static const u32 wcid[2] = { 0xffffffff, 0x00ffffff };
                 rt2800_register_multiwrite(rt2x00dev, MAC_WCID_ENTRY(i),
                                               wcid, sizeof(wcid));
 
@@ -2981,7 +3013,8 @@ int rt2800_init_eeprom(struct rt2x00_dev *rt2x00dev)
             !rt2x00_rf(rt2x00dev, RF2020) &&
             !rt2x00_rf(rt2x00dev, RF3021) &&
             !rt2x00_rf(rt2x00dev, RF3022) &&
-            !rt2x00_rf(rt2x00dev, RF3052)) {
+            !rt2x00_rf(rt2x00dev, RF3052) &&
+            !rt2x00_rf(rt2x00dev, RF3320)) {
                 ERROR(rt2x00dev, "Invalid RF chipset detected.\n");
                 return -ENODEV;
         }
@@ -3245,7 +3278,8 @@ int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         } else if (rt2x00_rf(rt2x00dev, RF3020) ||
                    rt2x00_rf(rt2x00dev, RF2020) ||
                    rt2x00_rf(rt2x00dev, RF3021) ||
-                   rt2x00_rf(rt2x00dev, RF3022)) {
+                   rt2x00_rf(rt2x00dev, RF3022) ||
+                   rt2x00_rf(rt2x00dev, RF3320)) {
                 spec->num_channels = 14;
                 spec->channels = rf_vals_3x;
         } else if (rt2x00_rf(rt2x00dev, RF3052)) {
diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
index b2673953598..433c7f3ef83 100644
--- a/drivers/net/wireless/rt2x00/rt2800pci.c
+++ b/drivers/net/wireless/rt2x00/rt2800pci.c
@@ -84,20 +84,22 @@ static void rt2800pci_mcu_status(struct rt2x00_dev *rt2x00dev, const u8 token)
         rt2800_register_write(rt2x00dev, H2M_MAILBOX_CID, ~0);
 }
 
-#ifdef CONFIG_RT2800PCI_SOC
+#if defined(CONFIG_RALINK_RT288X) || defined(CONFIG_RALINK_RT305X)
 static void rt2800pci_read_eeprom_soc(struct rt2x00_dev *rt2x00dev)
 {
-        u32 *base_addr = (u32 *) KSEG1ADDR(0x1F040000); /* XXX for RT3052 */
+        void __iomem *base_addr = ioremap(0x1F040000, EEPROM_SIZE);
 
         memcpy_fromio(rt2x00dev->eeprom, base_addr, EEPROM_SIZE);
+
+        iounmap(base_addr);
 }
 #else
 static inline void rt2800pci_read_eeprom_soc(struct rt2x00_dev *rt2x00dev)
 {
 }
-#endif /* CONFIG_RT2800PCI_SOC */
+#endif /* CONFIG_RALINK_RT288X || CONFIG_RALINK_RT305X */
 
-#ifdef CONFIG_RT2800PCI_PCI
+#ifdef CONFIG_PCI
 static void rt2800pci_eepromregister_read(struct eeprom_93cx6 *eeprom)
 {
         struct rt2x00_dev *rt2x00dev = eeprom->data;
@@ -181,7 +183,7 @@ static inline int rt2800pci_efuse_detect(struct rt2x00_dev *rt2x00dev)
 static inline void rt2800pci_read_eeprom_efuse(struct rt2x00_dev *rt2x00dev)
 {
 }
-#endif /* CONFIG_RT2800PCI_PCI */
+#endif /* CONFIG_PCI */
 
 /*
  * Firmware functions
@@ -328,8 +330,7 @@ static void rt2800pci_toggle_rx(struct rt2x00_dev *rt2x00dev,
 
         rt2800_register_read(rt2x00dev, MAC_SYS_CTRL, &reg);
         rt2x00_set_field32(&reg, MAC_SYS_CTRL_ENABLE_RX,
-                           (state == STATE_RADIO_RX_ON) ||
-                           (state == STATE_RADIO_RX_ON_LINK));
+                           (state == STATE_RADIO_RX_ON));
         rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, reg);
 }
 
@@ -442,7 +443,7 @@ static int rt2800pci_set_state(struct rt2x00_dev *rt2x00dev,
          * if the device is booting and wasn't asleep it will return
          * failure when attempting to wakeup.
          */
-        rt2800_mcu_request(rt2x00dev, MCU_SLEEP, 0xff, 0, 2);
+        rt2800_mcu_request(rt2x00dev, MCU_SLEEP, 0xff, 0xff, 2);
 
         if (state == STATE_AWAKE) {
                 rt2800_mcu_request(rt2x00dev, MCU_WAKEUP, TOKEN_WAKUP, 0, 0);
@@ -477,9 +478,7 @@ static int rt2800pci_set_device_state(struct rt2x00_dev *rt2x00dev,
                 rt2800pci_set_state(rt2x00dev, STATE_SLEEP);
                 break;
         case STATE_RADIO_RX_ON:
-        case STATE_RADIO_RX_ON_LINK:
         case STATE_RADIO_RX_OFF:
-        case STATE_RADIO_RX_OFF_LINK:
                 rt2800pci_toggle_rx(rt2x00dev, state);
                 break;
         case STATE_RADIO_IRQ_ON:
@@ -777,7 +776,7 @@ static void rt2800pci_txstatus_interrupt(struct rt2x00_dev *rt2x00dev)
          * Since we have only one producer and one consumer we don't
          * need to lock the kfifo.
          */
-        for (i = 0; i < TX_ENTRIES; i++) {
+        for (i = 0; i < rt2x00dev->ops->tx->entry_num; i++) {
                 rt2800_register_read(rt2x00dev, TX_STA_FIFO, &status);
 
                 if (!rt2x00_get_field32(status, TX_STA_FIFO_VALID))
@@ -943,6 +942,7 @@ static const struct ieee80211_ops rt2800pci_mac80211_ops = {
         .get_tsf                = rt2800_get_tsf,
         .rfkill_poll            = rt2x00mac_rfkill_poll,
         .ampdu_action           = rt2800_ampdu_action,
+        .flush                  = rt2x00mac_flush,
 };
 
 static const struct rt2800_ops rt2800pci_rt2800_ops = {
@@ -991,21 +991,21 @@ static const struct rt2x00lib_ops rt2800pci_rt2x00_ops = {
 };
 
 static const struct data_queue_desc rt2800pci_queue_rx = {
-        .entry_num              = RX_ENTRIES,
+        .entry_num              = 128,
         .data_size              = AGGREGATION_SIZE,
         .desc_size              = RXD_DESC_SIZE,
         .priv_size              = sizeof(struct queue_entry_priv_pci),
 };
 
 static const struct data_queue_desc rt2800pci_queue_tx = {
-        .entry_num              = TX_ENTRIES,
+        .entry_num              = 64,
         .data_size              = AGGREGATION_SIZE,
         .desc_size              = TXD_DESC_SIZE,
         .priv_size              = sizeof(struct queue_entry_priv_pci),
 };
 
 static const struct data_queue_desc rt2800pci_queue_bcn = {
-        .entry_num              = 8 * BEACON_ENTRIES,
+        .entry_num              = 8,
         .data_size              = 0, /* No DMA required for beacons */
         .desc_size              = TXWI_DESC_SIZE,
         .priv_size              = sizeof(struct queue_entry_priv_pci),
@@ -1033,12 +1033,15 @@ static const struct rt2x00_ops rt2800pci_ops = {
 /*
  * RT2800pci module information.
  */
-#ifdef CONFIG_RT2800PCI_PCI
+#ifdef CONFIG_PCI
 static DEFINE_PCI_DEVICE_TABLE(rt2800pci_device_table) = {
         { PCI_DEVICE(0x1814, 0x0601), PCI_DEVICE_DATA(&rt2800pci_ops) },
         { PCI_DEVICE(0x1814, 0x0681), PCI_DEVICE_DATA(&rt2800pci_ops) },
         { PCI_DEVICE(0x1814, 0x0701), PCI_DEVICE_DATA(&rt2800pci_ops) },
         { PCI_DEVICE(0x1814, 0x0781), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1814, 0x3090), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1814, 0x3091), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1814, 0x3092), PCI_DEVICE_DATA(&rt2800pci_ops) },
         { PCI_DEVICE(0x1432, 0x7708), PCI_DEVICE_DATA(&rt2800pci_ops) },
         { PCI_DEVICE(0x1432, 0x7727), PCI_DEVICE_DATA(&rt2800pci_ops) },
         { PCI_DEVICE(0x1432, 0x7728), PCI_DEVICE_DATA(&rt2800pci_ops) },
@@ -1046,12 +1049,10 @@ static DEFINE_PCI_DEVICE_TABLE(rt2800pci_device_table) = {
         { PCI_DEVICE(0x1432, 0x7748), PCI_DEVICE_DATA(&rt2800pci_ops) },
         { PCI_DEVICE(0x1432, 0x7758), PCI_DEVICE_DATA(&rt2800pci_ops) },
         { PCI_DEVICE(0x1432, 0x7768), PCI_DEVICE_DATA(&rt2800pci_ops) },
-        { PCI_DEVICE(0x1a3b, 0x1059), PCI_DEVICE_DATA(&rt2800pci_ops) },
-#ifdef CONFIG_RT2800PCI_RT30XX
-        { PCI_DEVICE(0x1814, 0x3090), PCI_DEVICE_DATA(&rt2800pci_ops) },
-        { PCI_DEVICE(0x1814, 0x3091), PCI_DEVICE_DATA(&rt2800pci_ops) },
-        { PCI_DEVICE(0x1814, 0x3092), PCI_DEVICE_DATA(&rt2800pci_ops) },
         { PCI_DEVICE(0x1462, 0x891a), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1a3b, 0x1059), PCI_DEVICE_DATA(&rt2800pci_ops) },
+#ifdef CONFIG_RT2800PCI_RT33XX
+        { PCI_DEVICE(0x1814, 0x3390), PCI_DEVICE_DATA(&rt2800pci_ops) },
 #endif
 #ifdef CONFIG_RT2800PCI_RT35XX
         { PCI_DEVICE(0x1814, 0x3060), PCI_DEVICE_DATA(&rt2800pci_ops) },
@@ -1062,19 +1063,19 @@ static DEFINE_PCI_DEVICE_TABLE(rt2800pci_device_table) = {
 #endif
         { 0, }
 };
-#endif /* CONFIG_RT2800PCI_PCI */
+#endif /* CONFIG_PCI */
 
 MODULE_AUTHOR(DRV_PROJECT);
 MODULE_VERSION(DRV_VERSION);
 MODULE_DESCRIPTION("Ralink RT2800 PCI & PCMCIA Wireless LAN driver.");
 MODULE_SUPPORTED_DEVICE("Ralink RT2860 PCI & PCMCIA chipset based cards");
-#ifdef CONFIG_RT2800PCI_PCI
+#ifdef CONFIG_PCI
 MODULE_FIRMWARE(FIRMWARE_RT2860);
 MODULE_DEVICE_TABLE(pci, rt2800pci_device_table);
-#endif /* CONFIG_RT2800PCI_PCI */
+#endif /* CONFIG_PCI */
 MODULE_LICENSE("GPL");
 
-#ifdef CONFIG_RT2800PCI_SOC
+#if defined(CONFIG_RALINK_RT288X) || defined(CONFIG_RALINK_RT305X)
 static int rt2800soc_probe(struct platform_device *pdev)
 {
         return rt2x00soc_probe(pdev, &rt2800pci_ops);
@@ -1091,9 +1092,9 @@ static struct platform_driver rt2800soc_driver = {
         .suspend        = rt2x00soc_suspend,
         .resume         = rt2x00soc_resume,
 };
-#endif /* CONFIG_RT2800PCI_SOC */
+#endif /* CONFIG_RALINK_RT288X || CONFIG_RALINK_RT305X */
 
-#ifdef CONFIG_RT2800PCI_PCI
+#ifdef CONFIG_PCI
 static struct pci_driver rt2800pci_driver = {
         .name           = KBUILD_MODNAME,
         .id_table       = rt2800pci_device_table,
@@ -1102,21 +1103,21 @@ static struct pci_driver rt2800pci_driver = {
         .suspend        = rt2x00pci_suspend,
         .resume         = rt2x00pci_resume,
 };
-#endif /* CONFIG_RT2800PCI_PCI */
+#endif /* CONFIG_PCI */
 
 static int __init rt2800pci_init(void)
 {
         int ret = 0;
 
-#ifdef CONFIG_RT2800PCI_SOC
+#if defined(CONFIG_RALINK_RT288X) || defined(CONFIG_RALINK_RT305X)
         ret = platform_driver_register(&rt2800soc_driver);
         if (ret)
                 return ret;
 #endif
-#ifdef CONFIG_RT2800PCI_PCI
+#ifdef CONFIG_PCI
         ret = pci_register_driver(&rt2800pci_driver);
         if (ret) {
-#ifdef CONFIG_RT2800PCI_SOC
+#if defined(CONFIG_RALINK_RT288X) || defined(CONFIG_RALINK_RT305X)
                 platform_driver_unregister(&rt2800soc_driver);
 #endif
                 return ret;
@@ -1128,10 +1129,10 @@ static int __init rt2800pci_init(void)
 
 static void __exit rt2800pci_exit(void)
 {
-#ifdef CONFIG_RT2800PCI_PCI
+#ifdef CONFIG_PCI
         pci_unregister_driver(&rt2800pci_driver);
 #endif
-#ifdef CONFIG_RT2800PCI_SOC
+#if defined(CONFIG_RALINK_RT288X) || defined(CONFIG_RALINK_RT305X)
         platform_driver_unregister(&rt2800soc_driver);
 #endif
 }
diff --git a/drivers/net/wireless/rt2x00/rt2800pci.h b/drivers/net/wireless/rt2x00/rt2800pci.h
index 5a8dda9b5b5..70e050d904c 100644
--- a/drivers/net/wireless/rt2x00/rt2800pci.h
+++ b/drivers/net/wireless/rt2x00/rt2800pci.h
@@ -38,10 +38,10 @@
  * Queue register offset macros
  */
 #define TX_QUEUE_REG_OFFSET             0x10
-#define TX_BASE_PTR(__x)                TX_BASE_PTR0 + ((__x) * TX_QUEUE_REG_OFFSET)
-#define TX_MAX_CNT(__x)                 TX_MAX_CNT0 + ((__x) * TX_QUEUE_REG_OFFSET)
-#define TX_CTX_IDX(__x)                 TX_CTX_IDX0 + ((__x) * TX_QUEUE_REG_OFFSET)
-#define TX_DTX_IDX(__x)                 TX_DTX_IDX0 + ((__x) * TX_QUEUE_REG_OFFSET)
+#define TX_BASE_PTR(__x)                (TX_BASE_PTR0 + ((__x) * TX_QUEUE_REG_OFFSET))
+#define TX_MAX_CNT(__x)                 (TX_MAX_CNT0 + ((__x) * TX_QUEUE_REG_OFFSET))
+#define TX_CTX_IDX(__x)                 (TX_CTX_IDX0 + ((__x) * TX_QUEUE_REG_OFFSET))
+#define TX_DTX_IDX(__x)                 (TX_DTX_IDX0 + ((__x) * TX_QUEUE_REG_OFFSET))
 
 /*
  * 8051 firmware image.
@@ -52,8 +52,8 @@
 /*
  * DMA descriptor defines.
  */
-#define TXD_DESC_SIZE                   ( 4 * sizeof(__le32) )
-#define RXD_DESC_SIZE                   ( 4 * sizeof(__le32) )
+#define TXD_DESC_SIZE                   (4 * sizeof(__le32))
+#define RXD_DESC_SIZE                   (4 * sizeof(__le32))
 
 /*
  * TX descriptor format for TX, PRIO and Beacon Ring.
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index 3dff56ec195..935b76d3ce4 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -45,7 +45,7 @@
 /*
  * Allow hardware encryption to be disabled.
  */
-static int modparam_nohwcrypt = 0;
+static int modparam_nohwcrypt;
 module_param_named(nohwcrypt, modparam_nohwcrypt, bool, S_IRUGO);
 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
 
@@ -114,8 +114,7 @@ static void rt2800usb_toggle_rx(struct rt2x00_dev *rt2x00dev,
 
         rt2800_register_read(rt2x00dev, MAC_SYS_CTRL, &reg);
         rt2x00_set_field32(&reg, MAC_SYS_CTRL_ENABLE_RX,
-                           (state == STATE_RADIO_RX_ON) ||
-                           (state == STATE_RADIO_RX_ON_LINK));
+                           (state == STATE_RADIO_RX_ON));
         rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, reg);
 }
 
@@ -165,7 +164,8 @@ static int rt2800usb_enable_radio(struct rt2x00_dev *rt2x00dev)
          * this limit so reduce the number to prevent errors.
          */
         rt2x00_set_field32(&reg, USB_DMA_CFG_RX_BULK_AGG_LIMIT,
-                           ((RX_ENTRIES * DATA_FRAME_SIZE) / 1024) - 3);
+                           ((rt2x00dev->ops->rx->entry_num * DATA_FRAME_SIZE)
+                            / 1024) - 3);
         rt2x00_set_field32(&reg, USB_DMA_CFG_RX_BULK_EN, 1);
         rt2x00_set_field32(&reg, USB_DMA_CFG_TX_BULK_EN, 1);
         rt2800_register_write(rt2x00dev, USB_DMA_CFG, reg);
@@ -183,9 +183,9 @@ static int rt2800usb_set_state(struct rt2x00_dev *rt2x00dev,
                                enum dev_state state)
 {
         if (state == STATE_AWAKE)
-                rt2800_mcu_request(rt2x00dev, MCU_WAKEUP, 0xff, 0, 0);
+                rt2800_mcu_request(rt2x00dev, MCU_WAKEUP, 0xff, 0, 2);
         else
-                rt2800_mcu_request(rt2x00dev, MCU_SLEEP, 0xff, 0, 2);
+                rt2800_mcu_request(rt2x00dev, MCU_SLEEP, 0xff, 0xff, 2);
 
         return 0;
 }
@@ -215,9 +215,7 @@ static int rt2800usb_set_device_state(struct rt2x00_dev *rt2x00dev,
                 rt2800usb_set_state(rt2x00dev, STATE_SLEEP);
                 break;
         case STATE_RADIO_RX_ON:
-        case STATE_RADIO_RX_ON_LINK:
         case STATE_RADIO_RX_OFF:
-        case STATE_RADIO_RX_OFF_LINK:
                 rt2800usb_toggle_rx(rt2x00dev, state);
                 break;
         case STATE_RADIO_IRQ_ON:
@@ -245,6 +243,49 @@ static int rt2800usb_set_device_state(struct rt2x00_dev *rt2x00dev,
 }
 
 /*
+ * Watchdog handlers
+ */
+static void rt2800usb_watchdog(struct rt2x00_dev *rt2x00dev)
+{
+        unsigned int i;
+        u32 reg;
+
+        rt2800_register_read(rt2x00dev, TXRXQ_PCNT, &reg);
+        if (rt2x00_get_field32(reg, TXRXQ_PCNT_TX0Q)) {
+                WARNING(rt2x00dev, "TX HW queue 0 timed out,"
+                        " invoke forced kick");
+
+                rt2800_register_write(rt2x00dev, PBF_CFG, 0xf40012);
+
+                for (i = 0; i < 10; i++) {
+                        udelay(10);
+                        if (!rt2x00_get_field32(reg, TXRXQ_PCNT_TX0Q))
+                                break;
+                }
+
+                rt2800_register_write(rt2x00dev, PBF_CFG, 0xf40006);
+        }
+
+        rt2800_register_read(rt2x00dev, TXRXQ_PCNT, &reg);
+        if (rt2x00_get_field32(reg, TXRXQ_PCNT_TX1Q)) {
+                WARNING(rt2x00dev, "TX HW queue 1 timed out,"
+                        " invoke forced kick");
+
+                rt2800_register_write(rt2x00dev, PBF_CFG, 0xf4000a);
+
+                for (i = 0; i < 10; i++) {
+                        udelay(10);
+                        if (!rt2x00_get_field32(reg, TXRXQ_PCNT_TX1Q))
+                                break;
+                }
+
+                rt2800_register_write(rt2x00dev, PBF_CFG, 0xf40006);
+        }
+
+        rt2x00usb_watchdog(rt2x00dev);
+}
+
+/*
  * TX descriptor initialization
  */
 static __le32 *rt2800usb_get_txwi(struct queue_entry *entry)
@@ -266,8 +307,14 @@ static void rt2800usb_write_tx_desc(struct queue_entry *entry,
          * Initialize TXINFO descriptor
          */
         rt2x00_desc_read(txi, 0, &word);
+
+        /*
+         * The size of TXINFO_W0_USB_DMA_TX_PKT_LEN is
+         * TXWI + 802.11 header + L2 pad + payload + pad,
+         * so need to decrease size of TXINFO and USB end pad.
+         */
         rt2x00_set_field32(&word, TXINFO_W0_USB_DMA_TX_PKT_LEN,
-                           entry->skb->len - TXINFO_DESC_SIZE);
+                           entry->skb->len - TXINFO_DESC_SIZE - 4);
         rt2x00_set_field32(&word, TXINFO_W0_WIV,
                            !test_bit(ENTRY_TXD_ENCRYPT_IV, &txdesc->flags));
         rt2x00_set_field32(&word, TXINFO_W0_QSEL, 2);
@@ -285,22 +332,29 @@ static void rt2800usb_write_tx_desc(struct queue_entry *entry,
         skbdesc->desc_len = TXINFO_DESC_SIZE + TXWI_DESC_SIZE;
 }
 
-/*
- * TX data initialization
- */
-static int rt2800usb_get_tx_data_len(struct queue_entry *entry)
+static void rt2800usb_write_tx_data(struct queue_entry *entry,
+                                        struct txentry_desc *txdesc)
 {
-        int length;
+        u8 padding_len;
 
         /*
-         * The length _must_ include 4 bytes padding,
-         * it should always be multiple of 4,
-         * but it must _not_ be a multiple of the USB packet size.
+         * pad(1~3 bytes) is added after each 802.11 payload.
+         * USB end pad(4 bytes) is added at each USB bulk out packet end.
+         * TX frame format is :
+         * | TXINFO | TXWI | 802.11 header | L2 pad | payload | pad | USB end pad |
+         *                 |<------------- tx_pkt_len ------------->|
          */
-        length = roundup(entry->skb->len + 4, 4);
-        length += (4 * !(length % entry->queue->usb_maxpacket));
+        rt2800_write_tx_data(entry, txdesc);
+        padding_len = roundup(entry->skb->len + 4, 4) - entry->skb->len;
+        memset(skb_put(entry->skb, padding_len), 0, padding_len);
+}
 
-        return length;
+/*
+ * TX data initialization
+ */
+static int rt2800usb_get_tx_data_len(struct queue_entry *entry)
+{
+        return entry->skb->len;
 }
 
 /*
@@ -507,6 +561,7 @@ static const struct ieee80211_ops rt2800usb_mac80211_ops = {
         .get_tsf                = rt2800_get_tsf,
         .rfkill_poll            = rt2x00mac_rfkill_poll,
         .ampdu_action           = rt2800_ampdu_action,
+        .flush                  = rt2x00mac_flush,
 };
 
 static const struct rt2800_ops rt2800usb_rt2800_ops = {
@@ -535,9 +590,9 @@ static const struct rt2x00lib_ops rt2800usb_rt2x00_ops = {
         .link_stats             = rt2800_link_stats,
         .reset_tuner            = rt2800_reset_tuner,
         .link_tuner             = rt2800_link_tuner,
-        .watchdog               = rt2x00usb_watchdog,
+        .watchdog               = rt2800usb_watchdog,
         .write_tx_desc          = rt2800usb_write_tx_desc,
-        .write_tx_data          = rt2800_write_tx_data,
+        .write_tx_data          = rt2800usb_write_tx_data,
         .write_beacon           = rt2800_write_beacon,
         .get_tx_data_len        = rt2800usb_get_tx_data_len,
         .kick_tx_queue          = rt2x00usb_kick_tx_queue,
@@ -553,21 +608,21 @@ static const struct rt2x00lib_ops rt2800usb_rt2x00_ops = {
 };
 
 static const struct data_queue_desc rt2800usb_queue_rx = {
-        .entry_num              = RX_ENTRIES,
+        .entry_num              = 128,
         .data_size              = AGGREGATION_SIZE,
         .desc_size              = RXINFO_DESC_SIZE + RXWI_DESC_SIZE,
         .priv_size              = sizeof(struct queue_entry_priv_usb),
 };
 
 static const struct data_queue_desc rt2800usb_queue_tx = {
-        .entry_num              = TX_ENTRIES,
+        .entry_num              = 64,
         .data_size              = AGGREGATION_SIZE,
         .desc_size              = TXINFO_DESC_SIZE + TXWI_DESC_SIZE,
         .priv_size              = sizeof(struct queue_entry_priv_usb),
 };
 
 static const struct data_queue_desc rt2800usb_queue_bcn = {
-        .entry_num              = 8 * BEACON_ENTRIES,
+        .entry_num              = 8,
         .data_size              = MGMT_FRAME_SIZE,
         .desc_size              = TXINFO_DESC_SIZE + TXWI_DESC_SIZE,
         .priv_size              = sizeof(struct queue_entry_priv_usb),
@@ -599,11 +654,19 @@ static struct usb_device_id rt2800usb_device_table[] = {
         /* Abocom */
         { USB_DEVICE(0x07b8, 0x2870), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x07b8, 0x2770), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x07b8, 0x3070), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x07b8, 0x3071), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x07b8, 0x3072), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x1482, 0x3c09), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* AirTies */
+        { USB_DEVICE(0x1eda, 0x2310), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Allwin */
         { USB_DEVICE(0x8516, 0x2070), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x8516, 0x2770), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x8516, 0x2870), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x8516, 0x3070), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x8516, 0x3071), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x8516, 0x3072), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Amit */
         { USB_DEVICE(0x15c5, 0x0008), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Askey */
@@ -612,8 +675,13 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x0b05, 0x1731), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0b05, 0x1732), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0b05, 0x1742), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0b05, 0x1784), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* AzureWave */
         { USB_DEVICE(0x13d3, 0x3247), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x13d3, 0x3273), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x13d3, 0x3305), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x13d3, 0x3307), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x13d3, 0x3321), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Belkin */
         { USB_DEVICE(0x050d, 0x8053), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x050d, 0x805c), USB_DEVICE_DATA(&rt2800usb_ops) },
@@ -624,6 +692,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x14b2, 0x3c06), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x14b2, 0x3c07), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x14b2, 0x3c09), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x14b2, 0x3c12), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x14b2, 0x3c23), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x14b2, 0x3c25), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x14b2, 0x3c27), USB_DEVICE_DATA(&rt2800usb_ops) },
@@ -632,17 +701,36 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x07aa, 0x002f), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x07aa, 0x003c), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x07aa, 0x003f), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x18c5, 0x0012), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* D-Link */
         { USB_DEVICE(0x07d1, 0x3c09), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x07d1, 0x3c0a), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x07d1, 0x3c0d), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x07d1, 0x3c0e), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x07d1, 0x3c0f), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x07d1, 0x3c11), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x07d1, 0x3c16), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Draytek */
+        { USB_DEVICE(0x07fa, 0x7712), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Edimax */
+        { USB_DEVICE(0x7392, 0x7711), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x7392, 0x7717), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x7392, 0x7718), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Encore */
+        { USB_DEVICE(0x203d, 0x1480), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x203d, 0x14a9), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* EnGenius */
         { USB_DEVICE(0x1740, 0x9701), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x1740, 0x9702), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x1740, 0x9703), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x1740, 0x9705), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x1740, 0x9706), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x1740, 0x9707), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x1740, 0x9708), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x1740, 0x9709), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Gigabyte */
         { USB_DEVICE(0x1044, 0x800b), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x1044, 0x800d), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Hawking */
         { USB_DEVICE(0x0e66, 0x0001), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0e66, 0x0003), USB_DEVICE_DATA(&rt2800usb_ops) },
@@ -651,6 +739,10 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x0e66, 0x0013), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0e66, 0x0017), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0e66, 0x0018), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* I-O DATA */
+        { USB_DEVICE(0x04bb, 0x0945), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x04bb, 0x0947), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x04bb, 0x0948), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Linksys */
         { USB_DEVICE(0x1737, 0x0070), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x1737, 0x0071), USB_DEVICE_DATA(&rt2800usb_ops) },
@@ -658,17 +750,44 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x0789, 0x0162), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0789, 0x0163), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0789, 0x0164), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0789, 0x0166), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Motorola */
         { USB_DEVICE(0x100d, 0x9031), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* MSI */
+        { USB_DEVICE(0x0db0, 0x3820), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0db0, 0x3821), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0db0, 0x3822), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0db0, 0x3870), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0db0, 0x3871), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0db0, 0x6899), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0db0, 0x821a), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0db0, 0x822a), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0db0, 0x822b), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0db0, 0x822c), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0db0, 0x870a), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0db0, 0x871a), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0db0, 0x871b), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0db0, 0x871c), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0db0, 0x899a), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Para */
+        { USB_DEVICE(0x20b8, 0x8888), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Pegatron */
+        { USB_DEVICE(0x1d4d, 0x000c), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x1d4d, 0x000e), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Philips */
         { USB_DEVICE(0x0471, 0x200f), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Planex */
+        { USB_DEVICE(0x2019, 0xab25), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x2019, 0xed06), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Quanta */
+        { USB_DEVICE(0x1a32, 0x0304), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Ralink */
+        { USB_DEVICE(0x148f, 0x2070), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x148f, 0x2770), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x148f, 0x2870), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x148f, 0x3070), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x148f, 0x3071), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x148f, 0x3072), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Samsung */
         { USB_DEVICE(0x04e8, 0x2018), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Siemens */
@@ -681,13 +800,22 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x0df6, 0x0039), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0df6, 0x003b), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0df6, 0x003d), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0df6, 0x003e), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0df6, 0x003f), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0df6, 0x0040), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0df6, 0x0042), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0df6, 0x0047), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0df6, 0x0048), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* SMC */
         { USB_DEVICE(0x083a, 0x6618), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x083a, 0x7511), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x083a, 0x7512), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x083a, 0x7522), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x083a, 0x8522), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x083a, 0xa618), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x083a, 0xa701), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x083a, 0xa702), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x083a, 0xa703), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x083a, 0xb522), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Sparklan */
         { USB_DEVICE(0x15a9, 0x0006), USB_DEVICE_DATA(&rt2800usb_ops) },
@@ -701,101 +829,16 @@ static struct usb_device_id rt2800usb_device_table[] = {
         /* Zinwell */
         { USB_DEVICE(0x5a57, 0x0280), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x5a57, 0x0282), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x5a57, 0x0283), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x5a57, 0x5257), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Zyxel */
         { USB_DEVICE(0x0586, 0x3416), USB_DEVICE_DATA(&rt2800usb_ops) },
-#ifdef CONFIG_RT2800USB_RT30XX
-        /* Abocom */
-        { USB_DEVICE(0x07b8, 0x3070), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x07b8, 0x3071), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x07b8, 0x3072), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* AirTies */
-        { USB_DEVICE(0x1eda, 0x2310), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* Allwin */
-        { USB_DEVICE(0x8516, 0x3070), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x8516, 0x3071), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x8516, 0x3072), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* ASUS */
-        { USB_DEVICE(0x0b05, 0x1784), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* AzureWave */
-        { USB_DEVICE(0x13d3, 0x3273), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x13d3, 0x3305), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x13d3, 0x3307), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x13d3, 0x3321), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* Conceptronic */
-        { USB_DEVICE(0x14b2, 0x3c12), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* Corega */
-        { USB_DEVICE(0x18c5, 0x0012), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* D-Link */
-        { USB_DEVICE(0x07d1, 0x3c0a), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x07d1, 0x3c0d), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x07d1, 0x3c0e), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x07d1, 0x3c0f), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x07d1, 0x3c16), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* Draytek */
-        { USB_DEVICE(0x07fa, 0x7712), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* Edimax */
-        { USB_DEVICE(0x7392, 0x7711), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* Encore */
-        { USB_DEVICE(0x203d, 0x1480), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x203d, 0x14a9), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* EnGenius */
-        { USB_DEVICE(0x1740, 0x9703), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x1740, 0x9705), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x1740, 0x9706), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x1740, 0x9707), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x1740, 0x9708), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x1740, 0x9709), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* Gigabyte */
-        { USB_DEVICE(0x1044, 0x800d), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* I-O DATA */
-        { USB_DEVICE(0x04bb, 0x0945), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x04bb, 0x0947), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x04bb, 0x0948), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* Logitec */
-        { USB_DEVICE(0x0789, 0x0166), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* MSI */
-        { USB_DEVICE(0x0db0, 0x3820), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0db0, 0x3821), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0db0, 0x3822), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0db0, 0x3870), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0db0, 0x3871), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0db0, 0x821a), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0db0, 0x822a), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0db0, 0x822b), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0db0, 0x822c), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0db0, 0x870a), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0db0, 0x871a), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0db0, 0x871b), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0db0, 0x871c), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0db0, 0x899a), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* Para */
-        { USB_DEVICE(0x20b8, 0x8888), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* Pegatron */
-        { USB_DEVICE(0x1d4d, 0x000c), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x1d4d, 0x000e), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* Planex */
-        { USB_DEVICE(0x2019, 0xab25), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* Quanta */
-        { USB_DEVICE(0x1a32, 0x0304), USB_DEVICE_DATA(&rt2800usb_ops) },
+#ifdef CONFIG_RT2800USB_RT33XX
         /* Ralink */
-        { USB_DEVICE(0x148f, 0x2070), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x148f, 0x3070), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x148f, 0x3071), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x148f, 0x3072), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x148f, 0x3370), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x148f, 0x8070), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Sitecom */
-        { USB_DEVICE(0x0df6, 0x003e), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0df6, 0x0040), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0df6, 0x0042), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0df6, 0x0047), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0df6, 0x0048), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* SMC */
-        { USB_DEVICE(0x083a, 0x7511), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x083a, 0xa701), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x083a, 0xa702), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x083a, 0xa703), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* Zinwell */
-        { USB_DEVICE(0x5a57, 0x0283), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x5a57, 0x5257), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0df6, 0x0050), USB_DEVICE_DATA(&rt2800usb_ops) },
 #endif
 #ifdef CONFIG_RT2800USB_RT35XX
         /* Allwin */
@@ -809,12 +852,9 @@ static struct usb_device_id rt2800usb_device_table[] = {
         /* I-O DATA */
         { USB_DEVICE(0x04bb, 0x0944), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Ralink */
-        { USB_DEVICE(0x148f, 0x3370), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x148f, 0x3572), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x148f, 0x8070), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Sitecom */
         { USB_DEVICE(0x0df6, 0x0041), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0df6, 0x0050), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Zinwell */
         { USB_DEVICE(0x5a57, 0x0284), USB_DEVICE_DATA(&rt2800usb_ops) },
 #endif
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.h b/drivers/net/wireless/rt2x00/rt2800usb.h
index 0722badccf8..671ea359261 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.h
+++ b/drivers/net/wireless/rt2x00/rt2800usb.h
@@ -40,8 +40,8 @@
 /*
  * DMA descriptor defines.
  */
-#define TXINFO_DESC_SIZE                ( 1 * sizeof(__le32) )
-#define RXINFO_DESC_SIZE                ( 1 * sizeof(__le32) )
+#define TXINFO_DESC_SIZE                (1 * sizeof(__le32))
+#define RXINFO_DESC_SIZE                (1 * sizeof(__le32))
 
 /*
  * TX Info structure
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index 94fe589acfa..0a55eeff871 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -915,7 +915,7 @@ struct rt2x00_dev {
  * in those cases REGISTER_BUSY_COUNT attempts should be
  * taken with a REGISTER_BUSY_DELAY interval.
  */
-#define REGISTER_BUSY_COUNT     5
+#define REGISTER_BUSY_COUNT     100
 #define REGISTER_BUSY_DELAY     100
 
 /*
@@ -1133,6 +1133,7 @@ void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw,
 int rt2x00mac_conf_tx(struct ieee80211_hw *hw, u16 queue,
                       const struct ieee80211_tx_queue_params *params);
 void rt2x00mac_rfkill_poll(struct ieee80211_hw *hw);
+void rt2x00mac_flush(struct ieee80211_hw *hw, bool drop);
 
 /*
  * Driver allocation handlers.
diff --git a/drivers/net/wireless/rt2x00/rt2x00config.c b/drivers/net/wireless/rt2x00/rt2x00config.c
index 54ffb5aeb34..a238e908c85 100644
--- a/drivers/net/wireless/rt2x00/rt2x00config.c
+++ b/drivers/net/wireless/rt2x00/rt2x00config.c
@@ -133,7 +133,7 @@ void rt2x00lib_config_antenna(struct rt2x00_dev *rt2x00dev,
          */
         if (!(ant->flags & ANTENNA_RX_DIVERSITY))
                 config.rx = rt2x00lib_config_antenna_check(config.rx, def->rx);
-        else if(config.rx == ANTENNA_SW_DIVERSITY)
+        else if (config.rx == ANTENNA_SW_DIVERSITY)
                 config.rx = active->rx;
 
         if (!(ant->flags & ANTENNA_TX_DIVERSITY))
@@ -146,7 +146,8 @@ void rt2x00lib_config_antenna(struct rt2x00_dev *rt2x00dev,
          * else the changes will be ignored by the device.
          */
         if (test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
-                rt2x00lib_toggle_rx(rt2x00dev, STATE_RADIO_RX_OFF_LINK);
+                rt2x00dev->ops->lib->set_device_state(rt2x00dev,
+                                                      STATE_RADIO_RX_OFF);
 
         /*
          * Write new antenna setup to device and reset the link tuner.
@@ -160,7 +161,8 @@ void rt2x00lib_config_antenna(struct rt2x00_dev *rt2x00dev,
         memcpy(active, &config, sizeof(config));
 
         if (test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
-                rt2x00lib_toggle_rx(rt2x00dev, STATE_RADIO_RX_ON_LINK);
+                rt2x00dev->ops->lib->set_device_state(rt2x00dev,
+                                                      STATE_RADIO_RX_ON);
 }
 
 void rt2x00lib_config(struct rt2x00_dev *rt2x00dev,
diff --git a/drivers/net/wireless/rt2x00/rt2x00debug.c b/drivers/net/wireless/rt2x00/rt2x00debug.c
index fcdb6b0dc40..64dfb1f6823 100644
--- a/drivers/net/wireless/rt2x00/rt2x00debug.c
+++ b/drivers/net/wireless/rt2x00/rt2x00debug.c
@@ -162,11 +162,11 @@ void rt2x00debug_dump_frame(struct rt2x00_dev *rt2x00dev,
         struct timeval timestamp;
         u32 data_len;
 
-        do_gettimeofday(&timestamp);
-
-        if (!test_bit(FRAME_DUMP_FILE_OPEN, &intf->frame_dump_flags))
+        if (likely(!test_bit(FRAME_DUMP_FILE_OPEN, &intf->frame_dump_flags)))
                 return;
 
+        do_gettimeofday(&timestamp);
+
         if (skb_queue_len(&intf->frame_dump_skbqueue) > 20) {
                 DEBUG(rt2x00dev, "txrx dump queue length exceeded.\n");
                 return;
@@ -342,7 +342,7 @@ static ssize_t rt2x00debug_read_queue_stats(struct file *file,
             sprintf(data, "qid\tcount\tlimit\tlength\tindex\tdma done\tdone\n");
 
         queue_for_each(intf->rt2x00dev, queue) {
-                spin_lock_irqsave(&queue->lock, irqflags);
+                spin_lock_irqsave(&queue->index_lock, irqflags);
 
                 temp += sprintf(temp, "%d\t%d\t%d\t%d\t%d\t%d\t%d\n", queue->qid,
                                 queue->count, queue->limit, queue->length,
@@ -350,7 +350,7 @@ static ssize_t rt2x00debug_read_queue_stats(struct file *file,
                                 queue->index[Q_INDEX_DMA_DONE],
                                 queue->index[Q_INDEX_DONE]);
 
-                spin_unlock_irqrestore(&queue->lock, irqflags);
+                spin_unlock_irqrestore(&queue->index_lock, irqflags);
         }
 
         size = strlen(data);
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 5ba79b935f0..c879f9a7037 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -68,7 +68,8 @@ int rt2x00lib_enable_radio(struct rt2x00_dev *rt2x00dev)
         /*
          * Enable RX.
          */
-        rt2x00lib_toggle_rx(rt2x00dev, STATE_RADIO_RX_ON);
+        rt2x00dev->ops->lib->set_device_state(rt2x00dev, STATE_RADIO_RX_ON);
+        rt2x00link_start_tuner(rt2x00dev);
 
         /*
          * Start watchdog monitoring.
@@ -102,7 +103,8 @@ void rt2x00lib_disable_radio(struct rt2x00_dev *rt2x00dev)
         /*
          * Disable RX.
          */
-        rt2x00lib_toggle_rx(rt2x00dev, STATE_RADIO_RX_OFF);
+        rt2x00link_stop_tuner(rt2x00dev);
+        rt2x00dev->ops->lib->set_device_state(rt2x00dev, STATE_RADIO_RX_OFF);
 
         /*
          * Disable radio.
@@ -113,23 +115,6 @@ void rt2x00lib_disable_radio(struct rt2x00_dev *rt2x00dev)
         rt2x00leds_led_radio(rt2x00dev, false);
 }
 
-void rt2x00lib_toggle_rx(struct rt2x00_dev *rt2x00dev, enum dev_state state)
-{
-        /*
-         * When we are disabling the RX, we should also stop the link tuner.
-         */
-        if (state == STATE_RADIO_RX_OFF)
-                rt2x00link_stop_tuner(rt2x00dev);
-
-        rt2x00dev->ops->lib->set_device_state(rt2x00dev, state);
-
-        /*
-         * When we are enabling the RX, we should also start the link tuner.
-         */
-        if (state == STATE_RADIO_RX_ON)
-                rt2x00link_start_tuner(rt2x00dev);
-}
-
 static void rt2x00lib_intf_scheduled_iter(void *data, u8 *mac,
                                           struct ieee80211_vif *vif)
 {
@@ -265,10 +250,9 @@ void rt2x00lib_txdone(struct queue_entry *entry,
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(entry->skb);
         struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
         enum data_queue_qid qid = skb_get_queue_mapping(entry->skb);
-        unsigned int header_length = ieee80211_get_hdrlen_from_skb(entry->skb);
+        unsigned int header_length, i;
         u8 rate_idx, rate_flags, retry_rates;
         u8 skbdesc_flags = skbdesc->flags;
-        unsigned int i;
         bool success;
 
         /*
@@ -287,6 +271,11 @@ void rt2x00lib_txdone(struct queue_entry *entry,
         skbdesc->flags &= ~SKBDESC_DESC_IN_SKB;
 
         /*
+         * Determine the length of 802.11 header.
+         */
+        header_length = ieee80211_get_hdrlen_from_skb(entry->skb);
+
+        /*
          * Remove L2 padding which was added during
          */
         if (test_bit(DRIVER_REQUIRE_L2PAD, &rt2x00dev->flags))
@@ -483,6 +472,10 @@ void rt2x00lib_rxdone(struct queue_entry *entry)
         unsigned int header_length;
         int rate_idx;
 
+        if (!test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags) ||
+            !test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
+                goto submit_entry;
+
         if (test_bit(ENTRY_DATA_IO_FAILED, &entry->flags))
                 goto submit_entry;
 
@@ -567,9 +560,13 @@ void rt2x00lib_rxdone(struct queue_entry *entry)
         entry->skb = skb;
 
 submit_entry:
-        rt2x00dev->ops->lib->clear_entry(entry);
-        rt2x00queue_index_inc(entry->queue, Q_INDEX);
+        entry->flags = 0;
         rt2x00queue_index_inc(entry->queue, Q_INDEX_DONE);
+        if (test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags) &&
+            test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags)) {
+                rt2x00dev->ops->lib->clear_entry(entry);
+                rt2x00queue_index_inc(entry->queue, Q_INDEX);
+        }
 }
 EXPORT_SYMBOL_GPL(rt2x00lib_rxdone);
 
@@ -678,7 +675,7 @@ static void rt2x00lib_rate(struct ieee80211_rate *entry,
 {
         entry->flags = 0;
         entry->bitrate = rate->bitrate;
-        entry->hw_value =index;
+        entry->hw_value = index;
         entry->hw_value_short = index;
 
         if (rate->flags & DEV_RATE_SHORT_PREAMBLE)
diff --git a/drivers/net/wireless/rt2x00/rt2x00lib.h b/drivers/net/wireless/rt2x00/rt2x00lib.h
index 619da23b7b5..2cf68f82674 100644
--- a/drivers/net/wireless/rt2x00/rt2x00lib.h
+++ b/drivers/net/wireless/rt2x00/rt2x00lib.h
@@ -57,7 +57,7 @@ static inline const struct rt2x00_rate *rt2x00_get_rate(const u16 hw_value)
 }
 
 #define RATE_MCS(__mode, __mcs) \
-        ( (((__mode) & 0x00ff) << 8) | ((__mcs) & 0x00ff) )
+        ((((__mode) & 0x00ff) << 8) | ((__mcs) & 0x00ff))
 
 static inline int rt2x00_get_rate_mcs(const u16 mcs_value)
 {
@@ -69,7 +69,6 @@ static inline int rt2x00_get_rate_mcs(const u16 mcs_value)
  */
 int rt2x00lib_enable_radio(struct rt2x00_dev *rt2x00dev);
 void rt2x00lib_disable_radio(struct rt2x00_dev *rt2x00dev);
-void rt2x00lib_toggle_rx(struct rt2x00_dev *rt2x00dev, enum dev_state state);
 
 /*
  * Initialization handlers.
diff --git a/drivers/net/wireless/rt2x00/rt2x00link.c b/drivers/net/wireless/rt2x00/rt2x00link.c
index b971d8798eb..bfda60eaf4e 100644
--- a/drivers/net/wireless/rt2x00/rt2x00link.c
+++ b/drivers/net/wireless/rt2x00/rt2x00link.c
@@ -67,7 +67,7 @@
             (__avg).avg_weight  ? \
                 ((((__avg).avg_weight * ((AVG_SAMPLES) - 1)) + \
                   ((__val) * (AVG_FACTOR))) / \
-                 (AVG_SAMPLES) ) : \
+                 (AVG_SAMPLES)) : \
                 ((__val) * (AVG_FACTOR)); \
         __new.avg = __new.avg_weight / (AVG_FACTOR); \
         __new; \
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index c3c206a97d5..829bf4be9bc 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -283,14 +283,8 @@ int rt2x00mac_add_interface(struct ieee80211_hw *hw,
          * invalid behavior in the device.
          */
         memcpy(&intf->mac, vif->addr, ETH_ALEN);
-        if (vif->type == NL80211_IFTYPE_AP) {
-                memcpy(&intf->bssid, vif->addr, ETH_ALEN);
-                rt2x00lib_config_intf(rt2x00dev, intf, vif->type,
-                                      intf->mac, intf->bssid);
-        } else {
-                rt2x00lib_config_intf(rt2x00dev, intf, vif->type,
-                                      intf->mac, NULL);
-        }
+        rt2x00lib_config_intf(rt2x00dev, intf, vif->type,
+                              intf->mac, NULL);
 
         /*
          * Some filters depend on the current working mode. We can force
@@ -358,7 +352,7 @@ int rt2x00mac_config(struct ieee80211_hw *hw, u32 changed)
          * if for any reason the link tuner must be reset, this will be
          * handled by rt2x00lib_config().
          */
-        rt2x00lib_toggle_rx(rt2x00dev, STATE_RADIO_RX_OFF_LINK);
+        rt2x00dev->ops->lib->set_device_state(rt2x00dev, STATE_RADIO_RX_OFF);
 
         /*
          * When we've just turned on the radio, we want to reprogram
@@ -376,7 +370,7 @@ int rt2x00mac_config(struct ieee80211_hw *hw, u32 changed)
         rt2x00lib_config_antenna(rt2x00dev, rt2x00dev->default_ant);
 
         /* Turn RX back on */
-        rt2x00lib_toggle_rx(rt2x00dev, STATE_RADIO_RX_ON_LINK);
+        rt2x00dev->ops->lib->set_device_state(rt2x00dev, STATE_RADIO_RX_ON);
 
         return 0;
 }
@@ -719,3 +713,41 @@ void rt2x00mac_rfkill_poll(struct ieee80211_hw *hw)
         wiphy_rfkill_set_hw_state(hw->wiphy, !active);
 }
 EXPORT_SYMBOL_GPL(rt2x00mac_rfkill_poll);
+
+void rt2x00mac_flush(struct ieee80211_hw *hw, bool drop)
+{
+        struct rt2x00_dev *rt2x00dev = hw->priv;
+        struct data_queue *queue;
+        unsigned int i = 0;
+
+        ieee80211_stop_queues(hw);
+
+        /*
+         * Run over all queues to kick them, this will force
+         * any pending frames to be transmitted.
+         */
+        tx_queue_for_each(rt2x00dev, queue) {
+                rt2x00dev->ops->lib->kick_tx_queue(queue);
+        }
+
+        /**
+         * All queues have been kicked, now wait for each queue
+         * to become empty. With a bit of luck, we only have to wait
+         * for the first queue to become empty, because while waiting
+         * for the that queue, the other queues will have transmitted
+         * all their frames as well (since they were already kicked).
+         */
+        tx_queue_for_each(rt2x00dev, queue) {
+                for (i = 0; i < 10; i++) {
+                        if (rt2x00queue_empty(queue))
+                                break;
+                        msleep(100);
+                }
+
+                if (!rt2x00queue_empty(queue))
+                        WARNING(rt2x00dev, "Failed to flush queue %d", queue->qid);
+        }
+
+        ieee80211_wake_queues(hw);
+}
+EXPORT_SYMBOL_GPL(rt2x00mac_flush);
diff --git a/drivers/net/wireless/rt2x00/rt2x00pci.c b/drivers/net/wireless/rt2x00/rt2x00pci.c
index 2449d785cf8..868ca19b13e 100644
--- a/drivers/net/wireless/rt2x00/rt2x00pci.c
+++ b/drivers/net/wireless/rt2x00/rt2x00pci.c
@@ -105,7 +105,7 @@ static int rt2x00pci_alloc_queue_dma(struct rt2x00_dev *rt2x00dev,
          */
         addr = dma_alloc_coherent(rt2x00dev->dev,
                                   queue->limit * queue->desc_size,
-                                  &dma, GFP_KERNEL | GFP_DMA);
+                                  &dma, GFP_KERNEL);
         if (!addr)
                 return -ENOMEM;
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index e360d287def..a3d79c7a21c 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -204,8 +204,10 @@ void rt2x00queue_remove_l2pad(struct sk_buff *skb, unsigned int header_length)
         if (!l2pad)
                 return;
 
-        memmove(skb->data + l2pad, skb->data, header_length);
-        skb_pull(skb, l2pad);
+        memmove(skb->data + header_length, skb->data + header_length + l2pad,
+                                skb->len - header_length - l2pad);
+
+        skb_trim(skb, skb->len - l2pad);
 }
 
 static void rt2x00queue_create_tx_descriptor_seq(struct queue_entry *entry,
@@ -311,14 +313,6 @@ static void rt2x00queue_create_tx_descriptor(struct queue_entry *entry,
         memset(txdesc, 0, sizeof(*txdesc));
 
         /*
-         * Initialize information from queue
-         */
-        txdesc->qid = entry->queue->qid;
-        txdesc->cw_min = entry->queue->cw_min;
-        txdesc->cw_max = entry->queue->cw_max;
-        txdesc->aifs = entry->queue->aifs;
-
-        /*
          * Header and frame information.
          */
         txdesc->length = entry->skb->len;
@@ -460,12 +454,9 @@ static void rt2x00queue_write_tx_descriptor(struct queue_entry *entry,
         rt2x00debug_dump_frame(queue->rt2x00dev, DUMP_FRAME_TX, entry->skb);
 }
 
-static void rt2x00queue_kick_tx_queue(struct queue_entry *entry,
+static void rt2x00queue_kick_tx_queue(struct data_queue *queue,
                                       struct txentry_desc *txdesc)
 {
-        struct data_queue *queue = entry->queue;
-        struct rt2x00_dev *rt2x00dev = queue->rt2x00dev;
-
         /*
          * Check if we need to kick the queue, there are however a few rules
          *      1) Don't kick unless this is the last in frame in a burst.
@@ -477,7 +468,7 @@ static void rt2x00queue_kick_tx_queue(struct queue_entry *entry,
          */
         if (rt2x00queue_threshold(queue) ||
             !test_bit(ENTRY_TXD_BURST, &txdesc->flags))
-                rt2x00dev->ops->lib->kick_tx_queue(queue);
+                queue->rt2x00dev->ops->lib->kick_tx_queue(queue);
 }
 
 int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb,
@@ -567,7 +558,7 @@ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb,
 
         rt2x00queue_index_inc(queue, Q_INDEX);
         rt2x00queue_write_tx_descriptor(entry, &txdesc);
-        rt2x00queue_kick_tx_queue(entry, &txdesc);
+        rt2x00queue_kick_tx_queue(queue, &txdesc);
 
         return 0;
 }
@@ -649,10 +640,10 @@ void rt2x00queue_for_each_entry(struct data_queue *queue,
          * it should not be kicked during this run, since it
          * is part of another TX operation.
          */
-        spin_lock_irqsave(&queue->lock, irqflags);
+        spin_lock_irqsave(&queue->index_lock, irqflags);
         index_start = queue->index[start];
         index_end = queue->index[end];
-        spin_unlock_irqrestore(&queue->lock, irqflags);
+        spin_unlock_irqrestore(&queue->index_lock, irqflags);
 
         /*
          * Start from the TX done pointer, this guarentees that we will
@@ -706,11 +697,11 @@ struct queue_entry *rt2x00queue_get_entry(struct data_queue *queue,
                 return NULL;
         }
 
-        spin_lock_irqsave(&queue->lock, irqflags);
+        spin_lock_irqsave(&queue->index_lock, irqflags);
 
         entry = &queue->entries[queue->index[index]];
 
-        spin_unlock_irqrestore(&queue->lock, irqflags);
+        spin_unlock_irqrestore(&queue->index_lock, irqflags);
 
         return entry;
 }
@@ -726,7 +717,7 @@ void rt2x00queue_index_inc(struct data_queue *queue, enum queue_index index)
                 return;
         }
 
-        spin_lock_irqsave(&queue->lock, irqflags);
+        spin_lock_irqsave(&queue->index_lock, irqflags);
 
         queue->index[index]++;
         if (queue->index[index] >= queue->limit)
@@ -741,7 +732,7 @@ void rt2x00queue_index_inc(struct data_queue *queue, enum queue_index index)
                 queue->count++;
         }
 
-        spin_unlock_irqrestore(&queue->lock, irqflags);
+        spin_unlock_irqrestore(&queue->index_lock, irqflags);
 }
 
 static void rt2x00queue_reset(struct data_queue *queue)
@@ -749,7 +740,7 @@ static void rt2x00queue_reset(struct data_queue *queue)
         unsigned long irqflags;
         unsigned int i;
 
-        spin_lock_irqsave(&queue->lock, irqflags);
+        spin_lock_irqsave(&queue->index_lock, irqflags);
 
         queue->count = 0;
         queue->length = 0;
@@ -759,7 +750,7 @@ static void rt2x00queue_reset(struct data_queue *queue)
                 queue->last_action[i] = jiffies;
         }
 
-        spin_unlock_irqrestore(&queue->lock, irqflags);
+        spin_unlock_irqrestore(&queue->index_lock, irqflags);
 }
 
 void rt2x00queue_stop_queues(struct rt2x00_dev *rt2x00dev)
@@ -809,8 +800,8 @@ static int rt2x00queue_alloc_entries(struct data_queue *queue,
                 return -ENOMEM;
 
 #define QUEUE_ENTRY_PRIV_OFFSET(__base, __index, __limit, __esize, __psize) \
-        ( ((char *)(__base)) + ((__limit) * (__esize)) + \
-            ((__index) * (__psize)) )
+        (((char *)(__base)) + ((__limit) * (__esize)) + \
+            ((__index) * (__psize)))
 
         for (i = 0; i < queue->limit; i++) {
                 entries[i].flags = 0;
@@ -911,7 +902,7 @@ void rt2x00queue_uninitialize(struct rt2x00_dev *rt2x00dev)
 static void rt2x00queue_init(struct rt2x00_dev *rt2x00dev,
                              struct data_queue *queue, enum data_queue_qid qid)
 {
-        spin_lock_init(&queue->lock);
+        spin_lock_init(&queue->index_lock);
 
         queue->rt2x00dev = rt2x00dev;
         queue->qid = qid;
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.h b/drivers/net/wireless/rt2x00/rt2x00queue.h
index d81d85f3486..29b051ac640 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.h
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.h
@@ -43,22 +43,6 @@
 #define AGGREGATION_SIZE        3840
 
 /**
- * DOC: Number of entries per queue
- *
- * Under normal load without fragmentation, 12 entries are sufficient
- * without the queue being filled up to the maximum. When using fragmentation
- * and the queue threshold code, we need to add some additional margins to
- * make sure the queue will never (or only under extreme load) fill up
- * completely.
- * Since we don't use preallocated DMA, having a large number of queue entries
- * will have minimal impact on the memory requirements for the queue.
- */
-#define RX_ENTRIES      24
-#define TX_ENTRIES      24
-#define BEACON_ENTRIES  1
-#define ATIM_ENTRIES    8
-
-/**
  * enum data_queue_qid: Queue identification
  *
  * @QID_AC_BE: AC BE queue
@@ -296,7 +280,6 @@ enum txentry_desc_flags {
  * Summary of information for the frame descriptor before sending a TX frame.
  *
  * @flags: Descriptor flags (See &enum queue_entry_flags).
- * @qid: Queue identification (See &enum data_queue_qid).
  * @length: Length of the entire frame.
  * @header_length: Length of 802.11 header.
  * @length_high: PLCP length high word.
@@ -309,11 +292,8 @@ enum txentry_desc_flags {
  * @rate_mode: Rate mode (See @enum rate_modulation).
  * @mpdu_density: MDPU density.
  * @retry_limit: Max number of retries.
- * @aifs: AIFS value.
  * @ifs: IFS value.
  * @txop: IFS value for 11n capable chips.
- * @cw_min: cwmin value.
- * @cw_max: cwmax value.
  * @cipher: Cipher type used for encryption.
  * @key_idx: Key index used for encryption.
  * @iv_offset: Position where IV should be inserted by hardware.
@@ -322,8 +302,6 @@ enum txentry_desc_flags {
 struct txentry_desc {
         unsigned long flags;
 
-        enum data_queue_qid qid;
-
         u16 length;
         u16 header_length;
 
@@ -339,11 +317,8 @@ struct txentry_desc {
         u16 mpdu_density;
 
         short retry_limit;
-        short aifs;
         short ifs;
         short txop;
-        short cw_min;
-        short cw_max;
 
         enum cipher cipher;
         u16 key_idx;
@@ -423,7 +398,7 @@ enum queue_index {
  * @entries: Base address of the &struct queue_entry which are
  *      part of this queue.
  * @qid: The queue identification, see &enum data_queue_qid.
- * @lock: Spinlock to protect index handling. Whenever @index, @index_done or
+ * @index_lock: Spinlock to protect index handling. Whenever @index, @index_done or
  *      @index_crypt needs to be changed this lock should be grabbed to prevent
  *      index corruption due to concurrency.
  * @count: Number of frames handled in the queue.
@@ -447,7 +422,7 @@ struct data_queue {
 
         enum data_queue_qid qid;
 
-        spinlock_t lock;
+        spinlock_t index_lock;
         unsigned int count;
         unsigned short limit;
         unsigned short threshold;
@@ -618,10 +593,10 @@ static inline int rt2x00queue_threshold(struct data_queue *queue)
 }
 
 /**
- * rt2x00queue_timeout - Check if a timeout occured for STATUS reorts
+ * rt2x00queue_status_timeout - Check if a timeout occured for STATUS reports
  * @queue: Queue to check.
  */
-static inline int rt2x00queue_timeout(struct data_queue *queue)
+static inline int rt2x00queue_status_timeout(struct data_queue *queue)
 {
         return time_after(queue->last_action[Q_INDEX_DMA_DONE],
                           queue->last_action[Q_INDEX_DONE] + (HZ / 10));
diff --git a/drivers/net/wireless/rt2x00/rt2x00reg.h b/drivers/net/wireless/rt2x00/rt2x00reg.h
index cef94621cef..ed71be95136 100644
--- a/drivers/net/wireless/rt2x00/rt2x00reg.h
+++ b/drivers/net/wireless/rt2x00/rt2x00reg.h
@@ -85,8 +85,6 @@ enum dev_state {
         STATE_RADIO_OFF,
         STATE_RADIO_RX_ON,
         STATE_RADIO_RX_OFF,
-        STATE_RADIO_RX_ON_LINK,
-        STATE_RADIO_RX_OFF_LINK,
         STATE_RADIO_IRQ_ON,
         STATE_RADIO_IRQ_OFF,
         STATE_RADIO_IRQ_ON_ISR,
diff --git a/drivers/net/wireless/rt2x00/rt2x00soc.c b/drivers/net/wireless/rt2x00/rt2x00soc.c
index fc98063de71..2aa5c38022f 100644
--- a/drivers/net/wireless/rt2x00/rt2x00soc.c
+++ b/drivers/net/wireless/rt2x00/rt2x00soc.c
@@ -40,6 +40,8 @@ static void rt2x00soc_free_reg(struct rt2x00_dev *rt2x00dev)
 
         kfree(rt2x00dev->eeprom);
         rt2x00dev->eeprom = NULL;
+
+        iounmap(rt2x00dev->csr.base);
 }
 
 static int rt2x00soc_alloc_reg(struct rt2x00_dev *rt2x00dev)
@@ -51,9 +53,9 @@ static int rt2x00soc_alloc_reg(struct rt2x00_dev *rt2x00dev)
         if (!res)
                 return -ENODEV;
 
-        rt2x00dev->csr.base = (void __iomem *)KSEG1ADDR(res->start);
+        rt2x00dev->csr.base = ioremap(res->start, resource_size(res));
         if (!rt2x00dev->csr.base)
-                goto exit;
+                return -ENOMEM;
 
         rt2x00dev->eeprom = kzalloc(rt2x00dev->ops->eeprom_size, GFP_KERNEL);
         if (!rt2x00dev->eeprom)
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index b3317df7a7d..9ac14598e2a 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -226,9 +226,7 @@ static void rt2x00usb_interrupt_txdone(struct urb *urb)
          * Schedule the delayed work for reading the TX status
          * from the device.
          */
-        if (test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags) &&
-            test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
-                ieee80211_queue_work(rt2x00dev->hw, &rt2x00dev->txdone_work);
+        ieee80211_queue_work(rt2x00dev->hw, &rt2x00dev->txdone_work);
 }
 
 static void rt2x00usb_kick_tx_entry(struct queue_entry *entry)
@@ -323,21 +321,6 @@ static void rt2x00usb_watchdog_tx_dma(struct data_queue *queue)
         rt2x00dev->txdone_work.func(&rt2x00dev->txdone_work);
 
         /*
-         * Security measure: if the driver did override the
-         * txdone_work function, and the hardware did arrive
-         * in a state which causes it to malfunction, it is
-         * possible that the driver couldn't handle the txdone
-         * event correctly. So after giving the driver the
-         * chance to cleanup, we now force a cleanup of any
-         * leftovers.
-         */
-        if (!rt2x00queue_empty(queue)) {
-                WARNING(queue->rt2x00dev, "TX queue %d DMA timed out,"
-                        " status handling failed, invoke hard reset", queue->qid);
-                rt2x00usb_work_txdone(&rt2x00dev->txdone_work);
-        }
-
-        /*
          * The queue has been reset, and mac80211 is allowed to use the
          * queue again.
          */
@@ -361,7 +344,7 @@ void rt2x00usb_watchdog(struct rt2x00_dev *rt2x00dev)
                 if (!rt2x00queue_empty(queue)) {
                         if (rt2x00queue_dma_timeout(queue))
                                 rt2x00usb_watchdog_tx_dma(queue);
-                        if (rt2x00queue_timeout(queue))
+                        if (rt2x00queue_status_timeout(queue))
                                 rt2x00usb_watchdog_tx_status(queue);
                 }
         }
@@ -424,9 +407,7 @@ static void rt2x00usb_interrupt_rxdone(struct urb *urb)
          * Schedule the delayed work for reading the RX status
          * from the device.
          */
-        if (test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags) &&
-            test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
-                ieee80211_queue_work(rt2x00dev->hw, &rt2x00dev->rxdone_work);
+        ieee80211_queue_work(rt2x00dev->hw, &rt2x00dev->rxdone_work);
 }
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index af548c87f10..6b09b01f634 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -1623,8 +1623,7 @@ static void rt61pci_toggle_rx(struct rt2x00_dev *rt2x00dev,
 
         rt2x00pci_register_read(rt2x00dev, TXRX_CSR0, &reg);
         rt2x00_set_field32(&reg, TXRX_CSR0_DISABLE_RX,
-                           (state == STATE_RADIO_RX_OFF) ||
-                           (state == STATE_RADIO_RX_OFF_LINK));
+                           (state == STATE_RADIO_RX_OFF));
         rt2x00pci_register_write(rt2x00dev, TXRX_CSR0, reg);
 }
 
@@ -1745,9 +1744,7 @@ static int rt61pci_set_device_state(struct rt2x00_dev *rt2x00dev,
                 rt61pci_disable_radio(rt2x00dev);
                 break;
         case STATE_RADIO_RX_ON:
-        case STATE_RADIO_RX_ON_LINK:
         case STATE_RADIO_RX_OFF:
-        case STATE_RADIO_RX_OFF_LINK:
                 rt61pci_toggle_rx(rt2x00dev, state);
                 break;
         case STATE_RADIO_IRQ_ON:
@@ -1789,10 +1786,10 @@ static void rt61pci_write_tx_desc(struct queue_entry *entry,
          * Start writing the descriptor words.
          */
         rt2x00_desc_read(txd, 1, &word);
-        rt2x00_set_field32(&word, TXD_W1_HOST_Q_ID, txdesc->qid);
-        rt2x00_set_field32(&word, TXD_W1_AIFSN, txdesc->aifs);
-        rt2x00_set_field32(&word, TXD_W1_CWMIN, txdesc->cw_min);
-        rt2x00_set_field32(&word, TXD_W1_CWMAX, txdesc->cw_max);
+        rt2x00_set_field32(&word, TXD_W1_HOST_Q_ID, entry->queue->qid);
+        rt2x00_set_field32(&word, TXD_W1_AIFSN, entry->queue->aifs);
+        rt2x00_set_field32(&word, TXD_W1_CWMIN, entry->queue->cw_min);
+        rt2x00_set_field32(&word, TXD_W1_CWMAX, entry->queue->cw_max);
         rt2x00_set_field32(&word, TXD_W1_IV_OFFSET, txdesc->iv_offset);
         rt2x00_set_field32(&word, TXD_W1_HW_SEQUENCE,
                            test_bit(ENTRY_TXD_GENERATE_SEQ, &txdesc->flags));
@@ -1820,7 +1817,7 @@ static void rt61pci_write_tx_desc(struct queue_entry *entry,
         rt2x00_set_field32(&word, TXD_W5_WAITING_DMA_DONE_INT, 1);
         rt2x00_desc_write(txd, 5, word);
 
-        if (txdesc->qid != QID_BEACON) {
+        if (entry->queue->qid != QID_BEACON) {
                 rt2x00_desc_read(txd, 6, &word);
                 rt2x00_set_field32(&word, TXD_W6_BUFFER_PHYSICAL_ADDRESS,
                                    skbdesc->skb_dma);
@@ -1866,8 +1863,8 @@ static void rt61pci_write_tx_desc(struct queue_entry *entry,
          * Register descriptor details in skb frame descriptor.
          */
         skbdesc->desc = txd;
-        skbdesc->desc_len =
-                (txdesc->qid == QID_BEACON) ?  TXINFO_SIZE : TXD_DESC_SIZE;
+        skbdesc->desc_len = (entry->queue->qid == QID_BEACON) ? TXINFO_SIZE :
+                            TXD_DESC_SIZE;
 }
 
 /*
@@ -2078,7 +2075,7 @@ static void rt61pci_txdone(struct rt2x00_dev *rt2x00dev)
          * that the TX_STA_FIFO stack has a size of 16. We stick to our
          * tx ring size for now.
          */
-        for (i = 0; i < TX_ENTRIES; i++) {
+        for (i = 0; i < rt2x00dev->ops->tx->entry_num; i++) {
                 rt2x00pci_register_read(rt2x00dev, STA_CSR4, &reg);
                 if (!rt2x00_get_field32(reg, STA_CSR4_VALID))
                         break;
@@ -2824,6 +2821,7 @@ static const struct ieee80211_ops rt61pci_mac80211_ops = {
         .conf_tx                = rt61pci_conf_tx,
         .get_tsf                = rt61pci_get_tsf,
         .rfkill_poll            = rt2x00mac_rfkill_poll,
+        .flush                  = rt2x00mac_flush,
 };
 
 static const struct rt2x00lib_ops rt61pci_rt2x00_ops = {
@@ -2857,21 +2855,21 @@ static const struct rt2x00lib_ops rt61pci_rt2x00_ops = {
 };
 
 static const struct data_queue_desc rt61pci_queue_rx = {
-        .entry_num              = RX_ENTRIES,
+        .entry_num              = 32,
         .data_size              = DATA_FRAME_SIZE,
         .desc_size              = RXD_DESC_SIZE,
         .priv_size              = sizeof(struct queue_entry_priv_pci),
 };
 
 static const struct data_queue_desc rt61pci_queue_tx = {
-        .entry_num              = TX_ENTRIES,
+        .entry_num              = 32,
         .data_size              = DATA_FRAME_SIZE,
         .desc_size              = TXD_DESC_SIZE,
         .priv_size              = sizeof(struct queue_entry_priv_pci),
 };
 
 static const struct data_queue_desc rt61pci_queue_bcn = {
-        .entry_num              = 4 * BEACON_ENTRIES,
+        .entry_num              = 4,
         .data_size              = 0, /* No DMA required for beacons */
         .desc_size              = TXINFO_SIZE,
         .priv_size              = sizeof(struct queue_entry_priv_pci),
diff --git a/drivers/net/wireless/rt2x00/rt61pci.h b/drivers/net/wireless/rt2x00/rt61pci.h
index e2e728ab0b2..afc803b7959 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.h
+++ b/drivers/net/wireless/rt2x00/rt61pci.h
@@ -412,7 +412,7 @@ struct hw_pairwise_ta_entry {
  * DROP_VERSION_ERROR: Drop version error frame.
  * DROP_MULTICAST: Drop multicast frames.
  * DROP_BORADCAST: Drop broadcast frames.
- * ROP_ACK_CTS: Drop received ACK and CTS.
+ * DROP_ACK_CTS: Drop received ACK and CTS.
  */
 #define TXRX_CSR0                       0x3040
 #define TXRX_CSR0_RX_ACK_TIMEOUT        FIELD32(0x000001ff)
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index 9be8089317e..6f04552f581 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -40,7 +40,7 @@
 /*
  * Allow hardware encryption to be disabled.
  */
-static int modparam_nohwcrypt = 0;
+static int modparam_nohwcrypt;
 module_param_named(nohwcrypt, modparam_nohwcrypt, bool, S_IRUGO);
 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
 
@@ -1331,8 +1331,7 @@ static void rt73usb_toggle_rx(struct rt2x00_dev *rt2x00dev,
 
         rt2x00usb_register_read(rt2x00dev, TXRX_CSR0, &reg);
         rt2x00_set_field32(&reg, TXRX_CSR0_DISABLE_RX,
-                           (state == STATE_RADIO_RX_OFF) ||
-                           (state == STATE_RADIO_RX_OFF_LINK));
+                           (state == STATE_RADIO_RX_OFF));
         rt2x00usb_register_write(rt2x00dev, TXRX_CSR0, reg);
 }
 
@@ -1403,9 +1402,7 @@ static int rt73usb_set_device_state(struct rt2x00_dev *rt2x00dev,
                 rt73usb_disable_radio(rt2x00dev);
                 break;
         case STATE_RADIO_RX_ON:
-        case STATE_RADIO_RX_ON_LINK:
         case STATE_RADIO_RX_OFF:
-        case STATE_RADIO_RX_OFF_LINK:
                 rt73usb_toggle_rx(rt2x00dev, state);
                 break;
         case STATE_RADIO_IRQ_ON:
@@ -1472,10 +1469,10 @@ static void rt73usb_write_tx_desc(struct queue_entry *entry,
         rt2x00_desc_write(txd, 0, word);
 
         rt2x00_desc_read(txd, 1, &word);
-        rt2x00_set_field32(&word, TXD_W1_HOST_Q_ID, txdesc->qid);
-        rt2x00_set_field32(&word, TXD_W1_AIFSN, txdesc->aifs);
-        rt2x00_set_field32(&word, TXD_W1_CWMIN, txdesc->cw_min);
-        rt2x00_set_field32(&word, TXD_W1_CWMAX, txdesc->cw_max);
+        rt2x00_set_field32(&word, TXD_W1_HOST_Q_ID, entry->queue->qid);
+        rt2x00_set_field32(&word, TXD_W1_AIFSN, entry->queue->aifs);
+        rt2x00_set_field32(&word, TXD_W1_CWMIN, entry->queue->cw_min);
+        rt2x00_set_field32(&word, TXD_W1_CWMAX, entry->queue->cw_max);
         rt2x00_set_field32(&word, TXD_W1_IV_OFFSET, txdesc->iv_offset);
         rt2x00_set_field32(&word, TXD_W1_HW_SEQUENCE,
                            test_bit(ENTRY_TXD_GENERATE_SEQ, &txdesc->flags));
@@ -2264,6 +2261,7 @@ static const struct ieee80211_ops rt73usb_mac80211_ops = {
         .conf_tx                = rt73usb_conf_tx,
         .get_tsf                = rt73usb_get_tsf,
         .rfkill_poll            = rt2x00mac_rfkill_poll,
+        .flush                  = rt2x00mac_flush,
 };
 
 static const struct rt2x00lib_ops rt73usb_rt2x00_ops = {
@@ -2296,21 +2294,21 @@ static const struct rt2x00lib_ops rt73usb_rt2x00_ops = {
 };
 
 static const struct data_queue_desc rt73usb_queue_rx = {
-        .entry_num              = RX_ENTRIES,
+        .entry_num              = 32,
         .data_size              = DATA_FRAME_SIZE,
         .desc_size              = RXD_DESC_SIZE,
         .priv_size              = sizeof(struct queue_entry_priv_usb),
 };
 
 static const struct data_queue_desc rt73usb_queue_tx = {
-        .entry_num              = TX_ENTRIES,
+        .entry_num              = 32,
         .data_size              = DATA_FRAME_SIZE,
         .desc_size              = TXD_DESC_SIZE,
         .priv_size              = sizeof(struct queue_entry_priv_usb),
 };
 
 static const struct data_queue_desc rt73usb_queue_bcn = {
-        .entry_num              = 4 * BEACON_ENTRIES,
+        .entry_num              = 4,
         .data_size              = MGMT_FRAME_SIZE,
         .desc_size              = TXINFO_SIZE,
         .priv_size              = sizeof(struct queue_entry_priv_usb),
diff --git a/drivers/net/wireless/rt2x00/rt73usb.h b/drivers/net/wireless/rt2x00/rt73usb.h
index 44d5b2bebd3..1315ce5c992 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.h
+++ b/drivers/net/wireless/rt2x00/rt73usb.h
@@ -322,7 +322,7 @@ struct hw_pairwise_ta_entry {
  * DROP_VERSION_ERROR: Drop version error frame.
  * DROP_MULTICAST: Drop multicast frames.
  * DROP_BORADCAST: Drop broadcast frames.
- * ROP_ACK_CTS: Drop received ACK and CTS.
+ * DROP_ACK_CTS: Drop received ACK and CTS.
  */
 #define TXRX_CSR0                       0x3040
 #define TXRX_CSR0_RX_ACK_TIMEOUT        FIELD32(0x000001ff)
diff --git a/drivers/net/wireless/rtl818x/rtl8187_dev.c b/drivers/net/wireless/rtl818x/rtl8187_dev.c
index 38fa8244cc9..eeee244fcaa 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_dev.c
@@ -553,6 +553,46 @@ static int rtl8187b_init_status_urb(struct ieee80211_hw *dev)
         return ret;
 }
 
+static void rtl8187_set_anaparam(struct rtl8187_priv *priv, bool rfon)
+{
+        u32 anaparam, anaparam2;
+        u8 anaparam3, reg;
+
+        if (!priv->is_rtl8187b) {
+                if (rfon) {
+                        anaparam = RTL8187_RTL8225_ANAPARAM_ON;
+                        anaparam2 = RTL8187_RTL8225_ANAPARAM2_ON;
+                } else {
+                        anaparam = RTL8187_RTL8225_ANAPARAM_OFF;
+                        anaparam2 = RTL8187_RTL8225_ANAPARAM2_OFF;
+                }
+        } else {
+                if (rfon) {
+                        anaparam = RTL8187B_RTL8225_ANAPARAM_ON;
+                        anaparam2 = RTL8187B_RTL8225_ANAPARAM2_ON;
+                        anaparam3 = RTL8187B_RTL8225_ANAPARAM3_ON;
+                } else {
+                        anaparam = RTL8187B_RTL8225_ANAPARAM_OFF;
+                        anaparam2 = RTL8187B_RTL8225_ANAPARAM2_OFF;
+                        anaparam3 = RTL8187B_RTL8225_ANAPARAM3_OFF;
+                }
+        }
+
+        rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD,
+                         RTL818X_EEPROM_CMD_CONFIG);
+        reg = rtl818x_ioread8(priv, &priv->map->CONFIG3);
+        reg |= RTL818X_CONFIG3_ANAPARAM_WRITE;
+        rtl818x_iowrite8(priv, &priv->map->CONFIG3, reg);
+        rtl818x_iowrite32(priv, &priv->map->ANAPARAM, anaparam);
+        rtl818x_iowrite32(priv, &priv->map->ANAPARAM2, anaparam2);
+        if (priv->is_rtl8187b)
+                rtl818x_iowrite8(priv, &priv->map->ANAPARAM3, anaparam3);
+        reg &= ~RTL818X_CONFIG3_ANAPARAM_WRITE;
+        rtl818x_iowrite8(priv, &priv->map->CONFIG3, reg);
+        rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD,
+                         RTL818X_EEPROM_CMD_NORMAL);
+}
+
 static int rtl8187_cmd_reset(struct ieee80211_hw *dev)
 {
         struct rtl8187_priv *priv = dev->priv;
@@ -603,19 +643,7 @@ static int rtl8187_init_hw(struct ieee80211_hw *dev)
         int res;
 
         /* reset */
-        rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD,
-                         RTL818X_EEPROM_CMD_CONFIG);
-        reg = rtl818x_ioread8(priv, &priv->map->CONFIG3);
-        rtl818x_iowrite8(priv, &priv->map->CONFIG3, reg |
-                         RTL818X_CONFIG3_ANAPARAM_WRITE);
-        rtl818x_iowrite32(priv, &priv->map->ANAPARAM,
-                          RTL8187_RTL8225_ANAPARAM_ON);
-        rtl818x_iowrite32(priv, &priv->map->ANAPARAM2,
-                          RTL8187_RTL8225_ANAPARAM2_ON);
-        rtl818x_iowrite8(priv, &priv->map->CONFIG3, reg &
-                         ~RTL818X_CONFIG3_ANAPARAM_WRITE);
-        rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD,
-                         RTL818X_EEPROM_CMD_NORMAL);
+        rtl8187_set_anaparam(priv, true);
 
         rtl818x_iowrite16(priv, &priv->map->INT_MASK, 0);
 
@@ -629,17 +657,7 @@ static int rtl8187_init_hw(struct ieee80211_hw *dev)
         if (res)
                 return res;
 
-        rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_CONFIG);
-        reg = rtl818x_ioread8(priv, &priv->map->CONFIG3);
-        rtl818x_iowrite8(priv, &priv->map->CONFIG3,
-                        reg | RTL818X_CONFIG3_ANAPARAM_WRITE);
-        rtl818x_iowrite32(priv, &priv->map->ANAPARAM,
-                          RTL8187_RTL8225_ANAPARAM_ON);
-        rtl818x_iowrite32(priv, &priv->map->ANAPARAM2,
-                          RTL8187_RTL8225_ANAPARAM2_ON);
-        rtl818x_iowrite8(priv, &priv->map->CONFIG3,
-                        reg & ~RTL818X_CONFIG3_ANAPARAM_WRITE);
-        rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_NORMAL);
+        rtl8187_set_anaparam(priv, true);
 
         /* setup card */
         rtl818x_iowrite16(priv, &priv->map->RFPinsSelect, 0);
@@ -712,10 +730,9 @@ static const u8 rtl8187b_reg_table[][3] = {
 
         {0x58, 0x4B, 1}, {0x59, 0x00, 1}, {0x5A, 0x4B, 1}, {0x5B, 0x00, 1},
         {0x60, 0x4B, 1}, {0x61, 0x09, 1}, {0x62, 0x4B, 1}, {0x63, 0x09, 1},
-        {0xCE, 0x0F, 1}, {0xCF, 0x00, 1}, {0xE0, 0xFF, 1}, {0xE1, 0x0F, 1},
-        {0xE2, 0x00, 1}, {0xF0, 0x4E, 1}, {0xF1, 0x01, 1}, {0xF2, 0x02, 1},
-        {0xF3, 0x03, 1}, {0xF4, 0x04, 1}, {0xF5, 0x05, 1}, {0xF6, 0x06, 1},
-        {0xF7, 0x07, 1}, {0xF8, 0x08, 1},
+        {0xCE, 0x0F, 1}, {0xCF, 0x00, 1}, {0xF0, 0x4E, 1}, {0xF1, 0x01, 1},
+        {0xF2, 0x02, 1}, {0xF3, 0x03, 1}, {0xF4, 0x04, 1}, {0xF5, 0x05, 1},
+        {0xF6, 0x06, 1}, {0xF7, 0x07, 1}, {0xF8, 0x08, 1},
 
         {0x4E, 0x00, 2}, {0x0C, 0x04, 2}, {0x21, 0x61, 2}, {0x22, 0x68, 2},
         {0x23, 0x6F, 2}, {0x24, 0x76, 2}, {0x25, 0x7D, 2}, {0x26, 0x84, 2},
@@ -723,14 +740,13 @@ static const u8 rtl8187b_reg_table[][3] = {
         {0x52, 0x04, 2}, {0x53, 0xA0, 2}, {0x54, 0x1F, 2}, {0x55, 0x23, 2},
         {0x56, 0x45, 2}, {0x57, 0x67, 2}, {0x58, 0x08, 2}, {0x59, 0x08, 2},
         {0x5A, 0x08, 2}, {0x5B, 0x08, 2}, {0x60, 0x08, 2}, {0x61, 0x08, 2},
-        {0x62, 0x08, 2}, {0x63, 0x08, 2}, {0x64, 0xCF, 2}, {0x72, 0x56, 2},
-        {0x73, 0x9A, 2},
+        {0x62, 0x08, 2}, {0x63, 0x08, 2}, {0x64, 0xCF, 2},
 
-        {0x34, 0xF0, 0}, {0x35, 0x0F, 0}, {0x5B, 0x40, 0}, {0x84, 0x88, 0},
-        {0x85, 0x24, 0}, {0x88, 0x54, 0}, {0x8B, 0xB8, 0}, {0x8C, 0x07, 0},
-        {0x8D, 0x00, 0}, {0x94, 0x1B, 0}, {0x95, 0x12, 0}, {0x96, 0x00, 0},
-        {0x97, 0x06, 0}, {0x9D, 0x1A, 0}, {0x9F, 0x10, 0}, {0xB4, 0x22, 0},
-        {0xBE, 0x80, 0}, {0xDB, 0x00, 0}, {0xEE, 0x00, 0}, {0x4C, 0x00, 2},
+        {0x5B, 0x40, 0}, {0x84, 0x88, 0}, {0x85, 0x24, 0}, {0x88, 0x54, 0},
+        {0x8B, 0xB8, 0}, {0x8C, 0x07, 0}, {0x8D, 0x00, 0}, {0x94, 0x1B, 0},
+        {0x95, 0x12, 0}, {0x96, 0x00, 0}, {0x97, 0x06, 0}, {0x9D, 0x1A, 0},
+        {0x9F, 0x10, 0}, {0xB4, 0x22, 0}, {0xBE, 0x80, 0}, {0xDB, 0x00, 0},
+        {0xEE, 0x00, 0}, {0x4C, 0x00, 2},
 
         {0x9F, 0x00, 3}, {0x8C, 0x01, 0}, {0x8D, 0x10, 0}, {0x8E, 0x08, 0},
         {0x8F, 0x00, 0}
@@ -742,48 +758,34 @@ static int rtl8187b_init_hw(struct ieee80211_hw *dev)
         int res, i;
         u8 reg;
 
-        rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD,
-                         RTL818X_EEPROM_CMD_CONFIG);
-
-        reg = rtl818x_ioread8(priv, &priv->map->CONFIG3);
-        reg |= RTL818X_CONFIG3_ANAPARAM_WRITE | RTL818X_CONFIG3_GNT_SELECT;
-        rtl818x_iowrite8(priv, &priv->map->CONFIG3, reg);
-        rtl818x_iowrite32(priv, &priv->map->ANAPARAM2,
-                          RTL8187B_RTL8225_ANAPARAM2_ON);
-        rtl818x_iowrite32(priv, &priv->map->ANAPARAM,
-                          RTL8187B_RTL8225_ANAPARAM_ON);
-        rtl818x_iowrite8(priv, &priv->map->ANAPARAM3,
-                         RTL8187B_RTL8225_ANAPARAM3_ON);
+        rtl8187_set_anaparam(priv, true);
 
+        /* Reset PLL sequence on 8187B. Realtek note: reduces power
+         * consumption about 30 mA */
         rtl818x_iowrite8(priv, (u8 *)0xFF61, 0x10);
         reg = rtl818x_ioread8(priv, (u8 *)0xFF62);
         rtl818x_iowrite8(priv, (u8 *)0xFF62, reg & ~(1 << 5));
         rtl818x_iowrite8(priv, (u8 *)0xFF62, reg | (1 << 5));
 
-        reg = rtl818x_ioread8(priv, &priv->map->CONFIG3);
-        reg &= ~RTL818X_CONFIG3_ANAPARAM_WRITE;
-        rtl818x_iowrite8(priv, &priv->map->CONFIG3, reg);
-
-        rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD,
-                         RTL818X_EEPROM_CMD_NORMAL);
-
         res = rtl8187_cmd_reset(dev);
         if (res)
                 return res;
 
-        rtl818x_iowrite16(priv, (__le16 *)0xFF2D, 0x0FFF);
+        rtl8187_set_anaparam(priv, true);
+
+        /* BRSR (Basic Rate Set Register) on 8187B looks to be the same as
+         * RESP_RATE on 8187L in Realtek sources: each bit should be each
+         * one of the 12 rates, all are enabled */
+        rtl818x_iowrite16(priv, (__le16 *)0xFF34, 0x0FFF);
+
         reg = rtl818x_ioread8(priv, &priv->map->CW_CONF);
         reg |= RTL818X_CW_CONF_PERPACKET_RETRY_SHIFT;
         rtl818x_iowrite8(priv, &priv->map->CW_CONF, reg);
-        reg = rtl818x_ioread8(priv, &priv->map->TX_AGC_CTL);
-        reg |= RTL818X_TX_AGC_CTL_PERPACKET_GAIN_SHIFT |
-               RTL818X_TX_AGC_CTL_PERPACKET_ANTSEL_SHIFT;
-        rtl818x_iowrite8(priv, &priv->map->TX_AGC_CTL, reg);
 
+        /* Auto Rate Fallback Register (ARFR): 1M-54M setting */
         rtl818x_iowrite16_idx(priv, (__le16 *)0xFFE0, 0x0FFF, 1);
+        rtl818x_iowrite8_idx(priv, (u8 *)0xFFE2, 0x00, 1);
 
-        rtl818x_iowrite16(priv, &priv->map->BEACON_INTERVAL, 100);
-        rtl818x_iowrite16(priv, &priv->map->ATIM_WND, 2);
         rtl818x_iowrite16_idx(priv, (__le16 *)0xFFD4, 0xFFFF, 1);
 
         rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD,
@@ -811,16 +813,9 @@ static int rtl8187b_init_hw(struct ieee80211_hw *dev)
 
         rtl818x_iowrite32(priv, &priv->map->RF_TIMING, 0x00004001);
 
+        /* RFSW_CTRL register */
         rtl818x_iowrite16_idx(priv, (__le16 *)0xFF72, 0x569A, 2);
 
-        rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD,
-                         RTL818X_EEPROM_CMD_CONFIG);
-        reg = rtl818x_ioread8(priv, &priv->map->CONFIG3);
-        reg |= RTL818X_CONFIG3_ANAPARAM_WRITE;
-        rtl818x_iowrite8(priv, &priv->map->CONFIG3, reg);
-        rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD,
-                         RTL818X_EEPROM_CMD_NORMAL);
-
         rtl818x_iowrite16(priv, &priv->map->RFPinsOutput, 0x0480);
         rtl818x_iowrite16(priv, &priv->map->RFPinsSelect, 0x2488);
         rtl818x_iowrite16(priv, &priv->map->RFPinsEnable, 0x1FFF);
@@ -929,6 +924,12 @@ static int rtl8187_start(struct ieee80211_hw *dev)
                 priv->rx_conf = reg;
                 rtl818x_iowrite32(priv, &priv->map->RX_CONF, reg);
 
+                reg = rtl818x_ioread8(priv, &priv->map->TX_AGC_CTL);
+                reg &= ~RTL818X_TX_AGC_CTL_PERPACKET_GAIN_SHIFT;
+                reg &= ~RTL818X_TX_AGC_CTL_PERPACKET_ANTSEL_SHIFT;
+                reg &= ~RTL818X_TX_AGC_CTL_FEEDBACK_ANT;
+                rtl818x_iowrite8(priv, &priv->map->TX_AGC_CTL, reg);
+
                 rtl818x_iowrite32(priv, &priv->map->TX_CONF,
                                   RTL818X_TX_CONF_HW_SEQNUM |
                                   RTL818X_TX_CONF_DISREQQSIZE |
@@ -1002,6 +1003,7 @@ static void rtl8187_stop(struct ieee80211_hw *dev)
         rtl818x_iowrite8(priv, &priv->map->CMD, reg);
 
         priv->rf->stop(dev);
+        rtl8187_set_anaparam(priv, false);
 
         rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_CONFIG);
         reg = rtl818x_ioread8(priv, &priv->map->CONFIG4);
diff --git a/drivers/net/wireless/rtl818x/rtl8187_rtl8225.c b/drivers/net/wireless/rtl818x/rtl8187_rtl8225.c
index 97eebdcf7eb..5c6666f09ac 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_rtl8225.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_rtl8225.c
@@ -898,29 +898,7 @@ static void rtl8225z2_b_rf_init(struct ieee80211_hw *dev)
 
 static void rtl8225_rf_stop(struct ieee80211_hw *dev)
 {
-        u8 reg;
-        struct rtl8187_priv *priv = dev->priv;
-
         rtl8225_write(dev, 0x4, 0x1f);
-
-        rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_CONFIG);
-        reg = rtl818x_ioread8(priv, &priv->map->CONFIG3);
-        rtl818x_iowrite8(priv, &priv->map->CONFIG3, reg | RTL818X_CONFIG3_ANAPARAM_WRITE);
-        if (!priv->is_rtl8187b) {
-                rtl818x_iowrite32(priv, &priv->map->ANAPARAM2,
-                                  RTL8187_RTL8225_ANAPARAM2_OFF);
-                rtl818x_iowrite32(priv, &priv->map->ANAPARAM,
-                                  RTL8187_RTL8225_ANAPARAM_OFF);
-        } else {
-                rtl818x_iowrite32(priv, &priv->map->ANAPARAM2,
-                                  RTL8187B_RTL8225_ANAPARAM2_OFF);
-                rtl818x_iowrite32(priv, &priv->map->ANAPARAM,
-                                  RTL8187B_RTL8225_ANAPARAM_OFF);
-                rtl818x_iowrite8(priv, &priv->map->ANAPARAM3,
-                                  RTL8187B_RTL8225_ANAPARAM3_OFF);
-        }
-        rtl818x_iowrite8(priv, &priv->map->CONFIG3, reg & ~RTL818X_CONFIG3_ANAPARAM_WRITE);
-        rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_NORMAL);
 }
 
 static void rtl8225_rf_set_channel(struct ieee80211_hw *dev,
diff --git a/drivers/net/wireless/wl1251/main.c b/drivers/net/wireless/wl1251/main.c
index 7a8762553cd..012e1a4016f 100644
--- a/drivers/net/wireless/wl1251/main.c
+++ b/drivers/net/wireless/wl1251/main.c
@@ -52,14 +52,14 @@ void wl1251_disable_interrupts(struct wl1251 *wl)
         wl->if_ops->disable_irq(wl);
 }
 
-static void wl1251_power_off(struct wl1251 *wl)
+static int wl1251_power_off(struct wl1251 *wl)
 {
-        wl->set_power(false);
+        return wl->if_ops->power(wl, false);
 }
 
-static void wl1251_power_on(struct wl1251 *wl)
+static int wl1251_power_on(struct wl1251 *wl)
 {
-        wl->set_power(true);
+        return wl->if_ops->power(wl, true);
 }
 
 static int wl1251_fetch_firmware(struct wl1251 *wl)
@@ -152,9 +152,12 @@ static void wl1251_fw_wakeup(struct wl1251 *wl)
 
 static int wl1251_chip_wakeup(struct wl1251 *wl)
 {
-        int ret = 0;
+        int ret;
+
+        ret = wl1251_power_on(wl);
+        if (ret < 0)
+                return ret;
 
-        wl1251_power_on(wl);
         msleep(WL1251_POWER_ON_SLEEP);
         wl->if_ops->reset(wl);
 
diff --git a/drivers/net/wireless/wl1251/sdio.c b/drivers/net/wireless/wl1251/sdio.c
index 74ba9ced539..596d90ecba3 100644
--- a/drivers/net/wireless/wl1251/sdio.c
+++ b/drivers/net/wireless/wl1251/sdio.c
@@ -26,6 +26,7 @@
 #include <linux/platform_device.h>
 #include <linux/wl12xx.h>
 #include <linux/irq.h>
+#include <linux/pm_runtime.h>
 
 #include "wl1251.h"
 
@@ -42,8 +43,6 @@ struct wl1251_sdio {
         u32 elp_val;
 };
 
-static struct wl12xx_platform_data *wl12xx_board_data;
-
 static struct sdio_func *wl_to_func(struct wl1251 *wl)
 {
         struct wl1251_sdio *wl_sdio = wl->if_priv;
@@ -171,8 +170,42 @@ static void wl1251_disable_line_irq(struct wl1251 *wl)
         return disable_irq(wl->irq);
 }
 
-static void wl1251_sdio_set_power(bool enable)
+static int wl1251_sdio_set_power(struct wl1251 *wl, bool enable)
 {
+        struct sdio_func *func = wl_to_func(wl);
+        int ret;
+
+        if (enable) {
+                /*
+                 * Power is controlled by runtime PM, but we still call board
+                 * callback in case it wants to do any additional setup,
+                 * for example enabling clock buffer for the module.
+                 */
+                if (wl->set_power)
+                        wl->set_power(true);
+
+                ret = pm_runtime_get_sync(&func->dev);
+                if (ret < 0)
+                        goto out;
+
+                sdio_claim_host(func);
+                sdio_enable_func(func);
+                sdio_release_host(func);
+        } else {
+                sdio_claim_host(func);
+                sdio_disable_func(func);
+                sdio_release_host(func);
+
+                ret = pm_runtime_put_sync(&func->dev);
+                if (ret < 0)
+                        goto out;
+
+                if (wl->set_power)
+                        wl->set_power(false);
+        }
+
+out:
+        return ret;
 }
 
 static struct wl1251_if_operations wl1251_sdio_ops = {
@@ -181,30 +214,7 @@ static struct wl1251_if_operations wl1251_sdio_ops = {
         .write_elp = wl1251_sdio_write_elp,
         .read_elp = wl1251_sdio_read_elp,
         .reset = wl1251_sdio_reset,
-};
-
-static int wl1251_platform_probe(struct platform_device *pdev)
-{
-        if (pdev->id != -1) {
-                wl1251_error("can only handle single device");
-                return -ENODEV;
-        }
-
-        wl12xx_board_data = pdev->dev.platform_data;
-        return 0;
-}
-
-/*
- * Dummy platform_driver for passing platform_data to this driver,
- * until we have a way to pass this through SDIO subsystem or
- * some other way.
- */
-static struct platform_driver wl1251_platform_driver = {
-        .driver = {
-                .name   = "wl1251_data",
-                .owner  = THIS_MODULE,
-        },
-        .probe  = wl1251_platform_probe,
+        .power = wl1251_sdio_set_power,
 };
 
 static int wl1251_sdio_probe(struct sdio_func *func,
@@ -214,6 +224,7 @@ static int wl1251_sdio_probe(struct sdio_func *func,
         struct wl1251 *wl;
         struct ieee80211_hw *hw;
         struct wl1251_sdio *wl_sdio;
+        const struct wl12xx_platform_data *wl12xx_board_data;
 
         hw = wl1251_alloc_hw();
         if (IS_ERR(hw))
@@ -239,8 +250,8 @@ static int wl1251_sdio_probe(struct sdio_func *func,
         wl_sdio->func = func;
         wl->if_priv = wl_sdio;
         wl->if_ops = &wl1251_sdio_ops;
-        wl->set_power = wl1251_sdio_set_power;
 
+        wl12xx_board_data = wl12xx_get_platform_data();
         if (wl12xx_board_data != NULL) {
                 wl->set_power = wl12xx_board_data->set_power;
                 wl->irq = wl12xx_board_data->irq;
@@ -273,6 +284,10 @@ static int wl1251_sdio_probe(struct sdio_func *func,
                 goto out_free_irq;
 
         sdio_set_drvdata(func, wl);
+
+        /* Tell PM core that we don't need the card to be powered now */
+        pm_runtime_put_noidle(&func->dev);
+
         return ret;
 
 out_free_irq:
@@ -294,6 +309,9 @@ static void __devexit wl1251_sdio_remove(struct sdio_func *func)
         struct wl1251 *wl = sdio_get_drvdata(func);
         struct wl1251_sdio *wl_sdio = wl->if_priv;
 
+        /* Undo decrement done above in wl1251_probe */
+        pm_runtime_get_noresume(&func->dev);
+
         if (wl->irq)
                 free_irq(wl->irq, wl);
         kfree(wl_sdio);
@@ -305,23 +323,37 @@ static void __devexit wl1251_sdio_remove(struct sdio_func *func)
         sdio_release_host(func);
 }
 
+static int wl1251_suspend(struct device *dev)
+{
+        /*
+         * Tell MMC/SDIO core it's OK to power down the card
+         * (if it isn't already), but not to remove it completely.
+         */
+        return 0;
+}
+
+static int wl1251_resume(struct device *dev)
+{
+        return 0;
+}
+
+static const struct dev_pm_ops wl1251_sdio_pm_ops = {
+        .suspend        = wl1251_suspend,
+        .resume         = wl1251_resume,
+};
+
 static struct sdio_driver wl1251_sdio_driver = {
         .name           = "wl1251_sdio",
         .id_table       = wl1251_devices,
         .probe          = wl1251_sdio_probe,
         .remove         = __devexit_p(wl1251_sdio_remove),
+        .drv.pm         = &wl1251_sdio_pm_ops,
 };
 
 static int __init wl1251_sdio_init(void)
 {
         int err;
 
-        err = platform_driver_register(&wl1251_platform_driver);
-        if (err) {
-                wl1251_error("failed to register platform driver: %d", err);
-                return err;
-        }
-
         err = sdio_register_driver(&wl1251_sdio_driver);
         if (err)
                 wl1251_error("failed to register sdio driver: %d", err);
@@ -331,7 +363,6 @@ static int __init wl1251_sdio_init(void)
 static void __exit wl1251_sdio_exit(void)
 {
         sdio_unregister_driver(&wl1251_sdio_driver);
-        platform_driver_unregister(&wl1251_platform_driver);
         wl1251_notice("unloaded");
 }
 
diff --git a/drivers/net/wireless/wl1251/spi.c b/drivers/net/wireless/wl1251/spi.c
index 88fa8e69d0d..ac872b38960 100644
--- a/drivers/net/wireless/wl1251/spi.c
+++ b/drivers/net/wireless/wl1251/spi.c
@@ -215,12 +215,21 @@ static void wl1251_spi_disable_irq(struct wl1251 *wl)
         return disable_irq(wl->irq);
 }
 
+static int wl1251_spi_set_power(struct wl1251 *wl, bool enable)
+{
+        if (wl->set_power)
+                wl->set_power(enable);
+
+        return 0;
+}
+
 static const struct wl1251_if_operations wl1251_spi_ops = {
         .read = wl1251_spi_read,
         .write = wl1251_spi_write,
         .reset = wl1251_spi_reset_wake,
         .enable_irq = wl1251_spi_enable_irq,
         .disable_irq = wl1251_spi_disable_irq,
+        .power = wl1251_spi_set_power,
 };
 
 static int __devinit wl1251_spi_probe(struct spi_device *spi)
diff --git a/drivers/net/wireless/wl1251/wl1251.h b/drivers/net/wireless/wl1251/wl1251.h
index e113d4c1fb3..13fbeeccf60 100644
--- a/drivers/net/wireless/wl1251/wl1251.h
+++ b/drivers/net/wireless/wl1251/wl1251.h
@@ -256,6 +256,7 @@ struct wl1251_if_operations {
         void (*write)(struct wl1251 *wl, int addr, void *buf, size_t len);
         void (*read_elp)(struct wl1251 *wl, int addr, u32 *val);
         void (*write_elp)(struct wl1251 *wl, int addr, u32 val);
+        int  (*power)(struct wl1251 *wl, bool enable);
         void (*reset)(struct wl1251 *wl);
         void (*enable_irq)(struct wl1251 *wl);
         void (*disable_irq)(struct wl1251 *wl);
diff --git a/drivers/net/wireless/wl12xx/Kconfig b/drivers/net/wireless/wl12xx/Kconfig
index b447559f1db..d2adeb1f72b 100644
--- a/drivers/net/wireless/wl12xx/Kconfig
+++ b/drivers/net/wireless/wl12xx/Kconfig
@@ -1,46 +1,58 @@
-menuconfig WL12XX
+menuconfig WL12XX_MENU
         tristate "TI wl12xx driver support"
         depends on MAC80211 && EXPERIMENTAL
         ---help---
-          This will enable TI wl12xx driver support. The drivers make
-          use of the mac80211 stack.
+          This will enable TI wl12xx driver support for the following chips:
+          wl1271 and wl1273.
+          The drivers make use of the mac80211 stack.
 
-config WL1271
-        tristate "TI wl1271 support"
-        depends on WL12XX && GENERIC_HARDIRQS
+config WL12XX
+        tristate "TI wl12xx support"
+        depends on WL12XX_MENU && GENERIC_HARDIRQS
         depends on INET
         select FW_LOADER
         select CRC7
         ---help---
-          This module adds support for wireless adapters based on the
-          TI wl1271 chipset.
+          This module adds support for wireless adapters based on TI wl1271 and
+          TI wl1273 chipsets. This module does *not* include support for wl1251.
+          For wl1251 support, use the separate homonymous driver instead.
 
-          If you choose to build a module, it'll be called wl1271. Say N if
+          If you choose to build a module, it will be called wl12xx. Say N if
           unsure.
 
-config WL1271_SPI
-        tristate "TI wl1271 SPI support"
-        depends on WL1271 && SPI_MASTER
+config WL12XX_HT
+        bool "TI wl12xx 802.11 HT support (EXPERIMENTAL)"
+        depends on WL12XX && EXPERIMENTAL
+        default n
+        ---help---
+          This will enable 802.11 HT support in the wl12xx module.
+
+          That configuration is temporary due to the code incomplete and
+          still in testing process.
+
+config WL12XX_SPI
+        tristate "TI wl12xx SPI support"
+        depends on WL12XX && SPI_MASTER
         ---help---
           This module adds support for the SPI interface of adapters using
-          TI wl1271 chipset.  Select this if your platform is using
+          TI wl12xx chipsets.  Select this if your platform is using
           the SPI bus.
 
-          If you choose to build a module, it'll be called wl1251_spi.
+          If you choose to build a module, it'll be called wl12xx_spi.
           Say N if unsure.
 
-config WL1271_SDIO
-        tristate "TI wl1271 SDIO support"
-        depends on WL1271 && MMC
+config WL12XX_SDIO
+        tristate "TI wl12xx SDIO support"
+        depends on WL12XX && MMC
         ---help---
           This module adds support for the SDIO interface of adapters using
-          TI wl1271 chipset.  Select this if your platform is using
+          TI wl12xx chipsets.  Select this if your platform is using
           the SDIO bus.
 
-          If you choose to build a module, it'll be called
-          wl1271_sdio. Say N if unsure.
+          If you choose to build a module, it'll be called wl12xx_sdio.
+          Say N if unsure.
 
 config WL12XX_PLATFORM_DATA
         bool
-        depends on WL1271_SDIO != n
+        depends on WL12XX_SDIO != n || WL1251_SDIO != n
         default y
diff --git a/drivers/net/wireless/wl12xx/Makefile b/drivers/net/wireless/wl12xx/Makefile
index 3a807444b2a..005a758174d 100644
--- a/drivers/net/wireless/wl12xx/Makefile
+++ b/drivers/net/wireless/wl12xx/Makefile
@@ -1,12 +1,13 @@
-wl1271-objs             = wl1271_main.o  wl1271_cmd.o wl1271_io.o \
-                          wl1271_event.o wl1271_tx.o  wl1271_rx.o   \
-                          wl1271_ps.o    wl1271_acx.o wl1271_boot.o \
-                          wl1271_init.o  wl1271_debugfs.o wl1271_scan.o
+wl12xx-objs             = main.o cmd.o io.o event.o tx.o rx.o ps.o acx.o \
+                          boot.o init.o debugfs.o scan.o
 
-wl1271-$(CONFIG_NL80211_TESTMODE)       += wl1271_testmode.o
-obj-$(CONFIG_WL1271)    += wl1271.o
-obj-$(CONFIG_WL1271_SPI)        += wl1271_spi.o
-obj-$(CONFIG_WL1271_SDIO)       += wl1271_sdio.o
+wl12xx_spi-objs = spi.o
+wl12xx_sdio-objs        = sdio.o
+
+wl12xx-$(CONFIG_NL80211_TESTMODE)       += testmode.o
+obj-$(CONFIG_WL12XX)                    += wl12xx.o
+obj-$(CONFIG_WL12XX_SPI)                += wl12xx_spi.o
+obj-$(CONFIG_WL12XX_SDIO)               += wl12xx_sdio.o
 
 # small builtin driver bit
 obj-$(CONFIG_WL12XX_PLATFORM_DATA)      += wl12xx_platform_data.o
diff --git a/drivers/net/wireless/wl12xx/wl1271_acx.c b/drivers/net/wireless/wl12xx/acx.c
index 61899340526..7cbaeb6d2a3 100644
--- a/drivers/net/wireless/wl12xx/wl1271_acx.c
+++ b/drivers/net/wireless/wl12xx/acx.c
@@ -21,7 +21,7 @@
  *
  */
 
-#include "wl1271_acx.h"
+#include "acx.h"
 
 #include <linux/module.h>
 #include <linux/platform_device.h>
@@ -29,10 +29,10 @@
 #include <linux/spi/spi.h>
 #include <linux/slab.h>
 
-#include "wl1271.h"
+#include "wl12xx.h"
 #include "wl12xx_80211.h"
-#include "wl1271_reg.h"
-#include "wl1271_ps.h"
+#include "reg.h"
+#include "ps.h"
 
 int wl1271_acx_wake_up_conditions(struct wl1271 *wl)
 {
@@ -862,7 +862,7 @@ out:
         return ret;
 }
 
-int wl1271_acx_frag_threshold(struct wl1271 *wl)
+int wl1271_acx_frag_threshold(struct wl1271 *wl, u16 frag_threshold)
 {
         struct acx_frag_threshold *acx;
         int ret = 0;
@@ -876,7 +876,7 @@ int wl1271_acx_frag_threshold(struct wl1271 *wl)
                 goto out;
         }
 
-        acx->frag_threshold = cpu_to_le16(wl->conf.tx.frag_threshold);
+        acx->frag_threshold = cpu_to_le16(frag_threshold);
         ret = wl1271_cmd_configure(wl, ACX_FRAG_CFG, acx, sizeof(*acx));
         if (ret < 0) {
                 wl1271_warning("Setting of frag threshold failed: %d", ret);
@@ -1226,6 +1226,89 @@ out:
         return ret;
 }
 
+int wl1271_acx_set_ht_capabilities(struct wl1271 *wl,
+                                    struct ieee80211_sta_ht_cap *ht_cap,
+                                    bool allow_ht_operation)
+{
+        struct wl1271_acx_ht_capabilities *acx;
+        u8 mac_address[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+        int ret = 0;
+
+        wl1271_debug(DEBUG_ACX, "acx ht capabilities setting");
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        /* Allow HT Operation ? */
+        if (allow_ht_operation) {
+                acx->ht_capabilites =
+                        WL1271_ACX_FW_CAP_HT_OPERATION;
+                if (ht_cap->cap & IEEE80211_HT_CAP_GRN_FLD)
+                        acx->ht_capabilites |=
+                                WL1271_ACX_FW_CAP_GREENFIELD_FRAME_FORMAT;
+                if (ht_cap->cap & IEEE80211_HT_CAP_SGI_20)
+                        acx->ht_capabilites |=
+                                WL1271_ACX_FW_CAP_SHORT_GI_FOR_20MHZ_PACKETS;
+                if (ht_cap->cap & IEEE80211_HT_CAP_LSIG_TXOP_PROT)
+                        acx->ht_capabilites |=
+                                WL1271_ACX_FW_CAP_LSIG_TXOP_PROTECTION;
+
+                /* get data from A-MPDU parameters field */
+                acx->ampdu_max_length = ht_cap->ampdu_factor;
+                acx->ampdu_min_spacing = ht_cap->ampdu_density;
+
+                memcpy(acx->mac_address, mac_address, ETH_ALEN);
+        } else { /* HT operations are not allowed */
+                acx->ht_capabilites = 0;
+        }
+
+        ret = wl1271_cmd_configure(wl, ACX_PEER_HT_CAP, acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1271_warning("acx ht capabilities setting failed: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
+
+int wl1271_acx_set_ht_information(struct wl1271 *wl,
+                                   u16 ht_operation_mode)
+{
+        struct wl1271_acx_ht_information *acx;
+        int ret = 0;
+
+        wl1271_debug(DEBUG_ACX, "acx ht information setting");
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        acx->ht_protection =
+                (u8)(ht_operation_mode & IEEE80211_HT_OP_MODE_PROTECTION);
+        acx->rifs_mode = 0;
+        acx->gf_protection = 0;
+        acx->ht_tx_burst_limit = 0;
+        acx->dual_cts_protection = 0;
+
+        ret = wl1271_cmd_configure(wl, ACX_HT_BSS_OPERATION, acx, sizeof(*acx));
+
+        if (ret < 0) {
+                wl1271_warning("acx ht information setting failed: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
+
 int wl1271_acx_tsf_info(struct wl1271 *wl, u64 *mactime)
 {
         struct wl1271_acx_fw_tsf_information *tsf_info;
diff --git a/drivers/net/wireless/wl12xx/wl1271_acx.h b/drivers/net/wireless/wl12xx/acx.h
index ebb341d36e8..75a6306ff55 100644
--- a/drivers/net/wireless/wl12xx/wl1271_acx.h
+++ b/drivers/net/wireless/wl12xx/acx.h
@@ -22,11 +22,11 @@
  *
  */
 
-#ifndef __WL1271_ACX_H__
-#define __WL1271_ACX_H__
+#ifndef __ACX_H__
+#define __ACX_H__
 
-#include "wl1271.h"
-#include "wl1271_cmd.h"
+#include "wl12xx.h"
+#include "cmd.h"
 
 /*************************************************************************
 
@@ -61,7 +61,8 @@
                                             WL1271_ACX_INTR_HW_AVAILABLE  | \
                                             WL1271_ACX_INTR_DATA)
 
-#define WL1271_INTR_MASK                   (WL1271_ACX_INTR_EVENT_A      | \
+#define WL1271_INTR_MASK                   (WL1271_ACX_INTR_WATCHDOG     | \
+                                            WL1271_ACX_INTR_EVENT_A      | \
                                             WL1271_ACX_INTR_EVENT_B      | \
                                             WL1271_ACX_INTR_HW_AVAILABLE | \
                                             WL1271_ACX_INTR_DATA)
@@ -964,6 +965,87 @@ struct wl1271_acx_rssi_snr_avg_weights {
         u8 snr_data;
 };
 
+/*
+ * ACX_PEER_HT_CAP
+ * Configure HT capabilities - declare the capabilities of the peer
+ * we are connected to.
+ */
+struct wl1271_acx_ht_capabilities {
+        struct acx_header header;
+
+        /*
+         * bit 0 - Allow HT Operation
+         * bit 1 - Allow Greenfield format in TX
+         * bit 2 - Allow Short GI in TX
+         * bit 3 - Allow L-SIG TXOP Protection in TX
+         * bit 4 - Allow HT Control fields in TX.
+         *         Note, driver will still leave space for HT control in packets
+         *         regardless of the value of this field. FW will be responsible
+         *         to drop the HT field from any frame when this Bit set to 0.
+         * bit 5 - Allow RD initiation in TXOP. FW is allowed to initate RD.
+         *         Exact policy setting for this feature is TBD.
+         *         Note, this bit can only be set to 1 if bit 3 is set to 1.
+         */
+        __le32 ht_capabilites;
+
+        /*
+         * Indicates to which peer these capabilities apply.
+         * For infrastructure use ff:ff:ff:ff:ff:ff that indicates relevance
+         * for all peers.
+         * Only valid for IBSS/DLS operation.
+         */
+        u8 mac_address[ETH_ALEN];
+
+        /*
+         * This the maximum A-MPDU length supported by the AP. The FW may not
+         * exceed this length when sending A-MPDUs
+         */
+        u8 ampdu_max_length;
+
+        /* This is the minimal spacing required when sending A-MPDUs to the AP*/
+        u8 ampdu_min_spacing;
+} __packed;
+
+/* HT Capabilites Fw Bit Mask Mapping */
+#define WL1271_ACX_FW_CAP_HT_OPERATION                 BIT(0)
+#define WL1271_ACX_FW_CAP_GREENFIELD_FRAME_FORMAT      BIT(1)
+#define WL1271_ACX_FW_CAP_SHORT_GI_FOR_20MHZ_PACKETS   BIT(2)
+#define WL1271_ACX_FW_CAP_LSIG_TXOP_PROTECTION         BIT(3)
+#define WL1271_ACX_FW_CAP_HT_CONTROL_FIELDS            BIT(4)
+#define WL1271_ACX_FW_CAP_RD_INITIATION                BIT(5)
+
+
+/*
+ * ACX_HT_BSS_OPERATION
+ * Configure HT capabilities - AP rules for behavior in the BSS.
+ */
+struct wl1271_acx_ht_information {
+        struct acx_header header;
+
+        /* Values: 0 - RIFS not allowed, 1 - RIFS allowed */
+        u8 rifs_mode;
+
+        /* Values: 0 - 3 like in spec */
+        u8 ht_protection;
+
+        /* Values: 0 - GF protection not required, 1 - GF protection required */
+        u8 gf_protection;
+
+        /*Values: 0 - TX Burst limit not required, 1 - TX Burst Limit required*/
+        u8 ht_tx_burst_limit;
+
+        /*
+         * Values: 0 - Dual CTS protection not required,
+         *         1 - Dual CTS Protection required
+         * Note: When this value is set to 1 FW will protect all TXOP with RTS
+         * frame and will not use CTS-to-self regardless of the value of the
+         * ACX_CTS_PROTECTION information element
+         */
+        u8 dual_cts_protection;
+
+        u8 padding[3];
+} __packed;
+
 struct wl1271_acx_fw_tsf_information {
         struct acx_header header;
 
@@ -1079,7 +1161,7 @@ int wl1271_acx_ac_cfg(struct wl1271 *wl, u8 ac, u8 cw_min, u16 cw_max,
 int wl1271_acx_tid_cfg(struct wl1271 *wl, u8 queue_id, u8 channel_type,
                        u8 tsid, u8 ps_scheme, u8 ack_policy,
                        u32 apsd_conf0, u32 apsd_conf1);
-int wl1271_acx_frag_threshold(struct wl1271 *wl);
+int wl1271_acx_frag_threshold(struct wl1271 *wl, u16 frag_threshold);
 int wl1271_acx_tx_config_options(struct wl1271 *wl);
 int wl1271_acx_mem_cfg(struct wl1271 *wl);
 int wl1271_acx_init_mem_config(struct wl1271 *wl);
@@ -1093,6 +1175,11 @@ int wl1271_acx_keep_alive_config(struct wl1271 *wl, u8 index, u8 tpl_valid);
 int wl1271_acx_rssi_snr_trigger(struct wl1271 *wl, bool enable,
                                 s16 thold, u8 hyst);
 int wl1271_acx_rssi_snr_avg_weights(struct wl1271 *wl);
+int wl1271_acx_set_ht_capabilities(struct wl1271 *wl,
+                                    struct ieee80211_sta_ht_cap *ht_cap,
+                                    bool allow_ht_operation);
+int wl1271_acx_set_ht_information(struct wl1271 *wl,
+                                   u16 ht_operation_mode);
 int wl1271_acx_tsf_info(struct wl1271 *wl, u64 *mactime);
 
 #endif /* __WL1271_ACX_H__ */
diff --git a/drivers/net/wireless/wl12xx/wl1271_boot.c b/drivers/net/wireless/wl12xx/boot.c
index b9102124209..1eafb817583 100644
--- a/drivers/net/wireless/wl12xx/wl1271_boot.c
+++ b/drivers/net/wireless/wl12xx/boot.c
@@ -24,11 +24,11 @@
 #include <linux/gpio.h>
 #include <linux/slab.h>
 
-#include "wl1271_acx.h"
-#include "wl1271_reg.h"
-#include "wl1271_boot.h"
-#include "wl1271_io.h"
-#include "wl1271_event.h"
+#include "acx.h"
+#include "reg.h"
+#include "boot.h"
+#include "io.h"
+#include "event.h"
 
 static struct wl1271_partition_set part_table[PART_TABLE_LEN] = {
         [PART_DOWN] = {
@@ -471,20 +471,19 @@ int wl1271_boot(struct wl1271 *wl)
 {
         int ret = 0;
         u32 tmp, clk, pause;
-        int ref_clock = wl->ref_clock;
 
         wl1271_boot_hw_version(wl);
 
-        if (ref_clock == 0 || ref_clock == 2 || ref_clock == 4)
+        if (wl->ref_clock == 0 || wl->ref_clock == 2 || wl->ref_clock == 4)
                 /* ref clk: 19.2/38.4/38.4-XTAL */
                 clk = 0x3;
-        else if (ref_clock == 1 || ref_clock == 3)
+        else if (wl->ref_clock == 1 || wl->ref_clock == 3)
                 /* ref clk: 26/52 */
                 clk = 0x5;
         else
                 return -EINVAL;
 
-        if (ref_clock != 0) {
+        if (wl->ref_clock != 0) {
                 u16 val;
                 /* Set clock type (open drain) */
                 val = wl1271_top_reg_read(wl, OCP_REG_CLK_TYPE);
@@ -529,8 +528,7 @@ int wl1271_boot(struct wl1271 *wl)
 
         wl1271_debug(DEBUG_BOOT, "clk2 0x%x", clk);
 
-        /* 2 */
-        clk |= (ref_clock << 1) << 4;
+        clk |= (wl->ref_clock << 1) << 4;
         wl1271_write32(wl, DRPW_SCRATCH_START, clk);
 
         wl1271_set_partition(wl, &part_table[PART_WORK]);
diff --git a/drivers/net/wireless/wl12xx/wl1271_boot.h b/drivers/net/wireless/wl12xx/boot.h
index f73b0b15a28..c7d771959f3 100644
--- a/drivers/net/wireless/wl12xx/wl1271_boot.h
+++ b/drivers/net/wireless/wl12xx/boot.h
@@ -24,7 +24,7 @@
 #ifndef __BOOT_H__
 #define __BOOT_H__
 
-#include "wl1271.h"
+#include "wl12xx.h"
 
 int wl1271_boot(struct wl1271 *wl);
 
diff --git a/drivers/net/wireless/wl12xx/wl1271_cmd.c b/drivers/net/wireless/wl12xx/cmd.c
index 5d3e8485ea4..f3d0541aaad 100644
--- a/drivers/net/wireless/wl12xx/wl1271_cmd.c
+++ b/drivers/net/wireless/wl12xx/cmd.c
@@ -29,13 +29,13 @@
 #include <linux/ieee80211.h>
 #include <linux/slab.h>
 
-#include "wl1271.h"
-#include "wl1271_reg.h"
-#include "wl1271_io.h"
-#include "wl1271_acx.h"
+#include "wl12xx.h"
+#include "reg.h"
+#include "io.h"
+#include "acx.h"
 #include "wl12xx_80211.h"
-#include "wl1271_cmd.h"
-#include "wl1271_event.h"
+#include "cmd.h"
+#include "event.h"
 
 #define WL1271_CMD_FAST_POLL_COUNT       50
 
diff --git a/drivers/net/wireless/wl12xx/wl1271_cmd.h b/drivers/net/wireless/wl12xx/cmd.h
index a0caf4fc37b..16d1bf814e7 100644
--- a/drivers/net/wireless/wl12xx/wl1271_cmd.h
+++ b/drivers/net/wireless/wl12xx/cmd.h
@@ -22,10 +22,10 @@
  *
  */
 
-#ifndef __WL1271_CMD_H__
-#define __WL1271_CMD_H__
+#ifndef __CMD_H__
+#define __CMD_H__
 
-#include "wl1271.h"
+#include "wl12xx.h"
 
 struct acx_header;
 
@@ -327,9 +327,6 @@ enum wl1271_channel_tune_bands {
 
 #define WL1271_PD_REFERENCE_POINT_BAND_B_G  0
 
-#define TEST_CMD_P2G_CAL                    0x02
-#define TEST_CMD_CHANNEL_TUNE               0x0d
-#define TEST_CMD_UPDATE_PD_REFERENCE_POINT  0x1d
 #define TEST_CMD_INI_FILE_RADIO_PARAM       0x19
 #define TEST_CMD_INI_FILE_GENERAL_PARAM     0x1E
 #define TEST_CMD_INI_FILE_RF_EXTENDED_PARAM 0x26
@@ -375,51 +372,6 @@ struct wl1271_ext_radio_parms_cmd {
         u8 padding[3];
 } __packed;
 
-struct wl1271_cmd_cal_channel_tune {
-        struct wl1271_cmd_header header;
-
-        struct wl1271_cmd_test_header test;
-
-        u8 band;
-        u8 channel;
-
-        __le16 radio_status;
-} __packed;
-
-struct wl1271_cmd_cal_update_ref_point {
-        struct wl1271_cmd_header header;
-
-        struct wl1271_cmd_test_header test;
-
-        __le32 ref_power;
-        __le32 ref_detector;
-        u8  sub_band;
-        u8  padding[3];
-} __packed;
-
-#define MAX_TLV_LENGTH         400
-#define MAX_NVS_VERSION_LENGTH 12
-
-#define WL1271_CAL_P2G_BAND_B_G BIT(0)
-
-struct wl1271_cmd_cal_p2g {
-        struct wl1271_cmd_header header;
-
-        struct wl1271_cmd_test_header test;
-
-        __le16 len;
-        u8  buf[MAX_TLV_LENGTH];
-        u8  type;
-        u8  padding;
-
-        __le16 radio_status;
-        u8  nvs_version[MAX_NVS_VERSION_LENGTH];
-
-        u8  sub_band_mask;
-        u8  padding2;
-} __packed;
-
-
 /*
  * There are three types of disconnections:
  *
diff --git a/drivers/net/wireless/wl12xx/wl1271_conf.h b/drivers/net/wireless/wl12xx/conf.h
index 5f78a6cb143..a16b3616e43 100644
--- a/drivers/net/wireless/wl12xx/wl1271_conf.h
+++ b/drivers/net/wireless/wl12xx/conf.h
@@ -21,8 +21,8 @@
  *
  */
 
-#ifndef __WL1271_CONF_H__
-#define __WL1271_CONF_H__
+#ifndef __CONF_H__
+#define __CONF_H__
 
 enum {
         CONF_HW_BIT_RATE_1MBPS   = BIT(0),
diff --git a/drivers/net/wireless/wl12xx/wl1271_debugfs.c b/drivers/net/wireless/wl12xx/debugfs.c
index 66c2b90ddfd..dd71b7d2105 100644
--- a/drivers/net/wireless/wl12xx/wl1271_debugfs.c
+++ b/drivers/net/wireless/wl12xx/debugfs.c
@@ -21,31 +21,42 @@
  *
  */
 
-#include "wl1271_debugfs.h"
+#include "debugfs.h"
 
 #include <linux/skbuff.h>
 #include <linux/slab.h>
 
-#include "wl1271.h"
-#include "wl1271_acx.h"
-#include "wl1271_ps.h"
-#include "wl1271_io.h"
+#include "wl12xx.h"
+#include "acx.h"
+#include "ps.h"
+#include "io.h"
 
 /* ms */
 #define WL1271_DEBUGFS_STATS_LIFETIME 1000
 
 /* debugfs macros idea from mac80211 */
+#define DEBUGFS_FORMAT_BUFFER_SIZE 100
+static int wl1271_format_buffer(char __user *userbuf, size_t count,
+                                    loff_t *ppos, char *fmt, ...)
+{
+        va_list args;
+        char buf[DEBUGFS_FORMAT_BUFFER_SIZE];
+        int res;
 
-#define DEBUGFS_READONLY_FILE(name, buflen, fmt, value...)              \
+        va_start(args, fmt);
+        res = vscnprintf(buf, sizeof(buf), fmt, args);
+        va_end(args);
+
+        return simple_read_from_buffer(userbuf, count, ppos, buf, res);
+}
+
+#define DEBUGFS_READONLY_FILE(name, fmt, value...)                      \
 static ssize_t name## _read(struct file *file, char __user *userbuf,    \
                             size_t count, loff_t *ppos)                 \
 {                                                                       \
         struct wl1271 *wl = file->private_data;                         \
-        char buf[buflen];                                               \
-        int res;                                                        \
-                                                                        \
-        res = scnprintf(buf, buflen, fmt "\n", ##value);                \
-        return simple_read_from_buffer(userbuf, count, ppos, buf, res); \
+        return wl1271_format_buffer(userbuf, count, ppos,               \
+                                    fmt "\n", ##value);                 \
 }                                                                       \
                                                                         \
 static const struct file_operations name## _ops = {                     \
@@ -69,20 +80,17 @@ static const struct file_operations name## _ops = {			\
                 wl->debugfs.name = NULL;                                \
         } while (0)
 
-#define DEBUGFS_FWSTATS_FILE(sub, name, buflen, fmt)                    \
+#define DEBUGFS_FWSTATS_FILE(sub, name, fmt)                            \
 static ssize_t sub## _ ##name## _read(struct file *file,                \
                                       char __user *userbuf,             \
                                       size_t count, loff_t *ppos)       \
 {                                                                       \
         struct wl1271 *wl = file->private_data;                         \
-        char buf[buflen];                                               \
-        int res;                                                        \
                                                                         \
         wl1271_debugfs_update_stats(wl);                                \
                                                                         \
-        res = scnprintf(buf, buflen, fmt "\n",                          \
-                        wl->stats.fw_stats->sub.name);                  \
-        return simple_read_from_buffer(userbuf, count, ppos, buf, res); \
+        return wl1271_format_buffer(userbuf, count, ppos, fmt "\n",     \
+                                    wl->stats.fw_stats->sub.name);      \
 }                                                                       \
                                                                         \
 static const struct file_operations sub## _ ##name## _ops = {           \
@@ -126,100 +134,99 @@ static int wl1271_open_file_generic(struct inode *inode, struct file *file)
         return 0;
 }
 
-DEBUGFS_FWSTATS_FILE(tx, internal_desc_overflow, 20, "%u");
-
-DEBUGFS_FWSTATS_FILE(rx, out_of_mem, 20, "%u");
-DEBUGFS_FWSTATS_FILE(rx, hdr_overflow, 20, "%u");
-DEBUGFS_FWSTATS_FILE(rx, hw_stuck, 20, "%u");
-DEBUGFS_FWSTATS_FILE(rx, dropped, 20, "%u");
-DEBUGFS_FWSTATS_FILE(rx, fcs_err, 20, "%u");
-DEBUGFS_FWSTATS_FILE(rx, xfr_hint_trig, 20, "%u");
-DEBUGFS_FWSTATS_FILE(rx, path_reset, 20, "%u");
-DEBUGFS_FWSTATS_FILE(rx, reset_counter, 20, "%u");
-
-DEBUGFS_FWSTATS_FILE(dma, rx_requested, 20, "%u");
-DEBUGFS_FWSTATS_FILE(dma, rx_errors, 20, "%u");
-DEBUGFS_FWSTATS_FILE(dma, tx_requested, 20, "%u");
-DEBUGFS_FWSTATS_FILE(dma, tx_errors, 20, "%u");
-
-DEBUGFS_FWSTATS_FILE(isr, cmd_cmplt, 20, "%u");
-DEBUGFS_FWSTATS_FILE(isr, fiqs, 20, "%u");
-DEBUGFS_FWSTATS_FILE(isr, rx_headers, 20, "%u");
-DEBUGFS_FWSTATS_FILE(isr, rx_mem_overflow, 20, "%u");
-DEBUGFS_FWSTATS_FILE(isr, rx_rdys, 20, "%u");
-DEBUGFS_FWSTATS_FILE(isr, irqs, 20, "%u");
-DEBUGFS_FWSTATS_FILE(isr, tx_procs, 20, "%u");
-DEBUGFS_FWSTATS_FILE(isr, decrypt_done, 20, "%u");
-DEBUGFS_FWSTATS_FILE(isr, dma0_done, 20, "%u");
-DEBUGFS_FWSTATS_FILE(isr, dma1_done, 20, "%u");
-DEBUGFS_FWSTATS_FILE(isr, tx_exch_complete, 20, "%u");
-DEBUGFS_FWSTATS_FILE(isr, commands, 20, "%u");
-DEBUGFS_FWSTATS_FILE(isr, rx_procs, 20, "%u");
-DEBUGFS_FWSTATS_FILE(isr, hw_pm_mode_changes, 20, "%u");
-DEBUGFS_FWSTATS_FILE(isr, host_acknowledges, 20, "%u");
-DEBUGFS_FWSTATS_FILE(isr, pci_pm, 20, "%u");
-DEBUGFS_FWSTATS_FILE(isr, wakeups, 20, "%u");
-DEBUGFS_FWSTATS_FILE(isr, low_rssi, 20, "%u");
-
-DEBUGFS_FWSTATS_FILE(wep, addr_key_count, 20, "%u");
-DEBUGFS_FWSTATS_FILE(wep, default_key_count, 20, "%u");
+DEBUGFS_FWSTATS_FILE(tx, internal_desc_overflow, "%u");
+
+DEBUGFS_FWSTATS_FILE(rx, out_of_mem, "%u");
+DEBUGFS_FWSTATS_FILE(rx, hdr_overflow, "%u");
+DEBUGFS_FWSTATS_FILE(rx, hw_stuck, "%u");
+DEBUGFS_FWSTATS_FILE(rx, dropped, "%u");
+DEBUGFS_FWSTATS_FILE(rx, fcs_err, "%u");
+DEBUGFS_FWSTATS_FILE(rx, xfr_hint_trig, "%u");
+DEBUGFS_FWSTATS_FILE(rx, path_reset, "%u");
+DEBUGFS_FWSTATS_FILE(rx, reset_counter, "%u");
+
+DEBUGFS_FWSTATS_FILE(dma, rx_requested, "%u");
+DEBUGFS_FWSTATS_FILE(dma, rx_errors, "%u");
+DEBUGFS_FWSTATS_FILE(dma, tx_requested, "%u");
+DEBUGFS_FWSTATS_FILE(dma, tx_errors, "%u");
+
+DEBUGFS_FWSTATS_FILE(isr, cmd_cmplt, "%u");
+DEBUGFS_FWSTATS_FILE(isr, fiqs, "%u");
+DEBUGFS_FWSTATS_FILE(isr, rx_headers, "%u");
+DEBUGFS_FWSTATS_FILE(isr, rx_mem_overflow, "%u");
+DEBUGFS_FWSTATS_FILE(isr, rx_rdys, "%u");
+DEBUGFS_FWSTATS_FILE(isr, irqs, "%u");
+DEBUGFS_FWSTATS_FILE(isr, tx_procs, "%u");
+DEBUGFS_FWSTATS_FILE(isr, decrypt_done, "%u");
+DEBUGFS_FWSTATS_FILE(isr, dma0_done, "%u");
+DEBUGFS_FWSTATS_FILE(isr, dma1_done, "%u");
+DEBUGFS_FWSTATS_FILE(isr, tx_exch_complete, "%u");
+DEBUGFS_FWSTATS_FILE(isr, commands, "%u");
+DEBUGFS_FWSTATS_FILE(isr, rx_procs, "%u");
+DEBUGFS_FWSTATS_FILE(isr, hw_pm_mode_changes, "%u");
+DEBUGFS_FWSTATS_FILE(isr, host_acknowledges, "%u");
+DEBUGFS_FWSTATS_FILE(isr, pci_pm, "%u");
+DEBUGFS_FWSTATS_FILE(isr, wakeups, "%u");
+DEBUGFS_FWSTATS_FILE(isr, low_rssi, "%u");
+
+DEBUGFS_FWSTATS_FILE(wep, addr_key_count, "%u");
+DEBUGFS_FWSTATS_FILE(wep, default_key_count, "%u");
 /* skipping wep.reserved */
-DEBUGFS_FWSTATS_FILE(wep, key_not_found, 20, "%u");
-DEBUGFS_FWSTATS_FILE(wep, decrypt_fail, 20, "%u");
-DEBUGFS_FWSTATS_FILE(wep, packets, 20, "%u");
-DEBUGFS_FWSTATS_FILE(wep, interrupt, 20, "%u");
-
-DEBUGFS_FWSTATS_FILE(pwr, ps_enter, 20, "%u");
-DEBUGFS_FWSTATS_FILE(pwr, elp_enter, 20, "%u");
-DEBUGFS_FWSTATS_FILE(pwr, missing_bcns, 20, "%u");
-DEBUGFS_FWSTATS_FILE(pwr, wake_on_host, 20, "%u");
-DEBUGFS_FWSTATS_FILE(pwr, wake_on_timer_exp, 20, "%u");
-DEBUGFS_FWSTATS_FILE(pwr, tx_with_ps, 20, "%u");
-DEBUGFS_FWSTATS_FILE(pwr, tx_without_ps, 20, "%u");
-DEBUGFS_FWSTATS_FILE(pwr, rcvd_beacons, 20, "%u");
-DEBUGFS_FWSTATS_FILE(pwr, power_save_off, 20, "%u");
-DEBUGFS_FWSTATS_FILE(pwr, enable_ps, 20, "%u");
-DEBUGFS_FWSTATS_FILE(pwr, disable_ps, 20, "%u");
-DEBUGFS_FWSTATS_FILE(pwr, fix_tsf_ps, 20, "%u");
+DEBUGFS_FWSTATS_FILE(wep, key_not_found, "%u");
+DEBUGFS_FWSTATS_FILE(wep, decrypt_fail, "%u");
+DEBUGFS_FWSTATS_FILE(wep, packets, "%u");
+DEBUGFS_FWSTATS_FILE(wep, interrupt, "%u");
+
+DEBUGFS_FWSTATS_FILE(pwr, ps_enter, "%u");
+DEBUGFS_FWSTATS_FILE(pwr, elp_enter, "%u");
+DEBUGFS_FWSTATS_FILE(pwr, missing_bcns, "%u");
+DEBUGFS_FWSTATS_FILE(pwr, wake_on_host, "%u");
+DEBUGFS_FWSTATS_FILE(pwr, wake_on_timer_exp, "%u");
+DEBUGFS_FWSTATS_FILE(pwr, tx_with_ps, "%u");
+DEBUGFS_FWSTATS_FILE(pwr, tx_without_ps, "%u");
+DEBUGFS_FWSTATS_FILE(pwr, rcvd_beacons, "%u");
+DEBUGFS_FWSTATS_FILE(pwr, power_save_off, "%u");
+DEBUGFS_FWSTATS_FILE(pwr, enable_ps, "%u");
+DEBUGFS_FWSTATS_FILE(pwr, disable_ps, "%u");
+DEBUGFS_FWSTATS_FILE(pwr, fix_tsf_ps, "%u");
 /* skipping cont_miss_bcns_spread for now */
-DEBUGFS_FWSTATS_FILE(pwr, rcvd_awake_beacons, 20, "%u");
-
-DEBUGFS_FWSTATS_FILE(mic, rx_pkts, 20, "%u");
-DEBUGFS_FWSTATS_FILE(mic, calc_failure, 20, "%u");
-
-DEBUGFS_FWSTATS_FILE(aes, encrypt_fail, 20, "%u");
-DEBUGFS_FWSTATS_FILE(aes, decrypt_fail, 20, "%u");
-DEBUGFS_FWSTATS_FILE(aes, encrypt_packets, 20, "%u");
-DEBUGFS_FWSTATS_FILE(aes, decrypt_packets, 20, "%u");
-DEBUGFS_FWSTATS_FILE(aes, encrypt_interrupt, 20, "%u");
-DEBUGFS_FWSTATS_FILE(aes, decrypt_interrupt, 20, "%u");
-
-DEBUGFS_FWSTATS_FILE(event, heart_beat, 20, "%u");
-DEBUGFS_FWSTATS_FILE(event, calibration, 20, "%u");
-DEBUGFS_FWSTATS_FILE(event, rx_mismatch, 20, "%u");
-DEBUGFS_FWSTATS_FILE(event, rx_mem_empty, 20, "%u");
-DEBUGFS_FWSTATS_FILE(event, rx_pool, 20, "%u");
-DEBUGFS_FWSTATS_FILE(event, oom_late, 20, "%u");
-DEBUGFS_FWSTATS_FILE(event, phy_transmit_error, 20, "%u");
-DEBUGFS_FWSTATS_FILE(event, tx_stuck, 20, "%u");
-
-DEBUGFS_FWSTATS_FILE(ps, pspoll_timeouts, 20, "%u");
-DEBUGFS_FWSTATS_FILE(ps, upsd_timeouts, 20, "%u");
-DEBUGFS_FWSTATS_FILE(ps, upsd_max_sptime, 20, "%u");
-DEBUGFS_FWSTATS_FILE(ps, upsd_max_apturn, 20, "%u");
-DEBUGFS_FWSTATS_FILE(ps, pspoll_max_apturn, 20, "%u");
-DEBUGFS_FWSTATS_FILE(ps, pspoll_utilization, 20, "%u");
-DEBUGFS_FWSTATS_FILE(ps, upsd_utilization, 20, "%u");
-
-DEBUGFS_FWSTATS_FILE(rxpipe, rx_prep_beacon_drop, 20, "%u");
-DEBUGFS_FWSTATS_FILE(rxpipe, descr_host_int_trig_rx_data, 20, "%u");
-DEBUGFS_FWSTATS_FILE(rxpipe, beacon_buffer_thres_host_int_trig_rx_data,
-                     20, "%u");
-DEBUGFS_FWSTATS_FILE(rxpipe, missed_beacon_host_int_trig_rx_data, 20, "%u");
-DEBUGFS_FWSTATS_FILE(rxpipe, tx_xfr_host_int_trig_rx_data, 20, "%u");
-
-DEBUGFS_READONLY_FILE(retry_count, 20, "%u", wl->stats.retry_count);
-DEBUGFS_READONLY_FILE(excessive_retries, 20, "%u",
+DEBUGFS_FWSTATS_FILE(pwr, rcvd_awake_beacons, "%u");
+
+DEBUGFS_FWSTATS_FILE(mic, rx_pkts, "%u");
+DEBUGFS_FWSTATS_FILE(mic, calc_failure, "%u");
+
+DEBUGFS_FWSTATS_FILE(aes, encrypt_fail, "%u");
+DEBUGFS_FWSTATS_FILE(aes, decrypt_fail, "%u");
+DEBUGFS_FWSTATS_FILE(aes, encrypt_packets, "%u");
+DEBUGFS_FWSTATS_FILE(aes, decrypt_packets, "%u");
+DEBUGFS_FWSTATS_FILE(aes, encrypt_interrupt, "%u");
+DEBUGFS_FWSTATS_FILE(aes, decrypt_interrupt, "%u");
+
+DEBUGFS_FWSTATS_FILE(event, heart_beat, "%u");
+DEBUGFS_FWSTATS_FILE(event, calibration, "%u");
+DEBUGFS_FWSTATS_FILE(event, rx_mismatch, "%u");
+DEBUGFS_FWSTATS_FILE(event, rx_mem_empty, "%u");
+DEBUGFS_FWSTATS_FILE(event, rx_pool, "%u");
+DEBUGFS_FWSTATS_FILE(event, oom_late, "%u");
+DEBUGFS_FWSTATS_FILE(event, phy_transmit_error, "%u");
+DEBUGFS_FWSTATS_FILE(event, tx_stuck, "%u");
+
+DEBUGFS_FWSTATS_FILE(ps, pspoll_timeouts, "%u");
+DEBUGFS_FWSTATS_FILE(ps, upsd_timeouts, "%u");
+DEBUGFS_FWSTATS_FILE(ps, upsd_max_sptime, "%u");
+DEBUGFS_FWSTATS_FILE(ps, upsd_max_apturn, "%u");
+DEBUGFS_FWSTATS_FILE(ps, pspoll_max_apturn, "%u");
+DEBUGFS_FWSTATS_FILE(ps, pspoll_utilization, "%u");
+DEBUGFS_FWSTATS_FILE(ps, upsd_utilization, "%u");
+
+DEBUGFS_FWSTATS_FILE(rxpipe, rx_prep_beacon_drop, "%u");
+DEBUGFS_FWSTATS_FILE(rxpipe, descr_host_int_trig_rx_data, "%u");
+DEBUGFS_FWSTATS_FILE(rxpipe, beacon_buffer_thres_host_int_trig_rx_data, "%u");
+DEBUGFS_FWSTATS_FILE(rxpipe, missed_beacon_host_int_trig_rx_data, "%u");
+DEBUGFS_FWSTATS_FILE(rxpipe, tx_xfr_host_int_trig_rx_data, "%u");
+
+DEBUGFS_READONLY_FILE(retry_count, "%u", wl->stats.retry_count);
+DEBUGFS_READONLY_FILE(excessive_retries, "%u",
                       wl->stats.excessive_retries);
 
 static ssize_t tx_queue_len_read(struct file *file, char __user *userbuf,
diff --git a/drivers/net/wireless/wl12xx/wl1271_debugfs.h b/drivers/net/wireless/wl12xx/debugfs.h
index 00a45b2669a..254c5b292cf 100644
--- a/drivers/net/wireless/wl12xx/wl1271_debugfs.h
+++ b/drivers/net/wireless/wl12xx/debugfs.h
@@ -21,10 +21,10 @@
  *
  */
 
-#ifndef WL1271_DEBUGFS_H
-#define WL1271_DEBUGFS_H
+#ifndef __DEBUGFS_H__
+#define __DEBUGFS_H__
 
-#include "wl1271.h"
+#include "wl12xx.h"
 
 int wl1271_debugfs_init(struct wl1271 *wl);
 void wl1271_debugfs_exit(struct wl1271 *wl);
diff --git a/drivers/net/wireless/wl12xx/wl1271_event.c b/drivers/net/wireless/wl12xx/event.c
index 7b3f5038296..f9146f5242f 100644
--- a/drivers/net/wireless/wl12xx/wl1271_event.c
+++ b/drivers/net/wireless/wl12xx/event.c
@@ -21,12 +21,12 @@
  *
  */
 
-#include "wl1271.h"
-#include "wl1271_reg.h"
-#include "wl1271_io.h"
-#include "wl1271_event.h"
-#include "wl1271_ps.h"
-#include "wl1271_scan.h"
+#include "wl12xx.h"
+#include "reg.h"
+#include "io.h"
+#include "event.h"
+#include "ps.h"
+#include "scan.h"
 #include "wl12xx_80211.h"
 
 void wl1271_pspoll_work(struct work_struct *work)
@@ -134,8 +134,6 @@ static int wl1271_event_ps_report(struct wl1271 *wl,
 
                 /* go to extremely low power mode */
                 wl1271_ps_elp_sleep(wl);
-                if (ret < 0)
-                        break;
                 break;
         case EVENT_EXIT_POWER_SAVE_FAIL:
                 wl1271_debug(DEBUG_PSM, "PSM exit failed");
diff --git a/drivers/net/wireless/wl12xx/wl1271_event.h b/drivers/net/wireless/wl12xx/event.h
index e4751667cf5..6cce0143adb 100644
--- a/drivers/net/wireless/wl12xx/wl1271_event.h
+++ b/drivers/net/wireless/wl12xx/event.h
@@ -22,8 +22,8 @@
  *
  */
 
-#ifndef __WL1271_EVENT_H__
-#define __WL1271_EVENT_H__
+#ifndef __EVENT_H__
+#define __EVENT_H__
 
 /*
  * Mbox events
diff --git a/drivers/net/wireless/wl12xx/wl1271_ini.h b/drivers/net/wireless/wl12xx/ini.h
index 2313047d401..c330a2583df 100644
--- a/drivers/net/wireless/wl12xx/wl1271_ini.h
+++ b/drivers/net/wireless/wl12xx/ini.h
@@ -21,8 +21,8 @@
  *
  */
 
-#ifndef __WL1271_INI_H__
-#define __WL1271_INI_H__
+#ifndef __INI_H__
+#define __INI_H__
 
 #define WL1271_INI_MAX_SMART_REFLEX_PARAM 16
 
diff --git a/drivers/net/wireless/wl12xx/wl1271_init.c b/drivers/net/wireless/wl12xx/init.c
index 8044bba70ee..7949d346aad 100644
--- a/drivers/net/wireless/wl12xx/wl1271_init.c
+++ b/drivers/net/wireless/wl12xx/init.c
@@ -25,11 +25,11 @@
 #include <linux/module.h>
 #include <linux/slab.h>
 
-#include "wl1271_init.h"
+#include "init.h"
 #include "wl12xx_80211.h"
-#include "wl1271_acx.h"
-#include "wl1271_cmd.h"
-#include "wl1271_reg.h"
+#include "acx.h"
+#include "cmd.h"
+#include "reg.h"
 
 static int wl1271_init_hwenc_config(struct wl1271 *wl)
 {
@@ -290,7 +290,7 @@ int wl1271_hw_init(struct wl1271 *wl)
                 goto out_free_memmap;
 
         /* Default fragmentation threshold */
-        ret = wl1271_acx_frag_threshold(wl);
+        ret = wl1271_acx_frag_threshold(wl, wl->conf.tx.frag_threshold);
         if (ret < 0)
                 goto out_free_memmap;
 
diff --git a/drivers/net/wireless/wl12xx/wl1271_init.h b/drivers/net/wireless/wl12xx/init.h
index bc26f8c53b9..7762421f860 100644
--- a/drivers/net/wireless/wl12xx/wl1271_init.h
+++ b/drivers/net/wireless/wl12xx/init.h
@@ -21,10 +21,10 @@
  *
  */
 
-#ifndef __WL1271_INIT_H__
-#define __WL1271_INIT_H__
+#ifndef __INIT_H__
+#define __INIT_H__
 
-#include "wl1271.h"
+#include "wl12xx.h"
 
 int wl1271_hw_init_power_auth(struct wl1271 *wl);
 int wl1271_init_templates_config(struct wl1271 *wl);
diff --git a/drivers/net/wireless/wl12xx/wl1271_io.c b/drivers/net/wireless/wl12xx/io.c
index c8759acef13..35c2f1aca6b 100644
--- a/drivers/net/wireless/wl12xx/wl1271_io.c
+++ b/drivers/net/wireless/wl12xx/io.c
@@ -26,9 +26,9 @@
 #include <linux/crc7.h>
 #include <linux/spi/spi.h>
 
-#include "wl1271.h"
+#include "wl12xx.h"
 #include "wl12xx_80211.h"
-#include "wl1271_io.h"
+#include "io.h"
 
 #define OCP_CMD_LOOP  32
 
diff --git a/drivers/net/wireless/wl12xx/wl1271_io.h b/drivers/net/wireless/wl12xx/io.h
index c1f92e65ded..844b32b170b 100644
--- a/drivers/net/wireless/wl12xx/wl1271_io.h
+++ b/drivers/net/wireless/wl12xx/io.h
@@ -22,10 +22,10 @@
  *
  */
 
-#ifndef __WL1271_IO_H__
-#define __WL1271_IO_H__
+#ifndef __IO_H__
+#define __IO_H__
 
-#include "wl1271_reg.h"
+#include "reg.h"
 
 #define HW_ACCESS_MEMORY_MAX_RANGE      0x1FFC0
 
diff --git a/drivers/net/wireless/wl12xx/wl1271_main.c b/drivers/net/wireless/wl12xx/main.c
index 48a4b9961ae..708ffe304c6 100644
--- a/drivers/net/wireless/wl12xx/wl1271_main.c
+++ b/drivers/net/wireless/wl12xx/main.c
@@ -31,20 +31,20 @@
 #include <linux/platform_device.h>
 #include <linux/slab.h>
 
-#include "wl1271.h"
+#include "wl12xx.h"
 #include "wl12xx_80211.h"
-#include "wl1271_reg.h"
-#include "wl1271_io.h"
-#include "wl1271_event.h"
-#include "wl1271_tx.h"
-#include "wl1271_rx.h"
-#include "wl1271_ps.h"
-#include "wl1271_init.h"
-#include "wl1271_debugfs.h"
-#include "wl1271_cmd.h"
-#include "wl1271_boot.h"
-#include "wl1271_testmode.h"
-#include "wl1271_scan.h"
+#include "reg.h"
+#include "io.h"
+#include "event.h"
+#include "tx.h"
+#include "rx.h"
+#include "ps.h"
+#include "init.h"
+#include "debugfs.h"
+#include "cmd.h"
+#include "boot.h"
+#include "testmode.h"
+#include "scan.h"
 
 #define WL1271_BOOT_RETRIES 3
 
@@ -335,6 +335,27 @@ out:
         return NOTIFY_OK;
 }
 
+static int wl1271_reg_notify(struct wiphy *wiphy,
+                             struct regulatory_request *request) {
+        struct ieee80211_supported_band *band;
+        struct ieee80211_channel *ch;
+        int i;
+
+        band = wiphy->bands[IEEE80211_BAND_5GHZ];
+        for (i = 0; i < band->n_channels; i++) {
+                ch = &band->channels[i];
+                if (ch->flags & IEEE80211_CHAN_DISABLED)
+                        continue;
+
+                if (ch->flags & IEEE80211_CHAN_RADAR)
+                        ch->flags |= IEEE80211_CHAN_NO_IBSS |
+                                     IEEE80211_CHAN_PASSIVE_SCAN;
+
+        }
+
+        return 0;
+}
+
 static void wl1271_conf_init(struct wl1271 *wl)
 {
 
@@ -404,7 +425,7 @@ static int wl1271_plt_init(struct wl1271 *wl)
                 goto out_free_memmap;
 
         /* Default fragmentation threshold */
-        ret = wl1271_acx_frag_threshold(wl);
+        ret = wl1271_acx_frag_threshold(wl, wl->conf.tx.frag_threshold);
         if (ret < 0)
                 goto out_free_memmap;
 
@@ -481,9 +502,9 @@ static void wl1271_fw_status(struct wl1271 *wl,
                 total += cnt;
         }
 
-        /* if more blocks are available now, schedule some tx work */
-        if (total && !skb_queue_empty(&wl->tx_queue))
-                ieee80211_queue_work(wl->hw, &wl->tx_work);
+        /* if more blocks are available now, tx work can be scheduled */
+        if (total)
+                clear_bit(WL1271_FLAG_FW_TX_BUSY, &wl->flags);
 
         /* update the host-chipset time offset */
         getnstimeofday(&ts);
@@ -529,6 +550,15 @@ static void wl1271_irq_work(struct work_struct *work)
 
                 intr &= WL1271_INTR_MASK;
 
+                if (unlikely(intr & WL1271_ACX_INTR_WATCHDOG)) {
+                        wl1271_error("watchdog interrupt received! "
+                                     "starting recovery.");
+                        ieee80211_queue_work(wl->hw, &wl->recovery_work);
+
+                        /* restarting the chip. ignore any other interrupt. */
+                        goto out;
+                }
+
                 if (intr & WL1271_ACX_INTR_DATA) {
                         wl1271_debug(DEBUG_IRQ, "WL1271_ACX_INTR_DATA");
 
@@ -537,6 +567,16 @@ static void wl1271_irq_work(struct work_struct *work)
                             (wl->tx_results_count & 0xff))
                                 wl1271_tx_complete(wl);
 
+                        /* Check if any tx blocks were freed */
+                        if (!test_bit(WL1271_FLAG_FW_TX_BUSY, &wl->flags) &&
+                                        !skb_queue_empty(&wl->tx_queue)) {
+                                /*
+                                 * In order to avoid starvation of the TX path,
+                                 * call the work function directly.
+                                 */
+                                wl1271_tx_work_locked(wl);
+                        }
+
                         wl1271_rx(wl, wl->fw_status);
                 }
 
@@ -851,12 +891,32 @@ static int wl1271_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
         struct ieee80211_sta *sta = txinfo->control.sta;
         unsigned long flags;
 
-        /* peek into the rates configured in the STA entry */
+        /*
+         * peek into the rates configured in the STA entry.
+         * The rates set after connection stage, The first block only BG sets:
+         * the compare is for bit 0-16 of sta_rate_set. The second block add
+         * HT rates in case of HT supported.
+         */
         spin_lock_irqsave(&wl->wl_lock, flags);
-        if (sta && sta->supp_rates[conf->channel->band] != wl->sta_rate_set) {
+        if (sta &&
+            (sta->supp_rates[conf->channel->band] !=
+            (wl->sta_rate_set & HW_BG_RATES_MASK))) {
                 wl->sta_rate_set = sta->supp_rates[conf->channel->band];
                 set_bit(WL1271_FLAG_STA_RATES_CHANGED, &wl->flags);
         }
+
+#ifdef CONFIG_WL12XX_HT
+        if (sta &&
+            sta->ht_cap.ht_supported &&
+            ((wl->sta_rate_set >> HW_HT_RATES_OFFSET) !=
+              sta->ht_cap.mcs.rx_mask[0])) {
+                /* Clean MCS bits before setting them */
+                wl->sta_rate_set &= HW_BG_RATES_MASK;
+                wl->sta_rate_set |=
+                        (sta->ht_cap.mcs.rx_mask[0] << HW_HT_RATES_OFFSET);
+                set_bit(WL1271_FLAG_STA_RATES_CHANGED, &wl->flags);
+        }
+#endif
         spin_unlock_irqrestore(&wl->wl_lock, flags);
 
         /* queue the packet */
@@ -867,7 +927,8 @@ static int wl1271_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
          * before that, the tx_work will not be initialized!
          */
 
-        ieee80211_queue_work(wl->hw, &wl->tx_work);
+        if (!test_bit(WL1271_FLAG_FW_TX_BUSY, &wl->flags))
+                ieee80211_queue_work(wl->hw, &wl->tx_work);
 
         /*
          * The workqueue is slow to process the tx_queue and we need stop
@@ -919,18 +980,19 @@ static int wl1271_op_add_interface(struct ieee80211_hw *hw,
         struct wiphy *wiphy = hw->wiphy;
         int retries = WL1271_BOOT_RETRIES;
         int ret = 0;
+        bool booted = false;
 
         wl1271_debug(DEBUG_MAC80211, "mac80211 add interface type %d mac %pM",
                      vif->type, vif->addr);
 
         mutex_lock(&wl->mutex);
         if (wl->vif) {
+                wl1271_debug(DEBUG_MAC80211,
+                             "multiple vifs are not supported yet");
                 ret = -EBUSY;
                 goto out;
         }
 
-        wl->vif = vif;
-
         switch (vif->type) {
         case NL80211_IFTYPE_STATION:
                 wl->bss_type = BSS_TYPE_STA_BSS;
@@ -968,15 +1030,8 @@ static int wl1271_op_add_interface(struct ieee80211_hw *hw,
                 if (ret < 0)
                         goto irq_disable;
 
-                wl->state = WL1271_STATE_ON;
-                wl1271_info("firmware booted (%s)", wl->chip.fw_ver);
-
-                /* update hw/fw version info in wiphy struct */
-                wiphy->hw_version = wl->chip.id;
-                strncpy(wiphy->fw_version, wl->chip.fw_ver,
-                        sizeof(wiphy->fw_version));
-
-                goto out;
+                booted = true;
+                break;
 
 irq_disable:
                 wl1271_disable_interrupts(wl);
@@ -994,8 +1049,21 @@ power_off:
                 wl1271_power_off(wl);
         }
 
-        wl1271_error("firmware boot failed despite %d retries",
-                     WL1271_BOOT_RETRIES);
+        if (!booted) {
+                wl1271_error("firmware boot failed despite %d retries",
+                             WL1271_BOOT_RETRIES);
+                goto out;
+        }
+
+        wl->vif = vif;
+        wl->state = WL1271_STATE_ON;
+        wl1271_info("firmware booted (%s)", wl->chip.fw_ver);
+
+        /* update hw/fw version info in wiphy struct */
+        wiphy->hw_version = wl->chip.id;
+        strncpy(wiphy->fw_version, wl->chip.fw_ver,
+                sizeof(wiphy->fw_version));
+
 out:
         mutex_unlock(&wl->mutex);
 
@@ -1025,6 +1093,7 @@ static void __wl1271_op_remove_interface(struct wl1271 *wl)
                 wl->scan.state = WL1271_SCAN_STATE_IDLE;
                 kfree(wl->scan.scanned_ch);
                 wl->scan.scanned_ch = NULL;
+                wl->scan.req = NULL;
                 ieee80211_scan_completed(wl->hw, true);
         }
 
@@ -1312,8 +1381,10 @@ static int wl1271_op_config(struct ieee80211_hw *hw, u32 changed)
 
         mutex_lock(&wl->mutex);
 
-        if (unlikely(wl->state == WL1271_STATE_OFF))
+        if (unlikely(wl->state == WL1271_STATE_OFF)) {
+                ret = -EAGAIN;
                 goto out;
+        }
 
         ret = wl1271_ps_elp_wakeup(wl, false);
         if (ret < 0)
@@ -1536,6 +1607,11 @@ static int wl1271_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
 
         mutex_lock(&wl->mutex);
 
+        if (unlikely(wl->state == WL1271_STATE_OFF)) {
+                ret = -EAGAIN;
+                goto out_unlock;
+        }
+
         ret = wl1271_ps_elp_wakeup(wl, false);
         if (ret < 0)
                 goto out_unlock;
@@ -1645,6 +1721,16 @@ static int wl1271_op_hw_scan(struct ieee80211_hw *hw,
 
         mutex_lock(&wl->mutex);
 
+        if (wl->state == WL1271_STATE_OFF) {
+                /*
+                 * We cannot return -EBUSY here because cfg80211 will expect
+                 * a call to ieee80211_scan_completed if we do - in this case
+                 * there won't be any call.
+                 */
+                ret = -EAGAIN;
+                goto out;
+        }
+
         ret = wl1271_ps_elp_wakeup(wl, false);
         if (ret < 0)
                 goto out;
@@ -1659,6 +1745,34 @@ out:
         return ret;
 }
 
+static int wl1271_op_set_frag_threshold(struct ieee80211_hw *hw, u32 value)
+{
+        struct wl1271 *wl = hw->priv;
+        int ret = 0;
+
+        mutex_lock(&wl->mutex);
+
+        if (unlikely(wl->state == WL1271_STATE_OFF)) {
+                ret = -EAGAIN;
+                goto out;
+        }
+
+        ret = wl1271_ps_elp_wakeup(wl, false);
+        if (ret < 0)
+                goto out;
+
+        ret = wl1271_acx_frag_threshold(wl, (u16)value);
+        if (ret < 0)
+                wl1271_warning("wl1271_op_set_frag_threshold failed: %d", ret);
+
+        wl1271_ps_elp_sleep(wl);
+
+out:
+        mutex_unlock(&wl->mutex);
+
+        return ret;
+}
+
 static int wl1271_op_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
 {
         struct wl1271 *wl = hw->priv;
@@ -1666,8 +1780,10 @@ static int wl1271_op_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
 
         mutex_lock(&wl->mutex);
 
-        if (unlikely(wl->state == WL1271_STATE_OFF))
+        if (unlikely(wl->state == WL1271_STATE_OFF)) {
+                ret = -EAGAIN;
                 goto out;
+        }
 
         ret = wl1271_ps_elp_wakeup(wl, false);
         if (ret < 0)
@@ -1709,6 +1825,7 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
 {
         enum wl1271_cmd_ps_mode mode;
         struct wl1271 *wl = hw->priv;
+        struct ieee80211_sta *sta = ieee80211_find_sta(vif, bss_conf->bssid);
         bool do_join = false;
         bool set_assoc = false;
         int ret;
@@ -1717,6 +1834,9 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
 
         mutex_lock(&wl->mutex);
 
+        if (unlikely(wl->state == WL1271_STATE_OFF))
+                goto out;
+
         ret = wl1271_ps_elp_wakeup(wl, false);
         if (ret < 0)
                 goto out;
@@ -1891,9 +2011,12 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
 
                         /* Disable the keep-alive feature */
                         ret = wl1271_acx_keep_alive_mode(wl, false);
-
                         if (ret < 0)
                                 goto out_sleep;
+
+                        /* restore the bssid filter and go to dummy bssid */
+                        wl1271_unjoin(wl);
+                        wl1271_dummy_join(wl);
                 }
 
         }
@@ -1927,6 +2050,37 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
                 }
         }
 
+        /*
+         * Takes care of: New association with HT enable,
+         *                HT information change in beacon.
+         */
+        if (sta &&
+            (changed & BSS_CHANGED_HT) &&
+            (bss_conf->channel_type != NL80211_CHAN_NO_HT)) {
+                ret = wl1271_acx_set_ht_capabilities(wl, &sta->ht_cap, true);
+                if (ret < 0) {
+                        wl1271_warning("Set ht cap true failed %d", ret);
+                        goto out_sleep;
+                }
+                        ret = wl1271_acx_set_ht_information(wl,
+                                bss_conf->ht_operation_mode);
+                if (ret < 0) {
+                        wl1271_warning("Set ht information failed %d", ret);
+                        goto out_sleep;
+                }
+        }
+        /*
+         * Takes care of: New association without HT,
+         *                Disassociation.
+         */
+        else if (sta && (changed & BSS_CHANGED_ASSOC)) {
+                ret = wl1271_acx_set_ht_capabilities(wl, &sta->ht_cap, false);
+                if (ret < 0) {
+                        wl1271_warning("Set ht cap false failed %d", ret);
+                        goto out_sleep;
+                }
+        }
+
         if (changed & BSS_CHANGED_ARP_FILTER) {
                 __be32 addr = bss_conf->arp_addr_list[0];
                 WARN_ON(wl->bss_type != BSS_TYPE_STA_BSS);
@@ -1966,6 +2120,11 @@ static int wl1271_op_conf_tx(struct ieee80211_hw *hw, u16 queue,
 
         wl1271_debug(DEBUG_MAC80211, "mac80211 conf tx %d", queue);
 
+        if (unlikely(wl->state == WL1271_STATE_OFF)) {
+                ret = -EAGAIN;
+                goto out;
+        }
+
         ret = wl1271_ps_elp_wakeup(wl, false);
         if (ret < 0)
                 goto out;
@@ -2009,6 +2168,9 @@ static u64 wl1271_op_get_tsf(struct ieee80211_hw *hw)
 
         mutex_lock(&wl->mutex);
 
+        if (unlikely(wl->state == WL1271_STATE_OFF))
+                goto out;
+
         ret = wl1271_ps_elp_wakeup(wl, false);
         if (ret < 0)
                 goto out;
@@ -2030,14 +2192,14 @@ static int wl1271_op_get_survey(struct ieee80211_hw *hw, int idx,
 {
         struct wl1271 *wl = hw->priv;
         struct ieee80211_conf *conf = &hw->conf;
- 
+
         if (idx != 0)
                 return -ENOENT;
- 
+
         survey->channel = conf->channel;
         survey->filled = SURVEY_INFO_NOISE_DBM;
         survey->noise = wl->noise;
- 
+
         return 0;
 }
 
@@ -2084,37 +2246,34 @@ static struct ieee80211_rate wl1271_rates[] = {
           .hw_value_short = CONF_HW_BIT_RATE_54MBPS, },
 };
 
-/*
- * Can't be const, mac80211 writes to this. The order of the channels here
- * is designed to improve scanning.
- */
+/* can't be const, mac80211 writes to this */
 static struct ieee80211_channel wl1271_channels[] = {
         { .hw_value = 1, .center_freq = 2412, .max_power = 25 },
-        { .hw_value = 5, .center_freq = 2432, .max_power = 25 },
-        { .hw_value = 9, .center_freq = 2452, .max_power = 25 },
-        { .hw_value = 13, .center_freq = 2472, .max_power = 25 },
-        { .hw_value = 4, .center_freq = 2427, .max_power = 25 },
-        { .hw_value = 8, .center_freq = 2447, .max_power = 25 },
-        { .hw_value = 12, .center_freq = 2467, .max_power = 25 },
-        { .hw_value = 3, .center_freq = 2422, .max_power = 25 },
-        { .hw_value = 7, .center_freq = 2442, .max_power = 25 },
-        { .hw_value = 11, .center_freq = 2462, .max_power = 25 },
         { .hw_value = 2, .center_freq = 2417, .max_power = 25 },
+        { .hw_value = 3, .center_freq = 2422, .max_power = 25 },
+        { .hw_value = 4, .center_freq = 2427, .max_power = 25 },
+        { .hw_value = 5, .center_freq = 2432, .max_power = 25 },
         { .hw_value = 6, .center_freq = 2437, .max_power = 25 },
+        { .hw_value = 7, .center_freq = 2442, .max_power = 25 },
+        { .hw_value = 8, .center_freq = 2447, .max_power = 25 },
+        { .hw_value = 9, .center_freq = 2452, .max_power = 25 },
         { .hw_value = 10, .center_freq = 2457, .max_power = 25 },
+        { .hw_value = 11, .center_freq = 2462, .max_power = 25 },
+        { .hw_value = 12, .center_freq = 2467, .max_power = 25 },
+        { .hw_value = 13, .center_freq = 2472, .max_power = 25 },
 };
 
 /* mapping to indexes for wl1271_rates */
 static const u8 wl1271_rate_to_idx_2ghz[] = {
         /* MCS rates are used only with 11n */
-        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS7 */
-        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS6 */
-        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS5 */
-        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS4 */
-        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS3 */
-        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS2 */
-        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS1 */
-        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS0 */
+        7,                            /* CONF_HW_RXTX_RATE_MCS7 */
+        6,                            /* CONF_HW_RXTX_RATE_MCS6 */
+        5,                            /* CONF_HW_RXTX_RATE_MCS5 */
+        4,                            /* CONF_HW_RXTX_RATE_MCS4 */
+        3,                            /* CONF_HW_RXTX_RATE_MCS3 */
+        2,                            /* CONF_HW_RXTX_RATE_MCS2 */
+        1,                            /* CONF_HW_RXTX_RATE_MCS1 */
+        0,                            /* CONF_HW_RXTX_RATE_MCS0 */
 
         11,                            /* CONF_HW_RXTX_RATE_54   */
         10,                            /* CONF_HW_RXTX_RATE_48   */
@@ -2134,12 +2293,34 @@ static const u8 wl1271_rate_to_idx_2ghz[] = {
         0                              /* CONF_HW_RXTX_RATE_1    */
 };
 
+/* 11n STA capabilities */
+#define HW_RX_HIGHEST_RATE      72
+
+#ifdef CONFIG_WL12XX_HT
+#define WL12XX_HT_CAP { \
+        .cap = IEEE80211_HT_CAP_GRN_FLD | IEEE80211_HT_CAP_SGI_20, \
+        .ht_supported = true, \
+        .ampdu_factor = IEEE80211_HT_MAX_AMPDU_8K, \
+        .ampdu_density = IEEE80211_HT_MPDU_DENSITY_8, \
+        .mcs = { \
+                .rx_mask = { 0xff, 0, 0, 0, 0, 0, 0, 0, 0, 0, }, \
+                .rx_highest = cpu_to_le16(HW_RX_HIGHEST_RATE), \
+                .tx_params = IEEE80211_HT_MCS_TX_DEFINED, \
+                }, \
+}
+#else
+#define WL12XX_HT_CAP { \
+        .ht_supported = false, \
+}
+#endif
+
 /* can't be const, mac80211 writes to this */
 static struct ieee80211_supported_band wl1271_band_2ghz = {
         .channels = wl1271_channels,
         .n_channels = ARRAY_SIZE(wl1271_channels),
         .bitrates = wl1271_rates,
         .n_bitrates = ARRAY_SIZE(wl1271_rates),
+        .ht_cap = WL12XX_HT_CAP,
 };
 
 /* 5 GHz data rates for WL1273 */
@@ -2170,66 +2351,63 @@ static struct ieee80211_rate wl1271_rates_5ghz[] = {
           .hw_value_short = CONF_HW_BIT_RATE_54MBPS, },
 };
 
-/*
- * 5 GHz band channels for WL1273 - can't be const, mac80211 writes to this.
- * The order of the channels here is designed to improve scanning.
- */
+/* 5 GHz band channels for WL1273 */
 static struct ieee80211_channel wl1271_channels_5ghz[] = {
         { .hw_value = 183, .center_freq = 4915},
-        { .hw_value = 188, .center_freq = 4940},
-        { .hw_value = 8, .center_freq = 5040},
-        { .hw_value = 34, .center_freq = 5170},
-        { .hw_value = 44, .center_freq = 5220},
-        { .hw_value = 60, .center_freq = 5300},
-        { .hw_value = 112, .center_freq = 5560},
-        { .hw_value = 132, .center_freq = 5660},
-        { .hw_value = 157, .center_freq = 5785},
         { .hw_value = 184, .center_freq = 4920},
+        { .hw_value = 185, .center_freq = 4925},
+        { .hw_value = 187, .center_freq = 4935},
+        { .hw_value = 188, .center_freq = 4940},
         { .hw_value = 189, .center_freq = 4945},
-        { .hw_value = 9, .center_freq = 5045},
-        { .hw_value = 36, .center_freq = 5180},
-        { .hw_value = 46, .center_freq = 5230},
-        { .hw_value = 64, .center_freq = 5320},
-        { .hw_value = 116, .center_freq = 5580},
-        { .hw_value = 136, .center_freq = 5680},
         { .hw_value = 192, .center_freq = 4960},
-        { .hw_value = 11, .center_freq = 5055},
-        { .hw_value = 38, .center_freq = 5190},
-        { .hw_value = 48, .center_freq = 5240},
-        { .hw_value = 100, .center_freq = 5500},
-        { .hw_value = 120, .center_freq = 5600},
-        { .hw_value = 140, .center_freq = 5700},
-        { .hw_value = 185, .center_freq = 4925},
         { .hw_value = 196, .center_freq = 4980},
-        { .hw_value = 12, .center_freq = 5060},
-        { .hw_value = 40, .center_freq = 5200},
-        { .hw_value = 52, .center_freq = 5260},
-        { .hw_value = 104, .center_freq = 5520},
-        { .hw_value = 124, .center_freq = 5620},
-        { .hw_value = 149, .center_freq = 5745},
-        { .hw_value = 161, .center_freq = 5805},
-        { .hw_value = 187, .center_freq = 4935},
         { .hw_value = 7, .center_freq = 5035},
+        { .hw_value = 8, .center_freq = 5040},
+        { .hw_value = 9, .center_freq = 5045},
+        { .hw_value = 11, .center_freq = 5055},
+        { .hw_value = 12, .center_freq = 5060},
         { .hw_value = 16, .center_freq = 5080},
+        { .hw_value = 34, .center_freq = 5170},
+        { .hw_value = 36, .center_freq = 5180},
+        { .hw_value = 38, .center_freq = 5190},
+        { .hw_value = 40, .center_freq = 5200},
         { .hw_value = 42, .center_freq = 5210},
+        { .hw_value = 44, .center_freq = 5220},
+        { .hw_value = 46, .center_freq = 5230},
+        { .hw_value = 48, .center_freq = 5240},
+        { .hw_value = 52, .center_freq = 5260},
         { .hw_value = 56, .center_freq = 5280},
+        { .hw_value = 60, .center_freq = 5300},
+        { .hw_value = 64, .center_freq = 5320},
+        { .hw_value = 100, .center_freq = 5500},
+        { .hw_value = 104, .center_freq = 5520},
         { .hw_value = 108, .center_freq = 5540},
+        { .hw_value = 112, .center_freq = 5560},
+        { .hw_value = 116, .center_freq = 5580},
+        { .hw_value = 120, .center_freq = 5600},
+        { .hw_value = 124, .center_freq = 5620},
         { .hw_value = 128, .center_freq = 5640},
+        { .hw_value = 132, .center_freq = 5660},
+        { .hw_value = 136, .center_freq = 5680},
+        { .hw_value = 140, .center_freq = 5700},
+        { .hw_value = 149, .center_freq = 5745},
         { .hw_value = 153, .center_freq = 5765},
+        { .hw_value = 157, .center_freq = 5785},
+        { .hw_value = 161, .center_freq = 5805},
         { .hw_value = 165, .center_freq = 5825},
 };
 
 /* mapping to indexes for wl1271_rates_5ghz */
 static const u8 wl1271_rate_to_idx_5ghz[] = {
         /* MCS rates are used only with 11n */
-        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS7 */
-        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS6 */
-        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS5 */
-        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS4 */
-        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS3 */
-        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS2 */
-        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS1 */
-        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS0 */
+        7,                            /* CONF_HW_RXTX_RATE_MCS7 */
+        6,                            /* CONF_HW_RXTX_RATE_MCS6 */
+        5,                            /* CONF_HW_RXTX_RATE_MCS5 */
+        4,                            /* CONF_HW_RXTX_RATE_MCS4 */
+        3,                            /* CONF_HW_RXTX_RATE_MCS3 */
+        2,                            /* CONF_HW_RXTX_RATE_MCS2 */
+        1,                            /* CONF_HW_RXTX_RATE_MCS1 */
+        0,                            /* CONF_HW_RXTX_RATE_MCS0 */
 
         7,                             /* CONF_HW_RXTX_RATE_54   */
         6,                             /* CONF_HW_RXTX_RATE_48   */
@@ -2254,6 +2432,7 @@ static struct ieee80211_supported_band wl1271_band_5ghz = {
         .n_channels = ARRAY_SIZE(wl1271_channels_5ghz),
         .bitrates = wl1271_rates_5ghz,
         .n_bitrates = ARRAY_SIZE(wl1271_rates_5ghz),
+        .ht_cap = WL12XX_HT_CAP,
 };
 
 static const u8 *wl1271_band_rate_to_idx[] = {
@@ -2273,6 +2452,7 @@ static const struct ieee80211_ops wl1271_ops = {
         .set_key = wl1271_op_set_key,
         .hw_scan = wl1271_op_hw_scan,
         .bss_info_changed = wl1271_op_bss_info_changed,
+        .set_frag_threshold = wl1271_op_set_frag_threshold,
         .set_rts_threshold = wl1271_op_set_rts_threshold,
         .conf_tx = wl1271_op_conf_tx,
         .get_tsf = wl1271_op_get_tsf,
@@ -2281,18 +2461,18 @@ static const struct ieee80211_ops wl1271_ops = {
 };
 
 
-u8 wl1271_rate_to_idx(struct wl1271 *wl, int rate)
+u8 wl1271_rate_to_idx(int rate, enum ieee80211_band band)
 {
         u8 idx;
 
-        BUG_ON(wl->band >= sizeof(wl1271_band_rate_to_idx)/sizeof(u8 *));
+        BUG_ON(band >= sizeof(wl1271_band_rate_to_idx)/sizeof(u8 *));
 
         if (unlikely(rate >= CONF_HW_RXTX_RATE_MAX)) {
                 wl1271_error("Illegal RX rate from HW: %d", rate);
                 return 0;
         }
 
-        idx = wl1271_band_rate_to_idx[wl->band][rate];
+        idx = wl1271_band_rate_to_idx[band][rate];
         if (unlikely(idx == CONF_HW_RXTX_RATE_UNSUPPORTED)) {
                 wl1271_error("Unsupported RX rate from HW: %d", rate);
                 return 0;
@@ -2457,6 +2637,8 @@ int wl1271_init_ieee80211(struct wl1271 *wl)
         wl->hw->queues = 4;
         wl->hw->max_rates = 1;
 
+        wl->hw->wiphy->reg_notifier = wl1271_reg_notify;
+
         SET_IEEE80211_DEV(wl->hw, wl1271_wl_to_dev(wl));
 
         return 0;
@@ -2521,6 +2703,7 @@ struct ieee80211_hw *wl1271_alloc_hw(void)
         wl->sg_enabled = true;
         wl->hw_pg_ver = -1;
 
+        memset(wl->tx_frames_map, 0, sizeof(wl->tx_frames_map));
         for (i = 0; i < ACX_TX_DESCRIPTORS; i++)
                 wl->tx_frames[i] = NULL;
 
diff --git a/drivers/net/wireless/wl12xx/wl1271_ps.c b/drivers/net/wireless/wl12xx/ps.c
index e3c332e2f97..60a3738eadb 100644
--- a/drivers/net/wireless/wl12xx/wl1271_ps.c
+++ b/drivers/net/wireless/wl12xx/ps.c
@@ -21,9 +21,9 @@
  *
  */
 
-#include "wl1271_reg.h"
-#include "wl1271_ps.h"
-#include "wl1271_io.h"
+#include "reg.h"
+#include "ps.h"
+#include "io.h"
 
 #define WL1271_WAKEUP_TIMEOUT 500
 
diff --git a/drivers/net/wireless/wl12xx/wl1271_ps.h b/drivers/net/wireless/wl12xx/ps.h
index 6ba7b032736..8415060f08e 100644
--- a/drivers/net/wireless/wl12xx/wl1271_ps.h
+++ b/drivers/net/wireless/wl12xx/ps.h
@@ -21,11 +21,11 @@
  *
  */
 
-#ifndef __WL1271_PS_H__
-#define __WL1271_PS_H__
+#ifndef __PS_H__
+#define __PS_H__
 
-#include "wl1271.h"
-#include "wl1271_acx.h"
+#include "wl12xx.h"
+#include "acx.h"
 
 int wl1271_ps_set_mode(struct wl1271 *wl, enum wl1271_cmd_ps_mode mode,
                        u32 rates, bool send);
diff --git a/drivers/net/wireless/wl12xx/wl1271_reg.h b/drivers/net/wireless/wl12xx/reg.h
index 99096077152..99096077152 100644
--- a/drivers/net/wireless/wl12xx/wl1271_reg.h
+++ b/drivers/net/wireless/wl12xx/reg.h
diff --git a/drivers/net/wireless/wl12xx/wl1271_rx.c b/drivers/net/wireless/wl12xx/rx.c
index bea133b6e48..682304c30b8 100644
--- a/drivers/net/wireless/wl12xx/wl1271_rx.c
+++ b/drivers/net/wireless/wl12xx/rx.c
@@ -23,11 +23,11 @@
 
 #include <linux/gfp.h>
 
-#include "wl1271.h"
-#include "wl1271_acx.h"
-#include "wl1271_reg.h"
-#include "wl1271_rx.h"
-#include "wl1271_io.h"
+#include "wl12xx.h"
+#include "acx.h"
+#include "reg.h"
+#include "rx.h"
+#include "io.h"
 
 static u8 wl1271_rx_get_mem_block(struct wl1271_fw_status *status,
                                   u32 drv_rx_counter)
@@ -48,10 +48,24 @@ static void wl1271_rx_status(struct wl1271 *wl,
                              struct ieee80211_rx_status *status,
                              u8 beacon)
 {
+        enum ieee80211_band desc_band;
+
         memset(status, 0, sizeof(struct ieee80211_rx_status));
 
         status->band = wl->band;
-        status->rate_idx = wl1271_rate_to_idx(wl, desc->rate);
+
+        if ((desc->flags & WL1271_RX_DESC_BAND_MASK) == WL1271_RX_DESC_BAND_BG)
+                desc_band = IEEE80211_BAND_2GHZ;
+        else
+                desc_band = IEEE80211_BAND_5GHZ;
+
+        status->rate_idx = wl1271_rate_to_idx(desc->rate, desc_band);
+
+#ifdef CONFIG_WL12XX_HT
+        /* 11n support */
+        if (desc->rate <= CONF_HW_RXTX_RATE_MCS0)
+                status->flag |= RX_FLAG_HT;
+#endif
 
         status->signal = desc->rssi;
 
@@ -170,10 +184,14 @@ void wl1271_rx(struct wl1271 *wl, struct wl1271_fw_status *status)
                 while (pkt_offset < buf_size) {
                         pkt_length = wl1271_rx_get_buf_size(status,
                                         drv_rx_counter);
-                        if (wl1271_rx_handle_data(wl,
-                                        wl->aggr_buf + pkt_offset,
-                                        pkt_length) < 0)
-                                break;
+                        /*
+                         * the handle data call can only fail in memory-outage
+                         * conditions, in that case the received frame will just
+                         * be dropped.
+                         */
+                        wl1271_rx_handle_data(wl,
+                                              wl->aggr_buf + pkt_offset,
+                                              pkt_length);
                         wl->rx_counter++;
                         drv_rx_counter++;
                         drv_rx_counter &= NUM_RX_PKT_DESC_MOD_MASK;
diff --git a/drivers/net/wireless/wl12xx/wl1271_rx.h b/drivers/net/wireless/wl12xx/rx.h
index 13a232333b1..3abb26fe036 100644
--- a/drivers/net/wireless/wl12xx/wl1271_rx.h
+++ b/drivers/net/wireless/wl12xx/rx.h
@@ -22,8 +22,8 @@
  *
  */
 
-#ifndef __WL1271_RX_H__
-#define __WL1271_RX_H__
+#ifndef __RX_H__
+#define __RX_H__
 
 #include <linux/bitops.h>
 
@@ -116,6 +116,6 @@ struct wl1271_rx_descriptor {
 } __packed;
 
 void wl1271_rx(struct wl1271 *wl, struct wl1271_fw_status *status);
-u8 wl1271_rate_to_idx(struct wl1271 *wl, int rate);
+u8 wl1271_rate_to_idx(int rate, enum ieee80211_band band);
 
 #endif
diff --git a/drivers/net/wireless/wl12xx/wl1271_scan.c b/drivers/net/wireless/wl12xx/scan.c
index 909bb47995b..f3f2c5b011e 100644
--- a/drivers/net/wireless/wl12xx/wl1271_scan.c
+++ b/drivers/net/wireless/wl12xx/scan.c
@@ -23,10 +23,10 @@
 
 #include <linux/ieee80211.h>
 
-#include "wl1271.h"
-#include "wl1271_cmd.h"
-#include "wl1271_scan.h"
-#include "wl1271_acx.h"
+#include "wl12xx.h"
+#include "cmd.h"
+#include "scan.h"
+#include "acx.h"
 
 void wl1271_scan_complete_work(struct work_struct *work)
 {
@@ -48,14 +48,15 @@ void wl1271_scan_complete_work(struct work_struct *work)
         wl->scan.state = WL1271_SCAN_STATE_IDLE;
         kfree(wl->scan.scanned_ch);
         wl->scan.scanned_ch = NULL;
-        mutex_unlock(&wl->mutex);
-
+        wl->scan.req = NULL;
         ieee80211_scan_completed(wl->hw, false);
 
         if (wl->scan.failed) {
                 wl1271_info("Scan completed due to error.");
                 ieee80211_queue_work(wl->hw, &wl->recovery_work);
         }
+        mutex_unlock(&wl->mutex);
+
 }
 
 
diff --git a/drivers/net/wireless/wl12xx/wl1271_scan.h b/drivers/net/wireless/wl12xx/scan.h
index 6d57127b5e6..421a750add5 100644
--- a/drivers/net/wireless/wl12xx/wl1271_scan.h
+++ b/drivers/net/wireless/wl12xx/scan.h
@@ -21,10 +21,10 @@
  *
  */
 
-#ifndef __WL1271_SCAN_H__
-#define __WL1271_SCAN_H__
+#ifndef __SCAN_H__
+#define __SCAN_H__
 
-#include "wl1271.h"
+#include "wl12xx.h"
 
 int wl1271_scan(struct wl1271 *wl, const u8 *ssid, size_t ssid_len,
                 struct cfg80211_scan_request *req);
diff --git a/drivers/net/wireless/wl12xx/wl1271_sdio.c b/drivers/net/wireless/wl12xx/sdio.c
index 784ef343264..93cbb8d5aba 100644
--- a/drivers/net/wireless/wl12xx/wl1271_sdio.c
+++ b/drivers/net/wireless/wl12xx/sdio.c
@@ -32,9 +32,9 @@
 #include <linux/wl12xx.h>
 #include <linux/pm_runtime.h>
 
-#include "wl1271.h"
+#include "wl12xx.h"
 #include "wl12xx_80211.h"
-#include "wl1271_io.h"
+#include "io.h"
 
 #ifndef SDIO_VENDOR_ID_TI
 #define SDIO_VENDOR_ID_TI               0x0097
diff --git a/drivers/net/wireless/wl12xx/wl1271_spi.c b/drivers/net/wireless/wl12xx/spi.c
index ef801680773..46714910f98 100644
--- a/drivers/net/wireless/wl12xx/wl1271_spi.c
+++ b/drivers/net/wireless/wl12xx/spi.c
@@ -28,11 +28,11 @@
 #include <linux/wl12xx.h>
 #include <linux/slab.h>
 
-#include "wl1271.h"
+#include "wl12xx.h"
 #include "wl12xx_80211.h"
-#include "wl1271_io.h"
+#include "io.h"
 
-#include "wl1271_reg.h"
+#include "reg.h"
 
 #define WSPI_CMD_READ                 0x40000000
 #define WSPI_CMD_WRITE                0x00000000
diff --git a/drivers/net/wireless/wl12xx/wl1271_testmode.c b/drivers/net/wireless/wl12xx/testmode.c
index a3aa84386c8..e64403b6896 100644
--- a/drivers/net/wireless/wl12xx/wl1271_testmode.c
+++ b/drivers/net/wireless/wl12xx/testmode.c
@@ -20,13 +20,13 @@
  * 02110-1301 USA
  *
  */
-#include "wl1271_testmode.h"
+#include "testmode.h"
 
 #include <linux/slab.h>
 #include <net/genetlink.h>
 
-#include "wl1271.h"
-#include "wl1271_acx.h"
+#include "wl12xx.h"
+#include "acx.h"
 
 #define WL1271_TM_MAX_DATA_LENGTH 1024
 
@@ -37,6 +37,7 @@ enum wl1271_tm_commands {
         WL1271_TM_CMD_CONFIGURE,
         WL1271_TM_CMD_NVS_PUSH,
         WL1271_TM_CMD_SET_PLT_MODE,
+        WL1271_TM_CMD_RECOVER,
 
         __WL1271_TM_CMD_AFTER_LAST
 };
@@ -248,6 +249,15 @@ static int wl1271_tm_cmd_set_plt_mode(struct wl1271 *wl, struct nlattr *tb[])
         return ret;
 }
 
+static int wl1271_tm_cmd_recover(struct wl1271 *wl, struct nlattr *tb[])
+{
+        wl1271_debug(DEBUG_TESTMODE, "testmode cmd recover");
+
+        ieee80211_queue_work(wl->hw, &wl->recovery_work);
+
+        return 0;
+}
+
 int wl1271_tm_cmd(struct ieee80211_hw *hw, void *data, int len)
 {
         struct wl1271 *wl = hw->priv;
@@ -272,6 +282,8 @@ int wl1271_tm_cmd(struct ieee80211_hw *hw, void *data, int len)
                 return wl1271_tm_cmd_nvs_push(wl, tb);
         case WL1271_TM_CMD_SET_PLT_MODE:
                 return wl1271_tm_cmd_set_plt_mode(wl, tb);
+        case WL1271_TM_CMD_RECOVER:
+                return wl1271_tm_cmd_recover(wl, tb);
         default:
                 return -EOPNOTSUPP;
         }
diff --git a/drivers/net/wireless/wl12xx/wl1271_testmode.h b/drivers/net/wireless/wl12xx/testmode.h
index c196d28f9d9..8071654259e 100644
--- a/drivers/net/wireless/wl12xx/wl1271_testmode.h
+++ b/drivers/net/wireless/wl12xx/testmode.h
@@ -21,8 +21,8 @@
  *
  */
 
-#ifndef __WL1271_TESTMODE_H__
-#define __WL1271_TESTMODE_H__
+#ifndef __TESTMODE_H__
+#define __TESTMODE_H__
 
 #include <net/mac80211.h>
 
diff --git a/drivers/net/wireless/wl12xx/wl1271_tx.c b/drivers/net/wireless/wl12xx/tx.c
index e3dc13c4d01..d332b3f6d0f 100644
--- a/drivers/net/wireless/wl12xx/wl1271_tx.c
+++ b/drivers/net/wireless/wl12xx/tx.c
@@ -24,23 +24,32 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 
-#include "wl1271.h"
-#include "wl1271_io.h"
-#include "wl1271_reg.h"
-#include "wl1271_ps.h"
-#include "wl1271_tx.h"
+#include "wl12xx.h"
+#include "io.h"
+#include "reg.h"
+#include "ps.h"
+#include "tx.h"
 
-static int wl1271_tx_id(struct wl1271 *wl, struct sk_buff *skb)
+static int wl1271_alloc_tx_id(struct wl1271 *wl, struct sk_buff *skb)
 {
-        int i;
-        for (i = 0; i < ACX_TX_DESCRIPTORS; i++)
-                if (wl->tx_frames[i] == NULL) {
-                        wl->tx_frames[i] = skb;
-                        wl->tx_frames_cnt++;
-                        return i;
-                }
+        int id;
+
+        id = find_first_zero_bit(wl->tx_frames_map, ACX_TX_DESCRIPTORS);
+        if (id >= ACX_TX_DESCRIPTORS)
+                return -EBUSY;
+
+        __set_bit(id, wl->tx_frames_map);
+        wl->tx_frames[id] = skb;
+        wl->tx_frames_cnt++;
+        return id;
+}
 
-        return -EBUSY;
+static void wl1271_free_tx_id(struct wl1271 *wl, int id)
+{
+        if (__test_and_clear_bit(id, wl->tx_frames_map)) {
+                wl->tx_frames[id] = NULL;
+                wl->tx_frames_cnt--;
+        }
 }
 
 static int wl1271_tx_allocate(struct wl1271 *wl, struct sk_buff *skb, u32 extra,
@@ -52,10 +61,10 @@ static int wl1271_tx_allocate(struct wl1271 *wl, struct sk_buff *skb, u32 extra,
         int id, ret = -EBUSY;
 
         if (buf_offset + total_len > WL1271_AGGR_BUFFER_SIZE)
-                return -EBUSY;
+                return -EAGAIN;
 
         /* allocate free identifier for the packet */
-        id = wl1271_tx_id(wl, skb);
+        id = wl1271_alloc_tx_id(wl, skb);
         if (id < 0)
                 return id;
 
@@ -79,8 +88,7 @@ static int wl1271_tx_allocate(struct wl1271 *wl, struct sk_buff *skb, u32 extra,
                              "tx_allocate: size: %d, blocks: %d, id: %d",
                              total_len, total_blocks, id);
         } else {
-                wl->tx_frames[id] = NULL;
-                wl->tx_frames_cnt--;
+                wl1271_free_tx_id(wl, id);
         }
 
         return ret;
@@ -201,41 +209,67 @@ u32 wl1271_tx_enabled_rates_get(struct wl1271 *wl, u32 rate_set)
                 rate_set >>= 1;
         }
 
+#ifdef CONFIG_WL12XX_HT
+        /* MCS rates indication are on bits 16 - 23 */
+        rate_set >>= HW_HT_RATES_OFFSET - band->n_bitrates;
+
+        for (bit = 0; bit < 8; bit++) {
+                if (rate_set & 0x1)
+                        enabled_rates |= (CONF_HW_BIT_RATE_MCS_0 << bit);
+                rate_set >>= 1;
+        }
+#endif
+
         return enabled_rates;
 }
 
-void wl1271_tx_work(struct work_struct *work)
+static void handle_tx_low_watermark(struct wl1271 *wl)
+{
+        unsigned long flags;
+
+        if (test_bit(WL1271_FLAG_TX_QUEUE_STOPPED, &wl->flags) &&
+            skb_queue_len(&wl->tx_queue) <= WL1271_TX_QUEUE_LOW_WATERMARK) {
+                /* firmware buffer has space, restart queues */
+                spin_lock_irqsave(&wl->wl_lock, flags);
+                ieee80211_wake_queues(wl->hw);
+                clear_bit(WL1271_FLAG_TX_QUEUE_STOPPED, &wl->flags);
+                spin_unlock_irqrestore(&wl->wl_lock, flags);
+        }
+}
+
+void wl1271_tx_work_locked(struct wl1271 *wl)
 {
-        struct wl1271 *wl = container_of(work, struct wl1271, tx_work);
         struct sk_buff *skb;
         bool woken_up = false;
         u32 sta_rates = 0;
-        u32 buf_offset;
+        u32 buf_offset = 0;
+        bool sent_packets = false;
         int ret;
 
         /* check if the rates supported by the AP have changed */
         if (unlikely(test_and_clear_bit(WL1271_FLAG_STA_RATES_CHANGED,
                                         &wl->flags))) {
                 unsigned long flags;
+
                 spin_lock_irqsave(&wl->wl_lock, flags);
                 sta_rates = wl->sta_rate_set;
                 spin_unlock_irqrestore(&wl->wl_lock, flags);
         }
 
-        mutex_lock(&wl->mutex);
-
         if (unlikely(wl->state == WL1271_STATE_OFF))
                 goto out;
 
         /* if rates have changed, re-configure the rate policy */
         if (unlikely(sta_rates)) {
+                ret = wl1271_ps_elp_wakeup(wl, false);
+                if (ret < 0)
+                        goto out;
+                woken_up = true;
+
                 wl->rate_set = wl1271_tx_enabled_rates_get(wl, sta_rates);
                 wl1271_acx_rate_policies(wl);
         }
 
-        /* Prepare the transfer buffer, by aggregating all
-         * available packets */
-        buf_offset = 0;
         while ((skb = skb_dequeue(&wl->tx_queue))) {
                 if (!woken_up) {
                         ret = wl1271_ps_elp_wakeup(wl, false);
@@ -245,13 +279,25 @@ void wl1271_tx_work(struct work_struct *work)
                 }
 
                 ret = wl1271_prepare_tx_frame(wl, skb, buf_offset);
-                if (ret == -EBUSY) {
+                if (ret == -EAGAIN) {
+                        /*
+                         * Aggregation buffer is full.
+                         * Flush buffer and try again.
+                         */
+                        skb_queue_head(&wl->tx_queue, skb);
+                        wl1271_write(wl, WL1271_SLV_MEM_DATA, wl->aggr_buf,
+                                buf_offset, true);
+                        sent_packets = true;
+                        buf_offset = 0;
+                        continue;
+                } else if (ret == -EBUSY) {
                         /*
-                         * Either the firmware buffer is full, or the
-                         * aggregation buffer is.
+                         * Firmware buffer is full.
                          * Queue back last skb, and stop aggregating.
                          */
                         skb_queue_head(&wl->tx_queue, skb);
+                        /* No work left, avoid scheduling redundant tx work */
+                        set_bit(WL1271_FLAG_FW_TX_BUSY, &wl->flags);
                         goto out_ack;
                 } else if (ret < 0) {
                         dev_kfree_skb(skb);
@@ -265,14 +311,25 @@ out_ack:
         if (buf_offset) {
                 wl1271_write(wl, WL1271_SLV_MEM_DATA, wl->aggr_buf,
                                 buf_offset, true);
+                sent_packets = true;
+        }
+        if (sent_packets) {
                 /* interrupt the firmware with the new packets */
                 wl1271_write32(wl, WL1271_HOST_WR_ACCESS, wl->tx_packets_count);
+                handle_tx_low_watermark(wl);
         }
 
 out:
         if (woken_up)
                 wl1271_ps_elp_sleep(wl);
+}
+
+void wl1271_tx_work(struct work_struct *work)
+{
+        struct wl1271 *wl = container_of(work, struct wl1271, tx_work);
 
+        mutex_lock(&wl->mutex);
+        wl1271_tx_work_locked(wl);
         mutex_unlock(&wl->mutex);
 }
 
@@ -298,7 +355,7 @@ static void wl1271_tx_complete_packet(struct wl1271 *wl,
         if (result->status == TX_SUCCESS) {
                 if (!(info->flags & IEEE80211_TX_CTL_NO_ACK))
                         info->flags |= IEEE80211_TX_STAT_ACK;
-                rate = wl1271_rate_to_idx(wl, result->rate_class_index);
+                rate = wl1271_rate_to_idx(result->rate_class_index, wl->band);
                 retries = result->ack_failures;
         } else if (result->status == TX_RETRY_EXCEEDED) {
                 wl->stats.excessive_retries++;
@@ -335,8 +392,7 @@ static void wl1271_tx_complete_packet(struct wl1271 *wl,
 
         /* return the packet to the stack */
         ieee80211_tx_status(wl->hw, skb);
-        wl->tx_frames[result->id] = NULL;
-        wl->tx_frames_cnt--;
+        wl1271_free_tx_id(wl, result->id);
 }
 
 /* Called upon reception of a TX complete interrupt */
@@ -375,19 +431,6 @@ void wl1271_tx_complete(struct wl1271 *wl)
 
                 wl->tx_results_count++;
         }
-
-        if (test_bit(WL1271_FLAG_TX_QUEUE_STOPPED, &wl->flags) &&
-            skb_queue_len(&wl->tx_queue) <= WL1271_TX_QUEUE_LOW_WATERMARK) {
-                unsigned long flags;
-
-                /* firmware buffer has space, restart queues */
-                wl1271_debug(DEBUG_TX, "tx_complete: waking queues");
-                spin_lock_irqsave(&wl->wl_lock, flags);
-                ieee80211_wake_queues(wl->hw);
-                clear_bit(WL1271_FLAG_TX_QUEUE_STOPPED, &wl->flags);
-                spin_unlock_irqrestore(&wl->wl_lock, flags);
-                ieee80211_queue_work(wl->hw, &wl->tx_work);
-        }
 }
 
 /* caller must hold wl->mutex */
@@ -402,14 +445,19 @@ void wl1271_tx_reset(struct wl1271 *wl)
                 ieee80211_tx_status(wl->hw, skb);
         }
 
+        /*
+         * Make sure the driver is at a consistent state, in case this
+         * function is called from a context other than interface removal.
+         */
+        handle_tx_low_watermark(wl);
+
         for (i = 0; i < ACX_TX_DESCRIPTORS; i++)
                 if (wl->tx_frames[i] != NULL) {
                         skb = wl->tx_frames[i];
-                        wl->tx_frames[i] = NULL;
+                        wl1271_free_tx_id(wl, i);
                         wl1271_debug(DEBUG_TX, "freeing skb 0x%p", skb);
                         ieee80211_tx_status(wl->hw, skb);
                 }
-        wl->tx_frames_cnt = 0;
 }
 
 #define WL1271_TX_FLUSH_TIMEOUT 500000
diff --git a/drivers/net/wireless/wl12xx/wl1271_tx.h b/drivers/net/wireless/wl12xx/tx.h
index d12a129ad11..903e5dc69b7 100644
--- a/drivers/net/wireless/wl12xx/wl1271_tx.h
+++ b/drivers/net/wireless/wl12xx/tx.h
@@ -22,8 +22,8 @@
  *
  */
 
-#ifndef __WL1271_TX_H__
-#define __WL1271_TX_H__
+#ifndef __TX_H__
+#define __TX_H__
 
 #define TX_HW_BLOCK_SPARE                2
 #define TX_HW_BLOCK_SIZE                 252
@@ -140,10 +140,11 @@ static inline int wl1271_tx_get_queue(int queue)
 }
 
 void wl1271_tx_work(struct work_struct *work);
+void wl1271_tx_work_locked(struct wl1271 *wl);
 void wl1271_tx_complete(struct wl1271 *wl);
 void wl1271_tx_reset(struct wl1271 *wl);
 void wl1271_tx_flush(struct wl1271 *wl);
-u8 wl1271_rate_to_idx(struct wl1271 *wl, int rate);
+u8 wl1271_rate_to_idx(int rate, enum ieee80211_band band);
 u32 wl1271_tx_enabled_rates_get(struct wl1271 *wl, u32 rate_set);
 
 #endif
diff --git a/drivers/net/wireless/wl12xx/wl1271.h b/drivers/net/wireless/wl12xx/wl12xx.h
index 8a4cd763e5a..3c836e6063e 100644
--- a/drivers/net/wireless/wl12xx/wl1271.h
+++ b/drivers/net/wireless/wl12xx/wl12xx.h
@@ -22,8 +22,8 @@
  *
  */
 
-#ifndef __WL1271_H__
-#define __WL1271_H__
+#ifndef __WL12XX_H__
+#define __WL12XX_H__
 
 #include <linux/mutex.h>
 #include <linux/completion.h>
@@ -32,8 +32,8 @@
 #include <linux/bitops.h>
 #include <net/mac80211.h>
 
-#include "wl1271_conf.h"
-#include "wl1271_ini.h"
+#include "conf.h"
+#include "ini.h"
 
 #define DRIVER_NAME "wl1271"
 #define DRIVER_PREFIX DRIVER_NAME ": "
@@ -351,6 +351,7 @@ struct wl1271 {
 #define WL1271_FLAG_IDLE_REQUESTED    (11)
 #define WL1271_FLAG_PSPOLL_FAILURE    (12)
 #define WL1271_FLAG_STA_STATE_SENT    (13)
+#define WL1271_FLAG_FW_TX_BUSY        (14)
         unsigned long flags;
 
         struct wl1271_partition_set part;
@@ -397,6 +398,7 @@ struct wl1271 {
         struct work_struct tx_work;
 
         /* Pending TX frames */
+        unsigned long tx_frames_map[BITS_TO_LONGS(ACX_TX_DESCRIPTORS)];
         struct sk_buff *tx_frames[ACX_TX_DESCRIPTORS];
         int tx_frames_cnt;
 
@@ -432,7 +434,12 @@ struct wl1271 {
         /* Our association ID */
         u16 aid;
 
-        /* currently configured rate set */
+        /*
+         * currently configured rate set:
+         *      bits  0-15 - 802.11abg rates
+         *      bits 16-23 - 802.11n   MCS index mask
+         * support only 1 stream, thus only 8 bits for the MCS rates (0-7).
+         */
         u32 sta_rate_set;
         u32 basic_rate_set;
         u32 basic_rate;
@@ -509,4 +516,8 @@ int wl1271_plt_stop(struct wl1271 *wl);
 #define WL1271_PRE_POWER_ON_SLEEP 20 /* in miliseconds */
 #define WL1271_POWER_ON_SLEEP 200 /* in miliseconds */
 
+/* Macros to handle wl1271.sta_rate_set */
+#define HW_BG_RATES_MASK        0xffff
+#define HW_HT_RATES_OFFSET      16
+
 #endif
diff --git a/drivers/net/wireless/zd1201.c b/drivers/net/wireless/zd1201.c
index 390d77f762c..b97aa9c78a9 100644
--- a/drivers/net/wireless/zd1201.c
+++ b/drivers/net/wireless/zd1201.c
@@ -30,6 +30,7 @@ static struct usb_device_id zd1201_table[] = {
         {USB_DEVICE(0x0ace, 0x1201)}, /* ZyDAS ZD1201 Wireless USB Adapter */
         {USB_DEVICE(0x050d, 0x6051)}, /* Belkin F5D6051 usb  adapter */
         {USB_DEVICE(0x0db0, 0x6823)}, /* MSI UB11B usb  adapter */
+        {USB_DEVICE(0x1044, 0x8004)}, /* Gigabyte GN-WLBZ101 */
         {USB_DEVICE(0x1044, 0x8005)}, /* GIGABYTE GN-WLBZ201 usb adapter */
         {}
 };
diff --git a/drivers/net/wireless/zd1211rw/zd_chip.c b/drivers/net/wireless/zd1211rw/zd_chip.c
index 87a95bcfee5..6a9b66051cf 100644
--- a/drivers/net/wireless/zd1211rw/zd_chip.c
+++ b/drivers/net/wireless/zd1211rw/zd_chip.c
@@ -117,6 +117,7 @@ int zd_ioread32v_locked(struct zd_chip *chip, u32 *values, const zd_addr_t *addr
 
         /* Allocate a single memory block for values and addresses. */
         count16 = 2*count;
+        /* zd_addr_t is __nocast, so the kmalloc needs an explicit cast */
         a16 = (zd_addr_t *) kmalloc(count16 * (sizeof(zd_addr_t) + sizeof(u16)),
                                    GFP_KERNEL);
         if (!a16) {
@@ -1448,7 +1449,7 @@ int zd_rfwritev_locked(struct zd_chip *chip,
  */
 int zd_rfwrite_cr_locked(struct zd_chip *chip, u32 value)
 {
-        struct zd_ioreq16 ioreqs[] = {
+        const struct zd_ioreq16 ioreqs[] = {
                 { CR244, (value >> 16) & 0xff },
                 { CR243, (value >>  8) & 0xff },
                 { CR242,  value        & 0xff },
@@ -1475,7 +1476,7 @@ int zd_rfwritev_cr_locked(struct zd_chip *chip,
 int zd_chip_set_multicast_hash(struct zd_chip *chip,
                                struct zd_mc_hash *hash)
 {
-        struct zd_ioreq32 ioreqs[] = {
+        const struct zd_ioreq32 ioreqs[] = {
                 { CR_GROUP_HASH_P1, hash->low },
                 { CR_GROUP_HASH_P2, hash->high },
         };
diff --git a/drivers/net/wireless/zd1211rw/zd_usb.c b/drivers/net/wireless/zd1211rw/zd_usb.c
index 818e1480ca9..06041cb1c42 100644
--- a/drivers/net/wireless/zd1211rw/zd_usb.c
+++ b/drivers/net/wireless/zd1211rw/zd_usb.c
@@ -55,6 +55,7 @@ static struct usb_device_id usb_ids[] = {
         { USB_DEVICE(0x129b, 0x1666), .driver_info = DEVICE_ZD1211 },
         { USB_DEVICE(0x13b1, 0x001e), .driver_info = DEVICE_ZD1211 },
         { USB_DEVICE(0x1435, 0x0711), .driver_info = DEVICE_ZD1211 },
+        { USB_DEVICE(0x14ea, 0xab10), .driver_info = DEVICE_ZD1211 },
         { USB_DEVICE(0x14ea, 0xab13), .driver_info = DEVICE_ZD1211 },
         { USB_DEVICE(0x157e, 0x300a), .driver_info = DEVICE_ZD1211 },
         { USB_DEVICE(0x157e, 0x300b), .driver_info = DEVICE_ZD1211 },
@@ -92,6 +93,7 @@ static struct usb_device_id usb_ids[] = {
         { USB_DEVICE(0x157e, 0x300d), .driver_info = DEVICE_ZD1211B },
         { USB_DEVICE(0x1582, 0x6003), .driver_info = DEVICE_ZD1211B },
         { USB_DEVICE(0x2019, 0x5303), .driver_info = DEVICE_ZD1211B },
+        { USB_DEVICE(0x2019, 0xed01), .driver_info = DEVICE_ZD1211B },
         /* "Driverless" devices that need ejecting */
         { USB_DEVICE(0x0ace, 0x2011), .driver_info = DEVICE_INSTALLER },
         { USB_DEVICE(0x0ace, 0x20ff), .driver_info = DEVICE_INSTALLER },
diff --git a/drivers/net/xilinx_emaclite.c b/drivers/net/xilinx_emaclite.c
index 14f0955eca6..de6c3086d23 100644
--- a/drivers/net/xilinx_emaclite.c
+++ b/drivers/net/xilinx_emaclite.c
@@ -515,7 +515,7 @@ static void xemaclite_update_address(struct net_local *drvdata,
  */
 static int xemaclite_set_mac_address(struct net_device *dev, void *address)
 {
-        struct net_local *lp = (struct net_local *) netdev_priv(dev);
+        struct net_local *lp = netdev_priv(dev);
         struct sockaddr *addr = address;
 
         if (netif_running(dev))
@@ -534,7 +534,7 @@ static int xemaclite_set_mac_address(struct net_device *dev, void *address)
  */
 static void xemaclite_tx_timeout(struct net_device *dev)
 {
-        struct net_local *lp = (struct net_local *) netdev_priv(dev);
+        struct net_local *lp = netdev_priv(dev);
         unsigned long flags;
 
         dev_err(&lp->ndev->dev, "Exceeded transmit timeout of %lu ms\n",
@@ -578,7 +578,7 @@ static void xemaclite_tx_timeout(struct net_device *dev)
  */
 static void xemaclite_tx_handler(struct net_device *dev)
 {
-        struct net_local *lp = (struct net_local *) netdev_priv(dev);
+        struct net_local *lp = netdev_priv(dev);
 
         dev->stats.tx_packets++;
         if (lp->deferred_skb) {
@@ -605,7 +605,7 @@ static void xemaclite_tx_handler(struct net_device *dev)
  */
 static void xemaclite_rx_handler(struct net_device *dev)
 {
-        struct net_local *lp = (struct net_local *) netdev_priv(dev);
+        struct net_local *lp = netdev_priv(dev);
         struct sk_buff *skb;
         unsigned int align;
         u32 len;
@@ -661,7 +661,7 @@ static irqreturn_t xemaclite_interrupt(int irq, void *dev_id)
 {
         bool tx_complete = 0;
         struct net_device *dev = dev_id;
-        struct net_local *lp = (struct net_local *) netdev_priv(dev);
+        struct net_local *lp = netdev_priv(dev);
         void __iomem *base_addr = lp->base_addr;
         u32 tx_status;
 
@@ -918,7 +918,7 @@ void xemaclite_adjust_link(struct net_device *ndev)
  */
 static int xemaclite_open(struct net_device *dev)
 {
-        struct net_local *lp = (struct net_local *) netdev_priv(dev);
+        struct net_local *lp = netdev_priv(dev);
         int retval;
 
         /* Just to be safe, stop the device first */
@@ -987,7 +987,7 @@ static int xemaclite_open(struct net_device *dev)
  */
 static int xemaclite_close(struct net_device *dev)
 {
-        struct net_local *lp = (struct net_local *) netdev_priv(dev);
+        struct net_local *lp = netdev_priv(dev);
 
         netif_stop_queue(dev);
         xemaclite_disable_interrupts(lp);
@@ -1001,21 +1001,6 @@ static int xemaclite_close(struct net_device *dev)
 }
 
 /**
- * xemaclite_get_stats - Get the stats for the net_device
- * @dev:        Pointer to the network device
- *
- * This function returns the address of the 'net_device_stats' structure for the
- * given network device. This structure holds usage statistics for the network
- * device.
- *
- * Return:      Pointer to the net_device_stats structure.
- */
-static struct net_device_stats *xemaclite_get_stats(struct net_device *dev)
-{
-        return &dev->stats;
-}
-
-/**
  * xemaclite_send - Transmit a frame
  * @orig_skb:   Pointer to the socket buffer to be transmitted
  * @dev:        Pointer to the network device
@@ -1031,7 +1016,7 @@ static struct net_device_stats *xemaclite_get_stats(struct net_device *dev)
  */
 static int xemaclite_send(struct sk_buff *orig_skb, struct net_device *dev)
 {
-        struct net_local *lp = (struct net_local *) netdev_priv(dev);
+        struct net_local *lp = netdev_priv(dev);
         struct sk_buff *new_skb;
         unsigned int len;
         unsigned long flags;
@@ -1068,7 +1053,7 @@ static int xemaclite_send(struct sk_buff *orig_skb, struct net_device *dev)
 static void xemaclite_remove_ndev(struct net_device *ndev)
 {
         if (ndev) {
-                struct net_local *lp = (struct net_local *) netdev_priv(ndev);
+                struct net_local *lp = netdev_priv(ndev);
 
                 if (lp->base_addr)
                         iounmap((void __iomem __force *) (lp->base_addr));
@@ -1245,7 +1230,7 @@ static int __devexit xemaclite_of_remove(struct platform_device *of_dev)
         struct device *dev = &of_dev->dev;
         struct net_device *ndev = dev_get_drvdata(dev);
 
-        struct net_local *lp = (struct net_local *) netdev_priv(ndev);
+        struct net_local *lp = netdev_priv(ndev);
 
         /* Un-register the mii_bus, if configured */
         if (lp->has_mdio) {
@@ -1285,7 +1270,6 @@ static struct net_device_ops xemaclite_netdev_ops = {
         .ndo_start_xmit         = xemaclite_send,
         .ndo_set_mac_address    = xemaclite_set_mac_address,
         .ndo_tx_timeout         = xemaclite_tx_timeout,
-        .ndo_get_stats          = xemaclite_get_stats,
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_poll_controller = xemaclite_poll_controller,
 #endif
diff --git a/drivers/net/znet.c b/drivers/net/znet.c
index c3a32920451..ae07b3dfbcc 100644
--- a/drivers/net/znet.c
+++ b/drivers/net/znet.c
@@ -124,7 +124,7 @@ MODULE_LICENSE("GPL");
 #define TX_BUF_SIZE 8192
 #define DMA_BUF_SIZE (RX_BUF_SIZE + 16) /* 8k + 16 bytes for trailers */
 
-#define TX_TIMEOUT      10
+#define TX_TIMEOUT      (HZ/10)
 
 struct znet_private {
         int rx_dma, tx_dma;
diff --git a/drivers/s390/net/lcs.c b/drivers/s390/net/lcs.c
index 0f19d540b65..c9f13b9ea33 100644
--- a/drivers/s390/net/lcs.c
+++ b/drivers/s390/net/lcs.c
@@ -1188,7 +1188,8 @@ lcs_remove_mc_addresses(struct lcs_card *card, struct in_device *in4_dev)
         spin_lock_irqsave(&card->ipm_lock, flags);
         list_for_each(l, &card->ipm_list) {
                 ipm = list_entry(l, struct lcs_ipm_list, list);
-                for (im4 = in4_dev->mc_list; im4 != NULL; im4 = im4->next) {
+                for (im4 = rcu_dereference(in4_dev->mc_list);
+                     im4 != NULL; im4 = rcu_dereference(im4->next_rcu)) {
                         lcs_get_mac_for_ipm(im4->multiaddr, buf, card->dev);
                         if ( (ipm->ipm.ip_addr == im4->multiaddr) &&
                              (memcmp(buf, &ipm->ipm.mac_addr,
@@ -1233,7 +1234,8 @@ lcs_set_mc_addresses(struct lcs_card *card, struct in_device *in4_dev)
         unsigned long flags;
 
         LCS_DBF_TEXT(4, trace, "setmclst");
-        for (im4 = in4_dev->mc_list; im4; im4 = im4->next) {
+        for (im4 = rcu_dereference(in4_dev->mc_list); im4 != NULL;
+             im4 = rcu_dereference(im4->next_rcu)) {
                 lcs_get_mac_for_ipm(im4->multiaddr, buf, card->dev);
                 ipm = lcs_check_addr_entry(card, im4, buf);
                 if (ipm != NULL)
@@ -1269,10 +1271,10 @@ lcs_register_mc_addresses(void *data)
         in4_dev = in_dev_get(card->dev);
         if (in4_dev == NULL)
                 goto out;
-        read_lock(&in4_dev->mc_list_lock);
+        rcu_read_lock();
         lcs_remove_mc_addresses(card,in4_dev);
         lcs_set_mc_addresses(card, in4_dev);
-        read_unlock(&in4_dev->mc_list_lock);
+        rcu_read_unlock();
         in_dev_put(in4_dev);
 
         netif_carrier_off(card->dev);
diff --git a/drivers/s390/net/qeth_core_sys.c b/drivers/s390/net/qeth_core_sys.c
index 42fa783a70c..b5e967cf7e2 100644
--- a/drivers/s390/net/qeth_core_sys.c
+++ b/drivers/s390/net/qeth_core_sys.c
@@ -372,7 +372,7 @@ static ssize_t qeth_dev_performance_stats_store(struct device *dev,
         i = simple_strtoul(buf, &tmp, 16);
         if ((i == 0) || (i == 1)) {
                 if (i == card->options.performance_stats)
-                        goto out;;
+                        goto out;
                 card->options.performance_stats = i;
                 if (i == 0)
                         memset(&card->perf_stats, 0,
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index 847e8797073..7a7a1b66478 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -849,8 +849,6 @@ static int qeth_l2_open(struct net_device *dev)
         card->state = CARD_STATE_UP;
         netif_start_queue(dev);
 
-        if (!card->lan_online && netif_carrier_ok(dev))
-                netif_carrier_off(dev);
         if (qdio_stop_irq(card->data.ccwdev, 0) >= 0) {
                 napi_enable(&card->napi);
                 napi_schedule(&card->napi);
@@ -1013,13 +1011,14 @@ static int __qeth_l2_set_online(struct ccwgroup_device *gdev, int recovery_mode)
                         dev_warn(&card->gdev->dev,
                                 "The LAN is offline\n");
                         card->lan_online = 0;
-                        goto out;
+                        goto contin;
                 }
                 rc = -ENODEV;
                 goto out_remove;
         } else
                 card->lan_online = 1;
 
+contin:
         if ((card->info.type == QETH_CARD_TYPE_OSD) ||
             (card->info.type == QETH_CARD_TYPE_OSX))
                 /* configure isolation level */
@@ -1038,7 +1037,10 @@ static int __qeth_l2_set_online(struct ccwgroup_device *gdev, int recovery_mode)
                 goto out_remove;
         }
         card->state = CARD_STATE_SOFTSETUP;
-        netif_carrier_on(card->dev);
+        if (card->lan_online)
+                netif_carrier_on(card->dev);
+        else
+                netif_carrier_off(card->dev);
 
         qeth_set_allowed_threads(card, 0xffffffff, 0);
         if (recover_flag == CARD_STATE_RECOVER) {
@@ -1055,7 +1057,6 @@ static int __qeth_l2_set_online(struct ccwgroup_device *gdev, int recovery_mode)
         }
         /* let user_space know that device is online */
         kobject_uevent(&gdev->dev.kobj, KOBJ_CHANGE);
-out:
         mutex_unlock(&card->conf_mutex);
         mutex_unlock(&card->discipline_mutex);
         return 0;
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index 74d1401a5d5..a1abb37db00 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -1796,7 +1796,8 @@ static void qeth_l3_add_mc(struct qeth_card *card, struct in_device *in4_dev)
         char buf[MAX_ADDR_LEN];
 
         QETH_CARD_TEXT(card, 4, "addmc");
-        for (im4 = in4_dev->mc_list; im4; im4 = im4->next) {
+        for (im4 = rcu_dereference(in4_dev->mc_list); im4 != NULL;
+             im4 = rcu_dereference(im4->next_rcu)) {
                 qeth_l3_get_mac_for_ipm(im4->multiaddr, buf, in4_dev->dev);
                 ipm = qeth_l3_get_addr_buffer(QETH_PROT_IPV4);
                 if (!ipm)
@@ -1828,9 +1829,9 @@ static void qeth_l3_add_vlan_mc(struct qeth_card *card)
                 in_dev = in_dev_get(netdev);
                 if (!in_dev)
                         continue;
-                read_lock(&in_dev->mc_list_lock);
+                rcu_read_lock();
                 qeth_l3_add_mc(card, in_dev);
-                read_unlock(&in_dev->mc_list_lock);
+                rcu_read_unlock();
                 in_dev_put(in_dev);
         }
 }
@@ -1843,10 +1844,10 @@ static void qeth_l3_add_multicast_ipv4(struct qeth_card *card)
         in4_dev = in_dev_get(card->dev);
         if (in4_dev == NULL)
                 return;
-        read_lock(&in4_dev->mc_list_lock);
+        rcu_read_lock();
         qeth_l3_add_mc(card, in4_dev);
         qeth_l3_add_vlan_mc(card);
-        read_unlock(&in4_dev->mc_list_lock);
+        rcu_read_unlock();
         in_dev_put(in4_dev);
 }
 
@@ -2938,6 +2939,7 @@ static void qeth_tso_fill_header(struct qeth_card *card,
 
         /*fix header to TSO values ...*/
         hdr->hdr.hdr.l3.id = QETH_HEADER_TYPE_TSO;
+        hdr->hdr.hdr.l3.length = skb->len - sizeof(struct qeth_hdr_tso);
         /*set values which are fix for the first approach ...*/
         hdr->ext.hdr_tot_len = (__u16) sizeof(struct qeth_hdr_ext_tso);
         hdr->ext.imb_hdr_no  = 1;
@@ -3176,8 +3178,6 @@ static int qeth_l3_open(struct net_device *dev)
         card->state = CARD_STATE_UP;
         netif_start_queue(dev);
 
-        if (!card->lan_online && netif_carrier_ok(dev))
-                netif_carrier_off(dev);
         if (qdio_stop_irq(card->data.ccwdev, 0) >= 0) {
                 napi_enable(&card->napi);
                 napi_schedule(&card->napi);
@@ -3449,13 +3449,14 @@ static int __qeth_l3_set_online(struct ccwgroup_device *gdev, int recovery_mode)
                         dev_warn(&card->gdev->dev,
                                 "The LAN is offline\n");
                         card->lan_online = 0;
-                        goto out;
+                        goto contin;
                 }
                 rc = -ENODEV;
                 goto out_remove;
         } else
                 card->lan_online = 1;
 
+contin:
         rc = qeth_l3_setadapter_parms(card);
         if (rc)
                 QETH_DBF_TEXT_(SETUP, 2, "2err%d", rc);
@@ -3480,10 +3481,13 @@ static int __qeth_l3_set_online(struct ccwgroup_device *gdev, int recovery_mode)
                 goto out_remove;
         }
         card->state = CARD_STATE_SOFTSETUP;
-        netif_carrier_on(card->dev);
 
         qeth_set_allowed_threads(card, 0xffffffff, 0);
         qeth_l3_set_ip_addr_list(card);
+        if (card->lan_online)
+                netif_carrier_on(card->dev);
+        else
+                netif_carrier_off(card->dev);
         if (recover_flag == CARD_STATE_RECOVER) {
                 if (recovery_mode)
                         qeth_l3_open(card->dev);
@@ -3496,7 +3500,6 @@ static int __qeth_l3_set_online(struct ccwgroup_device *gdev, int recovery_mode)
         }
         /* let user_space know that device is online */
         kobject_uevent(&gdev->dev.kobj, KOBJ_CHANGE);
-out:
         mutex_unlock(&card->conf_mutex);
         mutex_unlock(&card->discipline_mutex);
         return 0;
diff --git a/drivers/ssb/pci.c b/drivers/ssb/pci.c
index 6e88d2b603b..f52966305e0 100644
--- a/drivers/ssb/pci.c
+++ b/drivers/ssb/pci.c
@@ -573,37 +573,34 @@ static int sprom_extract(struct ssb_bus *bus, struct ssb_sprom *out,
         ssb_dprintk(KERN_DEBUG PFX "SPROM revision %d detected.\n", out->revision);
         memset(out->et0mac, 0xFF, 6);           /* preset et0 and et1 mac */
         memset(out->et1mac, 0xFF, 6);
+
         if ((bus->chip_id & 0xFF00) == 0x4400) {
                 /* Workaround: The BCM44XX chip has a stupid revision
                  * number stored in the SPROM.
                  * Always extract r1. */
                 out->revision = 1;
+                ssb_dprintk(KERN_DEBUG PFX "SPROM treated as revision %d\n", out->revision);
+        }
+
+        switch (out->revision) {
+        case 1:
+        case 2:
+        case 3:
                 sprom_extract_r123(out, in);
-        } else if (bus->chip_id == 0x4321) {
-                /* the BCM4328 has a chipid == 0x4321 and a rev 4 SPROM */
-                out->revision = 4;
+                break;
+        case 4:
+        case 5:
                 sprom_extract_r45(out, in);
-        } else {
-                switch (out->revision) {
-                case 1:
-                case 2:
-                case 3:
-                        sprom_extract_r123(out, in);
-                        break;
-                case 4:
-                case 5:
-                        sprom_extract_r45(out, in);
-                        break;
-                case 8:
-                        sprom_extract_r8(out, in);
-                        break;
-                default:
-                        ssb_printk(KERN_WARNING PFX "Unsupported SPROM"
-                                   "  revision %d detected. Will extract"
-                                   " v1\n", out->revision);
-                        out->revision = 1;
-                        sprom_extract_r123(out, in);
-                }
+                break;
+        case 8:
+                sprom_extract_r8(out, in);
+                break;
+        default:
+                ssb_printk(KERN_WARNING PFX "Unsupported SPROM"
+                           "  revision %d detected. Will extract"
+                           " v1\n", out->revision);
+                out->revision = 1;
+                sprom_extract_r123(out, in);
         }
 
         if (out->boardflags_lo == 0xFFFF)
@@ -618,7 +615,7 @@ static int ssb_pci_sprom_get(struct ssb_bus *bus,
                              struct ssb_sprom *sprom)
 {
         const struct ssb_sprom *fallback;
-        int err = -ENOMEM;
+        int err;
         u16 *buf;
 
         if (!ssb_is_sprom_available(bus)) {
@@ -645,7 +642,7 @@ static int ssb_pci_sprom_get(struct ssb_bus *bus,
 
         buf = kcalloc(SSB_SPROMSIZE_WORDS_R123, sizeof(u16), GFP_KERNEL);
         if (!buf)
-                goto out;
+                return -ENOMEM;
         bus->sprom_size = SSB_SPROMSIZE_WORDS_R123;
         sprom_do_read(bus, buf);
         err = sprom_check_crc(buf, bus->sprom_size);
@@ -655,7 +652,7 @@ static int ssb_pci_sprom_get(struct ssb_bus *bus,
                 buf = kcalloc(SSB_SPROMSIZE_WORDS_R4, sizeof(u16),
                               GFP_KERNEL);
                 if (!buf)
-                        goto out;
+                        return -ENOMEM;
                 bus->sprom_size = SSB_SPROMSIZE_WORDS_R4;
                 sprom_do_read(bus, buf);
                 err = sprom_check_crc(buf, bus->sprom_size);
@@ -677,7 +674,6 @@ static int ssb_pci_sprom_get(struct ssb_bus *bus,
 
 out_free:
         kfree(buf);
-out:
         return err;
 }
 
diff --git a/drivers/ssb/pcihost_wrapper.c b/drivers/ssb/pcihost_wrapper.c
index 6536a041d90..f6c8c81a002 100644
--- a/drivers/ssb/pcihost_wrapper.c
+++ b/drivers/ssb/pcihost_wrapper.c
@@ -59,6 +59,7 @@ static int ssb_pcihost_probe(struct pci_dev *dev,
         struct ssb_bus *ssb;
         int err = -ENOMEM;
         const char *name;
+        u32 val;
 
         ssb = kzalloc(sizeof(*ssb), GFP_KERNEL);
         if (!ssb)
@@ -74,6 +75,12 @@ static int ssb_pcihost_probe(struct pci_dev *dev,
                 goto err_pci_disable;
         pci_set_master(dev);
 
+        /* Disable the RETRY_TIMEOUT register (0x41) to keep
+         * PCI Tx retries from interfering with C3 CPU state */
+        pci_read_config_dword(dev, 0x40, &val);
+        if ((val & 0x0000ff00) != 0)
+                pci_write_config_dword(dev, 0x40, val & 0xffff00ff);
+
         err = ssb_bus_pcibus_register(ssb, dev);
         if (err)
                 goto err_pci_release_regions;
diff --git a/include/linux/average.h b/include/linux/average.h
new file mode 100644
index 00000000000..7706e40f95f
--- /dev/null
+++ b/include/linux/average.h
@@ -0,0 +1,32 @@
+#ifndef _LINUX_AVERAGE_H
+#define _LINUX_AVERAGE_H
+
+#include <linux/kernel.h>
+
+/* Exponentially weighted moving average (EWMA) */
+
+/* For more documentation see lib/average.c */
+
+struct ewma {
+        unsigned long internal;
+        unsigned long factor;
+        unsigned long weight;
+};
+
+extern void ewma_init(struct ewma *avg, unsigned long factor,
+                      unsigned long weight);
+
+extern struct ewma *ewma_add(struct ewma *avg, unsigned long val);
+
+/**
+ * ewma_read() - Get average value
+ * @avg: Average structure
+ *
+ * Returns the average value held in @avg.
+ */
+static inline unsigned long ewma_read(const struct ewma *avg)
+{
+        return DIV_ROUND_CLOSEST(avg->internal, avg->factor);
+}
+
+#endif /* _LINUX_AVERAGE_H */
diff --git a/include/linux/bitops.h b/include/linux/bitops.h
index 827cc95711e..2184c6b97ae 100644
--- a/include/linux/bitops.h
+++ b/include/linux/bitops.h
@@ -109,6 +109,17 @@ static inline __u8 ror8(__u8 word, unsigned int shift)
         return (word >> shift) | (word << (8 - shift));
 }
 
+/**
+ * sign_extend32 - sign extend a 32-bit value using specified bit as sign-bit
+ * @value: value to sign extend
+ * @index: 0 based bit index (0<=index<32) to sign bit
+ */
+static inline __s32 sign_extend32(__u32 value, int index)
+{
+        __u8 shift = 31 - index;
+        return (__s32)(value << shift) >> shift;
+}
+
 static inline unsigned fls_long(unsigned long l)
 {
         if (sizeof(l) == 4)
diff --git a/include/linux/dccp.h b/include/linux/dccp.h
index 749f01ccd26..010e2d87ed7 100644
--- a/include/linux/dccp.h
+++ b/include/linux/dccp.h
@@ -197,6 +197,21 @@ enum dccp_feature_numbers {
         DCCPF_MAX_CCID_SPECIFIC = 255,
 };
 
+/* DCCP socket control message types for cmsg */
+enum dccp_cmsg_type {
+        DCCP_SCM_PRIORITY = 1,
+        DCCP_SCM_QPOLICY_MAX = 0xFFFF,
+        /* ^-- Up to here reserved exclusively for qpolicy parameters */
+        DCCP_SCM_MAX
+};
+
+/* DCCP priorities for outgoing/queued packets */
+enum dccp_packet_dequeueing_policy {
+        DCCPQ_POLICY_SIMPLE,
+        DCCPQ_POLICY_PRIO,
+        DCCPQ_POLICY_MAX
+};
+
 /* DCCP socket options */
 #define DCCP_SOCKOPT_PACKET_SIZE        1 /* XXX deprecated, without effect */
 #define DCCP_SOCKOPT_SERVICE            2
@@ -210,6 +225,8 @@ enum dccp_feature_numbers {
 #define DCCP_SOCKOPT_CCID               13
 #define DCCP_SOCKOPT_TX_CCID            14
 #define DCCP_SOCKOPT_RX_CCID            15
+#define DCCP_SOCKOPT_QPOLICY_ID         16
+#define DCCP_SOCKOPT_QPOLICY_TXQLEN     17
 #define DCCP_SOCKOPT_CCID_RX_INFO       128
 #define DCCP_SOCKOPT_CCID_TX_INFO       192
 
@@ -458,10 +475,13 @@ struct dccp_ackvec;
  * @dccps_hc_rx_ccid - CCID used for the receiver (or receiving half-connection)
  * @dccps_hc_tx_ccid - CCID used for the sender (or sending half-connection)
  * @dccps_options_received - parsed set of retrieved options
+ * @dccps_qpolicy - TX dequeueing policy, one of %dccp_packet_dequeueing_policy
+ * @dccps_tx_qlen - maximum length of the TX queue
  * @dccps_role - role of this sock, one of %dccp_role
  * @dccps_hc_rx_insert_options - receiver wants to add options when acking
  * @dccps_hc_tx_insert_options - sender wants to add options when sending
  * @dccps_server_timewait - server holds timewait state on close (RFC 4340, 8.3)
+ * @dccps_sync_scheduled - flag which signals "send out-of-band message soon"
  * @dccps_xmitlet - tasklet scheduled by the TX CCID to dequeue data packets
  * @dccps_xmit_timer - used by the TX CCID to delay sending (rate-based pacing)
  * @dccps_syn_rtt - RTT sample from Request/Response exchange (in usecs)
@@ -499,10 +519,13 @@ struct dccp_sock {
         struct ccid                     *dccps_hc_rx_ccid;
         struct ccid                     *dccps_hc_tx_ccid;
         struct dccp_options_received    dccps_options_received;
+        __u8                            dccps_qpolicy;
+        __u32                           dccps_tx_qlen;
         enum dccp_role                  dccps_role:2;
         __u8                            dccps_hc_rx_insert_options:1;
         __u8                            dccps_hc_tx_insert_options:1;
         __u8                            dccps_server_timewait:1;
+        __u8                            dccps_sync_scheduled:1;
         struct tasklet_struct           dccps_xmitlet;
         struct timer_list               dccps_xmit_timer;
 };
diff --git a/include/linux/filter.h b/include/linux/filter.h
index 69b43dbea6c..45266b75409 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -91,54 +91,6 @@ struct sock_fprog {	/* Required for SO_ATTACH_FILTER. */
 #define         BPF_TAX         0x00
 #define         BPF_TXA         0x80
 
-enum {
-        BPF_S_RET_K = 0,
-        BPF_S_RET_A,
-        BPF_S_ALU_ADD_K,
-        BPF_S_ALU_ADD_X,
-        BPF_S_ALU_SUB_K,
-        BPF_S_ALU_SUB_X,
-        BPF_S_ALU_MUL_K,
-        BPF_S_ALU_MUL_X,
-        BPF_S_ALU_DIV_X,
-        BPF_S_ALU_AND_K,
-        BPF_S_ALU_AND_X,
-        BPF_S_ALU_OR_K,
-        BPF_S_ALU_OR_X,
-        BPF_S_ALU_LSH_K,
-        BPF_S_ALU_LSH_X,
-        BPF_S_ALU_RSH_K,
-        BPF_S_ALU_RSH_X,
-        BPF_S_ALU_NEG,
-        BPF_S_LD_W_ABS,
-        BPF_S_LD_H_ABS,
-        BPF_S_LD_B_ABS,
-        BPF_S_LD_W_LEN,
-        BPF_S_LD_W_IND,
-        BPF_S_LD_H_IND,
-        BPF_S_LD_B_IND,
-        BPF_S_LD_IMM,
-        BPF_S_LDX_W_LEN,
-        BPF_S_LDX_B_MSH,
-        BPF_S_LDX_IMM,
-        BPF_S_MISC_TAX,
-        BPF_S_MISC_TXA,
-        BPF_S_ALU_DIV_K,
-        BPF_S_LD_MEM,
-        BPF_S_LDX_MEM,
-        BPF_S_ST,
-        BPF_S_STX,
-        BPF_S_JMP_JA,
-        BPF_S_JMP_JEQ_K,
-        BPF_S_JMP_JEQ_X,
-        BPF_S_JMP_JGE_K,
-        BPF_S_JMP_JGE_X,
-        BPF_S_JMP_JGT_K,
-        BPF_S_JMP_JGT_X,
-        BPF_S_JMP_JSET_K,
-        BPF_S_JMP_JSET_X,
-};
-
 #ifndef BPF_MAXINSNS
 #define BPF_MAXINSNS 4096
 #endif
@@ -172,7 +124,9 @@ enum {
 #define SKF_AD_MARK     20
 #define SKF_AD_QUEUE    24
 #define SKF_AD_HATYPE   28
-#define SKF_AD_MAX      32
+#define SKF_AD_RXHASH   32
+#define SKF_AD_CPU      36
+#define SKF_AD_MAX      40
 #define SKF_NET_OFF   (-0x100000)
 #define SKF_LL_OFF    (-0x200000)
 
@@ -194,8 +148,8 @@ struct sk_buff;
 struct sock;
 
 extern int sk_filter(struct sock *sk, struct sk_buff *skb);
-extern unsigned int sk_run_filter(struct sk_buff *skb,
-                                  struct sock_filter *filter, int flen);
+extern unsigned int sk_run_filter(const struct sk_buff *skb,
+                                  const struct sock_filter *filter);
 extern int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk);
 extern int sk_detach_filter(struct sock *sk);
 extern int sk_chk_filter(struct sock_filter *filter, int flen);
diff --git a/include/linux/if_bridge.h b/include/linux/if_bridge.h
index 0d241a5c490..f7e73c338c4 100644
--- a/include/linux/if_bridge.h
+++ b/include/linux/if_bridge.h
@@ -102,7 +102,9 @@ struct __fdb_entry {
 #include <linux/netdevice.h>
 
 extern void brioctl_set(int (*ioctl_hook)(struct net *, unsigned int, void __user *));
-extern int (*br_should_route_hook)(struct sk_buff *skb);
+
+typedef int (*br_should_route_hook_t)(struct sk_buff *skb);
+extern br_should_route_hook_t __rcu *br_should_route_hook;
 
 #endif
 
diff --git a/include/linux/if_link.h b/include/linux/if_link.h
index 2fc66dd783e..6485d2a89be 100644
--- a/include/linux/if_link.h
+++ b/include/linux/if_link.h
@@ -80,6 +80,24 @@ struct rtnl_link_ifmap {
         __u8    port;
 };
 
+/*
+ * IFLA_AF_SPEC
+ *   Contains nested attributes for address family specific attributes.
+ *   Each address family may create a attribute with the address family
+ *   number as type and create its own attribute structure in it.
+ *
+ *   Example:
+ *   [IFLA_AF_SPEC] = {
+ *       [AF_INET] = {
+ *           [IFLA_INET_CONF] = ...,
+ *       },
+ *       [AF_INET6] = {
+ *           [IFLA_INET6_FLAGS] = ...,
+ *           [IFLA_INET6_CONF] = ...,
+ *       }
+ *   }
+ */
+
 enum {
         IFLA_UNSPEC,
         IFLA_ADDRESS,
@@ -116,6 +134,7 @@ enum {
         IFLA_STATS64,
         IFLA_VF_PORTS,
         IFLA_PORT_SELF,
+        IFLA_AF_SPEC,
         __IFLA_MAX
 };
 
@@ -128,6 +147,14 @@ enum {
 #define IFLA_PAYLOAD(n) NLMSG_PAYLOAD(n,sizeof(struct ifinfomsg))
 #endif
 
+enum {
+        IFLA_INET_UNSPEC,
+        IFLA_INET_CONF,
+        __IFLA_INET_MAX,
+};
+
+#define IFLA_INET_MAX (__IFLA_INET_MAX - 1)
+
 /* ifi_flags.
 
    IFF_* flags.
@@ -232,6 +259,7 @@ enum macvlan_mode {
         MACVLAN_MODE_PRIVATE = 1, /* don't talk to other macvlans */
         MACVLAN_MODE_VEPA    = 2, /* talk to other ports through ext bridge */
         MACVLAN_MODE_BRIDGE  = 4, /* talk to bridge ports directly */
+        MACVLAN_MODE_PASSTHRU = 8,/* take over the underlying device */
 };
 
 /* SR-IOV virtual function management section */
diff --git a/include/linux/if_macvlan.h b/include/linux/if_macvlan.h
index 8a2fd66a8b5..e28b2e4959d 100644
--- a/include/linux/if_macvlan.h
+++ b/include/linux/if_macvlan.h
@@ -25,19 +25,25 @@ struct macvlan_port;
 struct macvtap_queue;
 
 /**
- *      struct macvlan_rx_stats - MACVLAN percpu rx stats
+ *      struct macvlan_pcpu_stats - MACVLAN percpu stats
  *      @rx_packets: number of received packets
  *      @rx_bytes: number of received bytes
  *      @rx_multicast: number of received multicast packets
+ *      @tx_packets: number of transmitted packets
+ *      @tx_bytes: number of transmitted bytes
  *      @syncp: synchronization point for 64bit counters
- *      @rx_errors: number of errors
+ *      @rx_errors: number of rx errors
+ *      @tx_dropped: number of tx dropped packets
  */
-struct macvlan_rx_stats {
+struct macvlan_pcpu_stats {
         u64                     rx_packets;
         u64                     rx_bytes;
         u64                     rx_multicast;
+        u64                     tx_packets;
+        u64                     tx_bytes;
         struct u64_stats_sync   syncp;
-        unsigned long           rx_errors;
+        u32                     rx_errors;
+        u32                     tx_dropped;
 };
 
 /*
@@ -52,7 +58,7 @@ struct macvlan_dev {
         struct hlist_node       hlist;
         struct macvlan_port     *port;
         struct net_device       *lowerdev;
-        struct macvlan_rx_stats __percpu *rx_stats;
+        struct macvlan_pcpu_stats __percpu *pcpu_stats;
         enum macvlan_mode       mode;
         int (*receive)(struct sk_buff *skb);
         int (*forward)(struct net_device *dev, struct sk_buff *skb);
@@ -64,18 +70,18 @@ static inline void macvlan_count_rx(const struct macvlan_dev *vlan,
                                     unsigned int len, bool success,
                                     bool multicast)
 {
-        struct macvlan_rx_stats *rx_stats;
-
-        rx_stats = this_cpu_ptr(vlan->rx_stats);
         if (likely(success)) {
-                u64_stats_update_begin(&rx_stats->syncp);
-                rx_stats->rx_packets++;;
-                rx_stats->rx_bytes += len;
+                struct macvlan_pcpu_stats *pcpu_stats;
+
+                pcpu_stats = this_cpu_ptr(vlan->pcpu_stats);
+                u64_stats_update_begin(&pcpu_stats->syncp);
+                pcpu_stats->rx_packets++;
+                pcpu_stats->rx_bytes += len;
                 if (multicast)
-                        rx_stats->rx_multicast++;
-                u64_stats_update_end(&rx_stats->syncp);
+                        pcpu_stats->rx_multicast++;
+                u64_stats_update_end(&pcpu_stats->syncp);
         } else {
-                rx_stats->rx_errors++;
+                this_cpu_inc(vlan->pcpu_stats->rx_errors);
         }
 }
 
diff --git a/include/linux/igmp.h b/include/linux/igmp.h
index 93fc2449af1..c4987f26510 100644
--- a/include/linux/igmp.h
+++ b/include/linux/igmp.h
@@ -167,10 +167,10 @@ struct ip_sf_socklist {
  */
 
 struct ip_mc_socklist {
-        struct ip_mc_socklist   *next;
+        struct ip_mc_socklist __rcu *next_rcu;
         struct ip_mreqn         multi;
         unsigned int            sfmode;         /* MCAST_{INCLUDE,EXCLUDE} */
-        struct ip_sf_socklist   *sflist;
+        struct ip_sf_socklist __rcu     *sflist;
         struct rcu_head         rcu;
 };
 
@@ -186,11 +186,14 @@ struct ip_sf_list {
 struct ip_mc_list {
         struct in_device        *interface;
         __be32                  multiaddr;
+        unsigned int            sfmode;
         struct ip_sf_list       *sources;
         struct ip_sf_list       *tomb;
-        unsigned int            sfmode;
         unsigned long           sfcount[2];
-        struct ip_mc_list       *next;
+        union {
+                struct ip_mc_list *next;
+                struct ip_mc_list __rcu *next_rcu;
+        };
         struct timer_list       timer;
         int                     users;
         atomic_t                refcnt;
@@ -201,6 +204,7 @@ struct ip_mc_list {
         char                    loaded;
         unsigned char           gsquery;        /* check source marks? */
         unsigned char           crcount;
+        struct rcu_head         rcu;
 };
 
 /* V3 exponential field decoding */
@@ -234,7 +238,7 @@ extern void ip_mc_unmap(struct in_device *);
 extern void ip_mc_remap(struct in_device *);
 extern void ip_mc_dec_group(struct in_device *in_dev, __be32 addr);
 extern void ip_mc_inc_group(struct in_device *in_dev, __be32 addr);
-extern void ip_mc_rejoin_group(struct ip_mc_list *im);
+extern void ip_mc_rejoin_groups(struct in_device *in_dev);
 
 #endif
 #endif
diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
index ccd5b07d678..ae8fdc54e0c 100644
--- a/include/linux/inetdevice.h
+++ b/include/linux/inetdevice.h
@@ -41,10 +41,12 @@ enum
         __IPV4_DEVCONF_MAX
 };
 
+#define IPV4_DEVCONF_MAX (__IPV4_DEVCONF_MAX - 1)
+
 struct ipv4_devconf {
         void    *sysctl;
-        int     data[__IPV4_DEVCONF_MAX - 1];
-        DECLARE_BITMAP(state, __IPV4_DEVCONF_MAX - 1);
+        int     data[IPV4_DEVCONF_MAX];
+        DECLARE_BITMAP(state, IPV4_DEVCONF_MAX);
 };
 
 struct in_device {
@@ -52,9 +54,8 @@ struct in_device {
         atomic_t                refcnt;
         int                     dead;
         struct in_ifaddr        *ifa_list;      /* IP ifaddr chain              */
-        rwlock_t                mc_list_lock;
-        struct ip_mc_list       *mc_list;       /* IP multicast filter chain    */
-        int                     mc_count;                 /* Number of installed mcasts */
+        struct ip_mc_list __rcu *mc_list;       /* IP multicast filter chain    */
+        int                     mc_count;       /* Number of installed mcasts   */
         spinlock_t              mc_tomb_lock;
         struct ip_mc_list       *mc_tomb;
         unsigned long           mr_v1_seen;
@@ -91,7 +92,7 @@ static inline void ipv4_devconf_set(struct in_device *in_dev, int index,
 
 static inline void ipv4_devconf_setall(struct in_device *in_dev)
 {
-        bitmap_fill(in_dev->cnf.state, __IPV4_DEVCONF_MAX - 1);
+        bitmap_fill(in_dev->cnf.state, IPV4_DEVCONF_MAX);
 }
 
 #define IN_DEV_CONF_GET(in_dev, attr) \
@@ -221,7 +222,7 @@ static inline struct in_device *in_dev_get(const struct net_device *dev)
 
 static inline struct in_device *__in_dev_get_rtnl(const struct net_device *dev)
 {
-        return rcu_dereference_check(dev->ip_ptr, lockdep_rtnl_is_held());
+        return rtnl_dereference(dev->ip_ptr);
 }
 
 extern void in_dev_finish_destroy(struct in_device *idev);
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index 8e429d0e040..0c997767429 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -364,7 +364,7 @@ struct ipv6_pinfo {
 
         __u32                   dst_cookie;
 
-        struct ipv6_mc_socklist *ipv6_mc_list;
+        struct ipv6_mc_socklist __rcu *ipv6_mc_list;
         struct ipv6_ac_socklist *ipv6_ac_list;
         struct ipv6_fl_socklist *ipv6_fl_list;
 
diff --git a/include/linux/mdio.h b/include/linux/mdio.h
index c779b49a1fd..b1494aced21 100644
--- a/include/linux/mdio.h
+++ b/include/linux/mdio.h
@@ -55,6 +55,7 @@
 #define MDIO_PCS_10GBRT_STAT2   33      /* 10GBASE-R/-T PCS status 2 */
 #define MDIO_AN_10GBT_CTRL      32      /* 10GBASE-T auto-negotiation control */
 #define MDIO_AN_10GBT_STAT      33      /* 10GBASE-T auto-negotiation status */
+#define MDIO_AN_EEE_ADV         60      /* EEE advertisement */
 
 /* LASI (Link Alarm Status Interrupt) registers, defined by XENPAK MSA. */
 #define MDIO_PMA_LASI_RXCTRL    0x9000  /* RX_ALARM control */
@@ -235,6 +236,10 @@
 #define MDIO_AN_10GBT_STAT_MS           0x4000  /* Master/slave config */
 #define MDIO_AN_10GBT_STAT_MSFLT        0x8000  /* Master/slave config fault */
 
+/* AN EEE Advertisement register. */
+#define MDIO_AN_EEE_ADV_100TX           0x0002  /* Advertise 100TX EEE cap */
+#define MDIO_AN_EEE_ADV_1000T           0x0004  /* Advertise 1000T EEE cap */
+
 /* LASI RX_ALARM control/status registers. */
 #define MDIO_PMA_LASI_RX_PHYXSLFLT      0x0001  /* PHY XS RX local fault */
 #define MDIO_PMA_LASI_RX_PCSLFLT        0x0008  /* PCS RX local fault */
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index d8fd2c23a1b..d31bc3c9471 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -493,6 +493,8 @@ static inline void napi_synchronize(const struct napi_struct *n)
 enum netdev_queue_state_t {
         __QUEUE_STATE_XOFF,
         __QUEUE_STATE_FROZEN,
+#define QUEUE_STATE_XOFF_OR_FROZEN ((1 << __QUEUE_STATE_XOFF)           | \
+                                    (1 << __QUEUE_STATE_FROZEN))
 };
 
 struct netdev_queue {
@@ -503,6 +505,12 @@ struct netdev_queue {
         struct Qdisc            *qdisc;
         unsigned long           state;
         struct Qdisc            *qdisc_sleeping;
+#ifdef CONFIG_RPS
+        struct kobject          kobj;
+#endif
+#if defined(CONFIG_XPS) && defined(CONFIG_NUMA)
+        int                     numa_node;
+#endif
 /*
  * write mostly part
  */
@@ -517,6 +525,22 @@ struct netdev_queue {
         u64                     tx_dropped;
 } ____cacheline_aligned_in_smp;
 
+static inline int netdev_queue_numa_node_read(const struct netdev_queue *q)
+{
+#if defined(CONFIG_XPS) && defined(CONFIG_NUMA)
+        return q->numa_node;
+#else
+        return -1;
+#endif
+}
+
+static inline void netdev_queue_numa_node_write(struct netdev_queue *q, int node)
+{
+#if defined(CONFIG_XPS) && defined(CONFIG_NUMA)
+        q->numa_node = node;
+#endif
+}
+
 #ifdef CONFIG_RPS
 /*
  * This structure holds an RPS map which can be of variable length.  The
@@ -592,11 +616,36 @@ struct netdev_rx_queue {
         struct rps_map __rcu            *rps_map;
         struct rps_dev_flow_table __rcu *rps_flow_table;
         struct kobject                  kobj;
-        struct netdev_rx_queue          *first;
-        atomic_t                        count;
+        struct net_device               *dev;
 } ____cacheline_aligned_in_smp;
 #endif /* CONFIG_RPS */
 
+#ifdef CONFIG_XPS
+/*
+ * This structure holds an XPS map which can be of variable length.  The
+ * map is an array of queues.
+ */
+struct xps_map {
+        unsigned int len;
+        unsigned int alloc_len;
+        struct rcu_head rcu;
+        u16 queues[0];
+};
+#define XPS_MAP_SIZE(_num) (sizeof(struct xps_map) + (_num * sizeof(u16)))
+#define XPS_MIN_MAP_ALLOC ((L1_CACHE_BYTES - sizeof(struct xps_map))    \
+    / sizeof(u16))
+
+/*
+ * This structure holds all XPS maps for device.  Maps are indexed by CPU.
+ */
+struct xps_dev_maps {
+        struct rcu_head rcu;
+        struct xps_map __rcu *cpu_map[0];
+};
+#define XPS_DEV_MAPS_SIZE (sizeof(struct xps_dev_maps) +                \
+    (nr_cpu_ids * sizeof(struct xps_map *)))
+#endif /* CONFIG_XPS */
+
 /*
  * This structure defines the management hooks for network devices.
  * The following hooks can be defined; unless noted otherwise, they are
@@ -951,7 +1000,7 @@ struct net_device {
 #endif
         void                    *atalk_ptr;     /* AppleTalk link       */
         struct in_device __rcu  *ip_ptr;        /* IPv4 specific data   */
-        void                    *dn_ptr;        /* DECnet specific data */
+        struct dn_dev __rcu     *dn_ptr;        /* DECnet specific data */
         struct inet6_dev __rcu  *ip6_ptr;       /* IPv6 specific data */
         void                    *ec_ptr;        /* Econet specific data */
         void                    *ax25_ptr;      /* AX.25 specific data */
@@ -995,8 +1044,8 @@ struct net_device {
         unsigned int            real_num_rx_queues;
 #endif
 
-        rx_handler_func_t       *rx_handler;
-        void                    *rx_handler_data;
+        rx_handler_func_t __rcu *rx_handler;
+        void __rcu              *rx_handler_data;
 
         struct netdev_queue __rcu *ingress_queue;
 
@@ -1017,6 +1066,10 @@ struct net_device {
         unsigned long           tx_queue_len;   /* Max frames per queue allowed */
         spinlock_t              tx_global_lock;
 
+#ifdef CONFIG_XPS
+        struct xps_dev_maps __rcu *xps_maps;
+#endif
+
         /* These may be needed for future network-power-down code. */
 
         /*
@@ -1307,7 +1360,8 @@ static inline struct net_device *first_net_device(struct net *net)
 
 extern int                      netdev_boot_setup_check(struct net_device *dev);
 extern unsigned long            netdev_boot_base(const char *prefix, int unit);
-extern struct net_device    *dev_getbyhwaddr(struct net *net, unsigned short type, char *hwaddr);
+extern struct net_device *dev_getbyhwaddr_rcu(struct net *net, unsigned short type,
+                                              const char *hwaddr);
 extern struct net_device *dev_getfirstbyhwtype(struct net *net, unsigned short type);
 extern struct net_device *__dev_getfirstbyhwtype(struct net *net, unsigned short type);
 extern void             dev_add_pack(struct packet_type *pt);
@@ -1600,9 +1654,9 @@ static inline int netif_queue_stopped(const struct net_device *dev)
         return netif_tx_queue_stopped(netdev_get_tx_queue(dev, 0));
 }
 
-static inline int netif_tx_queue_frozen(const struct netdev_queue *dev_queue)
+static inline int netif_tx_queue_frozen_or_stopped(const struct netdev_queue *dev_queue)
 {
-        return test_bit(__QUEUE_STATE_FROZEN, &dev_queue->state);
+        return dev_queue->state & QUEUE_STATE_XOFF_OR_FROZEN;
 }
 
 /**
@@ -2239,6 +2293,8 @@ unsigned long netdev_fix_features(unsigned long features, const char *name);
 void netif_stacked_transfer_operstate(const struct net_device *rootdev,
                                         struct net_device *dev);
 
+int netif_get_vlan_features(struct sk_buff *skb, struct net_device *dev);
+
 static inline int net_gso_ok(int features, int gso_type)
 {
         int feature = gso_type << NETIF_F_GSO_SHIFT;
@@ -2254,10 +2310,7 @@ static inline int skb_gso_ok(struct sk_buff *skb, int features)
 static inline int netif_needs_gso(struct net_device *dev, struct sk_buff *skb)
 {
         if (skb_is_gso(skb)) {
-                int features = dev->features;
-
-                if (skb->protocol == htons(ETH_P_8021Q) || skb->vlan_tci)
-                        features &= dev->vlan_features;
+                int features = netif_get_vlan_features(skb, dev);
 
                 return (!skb_gso_ok(skb, features) ||
                         unlikely(skb->ip_summed != CHECKSUM_PARTIAL));
diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
index 03317c8d407..1893837b396 100644
--- a/include/linux/netfilter.h
+++ b/include/linux/netfilter.h
@@ -33,6 +33,8 @@
 
 #define NF_QUEUE_NR(x) ((((x) << NF_VERDICT_BITS) & NF_VERDICT_QMASK) | NF_QUEUE)
 
+#define NF_DROP_ERR(x) (((-x) << NF_VERDICT_BITS) | NF_DROP)
+
 /* only for userspace compatibility */
 #ifndef __KERNEL__
 /* Generic cache responses from hook functions.
diff --git a/include/linux/nl80211.h b/include/linux/nl80211.h
index 0edb2566c14..d706bf3badc 100644
--- a/include/linux/nl80211.h
+++ b/include/linux/nl80211.h
@@ -804,6 +804,30 @@ enum nl80211_commands {
  * @NL80211_ATTR_SUPPORT_IBSS_RSN: The device supports IBSS RSN, which mostly
  *      means support for per-station GTKs.
  *
+ * @NL80211_ATTR_WIPHY_ANTENNA_TX: Bitmap of allowed antennas for transmitting.
+ *      This can be used to mask out antennas which are not attached or should
+ *      not be used for transmitting. If an antenna is not selected in this
+ *      bitmap the hardware is not allowed to transmit on this antenna.
+ *
+ *      Each bit represents one antenna, starting with antenna 1 at the first
+ *      bit. Depending on which antennas are selected in the bitmap, 802.11n
+ *      drivers can derive which chainmasks to use (if all antennas belonging to
+ *      a particular chain are disabled this chain should be disabled) and if
+ *      a chain has diversity antennas wether diversity should be used or not.
+ *      HT capabilities (STBC, TX Beamforming, Antenna selection) can be
+ *      derived from the available chains after applying the antenna mask.
+ *      Non-802.11n drivers can derive wether to use diversity or not.
+ *      Drivers may reject configurations or RX/TX mask combinations they cannot
+ *      support by returning -EINVAL.
+ *
+ * @NL80211_ATTR_WIPHY_ANTENNA_RX: Bitmap of allowed antennas for receiving.
+ *      This can be used to mask out antennas which are not attached or should
+ *      not be used for receiving. If an antenna is not selected in this bitmap
+ *      the hardware should not be configured to receive on this antenna.
+ *      For a more detailed descripton see @NL80211_ATTR_WIPHY_ANTENNA_TX.
+ *
+ * @NL80211_ATTR_MCAST_RATE: Multicast tx rate (in 100 kbps) for IBSS
+ *
  * @NL80211_ATTR_MAX: highest attribute number currently defined
  * @__NL80211_ATTR_AFTER_LAST: internal use
  */
@@ -973,6 +997,11 @@ enum nl80211_attrs {
 
         NL80211_ATTR_SUPPORT_IBSS_RSN,
 
+        NL80211_ATTR_WIPHY_ANTENNA_TX,
+        NL80211_ATTR_WIPHY_ANTENNA_RX,
+
+        NL80211_ATTR_MCAST_RATE,
+
         /* add attributes here, update the policy in nl80211.c */
 
         __NL80211_ATTR_AFTER_LAST,
@@ -1307,7 +1336,11 @@ enum nl80211_bitrate_attr {
  *      wireless core it thinks its knows the regulatory domain we should be in.
  * @NL80211_REGDOM_SET_BY_COUNTRY_IE: the wireless core has received an
  *      802.11 country information element with regulatory information it
- *      thinks we should consider.
+ *      thinks we should consider. cfg80211 only processes the country
+ *      code from the IE, and relies on the regulatory domain information
+ *      structure pased by userspace (CRDA) from our wireless-regdb.
+ *      If a channel is enabled but the country code indicates it should
+ *      be disabled we disable the channel and re-enable it upon disassociation.
  */
 enum nl80211_reg_initiator {
         NL80211_REGDOM_SET_BY_CORE,
@@ -1786,6 +1819,8 @@ enum nl80211_ps_state {
  *      the minimum amount the RSSI level must change after an event before a
  *      new event may be issued (to reduce effects of RSSI oscillation).
  * @NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT: RSSI threshold event
+ * @NL80211_ATTR_CQM_PKT_LOSS_EVENT: a u32 value indicating that this many
+ *      consecutive packets were not acknowledged by the peer
  * @__NL80211_ATTR_CQM_AFTER_LAST: internal
  * @NL80211_ATTR_CQM_MAX: highest key attribute
  */
@@ -1794,6 +1829,7 @@ enum nl80211_attr_cqm {
         NL80211_ATTR_CQM_RSSI_THOLD,
         NL80211_ATTR_CQM_RSSI_HYST,
         NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
+        NL80211_ATTR_CQM_PKT_LOSS_EVENT,
 
         /* keep last */
         __NL80211_ATTR_CQM_AFTER_LAST,
diff --git a/include/linux/rfkill.h b/include/linux/rfkill.h
index 08c32e4f261..c6c608482cb 100644
--- a/include/linux/rfkill.h
+++ b/include/linux/rfkill.h
@@ -354,37 +354,6 @@ static inline bool rfkill_blocked(struct rfkill *rfkill)
 }
 #endif /* RFKILL || RFKILL_MODULE */
 
-
-#ifdef CONFIG_RFKILL_LEDS
-/**
- * rfkill_get_led_trigger_name - Get the LED trigger name for the button's LED.
- * This function might return a NULL pointer if registering of the
- * LED trigger failed. Use this as "default_trigger" for the LED.
- */
-const char *rfkill_get_led_trigger_name(struct rfkill *rfkill);
-
-/**
- * rfkill_set_led_trigger_name -- set the LED trigger name
- * @rfkill: rfkill struct
- * @name: LED trigger name
- *
- * This function sets the LED trigger name of the radio LED
- * trigger that rfkill creates. It is optional, but if called
- * must be called before rfkill_register() to be effective.
- */
-void rfkill_set_led_trigger_name(struct rfkill *rfkill, const char *name);
-#else
-static inline const char *rfkill_get_led_trigger_name(struct rfkill *rfkill)
-{
-        return NULL;
-}
-
-static inline void
-rfkill_set_led_trigger_name(struct rfkill *rfkill, const char *name)
-{
-}
-#endif
-
 #endif /* __KERNEL__ */
 
 #endif /* RFKILL_H */
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index e6ba898de61..19f37a6ee6c 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -386,9 +386,10 @@ struct sk_buff {
 #else
         __u8                    deliver_no_wcard:1;
 #endif
+        __u8                    ooo_okay:1;
         kmemcheck_bitfield_end(flags2);
 
-        /* 0/14 bit hole */
+        /* 0/13 bit hole */
 
 #ifdef CONFIG_NET_DMA
         dma_cookie_t            dma_cookie;
diff --git a/include/linux/stmmac.h b/include/linux/stmmac.h
index d66c61774d9..e1035291569 100644
--- a/include/linux/stmmac.h
+++ b/include/linux/stmmac.h
@@ -40,9 +40,9 @@ struct plat_stmmacenet_data {
         int pmt;
         void (*fix_mac_speed)(void *priv, unsigned int speed);
         void (*bus_setup)(void __iomem *ioaddr);
-#ifdef CONFIG_STM_DRIVERS
-        struct stm_pad_config *pad_config;
-#endif
+        int (*init)(struct platform_device *pdev);
+        void (*exit)(struct platform_device *pdev);
+        void *custom_cfg;
         void *bsp_priv;
 };
 
diff --git a/include/linux/usb/usbnet.h b/include/linux/usb/usbnet.h
index 7ae27a47381..44842c8d38c 100644
--- a/include/linux/usb/usbnet.h
+++ b/include/linux/usb/usbnet.h
@@ -97,6 +97,12 @@ struct driver_info {
 
 #define FLAG_LINK_INTR  0x0800          /* updates link (carrier) status */
 
+/*
+ * Indicates to usbnet, that USB driver accumulates multiple IP packets.
+ * Affects statistic (counters) and short packet handling.
+ */
+#define FLAG_MULTI_PACKET       0x1000
+
         /* init device ... can sleep, or cause probe() failure */
         int     (*bind)(struct usbnet *, struct usb_interface *);
 
diff --git a/include/linux/wl12xx.h b/include/linux/wl12xx.h
index 4f902e1908a..bebb8efea0a 100644
--- a/include/linux/wl12xx.h
+++ b/include/linux/wl12xx.h
@@ -24,6 +24,14 @@
 #ifndef _LINUX_WL12XX_H
 #define _LINUX_WL12XX_H
 
+/* The board reference clock values */
+enum {
+        WL12XX_REFCLOCK_19 = 0, /* 19.2 MHz */
+        WL12XX_REFCLOCK_26 = 1, /* 26 MHz */
+        WL12XX_REFCLOCK_38 = 2, /* 38.4 MHz */
+        WL12XX_REFCLOCK_54 = 3, /* 54 MHz */
+};
+
 struct wl12xx_platform_data {
         void (*set_power)(bool enable);
         /* SDIO only: IRQ number if WLAN_IRQ line is used, 0 for SDIO IRQs */
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index a9441249306..23710aa6a18 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -1,8 +1,6 @@
 #ifndef _ADDRCONF_H
 #define _ADDRCONF_H
 
-#define RETRANS_TIMER   HZ
-
 #define MAX_RTR_SOLICITATIONS           3
 #define RTR_SOLICITATION_INTERVAL       (4*HZ)
 
diff --git a/include/net/caif/cfctrl.h b/include/net/caif/cfctrl.h
index 9402543fc20..e54f6396fa4 100644
--- a/include/net/caif/cfctrl.h
+++ b/include/net/caif/cfctrl.h
@@ -51,7 +51,7 @@ struct cfctrl_rsp {
         void (*restart_rsp)(void);
         void (*radioset_rsp)(void);
         void (*reject_rsp)(struct cflayer *layer, u8 linkid,
-                                struct cflayer *client_layer);;
+                                struct cflayer *client_layer);
 };
 
 /* Link Setup Parameters for CAIF-Links. */
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 97b8b7c9b63..0663945cfa4 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -923,6 +923,7 @@ struct cfg80211_disassoc_request {
  * @privacy: this is a protected network, keys will be configured
  *      after joining
  * @basic_rates: bitmap of basic rates to use when creating the IBSS
+ * @mcast_rate: per-band multicast rate index + 1 (0: disabled)
  */
 struct cfg80211_ibss_params {
         u8 *ssid;
@@ -934,6 +935,7 @@ struct cfg80211_ibss_params {
         u32 basic_rates;
         bool channel_fixed;
         bool privacy;
+        int mcast_rate[IEEE80211_NUM_BANDS];
 };
 
 /**
@@ -1304,6 +1306,9 @@ struct cfg80211_ops {
         void    (*mgmt_frame_register)(struct wiphy *wiphy,
                                        struct net_device *dev,
                                        u16 frame_type, bool reg);
+
+        int     (*set_antenna)(struct wiphy *wiphy, u32 tx_ant, u32 rx_ant);
+        int     (*get_antenna)(struct wiphy *wiphy, u32 *tx_ant, u32 *rx_ant);
 };
 
 /*
@@ -1321,13 +1326,14 @@ struct cfg80211_ops {
  *      initiator is %REGDOM_SET_BY_CORE).
  * @WIPHY_FLAG_STRICT_REGULATORY: tells us the driver for this device will
  *      ignore regulatory domain settings until it gets its own regulatory
- *      domain via its regulatory_hint(). After its gets its own regulatory
- *      domain it will only allow further regulatory domain settings to
- *      further enhance compliance. For example if channel 13 and 14 are
- *      disabled by this regulatory domain no user regulatory domain can
- *      enable these channels at a later time. This can be used for devices
- *      which do not have calibration information gauranteed for frequencies
- *      or settings outside of its regulatory domain.
+ *      domain via its regulatory_hint() unless the regulatory hint is
+ *      from a country IE. After its gets its own regulatory domain it will
+ *      only allow further regulatory domain settings to further enhance
+ *      compliance. For example if channel 13 and 14 are disabled by this
+ *      regulatory domain no user regulatory domain can enable these channels
+ *      at a later time. This can be used for devices which do not have
+ *      calibration information guaranteed for frequencies or settings
+ *      outside of its regulatory domain.
  * @WIPHY_FLAG_DISABLE_BEACON_HINTS: enable this if your driver needs to ensure
  *      that passive scan flags and beaconing flags may not be lifted by
  *      cfg80211 due to regulatory beacon hints. For more information on beacon
@@ -2595,6 +2601,18 @@ void cfg80211_cqm_rssi_notify(struct net_device *dev,
                               enum nl80211_cqm_rssi_threshold_event rssi_event,
                               gfp_t gfp);
 
+/**
+ * cfg80211_cqm_pktloss_notify - notify userspace about packetloss to peer
+ * @dev: network device
+ * @peer: peer's MAC address
+ * @num_packets: how many packets were lost -- should be a fixed threshold
+ *      but probably no less than maybe 50, or maybe a throughput dependent
+ *      threshold (to account for temporary interference)
+ * @gfp: context flags
+ */
+void cfg80211_cqm_pktloss_notify(struct net_device *dev,
+                                 const u8 *peer, u32 num_packets, gfp_t gfp);
+
 /* Logging, debugging and troubleshooting/diagnostic helpers. */
 
 /* wiphy_printk helpers, similar to dev_printk */
diff --git a/include/net/dn_dev.h b/include/net/dn_dev.h
index 0916bbf3bdf..b9e32db03f2 100644
--- a/include/net/dn_dev.h
+++ b/include/net/dn_dev.h
@@ -5,13 +5,14 @@
 struct dn_dev;
 
 struct dn_ifaddr {
-        struct dn_ifaddr *ifa_next;
+        struct dn_ifaddr __rcu *ifa_next;
         struct dn_dev    *ifa_dev;
         __le16            ifa_local;
         __le16            ifa_address;
         __u8              ifa_flags;
         __u8              ifa_scope;
         char              ifa_label[IFNAMSIZ];
+        struct rcu_head   rcu;
 };
 
 #define DN_DEV_S_RU  0 /* Run - working normally   */
@@ -83,7 +84,7 @@ struct dn_dev_parms {
 
 
 struct dn_dev {
-        struct dn_ifaddr *ifa_list;
+        struct dn_ifaddr __rcu *ifa_list;
         struct net_device *dev;
         struct dn_dev_parms parms;
         char use_long;
@@ -171,19 +172,27 @@ extern int unregister_dnaddr_notifier(struct notifier_block *nb);
 
 static inline int dn_dev_islocal(struct net_device *dev, __le16 addr)
 {
-        struct dn_dev *dn_db = dev->dn_ptr;
+        struct dn_dev *dn_db;
         struct dn_ifaddr *ifa;
+        int res = 0;
 
+        rcu_read_lock();
+        dn_db = rcu_dereference(dev->dn_ptr);
         if (dn_db == NULL) {
                 printk(KERN_DEBUG "dn_dev_islocal: Called for non DECnet device\n");
-                return 0;
+                goto out;
         }
 
-        for(ifa = dn_db->ifa_list; ifa; ifa = ifa->ifa_next)
-                if ((addr ^ ifa->ifa_local) == 0)
-                        return 1;
-
-        return 0;
+        for (ifa = rcu_dereference(dn_db->ifa_list);
+             ifa != NULL;
+             ifa = rcu_dereference(ifa->ifa_next))
+                if ((addr ^ ifa->ifa_local) == 0) {
+                        res = 1;
+                        break;
+                }
+out:
+        rcu_read_unlock();
+        return res;
 }
 
 #endif /* _NET_DN_DEV_H */
diff --git a/include/net/dn_route.h b/include/net/dn_route.h
index ccadab3aa3f..9b185df265f 100644
--- a/include/net/dn_route.h
+++ b/include/net/dn_route.h
@@ -80,6 +80,16 @@ struct dn_route {
         unsigned rt_type;
 };
 
+static inline bool dn_is_input_route(struct dn_route *rt)
+{
+        return rt->fl.iif != 0;
+}
+
+static inline bool dn_is_output_route(struct dn_route *rt)
+{
+        return rt->fl.iif == 0;
+}
+
 extern void dn_route_init(void);
 extern void dn_route_cleanup(void);
 
diff --git a/include/net/dst.h b/include/net/dst.h
index ffe9cb719c0..a5bd72646d6 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -94,10 +94,10 @@ struct dst_entry {
         int                     __use;
         unsigned long           lastuse;
         union {
-                struct dst_entry *next;
-                struct rtable __rcu *rt_next;
-                struct rt6_info   *rt6_next;
-                struct dn_route  *dn_next;
+                struct dst_entry        *next;
+                struct rtable __rcu     *rt_next;
+                struct rt6_info         *rt6_next;
+                struct dn_route __rcu   *dn_next;
         };
 };
 
diff --git a/include/net/flow.h b/include/net/flow.h
index 0ac3fb5e097..7196e6864b8 100644
--- a/include/net/flow.h
+++ b/include/net/flow.h
@@ -67,6 +67,7 @@ struct flowi {
                 } dnports;
 
                 __be32          spi;
+                __be32          gre_key;
 
                 struct {
                         __u8    type;
@@ -78,6 +79,7 @@ struct flowi {
 #define fl_icmp_code    uli_u.icmpt.code
 #define fl_ipsec_spi    uli_u.spi
 #define fl_mh_type      uli_u.mht.type
+#define fl_gre_key      uli_u.gre_key
         __u32           secid;  /* used by xfrm; see secid.txt */
 } __attribute__((__aligned__(BITS_PER_LONG/8)));
 
diff --git a/include/net/if_inet6.h b/include/net/if_inet6.h
index f95ff8d9aa4..04977eefb0e 100644
--- a/include/net/if_inet6.h
+++ b/include/net/if_inet6.h
@@ -89,10 +89,11 @@ struct ip6_sf_socklist {
 struct ipv6_mc_socklist {
         struct in6_addr         addr;
         int                     ifindex;
-        struct ipv6_mc_socklist *next;
+        struct ipv6_mc_socklist __rcu *next;
         rwlock_t                sflock;
         unsigned int            sfmode;         /* MCAST_{INCLUDE,EXCLUDE} */
         struct ip6_sf_socklist  *sflist;
+        struct rcu_head         rcu;
 };
 
 struct ip6_sf_list {
diff --git a/include/net/inet6_connection_sock.h b/include/net/inet6_connection_sock.h
index aae08f68663..ff013505236 100644
--- a/include/net/inet6_connection_sock.h
+++ b/include/net/inet6_connection_sock.h
@@ -25,6 +25,9 @@ struct sockaddr;
 extern int inet6_csk_bind_conflict(const struct sock *sk,
                                    const struct inet_bind_bucket *tb);
 
+extern struct dst_entry* inet6_csk_route_req(struct sock *sk,
+                                             const struct request_sock *req);
+
 extern struct request_sock *inet6_csk_search_req(const struct sock *sk,
                                                  struct request_sock ***prevp,
                                                  const __be16 rport,
diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
index e4f494b42e0..6c93a56cc95 100644
--- a/include/net/inet_connection_sock.h
+++ b/include/net/inet_connection_sock.h
@@ -43,7 +43,7 @@ struct inet_connection_sock_af_ops {
         struct sock *(*syn_recv_sock)(struct sock *sk, struct sk_buff *skb,
                                       struct request_sock *req,
                                       struct dst_entry *dst);
-        int         (*remember_stamp)(struct sock *sk);
+        struct inet_peer *(*get_peer)(struct sock *sk, bool *release_it);
         u16         net_header_len;
         u16         sockaddr_len;
         int         (*setsockopt)(struct sock *sk, int level, int optname, 
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index 1989cfd7405..8945f9fb192 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -141,7 +141,7 @@ struct inet_sock {
                                 nodefrag:1;
         int                     mc_index;
         __be32                  mc_addr;
-        struct ip_mc_socklist   *mc_list;
+        struct ip_mc_socklist __rcu     *mc_list;
         struct {
                 unsigned int            flags;
                 unsigned int            fragsize;
diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
index fe239bfe5f7..599d96e7411 100644
--- a/include/net/inetpeer.h
+++ b/include/net/inetpeer.h
@@ -11,12 +11,21 @@
 #include <linux/init.h>
 #include <linux/jiffies.h>
 #include <linux/spinlock.h>
+#include <net/ipv6.h>
 #include <asm/atomic.h>
 
+struct inetpeer_addr {
+        union {
+                __be32          a4;
+                __be32          a6[4];
+        };
+        __u16   family;
+};
+
 struct inet_peer {
         /* group together avl_left,avl_right,v4daddr to speedup lookups */
         struct inet_peer __rcu  *avl_left, *avl_right;
-        __be32                  v4daddr;        /* peer's address */
+        struct inetpeer_addr    daddr;
         __u32                   avl_height;
         struct list_head        unused;
         __u32                   dtime;          /* the time of last use of not
@@ -26,7 +35,6 @@ struct inet_peer {
          * Once inet_peer is queued for deletion (refcnt == -1), following fields
          * are not available: rid, ip_id_count, tcp_ts, tcp_ts_stamp
          * We can share memory with rcu_head to keep inet_peer small
-         * (less then 64 bytes)
          */
         union {
                 struct {
@@ -42,7 +50,25 @@ struct inet_peer {
 void                    inet_initpeers(void) __init;
 
 /* can be called with or without local BH being disabled */
-struct inet_peer        *inet_getpeer(__be32 daddr, int create);
+struct inet_peer        *inet_getpeer(struct inetpeer_addr *daddr, int create);
+
+static inline struct inet_peer *inet_getpeer_v4(__be32 v4daddr, int create)
+{
+        struct inetpeer_addr daddr;
+
+        daddr.a4 = v4daddr;
+        daddr.family = AF_INET;
+        return inet_getpeer(&daddr, create);
+}
+
+static inline struct inet_peer *inet_getpeer_v6(struct in6_addr *v6daddr, int create)
+{
+        struct inetpeer_addr daddr;
+
+        ipv6_addr_copy((struct in6_addr *)daddr.a6, v6daddr);
+        daddr.family = AF_INET6;
+        return inet_getpeer(&daddr, create);
+}
 
 /* can be called from BH context or outside */
 extern void inet_putpeer(struct inet_peer *p);
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index 062a823d311..708ff7cb880 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -21,6 +21,7 @@
 #include <net/dst.h>
 #include <net/flow.h>
 #include <net/netlink.h>
+#include <net/inetpeer.h>
 
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
 #define FIB6_TABLE_HASHSZ 256
@@ -109,6 +110,7 @@ struct rt6_info {
         u32                             rt6i_metric;
 
         struct inet6_dev                *rt6i_idev;
+        struct inet_peer                *rt6i_peer;
 
 #ifdef CONFIG_XFRM
         u32                             rt6i_flow_cache_genid;
diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index 278312c95f9..e06e0ca1e91 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -3,7 +3,6 @@
 
 #define IP6_RT_PRIO_USER        1024
 #define IP6_RT_PRIO_ADDRCONF    256
-#define IP6_RT_PRIO_KERN        512
 
 struct route_info {
         __u8                    type;
@@ -56,6 +55,18 @@ static inline unsigned int rt6_flags2srcprefs(int flags)
         return (flags >> 3) & 7;
 }
 
+extern void                     rt6_bind_peer(struct rt6_info *rt,
+                                              int create);
+
+static inline struct inet_peer *rt6_get_peer(struct rt6_info *rt)
+{
+        if (rt->rt6i_peer)
+                return rt->rt6i_peer;
+
+        rt6_bind_peer(rt, 0);
+        return rt->rt6i_peer;
+}
+
 extern void                     ip6_route_input(struct sk_buff *skb);
 
 extern struct dst_entry *       ip6_route_output(struct net *net,
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 9fdf982d128..eaa4affd40c 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -97,6 +97,20 @@ enum ieee80211_max_queues {
 };
 
 /**
+ * enum ieee80211_ac_numbers - AC numbers as used in mac80211
+ * @IEEE80211_AC_VO: voice
+ * @IEEE80211_AC_VI: video
+ * @IEEE80211_AC_BE: best effort
+ * @IEEE80211_AC_BK: background
+ */
+enum ieee80211_ac_numbers {
+        IEEE80211_AC_VO         = 0,
+        IEEE80211_AC_VI         = 1,
+        IEEE80211_AC_BE         = 2,
+        IEEE80211_AC_BK         = 3,
+};
+
+/**
  * struct ieee80211_tx_queue_params - transmit queue configuration
  *
  * The information provided in this structure is required for QoS
@@ -205,6 +219,7 @@ enum ieee80211_bss_change {
  * @basic_rates: bitmap of basic rates, each bit stands for an
  *      index into the rate table configured by the driver in
  *      the current band.
+ * @mcast_rate: per-band multicast rate index + 1 (0: disabled)
  * @bssid: The BSSID for this BSS
  * @enable_beacon: whether beaconing should be enabled or not
  * @channel_type: Channel type for this BSS -- the hardware might be
@@ -244,6 +259,7 @@ struct ieee80211_bss_conf {
         u16 assoc_capability;
         u64 timestamp;
         u32 basic_rates;
+        int mcast_rate[IEEE80211_NUM_BANDS];
         u16 ht_operation_mode;
         s32 cqm_rssi_thold;
         u32 cqm_rssi_hyst;
@@ -1652,6 +1668,11 @@ enum ieee80211_ampdu_mlme_action {
  *      and IV16) for the given key from hardware.
  *      The callback must be atomic.
  *
+ * @set_frag_threshold: Configuration of fragmentation threshold. Assign this
+ *      if the device does fragmentation by itself; if this callback is
+ *      implemented then the stack will not do fragmentation.
+ *      The callback can sleep.
+ *
  * @set_rts_threshold: Configuration of RTS threshold (if device needs it)
  *      The callback can sleep.
  *
@@ -1724,6 +1745,13 @@ enum ieee80211_ampdu_mlme_action {
  *      completion of the channel switch.
  *
  * @napi_poll: Poll Rx queue for incoming data frames.
+ *
+ * @set_antenna: Set antenna configuration (tx_ant, rx_ant) on the device.
+ *      Parameters are bitmaps of allowed antennas to use for TX/RX. Drivers may
+ *      reject TX/RX mask combinations they cannot support by returning -EINVAL
+ *      (also see nl80211.h @NL80211_ATTR_WIPHY_ANTENNA_TX).
+ *
+ * @get_antenna: Get current antenna configuration from device (tx_ant, rx_ant).
  */
 struct ieee80211_ops {
         int (*tx)(struct ieee80211_hw *hw, struct sk_buff *skb);
@@ -1765,6 +1793,7 @@ struct ieee80211_ops {
                          struct ieee80211_low_level_stats *stats);
         void (*get_tkip_seq)(struct ieee80211_hw *hw, u8 hw_key_idx,
                              u32 *iv32, u16 *iv16);
+        int (*set_frag_threshold)(struct ieee80211_hw *hw, u32 value);
         int (*set_rts_threshold)(struct ieee80211_hw *hw, u32 value);
         int (*sta_add)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                        struct ieee80211_sta *sta);
@@ -1793,6 +1822,8 @@ struct ieee80211_ops {
         void (*channel_switch)(struct ieee80211_hw *hw,
                                struct ieee80211_channel_switch *ch_switch);
         int (*napi_poll)(struct ieee80211_hw *hw, int budget);
+        int (*set_antenna)(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant);
+        int (*get_antenna)(struct ieee80211_hw *hw, u32 *tx_ant, u32 *rx_ant);
 };
 
 /**
@@ -2501,6 +2532,21 @@ void ieee80211_sta_block_awake(struct ieee80211_hw *hw,
                                struct ieee80211_sta *pubsta, bool block);
 
 /**
+ * ieee80211_ap_probereq_get - retrieve a Probe Request template
+ * @hw: pointer obtained from ieee80211_alloc_hw().
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
+ *
+ * Creates a Probe Request template which can, for example, be uploaded to
+ * hardware. The template is filled with bssid, ssid and supported rate
+ * information. This function must only be called from within the
+ * .bss_info_changed callback function and only in managed mode. The function
+ * is only useful when the interface is associated, otherwise it will return
+ * NULL.
+ */
+struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
+                                          struct ieee80211_vif *vif);
+
+/**
  * ieee80211_beacon_loss - inform hardware does not receive beacons
  *
  * @vif: &struct ieee80211_vif pointer from the add_interface callback.
@@ -2640,7 +2686,7 @@ enum rate_control_changed {
  * @rate_idx_mask: user-requested rate mask (not MCS for now)
  * @skb: the skb that will be transmitted, the control information in it needs
  *      to be filled in
- * @ap: whether this frame is sent out in AP mode
+ * @bss: whether this frame is sent out in AP or IBSS mode
  */
 struct ieee80211_tx_rate_control {
         struct ieee80211_hw *hw;
@@ -2651,7 +2697,7 @@ struct ieee80211_tx_rate_control {
         bool rts, short_preamble;
         u8 max_rate_idx;
         u32 rate_idx_mask;
-        bool ap;
+        bool bss;
 };
 
 struct rate_control_ops {
diff --git a/include/net/ndisc.h b/include/net/ndisc.h
index 895997bc2ea..e0e594f8e9d 100644
--- a/include/net/ndisc.h
+++ b/include/net/ndisc.h
@@ -42,9 +42,6 @@ enum {
 #define ND_REACHABLE_TIME               (30*HZ)
 #define ND_RETRANS_TIMER                HZ
 
-#define ND_MIN_RANDOM_FACTOR            (1/2)
-#define ND_MAX_RANDOM_FACTOR            (3/2)
-
 #ifdef __KERNEL__
 
 #include <linux/compiler.h>
diff --git a/include/net/neighbour.h b/include/net/neighbour.h
index 6beb1ffc2b7..4014b623880 100644
--- a/include/net/neighbour.h
+++ b/include/net/neighbour.h
@@ -96,16 +96,16 @@ struct neighbour {
         struct neigh_parms      *parms;
         unsigned long           confirmed;
         unsigned long           updated;
-        __u8                    flags;
-        __u8                    nud_state;
-        __u8                    type;
-        __u8                    dead;
+        rwlock_t                lock;
         atomic_t                refcnt;
         struct sk_buff_head     arp_queue;
         struct timer_list       timer;
         unsigned long           used;
         atomic_t                probes;
-        rwlock_t                lock;
+        __u8                    flags;
+        __u8                    nud_state;
+        __u8                    type;
+        __u8                    dead;
         seqlock_t               ha_lock;
         unsigned char           ha[ALIGN(MAX_ADDR_LEN, sizeof(unsigned long))];
         struct hh_cache         *hh;
diff --git a/include/net/netlink.h b/include/net/netlink.h
index 9801c55de5d..373f1a900cf 100644
--- a/include/net/netlink.h
+++ b/include/net/netlink.h
@@ -225,13 +225,15 @@ extern int		nlmsg_notify(struct sock *sk, struct sk_buff *skb,
                                      u32 pid, unsigned int group, int report,
                                      gfp_t flags);
 
-extern int              nla_validate(struct nlattr *head, int len, int maxtype,
+extern int              nla_validate(const struct nlattr *head,
+                                     int len, int maxtype,
                                      const struct nla_policy *policy);
-extern int              nla_parse(struct nlattr *tb[], int maxtype,
-                                  struct nlattr *head, int len,
+extern int              nla_parse(struct nlattr **tb, int maxtype,
+                                  const struct nlattr *head, int len,
                                   const struct nla_policy *policy);
 extern int              nla_policy_len(const struct nla_policy *, int);
-extern struct nlattr *  nla_find(struct nlattr *head, int len, int attrtype);
+extern struct nlattr *  nla_find(const struct nlattr *head,
+                                 int len, int attrtype);
 extern size_t           nla_strlcpy(char *dst, const struct nlattr *nla,
                                     size_t dstsize);
 extern int              nla_memcpy(void *dest, const struct nlattr *src, int count);
@@ -346,7 +348,8 @@ static inline int nlmsg_ok(const struct nlmsghdr *nlh, int remaining)
  * Returns the next netlink message in the message stream and
  * decrements remaining by the size of the current message.
  */
-static inline struct nlmsghdr *nlmsg_next(struct nlmsghdr *nlh, int *remaining)
+static inline struct nlmsghdr *
+nlmsg_next(const struct nlmsghdr *nlh, int *remaining)
 {
         int totlen = NLMSG_ALIGN(nlh->nlmsg_len);
 
@@ -398,7 +401,8 @@ static inline struct nlattr *nlmsg_find_attr(const struct nlmsghdr *nlh,
  * @maxtype: maximum attribute type to be expected
  * @policy: validation policy
  */
-static inline int nlmsg_validate(struct nlmsghdr *nlh, int hdrlen, int maxtype,
+static inline int nlmsg_validate(const struct nlmsghdr *nlh,
+                                 int hdrlen, int maxtype,
                                  const struct nla_policy *policy)
 {
         if (nlh->nlmsg_len < nlmsg_msg_size(hdrlen))
@@ -727,7 +731,8 @@ static inline struct nlattr *nla_next(const struct nlattr *nla, int *remaining)
  *
  * Returns the first attribute which matches the specified type.
  */
-static inline struct nlattr *nla_find_nested(struct nlattr *nla, int attrtype)
+static inline struct nlattr *
+nla_find_nested(const struct nlattr *nla, int attrtype)
 {
         return nla_find(nla_data(nla), nla_len(nla), attrtype);
 }
@@ -1032,7 +1037,7 @@ static inline void nla_nest_cancel(struct sk_buff *skb, struct nlattr *start)
  *
  * Returns 0 on success or a negative error code.
  */
-static inline int nla_validate_nested(struct nlattr *start, int maxtype,
+static inline int nla_validate_nested(const struct nlattr *start, int maxtype,
                                       const struct nla_policy *policy)
 {
         return nla_validate(nla_data(start), nla_len(start), maxtype, policy);
diff --git a/include/net/netns/generic.h b/include/net/netns/generic.h
index 81a31c0db3e..3419bf5cd15 100644
--- a/include/net/netns/generic.h
+++ b/include/net/netns/generic.h
@@ -30,7 +30,7 @@ struct net_generic {
         void *ptr[0];
 };
 
-static inline void *net_generic(struct net *net, int id)
+static inline void *net_generic(const struct net *net, int id)
 {
         struct net_generic *ng;
         void *ptr;
diff --git a/include/net/regulatory.h b/include/net/regulatory.h
index 9e103a4e91e..356d6e3dc20 100644
--- a/include/net/regulatory.h
+++ b/include/net/regulatory.h
@@ -43,6 +43,12 @@ enum environment_cap {
  * @intersect: indicates whether the wireless core should intersect
  *      the requested regulatory domain with the presently set regulatory
  *      domain.
+ * @processed: indicates whether or not this requests has already been
+ *      processed. When the last request is processed it means that the
+ *      currently regulatory domain set on cfg80211 is updated from
+ *      CRDA and can be used by other regulatory requests. When a
+ *      the last request is not yet processed we must yield until it
+ *      is processed before processing any new requests.
  * @country_ie_checksum: checksum of the last processed and accepted
  *      country IE
  * @country_ie_env: lets us know if the AP is telling us we are outdoor,
@@ -54,6 +60,7 @@ struct regulatory_request {
         enum nl80211_reg_initiator initiator;
         char alpha2[2];
         bool intersect;
+        bool processed;
         enum environment_cap country_ie_env;
         struct list_head list;
 };
diff --git a/include/net/route.h b/include/net/route.h
index 7e5e73bfa4d..b8c1f7703fc 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -55,8 +55,6 @@ struct rtable {
         /* Cache lookup keys */
         struct flowi            fl;
 
-        struct in_device        *idev;
-        
         int                     rt_genid;
         unsigned                rt_flags;
         __u16                   rt_type;
@@ -73,6 +71,16 @@ struct rtable {
         struct inet_peer        *peer; /* long-living peer info */
 };
 
+static inline bool rt_is_input_route(struct rtable *rt)
+{
+        return rt->fl.iif != 0;
+}
+
+static inline bool rt_is_output_route(struct rtable *rt)
+{
+        return rt->fl.iif == 0;
+}
+
 struct ip_rt_acct {
         __u32   o_bytes;
         __u32   o_packets;
@@ -161,14 +169,12 @@ static inline int ip_route_connect(struct rtable **rp, __be32 dst,
 {
         struct flowi fl = { .oif = oif,
                             .mark = sk->sk_mark,
-                            .nl_u = { .ip4_u = { .daddr = dst,
-                                                 .saddr = src,
-                                                 .tos   = tos } },
+                            .fl4_dst = dst,
+                            .fl4_src = src,
+                            .fl4_tos = tos,
                             .proto = protocol,
-                            .uli_u = { .ports =
-                                       { .sport = sport,
-                                         .dport = dport } } };
-
+                            .fl_ip_sport = sport,
+                            .fl_ip_dport = dport };
         int err;
         struct net *net = sock_net(sk);
 
diff --git a/include/net/rtnetlink.h b/include/net/rtnetlink.h
index e013c68bfb0..4093ca78cf6 100644
--- a/include/net/rtnetlink.h
+++ b/include/net/rtnetlink.h
@@ -83,6 +83,41 @@ extern void	__rtnl_link_unregister(struct rtnl_link_ops *ops);
 extern int      rtnl_link_register(struct rtnl_link_ops *ops);
 extern void     rtnl_link_unregister(struct rtnl_link_ops *ops);
 
+/**
+ *      struct rtnl_af_ops - rtnetlink address family operations
+ *
+ *      @list: Used internally
+ *      @family: Address family
+ *      @fill_link_af: Function to fill IFLA_AF_SPEC with address family
+ *                     specific netlink attributes.
+ *      @get_link_af_size: Function to calculate size of address family specific
+ *                         netlink attributes exlusive the container attribute.
+ *      @validate_link_af: Validate a IFLA_AF_SPEC attribute, must check attr
+ *                         for invalid configuration settings.
+ *      @set_link_af: Function to parse a IFLA_AF_SPEC attribute and modify
+ *                    net_device accordingly.
+ */
+struct rtnl_af_ops {
+        struct list_head        list;
+        int                     family;
+
+        int                     (*fill_link_af)(struct sk_buff *skb,
+                                                const struct net_device *dev);
+        size_t                  (*get_link_af_size)(const struct net_device *dev);
+
+        int                     (*validate_link_af)(const struct net_device *dev,
+                                                    const struct nlattr *attr);
+        int                     (*set_link_af)(struct net_device *dev,
+                                               const struct nlattr *attr);
+};
+
+extern int      __rtnl_af_register(struct rtnl_af_ops *ops);
+extern void     __rtnl_af_unregister(struct rtnl_af_ops *ops);
+
+extern int      rtnl_af_register(struct rtnl_af_ops *ops);
+extern void     rtnl_af_unregister(struct rtnl_af_ops *ops);
+
+
 extern struct net *rtnl_link_get_net(struct net *src_net, struct nlattr *tb[]);
 extern struct net_device *rtnl_create_link(struct net *src_net, struct net *net,
         char *ifname, const struct rtnl_link_ops *ops, struct nlattr *tb[]);
diff --git a/include/net/scm.h b/include/net/scm.h
index 31656506d96..745460fa2f0 100644
--- a/include/net/scm.h
+++ b/include/net/scm.h
@@ -10,11 +10,12 @@
 /* Well, we should have at least one descriptor open
  * to accept passed FDs 8)
  */
-#define SCM_MAX_FD      255
+#define SCM_MAX_FD      253
 
 struct scm_fp_list {
         struct list_head        list;
-        int                     count;
+        short                   count;
+        short                   max;
         struct file             *fp[SCM_MAX_FD];
 };
 
diff --git a/include/net/sctp/command.h b/include/net/sctp/command.h
index 2c55a7ea20a..c01dc99def0 100644
--- a/include/net/sctp/command.h
+++ b/include/net/sctp/command.h
@@ -111,9 +111,6 @@ typedef enum {
         SCTP_CMD_LAST
 } sctp_verb_t;
 
-#define SCTP_CMD_MAX            (SCTP_CMD_LAST - 1)
-#define SCTP_CMD_NUM_VERBS      (SCTP_CMD_MAX + 1)
-
 /* How many commands can you put in an sctp_cmd_seq_t?
  * This is a rather arbitrary number, ideally derived from a careful
  * analysis of the state functions, but in reality just taken from
diff --git a/include/net/sctp/constants.h b/include/net/sctp/constants.h
index 63908840eef..c70d8ccc55c 100644
--- a/include/net/sctp/constants.h
+++ b/include/net/sctp/constants.h
@@ -61,7 +61,6 @@ enum { SCTP_DEFAULT_INSTREAMS = SCTP_MAX_STREAM };
  * symbols.  CIDs are dense through SCTP_CID_BASE_MAX.
  */
 #define SCTP_CID_BASE_MAX               SCTP_CID_SHUTDOWN_COMPLETE
-#define SCTP_CID_MAX                    SCTP_CID_ASCONF_ACK
 
 #define SCTP_NUM_BASE_CHUNK_TYPES       (SCTP_CID_BASE_MAX + 1)
 
@@ -86,9 +85,6 @@ typedef enum {
 
 } sctp_event_t;
 
-#define SCTP_EVENT_T_MAX SCTP_EVENT_T_PRIMITIVE
-#define SCTP_EVENT_T_NUM (SCTP_EVENT_T_MAX + 1)
-
 /* As a convenience for the state machine, we append SCTP_EVENT_* and
  * SCTP_ULP_* to the list of possible chunks.
  */
@@ -162,9 +158,6 @@ SCTP_SUBTYPE_CONSTRUCTOR(PRIMITIVE,	sctp_event_primitive_t,	primitive)
                                 - (unsigned long)(c->chunk_hdr)\
                                 - sizeof(sctp_data_chunk_t)))
 
-#define SCTP_MAX_ERROR_CAUSE  SCTP_ERROR_NONEXIST_IP
-#define SCTP_NUM_ERROR_CAUSE  10
-
 /* Internal error codes */
 typedef enum {
 
@@ -266,7 +259,6 @@ enum { SCTP_ARBITRARY_COOKIE_ECHO_LEN = 200 };
 #define SCTP_TSN_MAP_INITIAL BITS_PER_LONG
 #define SCTP_TSN_MAP_INCREMENT SCTP_TSN_MAP_INITIAL
 #define SCTP_TSN_MAP_SIZE 4096
-#define SCTP_TSN_MAX_GAP  65535
 
 /* We will not record more than this many duplicate TSNs between two
  * SACKs.  The minimum PMTU is 576.  Remove all the headers and there
@@ -301,9 +293,6 @@ enum { SCTP_MAX_GABS = 16 };
 
 #define SCTP_CLOCK_GRANULARITY  1       /* 1 jiffy */
 
-#define SCTP_DEF_MAX_INIT 6
-#define SCTP_DEF_MAX_SEND 10
-
 #define SCTP_DEFAULT_COOKIE_LIFE        (60 * 1000) /* 60 seconds */
 
 #define SCTP_DEFAULT_MINWINDOW  1500    /* default minimum rwnd size */
@@ -317,9 +306,6 @@ enum { SCTP_MAX_GABS = 16 };
                                          */
 #define SCTP_DEFAULT_MINSEGMENT 512     /* MTU size ... if no mtu disc */
 #define SCTP_HOW_MANY_SECRETS 2         /* How many secrets I keep */
-#define SCTP_HOW_LONG_COOKIE_LIVE 3600  /* How many seconds the current
-                                         * secret will live?
-                                         */
 #define SCTP_SECRET_SIZE 32             /* Number of octets in a 256 bits. */
 
 #define SCTP_SIGNATURE_SIZE 20          /* size of a SLA-1 signature */
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index 69fef4fb79c..cc9185ca8fd 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -261,8 +261,6 @@ extern struct sctp_globals {
 #define sctp_assoc_hashsize             (sctp_globals.assoc_hashsize)
 #define sctp_assoc_hashtable            (sctp_globals.assoc_hashtable)
 #define sctp_port_hashsize              (sctp_globals.port_hashsize)
-#define sctp_port_rover                 (sctp_globals.port_rover)
-#define sctp_port_alloc_lock            (sctp_globals.port_alloc_lock)
 #define sctp_port_hashtable             (sctp_globals.port_hashtable)
 #define sctp_local_addr_list            (sctp_globals.local_addr_list)
 #define sctp_local_addr_lock            (sctp_globals.addr_list_lock)
diff --git a/include/net/snmp.h b/include/net/snmp.h
index a0e61806d48..762e2abce88 100644
--- a/include/net/snmp.h
+++ b/include/net/snmp.h
@@ -60,9 +60,7 @@ struct ipstats_mib {
 };
 
 /* ICMP */
-#define ICMP_MIB_DUMMY  __ICMP_MIB_MAX
-#define ICMP_MIB_MAX    (__ICMP_MIB_MAX + 1)
-
+#define ICMP_MIB_MAX    __ICMP_MIB_MAX
 struct icmp_mib {
         unsigned long   mibs[ICMP_MIB_MAX];
 };
diff --git a/include/net/sock.h b/include/net/sock.h
index 659d968d95c..3482004e5c2 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -57,7 +57,7 @@
 #include <linux/rculist_nulls.h>
 #include <linux/poll.h>
 
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 #include <net/dst.h>
 #include <net/checksum.h>
 
@@ -241,59 +241,67 @@ struct sock {
 #define sk_bind_node            __sk_common.skc_bind_node
 #define sk_prot                 __sk_common.skc_prot
 #define sk_net                  __sk_common.skc_net
-        kmemcheck_bitfield_begin(flags);
-        unsigned int            sk_shutdown  : 2,
-                                sk_no_check  : 2,
-                                sk_userlocks : 4,
-                                sk_protocol  : 8,
-                                sk_type      : 16;
-        kmemcheck_bitfield_end(flags);
-        int                     sk_rcvbuf;
         socket_lock_t           sk_lock;
+        struct sk_buff_head     sk_receive_queue;
         /*
          * The backlog queue is special, it is always used with
          * the per-socket spinlock held and requires low latency
          * access. Therefore we special case it's implementation.
+         * Note : rmem_alloc is in this structure to fill a hole
+         * on 64bit arches, not because its logically part of
+         * backlog.
          */
         struct {
-                struct sk_buff *head;
-                struct sk_buff *tail;
-                int len;
+                atomic_t        rmem_alloc;
+                int             len;
+                struct sk_buff  *head;
+                struct sk_buff  *tail;
         } sk_backlog;
+#define sk_rmem_alloc sk_backlog.rmem_alloc
+        int                     sk_forward_alloc;
+#ifdef CONFIG_RPS
+        __u32                   sk_rxhash;
+#endif
+        atomic_t                sk_drops;
+        int                     sk_rcvbuf;
+
+        struct sk_filter __rcu  *sk_filter;
         struct socket_wq        *sk_wq;
-        struct dst_entry        *sk_dst_cache;
+
+#ifdef CONFIG_NET_DMA
+        struct sk_buff_head     sk_async_wait_queue;
+#endif
+
 #ifdef CONFIG_XFRM
         struct xfrm_policy      *sk_policy[2];
 #endif
+        unsigned long           sk_flags;
+        struct dst_entry        *sk_dst_cache;
         spinlock_t              sk_dst_lock;
-        atomic_t                sk_rmem_alloc;
         atomic_t                sk_wmem_alloc;
         atomic_t                sk_omem_alloc;
         int                     sk_sndbuf;
-        struct sk_buff_head     sk_receive_queue;
         struct sk_buff_head     sk_write_queue;
-#ifdef CONFIG_NET_DMA
-        struct sk_buff_head     sk_async_wait_queue;
-#endif
+        kmemcheck_bitfield_begin(flags);
+        unsigned int            sk_shutdown  : 2,
+                                sk_no_check  : 2,
+                                sk_userlocks : 4,
+                                sk_protocol  : 8,
+                                sk_type      : 16;
+        kmemcheck_bitfield_end(flags);
         int                     sk_wmem_queued;
-        int                     sk_forward_alloc;
         gfp_t                   sk_allocation;
         int                     sk_route_caps;
         int                     sk_route_nocaps;
         int                     sk_gso_type;
         unsigned int            sk_gso_max_size;
         int                     sk_rcvlowat;
-#ifdef CONFIG_RPS
-        __u32                   sk_rxhash;
-#endif
-        unsigned long           sk_flags;
         unsigned long           sk_lingertime;
         struct sk_buff_head     sk_error_queue;
         struct proto            *sk_prot_creator;
         rwlock_t                sk_callback_lock;
         int                     sk_err,
                                 sk_err_soft;
-        atomic_t                sk_drops;
         unsigned short          sk_ack_backlog;
         unsigned short          sk_max_ack_backlog;
         __u32                   sk_priority;
@@ -301,7 +309,6 @@ struct sock {
         const struct cred       *sk_peer_cred;
         long                    sk_rcvtimeo;
         long                    sk_sndtimeo;
-        struct sk_filter __rcu  *sk_filter;
         void                    *sk_protinfo;
         struct timer_list       sk_timer;
         ktime_t                 sk_stamp;
@@ -509,9 +516,6 @@ static __inline__ void sk_add_bind_node(struct sock *sk,
 #define sk_nulls_for_each_from(__sk, node) \
         if (__sk && ({ node = &(__sk)->sk_nulls_node; 1; })) \
                 hlist_nulls_for_each_entry_from(__sk, node, sk_nulls_node)
-#define sk_for_each_continue(__sk, node) \
-        if (__sk && ({ node = &(__sk)->sk_node; 1; })) \
-                hlist_for_each_entry_continue(__sk, node, sk_node)
 #define sk_for_each_safe(__sk, node, tmp, list) \
         hlist_for_each_entry_safe(__sk, node, tmp, list, sk_node)
 #define sk_for_each_bound(__sk, node, list) \
diff --git a/include/net/tcp.h b/include/net/tcp.h
index e36c874c7fb..3f227baee4b 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -100,12 +100,6 @@ extern void tcp_time_wait(struct sock *sk, int state, int timeo);
 #define TCP_SYNACK_RETRIES 5    /* number of times to retry passive opening a
                                  * connection: ~180sec is RFC minimum   */
 
-
-#define TCP_ORPHAN_RETRIES 7    /* number of times to retry on an orphaned
-                                 * socket. 7 is ~50sec-16min.
-                                 */
-
-
 #define TCP_TIMEWAIT_LEN (60*HZ) /* how long to wait to destroy TIME-WAIT
                                   * state, about 60 seconds     */
 #define TCP_FIN_TIMEOUT TCP_TIMEWAIT_LEN
@@ -312,7 +306,8 @@ extern void tcp_shutdown (struct sock *sk, int how);
 
 extern int tcp_v4_rcv(struct sk_buff *skb);
 
-extern int tcp_v4_remember_stamp(struct sock *sk);
+extern struct inet_peer *tcp_v4_get_peer(struct sock *sk, bool *release_it);
+extern void *tcp_v4_tw_get_peer(struct sock *sk);
 extern int tcp_v4_tw_remember_stamp(struct inet_timewait_sock *tw);
 extern int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                        size_t size);
diff --git a/include/net/timewait_sock.h b/include/net/timewait_sock.h
index 97c3b14da55..053b3cf2c66 100644
--- a/include/net/timewait_sock.h
+++ b/include/net/timewait_sock.h
@@ -21,6 +21,7 @@ struct timewait_sock_ops {
         int             (*twsk_unique)(struct sock *sk,
                                        struct sock *sktw, void *twp);
         void            (*twsk_destructor)(struct sock *sk);
+        void            *(*twsk_getpeer)(struct sock *sk);
 };
 
 static inline int twsk_unique(struct sock *sk, struct sock *sktw, void *twp)
@@ -39,4 +40,11 @@ static inline void twsk_destructor(struct sock *sk)
                 sk->sk_prot->twsk_prot->twsk_destructor(sk);
 }
 
+static inline void *twsk_getpeer(struct sock *sk)
+{
+        if (sk->sk_prot->twsk_prot->twsk_getpeer)
+                return sk->sk_prot->twsk_prot->twsk_getpeer(sk);
+        return NULL;
+}
+
 #endif /* _TIMEWAIT_SOCK_H */
diff --git a/include/net/tipc/tipc.h b/include/net/tipc/tipc.h
deleted file mode 100644
index 1e0645e1eed..00000000000
--- a/include/net/tipc/tipc.h
+++ /dev/null
@@ -1,186 +0,0 @@
-/*
- * include/net/tipc/tipc.h: Main include file for TIPC users
- * 
- * Copyright (c) 2003-2006, Ericsson AB
- * Copyright (c) 2005,2010 Wind River Systems
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the names of the copyright holders nor the names of its
- *    contributors may be used to endorse or promote products derived from
- *    this software without specific prior written permission.
- *
- * Alternatively, this software may be distributed under the terms of the
- * GNU General Public License ("GPL") version 2 as published by the Free
- * Software Foundation.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef _NET_TIPC_H_
-#define _NET_TIPC_H_
-
-#ifdef __KERNEL__
-
-#include <linux/tipc.h>
-#include <linux/skbuff.h>
-
-/* 
- * Native API
- */
-
-/*
- * TIPC operating mode routines
- */
-
-#define TIPC_NOT_RUNNING  0
-#define TIPC_NODE_MODE    1
-#define TIPC_NET_MODE     2
-
-typedef void (*tipc_mode_event)(void *usr_handle, int mode, u32 addr);
-
-int tipc_attach(unsigned int *userref, tipc_mode_event, void *usr_handle);
-
-void tipc_detach(unsigned int userref);
-
-/*
- * TIPC port manipulation routines
- */
-
-typedef void (*tipc_msg_err_event) (void *usr_handle,
-                                    u32 portref,
-                                    struct sk_buff **buf,
-                                    unsigned char const *data,
-                                    unsigned int size,
-                                    int reason, 
-                                    struct tipc_portid const *attmpt_destid);
-
-typedef void (*tipc_named_msg_err_event) (void *usr_handle,
-                                          u32 portref,
-                                          struct sk_buff **buf,
-                                          unsigned char const *data,
-                                          unsigned int size,
-                                          int reason, 
-                                          struct tipc_name_seq const *attmpt_dest);
-
-typedef void (*tipc_conn_shutdown_event) (void *usr_handle,
-                                          u32 portref,
-                                          struct sk_buff **buf,
-                                          unsigned char const *data,
-                                          unsigned int size,
-                                          int reason);
-
-typedef void (*tipc_msg_event) (void *usr_handle,
-                                u32 portref,
-                                struct sk_buff **buf,
-                                unsigned char const *data,
-                                unsigned int size,
-                                unsigned int importance, 
-                                struct tipc_portid const *origin);
-
-typedef void (*tipc_named_msg_event) (void *usr_handle,
-                                      u32 portref,
-                                      struct sk_buff **buf,
-                                      unsigned char const *data,
-                                      unsigned int size,
-                                      unsigned int importance, 
-                                      struct tipc_portid const *orig,
-                                      struct tipc_name_seq const *dest);
-
-typedef void (*tipc_conn_msg_event) (void *usr_handle,
-                                     u32 portref,
-                                     struct sk_buff **buf,
-                                     unsigned char const *data,
-                                     unsigned int size);
-
-typedef void (*tipc_continue_event) (void *usr_handle, 
-                                     u32 portref);
-
-int tipc_createport(unsigned int tipc_user, 
-                    void *usr_handle, 
-                    unsigned int importance, 
-                    tipc_msg_err_event error_cb, 
-                    tipc_named_msg_err_event named_error_cb, 
-                    tipc_conn_shutdown_event conn_error_cb, 
-                    tipc_msg_event message_cb, 
-                    tipc_named_msg_event named_message_cb, 
-                    tipc_conn_msg_event conn_message_cb, 
-                    tipc_continue_event continue_event_cb,
-                    u32 *portref);
-
-int tipc_deleteport(u32 portref);
-
-int tipc_ownidentity(u32 portref, struct tipc_portid *port);
-
-int tipc_portimportance(u32 portref, unsigned int *importance);
-int tipc_set_portimportance(u32 portref, unsigned int importance);
-
-int tipc_portunreliable(u32 portref, unsigned int *isunreliable);
-int tipc_set_portunreliable(u32 portref, unsigned int isunreliable);
-
-int tipc_portunreturnable(u32 portref, unsigned int *isunreturnable);
-int tipc_set_portunreturnable(u32 portref, unsigned int isunreturnable);
-
-int tipc_publish(u32 portref, unsigned int scope, 
-                 struct tipc_name_seq const *name_seq);
-int tipc_withdraw(u32 portref, unsigned int scope,
-                  struct tipc_name_seq const *name_seq);
-
-int tipc_connect2port(u32 portref, struct tipc_portid const *port);
-
-int tipc_disconnect(u32 portref);
-
-int tipc_shutdown(u32 ref);
-
-/*
- * TIPC messaging routines
- */
-
-#define TIPC_PORT_IMPORTANCE 100        /* send using current port setting */
-
-
-int tipc_send(u32 portref,
-              unsigned int num_sect,
-              struct iovec const *msg_sect);
-
-int tipc_send2name(u32 portref, 
-                   struct tipc_name const *name, 
-                   u32 domain,
-                   unsigned int num_sect,
-                   struct iovec const *msg_sect);
-
-int tipc_send2port(u32 portref,
-                   struct tipc_portid const *dest,
-                   unsigned int num_sect,
-                   struct iovec const *msg_sect);
-
-int tipc_send_buf2port(u32 portref,
-                       struct tipc_portid const *dest,
-                       struct sk_buff *buf,
-                       unsigned int dsz);
-
-int tipc_multicast(u32 portref, 
-                   struct tipc_name_seq const *seq, 
-                   u32 domain,  /* currently unused */
-                   unsigned int section_count,
-                   struct iovec const *msg);
-#endif
-
-#endif
diff --git a/include/net/tipc/tipc_bearer.h b/include/net/tipc/tipc_bearer.h
deleted file mode 100644
index ee2f304e491..00000000000
--- a/include/net/tipc/tipc_bearer.h
+++ /dev/null
@@ -1,138 +0,0 @@
-/*
- * include/net/tipc/tipc_bearer.h: Include file for privileged access to TIPC bearers
- * 
- * Copyright (c) 2003-2006, Ericsson AB
- * Copyright (c) 2005, Wind River Systems
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the names of the copyright holders nor the names of its
- *    contributors may be used to endorse or promote products derived from
- *    this software without specific prior written permission.
- *
- * Alternatively, this software may be distributed under the terms of the
- * GNU General Public License ("GPL") version 2 as published by the Free
- * Software Foundation.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef _NET_TIPC_BEARER_H_
-#define _NET_TIPC_BEARER_H_
-
-#ifdef __KERNEL__
-
-#include <linux/tipc_config.h>
-#include <linux/skbuff.h>
-#include <linux/spinlock.h>
-
-/*
- * Identifiers of supported TIPC media types
- */
-
-#define TIPC_MEDIA_TYPE_ETH     1
-
-/* 
- * Destination address structure used by TIPC bearers when sending messages
- * 
- * IMPORTANT: The fields of this structure MUST be stored using the specified
- * byte order indicated below, as the structure is exchanged between nodes
- * as part of a link setup process.
- */
-
-struct tipc_media_addr {
-        __be32  type;                   /* bearer type (network byte order) */
-        union {
-                __u8   eth_addr[6];     /* 48 bit Ethernet addr (byte array) */ 
-#if 0
-                /* Prototypes for other possible bearer types */
-
-                struct {
-                        __u16 sin_family;
-                        __u16 sin_port;
-                        struct {
-                                __u32 s_addr;
-                        } sin_addr;
-                        char pad[4];
-                } addr_in;              /* IP-based bearer */
-                __u16  sock_descr;      /* generic socket bearer */
-#endif
-        } dev_addr;
-};
-
-/**
- * struct tipc_bearer - TIPC bearer info available to privileged users
- * @usr_handle: pointer to additional user-defined information about bearer
- * @mtu: max packet size bearer can support
- * @blocked: non-zero if bearer is blocked
- * @lock: spinlock for controlling access to bearer
- * @addr: media-specific address associated with bearer
- * @name: bearer name (format = media:interface)
- * 
- * Note: TIPC initializes "name" and "lock" fields; user is responsible for
- * initialization all other fields when a bearer is enabled.
- */
-
-struct tipc_bearer {
-        void *usr_handle;
-        u32 mtu;
-        int blocked;
-        spinlock_t lock;
-        struct tipc_media_addr addr;
-        char name[TIPC_MAX_BEARER_NAME];
-};
-
-/*
- * TIPC routines available to supported media types
- */
-
-int  tipc_register_media(u32 media_type,
-                         char *media_name, 
-                         int (*enable)(struct tipc_bearer *), 
-                         void (*disable)(struct tipc_bearer *), 
-                         int (*send_msg)(struct sk_buff *, 
-                                         struct tipc_bearer *,
-                                         struct tipc_media_addr *), 
-                         char *(*addr2str)(struct tipc_media_addr *a,
-                                           char *str_buf,
-                                           int str_size),
-                         struct tipc_media_addr *bcast_addr,
-                         const u32 bearer_priority,
-                         const u32 link_tolerance,  /* [ms] */
-                         const u32 send_window_limit); 
-
-void tipc_recv_msg(struct sk_buff *buf, struct tipc_bearer *tb_ptr);
-
-int  tipc_block_bearer(const char *name);
-void tipc_continue(struct tipc_bearer *tb_ptr); 
-
-int tipc_enable_bearer(const char *bearer_name, u32 bcast_scope, u32 priority);
-int tipc_disable_bearer(const char *name);
-
-/*
- * Routines made available to TIPC by supported media types
- */
-
-int  tipc_eth_media_start(void);
-void tipc_eth_media_stop(void);
-
-#endif
-
-#endif
diff --git a/include/net/tipc/tipc_msg.h b/include/net/tipc/tipc_msg.h
deleted file mode 100644
index ffe50b4e7b9..00000000000
--- a/include/net/tipc/tipc_msg.h
+++ /dev/null
@@ -1,207 +0,0 @@
-/*
- * include/net/tipc/tipc_msg.h: Include file for privileged access to TIPC message headers
- * 
- * Copyright (c) 2003-2006, Ericsson AB
- * Copyright (c) 2005, Wind River Systems
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the names of the copyright holders nor the names of its
- *    contributors may be used to endorse or promote products derived from
- *    this software without specific prior written permission.
- *
- * Alternatively, this software may be distributed under the terms of the
- * GNU General Public License ("GPL") version 2 as published by the Free
- * Software Foundation.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef _NET_TIPC_MSG_H_
-#define _NET_TIPC_MSG_H_
-
-#ifdef __KERNEL__
-
-struct tipc_msg {
-        __be32 hdr[15];
-};
-
-
-/*
-                TIPC user data message header format, version 2:
-
-
-       1 0 9 8 7 6 5 4|3 2 1 0 9 8 7 6|5 4 3 2 1 0 9 8|7 6 5 4 3 2 1 0 
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   w0:|vers | user  |hdr sz |n|d|s|-|          message size           |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   w1:|mstyp| error |rer cnt|lsc|opt p|      broadcast ack no         |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   w2:|        link level ack no      |   broadcast/link level seq no |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   w3:|                       previous node                           |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   w4:|                      originating port                         |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   w5:|                      destination port                         |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+    
-   w6:|                      originating node                         |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   w7:|                      destination node                         |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   w8:|            name type / transport sequence number              |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   w9:|              name instance/multicast lower bound              |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+    
-   wA:|                    multicast upper bound                      |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+    
-      /                                                               /
-      \                           options                             \
-      /                                                               /
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-*/
-
-#define TIPC_CONN_MSG   0
-#define TIPC_MCAST_MSG  1
-#define TIPC_NAMED_MSG  2
-#define TIPC_DIRECT_MSG 3
-
-
-static inline u32 msg_word(struct tipc_msg *m, u32 pos)
-{
-        return ntohl(m->hdr[pos]);
-}
-
-static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask)
-{
-        return (msg_word(m, w) >> pos) & mask;
-}
-
-static inline u32 msg_importance(struct tipc_msg *m)
-{
-        return msg_bits(m, 0, 25, 0xf);
-}
-
-static inline u32 msg_hdr_sz(struct tipc_msg *m)
-{
-        return msg_bits(m, 0, 21, 0xf) << 2;
-}
-
-static inline int msg_short(struct tipc_msg *m)
-{
-        return msg_hdr_sz(m) == 24;
-}
-
-static inline u32 msg_size(struct tipc_msg *m)
-{
-        return msg_bits(m, 0, 0, 0x1ffff);
-}
-
-static inline u32 msg_data_sz(struct tipc_msg *m)
-{
-        return msg_size(m) - msg_hdr_sz(m);
-}
-
-static inline unchar *msg_data(struct tipc_msg *m)
-{
-        return ((unchar *)m) + msg_hdr_sz(m);
-}
-
-static inline u32 msg_type(struct tipc_msg *m)
-{
-        return msg_bits(m, 1, 29, 0x7);
-}
-
-static inline u32 msg_named(struct tipc_msg *m)
-{
-        return msg_type(m) == TIPC_NAMED_MSG;
-}
-
-static inline u32 msg_mcast(struct tipc_msg *m)
-{
-        return msg_type(m) == TIPC_MCAST_MSG;
-}
-
-static inline u32 msg_connected(struct tipc_msg *m)
-{
-        return msg_type(m) == TIPC_CONN_MSG;
-}
-
-static inline u32 msg_errcode(struct tipc_msg *m)
-{
-        return msg_bits(m, 1, 25, 0xf);
-}
-
-static inline u32 msg_prevnode(struct tipc_msg *m)
-{
-        return msg_word(m, 3);
-}
-
-static inline u32 msg_origport(struct tipc_msg *m)
-{
-        return msg_word(m, 4);
-}
-
-static inline u32 msg_destport(struct tipc_msg *m)
-{
-        return msg_word(m, 5);
-}
-
-static inline u32 msg_mc_netid(struct tipc_msg *m)
-{
-        return msg_word(m, 5);
-}
-
-static inline u32 msg_orignode(struct tipc_msg *m)
-{
-        if (likely(msg_short(m)))
-                return msg_prevnode(m);
-        return msg_word(m, 6);
-}
-
-static inline u32 msg_destnode(struct tipc_msg *m)
-{
-        return msg_word(m, 7);
-}
-
-static inline u32 msg_nametype(struct tipc_msg *m)
-{
-        return msg_word(m, 8);
-}
-
-static inline u32 msg_nameinst(struct tipc_msg *m)
-{
-        return msg_word(m, 9);
-}
-
-static inline u32 msg_namelower(struct tipc_msg *m)
-{
-        return msg_nameinst(m);
-}
-
-static inline u32 msg_nameupper(struct tipc_msg *m)
-{
-        return msg_word(m, 10);
-}
-
-#endif
-
-#endif
diff --git a/include/net/tipc/tipc_port.h b/include/net/tipc/tipc_port.h
deleted file mode 100644
index 1893aaf4942..00000000000
--- a/include/net/tipc/tipc_port.h
+++ /dev/null
@@ -1,101 +0,0 @@
-/*
- * include/net/tipc/tipc_port.h: Include file for privileged access to TIPC ports
- * 
- * Copyright (c) 1994-2007, Ericsson AB
- * Copyright (c) 2005-2008, Wind River Systems
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the names of the copyright holders nor the names of its
- *    contributors may be used to endorse or promote products derived from
- *    this software without specific prior written permission.
- *
- * Alternatively, this software may be distributed under the terms of the
- * GNU General Public License ("GPL") version 2 as published by the Free
- * Software Foundation.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef _NET_TIPC_PORT_H_
-#define _NET_TIPC_PORT_H_
-
-#ifdef __KERNEL__
-
-#include <linux/tipc.h>
-#include <linux/skbuff.h>
-#include <net/tipc/tipc_msg.h>
-
-#define TIPC_FLOW_CONTROL_WIN 512
-
-/**
- * struct tipc_port - native TIPC port info available to privileged users
- * @usr_handle: pointer to additional user-defined information about port
- * @lock: pointer to spinlock for controlling access to port
- * @connected: non-zero if port is currently connected to a peer port
- * @conn_type: TIPC type used when connection was established
- * @conn_instance: TIPC instance used when connection was established
- * @conn_unacked: number of unacknowledged messages received from peer port
- * @published: non-zero if port has one or more associated names
- * @congested: non-zero if cannot send because of link or port congestion
- * @max_pkt: maximum packet size "hint" used when building messages sent by port
- * @ref: unique reference to port in TIPC object registry
- * @phdr: preformatted message header used when sending messages
- */
-
-struct tipc_port {
-        void *usr_handle;
-        spinlock_t *lock;
-        int connected;
-        u32 conn_type;
-        u32 conn_instance;
-        u32 conn_unacked;
-        int published;
-        u32 congested;
-        u32 max_pkt;
-        u32 ref;
-        struct tipc_msg phdr;
-};
-
-
-struct tipc_port *tipc_createport_raw(void *usr_handle,
-                        u32 (*dispatcher)(struct tipc_port *, struct sk_buff *),
-                        void (*wakeup)(struct tipc_port *),
-                        const u32 importance);
-
-int tipc_reject_msg(struct sk_buff *buf, u32 err);
-
-int tipc_send_buf_fast(struct sk_buff *buf, u32 destnode);
-
-void tipc_acknowledge(u32 port_ref,u32 ack);
-
-struct tipc_port *tipc_get_port(const u32 ref);
-
-/*
- * The following routines require that the port be locked on entry
- */
-
-int tipc_disconnect_port(struct tipc_port *tp_ptr);
-
-
-#endif
-
-#endif
-
diff --git a/include/net/x25.h b/include/net/x25.h
index 1479cb4a41f..a06119a0512 100644
--- a/include/net/x25.h
+++ b/include/net/x25.h
@@ -315,6 +315,8 @@ extern struct list_head x25_route_list;
 extern rwlock_t x25_route_list_lock;
 extern struct list_head x25_forward_list;
 extern rwlock_t x25_forward_list_lock;
+extern struct list_head x25_neigh_list;
+extern rwlock_t x25_neigh_list_lock;
 
 extern int x25_proc_init(void);
 extern void x25_proc_exit(void);
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index bcfb6b24b01..7fa5b005893 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -805,6 +805,9 @@ __be16 xfrm_flowi_sport(struct flowi *fl)
         case IPPROTO_MH:
                 port = htons(fl->fl_mh_type);
                 break;
+        case IPPROTO_GRE:
+                port = htons(ntohl(fl->fl_gre_key) >> 16);
+                break;
         default:
                 port = 0;       /*XXX*/
         }
@@ -826,6 +829,9 @@ __be16 xfrm_flowi_dport(struct flowi *fl)
         case IPPROTO_ICMPV6:
                 port = htons(fl->fl_icmp_code);
                 break;
+        case IPPROTO_GRE:
+                port = htons(ntohl(fl->fl_gre_key) & 0xffff);
+                break;
         default:
                 port = 0;       /*XXX*/
         }
diff --git a/lib/Kconfig b/lib/Kconfig
index fa9bf2c0619..3116aa631af 100644
--- a/lib/Kconfig
+++ b/lib/Kconfig
@@ -210,4 +210,7 @@ config GENERIC_ATOMIC64
 config LRU_CACHE
         tristate
 
+config AVERAGE
+        bool
+
 endmenu
diff --git a/lib/Makefile b/lib/Makefile
index e6a3763b821..76d3b851490 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -106,6 +106,8 @@ obj-$(CONFIG_GENERIC_ATOMIC64) += atomic64.o
 
 obj-$(CONFIG_ATOMIC64_SELFTEST) += atomic64_test.o
 
+obj-$(CONFIG_AVERAGE) += average.o
+
 hostprogs-y     := gen_crc32table
 clean-files     := crc32table.h
 
diff --git a/lib/average.c b/lib/average.c
new file mode 100644
index 00000000000..f1d1b4660c4
--- /dev/null
+++ b/lib/average.c
@@ -0,0 +1,57 @@
+/*
+ * lib/average.c
+ *
+ * This source code is licensed under the GNU General Public License,
+ * Version 2.  See the file COPYING for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/average.h>
+#include <linux/bug.h>
+
+/**
+ * DOC: Exponentially Weighted Moving Average (EWMA)
+ *
+ * These are generic functions for calculating Exponentially Weighted Moving
+ * Averages (EWMA). We keep a structure with the EWMA parameters and a scaled
+ * up internal representation of the average value to prevent rounding errors.
+ * The factor for scaling up and the exponential weight (or decay rate) have to
+ * be specified thru the init fuction. The structure should not be accessed
+ * directly but only thru the helper functions.
+ */
+
+/**
+ * ewma_init() - Initialize EWMA parameters
+ * @avg: Average structure
+ * @factor: Factor to use for the scaled up internal value. The maximum value
+ *      of averages can be ULONG_MAX/(factor*weight).
+ * @weight: Exponential weight, or decay rate. This defines how fast the
+ *      influence of older values decreases. Has to be bigger than 1.
+ *
+ * Initialize the EWMA parameters for a given struct ewma @avg.
+ */
+void ewma_init(struct ewma *avg, unsigned long factor, unsigned long weight)
+{
+        WARN_ON(weight <= 1 || factor == 0);
+        avg->internal = 0;
+        avg->weight = weight;
+        avg->factor = factor;
+}
+EXPORT_SYMBOL(ewma_init);
+
+/**
+ * ewma_add() - Exponentially weighted moving average (EWMA)
+ * @avg: Average structure
+ * @val: Current value
+ *
+ * Add a sample to the average.
+ */
+struct ewma *ewma_add(struct ewma *avg, unsigned long val)
+{
+        avg->internal = avg->internal  ?
+                (((avg->internal * (avg->weight - 1)) +
+                        (val * avg->factor)) / avg->weight) :
+                (val * avg->factor);
+        return avg;
+}
+EXPORT_SYMBOL(ewma_add);
diff --git a/lib/nlattr.c b/lib/nlattr.c
index c4706eb98d3..00e8a02681a 100644
--- a/lib/nlattr.c
+++ b/lib/nlattr.c
@@ -15,7 +15,7 @@
 #include <linux/types.h>
 #include <net/netlink.h>
 
-static u16 nla_attr_minlen[NLA_TYPE_MAX+1] __read_mostly = {
+static const u16 nla_attr_minlen[NLA_TYPE_MAX+1] = {
         [NLA_U8]        = sizeof(u8),
         [NLA_U16]       = sizeof(u16),
         [NLA_U32]       = sizeof(u32),
@@ -23,7 +23,7 @@ static u16 nla_attr_minlen[NLA_TYPE_MAX+1] __read_mostly = {
         [NLA_NESTED]    = NLA_HDRLEN,
 };
 
-static int validate_nla(struct nlattr *nla, int maxtype,
+static int validate_nla(const struct nlattr *nla, int maxtype,
                         const struct nla_policy *policy)
 {
         const struct nla_policy *pt;
@@ -115,10 +115,10 @@ static int validate_nla(struct nlattr *nla, int maxtype,
  *
  * Returns 0 on success or a negative error code.
  */
-int nla_validate(struct nlattr *head, int len, int maxtype,
+int nla_validate(const struct nlattr *head, int len, int maxtype,
                  const struct nla_policy *policy)
 {
-        struct nlattr *nla;
+        const struct nlattr *nla;
         int rem, err;
 
         nla_for_each_attr(nla, head, len, rem) {
@@ -173,10 +173,10 @@ nla_policy_len(const struct nla_policy *p, int n)
  *
  * Returns 0 on success or a negative error code.
  */
-int nla_parse(struct nlattr *tb[], int maxtype, struct nlattr *head, int len,
-              const struct nla_policy *policy)
+int nla_parse(struct nlattr **tb, int maxtype, const struct nlattr *head,
+              int len, const struct nla_policy *policy)
 {
-        struct nlattr *nla;
+        const struct nlattr *nla;
         int rem, err;
 
         memset(tb, 0, sizeof(struct nlattr *) * (maxtype + 1));
@@ -191,7 +191,7 @@ int nla_parse(struct nlattr *tb[], int maxtype, struct nlattr *head, int len,
                                         goto errout;
                         }
 
-                        tb[type] = nla;
+                        tb[type] = (struct nlattr *)nla;
                 }
         }
 
@@ -212,14 +212,14 @@ errout:
  *
  * Returns the first attribute in the stream matching the specified type.
  */
-struct nlattr *nla_find(struct nlattr *head, int len, int attrtype)
+struct nlattr *nla_find(const struct nlattr *head, int len, int attrtype)
 {
-        struct nlattr *nla;
+        const struct nlattr *nla;
         int rem;
 
         nla_for_each_attr(nla, head, len, rem)
                 if (nla_type(nla) == attrtype)
-                        return nla;
+                        return (struct nlattr *)nla;
 
         return NULL;
 }
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 52077ca2207..6e64f7c6a2e 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -272,13 +272,11 @@ static int register_vlan_device(struct net_device *real_dev, u16 vlan_id)
                 snprintf(name, IFNAMSIZ, "vlan%.4i", vlan_id);
         }
 
-        new_dev = alloc_netdev_mq(sizeof(struct vlan_dev_info), name,
-                                  vlan_setup, real_dev->num_tx_queues);
+        new_dev = alloc_netdev(sizeof(struct vlan_dev_info), name, vlan_setup);
 
         if (new_dev == NULL)
                 return -ENOBUFS;
 
-        netif_copy_real_num_queues(new_dev, real_dev);
         dev_net_set(new_dev, net);
         /* need 4 bytes for extra VLAN header info,
          * hope the underlying device can handle it.
@@ -334,12 +332,15 @@ static void vlan_transfer_features(struct net_device *dev,
         vlandev->features &= ~dev->vlan_features;
         vlandev->features |= dev->features & dev->vlan_features;
         vlandev->gso_max_size = dev->gso_max_size;
+
+        if (dev->features & NETIF_F_HW_VLAN_TX)
+                vlandev->hard_header_len = dev->hard_header_len;
+        else
+                vlandev->hard_header_len = dev->hard_header_len + VLAN_HLEN;
+
 #if defined(CONFIG_FCOE) || defined(CONFIG_FCOE_MODULE)
         vlandev->fcoe_ddp_xid = dev->fcoe_ddp_xid;
 #endif
-        vlandev->real_num_tx_queues = dev->real_num_tx_queues;
-        BUG_ON(vlandev->real_num_tx_queues > vlandev->num_tx_queues);
-
         if (old_features != vlandev->features)
                 netdev_features_change(vlandev);
 }
diff --git a/net/8021q/vlan.h b/net/8021q/vlan.h
index db01b3181fd..5687c9b95f3 100644
--- a/net/8021q/vlan.h
+++ b/net/8021q/vlan.h
@@ -19,19 +19,25 @@ struct vlan_priority_tci_mapping {
 
 
 /**
- *      struct vlan_rx_stats - VLAN percpu rx stats
+ *      struct vlan_pcpu_stats - VLAN percpu rx/tx stats
  *      @rx_packets: number of received packets
  *      @rx_bytes: number of received bytes
  *      @rx_multicast: number of received multicast packets
+ *      @tx_packets: number of transmitted packets
+ *      @tx_bytes: number of transmitted bytes
  *      @syncp: synchronization point for 64bit counters
- *      @rx_errors: number of errors
+ *      @rx_errors: number of rx errors
+ *      @tx_dropped: number of tx drops
  */
-struct vlan_rx_stats {
+struct vlan_pcpu_stats {
         u64                     rx_packets;
         u64                     rx_bytes;
         u64                     rx_multicast;
+        u64                     tx_packets;
+        u64                     tx_bytes;
         struct u64_stats_sync   syncp;
-        unsigned long           rx_errors;
+        u32                     rx_errors;
+        u32                     tx_dropped;
 };
 
 /**
@@ -45,9 +51,7 @@ struct vlan_rx_stats {
  *      @real_dev: underlying netdevice
  *      @real_dev_addr: address of underlying netdevice
  *      @dent: proc dir entry
- *      @cnt_inc_headroom_on_tx: statistic - number of skb expansions on TX
- *      @cnt_encap_on_xmit: statistic - number of skb encapsulations on TX
- *      @vlan_rx_stats: ptr to percpu rx stats
+ *      @vlan_pcpu_stats: ptr to percpu rx stats
  */
 struct vlan_dev_info {
         unsigned int                            nr_ingress_mappings;
@@ -62,9 +66,7 @@ struct vlan_dev_info {
         unsigned char                           real_dev_addr[ETH_ALEN];
 
         struct proc_dir_entry                   *dent;
-        unsigned long                           cnt_inc_headroom_on_tx;
-        unsigned long                           cnt_encap_on_xmit;
-        struct vlan_rx_stats __percpu           *vlan_rx_stats;
+        struct vlan_pcpu_stats __percpu         *vlan_pcpu_stats;
 };
 
 static inline struct vlan_dev_info *vlan_dev_info(const struct net_device *dev)
diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index 69b2f79800a..ce8e3ab3e7a 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -9,7 +9,7 @@ bool vlan_hwaccel_do_receive(struct sk_buff **skbp)
         struct sk_buff *skb = *skbp;
         u16 vlan_id = skb->vlan_tci & VLAN_VID_MASK;
         struct net_device *vlan_dev;
-        struct vlan_rx_stats *rx_stats;
+        struct vlan_pcpu_stats *rx_stats;
 
         vlan_dev = vlan_find_dev(skb->dev, vlan_id);
         if (!vlan_dev) {
@@ -26,7 +26,7 @@ bool vlan_hwaccel_do_receive(struct sk_buff **skbp)
         skb->priority = vlan_get_ingress_priority(vlan_dev, skb->vlan_tci);
         skb->vlan_tci = 0;
 
-        rx_stats = this_cpu_ptr(vlan_dev_info(vlan_dev)->vlan_rx_stats);
+        rx_stats = this_cpu_ptr(vlan_dev_info(vlan_dev)->vlan_pcpu_stats);
 
         u64_stats_update_begin(&rx_stats->syncp);
         rx_stats->rx_packets++;
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 14e3d1fa07a..be737539f34 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -141,7 +141,7 @@ int vlan_skb_recv(struct sk_buff *skb, struct net_device *dev,
                   struct packet_type *ptype, struct net_device *orig_dev)
 {
         struct vlan_hdr *vhdr;
-        struct vlan_rx_stats *rx_stats;
+        struct vlan_pcpu_stats *rx_stats;
         struct net_device *vlan_dev;
         u16 vlan_id;
         u16 vlan_tci;
@@ -177,7 +177,7 @@ int vlan_skb_recv(struct sk_buff *skb, struct net_device *dev,
         } else {
                 skb->dev = vlan_dev;
 
-                rx_stats = this_cpu_ptr(vlan_dev_info(skb->dev)->vlan_rx_stats);
+                rx_stats = this_cpu_ptr(vlan_dev_info(skb->dev)->vlan_pcpu_stats);
 
                 u64_stats_update_begin(&rx_stats->syncp);
                 rx_stats->rx_packets++;
@@ -274,9 +274,6 @@ static int vlan_dev_hard_header(struct sk_buff *skb, struct net_device *dev,
         u16 vlan_tci = 0;
         int rc;
 
-        if (WARN_ON(skb_headroom(skb) < dev->hard_header_len))
-                return -ENOSPC;
-
         if (!(vlan_dev_info(dev)->flags & VLAN_FLAG_REORDER_HDR)) {
                 vhdr = (struct vlan_hdr *) skb_push(skb, VLAN_HLEN);
 
@@ -313,8 +310,6 @@ static int vlan_dev_hard_header(struct sk_buff *skb, struct net_device *dev,
 static netdev_tx_t vlan_dev_hard_start_xmit(struct sk_buff *skb,
                                             struct net_device *dev)
 {
-        int i = skb_get_queue_mapping(skb);
-        struct netdev_queue *txq = netdev_get_tx_queue(dev, i);
         struct vlan_ethhdr *veth = (struct vlan_ethhdr *)(skb->data);
         unsigned int len;
         int ret;
@@ -326,71 +321,31 @@ static netdev_tx_t vlan_dev_hard_start_xmit(struct sk_buff *skb,
          */
         if (veth->h_vlan_proto != htons(ETH_P_8021Q) ||
             vlan_dev_info(dev)->flags & VLAN_FLAG_REORDER_HDR) {
-                unsigned int orig_headroom = skb_headroom(skb);
                 u16 vlan_tci;
-
-                vlan_dev_info(dev)->cnt_encap_on_xmit++;
-
                 vlan_tci = vlan_dev_info(dev)->vlan_id;
                 vlan_tci |= vlan_dev_get_egress_qos_mask(dev, skb);
-                skb = __vlan_put_tag(skb, vlan_tci);
-                if (!skb) {
-                        txq->tx_dropped++;
-                        return NETDEV_TX_OK;
-                }
-
-                if (orig_headroom < VLAN_HLEN)
-                        vlan_dev_info(dev)->cnt_inc_headroom_on_tx++;
+                skb = __vlan_hwaccel_put_tag(skb, vlan_tci);
         }
 
-
         skb_set_dev(skb, vlan_dev_info(dev)->real_dev);
         len = skb->len;
         ret = dev_queue_xmit(skb);
 
         if (likely(ret == NET_XMIT_SUCCESS || ret == NET_XMIT_CN)) {
-                txq->tx_packets++;
-                txq->tx_bytes += len;
-        } else
-                txq->tx_dropped++;
+                struct vlan_pcpu_stats *stats;
 
-        return ret;
-}
-
-static netdev_tx_t vlan_dev_hwaccel_hard_start_xmit(struct sk_buff *skb,
-                                                    struct net_device *dev)
-{
-        int i = skb_get_queue_mapping(skb);
-        struct netdev_queue *txq = netdev_get_tx_queue(dev, i);
-        u16 vlan_tci;
-        unsigned int len;
-        int ret;
-
-        vlan_tci = vlan_dev_info(dev)->vlan_id;
-        vlan_tci |= vlan_dev_get_egress_qos_mask(dev, skb);
-        skb = __vlan_hwaccel_put_tag(skb, vlan_tci);
-
-        skb->dev = vlan_dev_info(dev)->real_dev;
-        len = skb->len;
-        ret = dev_queue_xmit(skb);
-
-        if (likely(ret == NET_XMIT_SUCCESS || ret == NET_XMIT_CN)) {
-                txq->tx_packets++;
-                txq->tx_bytes += len;
-        } else
-                txq->tx_dropped++;
+                stats = this_cpu_ptr(vlan_dev_info(dev)->vlan_pcpu_stats);
+                u64_stats_update_begin(&stats->syncp);
+                stats->tx_packets++;
+                stats->tx_bytes += len;
+                u64_stats_update_begin(&stats->syncp);
+        } else {
+                this_cpu_inc(vlan_dev_info(dev)->vlan_pcpu_stats->tx_dropped);
+        }
 
         return ret;
 }
 
-static u16 vlan_dev_select_queue(struct net_device *dev, struct sk_buff *skb)
-{
-        struct net_device *rdev = vlan_dev_info(dev)->real_dev;
-        const struct net_device_ops *ops = rdev->netdev_ops;
-
-        return ops->ndo_select_queue(rdev, skb);
-}
-
 static int vlan_dev_change_mtu(struct net_device *dev, int new_mtu)
 {
         /* TODO: gotta make sure the underlying layer can handle it,
@@ -719,8 +674,7 @@ static const struct header_ops vlan_header_ops = {
         .parse   = eth_header_parse,
 };
 
-static const struct net_device_ops vlan_netdev_ops, vlan_netdev_accel_ops,
-                    vlan_netdev_ops_sq, vlan_netdev_accel_ops_sq;
+static const struct net_device_ops vlan_netdev_ops;
 
 static int vlan_dev_init(struct net_device *dev)
 {
@@ -738,6 +692,7 @@ static int vlan_dev_init(struct net_device *dev)
                       (1<<__LINK_STATE_PRESENT);
 
         dev->features |= real_dev->features & real_dev->vlan_features;
+        dev->features |= NETIF_F_LLTX;
         dev->gso_max_size = real_dev->gso_max_size;
 
         /* ipv6 shared card related stuff */
@@ -755,26 +710,20 @@ static int vlan_dev_init(struct net_device *dev)
         if (real_dev->features & NETIF_F_HW_VLAN_TX) {
                 dev->header_ops      = real_dev->header_ops;
                 dev->hard_header_len = real_dev->hard_header_len;
-                if (real_dev->netdev_ops->ndo_select_queue)
-                        dev->netdev_ops = &vlan_netdev_accel_ops_sq;
-                else
-                        dev->netdev_ops = &vlan_netdev_accel_ops;
         } else {
                 dev->header_ops      = &vlan_header_ops;
                 dev->hard_header_len = real_dev->hard_header_len + VLAN_HLEN;
-                if (real_dev->netdev_ops->ndo_select_queue)
-                        dev->netdev_ops = &vlan_netdev_ops_sq;
-                else
-                        dev->netdev_ops = &vlan_netdev_ops;
         }
 
+        dev->netdev_ops = &vlan_netdev_ops;
+
         if (is_vlan_dev(real_dev))
                 subclass = 1;
 
         vlan_dev_set_lockdep_class(dev, subclass);
 
-        vlan_dev_info(dev)->vlan_rx_stats = alloc_percpu(struct vlan_rx_stats);
-        if (!vlan_dev_info(dev)->vlan_rx_stats)
+        vlan_dev_info(dev)->vlan_pcpu_stats = alloc_percpu(struct vlan_pcpu_stats);
+        if (!vlan_dev_info(dev)->vlan_pcpu_stats)
                 return -ENOMEM;
 
         return 0;
@@ -786,8 +735,8 @@ static void vlan_dev_uninit(struct net_device *dev)
         struct vlan_dev_info *vlan = vlan_dev_info(dev);
         int i;
 
-        free_percpu(vlan->vlan_rx_stats);
-        vlan->vlan_rx_stats = NULL;
+        free_percpu(vlan->vlan_pcpu_stats);
+        vlan->vlan_pcpu_stats = NULL;
         for (i = 0; i < ARRAY_SIZE(vlan->egress_priority_map); i++) {
                 while ((pm = vlan->egress_priority_map[i]) != NULL) {
                         vlan->egress_priority_map[i] = pm->next;
@@ -825,33 +774,37 @@ static u32 vlan_ethtool_get_flags(struct net_device *dev)
 
 static struct rtnl_link_stats64 *vlan_dev_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats)
 {
-        dev_txq_stats_fold(dev, stats);
 
-        if (vlan_dev_info(dev)->vlan_rx_stats) {
-                struct vlan_rx_stats *p, accum = {0};
+        if (vlan_dev_info(dev)->vlan_pcpu_stats) {
+                struct vlan_pcpu_stats *p;
+                u32 rx_errors = 0, tx_dropped = 0;
                 int i;
 
                 for_each_possible_cpu(i) {
-                        u64 rxpackets, rxbytes, rxmulticast;
+                        u64 rxpackets, rxbytes, rxmulticast, txpackets, txbytes;
                         unsigned int start;
 
-                        p = per_cpu_ptr(vlan_dev_info(dev)->vlan_rx_stats, i);
+                        p = per_cpu_ptr(vlan_dev_info(dev)->vlan_pcpu_stats, i);
                         do {
                                 start = u64_stats_fetch_begin_bh(&p->syncp);
                                 rxpackets       = p->rx_packets;
                                 rxbytes         = p->rx_bytes;
                                 rxmulticast     = p->rx_multicast;
+                                txpackets       = p->tx_packets;
+                                txbytes         = p->tx_bytes;
                         } while (u64_stats_fetch_retry_bh(&p->syncp, start));
-                        accum.rx_packets += rxpackets;
-                        accum.rx_bytes   += rxbytes;
-                        accum.rx_multicast += rxmulticast;
-                        /* rx_errors is ulong, not protected by syncp */
-                        accum.rx_errors  += p->rx_errors;
+
+                        stats->rx_packets       += rxpackets;
+                        stats->rx_bytes         += rxbytes;
+                        stats->multicast        += rxmulticast;
+                        stats->tx_packets       += txpackets;
+                        stats->tx_bytes         += txbytes;
+                        /* rx_errors & tx_dropped are u32 */
+                        rx_errors       += p->rx_errors;
+                        tx_dropped      += p->tx_dropped;
                 }
-                stats->rx_packets = accum.rx_packets;
-                stats->rx_bytes   = accum.rx_bytes;
-                stats->rx_errors  = accum.rx_errors;
-                stats->multicast  = accum.rx_multicast;
+                stats->rx_errors  = rx_errors;
+                stats->tx_dropped = tx_dropped;
         }
         return stats;
 }
@@ -908,80 +861,6 @@ static const struct net_device_ops vlan_netdev_ops = {
 #endif
 };
 
-static const struct net_device_ops vlan_netdev_accel_ops = {
-        .ndo_change_mtu         = vlan_dev_change_mtu,
-        .ndo_init               = vlan_dev_init,
-        .ndo_uninit             = vlan_dev_uninit,
-        .ndo_open               = vlan_dev_open,
-        .ndo_stop               = vlan_dev_stop,
-        .ndo_start_xmit =  vlan_dev_hwaccel_hard_start_xmit,
-        .ndo_validate_addr      = eth_validate_addr,
-        .ndo_set_mac_address    = vlan_dev_set_mac_address,
-        .ndo_set_rx_mode        = vlan_dev_set_rx_mode,
-        .ndo_set_multicast_list = vlan_dev_set_rx_mode,
-        .ndo_change_rx_flags    = vlan_dev_change_rx_flags,
-        .ndo_do_ioctl           = vlan_dev_ioctl,
-        .ndo_neigh_setup        = vlan_dev_neigh_setup,
-        .ndo_get_stats64        = vlan_dev_get_stats64,
-#if defined(CONFIG_FCOE) || defined(CONFIG_FCOE_MODULE)
-        .ndo_fcoe_ddp_setup     = vlan_dev_fcoe_ddp_setup,
-        .ndo_fcoe_ddp_done      = vlan_dev_fcoe_ddp_done,
-        .ndo_fcoe_enable        = vlan_dev_fcoe_enable,
-        .ndo_fcoe_disable       = vlan_dev_fcoe_disable,
-        .ndo_fcoe_get_wwn       = vlan_dev_fcoe_get_wwn,
-#endif
-};
-
-static const struct net_device_ops vlan_netdev_ops_sq = {
-        .ndo_select_queue       = vlan_dev_select_queue,
-        .ndo_change_mtu         = vlan_dev_change_mtu,
-        .ndo_init               = vlan_dev_init,
-        .ndo_uninit             = vlan_dev_uninit,
-        .ndo_open               = vlan_dev_open,
-        .ndo_stop               = vlan_dev_stop,
-        .ndo_start_xmit =  vlan_dev_hard_start_xmit,
-        .ndo_validate_addr      = eth_validate_addr,
-        .ndo_set_mac_address    = vlan_dev_set_mac_address,
-        .ndo_set_rx_mode        = vlan_dev_set_rx_mode,
-        .ndo_set_multicast_list = vlan_dev_set_rx_mode,
-        .ndo_change_rx_flags    = vlan_dev_change_rx_flags,
-        .ndo_do_ioctl           = vlan_dev_ioctl,
-        .ndo_neigh_setup        = vlan_dev_neigh_setup,
-        .ndo_get_stats64        = vlan_dev_get_stats64,
-#if defined(CONFIG_FCOE) || defined(CONFIG_FCOE_MODULE)
-        .ndo_fcoe_ddp_setup     = vlan_dev_fcoe_ddp_setup,
-        .ndo_fcoe_ddp_done      = vlan_dev_fcoe_ddp_done,
-        .ndo_fcoe_enable        = vlan_dev_fcoe_enable,
-        .ndo_fcoe_disable       = vlan_dev_fcoe_disable,
-        .ndo_fcoe_get_wwn       = vlan_dev_fcoe_get_wwn,
-#endif
-};
-
-static const struct net_device_ops vlan_netdev_accel_ops_sq = {
-        .ndo_select_queue       = vlan_dev_select_queue,
-        .ndo_change_mtu         = vlan_dev_change_mtu,
-        .ndo_init               = vlan_dev_init,
-        .ndo_uninit             = vlan_dev_uninit,
-        .ndo_open               = vlan_dev_open,
-        .ndo_stop               = vlan_dev_stop,
-        .ndo_start_xmit =  vlan_dev_hwaccel_hard_start_xmit,
-        .ndo_validate_addr      = eth_validate_addr,
-        .ndo_set_mac_address    = vlan_dev_set_mac_address,
-        .ndo_set_rx_mode        = vlan_dev_set_rx_mode,
-        .ndo_set_multicast_list = vlan_dev_set_rx_mode,
-        .ndo_change_rx_flags    = vlan_dev_change_rx_flags,
-        .ndo_do_ioctl           = vlan_dev_ioctl,
-        .ndo_neigh_setup        = vlan_dev_neigh_setup,
-        .ndo_get_stats64        = vlan_dev_get_stats64,
-#if defined(CONFIG_FCOE) || defined(CONFIG_FCOE_MODULE)
-        .ndo_fcoe_ddp_setup     = vlan_dev_fcoe_ddp_setup,
-        .ndo_fcoe_ddp_done      = vlan_dev_fcoe_ddp_done,
-        .ndo_fcoe_enable        = vlan_dev_fcoe_enable,
-        .ndo_fcoe_disable       = vlan_dev_fcoe_disable,
-        .ndo_fcoe_get_wwn       = vlan_dev_fcoe_get_wwn,
-#endif
-};
-
 void vlan_setup(struct net_device *dev)
 {
         ether_setup(dev);
diff --git a/net/8021q/vlan_netlink.c b/net/8021q/vlan_netlink.c
index ddc105734af..be9a5c19a77 100644
--- a/net/8021q/vlan_netlink.c
+++ b/net/8021q/vlan_netlink.c
@@ -101,25 +101,6 @@ static int vlan_changelink(struct net_device *dev,
         return 0;
 }
 
-static int vlan_get_tx_queues(struct net *net,
-                              struct nlattr *tb[],
-                              unsigned int *num_tx_queues,
-                              unsigned int *real_num_tx_queues)
-{
-        struct net_device *real_dev;
-
-        if (!tb[IFLA_LINK])
-                return -EINVAL;
-
-        real_dev = __dev_get_by_index(net, nla_get_u32(tb[IFLA_LINK]));
-        if (!real_dev)
-                return -ENODEV;
-
-        *num_tx_queues      = real_dev->num_tx_queues;
-        *real_num_tx_queues = real_dev->real_num_tx_queues;
-        return 0;
-}
-
 static int vlan_newlink(struct net *src_net, struct net_device *dev,
                         struct nlattr *tb[], struct nlattr *data[])
 {
@@ -237,7 +218,6 @@ struct rtnl_link_ops vlan_link_ops __read_mostly = {
         .maxtype        = IFLA_VLAN_MAX,
         .policy         = vlan_policy,
         .priv_size      = sizeof(struct vlan_dev_info),
-        .get_tx_queues  = vlan_get_tx_queues,
         .setup          = vlan_setup,
         .validate       = vlan_validate,
         .newlink        = vlan_newlink,
diff --git a/net/8021q/vlanproc.c b/net/8021q/vlanproc.c
index 80e280f5668..d1314cf18ad 100644
--- a/net/8021q/vlanproc.c
+++ b/net/8021q/vlanproc.c
@@ -280,7 +280,6 @@ static int vlandev_seq_show(struct seq_file *seq, void *offset)
         const struct vlan_dev_info *dev_info = vlan_dev_info(vlandev);
         struct rtnl_link_stats64 temp;
         const struct rtnl_link_stats64 *stats;
-        static const char fmt[] = "%30s %12lu\n";
         static const char fmt64[] = "%30s %12llu\n";
         int i;
 
@@ -299,10 +298,6 @@ static int vlandev_seq_show(struct seq_file *seq, void *offset)
         seq_puts(seq, "\n");
         seq_printf(seq, fmt64, "total frames transmitted", stats->tx_packets);
         seq_printf(seq, fmt64, "total bytes transmitted", stats->tx_bytes);
-        seq_printf(seq, fmt, "total headroom inc",
-                   dev_info->cnt_inc_headroom_on_tx);
-        seq_printf(seq, fmt, "total encap on xmit",
-                   dev_info->cnt_encap_on_xmit);
         seq_printf(seq, "Device: %s", dev_info->real_dev->name);
         /* now show all PRIORITY mappings relating to this VLAN */
         seq_printf(seq, "\nINGRESS priority mappings: "
diff --git a/net/9p/protocol.c b/net/9p/protocol.c
index 45c15f49140..798beac7f10 100644
--- a/net/9p/protocol.c
+++ b/net/9p/protocol.c
@@ -27,31 +27,16 @@
 
 #include <linux/module.h>
 #include <linux/errno.h>
+#include <linux/kernel.h>
 #include <linux/uaccess.h>
 #include <linux/slab.h>
 #include <linux/sched.h>
+#include <linux/stddef.h>
 #include <linux/types.h>
 #include <net/9p/9p.h>
 #include <net/9p/client.h>
 #include "protocol.h"
 
-#ifndef MIN
-#define MIN(a, b) (((a) < (b)) ? (a) : (b))
-#endif
-
-#ifndef MAX
-#define MAX(a, b) (((a) > (b)) ? (a) : (b))
-#endif
-
-#ifndef offset_of
-#define offset_of(type, memb) \
-        ((unsigned long)(&((type *)0)->memb))
-#endif
-#ifndef container_of
-#define container_of(obj, type, memb) \
-        ((type *)(((char *)obj) - offset_of(type, memb)))
-#endif
-
 static int
 p9pdu_writef(struct p9_fcall *pdu, int proto_version, const char *fmt, ...);
 
@@ -104,7 +89,7 @@ EXPORT_SYMBOL(p9stat_free);
 
 static size_t pdu_read(struct p9_fcall *pdu, void *data, size_t size)
 {
-        size_t len = MIN(pdu->size - pdu->offset, size);
+        size_t len = min(pdu->size - pdu->offset, size);
         memcpy(data, &pdu->sdata[pdu->offset], len);
         pdu->offset += len;
         return size - len;
@@ -112,7 +97,7 @@ static size_t pdu_read(struct p9_fcall *pdu, void *data, size_t size)
 
 static size_t pdu_write(struct p9_fcall *pdu, const void *data, size_t size)
 {
-        size_t len = MIN(pdu->capacity - pdu->size, size);
+        size_t len = min(pdu->capacity - pdu->size, size);
         memcpy(&pdu->sdata[pdu->size], data, len);
         pdu->size += len;
         return size - len;
@@ -121,7 +106,7 @@ static size_t pdu_write(struct p9_fcall *pdu, const void *data, size_t size)
 static size_t
 pdu_write_u(struct p9_fcall *pdu, const char __user *udata, size_t size)
 {
-        size_t len = MIN(pdu->capacity - pdu->size, size);
+        size_t len = min(pdu->capacity - pdu->size, size);
         if (copy_from_user(&pdu->sdata[pdu->size], udata, len))
                 len = 0;
 
@@ -201,7 +186,7 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt,
                                 if (errcode)
                                         break;
 
-                                size = MAX(len, 0);
+                                size = max_t(int16_t, len, 0);
 
                                 *sptr = kmalloc(size + 1, GFP_KERNEL);
                                 if (*sptr == NULL) {
@@ -256,8 +241,8 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt,
                                     p9pdu_readf(pdu, proto_version, "d", count);
                                 if (!errcode) {
                                         *count =
-                                            MIN(*count,
-                                                pdu->size - pdu->offset);
+                                            min_t(int32_t, *count,
+                                                  pdu->size - pdu->offset);
                                         *data = &pdu->sdata[pdu->offset];
                                 }
                         }
@@ -421,7 +406,7 @@ p9pdu_vwritef(struct p9_fcall *pdu, int proto_version, const char *fmt,
                                 const char *sptr = va_arg(ap, const char *);
                                 int16_t len = 0;
                                 if (sptr)
-                                        len = MIN(strlen(sptr), USHRT_MAX);
+                                        len = min_t(int16_t, strlen(sptr), USHRT_MAX);
 
                                 errcode = p9pdu_writef(pdu, proto_version,
                                                                 "w", len);
diff --git a/net/Kconfig b/net/Kconfig
index 55fd82e9ffd..126c2af0fc1 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -220,6 +220,11 @@ config RPS
         depends on SMP && SYSFS && USE_GENERIC_SMP_HELPERS
         default y
 
+config XPS
+        boolean
+        depends on SMP && SYSFS && USE_GENERIC_SMP_HELPERS
+        default y
+
 menu "Network testing"
 
 config NET_PKTGEN
diff --git a/net/atm/br2684.c b/net/atm/br2684.c
index ad2b232a205..fce2eae8d47 100644
--- a/net/atm/br2684.c
+++ b/net/atm/br2684.c
@@ -97,7 +97,7 @@ static LIST_HEAD(br2684_devs);
 
 static inline struct br2684_dev *BRPRIV(const struct net_device *net_dev)
 {
-        return (struct br2684_dev *)netdev_priv(net_dev);
+        return netdev_priv(net_dev);
 }
 
 static inline struct net_device *list_entry_brdev(const struct list_head *le)
diff --git a/net/atm/clip.c b/net/atm/clip.c
index ff956d1115b..d257da50fcf 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -502,7 +502,8 @@ static int clip_setentry(struct atm_vcc *vcc, __be32 ip)
         struct atmarp_entry *entry;
         int error;
         struct clip_vcc *clip_vcc;
-        struct flowi fl = { .nl_u = { .ip4_u = { .daddr = ip, .tos = 1}} };
+        struct flowi fl = { .fl4_dst = ip,
+                            .fl4_tos = 1 };
         struct rtable *rt;
 
         if (vcc->push != clip_push) {
diff --git a/net/atm/lec.c b/net/atm/lec.c
index 181d70c73d7..179e04bc99d 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -816,8 +816,7 @@ static int lec_mcast_attach(struct atm_vcc *vcc, int arg)
         if (arg < 0 || arg >= MAX_LEC_ITF || !dev_lec[arg])
                 return -EINVAL;
         vcc->proto_data = dev_lec[arg];
-        return lec_mcast_make((struct lec_priv *)netdev_priv(dev_lec[arg]),
-                                vcc);
+        return lec_mcast_make(netdev_priv(dev_lec[arg]), vcc);
 }
 
 /* Initialize device. */
diff --git a/net/bluetooth/Makefile b/net/bluetooth/Makefile
index d1e433f7d67..7ca1f46a471 100644
--- a/net/bluetooth/Makefile
+++ b/net/bluetooth/Makefile
@@ -10,4 +10,4 @@ obj-$(CONFIG_BT_BNEP)	+= bnep/
 obj-$(CONFIG_BT_CMTP)   += cmtp/
 obj-$(CONFIG_BT_HIDP)   += hidp/
 
-bluetooth-objs := af_bluetooth.o hci_core.o hci_conn.o hci_event.o hci_sock.o hci_sysfs.o lib.o
+bluetooth-y := af_bluetooth.o hci_core.o hci_conn.o hci_event.o hci_sock.o hci_sysfs.o lib.o
diff --git a/net/bridge/br.c b/net/bridge/br.c
index c8436fa3134..84bbb82599b 100644
--- a/net/bridge/br.c
+++ b/net/bridge/br.c
@@ -22,8 +22,6 @@
 
 #include "br_private.h"
 
-int (*br_should_route_hook)(struct sk_buff *skb);
-
 static const struct stp_proto br_stp_proto = {
         .rcv    = br_stp_rcv,
 };
@@ -102,8 +100,6 @@ static void __exit br_deinit(void)
         br_fdb_fini();
 }
 
-EXPORT_SYMBOL(br_should_route_hook);
-
 module_init(br_init)
 module_exit(br_deinit)
 MODULE_LICENSE("GPL");
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index 90512ccfd3e..2872393b293 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -238,15 +238,18 @@ struct net_bridge_fdb_entry *__br_fdb_get(struct net_bridge *br,
 int br_fdb_test_addr(struct net_device *dev, unsigned char *addr)
 {
         struct net_bridge_fdb_entry *fdb;
+        struct net_bridge_port *port;
         int ret;
 
-        if (!br_port_exists(dev))
-                return 0;
-
         rcu_read_lock();
-        fdb = __br_fdb_get(br_port_get_rcu(dev)->br, addr);
-        ret = fdb && fdb->dst->dev != dev &&
-                fdb->dst->state == BR_STATE_FORWARDING;
+        port = br_port_get_rcu(dev);
+        if (!port)
+                ret = 0;
+        else {
+                fdb = __br_fdb_get(port->br, addr);
+                ret = fdb && fdb->dst->dev != dev &&
+                        fdb->dst->state == BR_STATE_FORWARDING;
+        }
         rcu_read_unlock();
 
         return ret;
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index cbfe87f0f34..2bd11ec6d16 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -223,7 +223,7 @@ static void br_multicast_flood(struct net_bridge_mdb_entry *mdst,
         struct net_bridge_port_group *p;
         struct hlist_node *rp;
 
-        rp = rcu_dereference(br->router_list.first);
+        rp = rcu_dereference(hlist_first_rcu(&br->router_list));
         p = mdst ? rcu_dereference(mdst->ports) : NULL;
         while (p || rp) {
                 struct net_bridge_port *port, *lport, *rport;
@@ -242,7 +242,7 @@ static void br_multicast_flood(struct net_bridge_mdb_entry *mdst,
                 if ((unsigned long)lport >= (unsigned long)port)
                         p = rcu_dereference(p->next);
                 if ((unsigned long)rport >= (unsigned long)port)
-                        rp = rcu_dereference(rp->next);
+                        rp = rcu_dereference(hlist_next_rcu(rp));
         }
 
         if (!prev)
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 89ad25a7620..d9d1e2bac1d 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -475,11 +475,8 @@ int br_del_if(struct net_bridge *br, struct net_device *dev)
 {
         struct net_bridge_port *p;
 
-        if (!br_port_exists(dev))
-                return -EINVAL;
-
-        p = br_port_get(dev);
-        if (p->br != br)
+        p = br_port_get_rtnl(dev);
+        if (!p || p->br != br)
                 return -EINVAL;
 
         del_nbp(p);
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 25207a1f182..6f6d8e1b776 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -21,6 +21,10 @@
 /* Bridge group multicast address 802.1d (pg 51). */
 const u8 br_group_address[ETH_ALEN] = { 0x01, 0x80, 0xc2, 0x00, 0x00, 0x00 };
 
+/* Hook for brouter */
+br_should_route_hook_t __rcu *br_should_route_hook __read_mostly;
+EXPORT_SYMBOL(br_should_route_hook);
+
 static int br_pass_frame_up(struct sk_buff *skb)
 {
         struct net_device *indev, *brdev = BR_INPUT_SKB_CB(skb)->brdev;
@@ -139,7 +143,7 @@ struct sk_buff *br_handle_frame(struct sk_buff *skb)
 {
         struct net_bridge_port *p;
         const unsigned char *dest = eth_hdr(skb)->h_dest;
-        int (*rhook)(struct sk_buff *skb);
+        br_should_route_hook_t *rhook;
 
         if (unlikely(skb->pkt_type == PACKET_LOOPBACK))
                 return skb;
@@ -173,8 +177,8 @@ forward:
         switch (p->state) {
         case BR_STATE_FORWARDING:
                 rhook = rcu_dereference(br_should_route_hook);
-                if (rhook != NULL) {
-                        if (rhook(skb))
+                if (rhook) {
+                        if ((*rhook)(skb))
                                 return skb;
                         dest = eth_hdr(skb)->h_dest;
                 }
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index eb5b256ffc8..326e599f83f 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -33,6 +33,9 @@
 
 #include "br_private.h"
 
+#define mlock_dereference(X, br) \
+        rcu_dereference_protected(X, lockdep_is_held(&br->multicast_lock))
+
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 static inline int ipv6_is_local_multicast(const struct in6_addr *addr)
 {
@@ -135,7 +138,7 @@ static struct net_bridge_mdb_entry *br_mdb_ip6_get(
 struct net_bridge_mdb_entry *br_mdb_get(struct net_bridge *br,
                                         struct sk_buff *skb)
 {
-        struct net_bridge_mdb_htable *mdb = br->mdb;
+        struct net_bridge_mdb_htable *mdb = rcu_dereference(br->mdb);
         struct br_ip ip;
 
         if (br->multicast_disabled)
@@ -235,7 +238,8 @@ static void br_multicast_group_expired(unsigned long data)
         if (mp->ports)
                 goto out;
 
-        mdb = br->mdb;
+        mdb = mlock_dereference(br->mdb, br);
+
         hlist_del_rcu(&mp->hlist[mdb->ver]);
         mdb->size--;
 
@@ -249,16 +253,20 @@ out:
 static void br_multicast_del_pg(struct net_bridge *br,
                                 struct net_bridge_port_group *pg)
 {
-        struct net_bridge_mdb_htable *mdb = br->mdb;
+        struct net_bridge_mdb_htable *mdb;
         struct net_bridge_mdb_entry *mp;
         struct net_bridge_port_group *p;
-        struct net_bridge_port_group **pp;
+        struct net_bridge_port_group __rcu **pp;
+
+        mdb = mlock_dereference(br->mdb, br);
 
         mp = br_mdb_ip_get(mdb, &pg->addr);
         if (WARN_ON(!mp))
                 return;
 
-        for (pp = &mp->ports; (p = *pp); pp = &p->next) {
+        for (pp = &mp->ports;
+             (p = mlock_dereference(*pp, br)) != NULL;
+             pp = &p->next) {
                 if (p != pg)
                         continue;
 
@@ -294,10 +302,10 @@ out:
         spin_unlock(&br->multicast_lock);
 }
 
-static int br_mdb_rehash(struct net_bridge_mdb_htable **mdbp, int max,
+static int br_mdb_rehash(struct net_bridge_mdb_htable __rcu **mdbp, int max,
                          int elasticity)
 {
-        struct net_bridge_mdb_htable *old = *mdbp;
+        struct net_bridge_mdb_htable *old = rcu_dereference_protected(*mdbp, 1);
         struct net_bridge_mdb_htable *mdb;
         int err;
 
@@ -569,7 +577,7 @@ static struct net_bridge_mdb_entry *br_multicast_get_group(
         struct net_bridge *br, struct net_bridge_port *port,
         struct br_ip *group, int hash)
 {
-        struct net_bridge_mdb_htable *mdb = br->mdb;
+        struct net_bridge_mdb_htable *mdb;
         struct net_bridge_mdb_entry *mp;
         struct hlist_node *p;
         unsigned count = 0;
@@ -577,6 +585,7 @@ static struct net_bridge_mdb_entry *br_multicast_get_group(
         int elasticity;
         int err;
 
+        mdb = rcu_dereference_protected(br->mdb, 1);
         hlist_for_each_entry(mp, p, &mdb->mhash[hash], hlist[mdb->ver]) {
                 count++;
                 if (unlikely(br_ip_equal(group, &mp->addr)))
@@ -642,10 +651,11 @@ static struct net_bridge_mdb_entry *br_multicast_new_group(
         struct net_bridge *br, struct net_bridge_port *port,
         struct br_ip *group)
 {
-        struct net_bridge_mdb_htable *mdb = br->mdb;
+        struct net_bridge_mdb_htable *mdb;
         struct net_bridge_mdb_entry *mp;
         int hash;
 
+        mdb = rcu_dereference_protected(br->mdb, 1);
         if (!mdb) {
                 if (br_mdb_rehash(&br->mdb, BR_HASH_SIZE, 0))
                         return NULL;
@@ -660,7 +670,7 @@ static struct net_bridge_mdb_entry *br_multicast_new_group(
 
         case -EAGAIN:
 rehash:
-                mdb = br->mdb;
+                mdb = rcu_dereference_protected(br->mdb, 1);
                 hash = br_ip_hash(mdb, group);
                 break;
 
@@ -692,7 +702,7 @@ static int br_multicast_add_group(struct net_bridge *br,
 {
         struct net_bridge_mdb_entry *mp;
         struct net_bridge_port_group *p;
-        struct net_bridge_port_group **pp;
+        struct net_bridge_port_group __rcu **pp;
         unsigned long now = jiffies;
         int err;
 
@@ -712,7 +722,9 @@ static int br_multicast_add_group(struct net_bridge *br,
                 goto out;
         }
 
-        for (pp = &mp->ports; (p = *pp); pp = &p->next) {
+        for (pp = &mp->ports;
+             (p = mlock_dereference(*pp, br)) != NULL;
+             pp = &p->next) {
                 if (p->port == port)
                         goto found;
                 if ((unsigned long)p->port < (unsigned long)port)
@@ -1106,7 +1118,7 @@ static int br_ip4_multicast_query(struct net_bridge *br,
         struct net_bridge_mdb_entry *mp;
         struct igmpv3_query *ih3;
         struct net_bridge_port_group *p;
-        struct net_bridge_port_group **pp;
+        struct net_bridge_port_group __rcu **pp;
         unsigned long max_delay;
         unsigned long now = jiffies;
         __be32 group;
@@ -1145,7 +1157,7 @@ static int br_ip4_multicast_query(struct net_bridge *br,
         if (!group)
                 goto out;
 
-        mp = br_mdb_ip4_get(br->mdb, group);
+        mp = br_mdb_ip4_get(mlock_dereference(br->mdb, br), group);
         if (!mp)
                 goto out;
 
@@ -1157,7 +1169,9 @@ static int br_ip4_multicast_query(struct net_bridge *br,
              try_to_del_timer_sync(&mp->timer) >= 0))
                 mod_timer(&mp->timer, now + max_delay);
 
-        for (pp = &mp->ports; (p = *pp); pp = &p->next) {
+        for (pp = &mp->ports;
+             (p = mlock_dereference(*pp, br)) != NULL;
+             pp = &p->next) {
                 if (timer_pending(&p->timer) ?
                     time_after(p->timer.expires, now + max_delay) :
                     try_to_del_timer_sync(&p->timer) >= 0)
@@ -1178,7 +1192,8 @@ static int br_ip6_multicast_query(struct net_bridge *br,
         struct mld_msg *mld = (struct mld_msg *) icmp6_hdr(skb);
         struct net_bridge_mdb_entry *mp;
         struct mld2_query *mld2q;
-        struct net_bridge_port_group *p, **pp;
+        struct net_bridge_port_group *p;
+        struct net_bridge_port_group __rcu **pp;
         unsigned long max_delay;
         unsigned long now = jiffies;
         struct in6_addr *group = NULL;
@@ -1214,7 +1229,7 @@ static int br_ip6_multicast_query(struct net_bridge *br,
         if (!group)
                 goto out;
 
-        mp = br_mdb_ip6_get(br->mdb, group);
+        mp = br_mdb_ip6_get(mlock_dereference(br->mdb, br), group);
         if (!mp)
                 goto out;
 
@@ -1225,7 +1240,9 @@ static int br_ip6_multicast_query(struct net_bridge *br,
              try_to_del_timer_sync(&mp->timer) >= 0))
                 mod_timer(&mp->timer, now + max_delay);
 
-        for (pp = &mp->ports; (p = *pp); pp = &p->next) {
+        for (pp = &mp->ports;
+             (p = mlock_dereference(*pp, br)) != NULL;
+             pp = &p->next) {
                 if (timer_pending(&p->timer) ?
                     time_after(p->timer.expires, now + max_delay) :
                     try_to_del_timer_sync(&p->timer) >= 0)
@@ -1254,7 +1271,7 @@ static void br_multicast_leave_group(struct net_bridge *br,
             timer_pending(&br->multicast_querier_timer))
                 goto out;
 
-        mdb = br->mdb;
+        mdb = mlock_dereference(br->mdb, br);
         mp = br_mdb_ip_get(mdb, group);
         if (!mp)
                 goto out;
@@ -1277,7 +1294,9 @@ static void br_multicast_leave_group(struct net_bridge *br,
                 goto out;
         }
 
-        for (p = mp->ports; p; p = p->next) {
+        for (p = mlock_dereference(mp->ports, br);
+             p != NULL;
+             p = mlock_dereference(p->next, br)) {
                 if (p->port != port)
                         continue;
 
@@ -1625,7 +1644,7 @@ void br_multicast_stop(struct net_bridge *br)
         del_timer_sync(&br->multicast_query_timer);
 
         spin_lock_bh(&br->multicast_lock);
-        mdb = br->mdb;
+        mdb = mlock_dereference(br->mdb, br);
         if (!mdb)
                 goto out;
 
@@ -1729,6 +1748,7 @@ int br_multicast_toggle(struct net_bridge *br, unsigned long val)
 {
         struct net_bridge_port *port;
         int err = 0;
+        struct net_bridge_mdb_htable *mdb;
 
         spin_lock(&br->multicast_lock);
         if (br->multicast_disabled == !val)
@@ -1741,15 +1761,16 @@ int br_multicast_toggle(struct net_bridge *br, unsigned long val)
         if (!netif_running(br->dev))
                 goto unlock;
 
-        if (br->mdb) {
-                if (br->mdb->old) {
+        mdb = mlock_dereference(br->mdb, br);
+        if (mdb) {
+                if (mdb->old) {
                         err = -EEXIST;
 rollback:
                         br->multicast_disabled = !!val;
                         goto unlock;
                 }
 
-                err = br_mdb_rehash(&br->mdb, br->mdb->max,
+                err = br_mdb_rehash(&br->mdb, mdb->max,
                                     br->hash_elasticity);
                 if (err)
                         goto rollback;
@@ -1774,6 +1795,7 @@ int br_multicast_set_hash_max(struct net_bridge *br, unsigned long val)
 {
         int err = -ENOENT;
         u32 old;
+        struct net_bridge_mdb_htable *mdb;
 
         spin_lock(&br->multicast_lock);
         if (!netif_running(br->dev))
@@ -1782,7 +1804,9 @@ int br_multicast_set_hash_max(struct net_bridge *br, unsigned long val)
         err = -EINVAL;
         if (!is_power_of_2(val))
                 goto unlock;
-        if (br->mdb && val < br->mdb->size)
+
+        mdb = mlock_dereference(br->mdb, br);
+        if (mdb && val < mdb->size)
                 goto unlock;
 
         err = 0;
@@ -1790,8 +1814,8 @@ int br_multicast_set_hash_max(struct net_bridge *br, unsigned long val)
         old = br->hash_max;
         br->hash_max = val;
 
-        if (br->mdb) {
-                if (br->mdb->old) {
+        if (mdb) {
+                if (mdb->old) {
                         err = -EEXIST;
 rollback:
                         br->hash_max = old;
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 865fd7634b6..6e139209391 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -131,17 +131,18 @@ void br_netfilter_rtable_init(struct net_bridge *br)
 
 static inline struct rtable *bridge_parent_rtable(const struct net_device *dev)
 {
-        if (!br_port_exists(dev))
-                return NULL;
-        return &br_port_get_rcu(dev)->br->fake_rtable;
+        struct net_bridge_port *port;
+
+        port = br_port_get_rcu(dev);
+        return port ? &port->br->fake_rtable : NULL;
 }
 
 static inline struct net_device *bridge_parent(const struct net_device *dev)
 {
-        if (!br_port_exists(dev))
-                return NULL;
+        struct net_bridge_port *port;
 
-        return br_port_get_rcu(dev)->br->dev;
+        port = br_port_get_rcu(dev);
+        return port ? port->br->dev : NULL;
 }
 
 static inline struct nf_bridge_info *nf_bridge_alloc(struct sk_buff *skb)
@@ -412,13 +413,8 @@ static int br_nf_pre_routing_finish(struct sk_buff *skb)
         if (dnat_took_place(skb)) {
                 if ((err = ip_route_input(skb, iph->daddr, iph->saddr, iph->tos, dev))) {
                         struct flowi fl = {
-                                .nl_u = {
-                                        .ip4_u = {
-                                                 .daddr = iph->daddr,
-                                                 .saddr = 0,
-                                                 .tos = RT_TOS(iph->tos) },
-                                },
-                                .proto = 0,
+                                .fl4_dst = iph->daddr,
+                                .fl4_tos = RT_TOS(iph->tos),
                         };
                         struct in_device *in_dev = __in_dev_get_rcu(dev);
 
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index 4a6a378c84e..f8bf4c7f842 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -119,11 +119,13 @@ static int br_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
 
         idx = 0;
         for_each_netdev(net, dev) {
+                struct net_bridge_port *port = br_port_get_rtnl(dev);
+
                 /* not a bridge port */
-                if (!br_port_exists(dev) || idx < cb->args[0])
+                if (!port || idx < cb->args[0])
                         goto skip;
 
-                if (br_fill_ifinfo(skb, br_port_get(dev),
+                if (br_fill_ifinfo(skb, port,
                                    NETLINK_CB(cb->skb).pid,
                                    cb->nlh->nlmsg_seq, RTM_NEWLINK,
                                    NLM_F_MULTI) < 0)
@@ -169,9 +171,9 @@ static int br_rtm_setlink(struct sk_buff *skb,  struct nlmsghdr *nlh, void *arg)
         if (!dev)
                 return -ENODEV;
 
-        if (!br_port_exists(dev))
+        p = br_port_get_rtnl(dev);
+        if (!p)
                 return -EINVAL;
-        p = br_port_get(dev);
 
         /* if kernel STP is running, don't allow changes */
         if (p->br->stp_enabled == BR_KERNEL_STP)
diff --git a/net/bridge/br_notify.c b/net/bridge/br_notify.c
index 404d4e14c6a..7d337c9b608 100644
--- a/net/bridge/br_notify.c
+++ b/net/bridge/br_notify.c
@@ -32,15 +32,15 @@ struct notifier_block br_device_notifier = {
 static int br_device_event(struct notifier_block *unused, unsigned long event, void *ptr)
 {
         struct net_device *dev = ptr;
-        struct net_bridge_port *p = br_port_get(dev);
+        struct net_bridge_port *p;
         struct net_bridge *br;
         int err;
 
         /* not a port of a bridge */
-        if (!br_port_exists(dev))
+        p = br_port_get_rtnl(dev);
+        if (!p)
                 return NOTIFY_DONE;
 
-        p = br_port_get(dev);
         br = p->br;
 
         switch (event) {
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 75c90edaf7d..84aac7734bf 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -72,7 +72,7 @@ struct net_bridge_fdb_entry
 
 struct net_bridge_port_group {
         struct net_bridge_port          *port;
-        struct net_bridge_port_group    *next;
+        struct net_bridge_port_group __rcu *next;
         struct hlist_node               mglist;
         struct rcu_head                 rcu;
         struct timer_list               timer;
@@ -86,7 +86,7 @@ struct net_bridge_mdb_entry
         struct hlist_node               hlist[2];
         struct hlist_node               mglist;
         struct net_bridge               *br;
-        struct net_bridge_port_group    *ports;
+        struct net_bridge_port_group __rcu *ports;
         struct rcu_head                 rcu;
         struct timer_list               timer;
         struct timer_list               query_timer;
@@ -151,11 +151,20 @@ struct net_bridge_port
 #endif
 };
 
-#define br_port_get_rcu(dev) \
-        ((struct net_bridge_port *) rcu_dereference(dev->rx_handler_data))
-#define br_port_get(dev) ((struct net_bridge_port *) dev->rx_handler_data)
 #define br_port_exists(dev) (dev->priv_flags & IFF_BRIDGE_PORT)
 
+static inline struct net_bridge_port *br_port_get_rcu(const struct net_device *dev)
+{
+        struct net_bridge_port *port = rcu_dereference(dev->rx_handler_data);
+        return br_port_exists(dev) ? port : NULL;
+}
+
+static inline struct net_bridge_port *br_port_get_rtnl(struct net_device *dev)
+{
+        return br_port_exists(dev) ?
+                rtnl_dereference(dev->rx_handler_data) : NULL;
+}
+
 struct br_cpu_netstats {
         u64                     rx_packets;
         u64                     rx_bytes;
@@ -227,7 +236,7 @@ struct net_bridge
         unsigned long                   multicast_startup_query_interval;
 
         spinlock_t                      multicast_lock;
-        struct net_bridge_mdb_htable    *mdb;
+        struct net_bridge_mdb_htable __rcu *mdb;
         struct hlist_head               router_list;
         struct hlist_head               mglist;
 
diff --git a/net/bridge/br_stp_bpdu.c b/net/bridge/br_stp_bpdu.c
index 35cf27087b5..3d9a55d3822 100644
--- a/net/bridge/br_stp_bpdu.c
+++ b/net/bridge/br_stp_bpdu.c
@@ -141,10 +141,6 @@ void br_stp_rcv(const struct stp_proto *proto, struct sk_buff *skb,
         struct net_bridge *br;
         const unsigned char *buf;
 
-        if (!br_port_exists(dev))
-                goto err;
-        p = br_port_get_rcu(dev);
-
         if (!pskb_may_pull(skb, 4))
                 goto err;
 
@@ -153,6 +149,10 @@ void br_stp_rcv(const struct stp_proto *proto, struct sk_buff *skb,
         if (buf[0] != 0 || buf[1] != 0 || buf[2] != 0)
                 goto err;
 
+        p = br_port_get_rcu(dev);
+        if (!p)
+                goto err;
+
         br = p->br;
         spin_lock(&br->lock);
 
diff --git a/net/bridge/netfilter/ebtable_broute.c b/net/bridge/netfilter/ebtable_broute.c
index ae3f106c390..1bcaf36ad61 100644
--- a/net/bridge/netfilter/ebtable_broute.c
+++ b/net/bridge/netfilter/ebtable_broute.c
@@ -87,7 +87,8 @@ static int __init ebtable_broute_init(void)
         if (ret < 0)
                 return ret;
         /* see br_input.c */
-        rcu_assign_pointer(br_should_route_hook, ebt_broute);
+        rcu_assign_pointer(br_should_route_hook,
+                           (br_should_route_hook_t *)ebt_broute);
         return 0;
 }
 
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index a1dcf83f0d5..cbc9f395ab1 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -128,6 +128,7 @@ ebt_basic_match(const struct ebt_entry *e, const struct sk_buff *skb,
                 const struct net_device *in, const struct net_device *out)
 {
         const struct ethhdr *h = eth_hdr(skb);
+        const struct net_bridge_port *p;
         __be16 ethproto;
         int verdict, i;
 
@@ -148,13 +149,11 @@ ebt_basic_match(const struct ebt_entry *e, const struct sk_buff *skb,
         if (FWINV2(ebt_dev_check(e->out, out), EBT_IOUT))
                 return 1;
         /* rcu_read_lock()ed by nf_hook_slow */
-        if (in && br_port_exists(in) &&
-            FWINV2(ebt_dev_check(e->logical_in, br_port_get_rcu(in)->br->dev),
-                   EBT_ILOGICALIN))
+        if (in && (p = br_port_get_rcu(in)) != NULL &&
+            FWINV2(ebt_dev_check(e->logical_in, p->br->dev), EBT_ILOGICALIN))
                 return 1;
-        if (out && br_port_exists(out) &&
-            FWINV2(ebt_dev_check(e->logical_out, br_port_get_rcu(out)->br->dev),
-                   EBT_ILOGICALOUT))
+        if (out && (p = br_port_get_rcu(out)) != NULL &&
+            FWINV2(ebt_dev_check(e->logical_out, p->br->dev), EBT_ILOGICALOUT))
                 return 1;
 
         if (e->bitmask & EBT_SOURCEMAC) {
diff --git a/net/caif/Makefile b/net/caif/Makefile
index f87481fb0e6..9d38e406e4a 100644
--- a/net/caif/Makefile
+++ b/net/caif/Makefile
@@ -1,8 +1,6 @@
-ifeq ($(CONFIG_CAIF_DEBUG),y)
-EXTRA_CFLAGS += -DDEBUG
-endif
+ccflags-$(CONFIG_CAIF_DEBUG)     :=      -DDEBUG
 
-caif-objs := caif_dev.o \
+caif-y := caif_dev.o \
         cfcnfg.o cfmuxl.o cfctrl.o  \
         cffrml.o cfveil.o cfdbgl.o\
         cfserl.o cfdgml.o  \
@@ -13,4 +11,4 @@ obj-$(CONFIG_CAIF) += caif.o
 obj-$(CONFIG_CAIF_NETDEV) += chnl_net.o
 obj-$(CONFIG_CAIF) += caif_socket.o
 
-export-objs := caif.o
+export-y := caif.o
diff --git a/net/can/Makefile b/net/can/Makefile
index 9cd3c4b3abd..2d3894b3274 100644
--- a/net/can/Makefile
+++ b/net/can/Makefile
@@ -3,10 +3,10 @@
 #
 
 obj-$(CONFIG_CAN)       += can.o
-can-objs                := af_can.o proc.o
+can-y                   := af_can.o proc.o
 
 obj-$(CONFIG_CAN_RAW)   += can-raw.o
-can-raw-objs            := raw.o
+can-raw-y               := raw.o
 
 obj-$(CONFIG_CAN_BCM)   += can-bcm.o
-can-bcm-objs            := bcm.o
+can-bcm-y               := bcm.o
diff --git a/net/ceph/Makefile b/net/ceph/Makefile
index 5f19415ec9c..e87ef435e11 100644
--- a/net/ceph/Makefile
+++ b/net/ceph/Makefile
@@ -3,7 +3,7 @@
 #
 obj-$(CONFIG_CEPH_LIB) += libceph.o
 
-libceph-objs := ceph_common.o messenger.o msgpool.o buffer.o pagelist.o \
+libceph-y := ceph_common.o messenger.o msgpool.o buffer.o pagelist.o \
         mon_client.o \
         osd_client.o osdmap.o crush/crush.o crush/mapper.o crush/hash.o \
         debugfs.o \
diff --git a/net/core/datagram.c b/net/core/datagram.c
index cd1e039c875..18ac112ea7a 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -177,7 +177,7 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned flags,
                  * interrupt level will suddenly eat the receive_queue.
                  *
                  * Look at current nfs client by the way...
-                 * However, this function was corrent in any case. 8)
+                 * However, this function was correct in any case. 8)
                  */
                 unsigned long cpu_flags;
 
diff --git a/net/core/dev.c b/net/core/dev.c
index 0dd54a69dac..d28b3a023bb 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -743,34 +743,31 @@ struct net_device *dev_get_by_index(struct net *net, int ifindex)
 EXPORT_SYMBOL(dev_get_by_index);
 
 /**
- *      dev_getbyhwaddr - find a device by its hardware address
+ *      dev_getbyhwaddr_rcu - find a device by its hardware address
  *      @net: the applicable net namespace
  *      @type: media type of device
  *      @ha: hardware address
  *
  *      Search for an interface by MAC address. Returns NULL if the device
- *      is not found or a pointer to the device. The caller must hold the
- *      rtnl semaphore. The returned device has not had its ref count increased
+ *      is not found or a pointer to the device. The caller must hold RCU
+ *      The returned device has not had its ref count increased
  *      and the caller must therefore be careful about locking
  *
- *      BUGS:
- *      If the API was consistent this would be __dev_get_by_hwaddr
  */
 
-struct net_device *dev_getbyhwaddr(struct net *net, unsigned short type, char *ha)
+struct net_device *dev_getbyhwaddr_rcu(struct net *net, unsigned short type,
+                                       const char *ha)
 {
         struct net_device *dev;
 
-        ASSERT_RTNL();
-
-        for_each_netdev(net, dev)
+        for_each_netdev_rcu(net, dev)
                 if (dev->type == type &&
                     !memcmp(dev->dev_addr, ha, dev->addr_len))
                         return dev;
 
         return NULL;
 }
-EXPORT_SYMBOL(dev_getbyhwaddr);
+EXPORT_SYMBOL(dev_getbyhwaddr_rcu);
 
 struct net_device *__dev_getfirstbyhwtype(struct net *net, unsigned short type)
 {
@@ -1557,12 +1554,19 @@ static void dev_queue_xmit_nit(struct sk_buff *skb, struct net_device *dev)
  */
 int netif_set_real_num_tx_queues(struct net_device *dev, unsigned int txq)
 {
+        int rc;
+
         if (txq < 1 || txq > dev->num_tx_queues)
                 return -EINVAL;
 
         if (dev->reg_state == NETREG_REGISTERED) {
                 ASSERT_RTNL();
 
+                rc = netdev_queue_update_kobjects(dev, dev->real_num_tx_queues,
+                                                  txq);
+                if (rc)
+                        return rc;
+
                 if (txq < dev->real_num_tx_queues)
                         qdisc_reset_all_tx_gt(dev, txq);
         }
@@ -1794,16 +1798,18 @@ struct sk_buff *skb_gso_segment(struct sk_buff *skb, int features)
         struct sk_buff *segs = ERR_PTR(-EPROTONOSUPPORT);
         struct packet_type *ptype;
         __be16 type = skb->protocol;
+        int vlan_depth = ETH_HLEN;
         int err;
 
-        if (type == htons(ETH_P_8021Q)) {
-                struct vlan_ethhdr *veh;
+        while (type == htons(ETH_P_8021Q)) {
+                struct vlan_hdr *vh;
 
-                if (unlikely(!pskb_may_pull(skb, VLAN_ETH_HLEN)))
+                if (unlikely(!pskb_may_pull(skb, vlan_depth + VLAN_HLEN)))
                         return ERR_PTR(-EINVAL);
 
-                veh = (struct vlan_ethhdr *)skb->data;
-                type = veh->h_vlan_encapsulated_proto;
+                vh = (struct vlan_hdr *)(skb->data + vlan_depth);
+                type = vh->h_vlan_encapsulated_proto;
+                vlan_depth += VLAN_HLEN;
         }
 
         skb_reset_mac_header(skb);
@@ -1817,8 +1823,7 @@ struct sk_buff *skb_gso_segment(struct sk_buff *skb, int features)
                 if (dev && dev->ethtool_ops && dev->ethtool_ops->get_drvinfo)
                         dev->ethtool_ops->get_drvinfo(dev, &info);
 
-                WARN(1, "%s: caps=(0x%lx, 0x%lx) len=%d data_len=%d "
-                        "ip_summed=%d",
+                WARN(1, "%s: caps=(0x%lx, 0x%lx) len=%d data_len=%d ip_summed=%d\n",
                      info.driver, dev ? dev->features : 0L,
                      skb->sk ? skb->sk->sk_route_caps : 0L,
                      skb->len, skb->data_len, skb->ip_summed);
@@ -1967,6 +1972,23 @@ static inline void skb_orphan_try(struct sk_buff *skb)
         }
 }
 
+int netif_get_vlan_features(struct sk_buff *skb, struct net_device *dev)
+{
+        __be16 protocol = skb->protocol;
+
+        if (protocol == htons(ETH_P_8021Q)) {
+                struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data;
+                protocol = veh->h_vlan_encapsulated_proto;
+        } else if (!skb->vlan_tci)
+                return dev->features;
+
+        if (protocol != htons(ETH_P_8021Q))
+                return dev->features & dev->vlan_features;
+        else
+                return 0;
+}
+EXPORT_SYMBOL(netif_get_vlan_features);
+
 /*
  * Returns true if either:
  *      1. skb has frag_list and the device doesn't support FRAGLIST, or
@@ -1977,15 +1999,20 @@ static inline void skb_orphan_try(struct sk_buff *skb)
 static inline int skb_needs_linearize(struct sk_buff *skb,
                                       struct net_device *dev)
 {
-        int features = dev->features;
+        if (skb_is_nonlinear(skb)) {
+                int features = dev->features;
 
-        if (skb->protocol == htons(ETH_P_8021Q) || vlan_tx_tag_present(skb))
-                features &= dev->vlan_features;
+                if (vlan_tx_tag_present(skb))
+                        features &= dev->vlan_features;
+
+                return (skb_has_frag_list(skb) &&
+                        !(features & NETIF_F_FRAGLIST)) ||
+                        (skb_shinfo(skb)->nr_frags &&
+                        (!(features & NETIF_F_SG) ||
+                        illegal_highdma(dev, skb)));
+        }
 
-        return skb_is_nonlinear(skb) &&
-               ((skb_has_frag_list(skb) && !(features & NETIF_F_FRAGLIST)) ||
-                (skb_shinfo(skb)->nr_frags && (!(features & NETIF_F_SG) ||
-                                              illegal_highdma(dev, skb))));
+        return 0;
 }
 
 int dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev,
@@ -1995,9 +2022,6 @@ int dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev,
         int rc = NETDEV_TX_OK;
 
         if (likely(!skb->next)) {
-                if (!list_empty(&ptype_all))
-                        dev_queue_xmit_nit(skb, dev);
-
                 /*
                  * If device doesnt need skb->dst, release it right now while
                  * its hot in this cpu cache
@@ -2005,6 +2029,9 @@ int dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev,
                 if (dev->priv_flags & IFF_XMIT_DST_RELEASE)
                         skb_dst_drop(skb);
 
+                if (!list_empty(&ptype_all))
+                        dev_queue_xmit_nit(skb, dev);
+
                 skb_orphan_try(skb);
 
                 if (vlan_tx_tag_present(skb) &&
@@ -2119,26 +2146,70 @@ static inline u16 dev_cap_txqueue(struct net_device *dev, u16 queue_index)
         return queue_index;
 }
 
+static inline int get_xps_queue(struct net_device *dev, struct sk_buff *skb)
+{
+#ifdef CONFIG_XPS
+        struct xps_dev_maps *dev_maps;
+        struct xps_map *map;
+        int queue_index = -1;
+
+        rcu_read_lock();
+        dev_maps = rcu_dereference(dev->xps_maps);
+        if (dev_maps) {
+                map = rcu_dereference(
+                    dev_maps->cpu_map[raw_smp_processor_id()]);
+                if (map) {
+                        if (map->len == 1)
+                                queue_index = map->queues[0];
+                        else {
+                                u32 hash;
+                                if (skb->sk && skb->sk->sk_hash)
+                                        hash = skb->sk->sk_hash;
+                                else
+                                        hash = (__force u16) skb->protocol ^
+                                            skb->rxhash;
+                                hash = jhash_1word(hash, hashrnd);
+                                queue_index = map->queues[
+                                    ((u64)hash * map->len) >> 32];
+                        }
+                        if (unlikely(queue_index >= dev->real_num_tx_queues))
+                                queue_index = -1;
+                }
+        }
+        rcu_read_unlock();
+
+        return queue_index;
+#else
+        return -1;
+#endif
+}
+
 static struct netdev_queue *dev_pick_tx(struct net_device *dev,
                                         struct sk_buff *skb)
 {
         int queue_index;
         const struct net_device_ops *ops = dev->netdev_ops;
 
-        if (ops->ndo_select_queue) {
+        if (dev->real_num_tx_queues == 1)
+                queue_index = 0;
+        else if (ops->ndo_select_queue) {
                 queue_index = ops->ndo_select_queue(dev, skb);
                 queue_index = dev_cap_txqueue(dev, queue_index);
         } else {
                 struct sock *sk = skb->sk;
                 queue_index = sk_tx_queue_get(sk);
-                if (queue_index < 0 || queue_index >= dev->real_num_tx_queues) {
 
-                        queue_index = 0;
-                        if (dev->real_num_tx_queues > 1)
+                if (queue_index < 0 || skb->ooo_okay ||
+                    queue_index >= dev->real_num_tx_queues) {
+                        int old_index = queue_index;
+
+                        queue_index = get_xps_queue(dev, skb);
+                        if (queue_index < 0)
                                 queue_index = skb_tx_hash(dev, skb);
 
-                        if (sk) {
-                                struct dst_entry *dst = rcu_dereference_check(sk->sk_dst_cache, 1);
+                        if (queue_index != old_index && sk) {
+                                struct dst_entry *dst =
+                                    rcu_dereference_check(sk->sk_dst_cache, 1);
 
                                 if (dst && skb_dst(skb) == dst)
                                         sk_tx_queue_set(sk, queue_index);
@@ -4967,10 +5038,13 @@ unsigned long netdev_fix_features(unsigned long features, const char *name)
         }
 
         if (features & NETIF_F_UFO) {
-                if (!(features & NETIF_F_GEN_CSUM)) {
+                /* maybe split UFO into V4 and V6? */
+                if (!((features & NETIF_F_GEN_CSUM) ||
+                    (features & (NETIF_F_IP_CSUM|NETIF_F_IPV6_CSUM))
+                            == (NETIF_F_IP_CSUM|NETIF_F_IPV6_CSUM))) {
                         if (name)
                                 printk(KERN_ERR "%s: Dropping NETIF_F_UFO "
-                                       "since no NETIF_F_HW_CSUM feature.\n",
+                                       "since no checksum offload features.\n",
                                        name);
                         features &= ~NETIF_F_UFO;
                 }
@@ -5014,9 +5088,9 @@ void netif_stacked_transfer_operstate(const struct net_device *rootdev,
 }
 EXPORT_SYMBOL(netif_stacked_transfer_operstate);
 
+#ifdef CONFIG_RPS
 static int netif_alloc_rx_queues(struct net_device *dev)
 {
-#ifdef CONFIG_RPS
         unsigned int i, count = dev->num_rx_queues;
         struct netdev_rx_queue *rx;
 
@@ -5029,15 +5103,22 @@ static int netif_alloc_rx_queues(struct net_device *dev)
         }
         dev->_rx = rx;
 
-        /*
-         * Set a pointer to first element in the array which holds the
-         * reference count.
-         */
         for (i = 0; i < count; i++)
-                rx[i].first = rx;
-#endif
+                rx[i].dev = dev;
         return 0;
 }
+#endif
+
+static void netdev_init_one_queue(struct net_device *dev,
+                                  struct netdev_queue *queue, void *_unused)
+{
+        /* Initialize queue lock */
+        spin_lock_init(&queue->_xmit_lock);
+        netdev_set_xmit_lockdep_class(&queue->_xmit_lock, dev->type);
+        queue->xmit_lock_owner = -1;
+        netdev_queue_numa_node_write(queue, -1);
+        queue->dev = dev;
+}
 
 static int netif_alloc_netdev_queues(struct net_device *dev)
 {
@@ -5053,25 +5134,11 @@ static int netif_alloc_netdev_queues(struct net_device *dev)
                 return -ENOMEM;
         }
         dev->_tx = tx;
-        return 0;
-}
 
-static void netdev_init_one_queue(struct net_device *dev,
-                                  struct netdev_queue *queue,
-                                  void *_unused)
-{
-        queue->dev = dev;
-
-        /* Initialize queue lock */
-        spin_lock_init(&queue->_xmit_lock);
-        netdev_set_xmit_lockdep_class(&queue->_xmit_lock, dev->type);
-        queue->xmit_lock_owner = -1;
-}
-
-static void netdev_init_queues(struct net_device *dev)
-{
         netdev_for_each_tx_queue(dev, netdev_init_one_queue, NULL);
         spin_lock_init(&dev->tx_global_lock);
+
+        return 0;
 }
 
 /**
@@ -5110,16 +5177,6 @@ int register_netdevice(struct net_device *dev)
 
         dev->iflink = -1;
 
-        ret = netif_alloc_rx_queues(dev);
-        if (ret)
-                goto out;
-
-        ret = netif_alloc_netdev_queues(dev);
-        if (ret)
-                goto out;
-
-        netdev_init_queues(dev);
-
         /* Init, if this function is available */
         if (dev->netdev_ops->ndo_init) {
                 ret = dev->netdev_ops->ndo_init(dev);
@@ -5577,10 +5634,14 @@ struct net_device *alloc_netdev_mq(int sizeof_priv, const char *name,
 
         dev->num_tx_queues = queue_count;
         dev->real_num_tx_queues = queue_count;
+        if (netif_alloc_netdev_queues(dev))
+                goto free_pcpu;
 
 #ifdef CONFIG_RPS
         dev->num_rx_queues = queue_count;
         dev->real_num_rx_queues = queue_count;
+        if (netif_alloc_rx_queues(dev))
+                goto free_pcpu;
 #endif
 
         dev->gso_max_size = GSO_MAX_SIZE;
@@ -5597,6 +5658,11 @@ struct net_device *alloc_netdev_mq(int sizeof_priv, const char *name,
 
 free_pcpu:
         free_percpu(dev->pcpu_refcnt);
+        kfree(dev->_tx);
+#ifdef CONFIG_RPS
+        kfree(dev->_rx);
+#endif
+
 free_p:
         kfree(p);
         return NULL;
@@ -5618,6 +5684,9 @@ void free_netdev(struct net_device *dev)
         release_net(dev_net(dev));
 
         kfree(dev->_tx);
+#ifdef CONFIG_RPS
+        kfree(dev->_rx);
+#endif
 
         kfree(rcu_dereference_raw(dev->ingress_queue));
 
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 956a9f4971c..d5bc2881888 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -1171,7 +1171,9 @@ static int ethtool_set_ufo(struct net_device *dev, char __user *useraddr)
                 return -EFAULT;
         if (edata.data && !(dev->features & NETIF_F_SG))
                 return -EINVAL;
-        if (edata.data && !(dev->features & NETIF_F_HW_CSUM))
+        if (edata.data && !((dev->features & NETIF_F_GEN_CSUM) ||
+                (dev->features & (NETIF_F_IP_CSUM|NETIF_F_IPV6_CSUM))
+                        == (NETIF_F_IP_CSUM|NETIF_F_IPV6_CSUM)))
                 return -EINVAL;
         return dev->ethtool_ops->set_ufo(dev, edata.data);
 }
diff --git a/net/core/filter.c b/net/core/filter.c
index ae21a0d3c4a..e193e29d467 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -37,9 +37,58 @@
 #include <asm/uaccess.h>
 #include <asm/unaligned.h>
 #include <linux/filter.h>
+#include <linux/reciprocal_div.h>
+
+enum {
+        BPF_S_RET_K = 1,
+        BPF_S_RET_A,
+        BPF_S_ALU_ADD_K,
+        BPF_S_ALU_ADD_X,
+        BPF_S_ALU_SUB_K,
+        BPF_S_ALU_SUB_X,
+        BPF_S_ALU_MUL_K,
+        BPF_S_ALU_MUL_X,
+        BPF_S_ALU_DIV_X,
+        BPF_S_ALU_AND_K,
+        BPF_S_ALU_AND_X,
+        BPF_S_ALU_OR_K,
+        BPF_S_ALU_OR_X,
+        BPF_S_ALU_LSH_K,
+        BPF_S_ALU_LSH_X,
+        BPF_S_ALU_RSH_K,
+        BPF_S_ALU_RSH_X,
+        BPF_S_ALU_NEG,
+        BPF_S_LD_W_ABS,
+        BPF_S_LD_H_ABS,
+        BPF_S_LD_B_ABS,
+        BPF_S_LD_W_LEN,
+        BPF_S_LD_W_IND,
+        BPF_S_LD_H_IND,
+        BPF_S_LD_B_IND,
+        BPF_S_LD_IMM,
+        BPF_S_LDX_W_LEN,
+        BPF_S_LDX_B_MSH,
+        BPF_S_LDX_IMM,
+        BPF_S_MISC_TAX,
+        BPF_S_MISC_TXA,
+        BPF_S_ALU_DIV_K,
+        BPF_S_LD_MEM,
+        BPF_S_LDX_MEM,
+        BPF_S_ST,
+        BPF_S_STX,
+        BPF_S_JMP_JA,
+        BPF_S_JMP_JEQ_K,
+        BPF_S_JMP_JEQ_X,
+        BPF_S_JMP_JGE_K,
+        BPF_S_JMP_JGE_X,
+        BPF_S_JMP_JGT_K,
+        BPF_S_JMP_JGT_X,
+        BPF_S_JMP_JSET_K,
+        BPF_S_JMP_JSET_X,
+};
 
 /* No hurry in this branch */
-static void *__load_pointer(struct sk_buff *skb, int k)
+static void *__load_pointer(const struct sk_buff *skb, int k)
 {
         u8 *ptr = NULL;
 
@@ -53,7 +102,7 @@ static void *__load_pointer(struct sk_buff *skb, int k)
         return NULL;
 }
 
-static inline void *load_pointer(struct sk_buff *skb, int k,
+static inline void *load_pointer(const struct sk_buff *skb, int k,
                                  unsigned int size, void *buffer)
 {
         if (k >= 0)
@@ -89,7 +138,7 @@ int sk_filter(struct sock *sk, struct sk_buff *skb)
         rcu_read_lock_bh();
         filter = rcu_dereference_bh(sk->sk_filter);
         if (filter) {
-                unsigned int pkt_len = sk_run_filter(skb, filter->insns, filter->len);
+                unsigned int pkt_len = sk_run_filter(skb, filter->insns);
 
                 err = pkt_len ? pskb_trim(skb, pkt_len) : -EPERM;
         }
@@ -103,50 +152,52 @@ EXPORT_SYMBOL(sk_filter);
  *      sk_run_filter - run a filter on a socket
  *      @skb: buffer to run the filter on
  *      @filter: filter to apply
- *      @flen: length of filter
  *
  * Decode and apply filter instructions to the skb->data.
- * Return length to keep, 0 for none. skb is the data we are
- * filtering, filter is the array of filter instructions, and
- * len is the number of filter blocks in the array.
+ * Return length to keep, 0 for none. @skb is the data we are
+ * filtering, @filter is the array of filter instructions.
+ * Because all jumps are guaranteed to be before last instruction,
+ * and last instruction guaranteed to be a RET, we dont need to check
+ * flen. (We used to pass to this function the length of filter)
  */
-unsigned int sk_run_filter(struct sk_buff *skb, struct sock_filter *filter, int flen)
+unsigned int sk_run_filter(const struct sk_buff *skb,
+                           const struct sock_filter *fentry)
 {
         void *ptr;
         u32 A = 0;                      /* Accumulator */
         u32 X = 0;                      /* Index Register */
         u32 mem[BPF_MEMWORDS];          /* Scratch Memory Store */
-        unsigned long memvalid = 0;
         u32 tmp;
         int k;
-        int pc;
 
-        BUILD_BUG_ON(BPF_MEMWORDS > BITS_PER_LONG);
         /*
          * Process array of filter instructions.
          */
-        for (pc = 0; pc < flen; pc++) {
-                const struct sock_filter *fentry = &filter[pc];
-                u32 f_k = fentry->k;
+        for (;; fentry++) {
+#if defined(CONFIG_X86_32)
+#define K (fentry->k)
+#else
+                const u32 K = fentry->k;
+#endif
 
                 switch (fentry->code) {
                 case BPF_S_ALU_ADD_X:
                         A += X;
                         continue;
                 case BPF_S_ALU_ADD_K:
-                        A += f_k;
+                        A += K;
                         continue;
                 case BPF_S_ALU_SUB_X:
                         A -= X;
                         continue;
                 case BPF_S_ALU_SUB_K:
-                        A -= f_k;
+                        A -= K;
                         continue;
                 case BPF_S_ALU_MUL_X:
                         A *= X;
                         continue;
                 case BPF_S_ALU_MUL_K:
-                        A *= f_k;
+                        A *= K;
                         continue;
                 case BPF_S_ALU_DIV_X:
                         if (X == 0)
@@ -154,64 +205,64 @@ unsigned int sk_run_filter(struct sk_buff *skb, struct sock_filter *filter, int
                         A /= X;
                         continue;
                 case BPF_S_ALU_DIV_K:
-                        A /= f_k;
+                        A = reciprocal_divide(A, K);
                         continue;
                 case BPF_S_ALU_AND_X:
                         A &= X;
                         continue;
                 case BPF_S_ALU_AND_K:
-                        A &= f_k;
+                        A &= K;
                         continue;
                 case BPF_S_ALU_OR_X:
                         A |= X;
                         continue;
                 case BPF_S_ALU_OR_K:
-                        A |= f_k;
+                        A |= K;
                         continue;
                 case BPF_S_ALU_LSH_X:
                         A <<= X;
                         continue;
                 case BPF_S_ALU_LSH_K:
-                        A <<= f_k;
+                        A <<= K;
                         continue;
                 case BPF_S_ALU_RSH_X:
                         A >>= X;
                         continue;
                 case BPF_S_ALU_RSH_K:
-                        A >>= f_k;
+                        A >>= K;
                         continue;
                 case BPF_S_ALU_NEG:
                         A = -A;
                         continue;
                 case BPF_S_JMP_JA:
-                        pc += f_k;
+                        fentry += K;
                         continue;
                 case BPF_S_JMP_JGT_K:
-                        pc += (A > f_k) ? fentry->jt : fentry->jf;
+                        fentry += (A > K) ? fentry->jt : fentry->jf;
                         continue;
                 case BPF_S_JMP_JGE_K:
-                        pc += (A >= f_k) ? fentry->jt : fentry->jf;
+                        fentry += (A >= K) ? fentry->jt : fentry->jf;
                         continue;
                 case BPF_S_JMP_JEQ_K:
-                        pc += (A == f_k) ? fentry->jt : fentry->jf;
+                        fentry += (A == K) ? fentry->jt : fentry->jf;
                         continue;
                 case BPF_S_JMP_JSET_K:
-                        pc += (A & f_k) ? fentry->jt : fentry->jf;
+                        fentry += (A & K) ? fentry->jt : fentry->jf;
                         continue;
                 case BPF_S_JMP_JGT_X:
-                        pc += (A > X) ? fentry->jt : fentry->jf;
+                        fentry += (A > X) ? fentry->jt : fentry->jf;
                         continue;
                 case BPF_S_JMP_JGE_X:
-                        pc += (A >= X) ? fentry->jt : fentry->jf;
+                        fentry += (A >= X) ? fentry->jt : fentry->jf;
                         continue;
                 case BPF_S_JMP_JEQ_X:
-                        pc += (A == X) ? fentry->jt : fentry->jf;
+                        fentry += (A == X) ? fentry->jt : fentry->jf;
                         continue;
                 case BPF_S_JMP_JSET_X:
-                        pc += (A & X) ? fentry->jt : fentry->jf;
+                        fentry += (A & X) ? fentry->jt : fentry->jf;
                         continue;
                 case BPF_S_LD_W_ABS:
-                        k = f_k;
+                        k = K;
 load_w:
                         ptr = load_pointer(skb, k, 4, &tmp);
                         if (ptr != NULL) {
@@ -220,7 +271,7 @@ load_w:
                         }
                         break;
                 case BPF_S_LD_H_ABS:
-                        k = f_k;
+                        k = K;
 load_h:
                         ptr = load_pointer(skb, k, 2, &tmp);
                         if (ptr != NULL) {
@@ -229,7 +280,7 @@ load_h:
                         }
                         break;
                 case BPF_S_LD_B_ABS:
-                        k = f_k;
+                        k = K;
 load_b:
                         ptr = load_pointer(skb, k, 1, &tmp);
                         if (ptr != NULL) {
@@ -244,34 +295,32 @@ load_b:
                         X = skb->len;
                         continue;
                 case BPF_S_LD_W_IND:
-                        k = X + f_k;
+                        k = X + K;
                         goto load_w;
                 case BPF_S_LD_H_IND:
-                        k = X + f_k;
+                        k = X + K;
                         goto load_h;
                 case BPF_S_LD_B_IND:
-                        k = X + f_k;
+                        k = X + K;
                         goto load_b;
                 case BPF_S_LDX_B_MSH:
-                        ptr = load_pointer(skb, f_k, 1, &tmp);
+                        ptr = load_pointer(skb, K, 1, &tmp);
                         if (ptr != NULL) {
                                 X = (*(u8 *)ptr & 0xf) << 2;
                                 continue;
                         }
                         return 0;
                 case BPF_S_LD_IMM:
-                        A = f_k;
+                        A = K;
                         continue;
                 case BPF_S_LDX_IMM:
-                        X = f_k;
+                        X = K;
                         continue;
                 case BPF_S_LD_MEM:
-                        A = (memvalid & (1UL << f_k)) ?
-                                mem[f_k] : 0;
+                        A = mem[K];
                         continue;
                 case BPF_S_LDX_MEM:
-                        X = (memvalid & (1UL << f_k)) ?
-                                mem[f_k] : 0;
+                        X = mem[K];
                         continue;
                 case BPF_S_MISC_TAX:
                         X = A;
@@ -280,16 +329,14 @@ load_b:
                         A = X;
                         continue;
                 case BPF_S_RET_K:
-                        return f_k;
+                        return K;
                 case BPF_S_RET_A:
                         return A;
                 case BPF_S_ST:
-                        memvalid |= 1UL << f_k;
-                        mem[f_k] = A;
+                        mem[K] = A;
                         continue;
                 case BPF_S_STX:
-                        memvalid |= 1UL << f_k;
-                        mem[f_k] = X;
+                        mem[K] = X;
                         continue;
                 default:
                         WARN_ON(1);
@@ -323,6 +370,12 @@ load_b:
                                 return 0;
                         A = skb->dev->type;
                         continue;
+                case SKF_AD_RXHASH:
+                        A = skb->rxhash;
+                        continue;
+                case SKF_AD_CPU:
+                        A = raw_smp_processor_id();
+                        continue;
                 case SKF_AD_NLATTR: {
                         struct nlattr *nla;
 
@@ -367,6 +420,66 @@ load_b:
 }
 EXPORT_SYMBOL(sk_run_filter);
 
+/*
+ * Security :
+ * A BPF program is able to use 16 cells of memory to store intermediate
+ * values (check u32 mem[BPF_MEMWORDS] in sk_run_filter())
+ * As we dont want to clear mem[] array for each packet going through
+ * sk_run_filter(), we check that filter loaded by user never try to read
+ * a cell if not previously written, and we check all branches to be sure
+ * a malicious user doesnt try to abuse us.
+ */
+static int check_load_and_stores(struct sock_filter *filter, int flen)
+{
+        u16 *masks, memvalid = 0; /* one bit per cell, 16 cells */
+        int pc, ret = 0;
+
+        BUILD_BUG_ON(BPF_MEMWORDS > 16);
+        masks = kmalloc(flen * sizeof(*masks), GFP_KERNEL);
+        if (!masks)
+                return -ENOMEM;
+        memset(masks, 0xff, flen * sizeof(*masks));
+
+        for (pc = 0; pc < flen; pc++) {
+                memvalid &= masks[pc];
+
+                switch (filter[pc].code) {
+                case BPF_S_ST:
+                case BPF_S_STX:
+                        memvalid |= (1 << filter[pc].k);
+                        break;
+                case BPF_S_LD_MEM:
+                case BPF_S_LDX_MEM:
+                        if (!(memvalid & (1 << filter[pc].k))) {
+                                ret = -EINVAL;
+                                goto error;
+                        }
+                        break;
+                case BPF_S_JMP_JA:
+                        /* a jump must set masks on target */
+                        masks[pc + 1 + filter[pc].k] &= memvalid;
+                        memvalid = ~0;
+                        break;
+                case BPF_S_JMP_JEQ_K:
+                case BPF_S_JMP_JEQ_X:
+                case BPF_S_JMP_JGE_K:
+                case BPF_S_JMP_JGE_X:
+                case BPF_S_JMP_JGT_K:
+                case BPF_S_JMP_JGT_X:
+                case BPF_S_JMP_JSET_X:
+                case BPF_S_JMP_JSET_K:
+                        /* a jump must set masks on targets */
+                        masks[pc + 1 + filter[pc].jt] &= memvalid;
+                        masks[pc + 1 + filter[pc].jf] &= memvalid;
+                        memvalid = ~0;
+                        break;
+                }
+        }
+error:
+        kfree(masks);
+        return ret;
+}
+
 /**
  *      sk_chk_filter - verify socket filter code
  *      @filter: filter to verify
@@ -383,7 +496,57 @@ EXPORT_SYMBOL(sk_run_filter);
  */
 int sk_chk_filter(struct sock_filter *filter, int flen)
 {
-        struct sock_filter *ftest;
+        /*
+         * Valid instructions are initialized to non-0.
+         * Invalid instructions are initialized to 0.
+         */
+        static const u8 codes[] = {
+                [BPF_ALU|BPF_ADD|BPF_K]  = BPF_S_ALU_ADD_K,
+                [BPF_ALU|BPF_ADD|BPF_X]  = BPF_S_ALU_ADD_X,
+                [BPF_ALU|BPF_SUB|BPF_K]  = BPF_S_ALU_SUB_K,
+                [BPF_ALU|BPF_SUB|BPF_X]  = BPF_S_ALU_SUB_X,
+                [BPF_ALU|BPF_MUL|BPF_K]  = BPF_S_ALU_MUL_K,
+                [BPF_ALU|BPF_MUL|BPF_X]  = BPF_S_ALU_MUL_X,
+                [BPF_ALU|BPF_DIV|BPF_X]  = BPF_S_ALU_DIV_X,
+                [BPF_ALU|BPF_AND|BPF_K]  = BPF_S_ALU_AND_K,
+                [BPF_ALU|BPF_AND|BPF_X]  = BPF_S_ALU_AND_X,
+                [BPF_ALU|BPF_OR|BPF_K]   = BPF_S_ALU_OR_K,
+                [BPF_ALU|BPF_OR|BPF_X]   = BPF_S_ALU_OR_X,
+                [BPF_ALU|BPF_LSH|BPF_K]  = BPF_S_ALU_LSH_K,
+                [BPF_ALU|BPF_LSH|BPF_X]  = BPF_S_ALU_LSH_X,
+                [BPF_ALU|BPF_RSH|BPF_K]  = BPF_S_ALU_RSH_K,
+                [BPF_ALU|BPF_RSH|BPF_X]  = BPF_S_ALU_RSH_X,
+                [BPF_ALU|BPF_NEG]        = BPF_S_ALU_NEG,
+                [BPF_LD|BPF_W|BPF_ABS]   = BPF_S_LD_W_ABS,
+                [BPF_LD|BPF_H|BPF_ABS]   = BPF_S_LD_H_ABS,
+                [BPF_LD|BPF_B|BPF_ABS]   = BPF_S_LD_B_ABS,
+                [BPF_LD|BPF_W|BPF_LEN]   = BPF_S_LD_W_LEN,
+                [BPF_LD|BPF_W|BPF_IND]   = BPF_S_LD_W_IND,
+                [BPF_LD|BPF_H|BPF_IND]   = BPF_S_LD_H_IND,
+                [BPF_LD|BPF_B|BPF_IND]   = BPF_S_LD_B_IND,
+                [BPF_LD|BPF_IMM]         = BPF_S_LD_IMM,
+                [BPF_LDX|BPF_W|BPF_LEN]  = BPF_S_LDX_W_LEN,
+                [BPF_LDX|BPF_B|BPF_MSH]  = BPF_S_LDX_B_MSH,
+                [BPF_LDX|BPF_IMM]        = BPF_S_LDX_IMM,
+                [BPF_MISC|BPF_TAX]       = BPF_S_MISC_TAX,
+                [BPF_MISC|BPF_TXA]       = BPF_S_MISC_TXA,
+                [BPF_RET|BPF_K]          = BPF_S_RET_K,
+                [BPF_RET|BPF_A]          = BPF_S_RET_A,
+                [BPF_ALU|BPF_DIV|BPF_K]  = BPF_S_ALU_DIV_K,
+                [BPF_LD|BPF_MEM]         = BPF_S_LD_MEM,
+                [BPF_LDX|BPF_MEM]        = BPF_S_LDX_MEM,
+                [BPF_ST]                 = BPF_S_ST,
+                [BPF_STX]                = BPF_S_STX,
+                [BPF_JMP|BPF_JA]         = BPF_S_JMP_JA,
+                [BPF_JMP|BPF_JEQ|BPF_K]  = BPF_S_JMP_JEQ_K,
+                [BPF_JMP|BPF_JEQ|BPF_X]  = BPF_S_JMP_JEQ_X,
+                [BPF_JMP|BPF_JGE|BPF_K]  = BPF_S_JMP_JGE_K,
+                [BPF_JMP|BPF_JGE|BPF_X]  = BPF_S_JMP_JGE_X,
+                [BPF_JMP|BPF_JGT|BPF_K]  = BPF_S_JMP_JGT_K,
+                [BPF_JMP|BPF_JGT|BPF_X]  = BPF_S_JMP_JGT_X,
+                [BPF_JMP|BPF_JSET|BPF_K] = BPF_S_JMP_JSET_K,
+                [BPF_JMP|BPF_JSET|BPF_X] = BPF_S_JMP_JSET_X,
+        };
         int pc;
 
         if (flen == 0 || flen > BPF_MAXINSNS)
@@ -391,136 +554,31 @@ int sk_chk_filter(struct sock_filter *filter, int flen)
 
         /* check the filter code now */
         for (pc = 0; pc < flen; pc++) {
-                ftest = &filter[pc];
-
-                /* Only allow valid instructions */
-                switch (ftest->code) {
-                case BPF_ALU|BPF_ADD|BPF_K:
-                        ftest->code = BPF_S_ALU_ADD_K;
-                        break;
-                case BPF_ALU|BPF_ADD|BPF_X:
-                        ftest->code = BPF_S_ALU_ADD_X;
-                        break;
-                case BPF_ALU|BPF_SUB|BPF_K:
-                        ftest->code = BPF_S_ALU_SUB_K;
-                        break;
-                case BPF_ALU|BPF_SUB|BPF_X:
-                        ftest->code = BPF_S_ALU_SUB_X;
-                        break;
-                case BPF_ALU|BPF_MUL|BPF_K:
-                        ftest->code = BPF_S_ALU_MUL_K;
-                        break;
-                case BPF_ALU|BPF_MUL|BPF_X:
-                        ftest->code = BPF_S_ALU_MUL_X;
-                        break;
-                case BPF_ALU|BPF_DIV|BPF_X:
-                        ftest->code = BPF_S_ALU_DIV_X;
-                        break;
-                case BPF_ALU|BPF_AND|BPF_K:
-                        ftest->code = BPF_S_ALU_AND_K;
-                        break;
-                case BPF_ALU|BPF_AND|BPF_X:
-                        ftest->code = BPF_S_ALU_AND_X;
-                        break;
-                case BPF_ALU|BPF_OR|BPF_K:
-                        ftest->code = BPF_S_ALU_OR_K;
-                        break;
-                case BPF_ALU|BPF_OR|BPF_X:
-                        ftest->code = BPF_S_ALU_OR_X;
-                        break;
-                case BPF_ALU|BPF_LSH|BPF_K:
-                        ftest->code = BPF_S_ALU_LSH_K;
-                        break;
-                case BPF_ALU|BPF_LSH|BPF_X:
-                        ftest->code = BPF_S_ALU_LSH_X;
-                        break;
-                case BPF_ALU|BPF_RSH|BPF_K:
-                        ftest->code = BPF_S_ALU_RSH_K;
-                        break;
-                case BPF_ALU|BPF_RSH|BPF_X:
-                        ftest->code = BPF_S_ALU_RSH_X;
-                        break;
-                case BPF_ALU|BPF_NEG:
-                        ftest->code = BPF_S_ALU_NEG;
-                        break;
-                case BPF_LD|BPF_W|BPF_ABS:
-                        ftest->code = BPF_S_LD_W_ABS;
-                        break;
-                case BPF_LD|BPF_H|BPF_ABS:
-                        ftest->code = BPF_S_LD_H_ABS;
-                        break;
-                case BPF_LD|BPF_B|BPF_ABS:
-                        ftest->code = BPF_S_LD_B_ABS;
-                        break;
-                case BPF_LD|BPF_W|BPF_LEN:
-                        ftest->code = BPF_S_LD_W_LEN;
-                        break;
-                case BPF_LD|BPF_W|BPF_IND:
-                        ftest->code = BPF_S_LD_W_IND;
-                        break;
-                case BPF_LD|BPF_H|BPF_IND:
-                        ftest->code = BPF_S_LD_H_IND;
-                        break;
-                case BPF_LD|BPF_B|BPF_IND:
-                        ftest->code = BPF_S_LD_B_IND;
-                        break;
-                case BPF_LD|BPF_IMM:
-                        ftest->code = BPF_S_LD_IMM;
-                        break;
-                case BPF_LDX|BPF_W|BPF_LEN:
-                        ftest->code = BPF_S_LDX_W_LEN;
-                        break;
-                case BPF_LDX|BPF_B|BPF_MSH:
-                        ftest->code = BPF_S_LDX_B_MSH;
-                        break;
-                case BPF_LDX|BPF_IMM:
-                        ftest->code = BPF_S_LDX_IMM;
-                        break;
-                case BPF_MISC|BPF_TAX:
-                        ftest->code = BPF_S_MISC_TAX;
-                        break;
-                case BPF_MISC|BPF_TXA:
-                        ftest->code = BPF_S_MISC_TXA;
-                        break;
-                case BPF_RET|BPF_K:
-                        ftest->code = BPF_S_RET_K;
-                        break;
-                case BPF_RET|BPF_A:
-                        ftest->code = BPF_S_RET_A;
-                        break;
+                struct sock_filter *ftest = &filter[pc];
+                u16 code = ftest->code;
 
+                if (code >= ARRAY_SIZE(codes))
+                        return -EINVAL;
+                code = codes[code];
+                if (!code)
+                        return -EINVAL;
                 /* Some instructions need special checks */
-
+                switch (code) {
+                case BPF_S_ALU_DIV_K:
                         /* check for division by zero */
-                case BPF_ALU|BPF_DIV|BPF_K:
                         if (ftest->k == 0)
                                 return -EINVAL;
-                        ftest->code = BPF_S_ALU_DIV_K;
-                        break;
-
-                /* check for invalid memory addresses */
-                case BPF_LD|BPF_MEM:
-                        if (ftest->k >= BPF_MEMWORDS)
-                                return -EINVAL;
-                        ftest->code = BPF_S_LD_MEM;
-                        break;
-                case BPF_LDX|BPF_MEM:
-                        if (ftest->k >= BPF_MEMWORDS)
-                                return -EINVAL;
-                        ftest->code = BPF_S_LDX_MEM;
-                        break;
-                case BPF_ST:
-                        if (ftest->k >= BPF_MEMWORDS)
-                                return -EINVAL;
-                        ftest->code = BPF_S_ST;
+                        ftest->k = reciprocal_value(ftest->k);
                         break;
-                case BPF_STX:
+                case BPF_S_LD_MEM:
+                case BPF_S_LDX_MEM:
+                case BPF_S_ST:
+                case BPF_S_STX:
+                        /* check for invalid memory addresses */
                         if (ftest->k >= BPF_MEMWORDS)
                                 return -EINVAL;
-                        ftest->code = BPF_S_STX;
                         break;
-
-                case BPF_JMP|BPF_JA:
+                case BPF_S_JMP_JA:
                         /*
                          * Note, the large ftest->k might cause loops.
                          * Compare this with conditional jumps below,
@@ -528,40 +586,7 @@ int sk_chk_filter(struct sock_filter *filter, int flen)
                          */
                         if (ftest->k >= (unsigned)(flen-pc-1))
                                 return -EINVAL;
-                        ftest->code = BPF_S_JMP_JA;
-                        break;
-
-                case BPF_JMP|BPF_JEQ|BPF_K:
-                        ftest->code = BPF_S_JMP_JEQ_K;
-                        break;
-                case BPF_JMP|BPF_JEQ|BPF_X:
-                        ftest->code = BPF_S_JMP_JEQ_X;
-                        break;
-                case BPF_JMP|BPF_JGE|BPF_K:
-                        ftest->code = BPF_S_JMP_JGE_K;
-                        break;
-                case BPF_JMP|BPF_JGE|BPF_X:
-                        ftest->code = BPF_S_JMP_JGE_X;
-                        break;
-                case BPF_JMP|BPF_JGT|BPF_K:
-                        ftest->code = BPF_S_JMP_JGT_K;
-                        break;
-                case BPF_JMP|BPF_JGT|BPF_X:
-                        ftest->code = BPF_S_JMP_JGT_X;
-                        break;
-                case BPF_JMP|BPF_JSET|BPF_K:
-                        ftest->code = BPF_S_JMP_JSET_K;
                         break;
-                case BPF_JMP|BPF_JSET|BPF_X:
-                        ftest->code = BPF_S_JMP_JSET_X;
-                        break;
-
-                default:
-                        return -EINVAL;
-                }
-
-                        /* for conditionals both must be safe */
-                switch (ftest->code) {
                 case BPF_S_JMP_JEQ_K:
                 case BPF_S_JMP_JEQ_X:
                 case BPF_S_JMP_JGE_K:
@@ -570,21 +595,22 @@ int sk_chk_filter(struct sock_filter *filter, int flen)
                 case BPF_S_JMP_JGT_X:
                 case BPF_S_JMP_JSET_X:
                 case BPF_S_JMP_JSET_K:
+                        /* for conditionals both must be safe */
                         if (pc + ftest->jt + 1 >= flen ||
                             pc + ftest->jf + 1 >= flen)
                                 return -EINVAL;
+                        break;
                 }
+                ftest->code = code;
         }
 
         /* last instruction must be a RET code */
         switch (filter[flen - 1].code) {
         case BPF_S_RET_K:
         case BPF_S_RET_A:
-                return 0;
-                break;
-                default:
-                        return -EINVAL;
-                }
+                return check_load_and_stores(filter, flen);
+        }
+        return -EINVAL;
 }
 EXPORT_SYMBOL(sk_chk_filter);
 
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index 7f902cad10f..85e8b5326dd 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -706,7 +706,6 @@ static struct attribute *rx_queue_default_attrs[] = {
 static void rx_queue_release(struct kobject *kobj)
 {
         struct netdev_rx_queue *queue = to_rx_queue(kobj);
-        struct netdev_rx_queue *first = queue->first;
         struct rps_map *map;
         struct rps_dev_flow_table *flow_table;
 
@@ -723,10 +722,8 @@ static void rx_queue_release(struct kobject *kobj)
                 call_rcu(&flow_table->rcu, rps_dev_flow_table_release);
         }
 
-        if (atomic_dec_and_test(&first->count))
-                kfree(first);
-        else
-                memset(kobj, 0, sizeof(*kobj));
+        memset(kobj, 0, sizeof(*kobj));
+        dev_put(queue->dev);
 }
 
 static struct kobj_type rx_queue_ktype = {
@@ -738,7 +735,6 @@ static struct kobj_type rx_queue_ktype = {
 static int rx_queue_add_kobject(struct net_device *net, int index)
 {
         struct netdev_rx_queue *queue = net->_rx + index;
-        struct netdev_rx_queue *first = queue->first;
         struct kobject *kobj = &queue->kobj;
         int error = 0;
 
@@ -751,14 +747,16 @@ static int rx_queue_add_kobject(struct net_device *net, int index)
         }
 
         kobject_uevent(kobj, KOBJ_ADD);
-        atomic_inc(&first->count);
+        dev_hold(queue->dev);
 
         return error;
 }
+#endif /* CONFIG_RPS */
 
 int
 net_rx_queue_update_kobjects(struct net_device *net, int old_num, int new_num)
 {
+#ifdef CONFIG_RPS
         int i;
         int error = 0;
 
@@ -774,23 +772,422 @@ net_rx_queue_update_kobjects(struct net_device *net, int old_num, int new_num)
                 kobject_put(&net->_rx[i].kobj);
 
         return error;
+#else
+        return 0;
+#endif
+}
+
+#ifdef CONFIG_XPS
+/*
+ * netdev_queue sysfs structures and functions.
+ */
+struct netdev_queue_attribute {
+        struct attribute attr;
+        ssize_t (*show)(struct netdev_queue *queue,
+            struct netdev_queue_attribute *attr, char *buf);
+        ssize_t (*store)(struct netdev_queue *queue,
+            struct netdev_queue_attribute *attr, const char *buf, size_t len);
+};
+#define to_netdev_queue_attr(_attr) container_of(_attr,         \
+    struct netdev_queue_attribute, attr)
+
+#define to_netdev_queue(obj) container_of(obj, struct netdev_queue, kobj)
+
+static ssize_t netdev_queue_attr_show(struct kobject *kobj,
+                                      struct attribute *attr, char *buf)
+{
+        struct netdev_queue_attribute *attribute = to_netdev_queue_attr(attr);
+        struct netdev_queue *queue = to_netdev_queue(kobj);
+
+        if (!attribute->show)
+                return -EIO;
+
+        return attribute->show(queue, attribute, buf);
 }
 
-static int rx_queue_register_kobjects(struct net_device *net)
+static ssize_t netdev_queue_attr_store(struct kobject *kobj,
+                                       struct attribute *attr,
+                                       const char *buf, size_t count)
 {
+        struct netdev_queue_attribute *attribute = to_netdev_queue_attr(attr);
+        struct netdev_queue *queue = to_netdev_queue(kobj);
+
+        if (!attribute->store)
+                return -EIO;
+
+        return attribute->store(queue, attribute, buf, count);
+}
+
+static const struct sysfs_ops netdev_queue_sysfs_ops = {
+        .show = netdev_queue_attr_show,
+        .store = netdev_queue_attr_store,
+};
+
+static inline unsigned int get_netdev_queue_index(struct netdev_queue *queue)
+{
+        struct net_device *dev = queue->dev;
+        int i;
+
+        for (i = 0; i < dev->num_tx_queues; i++)
+                if (queue == &dev->_tx[i])
+                        break;
+
+        BUG_ON(i >= dev->num_tx_queues);
+
+        return i;
+}
+
+
+static ssize_t show_xps_map(struct netdev_queue *queue,
+                            struct netdev_queue_attribute *attribute, char *buf)
+{
+        struct net_device *dev = queue->dev;
+        struct xps_dev_maps *dev_maps;
+        cpumask_var_t mask;
+        unsigned long index;
+        size_t len = 0;
+        int i;
+
+        if (!zalloc_cpumask_var(&mask, GFP_KERNEL))
+                return -ENOMEM;
+
+        index = get_netdev_queue_index(queue);
+
+        rcu_read_lock();
+        dev_maps = rcu_dereference(dev->xps_maps);
+        if (dev_maps) {
+                for_each_possible_cpu(i) {
+                        struct xps_map *map =
+                            rcu_dereference(dev_maps->cpu_map[i]);
+                        if (map) {
+                                int j;
+                                for (j = 0; j < map->len; j++) {
+                                        if (map->queues[j] == index) {
+                                                cpumask_set_cpu(i, mask);
+                                                break;
+                                        }
+                                }
+                        }
+                }
+        }
+        rcu_read_unlock();
+
+        len += cpumask_scnprintf(buf + len, PAGE_SIZE, mask);
+        if (PAGE_SIZE - len < 3) {
+                free_cpumask_var(mask);
+                return -EINVAL;
+        }
+
+        free_cpumask_var(mask);
+        len += sprintf(buf + len, "\n");
+        return len;
+}
+
+static void xps_map_release(struct rcu_head *rcu)
+{
+        struct xps_map *map = container_of(rcu, struct xps_map, rcu);
+
+        kfree(map);
+}
+
+static void xps_dev_maps_release(struct rcu_head *rcu)
+{
+        struct xps_dev_maps *dev_maps =
+            container_of(rcu, struct xps_dev_maps, rcu);
+
+        kfree(dev_maps);
+}
+
+static DEFINE_MUTEX(xps_map_mutex);
+#define xmap_dereference(P)             \
+        rcu_dereference_protected((P), lockdep_is_held(&xps_map_mutex))
+
+static ssize_t store_xps_map(struct netdev_queue *queue,
+                      struct netdev_queue_attribute *attribute,
+                      const char *buf, size_t len)
+{
+        struct net_device *dev = queue->dev;
+        cpumask_var_t mask;
+        int err, i, cpu, pos, map_len, alloc_len, need_set;
+        unsigned long index;
+        struct xps_map *map, *new_map;
+        struct xps_dev_maps *dev_maps, *new_dev_maps;
+        int nonempty = 0;
+        int numa_node = -2;
+
+        if (!capable(CAP_NET_ADMIN))
+                return -EPERM;
+
+        if (!alloc_cpumask_var(&mask, GFP_KERNEL))
+                return -ENOMEM;
+
+        index = get_netdev_queue_index(queue);
+
+        err = bitmap_parse(buf, len, cpumask_bits(mask), nr_cpumask_bits);
+        if (err) {
+                free_cpumask_var(mask);
+                return err;
+        }
+
+        new_dev_maps = kzalloc(max_t(unsigned,
+            XPS_DEV_MAPS_SIZE, L1_CACHE_BYTES), GFP_KERNEL);
+        if (!new_dev_maps) {
+                free_cpumask_var(mask);
+                return -ENOMEM;
+        }
+
+        mutex_lock(&xps_map_mutex);
+
+        dev_maps = xmap_dereference(dev->xps_maps);
+
+        for_each_possible_cpu(cpu) {
+                map = dev_maps ?
+                        xmap_dereference(dev_maps->cpu_map[cpu]) : NULL;
+                new_map = map;
+                if (map) {
+                        for (pos = 0; pos < map->len; pos++)
+                                if (map->queues[pos] == index)
+                                        break;
+                        map_len = map->len;
+                        alloc_len = map->alloc_len;
+                } else
+                        pos = map_len = alloc_len = 0;
+
+                need_set = cpu_isset(cpu, *mask) && cpu_online(cpu);
+#ifdef CONFIG_NUMA
+                if (need_set) {
+                        if (numa_node == -2)
+                                numa_node = cpu_to_node(cpu);
+                        else if (numa_node != cpu_to_node(cpu))
+                                numa_node = -1;
+                }
+#endif
+                if (need_set && pos >= map_len) {
+                        /* Need to add queue to this CPU's map */
+                        if (map_len >= alloc_len) {
+                                alloc_len = alloc_len ?
+                                    2 * alloc_len : XPS_MIN_MAP_ALLOC;
+                                new_map = kzalloc_node(XPS_MAP_SIZE(alloc_len),
+                                                       GFP_KERNEL,
+                                                       cpu_to_node(cpu));
+                                if (!new_map)
+                                        goto error;
+                                new_map->alloc_len = alloc_len;
+                                for (i = 0; i < map_len; i++)
+                                        new_map->queues[i] = map->queues[i];
+                                new_map->len = map_len;
+                        }
+                        new_map->queues[new_map->len++] = index;
+                } else if (!need_set && pos < map_len) {
+                        /* Need to remove queue from this CPU's map */
+                        if (map_len > 1)
+                                new_map->queues[pos] =
+                                    new_map->queues[--new_map->len];
+                        else
+                                new_map = NULL;
+                }
+                RCU_INIT_POINTER(new_dev_maps->cpu_map[cpu], new_map);
+        }
+
+        /* Cleanup old maps */
+        for_each_possible_cpu(cpu) {
+                map = dev_maps ?
+                        xmap_dereference(dev_maps->cpu_map[cpu]) : NULL;
+                if (map && xmap_dereference(new_dev_maps->cpu_map[cpu]) != map)
+                        call_rcu(&map->rcu, xps_map_release);
+                if (new_dev_maps->cpu_map[cpu])
+                        nonempty = 1;
+        }
+
+        if (nonempty)
+                rcu_assign_pointer(dev->xps_maps, new_dev_maps);
+        else {
+                kfree(new_dev_maps);
+                rcu_assign_pointer(dev->xps_maps, NULL);
+        }
+
+        if (dev_maps)
+                call_rcu(&dev_maps->rcu, xps_dev_maps_release);
+
+        netdev_queue_numa_node_write(queue, (numa_node >= 0) ? numa_node : -1);
+
+        mutex_unlock(&xps_map_mutex);
+
+        free_cpumask_var(mask);
+        return len;
+
+error:
+        mutex_unlock(&xps_map_mutex);
+
+        if (new_dev_maps)
+                for_each_possible_cpu(i)
+                        kfree(rcu_dereference_protected(
+                                new_dev_maps->cpu_map[i],
+                                1));
+        kfree(new_dev_maps);
+        free_cpumask_var(mask);
+        return -ENOMEM;
+}
+
+static struct netdev_queue_attribute xps_cpus_attribute =
+    __ATTR(xps_cpus, S_IRUGO | S_IWUSR, show_xps_map, store_xps_map);
+
+static struct attribute *netdev_queue_default_attrs[] = {
+        &xps_cpus_attribute.attr,
+        NULL
+};
+
+static void netdev_queue_release(struct kobject *kobj)
+{
+        struct netdev_queue *queue = to_netdev_queue(kobj);
+        struct net_device *dev = queue->dev;
+        struct xps_dev_maps *dev_maps;
+        struct xps_map *map;
+        unsigned long index;
+        int i, pos, nonempty = 0;
+
+        index = get_netdev_queue_index(queue);
+
+        mutex_lock(&xps_map_mutex);
+        dev_maps = xmap_dereference(dev->xps_maps);
+
+        if (dev_maps) {
+                for_each_possible_cpu(i) {
+                        map = xmap_dereference(dev_maps->cpu_map[i]);
+                        if (!map)
+                                continue;
+
+                        for (pos = 0; pos < map->len; pos++)
+                                if (map->queues[pos] == index)
+                                        break;
+
+                        if (pos < map->len) {
+                                if (map->len > 1)
+                                        map->queues[pos] =
+                                            map->queues[--map->len];
+                                else {
+                                        RCU_INIT_POINTER(dev_maps->cpu_map[i],
+                                            NULL);
+                                        call_rcu(&map->rcu, xps_map_release);
+                                        map = NULL;
+                                }
+                        }
+                        if (map)
+                                nonempty = 1;
+                }
+
+                if (!nonempty) {
+                        RCU_INIT_POINTER(dev->xps_maps, NULL);
+                        call_rcu(&dev_maps->rcu, xps_dev_maps_release);
+                }
+        }
+
+        mutex_unlock(&xps_map_mutex);
+
+        memset(kobj, 0, sizeof(*kobj));
+        dev_put(queue->dev);
+}
+
+static struct kobj_type netdev_queue_ktype = {
+        .sysfs_ops = &netdev_queue_sysfs_ops,
+        .release = netdev_queue_release,
+        .default_attrs = netdev_queue_default_attrs,
+};
+
+static int netdev_queue_add_kobject(struct net_device *net, int index)
+{
+        struct netdev_queue *queue = net->_tx + index;
+        struct kobject *kobj = &queue->kobj;
+        int error = 0;
+
+        kobj->kset = net->queues_kset;
+        error = kobject_init_and_add(kobj, &netdev_queue_ktype, NULL,
+            "tx-%u", index);
+        if (error) {
+                kobject_put(kobj);
+                return error;
+        }
+
+        kobject_uevent(kobj, KOBJ_ADD);
+        dev_hold(queue->dev);
+
+        return error;
+}
+#endif /* CONFIG_XPS */
+
+int
+netdev_queue_update_kobjects(struct net_device *net, int old_num, int new_num)
+{
+#ifdef CONFIG_XPS
+        int i;
+        int error = 0;
+
+        for (i = old_num; i < new_num; i++) {
+                error = netdev_queue_add_kobject(net, i);
+                if (error) {
+                        new_num = old_num;
+                        break;
+                }
+        }
+
+        while (--i >= new_num)
+                kobject_put(&net->_tx[i].kobj);
+
+        return error;
+#else
+        return 0;
+#endif
+}
+
+static int register_queue_kobjects(struct net_device *net)
+{
+        int error = 0, txq = 0, rxq = 0, real_rx = 0, real_tx = 0;
+
+#if defined(CONFIG_RPS) || defined(CONFIG_XPS)
         net->queues_kset = kset_create_and_add("queues",
             NULL, &net->dev.kobj);
         if (!net->queues_kset)
                 return -ENOMEM;
-        return net_rx_queue_update_kobjects(net, 0, net->real_num_rx_queues);
+#endif
+
+#ifdef CONFIG_RPS
+        real_rx = net->real_num_rx_queues;
+#endif
+        real_tx = net->real_num_tx_queues;
+
+        error = net_rx_queue_update_kobjects(net, 0, real_rx);
+        if (error)
+                goto error;
+        rxq = real_rx;
+
+        error = netdev_queue_update_kobjects(net, 0, real_tx);
+        if (error)
+                goto error;
+        txq = real_tx;
+
+        return 0;
+
+error:
+        netdev_queue_update_kobjects(net, txq, 0);
+        net_rx_queue_update_kobjects(net, rxq, 0);
+        return error;
 }
 
-static void rx_queue_remove_kobjects(struct net_device *net)
+static void remove_queue_kobjects(struct net_device *net)
 {
-        net_rx_queue_update_kobjects(net, net->real_num_rx_queues, 0);
+        int real_rx = 0, real_tx = 0;
+
+#ifdef CONFIG_RPS
+        real_rx = net->real_num_rx_queues;
+#endif
+        real_tx = net->real_num_tx_queues;
+
+        net_rx_queue_update_kobjects(net, real_rx, 0);
+        netdev_queue_update_kobjects(net, real_tx, 0);
+#if defined(CONFIG_RPS) || defined(CONFIG_XPS)
         kset_unregister(net->queues_kset);
+#endif
 }
-#endif /* CONFIG_RPS */
 
 static const void *net_current_ns(void)
 {
@@ -889,9 +1286,7 @@ void netdev_unregister_kobject(struct net_device * net)
 
         kobject_get(&dev->kobj);
 
-#ifdef CONFIG_RPS
-        rx_queue_remove_kobjects(net);
-#endif
+        remove_queue_kobjects(net);
 
         device_del(dev);
 }
@@ -930,13 +1325,11 @@ int netdev_register_kobject(struct net_device *net)
         if (error)
                 return error;
 
-#ifdef CONFIG_RPS
-        error = rx_queue_register_kobjects(net);
+        error = register_queue_kobjects(net);
         if (error) {
                 device_del(dev);
                 return error;
         }
-#endif
 
         return error;
 }
diff --git a/net/core/net-sysfs.h b/net/core/net-sysfs.h
index 778e1571548..bd7751ec1c4 100644
--- a/net/core/net-sysfs.h
+++ b/net/core/net-sysfs.h
@@ -4,8 +4,8 @@
 int netdev_kobject_init(void);
 int netdev_register_kobject(struct net_device *);
 void netdev_unregister_kobject(struct net_device *);
-#ifdef CONFIG_RPS
 int net_rx_queue_update_kobjects(struct net_device *, int old_num, int new_num);
-#endif
+int netdev_queue_update_kobjects(struct net_device *net,
+                                 int old_num, int new_num);
 
 #endif
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 4e98ffac3af..ee38acb6d46 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -76,8 +76,7 @@ static void queue_process(struct work_struct *work)
 
                 local_irq_save(flags);
                 __netif_tx_lock(txq, smp_processor_id());
-                if (netif_tx_queue_stopped(txq) ||
-                    netif_tx_queue_frozen(txq) ||
+                if (netif_tx_queue_frozen_or_stopped(txq) ||
                     ops->ndo_start_xmit(skb, dev) != NETDEV_TX_OK) {
                         skb_queue_head(&npinfo->txq, skb);
                         __netif_tx_unlock(txq);
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 33bc3823ac6..2953b2abc97 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -378,6 +378,7 @@ struct pktgen_dev {
 
         u16 queue_map_min;
         u16 queue_map_max;
+        __u32 skb_priority;     /* skb priority field */
         int node;               /* Memory node */
 
 #ifdef CONFIG_XFRM
@@ -394,6 +395,8 @@ struct pktgen_hdr {
         __be32 tv_usec;
 };
 
+static bool pktgen_exiting __read_mostly;
+
 struct pktgen_thread {
         spinlock_t if_lock;             /* for list of devices */
         struct list_head if_list;       /* All device here */
@@ -547,6 +550,10 @@ static int pktgen_if_show(struct seq_file *seq, void *v)
                    pkt_dev->queue_map_min,
                    pkt_dev->queue_map_max);
 
+        if (pkt_dev->skb_priority)
+                seq_printf(seq, "     skb_priority: %u\n",
+                           pkt_dev->skb_priority);
+
         if (pkt_dev->flags & F_IPV6) {
                 char b1[128], b2[128], b3[128];
                 fmt_ip6(b1, pkt_dev->in6_saddr.s6_addr);
@@ -1711,6 +1718,18 @@ static ssize_t pktgen_if_write(struct file *file,
                 return count;
         }
 
+        if (!strcmp(name, "skb_priority")) {
+                len = num_arg(&user_buffer[i], 9, &value);
+                if (len < 0)
+                        return len;
+
+                i += len;
+                pkt_dev->skb_priority = value;
+                sprintf(pg_result, "OK: skb_priority=%i",
+                        pkt_dev->skb_priority);
+                return count;
+        }
+
         sprintf(pkt_dev->result, "No such parameter \"%s\"", name);
         return -EINVAL;
 }
@@ -2671,6 +2690,8 @@ static struct sk_buff *fill_packet_ipv4(struct net_device *odev,
         skb->transport_header = skb->network_header + sizeof(struct iphdr);
         skb_put(skb, sizeof(struct iphdr) + sizeof(struct udphdr));
         skb_set_queue_mapping(skb, queue_map);
+        skb->priority = pkt_dev->skb_priority;
+
         iph = ip_hdr(skb);
         udph = udp_hdr(skb);
 
@@ -3016,6 +3037,7 @@ static struct sk_buff *fill_packet_ipv6(struct net_device *odev,
         skb->transport_header = skb->network_header + sizeof(struct ipv6hdr);
         skb_put(skb, sizeof(struct ipv6hdr) + sizeof(struct udphdr));
         skb_set_queue_mapping(skb, queue_map);
+        skb->priority = pkt_dev->skb_priority;
         iph = ipv6_hdr(skb);
         udph = udp_hdr(skb);
 
@@ -3431,11 +3453,6 @@ static void pktgen_rem_thread(struct pktgen_thread *t)
 
         remove_proc_entry(t->tsk->comm, pg_proc_dir);
 
-        mutex_lock(&pktgen_thread_lock);
-
-        list_del(&t->th_list);
-
-        mutex_unlock(&pktgen_thread_lock);
 }
 
 static void pktgen_resched(struct pktgen_dev *pkt_dev)
@@ -3510,7 +3527,7 @@ static void pktgen_xmit(struct pktgen_dev *pkt_dev)
 
         __netif_tx_lock_bh(txq);
 
-        if (unlikely(netif_tx_queue_stopped(txq) || netif_tx_queue_frozen(txq))) {
+        if (unlikely(netif_tx_queue_frozen_or_stopped(txq))) {
                 ret = NETDEV_TX_BUSY;
                 pkt_dev->last_ok = 0;
                 goto unlock;
@@ -3582,6 +3599,8 @@ static int pktgen_thread_worker(void *arg)
                 pkt_dev = next_to_run(t);
 
                 if (unlikely(!pkt_dev && t->control == 0)) {
+                        if (pktgen_exiting)
+                                break;
                         wait_event_interruptible_timeout(t->queue,
                                                          t->control != 0,
                                                          HZ/10);
@@ -3634,6 +3653,13 @@ static int pktgen_thread_worker(void *arg)
         pr_debug("%s removing thread\n", t->tsk->comm);
         pktgen_rem_thread(t);
 
+        /* Wait for kthread_stop */
+        while (!kthread_should_stop()) {
+                set_current_state(TASK_INTERRUPTIBLE);
+                schedule();
+        }
+        __set_current_state(TASK_RUNNING);
+
         return 0;
 }
 
@@ -3908,6 +3934,7 @@ static void __exit pg_cleanup(void)
         struct list_head *q, *n;
 
         /* Stop all interfaces & threads */
+        pktgen_exiting = true;
 
         list_for_each_safe(q, n, &pktgen_threads) {
                 t = list_entry(q, struct pktgen_thread, th_list);
diff --git a/net/core/request_sock.c b/net/core/request_sock.c
index fceeb37d716..182236b2510 100644
--- a/net/core/request_sock.c
+++ b/net/core/request_sock.c
@@ -33,6 +33,7 @@
  * Note : Dont forget somaxconn that may limit backlog too.
  */
 int sysctl_max_syn_backlog = 256;
+EXPORT_SYMBOL(sysctl_max_syn_backlog);
 
 int reqsk_queue_alloc(struct request_sock_queue *queue,
                       unsigned int nr_table_entries)
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 841c287ef40..750db57f3bb 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -362,6 +362,95 @@ static size_t rtnl_link_get_size(const struct net_device *dev)
         return size;
 }
 
+static LIST_HEAD(rtnl_af_ops);
+
+static const struct rtnl_af_ops *rtnl_af_lookup(const int family)
+{
+        const struct rtnl_af_ops *ops;
+
+        list_for_each_entry(ops, &rtnl_af_ops, list) {
+                if (ops->family == family)
+                        return ops;
+        }
+
+        return NULL;
+}
+
+/**
+ * __rtnl_af_register - Register rtnl_af_ops with rtnetlink.
+ * @ops: struct rtnl_af_ops * to register
+ *
+ * The caller must hold the rtnl_mutex.
+ *
+ * Returns 0 on success or a negative error code.
+ */
+int __rtnl_af_register(struct rtnl_af_ops *ops)
+{
+        list_add_tail(&ops->list, &rtnl_af_ops);
+        return 0;
+}
+EXPORT_SYMBOL_GPL(__rtnl_af_register);
+
+/**
+ * rtnl_af_register - Register rtnl_af_ops with rtnetlink.
+ * @ops: struct rtnl_af_ops * to register
+ *
+ * Returns 0 on success or a negative error code.
+ */
+int rtnl_af_register(struct rtnl_af_ops *ops)
+{
+        int err;
+
+        rtnl_lock();
+        err = __rtnl_af_register(ops);
+        rtnl_unlock();
+        return err;
+}
+EXPORT_SYMBOL_GPL(rtnl_af_register);
+
+/**
+ * __rtnl_af_unregister - Unregister rtnl_af_ops from rtnetlink.
+ * @ops: struct rtnl_af_ops * to unregister
+ *
+ * The caller must hold the rtnl_mutex.
+ */
+void __rtnl_af_unregister(struct rtnl_af_ops *ops)
+{
+        list_del(&ops->list);
+}
+EXPORT_SYMBOL_GPL(__rtnl_af_unregister);
+
+/**
+ * rtnl_af_unregister - Unregister rtnl_af_ops from rtnetlink.
+ * @ops: struct rtnl_af_ops * to unregister
+ */
+void rtnl_af_unregister(struct rtnl_af_ops *ops)
+{
+        rtnl_lock();
+        __rtnl_af_unregister(ops);
+        rtnl_unlock();
+}
+EXPORT_SYMBOL_GPL(rtnl_af_unregister);
+
+static size_t rtnl_link_get_af_size(const struct net_device *dev)
+{
+        struct rtnl_af_ops *af_ops;
+        size_t size;
+
+        /* IFLA_AF_SPEC */
+        size = nla_total_size(sizeof(struct nlattr));
+
+        list_for_each_entry(af_ops, &rtnl_af_ops, list) {
+                if (af_ops->get_link_af_size) {
+                        /* AF_* + nested data */
+                        size += nla_total_size(sizeof(struct nlattr)) +
+                                af_ops->get_link_af_size(dev);
+                }
+        }
+
+        return size;
+}
+
 static int rtnl_link_fill(struct sk_buff *skb, const struct net_device *dev)
 {
         const struct rtnl_link_ops *ops = dev->rtnl_link_ops;
@@ -671,7 +760,8 @@ static noinline size_t if_nlmsg_size(const struct net_device *dev)
                + nla_total_size(4) /* IFLA_NUM_VF */
                + rtnl_vfinfo_size(dev) /* IFLA_VFINFO_LIST */
                + rtnl_port_size(dev) /* IFLA_VF_PORTS + IFLA_PORT_SELF */
-               + rtnl_link_get_size(dev); /* IFLA_LINKINFO */
+               + rtnl_link_get_size(dev) /* IFLA_LINKINFO */
+               + rtnl_link_get_af_size(dev); /* IFLA_AF_SPEC */
 }
 
 static int rtnl_vf_ports_fill(struct sk_buff *skb, struct net_device *dev)
@@ -757,7 +847,8 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
         struct nlmsghdr *nlh;
         struct rtnl_link_stats64 temp;
         const struct rtnl_link_stats64 *stats;
-        struct nlattr *attr;
+        struct nlattr *attr, *af_spec;
+        struct rtnl_af_ops *af_ops;
 
         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ifm), flags);
         if (nlh == NULL)
@@ -866,6 +957,36 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
                         goto nla_put_failure;
         }
 
+        if (!(af_spec = nla_nest_start(skb, IFLA_AF_SPEC)))
+                goto nla_put_failure;
+
+        list_for_each_entry(af_ops, &rtnl_af_ops, list) {
+                if (af_ops->fill_link_af) {
+                        struct nlattr *af;
+                        int err;
+
+                        if (!(af = nla_nest_start(skb, af_ops->family)))
+                                goto nla_put_failure;
+
+                        err = af_ops->fill_link_af(skb, dev);
+
+                        /*
+                         * Caller may return ENODATA to indicate that there
+                         * was no data to be dumped. This is not an error, it
+                         * means we should trim the attribute header and
+                         * continue.
+                         */
+                        if (err == -ENODATA)
+                                nla_nest_cancel(skb, af);
+                        else if (err < 0)
+                                goto nla_put_failure;
+
+                        nla_nest_end(skb, af);
+                }
+        }
+
+        nla_nest_end(skb, af_spec);
+
         return nlmsg_end(skb, nlh);
 
 nla_put_failure:
@@ -924,6 +1045,7 @@ const struct nla_policy ifla_policy[IFLA_MAX+1] = {
         [IFLA_VFINFO_LIST]      = {. type = NLA_NESTED },
         [IFLA_VF_PORTS]         = { .type = NLA_NESTED },
         [IFLA_PORT_SELF]        = { .type = NLA_NESTED },
+        [IFLA_AF_SPEC]          = { .type = NLA_NESTED },
 };
 EXPORT_SYMBOL(ifla_policy);
 
@@ -985,6 +1107,28 @@ static int validate_linkmsg(struct net_device *dev, struct nlattr *tb[])
                         return -EINVAL;
         }
 
+        if (tb[IFLA_AF_SPEC]) {
+                struct nlattr *af;
+                int rem, err;
+
+                nla_for_each_nested(af, tb[IFLA_AF_SPEC], rem) {
+                        const struct rtnl_af_ops *af_ops;
+
+                        if (!(af_ops = rtnl_af_lookup(nla_type(af))))
+                                return -EAFNOSUPPORT;
+
+                        if (!af_ops->set_link_af)
+                                return -EOPNOTSUPP;
+
+                        if (af_ops->validate_link_af) {
+                                err = af_ops->validate_link_af(dev,
+                                                        tb[IFLA_AF_SPEC]);
+                                if (err < 0)
+                                        return err;
+                        }
+                }
+        }
+
         return 0;
 }
 
@@ -1225,6 +1369,24 @@ static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm,
                         goto errout;
                 modified = 1;
         }
+
+        if (tb[IFLA_AF_SPEC]) {
+                struct nlattr *af;
+                int rem;
+
+                nla_for_each_nested(af, tb[IFLA_AF_SPEC], rem) {
+                        const struct rtnl_af_ops *af_ops;
+
+                        if (!(af_ops = rtnl_af_lookup(nla_type(af))))
+                                BUG();
+
+                        err = af_ops->set_link_af(dev, af);
+                        if (err < 0)
+                                goto errout;
+
+                        modified = 1;
+                }
+        }
         err = 0;
 
 errout:
diff --git a/net/core/scm.c b/net/core/scm.c
index 413cab89017..bbe45445080 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -79,10 +79,11 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp)
                         return -ENOMEM;
                 *fplp = fpl;
                 fpl->count = 0;
+                fpl->max = SCM_MAX_FD;
         }
         fpp = &fpl->fp[fpl->count];
 
-        if (fpl->count + num > SCM_MAX_FD)
+        if (fpl->count + num > fpl->max)
                 return -EINVAL;
 
         /*
@@ -331,11 +332,12 @@ struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl)
         if (!fpl)
                 return NULL;
 
-        new_fpl = kmalloc(sizeof(*fpl), GFP_KERNEL);
+        new_fpl = kmemdup(fpl, offsetof(struct scm_fp_list, fp[fpl->count]),
+                          GFP_KERNEL);
         if (new_fpl) {
-                for (i=fpl->count-1; i>=0; i--)
+                for (i = 0; i < fpl->count; i++)
                         get_file(fpl->fp[i]);
-                memcpy(new_fpl, fpl, sizeof(*fpl));
+                new_fpl->max = new_fpl->count;
         }
         return new_fpl;
 }
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 104f8444754..8814a9a52f4 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -778,6 +778,28 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
 
         size = SKB_DATA_ALIGN(size);
 
+        /* Check if we can avoid taking references on fragments if we own
+         * the last reference on skb->head. (see skb_release_data())
+         */
+        if (!skb->cloned)
+                fastpath = true;
+        else {
+                int delta = skb->nohdr ? (1 << SKB_DATAREF_SHIFT) + 1 : 1;
+
+                fastpath = atomic_read(&skb_shinfo(skb)->dataref) == delta;
+        }
+
+        if (fastpath &&
+            size + sizeof(struct skb_shared_info) <= ksize(skb->head)) {
+                memmove(skb->head + size, skb_shinfo(skb),
+                        offsetof(struct skb_shared_info,
+                                 frags[skb_shinfo(skb)->nr_frags]));
+                memmove(skb->head + nhead, skb->head,
+                        skb_tail_pointer(skb) - skb->head);
+                off = nhead;
+                goto adjust_others;
+        }
+
         data = kmalloc(size + sizeof(struct skb_shared_info), gfp_mask);
         if (!data)
                 goto nodata;
@@ -791,17 +813,6 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
                skb_shinfo(skb),
                offsetof(struct skb_shared_info, frags[skb_shinfo(skb)->nr_frags]));
 
-        /* Check if we can avoid taking references on fragments if we own
-         * the last reference on skb->head. (see skb_release_data())
-         */
-        if (!skb->cloned)
-                fastpath = true;
-        else {
-                int delta = skb->nohdr ? (1 << SKB_DATAREF_SHIFT) + 1 : 1;
-
-                fastpath = atomic_read(&skb_shinfo(skb)->dataref) == delta;
-        }
-
         if (fastpath) {
                 kfree(skb->head);
         } else {
@@ -816,6 +827,7 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
         off = (data + nhead) - skb->head;
 
         skb->head     = data;
+adjust_others:
         skb->data    += off;
 #ifdef NET_SKBUFF_DATA_USES_OFFSET
         skb->end      = size;
diff --git a/net/core/timestamping.c b/net/core/timestamping.c
index 0ae6c22da85..b124d28ff1c 100644
--- a/net/core/timestamping.c
+++ b/net/core/timestamping.c
@@ -26,12 +26,12 @@ static struct sock_filter ptp_filter[] = {
         PTP_FILTER
 };
 
-static unsigned int classify(struct sk_buff *skb)
+static unsigned int classify(const struct sk_buff *skb)
 {
         if (likely(skb->dev &&
                    skb->dev->phydev &&
                    skb->dev->phydev->drv))
-                return sk_run_filter(skb, ptp_filter, ARRAY_SIZE(ptp_filter));
+                return sk_run_filter(skb, ptp_filter);
         else
                 return PTP_CLASS_NONE;
 }
diff --git a/net/dccp/Makefile b/net/dccp/Makefile
index 2991efcc8de..5c8362b037e 100644
--- a/net/dccp/Makefile
+++ b/net/dccp/Makefile
@@ -1,7 +1,7 @@
 obj-$(CONFIG_IP_DCCP) += dccp.o dccp_ipv4.o
 
-dccp-y := ccid.o feat.o input.o minisocks.o options.o output.o proto.o timer.o
-
+dccp-y := ccid.o feat.o input.o minisocks.o options.o output.o proto.o timer.o \
+          qpolicy.o
 #
 # CCID algorithms to be used by dccp.ko
 #
diff --git a/net/dccp/ackvec.c b/net/dccp/ackvec.c
index 92a6fcb40d7..25b7a8d1ad5 100644
--- a/net/dccp/ackvec.c
+++ b/net/dccp/ackvec.c
@@ -1,444 +1,375 @@
 /*
  *  net/dccp/ackvec.c
  *
- *  An implementation of the DCCP protocol
+ *  An implementation of Ack Vectors for the DCCP protocol
+ *  Copyright (c) 2007 University of Aberdeen, Scotland, UK
  *  Copyright (c) 2005 Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
  *
  *      This program is free software; you can redistribute it and/or modify it
  *      under the terms of the GNU General Public License as published by the
  *      Free Software Foundation; version 2 of the License;
  */
-
-#include "ackvec.h"
 #include "dccp.h"
-
-#include <linux/init.h>
-#include <linux/errno.h>
 #include <linux/kernel.h>
-#include <linux/skbuff.h>
 #include <linux/slab.h>
 
-#include <net/sock.h>
-
 static struct kmem_cache *dccp_ackvec_slab;
 static struct kmem_cache *dccp_ackvec_record_slab;
 
-static struct dccp_ackvec_record *dccp_ackvec_record_new(void)
+struct dccp_ackvec *dccp_ackvec_alloc(const gfp_t priority)
 {
-        struct dccp_ackvec_record *avr =
-                        kmem_cache_alloc(dccp_ackvec_record_slab, GFP_ATOMIC);
+        struct dccp_ackvec *av = kmem_cache_zalloc(dccp_ackvec_slab, priority);
 
-        if (avr != NULL)
-                INIT_LIST_HEAD(&avr->avr_node);
-
-        return avr;
+        if (av != NULL) {
+                av->av_buf_head = av->av_buf_tail = DCCPAV_MAX_ACKVEC_LEN - 1;
+                INIT_LIST_HEAD(&av->av_records);
+        }
+        return av;
 }
 
-static void dccp_ackvec_record_delete(struct dccp_ackvec_record *avr)
+static void dccp_ackvec_purge_records(struct dccp_ackvec *av)
 {
-        if (unlikely(avr == NULL))
-                return;
-        /* Check if deleting a linked record */
-        WARN_ON(!list_empty(&avr->avr_node));
-        kmem_cache_free(dccp_ackvec_record_slab, avr);
+        struct dccp_ackvec_record *cur, *next;
+
+        list_for_each_entry_safe(cur, next, &av->av_records, avr_node)
+                kmem_cache_free(dccp_ackvec_record_slab, cur);
+        INIT_LIST_HEAD(&av->av_records);
 }
 
-static void dccp_ackvec_insert_avr(struct dccp_ackvec *av,
-                                   struct dccp_ackvec_record *avr)
+void dccp_ackvec_free(struct dccp_ackvec *av)
 {
-        /*
-         * AVRs are sorted by seqno. Since we are sending them in order, we
-         * just add the AVR at the head of the list.
-         * -sorbo.
-         */
-        if (!list_empty(&av->av_records)) {
-                const struct dccp_ackvec_record *head =
-                                        list_entry(av->av_records.next,
-                                                   struct dccp_ackvec_record,
-                                                   avr_node);
-                BUG_ON(before48(avr->avr_ack_seqno, head->avr_ack_seqno));
+        if (likely(av != NULL)) {
+                dccp_ackvec_purge_records(av);
+                kmem_cache_free(dccp_ackvec_slab, av);
         }
-
-        list_add(&avr->avr_node, &av->av_records);
 }
 
-int dccp_insert_option_ackvec(struct sock *sk, struct sk_buff *skb)
+/**
+ * dccp_ackvec_update_records  -  Record information about sent Ack Vectors
+ * @av:         Ack Vector records to update
+ * @seqno:      Sequence number of the packet carrying the Ack Vector just sent
+ * @nonce_sum:  The sum of all buffer nonces contained in the Ack Vector
+ */
+int dccp_ackvec_update_records(struct dccp_ackvec *av, u64 seqno, u8 nonce_sum)
 {
-        struct dccp_sock *dp = dccp_sk(sk);
-        struct dccp_ackvec *av = dp->dccps_hc_rx_ackvec;
-        /* Figure out how many options do we need to represent the ackvec */
-        const u8 nr_opts = DIV_ROUND_UP(av->av_vec_len, DCCP_SINGLE_OPT_MAXLEN);
-        u16 len = av->av_vec_len + 2 * nr_opts, i;
-        u32 elapsed_time;
-        const unsigned char *tail, *from;
-        unsigned char *to;
         struct dccp_ackvec_record *avr;
-        suseconds_t delta;
-
-        if (DCCP_SKB_CB(skb)->dccpd_opt_len + len > DCCP_MAX_OPT_LEN)
-                return -1;
-
-        delta = ktime_us_delta(ktime_get_real(), av->av_time);
-        elapsed_time = delta / 10;
 
-        if (elapsed_time != 0 &&
-            dccp_insert_option_elapsed_time(skb, elapsed_time))
-                return -1;
-
-        avr = dccp_ackvec_record_new();
+        avr = kmem_cache_alloc(dccp_ackvec_record_slab, GFP_ATOMIC);
         if (avr == NULL)
-                return -1;
-
-        DCCP_SKB_CB(skb)->dccpd_opt_len += len;
-
-        to   = skb_push(skb, len);
-        len  = av->av_vec_len;
-        from = av->av_buf + av->av_buf_head;
-        tail = av->av_buf + DCCP_MAX_ACKVEC_LEN;
-
-        for (i = 0; i < nr_opts; ++i) {
-                int copylen = len;
-
-                if (len > DCCP_SINGLE_OPT_MAXLEN)
-                        copylen = DCCP_SINGLE_OPT_MAXLEN;
-
-                *to++ = DCCPO_ACK_VECTOR_0;
-                *to++ = copylen + 2;
-
-                /* Check if buf_head wraps */
-                if (from + copylen > tail) {
-                        const u16 tailsize = tail - from;
-
-                        memcpy(to, from, tailsize);
-                        to      += tailsize;
-                        len     -= tailsize;
-                        copylen -= tailsize;
-                        from    = av->av_buf;
-                }
-
-                memcpy(to, from, copylen);
-                from += copylen;
-                to   += copylen;
-                len  -= copylen;
-        }
+                return -ENOBUFS;
 
+        avr->avr_ack_seqno  = seqno;
+        avr->avr_ack_ptr    = av->av_buf_head;
+        avr->avr_ack_ackno  = av->av_buf_ackno;
+        avr->avr_ack_nonce  = nonce_sum;
+        avr->avr_ack_runlen = dccp_ackvec_runlen(av->av_buf + av->av_buf_head);
         /*
-         *      From RFC 4340, A.2:
-         *
-         *      For each acknowledgement it sends, the HC-Receiver will add an
-         *      acknowledgement record.  ack_seqno will equal the HC-Receiver
-         *      sequence number it used for the ack packet; ack_ptr will equal
-         *      buf_head; ack_ackno will equal buf_ackno; and ack_nonce will
-         *      equal buf_nonce.
+         * When the buffer overflows, we keep no more than one record. This is
+         * the simplest way of disambiguating sender-Acks dating from before the
+         * overflow from sender-Acks which refer to after the overflow; a simple
+         * solution is preferable here since we are handling an exception.
          */
-        avr->avr_ack_seqno = DCCP_SKB_CB(skb)->dccpd_seq;
-        avr->avr_ack_ptr   = av->av_buf_head;
-        avr->avr_ack_ackno = av->av_buf_ackno;
-        avr->avr_ack_nonce = av->av_buf_nonce;
-        avr->avr_sent_len  = av->av_vec_len;
-
-        dccp_ackvec_insert_avr(av, avr);
+        if (av->av_overflow)
+                dccp_ackvec_purge_records(av);
+        /*
+         * Since GSS is incremented for each packet, the list is automatically
+         * arranged in descending order of @ack_seqno.
+         */
+        list_add(&avr->avr_node, &av->av_records);
 
-        dccp_pr_debug("%s ACK Vector 0, len=%d, ack_seqno=%llu, "
-                      "ack_ackno=%llu\n",
-                      dccp_role(sk), avr->avr_sent_len,
+        dccp_pr_debug("Added Vector, ack_seqno=%llu, ack_ackno=%llu (rl=%u)\n",
                       (unsigned long long)avr->avr_ack_seqno,
-                      (unsigned long long)avr->avr_ack_ackno);
+                      (unsigned long long)avr->avr_ack_ackno,
+                      avr->avr_ack_runlen);
         return 0;
 }
 
-struct dccp_ackvec *dccp_ackvec_alloc(const gfp_t priority)
+static struct dccp_ackvec_record *dccp_ackvec_lookup(struct list_head *av_list,
+                                                     const u64 ackno)
 {
-        struct dccp_ackvec *av = kmem_cache_alloc(dccp_ackvec_slab, priority);
-
-        if (av != NULL) {
-                av->av_buf_head  = DCCP_MAX_ACKVEC_LEN - 1;
-                av->av_buf_ackno = UINT48_MAX + 1;
-                av->av_buf_nonce = 0;
-                av->av_time      = ktime_set(0, 0);
-                av->av_vec_len   = 0;
-                INIT_LIST_HEAD(&av->av_records);
+        struct dccp_ackvec_record *avr;
+        /*
+         * Exploit that records are inserted in descending order of sequence
+         * number, start with the oldest record first. If @ackno is `before'
+         * the earliest ack_ackno, the packet is too old to be considered.
+         */
+        list_for_each_entry_reverse(avr, av_list, avr_node) {
+                if (avr->avr_ack_seqno == ackno)
+                        return avr;
+                if (before48(ackno, avr->avr_ack_seqno))
+                        break;
         }
-
-        return av;
+        return NULL;
 }
 
-void dccp_ackvec_free(struct dccp_ackvec *av)
+/*
+ * Buffer index and length computation using modulo-buffersize arithmetic.
+ * Note that, as pointers move from right to left, head is `before' tail.
+ */
+static inline u16 __ackvec_idx_add(const u16 a, const u16 b)
 {
-        if (unlikely(av == NULL))
-                return;
-
-        if (!list_empty(&av->av_records)) {
-                struct dccp_ackvec_record *avr, *next;
-
-                list_for_each_entry_safe(avr, next, &av->av_records, avr_node) {
-                        list_del_init(&avr->avr_node);
-                        dccp_ackvec_record_delete(avr);
-                }
-        }
-
-        kmem_cache_free(dccp_ackvec_slab, av);
+        return (a + b) % DCCPAV_MAX_ACKVEC_LEN;
 }
 
-static inline u8 dccp_ackvec_state(const struct dccp_ackvec *av,
-                                   const u32 index)
+static inline u16 __ackvec_idx_sub(const u16 a, const u16 b)
 {
-        return av->av_buf[index] & DCCP_ACKVEC_STATE_MASK;
+        return __ackvec_idx_add(a, DCCPAV_MAX_ACKVEC_LEN - b);
 }
 
-static inline u8 dccp_ackvec_len(const struct dccp_ackvec *av,
-                                 const u32 index)
+u16 dccp_ackvec_buflen(const struct dccp_ackvec *av)
 {
-        return av->av_buf[index] & DCCP_ACKVEC_LEN_MASK;
+        if (unlikely(av->av_overflow))
+                return DCCPAV_MAX_ACKVEC_LEN;
+        return __ackvec_idx_sub(av->av_buf_tail, av->av_buf_head);
 }
 
-/*
- * If several packets are missing, the HC-Receiver may prefer to enter multiple
- * bytes with run length 0, rather than a single byte with a larger run length;
- * this simplifies table updates if one of the missing packets arrives.
+/**
+ * dccp_ackvec_update_old  -  Update previous state as per RFC 4340, 11.4.1
+ * @av:         non-empty buffer to update
+ * @distance:   negative or zero distance of @seqno from buf_ackno downward
+ * @seqno:      the (old) sequence number whose record is to be updated
+ * @state:      state in which packet carrying @seqno was received
  */
-static inline int dccp_ackvec_set_buf_head_state(struct dccp_ackvec *av,
-                                                 const unsigned int packets,
-                                                 const unsigned char state)
+static void dccp_ackvec_update_old(struct dccp_ackvec *av, s64 distance,
+                                   u64 seqno, enum dccp_ackvec_states state)
 {
-        long gap;
-        long new_head;
+        u16 ptr = av->av_buf_head;
 
-        if (av->av_vec_len + packets > DCCP_MAX_ACKVEC_LEN)
-                return -ENOBUFS;
+        BUG_ON(distance > 0);
+        if (unlikely(dccp_ackvec_is_empty(av)))
+                return;
 
-        gap      = packets - 1;
-        new_head = av->av_buf_head - packets;
+        do {
+                u8 runlen = dccp_ackvec_runlen(av->av_buf + ptr);
 
-        if (new_head < 0) {
-                if (gap > 0) {
-                        memset(av->av_buf, DCCP_ACKVEC_STATE_NOT_RECEIVED,
-                               gap + new_head + 1);
-                        gap = -new_head;
+                if (distance + runlen >= 0) {
+                        /*
+                         * Only update the state if packet has not been received
+                         * yet. This is OK as per the second table in RFC 4340,
+                         * 11.4.1; i.e. here we are using the following table:
+                         *                     RECEIVED
+                         *                      0   1   3
+                         *              S     +---+---+---+
+                         *              T   0 | 0 | 0 | 0 |
+                         *              O     +---+---+---+
+                         *              R   1 | 1 | 1 | 1 |
+                         *              E     +---+---+---+
+                         *              D   3 | 0 | 1 | 3 |
+                         *                    +---+---+---+
+                         * The "Not Received" state was set by reserve_seats().
+                         */
+                        if (av->av_buf[ptr] == DCCPAV_NOT_RECEIVED)
+                                av->av_buf[ptr] = state;
+                        else
+                                dccp_pr_debug("Not changing %llu state to %u\n",
+                                              (unsigned long long)seqno, state);
+                        break;
                 }
-                new_head += DCCP_MAX_ACKVEC_LEN;
-        }
 
-        av->av_buf_head = new_head;
+                distance += runlen + 1;
+                ptr       = __ackvec_idx_add(ptr, 1);
 
-        if (gap > 0)
-                memset(av->av_buf + av->av_buf_head + 1,
-                       DCCP_ACKVEC_STATE_NOT_RECEIVED, gap);
+        } while (ptr != av->av_buf_tail);
+}
 
-        av->av_buf[av->av_buf_head] = state;
-        av->av_vec_len += packets;
-        return 0;
+/* Mark @num entries after buf_head as "Not yet received". */
+static void dccp_ackvec_reserve_seats(struct dccp_ackvec *av, u16 num)
+{
+        u16 start = __ackvec_idx_add(av->av_buf_head, 1),
+            len   = DCCPAV_MAX_ACKVEC_LEN - start;
+
+        /* check for buffer wrap-around */
+        if (num > len) {
+                memset(av->av_buf + start, DCCPAV_NOT_RECEIVED, len);
+                start = 0;
+                num  -= len;
+        }
+        if (num)
+                memset(av->av_buf + start, DCCPAV_NOT_RECEIVED, num);
 }
 
-/*
- * Implements the RFC 4340, Appendix A
+/**
+ * dccp_ackvec_add_new  -  Record one or more new entries in Ack Vector buffer
+ * @av:          container of buffer to update (can be empty or non-empty)
+ * @num_packets: number of packets to register (must be >= 1)
+ * @seqno:       sequence number of the first packet in @num_packets
+ * @state:       state in which packet carrying @seqno was received
  */
-int dccp_ackvec_add(struct dccp_ackvec *av, const struct sock *sk,
-                    const u64 ackno, const u8 state)
+static void dccp_ackvec_add_new(struct dccp_ackvec *av, u32 num_packets,
+                                u64 seqno, enum dccp_ackvec_states state)
 {
-        /*
-         * Check at the right places if the buffer is full, if it is, tell the
-         * caller to start dropping packets till the HC-Sender acks our ACK
-         * vectors, when we will free up space in av_buf.
-         *
-         * We may well decide to do buffer compression, etc, but for now lets
-         * just drop.
-         *
-         * From Appendix A.1.1 (`New Packets'):
-         *
-         *      Of course, the circular buffer may overflow, either when the
-         *      HC-Sender is sending data at a very high rate, when the
-         *      HC-Receiver's acknowledgements are not reaching the HC-Sender,
-         *      or when the HC-Sender is forgetting to acknowledge those acks
-         *      (so the HC-Receiver is unable to clean up old state). In this
-         *      case, the HC-Receiver should either compress the buffer (by
-         *      increasing run lengths when possible), transfer its state to
-         *      a larger buffer, or, as a last resort, drop all received
-         *      packets, without processing them whatsoever, until its buffer
-         *      shrinks again.
-         */
+        u32 num_cells = num_packets;
 
-        /* See if this is the first ackno being inserted */
-        if (av->av_vec_len == 0) {
-                av->av_buf[av->av_buf_head] = state;
-                av->av_vec_len = 1;
-        } else if (after48(ackno, av->av_buf_ackno)) {
-                const u64 delta = dccp_delta_seqno(av->av_buf_ackno, ackno);
+        if (num_packets > DCCPAV_BURST_THRESH) {
+                u32 lost_packets = num_packets - 1;
 
+                DCCP_WARN("Warning: large burst loss (%u)\n", lost_packets);
                 /*
-                 * Look if the state of this packet is the same as the
-                 * previous ackno and if so if we can bump the head len.
+                 * We received 1 packet and have a loss of size "num_packets-1"
+                 * which we squeeze into num_cells-1 rather than reserving an
+                 * entire byte for each lost packet.
+                 * The reason is that the vector grows in O(burst_length); when
+                 * it grows too large there will no room left for the payload.
+                 * This is a trade-off: if a few packets out of the burst show
+                 * up later, their state will not be changed; it is simply too
+                 * costly to reshuffle/reallocate/copy the buffer each time.
+                 * Should such problems persist, we will need to switch to a
+                 * different underlying data structure.
                  */
-                if (delta == 1 &&
-                    dccp_ackvec_state(av, av->av_buf_head) == state &&
-                    dccp_ackvec_len(av, av->av_buf_head) < DCCP_ACKVEC_LEN_MASK)
-                        av->av_buf[av->av_buf_head]++;
-                else if (dccp_ackvec_set_buf_head_state(av, delta, state))
-                        return -ENOBUFS;
-        } else {
-                /*
-                 * A.1.2.  Old Packets
-                 *
-                 *      When a packet with Sequence Number S <= buf_ackno
-                 *      arrives, the HC-Receiver will scan the table for
-                 *      the byte corresponding to S. (Indexing structures
-                 *      could reduce the complexity of this scan.)
-                 */
-                u64 delta = dccp_delta_seqno(ackno, av->av_buf_ackno);
-                u32 index = av->av_buf_head;
+                for (num_packets = num_cells = 1; lost_packets; ++num_cells) {
+                        u8 len = min(lost_packets, (u32)DCCPAV_MAX_RUNLEN);
 
-                while (1) {
-                        const u8 len = dccp_ackvec_len(av, index);
-                        const u8 av_state = dccp_ackvec_state(av, index);
-                        /*
-                         * valid packets not yet in av_buf have a reserved
-                         * entry, with a len equal to 0.
-                         */
-                        if (av_state == DCCP_ACKVEC_STATE_NOT_RECEIVED &&
-                            len == 0 && delta == 0) { /* Found our
-                                                         reserved seat! */
-                                dccp_pr_debug("Found %llu reserved seat!\n",
-                                              (unsigned long long)ackno);
-                                av->av_buf[index] = state;
-                                goto out;
-                        }
-                        /* len == 0 means one packet */
-                        if (delta < len + 1)
-                                goto out_duplicate;
-
-                        delta -= len + 1;
-                        if (++index == DCCP_MAX_ACKVEC_LEN)
-                                index = 0;
+                        av->av_buf_head = __ackvec_idx_sub(av->av_buf_head, 1);
+                        av->av_buf[av->av_buf_head] = DCCPAV_NOT_RECEIVED | len;
+
+                        lost_packets -= len;
                 }
         }
 
-        av->av_buf_ackno = ackno;
-        av->av_time = ktime_get_real();
-out:
-        return 0;
+        if (num_cells + dccp_ackvec_buflen(av) >= DCCPAV_MAX_ACKVEC_LEN) {
+                DCCP_CRIT("Ack Vector buffer overflow: dropping old entries\n");
+                av->av_overflow = true;
+        }
+
+        av->av_buf_head = __ackvec_idx_sub(av->av_buf_head, num_packets);
+        if (av->av_overflow)
+                av->av_buf_tail = av->av_buf_head;
 
-out_duplicate:
-        /* Duplicate packet */
-        dccp_pr_debug("Received a dup or already considered lost "
-                      "packet: %llu\n", (unsigned long long)ackno);
-        return -EILSEQ;
+        av->av_buf[av->av_buf_head] = state;
+        av->av_buf_ackno            = seqno;
+
+        if (num_packets > 1)
+                dccp_ackvec_reserve_seats(av, num_packets - 1);
 }
 
-static void dccp_ackvec_throw_record(struct dccp_ackvec *av,
-                                     struct dccp_ackvec_record *avr)
+/**
+ * dccp_ackvec_input  -  Register incoming packet in the buffer
+ */
+void dccp_ackvec_input(struct dccp_ackvec *av, struct sk_buff *skb)
 {
-        struct dccp_ackvec_record *next;
+        u64 seqno = DCCP_SKB_CB(skb)->dccpd_seq;
+        enum dccp_ackvec_states state = DCCPAV_RECEIVED;
 
-        /* sort out vector length */
-        if (av->av_buf_head <= avr->avr_ack_ptr)
-                av->av_vec_len = avr->avr_ack_ptr - av->av_buf_head;
-        else
-                av->av_vec_len = DCCP_MAX_ACKVEC_LEN - 1 -
-                                 av->av_buf_head + avr->avr_ack_ptr;
+        if (dccp_ackvec_is_empty(av)) {
+                dccp_ackvec_add_new(av, 1, seqno, state);
+                av->av_tail_ackno = seqno;
 
-        /* free records */
-        list_for_each_entry_safe_from(avr, next, &av->av_records, avr_node) {
-                list_del_init(&avr->avr_node);
-                dccp_ackvec_record_delete(avr);
-        }
-}
+        } else {
+                s64 num_packets = dccp_delta_seqno(av->av_buf_ackno, seqno);
+                u8 *current_head = av->av_buf + av->av_buf_head;
 
-void dccp_ackvec_check_rcv_ackno(struct dccp_ackvec *av, struct sock *sk,
-                                 const u64 ackno)
-{
-        struct dccp_ackvec_record *avr;
+                if (num_packets == 1 &&
+                    dccp_ackvec_state(current_head) == state &&
+                    dccp_ackvec_runlen(current_head) < DCCPAV_MAX_RUNLEN) {
 
-        /*
-         * If we traverse backwards, it should be faster when we have large
-         * windows. We will be receiving ACKs for stuff we sent a while back
-         * -sorbo.
-         */
-        list_for_each_entry_reverse(avr, &av->av_records, avr_node) {
-                if (ackno == avr->avr_ack_seqno) {
-                        dccp_pr_debug("%s ACK packet 0, len=%d, ack_seqno=%llu, "
-                                      "ack_ackno=%llu, ACKED!\n",
-                                      dccp_role(sk), 1,
-                                      (unsigned long long)avr->avr_ack_seqno,
-                                      (unsigned long long)avr->avr_ack_ackno);
-                        dccp_ackvec_throw_record(av, avr);
-                        break;
-                } else if (avr->avr_ack_seqno > ackno)
-                        break; /* old news */
+                        *current_head   += 1;
+                        av->av_buf_ackno = seqno;
+
+                } else if (num_packets > 0) {
+                        dccp_ackvec_add_new(av, num_packets, seqno, state);
+                } else {
+                        dccp_ackvec_update_old(av, num_packets, seqno, state);
+                }
         }
 }
 
-static void dccp_ackvec_check_rcv_ackvector(struct dccp_ackvec *av,
-                                            struct sock *sk, u64 *ackno,
-                                            const unsigned char len,
-                                            const unsigned char *vector)
+/**
+ * dccp_ackvec_clear_state  -  Perform house-keeping / garbage-collection
+ * This routine is called when the peer acknowledges the receipt of Ack Vectors
+ * up to and including @ackno. While based on on section A.3 of RFC 4340, here
+ * are additional precautions to prevent corrupted buffer state. In particular,
+ * we use tail_ackno to identify outdated records; it always marks the earliest
+ * packet of group (2) in 11.4.2.
+ */
+void dccp_ackvec_clear_state(struct dccp_ackvec *av, const u64 ackno)
 {
-        unsigned char i;
-        struct dccp_ackvec_record *avr;
+        struct dccp_ackvec_record *avr, *next;
+        u8 runlen_now, eff_runlen;
+        s64 delta;
 
-        /* Check if we actually sent an ACK vector */
-        if (list_empty(&av->av_records))
+        avr = dccp_ackvec_lookup(&av->av_records, ackno);
+        if (avr == NULL)
                 return;
+        /*
+         * Deal with outdated acknowledgments: this arises when e.g. there are
+         * several old records and the acks from the peer come in slowly. In
+         * that case we may still have records that pre-date tail_ackno.
+         */
+        delta = dccp_delta_seqno(av->av_tail_ackno, avr->avr_ack_ackno);
+        if (delta < 0)
+                goto free_records;
+        /*
+         * Deal with overlapping Ack Vectors: don't subtract more than the
+         * number of packets between tail_ackno and ack_ackno.
+         */
+        eff_runlen = delta < avr->avr_ack_runlen ? delta : avr->avr_ack_runlen;
 
-        i = len;
+        runlen_now = dccp_ackvec_runlen(av->av_buf + avr->avr_ack_ptr);
         /*
-         * XXX
-         * I think it might be more efficient to work backwards. See comment on
-         * rcv_ackno. -sorbo.
+         * The run length of Ack Vector cells does not decrease over time. If
+         * the run length is the same as at the time the Ack Vector was sent, we
+         * free the ack_ptr cell. That cell can however not be freed if the run
+         * length has increased: in this case we need to move the tail pointer
+         * backwards (towards higher indices), to its next-oldest neighbour.
          */
-        avr = list_entry(av->av_records.next, struct dccp_ackvec_record, avr_node);
-        while (i--) {
-                const u8 rl = *vector & DCCP_ACKVEC_LEN_MASK;
-                u64 ackno_end_rl;
+        if (runlen_now > eff_runlen) {
 
-                dccp_set_seqno(&ackno_end_rl, *ackno - rl);
+                av->av_buf[avr->avr_ack_ptr] -= eff_runlen + 1;
+                av->av_buf_tail = __ackvec_idx_add(avr->avr_ack_ptr, 1);
 
+                /* This move may not have cleared the overflow flag. */
+                if (av->av_overflow)
+                        av->av_overflow = (av->av_buf_head == av->av_buf_tail);
+        } else {
+                av->av_buf_tail = avr->avr_ack_ptr;
                 /*
-                 * If our AVR sequence number is greater than the ack, go
-                 * forward in the AVR list until it is not so.
+                 * We have made sure that avr points to a valid cell within the
+                 * buffer. This cell is either older than head, or equals head
+                 * (empty buffer): in both cases we no longer have any overflow.
                  */
-                list_for_each_entry_from(avr, &av->av_records, avr_node) {
-                        if (!after48(avr->avr_ack_seqno, *ackno))
-                                goto found;
-                }
-                /* End of the av_records list, not found, exit */
-                break;
-found:
-                if (between48(avr->avr_ack_seqno, ackno_end_rl, *ackno)) {
-                        const u8 state = *vector & DCCP_ACKVEC_STATE_MASK;
-                        if (state != DCCP_ACKVEC_STATE_NOT_RECEIVED) {
-                                dccp_pr_debug("%s ACK vector 0, len=%d, "
-                                              "ack_seqno=%llu, ack_ackno=%llu, "
-                                              "ACKED!\n",
-                                              dccp_role(sk), len,
-                                              (unsigned long long)
-                                              avr->avr_ack_seqno,
-                                              (unsigned long long)
-                                              avr->avr_ack_ackno);
-                                dccp_ackvec_throw_record(av, avr);
-                                break;
-                        }
-                        /*
-                         * If it wasn't received, continue scanning... we might
-                         * find another one.
-                         */
-                }
+                av->av_overflow = 0;
+        }
 
-                dccp_set_seqno(ackno, ackno_end_rl - 1);
-                ++vector;
+        /*
+         * The peer has acknowledged up to and including ack_ackno. Hence the
+         * first packet in group (2) of 11.4.2 is the successor of ack_ackno.
+         */
+        av->av_tail_ackno = ADD48(avr->avr_ack_ackno, 1);
+
+free_records:
+        list_for_each_entry_safe_from(avr, next, &av->av_records, avr_node) {
+                list_del(&avr->avr_node);
+                kmem_cache_free(dccp_ackvec_record_slab, avr);
         }
 }
 
-int dccp_ackvec_parse(struct sock *sk, const struct sk_buff *skb,
-                      u64 *ackno, const u8 opt, const u8 *value, const u8 len)
+/*
+ *      Routines to keep track of Ack Vectors received in an skb
+ */
+int dccp_ackvec_parsed_add(struct list_head *head, u8 *vec, u8 len, u8 nonce)
 {
-        if (len > DCCP_SINGLE_OPT_MAXLEN)
-                return -1;
+        struct dccp_ackvec_parsed *new = kmalloc(sizeof(*new), GFP_ATOMIC);
+
+        if (new == NULL)
+                return -ENOBUFS;
+        new->vec   = vec;
+        new->len   = len;
+        new->nonce = nonce;
 
-        /* dccp_ackvector_print(DCCP_SKB_CB(skb)->dccpd_ack_seq, value, len); */
-        dccp_ackvec_check_rcv_ackvector(dccp_sk(sk)->dccps_hc_rx_ackvec, sk,
-                                        ackno, len, value);
+        list_add_tail(&new->node, head);
         return 0;
 }
+EXPORT_SYMBOL_GPL(dccp_ackvec_parsed_add);
+
+void dccp_ackvec_parsed_cleanup(struct list_head *parsed_chunks)
+{
+        struct dccp_ackvec_parsed *cur, *next;
+
+        list_for_each_entry_safe(cur, next, parsed_chunks, node)
+                kfree(cur);
+        INIT_LIST_HEAD(parsed_chunks);
+}
+EXPORT_SYMBOL_GPL(dccp_ackvec_parsed_cleanup);
 
 int __init dccp_ackvec_init(void)
 {
@@ -448,10 +379,9 @@ int __init dccp_ackvec_init(void)
         if (dccp_ackvec_slab == NULL)
                 goto out_err;
 
-        dccp_ackvec_record_slab =
-                        kmem_cache_create("dccp_ackvec_record",
-                                          sizeof(struct dccp_ackvec_record),
-                                          0, SLAB_HWCACHE_ALIGN, NULL);
+        dccp_ackvec_record_slab = kmem_cache_create("dccp_ackvec_record",
+                                             sizeof(struct dccp_ackvec_record),
+                                             0, SLAB_HWCACHE_ALIGN, NULL);
         if (dccp_ackvec_record_slab == NULL)
                 goto out_destroy_slab;
 
diff --git a/net/dccp/ackvec.h b/net/dccp/ackvec.h
index 7ea557b7c6b..e2ab0627a5f 100644
--- a/net/dccp/ackvec.h
+++ b/net/dccp/ackvec.h
@@ -3,9 +3,9 @@
 /*
  *  net/dccp/ackvec.h
  *
- *  An implementation of the DCCP protocol
+ *  An implementation of Ack Vectors for the DCCP protocol
+ *  Copyright (c) 2007 University of Aberdeen, Scotland, UK
  *  Copyright (c) 2005 Arnaldo Carvalho de Melo <acme@mandriva.com>
- *
  *      This program is free software; you can redistribute it and/or modify it
  *      under the terms of the GNU General Public License version 2 as
  *      published by the Free Software Foundation.
@@ -13,99 +13,124 @@
 
 #include <linux/dccp.h>
 #include <linux/compiler.h>
-#include <linux/ktime.h>
 #include <linux/list.h>
 #include <linux/types.h>
 
-/* We can spread an ack vector across multiple options */
-#define DCCP_MAX_ACKVEC_LEN (DCCP_SINGLE_OPT_MAXLEN * 2)
+/*
+ * Ack Vector buffer space is static, in multiples of %DCCP_SINGLE_OPT_MAXLEN,
+ * the maximum size of a single Ack Vector. Setting %DCCPAV_NUM_ACKVECS to 1
+ * will be sufficient for most cases of low Ack Ratios, using a value of 2 gives
+ * more headroom if Ack Ratio is higher or when the sender acknowledges slowly.
+ * The maximum value is bounded by the u16 types for indices and functions.
+ */
+#define DCCPAV_NUM_ACKVECS      2
+#define DCCPAV_MAX_ACKVEC_LEN   (DCCP_SINGLE_OPT_MAXLEN * DCCPAV_NUM_ACKVECS)
 
 /* Estimated minimum average Ack Vector length - used for updating MPS */
 #define DCCPAV_MIN_OPTLEN       16
 
-#define DCCP_ACKVEC_STATE_RECEIVED      0
-#define DCCP_ACKVEC_STATE_ECN_MARKED    (1 << 6)
-#define DCCP_ACKVEC_STATE_NOT_RECEIVED  (3 << 6)
+/* Threshold for coping with large bursts of losses */
+#define DCCPAV_BURST_THRESH     (DCCPAV_MAX_ACKVEC_LEN / 8)
 
-#define DCCP_ACKVEC_STATE_MASK          0xC0 /* 11000000 */
-#define DCCP_ACKVEC_LEN_MASK            0x3F /* 00111111 */
+enum dccp_ackvec_states {
+        DCCPAV_RECEIVED =       0x00,
+        DCCPAV_ECN_MARKED =     0x40,
+        DCCPAV_RESERVED =       0x80,
+        DCCPAV_NOT_RECEIVED =   0xC0
+};
+#define DCCPAV_MAX_RUNLEN       0x3F
 
-/** struct dccp_ackvec - ack vector
- *
- * This data structure is the one defined in RFC 4340, Appendix A.
- *
- * @av_buf_head - circular buffer head
- * @av_buf_tail - circular buffer tail
- * @av_buf_ackno - ack # of the most recent packet acknowledgeable in the
- *                     buffer (i.e. %av_buf_head)
- * @av_buf_nonce - the one-bit sum of the ECN Nonces on all packets acked
- *                     by the buffer with State 0
- *
- * Additionally, the HC-Receiver must keep some information about the
- * Ack Vectors it has recently sent. For each packet sent carrying an
- * Ack Vector, it remembers four variables:
+static inline u8 dccp_ackvec_runlen(const u8 *cell)
+{
+        return *cell & DCCPAV_MAX_RUNLEN;
+}
+
+static inline u8 dccp_ackvec_state(const u8 *cell)
+{
+        return *cell & ~DCCPAV_MAX_RUNLEN;
+}
+
+/** struct dccp_ackvec - Ack Vector main data structure
  *
- * @av_records - list of dccp_ackvec_record
- * @av_ack_nonce - the one-bit sum of the ECN Nonces for all State 0.
+ * This implements a fixed-size circular buffer within an array and is largely
+ * based on Appendix A of RFC 4340.
  *
- * @av_time - the time in usecs
- * @av_buf - circular buffer of acknowledgeable packets
+ * @av_buf:        circular buffer storage area
+ * @av_buf_head:   head index; begin of live portion in @av_buf
+ * @av_buf_tail:   tail index; first index _after_ the live portion in @av_buf
+ * @av_buf_ackno:  highest seqno of acknowledgeable packet recorded in @av_buf
+ * @av_tail_ackno: lowest  seqno of acknowledgeable packet recorded in @av_buf
+ * @av_buf_nonce:  ECN nonce sums, each covering subsequent segments of up to
+ *                 %DCCP_SINGLE_OPT_MAXLEN cells in the live portion of @av_buf
+ * @av_overflow:   if 1 then buf_head == buf_tail indicates buffer wraparound
+ * @av_records:    list of %dccp_ackvec_record (Ack Vectors sent previously)
  */
 struct dccp_ackvec {
-        u64                     av_buf_ackno;
-        struct list_head        av_records;
-        ktime_t                 av_time;
+        u8                      av_buf[DCCPAV_MAX_ACKVEC_LEN];
         u16                     av_buf_head;
-        u16                     av_vec_len;
-        u8                      av_buf_nonce;
-        u8                      av_ack_nonce;
-        u8                      av_buf[DCCP_MAX_ACKVEC_LEN];
+        u16                     av_buf_tail;
+        u64                     av_buf_ackno:48;
+        u64                     av_tail_ackno:48;
+        bool                    av_buf_nonce[DCCPAV_NUM_ACKVECS];
+        u8                      av_overflow:1;
+        struct list_head        av_records;
 };
 
-/** struct dccp_ackvec_record - ack vector record
+/** struct dccp_ackvec_record - Records information about sent Ack Vectors
  *
- * ACK vector record as defined in Appendix A of spec.
+ * These list entries define the additional information which the HC-Receiver
+ * keeps about recently-sent Ack Vectors; again refer to RFC 4340, Appendix A.
  *
- * The list is sorted by avr_ack_seqno
+ * @avr_node:       the list node in @av_records
+ * @avr_ack_seqno:  sequence number of the packet the Ack Vector was sent on
+ * @avr_ack_ackno:  the Ack number that this record/Ack Vector refers to
+ * @avr_ack_ptr:    pointer into @av_buf where this record starts
+ * @avr_ack_runlen: run length of @avr_ack_ptr at the time of sending
+ * @avr_ack_nonce:  the sum of @av_buf_nonce's at the time this record was sent
  *
- * @avr_node - node in av_records
- * @avr_ack_seqno - sequence number of the packet this record was sent on
- * @avr_ack_ackno - sequence number being acknowledged
- * @avr_ack_ptr - pointer into av_buf where this record starts
- * @avr_ack_nonce - av_ack_nonce at the time this record was sent
- * @avr_sent_len - lenght of the record in av_buf
+ * The list as a whole is sorted in descending order by @avr_ack_seqno.
  */
 struct dccp_ackvec_record {
         struct list_head avr_node;
-        u64              avr_ack_seqno;
-        u64              avr_ack_ackno;
+        u64              avr_ack_seqno:48;
+        u64              avr_ack_ackno:48;
         u16              avr_ack_ptr;
-        u16              avr_sent_len;
-        u8               avr_ack_nonce;
+        u8               avr_ack_runlen;
+        u8               avr_ack_nonce:1;
 };
 
-struct sock;
-struct sk_buff;
-
 extern int dccp_ackvec_init(void);
 extern void dccp_ackvec_exit(void);
 
 extern struct dccp_ackvec *dccp_ackvec_alloc(const gfp_t priority);
 extern void dccp_ackvec_free(struct dccp_ackvec *av);
 
-extern int dccp_ackvec_add(struct dccp_ackvec *av, const struct sock *sk,
-                           const u64 ackno, const u8 state);
-
-extern void dccp_ackvec_check_rcv_ackno(struct dccp_ackvec *av,
-                                        struct sock *sk, const u64 ackno);
-extern int dccp_ackvec_parse(struct sock *sk, const struct sk_buff *skb,
-                             u64 *ackno, const u8 opt,
-                             const u8 *value, const u8 len);
+extern void dccp_ackvec_input(struct dccp_ackvec *av, struct sk_buff *skb);
+extern int  dccp_ackvec_update_records(struct dccp_ackvec *av, u64 seq, u8 sum);
+extern void dccp_ackvec_clear_state(struct dccp_ackvec *av, const u64 ackno);
+extern u16  dccp_ackvec_buflen(const struct dccp_ackvec *av);
 
-extern int dccp_insert_option_ackvec(struct sock *sk, struct sk_buff *skb);
-
-static inline int dccp_ackvec_pending(const struct dccp_ackvec *av)
+static inline bool dccp_ackvec_is_empty(const struct dccp_ackvec *av)
 {
-        return av->av_vec_len;
+        return av->av_overflow == 0 && av->av_buf_head == av->av_buf_tail;
 }
+
+/**
+ * struct dccp_ackvec_parsed  -  Record offsets of Ack Vectors in skb
+ * @vec:        start of vector (offset into skb)
+ * @len:        length of @vec
+ * @nonce:      whether @vec had an ECN nonce of 0 or 1
+ * @node:       FIFO - arranged in descending order of ack_ackno
+ * This structure is used by CCIDs to access Ack Vectors in a received skb.
+ */
+struct dccp_ackvec_parsed {
+        u8               *vec,
+                         len,
+                         nonce:1;
+        struct list_head node;
+};
+
+extern int dccp_ackvec_parsed_add(struct list_head *head,
+                                  u8 *vec, u8 len, u8 nonce);
+extern void dccp_ackvec_parsed_cleanup(struct list_head *parsed_chunks);
 #endif /* _ACKVEC_H */
diff --git a/net/dccp/ccids/ccid2.c b/net/dccp/ccids/ccid2.c
index 6576eae9e77..e96d5e81003 100644
--- a/net/dccp/ccids/ccid2.c
+++ b/net/dccp/ccids/ccid2.c
@@ -246,68 +246,6 @@ static void ccid2_hc_tx_packet_sent(struct sock *sk, unsigned int len)
 #endif
 }
 
-/* XXX Lame code duplication!
- * returns -1 if none was found.
- * else returns the next offset to use in the function call.
- */
-static int ccid2_ackvector(struct sock *sk, struct sk_buff *skb, int offset,
-                           unsigned char **vec, unsigned char *veclen)
-{
-        const struct dccp_hdr *dh = dccp_hdr(skb);
-        unsigned char *options = (unsigned char *)dh + dccp_hdr_len(skb);
-        unsigned char *opt_ptr;
-        const unsigned char *opt_end = (unsigned char *)dh +
-                                        (dh->dccph_doff * 4);
-        unsigned char opt, len;
-        unsigned char *value;
-
-        BUG_ON(offset < 0);
-        options += offset;
-        opt_ptr = options;
-        if (opt_ptr >= opt_end)
-                return -1;
-
-        while (opt_ptr != opt_end) {
-                opt   = *opt_ptr++;
-                len   = 0;
-                value = NULL;
-
-                /* Check if this isn't a single byte option */
-                if (opt > DCCPO_MAX_RESERVED) {
-                        if (opt_ptr == opt_end)
-                                goto out_invalid_option;
-
-                        len = *opt_ptr++;
-                        if (len < 3)
-                                goto out_invalid_option;
-                        /*
-                         * Remove the type and len fields, leaving
-                         * just the value size
-                         */
-                        len     -= 2;
-                        value   = opt_ptr;
-                        opt_ptr += len;
-
-                        if (opt_ptr > opt_end)
-                                goto out_invalid_option;
-                }
-
-                switch (opt) {
-                case DCCPO_ACK_VECTOR_0:
-                case DCCPO_ACK_VECTOR_1:
-                        *vec    = value;
-                        *veclen = len;
-                        return offset + (opt_ptr - options);
-                }
-        }
-
-        return -1;
-
-out_invalid_option:
-        DCCP_BUG("Invalid option - this should not happen (previous parsing)!");
-        return -1;
-}
-
 /**
  * ccid2_rtt_estimator - Sample RTT and compute RTO using RFC2988 algorithm
  * This code is almost identical with TCP's tcp_rtt_estimator(), since
@@ -432,16 +370,28 @@ static void ccid2_congestion_event(struct sock *sk, struct ccid2_seq *seqp)
                 ccid2_change_l_ack_ratio(sk, hc->tx_cwnd);
 }
 
+static int ccid2_hc_tx_parse_options(struct sock *sk, u8 packet_type,
+                                     u8 option, u8 *optval, u8 optlen)
+{
+        struct ccid2_hc_tx_sock *hc = ccid2_hc_tx_sk(sk);
+
+        switch (option) {
+        case DCCPO_ACK_VECTOR_0:
+        case DCCPO_ACK_VECTOR_1:
+                return dccp_ackvec_parsed_add(&hc->tx_av_chunks, optval, optlen,
+                                              option - DCCPO_ACK_VECTOR_0);
+        }
+        return 0;
+}
+
 static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
 {
         struct dccp_sock *dp = dccp_sk(sk);
         struct ccid2_hc_tx_sock *hc = ccid2_hc_tx_sk(sk);
         const bool sender_was_blocked = ccid2_cwnd_network_limited(hc);
+        struct dccp_ackvec_parsed *avp;
         u64 ackno, seqno;
         struct ccid2_seq *seqp;
-        unsigned char *vector;
-        unsigned char veclen;
-        int offset = 0;
         int done = 0;
         unsigned int maxincr = 0;
 
@@ -475,17 +425,12 @@ static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
         }
 
         /* check forward path congestion */
-        /* still didn't send out new data packets */
-        if (hc->tx_seqh == hc->tx_seqt)
+        if (dccp_packet_without_ack(skb))
                 return;
 
-        switch (DCCP_SKB_CB(skb)->dccpd_type) {
-        case DCCP_PKT_ACK:
-        case DCCP_PKT_DATAACK:
-                break;
-        default:
-                return;
-        }
+        /* still didn't send out new data packets */
+        if (hc->tx_seqh == hc->tx_seqt)
+                goto done;
 
         ackno = DCCP_SKB_CB(skb)->dccpd_ack_seq;
         if (after48(ackno, hc->tx_high_ack))
@@ -509,16 +454,16 @@ static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
                 maxincr = DIV_ROUND_UP(dp->dccps_l_ack_ratio, 2);
 
         /* go through all ack vectors */
-        while ((offset = ccid2_ackvector(sk, skb, offset,
-                                         &vector, &veclen)) != -1) {
+        list_for_each_entry(avp, &hc->tx_av_chunks, node) {
                 /* go through this ack vector */
-                while (veclen--) {
-                        const u8 rl = *vector & DCCP_ACKVEC_LEN_MASK;
-                        u64 ackno_end_rl = SUB48(ackno, rl);
+                for (; avp->len--; avp->vec++) {
+                        u64 ackno_end_rl = SUB48(ackno,
+                                                 dccp_ackvec_runlen(avp->vec));
 
-                        ccid2_pr_debug("ackvec start:%llu end:%llu\n",
+                        ccid2_pr_debug("ackvec %llu |%u,%u|\n",
                                        (unsigned long long)ackno,
-                                       (unsigned long long)ackno_end_rl);
+                                       dccp_ackvec_state(avp->vec) >> 6,
+                                       dccp_ackvec_runlen(avp->vec));
                         /* if the seqno we are analyzing is larger than the
                          * current ackno, then move towards the tail of our
                          * seqnos.
@@ -537,17 +482,15 @@ static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
                          * run length
                          */
                         while (between48(seqp->ccid2s_seq,ackno_end_rl,ackno)) {
-                                const u8 state = *vector &
-                                                 DCCP_ACKVEC_STATE_MASK;
+                                const u8 state = dccp_ackvec_state(avp->vec);
 
                                 /* new packet received or marked */
-                                if (state != DCCP_ACKVEC_STATE_NOT_RECEIVED &&
+                                if (state != DCCPAV_NOT_RECEIVED &&
                                     !seqp->ccid2s_acked) {
-                                        if (state ==
-                                            DCCP_ACKVEC_STATE_ECN_MARKED) {
+                                        if (state == DCCPAV_ECN_MARKED)
                                                 ccid2_congestion_event(sk,
                                                                        seqp);
-                                        } else
+                                        else
                                                 ccid2_new_ack(sk, seqp,
                                                               &maxincr);
 
@@ -566,7 +509,6 @@ static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
                                 break;
 
                         ackno = SUB48(ackno_end_rl, 1);
-                        vector++;
                 }
                 if (done)
                         break;
@@ -634,10 +576,11 @@ static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
                 sk_stop_timer(sk, &hc->tx_rtotimer);
         else
                 sk_reset_timer(sk, &hc->tx_rtotimer, jiffies + hc->tx_rto);
-
+done:
         /* check if incoming Acks allow pending packets to be sent */
         if (sender_was_blocked && !ccid2_cwnd_network_limited(hc))
                 tasklet_schedule(&dccp_sk(sk)->dccps_xmitlet);
+        dccp_ackvec_parsed_cleanup(&hc->tx_av_chunks);
 }
 
 static int ccid2_hc_tx_init(struct ccid *ccid, struct sock *sk)
@@ -666,6 +609,7 @@ static int ccid2_hc_tx_init(struct ccid *ccid, struct sock *sk)
         hc->tx_last_cong = ccid2_time_stamp;
         setup_timer(&hc->tx_rtotimer, ccid2_hc_tx_rto_expire,
                         (unsigned long)sk);
+        INIT_LIST_HEAD(&hc->tx_av_chunks);
         return 0;
 }
 
@@ -699,16 +643,17 @@ static void ccid2_hc_rx_packet_recv(struct sock *sk, struct sk_buff *skb)
 }
 
 struct ccid_operations ccid2_ops = {
-        .ccid_id                = DCCPC_CCID2,
-        .ccid_name              = "TCP-like",
-        .ccid_hc_tx_obj_size    = sizeof(struct ccid2_hc_tx_sock),
-        .ccid_hc_tx_init        = ccid2_hc_tx_init,
-        .ccid_hc_tx_exit        = ccid2_hc_tx_exit,
-        .ccid_hc_tx_send_packet = ccid2_hc_tx_send_packet,
-        .ccid_hc_tx_packet_sent = ccid2_hc_tx_packet_sent,
-        .ccid_hc_tx_packet_recv = ccid2_hc_tx_packet_recv,
-        .ccid_hc_rx_obj_size    = sizeof(struct ccid2_hc_rx_sock),
-        .ccid_hc_rx_packet_recv = ccid2_hc_rx_packet_recv,
+        .ccid_id                  = DCCPC_CCID2,
+        .ccid_name                = "TCP-like",
+        .ccid_hc_tx_obj_size      = sizeof(struct ccid2_hc_tx_sock),
+        .ccid_hc_tx_init          = ccid2_hc_tx_init,
+        .ccid_hc_tx_exit          = ccid2_hc_tx_exit,
+        .ccid_hc_tx_send_packet   = ccid2_hc_tx_send_packet,
+        .ccid_hc_tx_packet_sent   = ccid2_hc_tx_packet_sent,
+        .ccid_hc_tx_parse_options = ccid2_hc_tx_parse_options,
+        .ccid_hc_tx_packet_recv   = ccid2_hc_tx_packet_recv,
+        .ccid_hc_rx_obj_size      = sizeof(struct ccid2_hc_rx_sock),
+        .ccid_hc_rx_packet_recv   = ccid2_hc_rx_packet_recv,
 };
 
 #ifdef CONFIG_IP_DCCP_CCID2_DEBUG
diff --git a/net/dccp/ccids/ccid2.h b/net/dccp/ccids/ccid2.h
index 25cb6b216ed..e9985dafc2c 100644
--- a/net/dccp/ccids/ccid2.h
+++ b/net/dccp/ccids/ccid2.h
@@ -55,6 +55,7 @@ struct ccid2_seq {
  * @tx_rtt_seq:              to decay RTTVAR at most once per flight
  * @tx_rpseq:                last consecutive seqno
  * @tx_rpdupack:             dupacks since rpseq
+ * @tx_av_chunks:            list of Ack Vectors received on current skb
  */
 struct ccid2_hc_tx_sock {
         u32                     tx_cwnd;
@@ -79,6 +80,7 @@ struct ccid2_hc_tx_sock {
         int                     tx_rpdupack;
         u32                     tx_last_cong;
         u64                     tx_high_ack;
+        struct list_head        tx_av_chunks;
 };
 
 static inline bool ccid2_cwnd_network_limited(struct ccid2_hc_tx_sock *hc)
diff --git a/net/dccp/dccp.h b/net/dccp/dccp.h
index a8ed459508b..48ad5d9da7c 100644
--- a/net/dccp/dccp.h
+++ b/net/dccp/dccp.h
@@ -243,6 +243,19 @@ extern void dccp_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
 extern void dccp_send_sync(struct sock *sk, const u64 seq,
                            const enum dccp_pkt_type pkt_type);
 
+/*
+ * TX Packet Dequeueing Interface
+ */
+extern void             dccp_qpolicy_push(struct sock *sk, struct sk_buff *skb);
+extern bool             dccp_qpolicy_full(struct sock *sk);
+extern void             dccp_qpolicy_drop(struct sock *sk, struct sk_buff *skb);
+extern struct sk_buff   *dccp_qpolicy_top(struct sock *sk);
+extern struct sk_buff   *dccp_qpolicy_pop(struct sock *sk);
+extern bool             dccp_qpolicy_param_ok(struct sock *sk, __be32 param);
+
+/*
+ * TX Packet Output and TX Timers
+ */
 extern void   dccp_write_xmit(struct sock *sk);
 extern void   dccp_write_space(struct sock *sk);
 extern void   dccp_flush_write_queue(struct sock *sk, long *time_budget);
@@ -457,12 +470,15 @@ static inline void dccp_update_gss(struct sock *sk, u64 seq)
         dp->dccps_awh = dp->dccps_gss;
 }
 
+static inline int dccp_ackvec_pending(const struct sock *sk)
+{
+        return dccp_sk(sk)->dccps_hc_rx_ackvec != NULL &&
+               !dccp_ackvec_is_empty(dccp_sk(sk)->dccps_hc_rx_ackvec);
+}
+
 static inline int dccp_ack_pending(const struct sock *sk)
 {
-        const struct dccp_sock *dp = dccp_sk(sk);
-        return (dp->dccps_hc_rx_ackvec != NULL &&
-                dccp_ackvec_pending(dp->dccps_hc_rx_ackvec)) ||
-               inet_csk_ack_scheduled(sk);
+        return dccp_ackvec_pending(sk) || inet_csk_ack_scheduled(sk);
 }
 
 extern int  dccp_feat_finalise_settings(struct dccp_sock *dp);
diff --git a/net/dccp/input.c b/net/dccp/input.c
index e424a09e83f..15af247ea00 100644
--- a/net/dccp/input.c
+++ b/net/dccp/input.c
@@ -160,13 +160,15 @@ static void dccp_rcv_reset(struct sock *sk, struct sk_buff *skb)
         dccp_time_wait(sk, DCCP_TIME_WAIT, 0);
 }
 
-static void dccp_event_ack_recv(struct sock *sk, struct sk_buff *skb)
+static void dccp_handle_ackvec_processing(struct sock *sk, struct sk_buff *skb)
 {
-        struct dccp_sock *dp = dccp_sk(sk);
+        struct dccp_ackvec *av = dccp_sk(sk)->dccps_hc_rx_ackvec;
 
-        if (dp->dccps_hc_rx_ackvec != NULL)
-                dccp_ackvec_check_rcv_ackno(dp->dccps_hc_rx_ackvec, sk,
-                                            DCCP_SKB_CB(skb)->dccpd_ack_seq);
+        if (av == NULL)
+                return;
+        if (DCCP_SKB_CB(skb)->dccpd_ack_seq != DCCP_PKT_WITHOUT_ACK_SEQ)
+                dccp_ackvec_clear_state(av, DCCP_SKB_CB(skb)->dccpd_ack_seq);
+        dccp_ackvec_input(av, skb);
 }
 
 static void dccp_deliver_input_to_ccids(struct sock *sk, struct sk_buff *skb)
@@ -366,22 +368,13 @@ discard:
 int dccp_rcv_established(struct sock *sk, struct sk_buff *skb,
                          const struct dccp_hdr *dh, const unsigned len)
 {
-        struct dccp_sock *dp = dccp_sk(sk);
-
         if (dccp_check_seqno(sk, skb))
                 goto discard;
 
         if (dccp_parse_options(sk, NULL, skb))
                 return 1;
 
-        if (DCCP_SKB_CB(skb)->dccpd_ack_seq != DCCP_PKT_WITHOUT_ACK_SEQ)
-                dccp_event_ack_recv(sk, skb);
-
-        if (dp->dccps_hc_rx_ackvec != NULL &&
-            dccp_ackvec_add(dp->dccps_hc_rx_ackvec, sk,
-                            DCCP_SKB_CB(skb)->dccpd_seq,
-                            DCCP_ACKVEC_STATE_RECEIVED))
-                goto discard;
+        dccp_handle_ackvec_processing(sk, skb);
         dccp_deliver_input_to_ccids(sk, skb);
 
         return __dccp_rcv_established(sk, skb, dh, len);
@@ -633,15 +626,7 @@ int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                 if (dccp_parse_options(sk, NULL, skb))
                         return 1;
 
-                if (dcb->dccpd_ack_seq != DCCP_PKT_WITHOUT_ACK_SEQ)
-                        dccp_event_ack_recv(sk, skb);
-
-                if (dp->dccps_hc_rx_ackvec != NULL &&
-                    dccp_ackvec_add(dp->dccps_hc_rx_ackvec, sk,
-                                    DCCP_SKB_CB(skb)->dccpd_seq,
-                                    DCCP_ACKVEC_STATE_RECEIVED))
-                        goto discard;
-
+                dccp_handle_ackvec_processing(sk, skb);
                 dccp_deliver_input_to_ccids(sk, skb);
         }
 
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index 3f69ea11482..45a434f9416 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -462,15 +462,12 @@ static struct dst_entry* dccp_v4_route_skb(struct net *net, struct sock *sk,
 {
         struct rtable *rt;
         struct flowi fl = { .oif = skb_rtable(skb)->rt_iif,
-                            .nl_u = { .ip4_u =
-                                      { .daddr = ip_hdr(skb)->saddr,
-                                        .saddr = ip_hdr(skb)->daddr,
-                                        .tos = RT_CONN_FLAGS(sk) } },
+                            .fl4_dst = ip_hdr(skb)->saddr,
+                            .fl4_src = ip_hdr(skb)->daddr,
+                            .fl4_tos = RT_CONN_FLAGS(sk),
                             .proto = sk->sk_protocol,
-                            .uli_u = { .ports =
-                                       { .sport = dccp_hdr(skb)->dccph_dport,
-                                         .dport = dccp_hdr(skb)->dccph_sport }
-                                     }
+                            .fl_ip_sport = dccp_hdr(skb)->dccph_dport,
+                            .fl_ip_dport = dccp_hdr(skb)->dccph_sport
                           };
 
         security_skb_classify_flow(skb, &fl);
diff --git a/net/dccp/options.c b/net/dccp/options.c
index cd306181300..f06ffcfc8d7 100644
--- a/net/dccp/options.c
+++ b/net/dccp/options.c
@@ -54,7 +54,6 @@ int dccp_parse_options(struct sock *sk, struct dccp_request_sock *dreq,
         struct dccp_sock *dp = dccp_sk(sk);
         const struct dccp_hdr *dh = dccp_hdr(skb);
         const u8 pkt_type = DCCP_SKB_CB(skb)->dccpd_type;
-        u64 ackno = DCCP_SKB_CB(skb)->dccpd_ack_seq;
         unsigned char *options = (unsigned char *)dh + dccp_hdr_len(skb);
         unsigned char *opt_ptr = options;
         const unsigned char *opt_end = (unsigned char *)dh +
@@ -129,14 +128,6 @@ int dccp_parse_options(struct sock *sk, struct dccp_request_sock *dreq,
                         if (rc)
                                 goto out_featneg_failed;
                         break;
-                case DCCPO_ACK_VECTOR_0:
-                case DCCPO_ACK_VECTOR_1:
-                        if (dccp_packet_without_ack(skb))   /* RFC 4340, 11.4 */
-                                break;
-                        if (dp->dccps_hc_rx_ackvec != NULL &&
-                            dccp_ackvec_parse(sk, skb, &ackno, opt, value, len))
-                                goto out_invalid_option;
-                        break;
                 case DCCPO_TIMESTAMP:
                         if (len != 4)
                                 goto out_invalid_option;
@@ -226,6 +217,16 @@ int dccp_parse_options(struct sock *sk, struct dccp_request_sock *dreq,
                                                      pkt_type, opt, value, len))
                                 goto out_invalid_option;
                         break;
+                case DCCPO_ACK_VECTOR_0:
+                case DCCPO_ACK_VECTOR_1:
+                        if (dccp_packet_without_ack(skb))   /* RFC 4340, 11.4 */
+                                break;
+                        /*
+                         * Ack vectors are processed by the TX CCID if it is
+                         * interested. The RX CCID need not parse Ack Vectors,
+                         * since it is only interested in clearing old state.
+                         * Fall through.
+                         */
                 case DCCPO_MIN_TX_CCID_SPECIFIC ... DCCPO_MAX_TX_CCID_SPECIFIC:
                         if (ccid_hc_tx_parse_options(dp->dccps_hc_tx_ccid, sk,
                                                      pkt_type, opt, value, len))
@@ -340,6 +341,7 @@ static inline int dccp_elapsed_time_len(const u32 elapsed_time)
         return elapsed_time == 0 ? 0 : elapsed_time <= 0xFFFF ? 2 : 4;
 }
 
+/* FIXME: This function is currently not used anywhere */
 int dccp_insert_option_elapsed_time(struct sk_buff *skb, u32 elapsed_time)
 {
         const int elapsed_time_len = dccp_elapsed_time_len(elapsed_time);
@@ -424,6 +426,83 @@ static int dccp_insert_option_timestamp_echo(struct dccp_sock *dp,
         return 0;
 }
 
+static int dccp_insert_option_ackvec(struct sock *sk, struct sk_buff *skb)
+{
+        struct dccp_sock *dp = dccp_sk(sk);
+        struct dccp_ackvec *av = dp->dccps_hc_rx_ackvec;
+        struct dccp_skb_cb *dcb = DCCP_SKB_CB(skb);
+        const u16 buflen = dccp_ackvec_buflen(av);
+        /* Figure out how many options do we need to represent the ackvec */
+        const u8 nr_opts = DIV_ROUND_UP(buflen, DCCP_SINGLE_OPT_MAXLEN);
+        u16 len = buflen + 2 * nr_opts;
+        u8 i, nonce = 0;
+        const unsigned char *tail, *from;
+        unsigned char *to;
+
+        if (dcb->dccpd_opt_len + len > DCCP_MAX_OPT_LEN) {
+                DCCP_WARN("Lacking space for %u bytes on %s packet\n", len,
+                          dccp_packet_name(dcb->dccpd_type));
+                return -1;
+        }
+        /*
+         * Since Ack Vectors are variable-length, we can not always predict
+         * their size. To catch exception cases where the space is running out
+         * on the skb, a separate Sync is scheduled to carry the Ack Vector.
+         */
+        if (len > DCCPAV_MIN_OPTLEN &&
+            len + dcb->dccpd_opt_len + skb->len > dp->dccps_mss_cache) {
+                DCCP_WARN("No space left for Ack Vector (%u) on skb (%u+%u), "
+                          "MPS=%u ==> reduce payload size?\n", len, skb->len,
+                          dcb->dccpd_opt_len, dp->dccps_mss_cache);
+                dp->dccps_sync_scheduled = 1;
+                return 0;
+        }
+        dcb->dccpd_opt_len += len;
+
+        to   = skb_push(skb, len);
+        len  = buflen;
+        from = av->av_buf + av->av_buf_head;
+        tail = av->av_buf + DCCPAV_MAX_ACKVEC_LEN;
+
+        for (i = 0; i < nr_opts; ++i) {
+                int copylen = len;
+
+                if (len > DCCP_SINGLE_OPT_MAXLEN)
+                        copylen = DCCP_SINGLE_OPT_MAXLEN;
+
+                /*
+                 * RFC 4340, 12.2: Encode the Nonce Echo for this Ack Vector via
+                 * its type; ack_nonce is the sum of all individual buf_nonce's.
+                 */
+                nonce ^= av->av_buf_nonce[i];
+
+                *to++ = DCCPO_ACK_VECTOR_0 + av->av_buf_nonce[i];
+                *to++ = copylen + 2;
+
+                /* Check if buf_head wraps */
+                if (from + copylen > tail) {
+                        const u16 tailsize = tail - from;
+
+                        memcpy(to, from, tailsize);
+                        to      += tailsize;
+                        len     -= tailsize;
+                        copylen -= tailsize;
+                        from    = av->av_buf;
+                }
+
+                memcpy(to, from, copylen);
+                from += copylen;
+                to   += copylen;
+                len  -= copylen;
+        }
+        /*
+         * Each sent Ack Vector is recorded in the list, as per A.2 of RFC 4340.
+         */
+        if (dccp_ackvec_update_records(av, dcb->dccpd_seq, nonce))
+                return -ENOBUFS;
+        return 0;
+}
+
 /**
  * dccp_insert_option_mandatory  -  Mandatory option (5.8.2)
  * Note that since we are using skb_push, this function needs to be called
@@ -519,8 +598,7 @@ int dccp_insert_options(struct sock *sk, struct sk_buff *skb)
                         if (dccp_insert_option_timestamp(skb))
                                 return -1;
 
-                } else if (dp->dccps_hc_rx_ackvec != NULL &&
-                           dccp_ackvec_pending(dp->dccps_hc_rx_ackvec) &&
+                } else if (dccp_ackvec_pending(sk) &&
                            dccp_insert_option_ackvec(sk, skb)) {
                                 return -1;
                 }
diff --git a/net/dccp/output.c b/net/dccp/output.c
index 45b91853f5a..784d3021054 100644
--- a/net/dccp/output.c
+++ b/net/dccp/output.c
@@ -242,7 +242,7 @@ static void dccp_xmit_packet(struct sock *sk)
 {
         int err, len;
         struct dccp_sock *dp = dccp_sk(sk);
-        struct sk_buff *skb = skb_dequeue(&sk->sk_write_queue);
+        struct sk_buff *skb = dccp_qpolicy_pop(sk);
 
         if (unlikely(skb == NULL))
                 return;
@@ -283,6 +283,15 @@ static void dccp_xmit_packet(struct sock *sk)
          * any local drop will eventually be reported via receiver feedback.
          */
         ccid_hc_tx_packet_sent(dp->dccps_hc_tx_ccid, sk, len);
+
+        /*
+         * If the CCID needs to transfer additional header options out-of-band
+         * (e.g. Ack Vectors or feature-negotiation options), it activates this
+         * flag to schedule a Sync. The Sync will automatically incorporate all
+         * currently pending header options, thus clearing the backlog.
+         */
+        if (dp->dccps_sync_scheduled)
+                dccp_send_sync(sk, dp->dccps_gsr, DCCP_PKT_SYNC);
 }
 
 /**
@@ -336,7 +345,7 @@ void dccp_write_xmit(struct sock *sk)
         struct dccp_sock *dp = dccp_sk(sk);
         struct sk_buff *skb;
 
-        while ((skb = skb_peek(&sk->sk_write_queue))) {
+        while ((skb = dccp_qpolicy_top(sk))) {
                 int rc = ccid_hc_tx_send_packet(dp->dccps_hc_tx_ccid, sk, skb);
 
                 switch (ccid_packet_dequeue_eval(rc)) {
@@ -350,8 +359,7 @@ void dccp_write_xmit(struct sock *sk)
                         dccp_xmit_packet(sk);
                         break;
                 case CCID_PACKET_ERR:
-                        skb_dequeue(&sk->sk_write_queue);
-                        kfree_skb(skb);
+                        dccp_qpolicy_drop(sk, skb);
                         dccp_pr_debug("packet discarded due to err=%d\n", rc);
                 }
         }
@@ -636,6 +644,12 @@ void dccp_send_sync(struct sock *sk, const u64 ackno,
         DCCP_SKB_CB(skb)->dccpd_type = pkt_type;
         DCCP_SKB_CB(skb)->dccpd_ack_seq = ackno;
 
+        /*
+         * Clear the flag in case the Sync was scheduled for out-of-band data,
+         * such as carrying a long Ack Vector.
+         */
+        dccp_sk(sk)->dccps_sync_scheduled = 0;
+
         dccp_transmit_skb(sk, skb);
 }
 
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index ef343d53fce..152975d942d 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -185,6 +185,7 @@ int dccp_init_sock(struct sock *sk, const __u8 ctl_sock_initialized)
         dp->dccps_role          = DCCP_ROLE_UNDEFINED;
         dp->dccps_service       = DCCP_SERVICE_CODE_IS_ABSENT;
         dp->dccps_l_ack_ratio   = dp->dccps_r_ack_ratio = 1;
+        dp->dccps_tx_qlen       = sysctl_dccp_tx_qlen;
 
         dccp_init_xmit_timers(sk);
 
@@ -532,6 +533,20 @@ static int do_dccp_setsockopt(struct sock *sk, int level, int optname,
         case DCCP_SOCKOPT_RECV_CSCOV:
                 err = dccp_setsockopt_cscov(sk, val, true);
                 break;
+        case DCCP_SOCKOPT_QPOLICY_ID:
+                if (sk->sk_state != DCCP_CLOSED)
+                        err = -EISCONN;
+                else if (val < 0 || val >= DCCPQ_POLICY_MAX)
+                        err = -EINVAL;
+                else
+                        dp->dccps_qpolicy = val;
+                break;
+        case DCCP_SOCKOPT_QPOLICY_TXQLEN:
+                if (val < 0)
+                        err = -EINVAL;
+                else
+                        dp->dccps_tx_qlen = val;
+                break;
         default:
                 err = -ENOPROTOOPT;
                 break;
@@ -639,6 +654,12 @@ static int do_dccp_getsockopt(struct sock *sk, int level, int optname,
         case DCCP_SOCKOPT_RECV_CSCOV:
                 val = dp->dccps_pcrlen;
                 break;
+        case DCCP_SOCKOPT_QPOLICY_ID:
+                val = dp->dccps_qpolicy;
+                break;
+        case DCCP_SOCKOPT_QPOLICY_TXQLEN:
+                val = dp->dccps_tx_qlen;
+                break;
         case 128 ... 191:
                 return ccid_hc_rx_getsockopt(dp->dccps_hc_rx_ccid, sk, optname,
                                              len, (u32 __user *)optval, optlen);
@@ -681,6 +702,47 @@ int compat_dccp_getsockopt(struct sock *sk, int level, int optname,
 EXPORT_SYMBOL_GPL(compat_dccp_getsockopt);
 #endif
 
+static int dccp_msghdr_parse(struct msghdr *msg, struct sk_buff *skb)
+{
+        struct cmsghdr *cmsg = CMSG_FIRSTHDR(msg);
+
+        /*
+         * Assign an (opaque) qpolicy priority value to skb->priority.
+         *
+         * We are overloading this skb field for use with the qpolicy subystem.
+         * The skb->priority is normally used for the SO_PRIORITY option, which
+         * is initialised from sk_priority. Since the assignment of sk_priority
+         * to skb->priority happens later (on layer 3), we overload this field
+         * for use with queueing priorities as long as the skb is on layer 4.
+         * The default priority value (if nothing is set) is 0.
+         */
+        skb->priority = 0;
+
+        for (; cmsg != NULL; cmsg = CMSG_NXTHDR(msg, cmsg)) {
+
+                if (!CMSG_OK(msg, cmsg))
+                        return -EINVAL;
+
+                if (cmsg->cmsg_level != SOL_DCCP)
+                        continue;
+
+                if (cmsg->cmsg_type <= DCCP_SCM_QPOLICY_MAX &&
+                    !dccp_qpolicy_param_ok(skb->sk, cmsg->cmsg_type))
+                        return -EINVAL;
+
+                switch (cmsg->cmsg_type) {
+                case DCCP_SCM_PRIORITY:
+                        if (cmsg->cmsg_len != CMSG_LEN(sizeof(__u32)))
+                                return -EINVAL;
+                        skb->priority = *(__u32 *)CMSG_DATA(cmsg);
+                        break;
+                default:
+                        return -EINVAL;
+                }
+        }
+        return 0;
+}
+
 int dccp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                  size_t len)
 {
@@ -696,8 +758,7 @@ int dccp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
 
         lock_sock(sk);
 
-        if (sysctl_dccp_tx_qlen &&
-            (sk->sk_write_queue.qlen >= sysctl_dccp_tx_qlen)) {
+        if (dccp_qpolicy_full(sk)) {
                 rc = -EAGAIN;
                 goto out_release;
         }
@@ -725,7 +786,11 @@ int dccp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         if (rc != 0)
                 goto out_discard;
 
-        skb_queue_tail(&sk->sk_write_queue, skb);
+        rc = dccp_msghdr_parse(msg, skb);
+        if (rc != 0)
+                goto out_discard;
+
+        dccp_qpolicy_push(sk, skb);
         /*
          * The xmit_timer is set if the TX CCID is rate-based and will expire
          * when congestion control permits to release further packets into the
diff --git a/net/dccp/qpolicy.c b/net/dccp/qpolicy.c
new file mode 100644
index 00000000000..63c30bfa470
--- /dev/null
+++ b/net/dccp/qpolicy.c
@@ -0,0 +1,137 @@
+/*
+ *  net/dccp/qpolicy.c
+ *
+ *  Policy-based packet dequeueing interface for DCCP.
+ *
+ *  Copyright (c) 2008 Tomasz Grobelny <tomasz@grobelny.oswiecenia.net>
+ *
+ *  This program is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU General Public License v2
+ *  as published by the Free Software Foundation.
+ */
+#include "dccp.h"
+
+/*
+ *      Simple Dequeueing Policy:
+ *      If tx_qlen is different from 0, enqueue up to tx_qlen elements.
+ */
+static void qpolicy_simple_push(struct sock *sk, struct sk_buff *skb)
+{
+        skb_queue_tail(&sk->sk_write_queue, skb);
+}
+
+static bool qpolicy_simple_full(struct sock *sk)
+{
+        return dccp_sk(sk)->dccps_tx_qlen &&
+               sk->sk_write_queue.qlen >= dccp_sk(sk)->dccps_tx_qlen;
+}
+
+static struct sk_buff *qpolicy_simple_top(struct sock *sk)
+{
+        return skb_peek(&sk->sk_write_queue);
+}
+
+/*
+ *      Priority-based Dequeueing Policy:
+ *      If tx_qlen is different from 0 and the queue has reached its upper bound
+ *      of tx_qlen elements, replace older packets lowest-priority-first.
+ */
+static struct sk_buff *qpolicy_prio_best_skb(struct sock *sk)
+{
+        struct sk_buff *skb, *best = NULL;
+
+        skb_queue_walk(&sk->sk_write_queue, skb)
+                if (best == NULL || skb->priority > best->priority)
+                        best = skb;
+        return best;
+}
+
+static struct sk_buff *qpolicy_prio_worst_skb(struct sock *sk)
+{
+        struct sk_buff *skb, *worst = NULL;
+
+        skb_queue_walk(&sk->sk_write_queue, skb)
+                if (worst == NULL || skb->priority < worst->priority)
+                        worst = skb;
+        return worst;
+}
+
+static bool qpolicy_prio_full(struct sock *sk)
+{
+        if (qpolicy_simple_full(sk))
+                dccp_qpolicy_drop(sk, qpolicy_prio_worst_skb(sk));
+        return false;
+}
+
+/**
+ * struct dccp_qpolicy_operations  -  TX Packet Dequeueing Interface
+ * @push: add a new @skb to the write queue
+ * @full: indicates that no more packets will be admitted
+ * @top:  peeks at whatever the queueing policy defines as its `top'
+ */
+static struct dccp_qpolicy_operations {
+        void            (*push) (struct sock *sk, struct sk_buff *skb);
+        bool            (*full) (struct sock *sk);
+        struct sk_buff* (*top)  (struct sock *sk);
+        __be32          params;
+
+} qpol_table[DCCPQ_POLICY_MAX] = {
+        [DCCPQ_POLICY_SIMPLE] = {
+                .push   = qpolicy_simple_push,
+                .full   = qpolicy_simple_full,
+                .top    = qpolicy_simple_top,
+                .params = 0,
+        },
+        [DCCPQ_POLICY_PRIO] = {
+                .push   = qpolicy_simple_push,
+                .full   = qpolicy_prio_full,
+                .top    = qpolicy_prio_best_skb,
+                .params = DCCP_SCM_PRIORITY,
+        },
+};
+
+/*
+ *      Externally visible interface
+ */
+void dccp_qpolicy_push(struct sock *sk, struct sk_buff *skb)
+{
+        qpol_table[dccp_sk(sk)->dccps_qpolicy].push(sk, skb);
+}
+
+bool dccp_qpolicy_full(struct sock *sk)
+{
+        return qpol_table[dccp_sk(sk)->dccps_qpolicy].full(sk);
+}
+
+void dccp_qpolicy_drop(struct sock *sk, struct sk_buff *skb)
+{
+        if (skb != NULL) {
+                skb_unlink(skb, &sk->sk_write_queue);
+                kfree_skb(skb);
+        }
+}
+
+struct sk_buff *dccp_qpolicy_top(struct sock *sk)
+{
+        return qpol_table[dccp_sk(sk)->dccps_qpolicy].top(sk);
+}
+
+struct sk_buff *dccp_qpolicy_pop(struct sock *sk)
+{
+        struct sk_buff *skb = dccp_qpolicy_top(sk);
+
+        if (skb != NULL) {
+                /* Clear any skb fields that we used internally */
+                skb->priority = 0;
+                skb_unlink(skb, &sk->sk_write_queue);
+        }
+        return skb;
+}
+
+bool dccp_qpolicy_param_ok(struct sock *sk, __be32 param)
+{
+        /* check if exactly one bit is set */
+        if (!param || (param & (param - 1)))
+                return false;
+        return (qpol_table[dccp_sk(sk)->dccps_qpolicy].params & param) == param;
+}
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index 6f97268ed85..0065e7e14af 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -1850,7 +1850,7 @@ unsigned dn_mss_from_pmtu(struct net_device *dev, int mtu)
 {
         unsigned mss = 230 - DN_MAX_NSP_DATA_HEADER;
         if (dev) {
-                struct dn_dev *dn_db = dev->dn_ptr;
+                struct dn_dev *dn_db = rcu_dereference_raw(dev->dn_ptr);
                 mtu -= LL_RESERVED_SPACE(dev);
                 if (dn_db->use_long)
                         mtu -= 21;
diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
index 4c409b46aa3..0ba15633c41 100644
--- a/net/decnet/dn_dev.c
+++ b/net/decnet/dn_dev.c
@@ -267,7 +267,7 @@ static int dn_forwarding_proc(ctl_table *table, int write,
         if (table->extra1 == NULL)
                 return -EINVAL;
 
-        dn_db = dev->dn_ptr;
+        dn_db = rcu_dereference_raw(dev->dn_ptr);
         old = dn_db->parms.forwarding;
 
         err = proc_dointvec(table, write, buffer, lenp, ppos);
@@ -332,14 +332,19 @@ static struct dn_ifaddr *dn_dev_alloc_ifa(void)
         return ifa;
 }
 
-static __inline__ void dn_dev_free_ifa(struct dn_ifaddr *ifa)
+static void dn_dev_free_ifa_rcu(struct rcu_head *head)
 {
-        kfree(ifa);
+        kfree(container_of(head, struct dn_ifaddr, rcu));
 }
 
-static void dn_dev_del_ifa(struct dn_dev *dn_db, struct dn_ifaddr **ifap, int destroy)
+static void dn_dev_free_ifa(struct dn_ifaddr *ifa)
 {
-        struct dn_ifaddr *ifa1 = *ifap;
+        call_rcu(&ifa->rcu, dn_dev_free_ifa_rcu);
+}
+
+static void dn_dev_del_ifa(struct dn_dev *dn_db, struct dn_ifaddr __rcu **ifap, int destroy)
+{
+        struct dn_ifaddr *ifa1 = rtnl_dereference(*ifap);
         unsigned char mac_addr[6];
         struct net_device *dev = dn_db->dev;
 
@@ -373,7 +378,9 @@ static int dn_dev_insert_ifa(struct dn_dev *dn_db, struct dn_ifaddr *ifa)
         ASSERT_RTNL();
 
         /* Check for duplicates */
-        for(ifa1 = dn_db->ifa_list; ifa1; ifa1 = ifa1->ifa_next) {
+        for (ifa1 = rtnl_dereference(dn_db->ifa_list);
+             ifa1 != NULL;
+             ifa1 = rtnl_dereference(ifa1->ifa_next)) {
                 if (ifa1->ifa_local == ifa->ifa_local)
                         return -EEXIST;
         }
@@ -386,7 +393,7 @@ static int dn_dev_insert_ifa(struct dn_dev *dn_db, struct dn_ifaddr *ifa)
         }
 
         ifa->ifa_next = dn_db->ifa_list;
-        dn_db->ifa_list = ifa;
+        rcu_assign_pointer(dn_db->ifa_list, ifa);
 
         dn_ifaddr_notify(RTM_NEWADDR, ifa);
         blocking_notifier_call_chain(&dnaddr_chain, NETDEV_UP, ifa);
@@ -396,7 +403,7 @@ static int dn_dev_insert_ifa(struct dn_dev *dn_db, struct dn_ifaddr *ifa)
 
 static int dn_dev_set_ifa(struct net_device *dev, struct dn_ifaddr *ifa)
 {
-        struct dn_dev *dn_db = dev->dn_ptr;
+        struct dn_dev *dn_db = rtnl_dereference(dev->dn_ptr);
         int rv;
 
         if (dn_db == NULL) {
@@ -425,7 +432,8 @@ int dn_dev_ioctl(unsigned int cmd, void __user *arg)
         struct sockaddr_dn *sdn = (struct sockaddr_dn *)&ifr->ifr_addr;
         struct dn_dev *dn_db;
         struct net_device *dev;
-        struct dn_ifaddr *ifa = NULL, **ifap = NULL;
+        struct dn_ifaddr *ifa = NULL;
+        struct dn_ifaddr __rcu **ifap = NULL;
         int ret = 0;
 
         if (copy_from_user(ifr, arg, DN_IFREQ_SIZE))
@@ -454,8 +462,10 @@ int dn_dev_ioctl(unsigned int cmd, void __user *arg)
                 goto done;
         }
 
-        if ((dn_db = dev->dn_ptr) != NULL) {
-                for (ifap = &dn_db->ifa_list; (ifa=*ifap) != NULL; ifap = &ifa->ifa_next)
+        if ((dn_db = rtnl_dereference(dev->dn_ptr)) != NULL) {
+                for (ifap = &dn_db->ifa_list;
+                     (ifa = rtnl_dereference(*ifap)) != NULL;
+                     ifap = &ifa->ifa_next)
                         if (strcmp(ifr->ifr_name, ifa->ifa_label) == 0)
                                 break;
         }
@@ -558,7 +568,7 @@ static struct dn_dev *dn_dev_by_index(int ifindex)
 
         dev = __dev_get_by_index(&init_net, ifindex);
         if (dev)
-                dn_dev = dev->dn_ptr;
+                dn_dev = rtnl_dereference(dev->dn_ptr);
 
         return dn_dev;
 }
@@ -576,7 +586,8 @@ static int dn_nl_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
         struct nlattr *tb[IFA_MAX+1];
         struct dn_dev *dn_db;
         struct ifaddrmsg *ifm;
-        struct dn_ifaddr *ifa, **ifap;
+        struct dn_ifaddr *ifa;
+        struct dn_ifaddr __rcu **ifap;
         int err = -EINVAL;
 
         if (!net_eq(net, &init_net))
@@ -592,7 +603,9 @@ static int dn_nl_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
                 goto errout;
 
         err = -EADDRNOTAVAIL;
-        for (ifap = &dn_db->ifa_list; (ifa = *ifap); ifap = &ifa->ifa_next) {
+        for (ifap = &dn_db->ifa_list;
+             (ifa = rtnl_dereference(*ifap)) != NULL;
+             ifap = &ifa->ifa_next) {
                 if (tb[IFA_LOCAL] &&
                     nla_memcmp(tb[IFA_LOCAL], &ifa->ifa_local, 2))
                         continue;
@@ -632,7 +645,7 @@ static int dn_nl_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
         if ((dev = __dev_get_by_index(&init_net, ifm->ifa_index)) == NULL)
                 return -ENODEV;
 
-        if ((dn_db = dev->dn_ptr) == NULL) {
+        if ((dn_db = rtnl_dereference(dev->dn_ptr)) == NULL) {
                 dn_db = dn_dev_create(dev, &err);
                 if (!dn_db)
                         return err;
@@ -748,11 +761,11 @@ static int dn_nl_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
                         skip_naddr = 0;
                 }
 
-                if ((dn_db = dev->dn_ptr) == NULL)
+                if ((dn_db = rtnl_dereference(dev->dn_ptr)) == NULL)
                         goto cont;
 
-                for (ifa = dn_db->ifa_list, dn_idx = 0; ifa;
-                     ifa = ifa->ifa_next, dn_idx++) {
+                for (ifa = rtnl_dereference(dn_db->ifa_list), dn_idx = 0; ifa;
+                     ifa = rtnl_dereference(ifa->ifa_next), dn_idx++) {
                         if (dn_idx < skip_naddr)
                                 continue;
 
@@ -773,21 +786,22 @@ done:
 
 static int dn_dev_get_first(struct net_device *dev, __le16 *addr)
 {
-        struct dn_dev *dn_db = (struct dn_dev *)dev->dn_ptr;
+        struct dn_dev *dn_db;
         struct dn_ifaddr *ifa;
         int rv = -ENODEV;
 
+        rcu_read_lock();
+        dn_db = rcu_dereference(dev->dn_ptr);
         if (dn_db == NULL)
                 goto out;
 
-        rtnl_lock();
-        ifa = dn_db->ifa_list;
+        ifa = rcu_dereference(dn_db->ifa_list);
         if (ifa != NULL) {
                 *addr = ifa->ifa_local;
                 rv = 0;
         }
-        rtnl_unlock();
 out:
+        rcu_read_unlock();
         return rv;
 }
 
@@ -823,7 +837,7 @@ static void dn_send_endnode_hello(struct net_device *dev, struct dn_ifaddr *ifa)
         struct endnode_hello_message *msg;
         struct sk_buff *skb = NULL;
         __le16 *pktlen;
-        struct dn_dev *dn_db = (struct dn_dev *)dev->dn_ptr;
+        struct dn_dev *dn_db = rcu_dereference_raw(dev->dn_ptr);
 
         if ((skb = dn_alloc_skb(NULL, sizeof(*msg), GFP_ATOMIC)) == NULL)
                 return;
@@ -889,7 +903,7 @@ static int dn_am_i_a_router(struct dn_neigh *dn, struct dn_dev *dn_db, struct dn
 static void dn_send_router_hello(struct net_device *dev, struct dn_ifaddr *ifa)
 {
         int n;
-        struct dn_dev *dn_db = dev->dn_ptr;
+        struct dn_dev *dn_db = rcu_dereference_raw(dev->dn_ptr);
         struct dn_neigh *dn = (struct dn_neigh *)dn_db->router;
         struct sk_buff *skb;
         size_t size;
@@ -960,7 +974,7 @@ static void dn_send_router_hello(struct net_device *dev, struct dn_ifaddr *ifa)
 
 static void dn_send_brd_hello(struct net_device *dev, struct dn_ifaddr *ifa)
 {
-        struct dn_dev *dn_db = (struct dn_dev *)dev->dn_ptr;
+        struct dn_dev *dn_db = rcu_dereference_raw(dev->dn_ptr);
 
         if (dn_db->parms.forwarding == 0)
                 dn_send_endnode_hello(dev, ifa);
@@ -998,7 +1012,7 @@ static void dn_send_ptp_hello(struct net_device *dev, struct dn_ifaddr *ifa)
 
 static int dn_eth_up(struct net_device *dev)
 {
-        struct dn_dev *dn_db = dev->dn_ptr;
+        struct dn_dev *dn_db = rcu_dereference_raw(dev->dn_ptr);
 
         if (dn_db->parms.forwarding == 0)
                 dev_mc_add(dev, dn_rt_all_end_mcast);
@@ -1012,7 +1026,7 @@ static int dn_eth_up(struct net_device *dev)
 
 static void dn_eth_down(struct net_device *dev)
 {
-        struct dn_dev *dn_db = dev->dn_ptr;
+        struct dn_dev *dn_db = rcu_dereference_raw(dev->dn_ptr);
 
         if (dn_db->parms.forwarding == 0)
                 dev_mc_del(dev, dn_rt_all_end_mcast);
@@ -1025,12 +1039,16 @@ static void dn_dev_set_timer(struct net_device *dev);
 static void dn_dev_timer_func(unsigned long arg)
 {
         struct net_device *dev = (struct net_device *)arg;
-        struct dn_dev *dn_db = dev->dn_ptr;
+        struct dn_dev *dn_db;
         struct dn_ifaddr *ifa;
 
+        rcu_read_lock();
+        dn_db = rcu_dereference(dev->dn_ptr);
         if (dn_db->t3 <= dn_db->parms.t2) {
                 if (dn_db->parms.timer3) {
-                        for(ifa = dn_db->ifa_list; ifa; ifa = ifa->ifa_next) {
+                        for (ifa = rcu_dereference(dn_db->ifa_list);
+                             ifa;
+                             ifa = rcu_dereference(ifa->ifa_next)) {
                                 if (!(ifa->ifa_flags & IFA_F_SECONDARY))
                                         dn_db->parms.timer3(dev, ifa);
                         }
@@ -1039,13 +1057,13 @@ static void dn_dev_timer_func(unsigned long arg)
         } else {
                 dn_db->t3 -= dn_db->parms.t2;
         }
-
+        rcu_read_unlock();
         dn_dev_set_timer(dev);
 }
 
 static void dn_dev_set_timer(struct net_device *dev)
 {
-        struct dn_dev *dn_db = dev->dn_ptr;
+        struct dn_dev *dn_db = rcu_dereference_raw(dev->dn_ptr);
 
         if (dn_db->parms.t2 > dn_db->parms.t3)
                 dn_db->parms.t2 = dn_db->parms.t3;
@@ -1077,8 +1095,8 @@ static struct dn_dev *dn_dev_create(struct net_device *dev, int *err)
                 return NULL;
 
         memcpy(&dn_db->parms, p, sizeof(struct dn_dev_parms));
-        smp_wmb();
-        dev->dn_ptr = dn_db;
+
+        rcu_assign_pointer(dev->dn_ptr, dn_db);
         dn_db->dev = dev;
         init_timer(&dn_db->timer);
 
@@ -1086,7 +1104,7 @@ static struct dn_dev *dn_dev_create(struct net_device *dev, int *err)
 
         dn_db->neigh_parms = neigh_parms_alloc(dev, &dn_neigh_table);
         if (!dn_db->neigh_parms) {
-                dev->dn_ptr = NULL;
+                rcu_assign_pointer(dev->dn_ptr, NULL);
                 kfree(dn_db);
                 return NULL;
         }
@@ -1125,7 +1143,7 @@ void dn_dev_up(struct net_device *dev)
         struct dn_ifaddr *ifa;
         __le16 addr = decnet_address;
         int maybe_default = 0;
-        struct dn_dev *dn_db = (struct dn_dev *)dev->dn_ptr;
+        struct dn_dev *dn_db = rtnl_dereference(dev->dn_ptr);
 
         if ((dev->type != ARPHRD_ETHER) && (dev->type != ARPHRD_LOOPBACK))
                 return;
@@ -1176,7 +1194,7 @@ void dn_dev_up(struct net_device *dev)
 
 static void dn_dev_delete(struct net_device *dev)
 {
-        struct dn_dev *dn_db = dev->dn_ptr;
+        struct dn_dev *dn_db = rtnl_dereference(dev->dn_ptr);
 
         if (dn_db == NULL)
                 return;
@@ -1204,13 +1222,13 @@ static void dn_dev_delete(struct net_device *dev)
 
 void dn_dev_down(struct net_device *dev)
 {
-        struct dn_dev *dn_db = dev->dn_ptr;
+        struct dn_dev *dn_db = rtnl_dereference(dev->dn_ptr);
         struct dn_ifaddr *ifa;
 
         if (dn_db == NULL)
                 return;
 
-        while((ifa = dn_db->ifa_list) != NULL) {
+        while ((ifa = rtnl_dereference(dn_db->ifa_list)) != NULL) {
                 dn_dev_del_ifa(dn_db, &dn_db->ifa_list, 0);
                 dn_dev_free_ifa(ifa);
         }
@@ -1270,7 +1288,7 @@ static inline int is_dn_dev(struct net_device *dev)
 }
 
 static void *dn_dev_seq_start(struct seq_file *seq, loff_t *pos)
-        __acquires(rcu)
+        __acquires(RCU)
 {
         int i;
         struct net_device *dev;
@@ -1313,7 +1331,7 @@ static void *dn_dev_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 }
 
 static void dn_dev_seq_stop(struct seq_file *seq, void *v)
-        __releases(rcu)
+        __releases(RCU)
 {
         rcu_read_unlock();
 }
@@ -1340,7 +1358,7 @@ static int dn_dev_seq_show(struct seq_file *seq, void *v)
                 struct net_device *dev = v;
                 char peer_buf[DN_ASCBUF_LEN];
                 char router_buf[DN_ASCBUF_LEN];
-                struct dn_dev *dn_db = dev->dn_ptr;
+                struct dn_dev *dn_db = rcu_dereference(dev->dn_ptr);
 
                 seq_printf(seq, "%-8s %1s     %04u %04u   %04lu %04lu"
                                 "   %04hu    %03d %02x    %-10s %-7s %-7s\n",
diff --git a/net/decnet/dn_fib.c b/net/decnet/dn_fib.c
index 4ab96c15166..0ef0a81bcd7 100644
--- a/net/decnet/dn_fib.c
+++ b/net/decnet/dn_fib.c
@@ -610,10 +610,12 @@ static void dn_fib_del_ifaddr(struct dn_ifaddr *ifa)
         /* Scan device list */
         rcu_read_lock();
         for_each_netdev_rcu(&init_net, dev) {
-                dn_db = dev->dn_ptr;
+                dn_db = rcu_dereference(dev->dn_ptr);
                 if (dn_db == NULL)
                         continue;
-                for(ifa2 = dn_db->ifa_list; ifa2; ifa2 = ifa2->ifa_next) {
+                for (ifa2 = rcu_dereference(dn_db->ifa_list);
+                     ifa2 != NULL;
+                     ifa2 = rcu_dereference(ifa2->ifa_next)) {
                         if (ifa2->ifa_local == ifa->ifa_local) {
                                 found_it = 1;
                                 break;
diff --git a/net/decnet/dn_neigh.c b/net/decnet/dn_neigh.c
index a085dbcf5c7..602dade7e9a 100644
--- a/net/decnet/dn_neigh.c
+++ b/net/decnet/dn_neigh.c
@@ -391,7 +391,7 @@ int dn_neigh_router_hello(struct sk_buff *skb)
                 write_lock(&neigh->lock);
 
                 neigh->used = jiffies;
-                dn_db = (struct dn_dev *)neigh->dev->dn_ptr;
+                dn_db = rcu_dereference(neigh->dev->dn_ptr);
 
                 if (!(neigh->nud_state & NUD_PERMANENT)) {
                         neigh->updated = jiffies;
diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c
index df0f3e54ff8..8280e43c886 100644
--- a/net/decnet/dn_route.c
+++ b/net/decnet/dn_route.c
@@ -93,7 +93,7 @@
 
 struct dn_rt_hash_bucket
 {
-        struct dn_route *chain;
+        struct dn_route __rcu *chain;
         spinlock_t lock;
 };
 
@@ -157,15 +157,17 @@ static inline void dnrt_drop(struct dn_route *rt)
 static void dn_dst_check_expire(unsigned long dummy)
 {
         int i;
-        struct dn_route *rt, **rtp;
+        struct dn_route *rt;
+        struct dn_route __rcu **rtp;
         unsigned long now = jiffies;
         unsigned long expire = 120 * HZ;
 
-        for(i = 0; i <= dn_rt_hash_mask; i++) {
+        for (i = 0; i <= dn_rt_hash_mask; i++) {
                 rtp = &dn_rt_hash_table[i].chain;
 
                 spin_lock(&dn_rt_hash_table[i].lock);
-                while((rt=*rtp) != NULL) {
+                while ((rt = rcu_dereference_protected(*rtp,
+                                                lockdep_is_held(&dn_rt_hash_table[i].lock))) != NULL) {
                         if (atomic_read(&rt->dst.__refcnt) ||
                                         (now - rt->dst.lastuse) < expire) {
                                 rtp = &rt->dst.dn_next;
@@ -186,17 +188,19 @@ static void dn_dst_check_expire(unsigned long dummy)
 
 static int dn_dst_gc(struct dst_ops *ops)
 {
-        struct dn_route *rt, **rtp;
+        struct dn_route *rt;
+        struct dn_route __rcu **rtp;
         int i;
         unsigned long now = jiffies;
         unsigned long expire = 10 * HZ;
 
-        for(i = 0; i <= dn_rt_hash_mask; i++) {
+        for (i = 0; i <= dn_rt_hash_mask; i++) {
 
                 spin_lock_bh(&dn_rt_hash_table[i].lock);
                 rtp = &dn_rt_hash_table[i].chain;
 
-                while((rt=*rtp) != NULL) {
+                while ((rt = rcu_dereference_protected(*rtp,
+                                                lockdep_is_held(&dn_rt_hash_table[i].lock))) != NULL) {
                         if (atomic_read(&rt->dst.__refcnt) ||
                                         (now - rt->dst.lastuse) < expire) {
                                 rtp = &rt->dst.dn_next;
@@ -227,7 +231,7 @@ static void dn_dst_update_pmtu(struct dst_entry *dst, u32 mtu)
 {
         u32 min_mtu = 230;
         struct dn_dev *dn = dst->neighbour ?
-                            (struct dn_dev *)dst->neighbour->dev->dn_ptr : NULL;
+                            rcu_dereference_raw(dst->neighbour->dev->dn_ptr) : NULL;
 
         if (dn && dn->use_long == 0)
                 min_mtu -= 6;
@@ -267,23 +271,25 @@ static void dn_dst_link_failure(struct sk_buff *skb)
 
 static inline int compare_keys(struct flowi *fl1, struct flowi *fl2)
 {
-        return ((fl1->nl_u.dn_u.daddr ^ fl2->nl_u.dn_u.daddr) |
-                (fl1->nl_u.dn_u.saddr ^ fl2->nl_u.dn_u.saddr) |
+        return ((fl1->fld_dst ^ fl2->fld_dst) |
+                (fl1->fld_src ^ fl2->fld_src) |
                 (fl1->mark ^ fl2->mark) |
-                (fl1->nl_u.dn_u.scope ^ fl2->nl_u.dn_u.scope) |
+                (fl1->fld_scope ^ fl2->fld_scope) |
                 (fl1->oif ^ fl2->oif) |
                 (fl1->iif ^ fl2->iif)) == 0;
 }
 
 static int dn_insert_route(struct dn_route *rt, unsigned hash, struct dn_route **rp)
 {
-        struct dn_route *rth, **rthp;
+        struct dn_route *rth;
+        struct dn_route __rcu **rthp;
         unsigned long now = jiffies;
 
         rthp = &dn_rt_hash_table[hash].chain;
 
         spin_lock_bh(&dn_rt_hash_table[hash].lock);
-        while((rth = *rthp) != NULL) {
+        while ((rth = rcu_dereference_protected(*rthp,
+                                                lockdep_is_held(&dn_rt_hash_table[hash].lock))) != NULL) {
                 if (compare_keys(&rth->fl, &rt->fl)) {
                         /* Put it first */
                         *rthp = rth->dst.dn_next;
@@ -315,15 +321,15 @@ static void dn_run_flush(unsigned long dummy)
         int i;
         struct dn_route *rt, *next;
 
-        for(i = 0; i < dn_rt_hash_mask; i++) {
+        for (i = 0; i < dn_rt_hash_mask; i++) {
                 spin_lock_bh(&dn_rt_hash_table[i].lock);
 
-                if ((rt = xchg(&dn_rt_hash_table[i].chain, NULL)) == NULL)
+                if ((rt = xchg((struct dn_route **)&dn_rt_hash_table[i].chain, NULL)) == NULL)
                         goto nothing_to_declare;
 
-                for(; rt; rt=next) {
-                        next = rt->dst.dn_next;
-                        rt->dst.dn_next = NULL;
+                for(; rt; rt = next) {
+                        next = rcu_dereference_raw(rt->dst.dn_next);
+                        RCU_INIT_POINTER(rt->dst.dn_next, NULL);
                         dst_free((struct dst_entry *)rt);
                 }
 
@@ -458,15 +464,16 @@ static int dn_return_long(struct sk_buff *skb)
  */
 static int dn_route_rx_packet(struct sk_buff *skb)
 {
-        struct dn_skb_cb *cb = DN_SKB_CB(skb);
+        struct dn_skb_cb *cb;
         int err;
 
         if ((err = dn_route_input(skb)) == 0)
                 return dst_input(skb);
 
+        cb = DN_SKB_CB(skb);
         if (decnet_debug_level & 4) {
                 char *devname = skb->dev ? skb->dev->name : "???";
-                struct dn_skb_cb *cb = DN_SKB_CB(skb);
+
                 printk(KERN_DEBUG
                         "DECnet: dn_route_rx_packet: rt_flags=0x%02x dev=%s len=%d src=0x%04hx dst=0x%04hx err=%d type=%d\n",
                         (int)cb->rt_flags, devname, skb->len,
@@ -573,7 +580,7 @@ int dn_route_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type
         struct dn_skb_cb *cb;
         unsigned char flags = 0;
         __u16 len = le16_to_cpu(*(__le16 *)skb->data);
-        struct dn_dev *dn = (struct dn_dev *)dev->dn_ptr;
+        struct dn_dev *dn = rcu_dereference(dev->dn_ptr);
         unsigned char padlen = 0;
 
         if (!net_eq(dev_net(dev), &init_net))
@@ -728,7 +735,7 @@ static int dn_forward(struct sk_buff *skb)
 {
         struct dn_skb_cb *cb = DN_SKB_CB(skb);
         struct dst_entry *dst = skb_dst(skb);
-        struct dn_dev *dn_db = dst->dev->dn_ptr;
+        struct dn_dev *dn_db = rcu_dereference(dst->dev->dn_ptr);
         struct dn_route *rt;
         struct neighbour *neigh = dst->neighbour;
         int header_len;
@@ -835,13 +842,16 @@ static inline int dn_match_addr(__le16 addr1, __le16 addr2)
 static __le16 dnet_select_source(const struct net_device *dev, __le16 daddr, int scope)
 {
         __le16 saddr = 0;
-        struct dn_dev *dn_db = dev->dn_ptr;
+        struct dn_dev *dn_db;
         struct dn_ifaddr *ifa;
         int best_match = 0;
         int ret;
 
-        read_lock(&dev_base_lock);
-        for(ifa = dn_db->ifa_list; ifa; ifa = ifa->ifa_next) {
+        rcu_read_lock();
+        dn_db = rcu_dereference(dev->dn_ptr);
+        for (ifa = rcu_dereference(dn_db->ifa_list);
+             ifa != NULL;
+             ifa = rcu_dereference(ifa->ifa_next)) {
                 if (ifa->ifa_scope > scope)
                         continue;
                 if (!daddr) {
@@ -854,7 +864,7 @@ static __le16 dnet_select_source(const struct net_device *dev, __le16 daddr, int
                 if (best_match == 0)
                         saddr = ifa->ifa_local;
         }
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 
         return saddr;
 }
@@ -872,11 +882,9 @@ static inline __le16 dn_fib_rules_map_destination(__le16 daddr, struct dn_fib_re
 
 static int dn_route_output_slow(struct dst_entry **pprt, const struct flowi *oldflp, int try_hard)
 {
-        struct flowi fl = { .nl_u = { .dn_u =
-                                      { .daddr = oldflp->fld_dst,
-                                        .saddr = oldflp->fld_src,
-                                        .scope = RT_SCOPE_UNIVERSE,
-                                     } },
+        struct flowi fl = { .fld_dst = oldflp->fld_dst,
+                            .fld_src = oldflp->fld_src,
+                            .fld_scope = RT_SCOPE_UNIVERSE,
                             .mark = oldflp->mark,
                             .iif = init_net.loopback_dev->ifindex,
                             .oif = oldflp->oif };
@@ -1020,7 +1028,7 @@ source_ok:
                 err = -ENODEV;
                 if (dev_out == NULL)
                         goto out;
-                dn_db = dev_out->dn_ptr;
+                dn_db = rcu_dereference_raw(dev_out->dn_ptr);
                 /* Possible improvement - check all devices for local addr */
                 if (dn_dev_islocal(dev_out, fl.fld_dst)) {
                         dev_put(dev_out);
@@ -1171,7 +1179,7 @@ static int __dn_route_output_key(struct dst_entry **pprt, const struct flowi *fl
                         if ((flp->fld_dst == rt->fl.fld_dst) &&
                             (flp->fld_src == rt->fl.fld_src) &&
                             (flp->mark == rt->fl.mark) &&
-                            (rt->fl.iif == 0) &&
+                            dn_is_output_route(rt) &&
                             (rt->fl.oif == flp->oif)) {
                                 dst_use(&rt->dst, jiffies);
                                 rcu_read_unlock_bh();
@@ -1220,11 +1228,9 @@ static int dn_route_input_slow(struct sk_buff *skb)
         int flags = 0;
         __le16 gateway = 0;
         __le16 local_src = 0;
-        struct flowi fl = { .nl_u = { .dn_u =
-                                     { .daddr = cb->dst,
-                                       .saddr = cb->src,
-                                       .scope = RT_SCOPE_UNIVERSE,
-                                    } },
+        struct flowi fl = { .fld_dst = cb->dst,
+                            .fld_src = cb->src,
+                            .fld_scope = RT_SCOPE_UNIVERSE,
                             .mark = skb->mark,
                             .iif = skb->dev->ifindex };
         struct dn_fib_res res = { .fi = NULL, .type = RTN_UNREACHABLE };
@@ -1233,7 +1239,7 @@ static int dn_route_input_slow(struct sk_buff *skb)
 
         dev_hold(in_dev);
 
-        if ((dn_db = in_dev->dn_ptr) == NULL)
+        if ((dn_db = rcu_dereference(in_dev->dn_ptr)) == NULL)
                 goto out;
 
         /* Zero source addresses are not allowed */
@@ -1502,7 +1508,7 @@ static int dn_rt_fill_info(struct sk_buff *skb, u32 pid, u32 seq,
         if (rtnl_put_cacheinfo(skb, &rt->dst, 0, 0, 0, expires,
                                rt->dst.error) < 0)
                 goto rtattr_failure;
-        if (rt->fl.iif)
+        if (dn_is_input_route(rt))
                 RTA_PUT(skb, RTA_IIF, sizeof(int), &rt->fl.iif);
 
         nlh->nlmsg_len = skb_tail_pointer(skb) - b;
@@ -1677,15 +1683,15 @@ static struct dn_route *dn_rt_cache_get_next(struct seq_file *seq, struct dn_rou
 {
         struct dn_rt_cache_iter_state *s = seq->private;
 
-        rt = rt->dst.dn_next;
-        while(!rt) {
+        rt = rcu_dereference_bh(rt->dst.dn_next);
+        while (!rt) {
                 rcu_read_unlock_bh();
                 if (--s->bucket < 0)
                         break;
                 rcu_read_lock_bh();
-                rt = dn_rt_hash_table[s->bucket].chain;
+                rt = rcu_dereference_bh(dn_rt_hash_table[s->bucket].chain);
         }
-        return rcu_dereference_bh(rt);
+        return rt;
 }
 
 static void *dn_rt_cache_seq_start(struct seq_file *seq, loff_t *pos)
diff --git a/net/decnet/dn_rules.c b/net/decnet/dn_rules.c
index 48fdf10be7a..6eb91df3c55 100644
--- a/net/decnet/dn_rules.c
+++ b/net/decnet/dn_rules.c
@@ -175,7 +175,7 @@ static int dn_fib_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh,
 
 unsigned dnet_addr_type(__le16 addr)
 {
-        struct flowi fl = { .nl_u = { .dn_u = { .daddr = addr } } };
+        struct flowi fl = { .fld_dst = addr };
         struct dn_fib_res res;
         unsigned ret = RTN_UNICAST;
         struct dn_fib_table *tb = dn_fib_get_table(RT_TABLE_LOCAL, 0);
diff --git a/net/dns_resolver/Makefile b/net/dns_resolver/Makefile
index c0ef4e71dc4..d5c13c2eb36 100644
--- a/net/dns_resolver/Makefile
+++ b/net/dns_resolver/Makefile
@@ -4,4 +4,4 @@
 
 obj-$(CONFIG_DNS_RESOLVER) += dns_resolver.o
 
-dns_resolver-objs :=  dns_key.o dns_query.o
+dns_resolver-y :=  dns_key.o dns_query.o
diff --git a/net/econet/Makefile b/net/econet/Makefile
index 39f0a77abdb..05fae8be2fe 100644
--- a/net/econet/Makefile
+++ b/net/econet/Makefile
@@ -4,4 +4,4 @@
 
 obj-$(CONFIG_ECONET) += econet.o
 
-econet-objs := af_econet.o
+econet-y := af_econet.o
diff --git a/net/ieee802154/af_ieee802154.c b/net/ieee802154/af_ieee802154.c
index 93c91b633a5..6df6ecf4970 100644
--- a/net/ieee802154/af_ieee802154.c
+++ b/net/ieee802154/af_ieee802154.c
@@ -52,11 +52,11 @@ struct net_device *ieee802154_get_dev(struct net *net,
 
         switch (addr->addr_type) {
         case IEEE802154_ADDR_LONG:
-                rtnl_lock();
-                dev = dev_getbyhwaddr(net, ARPHRD_IEEE802154, addr->hwaddr);
+                rcu_read_lock();
+                dev = dev_getbyhwaddr_rcu(net, ARPHRD_IEEE802154, addr->hwaddr);
                 if (dev)
                         dev_hold(dev);
-                rtnl_unlock();
+                rcu_read_unlock();
                 break;
         case IEEE802154_ADDR_SHORT:
                 if (addr->pan_id == 0xffff ||
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index f581f77d109..f2b61107df6 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1148,21 +1148,13 @@ int inet_sk_rebuild_header(struct sock *sk)
         struct flowi fl = {
                 .oif = sk->sk_bound_dev_if,
                 .mark = sk->sk_mark,
-                .nl_u = {
-                        .ip4_u = {
-                                .daddr  = daddr,
-                                .saddr  = inet->inet_saddr,
-                                .tos    = RT_CONN_FLAGS(sk),
-                        },
-                },
+                .fl4_dst = daddr,
+                .fl4_src = inet->inet_saddr,
+                .fl4_tos = RT_CONN_FLAGS(sk),
                 .proto = sk->sk_protocol,
                 .flags = inet_sk_flowi_flags(sk),
-                .uli_u = {
-                        .ports = {
-                                .sport = inet->inet_sport,
-                                .dport = inet->inet_dport,
-                        },
-                },
+                .fl_ip_sport = inet->inet_sport,
+                .fl_ip_dport = inet->inet_dport,
         };
 
         security_sk_classify_flow(sk, &fl);
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index d8e540c5b07..a2fc7b961db 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -433,8 +433,8 @@ static int arp_ignore(struct in_device *in_dev, __be32 sip, __be32 tip)
 
 static int arp_filter(__be32 sip, __be32 tip, struct net_device *dev)
 {
-        struct flowi fl = { .nl_u = { .ip4_u = { .daddr = sip,
-                                                 .saddr = tip } } };
+        struct flowi fl = { .fl4_dst = sip,
+                            .fl4_src = tip };
         struct rtable *rt;
         int flag = 0;
         /*unsigned long now; */
@@ -883,7 +883,7 @@ static int arp_process(struct sk_buff *skb)
 
                         dont_send = arp_ignore(in_dev, sip, tip);
                         if (!dont_send && IN_DEV_ARPFILTER(in_dev))
-                                dont_send |= arp_filter(sip, tip, dev);
+                                dont_send = arp_filter(sip, tip, dev);
                         if (!dont_send) {
                                 n = neigh_event_ns(&arp_tbl, sha, &sip, dev);
                                 if (n) {
@@ -1017,13 +1017,14 @@ static int arp_req_set_proxy(struct net *net, struct net_device *dev, int on)
                 IPV4_DEVCONF_ALL(net, PROXY_ARP) = on;
                 return 0;
         }
-        if (__in_dev_get_rtnl(dev)) {
-                IN_DEV_CONF_SET(__in_dev_get_rtnl(dev), PROXY_ARP, on);
+        if (__in_dev_get_rcu(dev)) {
+                IN_DEV_CONF_SET(__in_dev_get_rcu(dev), PROXY_ARP, on);
                 return 0;
         }
         return -ENXIO;
 }
 
+/* must be called with rcu_read_lock() */
 static int arp_req_set_public(struct net *net, struct arpreq *r,
                 struct net_device *dev)
 {
@@ -1033,7 +1034,7 @@ static int arp_req_set_public(struct net *net, struct arpreq *r,
         if (mask && mask != htonl(0xFFFFFFFF))
                 return -EINVAL;
         if (!dev && (r->arp_flags & ATF_COM)) {
-                dev = dev_getbyhwaddr(net, r->arp_ha.sa_family,
+                dev = dev_getbyhwaddr_rcu(net, r->arp_ha.sa_family,
                                       r->arp_ha.sa_data);
                 if (!dev)
                         return -ENODEV;
@@ -1061,8 +1062,8 @@ static int arp_req_set(struct net *net, struct arpreq *r,
         if (r->arp_flags & ATF_PERM)
                 r->arp_flags |= ATF_COM;
         if (dev == NULL) {
-                struct flowi fl = { .nl_u.ip4_u = { .daddr = ip,
-                                                    .tos = RTO_ONLINK } };
+                struct flowi fl = { .fl4_dst = ip,
+                                    .fl4_tos = RTO_ONLINK };
                 struct rtable *rt;
                 err = ip_route_output_key(net, &rt, &fl);
                 if (err != 0)
@@ -1169,8 +1170,8 @@ static int arp_req_delete(struct net *net, struct arpreq *r,
 
         ip = ((struct sockaddr_in *)&r->arp_pa)->sin_addr.s_addr;
         if (dev == NULL) {
-                struct flowi fl = { .nl_u.ip4_u = { .daddr = ip,
-                                                    .tos = RTO_ONLINK } };
+                struct flowi fl = { .fl4_dst = ip,
+                                    .fl4_tos = RTO_ONLINK };
                 struct rtable *rt;
                 err = ip_route_output_key(net, &rt, &fl);
                 if (err != 0)
@@ -1225,10 +1226,10 @@ int arp_ioctl(struct net *net, unsigned int cmd, void __user *arg)
         if (!(r.arp_flags & ATF_NETMASK))
                 ((struct sockaddr_in *)&r.arp_netmask)->sin_addr.s_addr =
                                                            htonl(0xFFFFFFFFUL);
-        rtnl_lock();
+        rcu_read_lock();
         if (r.arp_dev[0]) {
                 err = -ENODEV;
-                dev = __dev_get_by_name(net, r.arp_dev);
+                dev = dev_get_by_name_rcu(net, r.arp_dev);
                 if (dev == NULL)
                         goto out;
 
@@ -1252,12 +1253,12 @@ int arp_ioctl(struct net *net, unsigned int cmd, void __user *arg)
                 break;
         case SIOCGARP:
                 err = arp_req_get(&r, dev);
-                if (!err && copy_to_user(arg, &r, sizeof(r)))
-                        err = -EFAULT;
                 break;
         }
 out:
-        rtnl_unlock();
+        rcu_read_unlock();
+        if (cmd == SIOCGARP && !err && copy_to_user(arg, &r, sizeof(r)))
+                err = -EFAULT;
         return err;
 }
 
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index dc94b0316b7..3b067704ab3 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1256,6 +1256,87 @@ errout:
                 rtnl_set_sk_err(net, RTNLGRP_IPV4_IFADDR, err);
 }
 
+static size_t inet_get_link_af_size(const struct net_device *dev)
+{
+        struct in_device *in_dev = __in_dev_get_rtnl(dev);
+
+        if (!in_dev)
+                return 0;
+
+        return nla_total_size(IPV4_DEVCONF_MAX * 4); /* IFLA_INET_CONF */
+}
+
+static int inet_fill_link_af(struct sk_buff *skb, const struct net_device *dev)
+{
+        struct in_device *in_dev = __in_dev_get_rtnl(dev);
+        struct nlattr *nla;
+        int i;
+
+        if (!in_dev)
+                return -ENODATA;
+
+        nla = nla_reserve(skb, IFLA_INET_CONF, IPV4_DEVCONF_MAX * 4);
+        if (nla == NULL)
+                return -EMSGSIZE;
+
+        for (i = 0; i < IPV4_DEVCONF_MAX; i++)
+                ((u32 *) nla_data(nla))[i] = in_dev->cnf.data[i];
+
+        return 0;
+}
+
+static const struct nla_policy inet_af_policy[IFLA_INET_MAX+1] = {
+        [IFLA_INET_CONF]        = { .type = NLA_NESTED },
+};
+
+static int inet_validate_link_af(const struct net_device *dev,
+                                 const struct nlattr *nla)
+{
+        struct nlattr *a, *tb[IFLA_INET_MAX+1];
+        int err, rem;
+
+        if (dev && !__in_dev_get_rtnl(dev))
+                return -EAFNOSUPPORT;
+
+        err = nla_parse_nested(tb, IFLA_INET_MAX, nla, inet_af_policy);
+        if (err < 0)
+                return err;
+
+        if (tb[IFLA_INET_CONF]) {
+                nla_for_each_nested(a, tb[IFLA_INET_CONF], rem) {
+                        int cfgid = nla_type(a);
+
+                        if (nla_len(a) < 4)
+                                return -EINVAL;
+
+                        if (cfgid <= 0 || cfgid > IPV4_DEVCONF_MAX)
+                                return -EINVAL;
+                }
+        }
+
+        return 0;
+}
+
+static int inet_set_link_af(struct net_device *dev, const struct nlattr *nla)
+{
+        struct in_device *in_dev = __in_dev_get_rtnl(dev);
+        struct nlattr *a, *tb[IFLA_INET_MAX+1];
+        int rem;
+
+        if (!in_dev)
+                return -EAFNOSUPPORT;
+
+        if (nla_parse_nested(tb, IFLA_INET_MAX, nla, NULL) < 0)
+                BUG();
+
+        if (tb[IFLA_INET_CONF]) {
+                nla_for_each_nested(a, tb[IFLA_INET_CONF], rem)
+                        ipv4_devconf_set(in_dev, nla_type(a), nla_get_u32(a));
+        }
+
+        return 0;
+}
+
 #ifdef CONFIG_SYSCTL
 
 static void devinet_copy_dflt_conf(struct net *net, int i)
@@ -1619,6 +1700,14 @@ static __net_initdata struct pernet_operations devinet_ops = {
         .exit = devinet_exit_net,
 };
 
+static struct rtnl_af_ops inet_af_ops = {
+        .family           = AF_INET,
+        .fill_link_af     = inet_fill_link_af,
+        .get_link_af_size = inet_get_link_af_size,
+        .validate_link_af = inet_validate_link_af,
+        .set_link_af      = inet_set_link_af,
+};
+
 void __init devinet_init(void)
 {
         register_pernet_subsys(&devinet_ops);
@@ -1626,6 +1715,8 @@ void __init devinet_init(void)
         register_gifconf(PF_INET, inet_gifconf);
         register_netdevice_notifier(&ip_netdev_notifier);
 
+        rtnl_af_register(&inet_af_ops);
+
         rtnl_register(PF_INET, RTM_NEWADDR, inet_rtm_newaddr, NULL);
         rtnl_register(PF_INET, RTM_DELADDR, inet_rtm_deladdr, NULL);
         rtnl_register(PF_INET, RTM_GETADDR, NULL, inet_dump_ifaddr);
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index eb6f69a8f27..d3a1112b9d9 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -158,11 +158,7 @@ static void fib_flush(struct net *net)
 struct net_device *__ip_dev_find(struct net *net, __be32 addr, bool devref)
 {
         struct flowi fl = {
-                .nl_u = {
-                        .ip4_u = {
-                                .daddr = addr
-                        }
-                },
+                .fl4_dst = addr,
                 .flags = FLOWI_FLAG_MATCH_ANY_IIF
         };
         struct fib_result res = { 0 };
@@ -193,7 +189,7 @@ static inline unsigned __inet_dev_addr_type(struct net *net,
                                             const struct net_device *dev,
                                             __be32 addr)
 {
-        struct flowi            fl = { .nl_u = { .ip4_u = { .daddr = addr } } };
+        struct flowi            fl = { .fl4_dst = addr };
         struct fib_result       res;
         unsigned ret = RTN_BROADCAST;
         struct fib_table *local_table;
@@ -247,13 +243,9 @@ int fib_validate_source(__be32 src, __be32 dst, u8 tos, int oif,
 {
         struct in_device *in_dev;
         struct flowi fl = {
-                .nl_u = {
-                        .ip4_u = {
-                                .daddr = src,
-                                .saddr = dst,
-                                .tos = tos
-                        }
-                },
+                .fl4_dst = src,
+                .fl4_src = dst,
+                .fl4_tos = tos,
                 .mark = mark,
                 .iif = oif
         };
@@ -853,13 +845,9 @@ static void nl_fib_lookup(struct fib_result_nl *frn, struct fib_table *tb)
         struct fib_result       res;
         struct flowi            fl = {
                 .mark = frn->fl_mark,
-                .nl_u = {
-                        .ip4_u = {
-                                .daddr = frn->fl_addr,
-                                .tos = frn->fl_tos,
-                                .scope = frn->fl_scope
-                        }
-                }
+                .fl4_dst = frn->fl_addr,
+                .fl4_tos = frn->fl_tos,
+                .fl4_scope = frn->fl_scope,
         };
 
 #ifdef CONFIG_IP_MULTIPLE_TABLES
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index 3e0da3ef611..12d3dc3df1b 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -563,12 +563,8 @@ static int fib_check_nh(struct fib_config *cfg, struct fib_info *fi,
                 rcu_read_lock();
                 {
                         struct flowi fl = {
-                                .nl_u = {
-                                        .ip4_u = {
-                                                .daddr = nh->nh_gw,
-                                                .scope = cfg->fc_scope + 1,
-                                        },
-                                },
+                                .fl4_dst = nh->nh_gw,
+                                .fl4_scope = cfg->fc_scope + 1,
                                 .oif = nh->nh_oif,
                         };
 
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index e5d1a44bcbd..4aa1b7f01ea 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -386,10 +386,9 @@ static void icmp_reply(struct icmp_bxm *icmp_param, struct sk_buff *skb)
                         daddr = icmp_param->replyopts.faddr;
         }
         {
-                struct flowi fl = { .nl_u = { .ip4_u =
-                                              { .daddr = daddr,
-                                                .saddr = rt->rt_spec_dst,
-                                                .tos = RT_TOS(ip_hdr(skb)->tos) } },
+                struct flowi fl = { .fl4_dst= daddr,
+                                    .fl4_src = rt->rt_spec_dst,
+                                    .fl4_tos = RT_TOS(ip_hdr(skb)->tos),
                                     .proto = IPPROTO_ICMP };
                 security_skb_classify_flow(skb, &fl);
                 if (ip_route_output_key(net, &rt, &fl))
@@ -506,8 +505,8 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
                 struct net_device *dev = NULL;
 
                 rcu_read_lock();
-                if (rt->fl.iif &&
-                        net->ipv4.sysctl_icmp_errors_use_inbound_ifaddr)
+                if (rt_is_input_route(rt) &&
+                    net->ipv4.sysctl_icmp_errors_use_inbound_ifaddr)
                         dev = dev_get_by_index_rcu(net, rt->fl.iif);
 
                 if (dev)
@@ -542,22 +541,13 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
 
         {
                 struct flowi fl = {
-                        .nl_u = {
-                                .ip4_u = {
-                                        .daddr = icmp_param.replyopts.srr ?
-                                                icmp_param.replyopts.faddr :
-                                                iph->saddr,
-                                        .saddr = saddr,
-                                        .tos = RT_TOS(tos)
-                                }
-                        },
+                        .fl4_dst = icmp_param.replyopts.srr ?
+                                   icmp_param.replyopts.faddr : iph->saddr,
+                        .fl4_src = saddr,
+                        .fl4_tos = RT_TOS(tos),
                         .proto = IPPROTO_ICMP,
-                        .uli_u = {
-                                .icmpt = {
-                                        .type = type,
-                                        .code = code
-                                }
-                        }
+                        .fl_icmp_type = type,
+                        .fl_icmp_code = code,
                 };
                 int err;
                 struct rtable *rt2;
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 3c53c2d89e3..e0e77e297de 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -149,21 +149,37 @@ static void ip_mc_clear_src(struct ip_mc_list *pmc);
 static int ip_mc_add_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
                          int sfcount, __be32 *psfsrc, int delta);
 
+
+static void ip_mc_list_reclaim(struct rcu_head *head)
+{
+        kfree(container_of(head, struct ip_mc_list, rcu));
+}
+
 static void ip_ma_put(struct ip_mc_list *im)
 {
         if (atomic_dec_and_test(&im->refcnt)) {
                 in_dev_put(im->interface);
-                kfree(im);
+                call_rcu(&im->rcu, ip_mc_list_reclaim);
         }
 }
 
+#define for_each_pmc_rcu(in_dev, pmc)                           \
+        for (pmc = rcu_dereference(in_dev->mc_list);            \
+             pmc != NULL;                                       \
+             pmc = rcu_dereference(pmc->next_rcu))
+
+#define for_each_pmc_rtnl(in_dev, pmc)                          \
+        for (pmc = rtnl_dereference(in_dev->mc_list);           \
+             pmc != NULL;                                       \
+             pmc = rtnl_dereference(pmc->next_rcu))
+
 #ifdef CONFIG_IP_MULTICAST
 
 /*
  *      Timer management
  */
 
-static __inline__ void igmp_stop_timer(struct ip_mc_list *im)
+static void igmp_stop_timer(struct ip_mc_list *im)
 {
         spin_lock_bh(&im->lock);
         if (del_timer(&im->timer))
@@ -284,6 +300,8 @@ igmp_scount(struct ip_mc_list *pmc, int type, int gdeleted, int sdeleted)
         return scount;
 }
 
+#define igmp_skb_size(skb) (*(unsigned int *)((skb)->cb))
+
 static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
 {
         struct sk_buff *skb;
@@ -292,14 +310,20 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
         struct igmpv3_report *pig;
         struct net *net = dev_net(dev);
 
-        skb = alloc_skb(size + LL_ALLOCATED_SPACE(dev), GFP_ATOMIC);
-        if (skb == NULL)
-                return NULL;
+        while (1) {
+                skb = alloc_skb(size + LL_ALLOCATED_SPACE(dev),
+                                GFP_ATOMIC | __GFP_NOWARN);
+                if (skb)
+                        break;
+                size >>= 1;
+                if (size < 256)
+                        return NULL;
+        }
+        igmp_skb_size(skb) = size;
 
         {
                 struct flowi fl = { .oif = dev->ifindex,
-                                    .nl_u = { .ip4_u = {
-                                    .daddr = IGMPV3_ALL_MCR } },
+                                    .fl4_dst = IGMPV3_ALL_MCR,
                                     .proto = IPPROTO_IGMP };
                 if (ip_route_output_key(net, &rt, &fl)) {
                         kfree_skb(skb);
@@ -384,7 +408,7 @@ static struct sk_buff *add_grhead(struct sk_buff *skb, struct ip_mc_list *pmc,
         return skb;
 }
 
-#define AVAILABLE(skb) ((skb) ? ((skb)->dev ? (skb)->dev->mtu - (skb)->len : \
+#define AVAILABLE(skb) ((skb) ? ((skb)->dev ? igmp_skb_size(skb) - (skb)->len : \
         skb_tailroom(skb)) : 0)
 
 static struct sk_buff *add_grec(struct sk_buff *skb, struct ip_mc_list *pmc,
@@ -502,8 +526,8 @@ static int igmpv3_send_report(struct in_device *in_dev, struct ip_mc_list *pmc)
         int type;
 
         if (!pmc) {
-                read_lock(&in_dev->mc_list_lock);
-                for (pmc=in_dev->mc_list; pmc; pmc=pmc->next) {
+                rcu_read_lock();
+                for_each_pmc_rcu(in_dev, pmc) {
                         if (pmc->multiaddr == IGMP_ALL_HOSTS)
                                 continue;
                         spin_lock_bh(&pmc->lock);
@@ -514,7 +538,7 @@ static int igmpv3_send_report(struct in_device *in_dev, struct ip_mc_list *pmc)
                         skb = add_grec(skb, pmc, type, 0, 0);
                         spin_unlock_bh(&pmc->lock);
                 }
-                read_unlock(&in_dev->mc_list_lock);
+                rcu_read_unlock();
         } else {
                 spin_lock_bh(&pmc->lock);
                 if (pmc->sfcount[MCAST_EXCLUDE])
@@ -556,7 +580,7 @@ static void igmpv3_send_cr(struct in_device *in_dev)
         struct sk_buff *skb = NULL;
         int type, dtype;
 
-        read_lock(&in_dev->mc_list_lock);
+        rcu_read_lock();
         spin_lock_bh(&in_dev->mc_tomb_lock);
 
         /* deleted MCA's */
@@ -593,7 +617,7 @@ static void igmpv3_send_cr(struct in_device *in_dev)
         spin_unlock_bh(&in_dev->mc_tomb_lock);
 
         /* change recs */
-        for (pmc=in_dev->mc_list; pmc; pmc=pmc->next) {
+        for_each_pmc_rcu(in_dev, pmc) {
                 spin_lock_bh(&pmc->lock);
                 if (pmc->sfcount[MCAST_EXCLUDE]) {
                         type = IGMPV3_BLOCK_OLD_SOURCES;
@@ -616,7 +640,7 @@ static void igmpv3_send_cr(struct in_device *in_dev)
                 }
                 spin_unlock_bh(&pmc->lock);
         }
-        read_unlock(&in_dev->mc_list_lock);
+        rcu_read_unlock();
 
         if (!skb)
                 return;
@@ -644,7 +668,7 @@ static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc,
 
         {
                 struct flowi fl = { .oif = dev->ifindex,
-                                    .nl_u = { .ip4_u = { .daddr = dst } },
+                                    .fl4_dst = dst,
                                     .proto = IPPROTO_IGMP };
                 if (ip_route_output_key(net, &rt, &fl))
                         return -1;
@@ -813,14 +837,14 @@ static void igmp_heard_report(struct in_device *in_dev, __be32 group)
         if (group == IGMP_ALL_HOSTS)
                 return;
 
-        read_lock(&in_dev->mc_list_lock);
-        for (im=in_dev->mc_list; im!=NULL; im=im->next) {
+        rcu_read_lock();
+        for_each_pmc_rcu(in_dev, im) {
                 if (im->multiaddr == group) {
                         igmp_stop_timer(im);
                         break;
                 }
         }
-        read_unlock(&in_dev->mc_list_lock);
+        rcu_read_unlock();
 }
 
 static void igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
@@ -906,8 +930,8 @@ static void igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
          * - Use the igmp->igmp_code field as the maximum
          *   delay possible
          */
-        read_lock(&in_dev->mc_list_lock);
-        for (im=in_dev->mc_list; im!=NULL; im=im->next) {
+        rcu_read_lock();
+        for_each_pmc_rcu(in_dev, im) {
                 int changed;
 
                 if (group && group != im->multiaddr)
@@ -925,7 +949,7 @@ static void igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
                 if (changed)
                         igmp_mod_timer(im, max_delay);
         }
-        read_unlock(&in_dev->mc_list_lock);
+        rcu_read_unlock();
 }
 
 /* called in rcu_read_lock() section */
@@ -961,7 +985,7 @@ int igmp_rcv(struct sk_buff *skb)
         case IGMP_HOST_MEMBERSHIP_REPORT:
         case IGMPV2_HOST_MEMBERSHIP_REPORT:
                 /* Is it our report looped back? */
-                if (skb_rtable(skb)->fl.iif == 0)
+                if (rt_is_output_route(skb_rtable(skb)))
                         break;
                 /* don't rely on MC router hearing unicast reports */
                 if (skb->pkt_type == PACKET_MULTICAST ||
@@ -1110,8 +1134,8 @@ static void igmpv3_clear_delrec(struct in_device *in_dev)
                 kfree(pmc);
         }
         /* clear dead sources, too */
-        read_lock(&in_dev->mc_list_lock);
-        for (pmc=in_dev->mc_list; pmc; pmc=pmc->next) {
+        rcu_read_lock();
+        for_each_pmc_rcu(in_dev, pmc) {
                 struct ip_sf_list *psf, *psf_next;
 
                 spin_lock_bh(&pmc->lock);
@@ -1123,7 +1147,7 @@ static void igmpv3_clear_delrec(struct in_device *in_dev)
                         kfree(psf);
                 }
         }
-        read_unlock(&in_dev->mc_list_lock);
+        rcu_read_unlock();
 }
 #endif
 
@@ -1209,7 +1233,7 @@ void ip_mc_inc_group(struct in_device *in_dev, __be32 addr)
 
         ASSERT_RTNL();
 
-        for (im=in_dev->mc_list; im; im=im->next) {
+        for_each_pmc_rtnl(in_dev, im) {
                 if (im->multiaddr == addr) {
                         im->users++;
                         ip_mc_add_src(in_dev, &addr, MCAST_EXCLUDE, 0, NULL, 0);
@@ -1217,7 +1241,7 @@ void ip_mc_inc_group(struct in_device *in_dev, __be32 addr)
                 }
         }
 
-        im = kmalloc(sizeof(*im), GFP_KERNEL);
+        im = kzalloc(sizeof(*im), GFP_KERNEL);
         if (!im)
                 goto out;
 
@@ -1227,26 +1251,18 @@ void ip_mc_inc_group(struct in_device *in_dev, __be32 addr)
         im->multiaddr = addr;
         /* initial mode is (EX, empty) */
         im->sfmode = MCAST_EXCLUDE;
-        im->sfcount[MCAST_INCLUDE] = 0;
         im->sfcount[MCAST_EXCLUDE] = 1;
-        im->sources = NULL;
-        im->tomb = NULL;
-        im->crcount = 0;
         atomic_set(&im->refcnt, 1);
         spin_lock_init(&im->lock);
 #ifdef CONFIG_IP_MULTICAST
-        im->tm_running = 0;
         setup_timer(&im->timer, &igmp_timer_expire, (unsigned long)im);
         im->unsolicit_count = IGMP_Unsolicited_Report_Count;
-        im->reporter = 0;
-        im->gsquery = 0;
 #endif
-        im->loaded = 0;
-        write_lock_bh(&in_dev->mc_list_lock);
-        im->next = in_dev->mc_list;
-        in_dev->mc_list = im;
+
+        im->next_rcu = in_dev->mc_list;
         in_dev->mc_count++;
-        write_unlock_bh(&in_dev->mc_list_lock);
+        rcu_assign_pointer(in_dev->mc_list, im);
+
 #ifdef CONFIG_IP_MULTICAST
         igmpv3_del_delrec(in_dev, im->multiaddr);
 #endif
@@ -1260,26 +1276,32 @@ EXPORT_SYMBOL(ip_mc_inc_group);
 
 /*
  *      Resend IGMP JOIN report; used for bonding.
+ *      Called with rcu_read_lock()
  */
-void ip_mc_rejoin_group(struct ip_mc_list *im)
+void ip_mc_rejoin_groups(struct in_device *in_dev)
 {
 #ifdef CONFIG_IP_MULTICAST
-        struct in_device *in_dev = im->interface;
+        struct ip_mc_list *im;
+        int type;
 
-        if (im->multiaddr == IGMP_ALL_HOSTS)
-                return;
+        for_each_pmc_rcu(in_dev, im) {
+                if (im->multiaddr == IGMP_ALL_HOSTS)
+                        continue;
 
-        /* a failover is happening and switches
-         * must be notified immediately */
-        if (IGMP_V1_SEEN(in_dev))
-                igmp_send_report(in_dev, im, IGMP_HOST_MEMBERSHIP_REPORT);
-        else if (IGMP_V2_SEEN(in_dev))
-                igmp_send_report(in_dev, im, IGMPV2_HOST_MEMBERSHIP_REPORT);
-        else
-                igmp_send_report(in_dev, im, IGMPV3_HOST_MEMBERSHIP_REPORT);
+                /* a failover is happening and switches
+                 * must be notified immediately
+                 */
+                if (IGMP_V1_SEEN(in_dev))
+                        type = IGMP_HOST_MEMBERSHIP_REPORT;
+                else if (IGMP_V2_SEEN(in_dev))
+                        type = IGMPV2_HOST_MEMBERSHIP_REPORT;
+                else
+                        type = IGMPV3_HOST_MEMBERSHIP_REPORT;
+                igmp_send_report(in_dev, im, type);
+        }
 #endif
 }
-EXPORT_SYMBOL(ip_mc_rejoin_group);
+EXPORT_SYMBOL(ip_mc_rejoin_groups);
 
 /*
  *      A socket has left a multicast group on device dev
@@ -1287,17 +1309,18 @@ EXPORT_SYMBOL(ip_mc_rejoin_group);
 
 void ip_mc_dec_group(struct in_device *in_dev, __be32 addr)
 {
-        struct ip_mc_list *i, **ip;
+        struct ip_mc_list *i;
+        struct ip_mc_list __rcu **ip;
 
         ASSERT_RTNL();
 
-        for (ip=&in_dev->mc_list; (i=*ip)!=NULL; ip=&i->next) {
+        for (ip = &in_dev->mc_list;
+             (i = rtnl_dereference(*ip)) != NULL;
+             ip = &i->next_rcu) {
                 if (i->multiaddr == addr) {
                         if (--i->users == 0) {
-                                write_lock_bh(&in_dev->mc_list_lock);
-                                *ip = i->next;
+                                *ip = i->next_rcu;
                                 in_dev->mc_count--;
-                                write_unlock_bh(&in_dev->mc_list_lock);
                                 igmp_group_dropped(i);
 
                                 if (!in_dev->dead)
@@ -1316,34 +1339,34 @@ EXPORT_SYMBOL(ip_mc_dec_group);
 
 void ip_mc_unmap(struct in_device *in_dev)
 {
-        struct ip_mc_list *i;
+        struct ip_mc_list *pmc;
 
         ASSERT_RTNL();
 
-        for (i = in_dev->mc_list; i; i = i->next)
-                igmp_group_dropped(i);
+        for_each_pmc_rtnl(in_dev, pmc)
+                igmp_group_dropped(pmc);
 }
 
 void ip_mc_remap(struct in_device *in_dev)
 {
-        struct ip_mc_list *i;
+        struct ip_mc_list *pmc;
 
         ASSERT_RTNL();
 
-        for (i = in_dev->mc_list; i; i = i->next)
-                igmp_group_added(i);
+        for_each_pmc_rtnl(in_dev, pmc)
+                igmp_group_added(pmc);
 }
 
 /* Device going down */
 
 void ip_mc_down(struct in_device *in_dev)
 {
-        struct ip_mc_list *i;
+        struct ip_mc_list *pmc;
 
         ASSERT_RTNL();
 
-        for (i=in_dev->mc_list; i; i=i->next)
-                igmp_group_dropped(i);
+        for_each_pmc_rtnl(in_dev, pmc)
+                igmp_group_dropped(pmc);
 
 #ifdef CONFIG_IP_MULTICAST
         in_dev->mr_ifc_count = 0;
@@ -1374,7 +1397,6 @@ void ip_mc_init_dev(struct in_device *in_dev)
         in_dev->mr_qrv = IGMP_Unsolicited_Report_Count;
 #endif
 
-        rwlock_init(&in_dev->mc_list_lock);
         spin_lock_init(&in_dev->mc_tomb_lock);
 }
 
@@ -1382,14 +1404,14 @@ void ip_mc_init_dev(struct in_device *in_dev)
 
 void ip_mc_up(struct in_device *in_dev)
 {
-        struct ip_mc_list *i;
+        struct ip_mc_list *pmc;
 
         ASSERT_RTNL();
 
         ip_mc_inc_group(in_dev, IGMP_ALL_HOSTS);
 
-        for (i=in_dev->mc_list; i; i=i->next)
-                igmp_group_added(i);
+        for_each_pmc_rtnl(in_dev, pmc)
+                igmp_group_added(pmc);
 }
 
 /*
@@ -1405,24 +1427,19 @@ void ip_mc_destroy_dev(struct in_device *in_dev)
         /* Deactivate timers */
         ip_mc_down(in_dev);
 
-        write_lock_bh(&in_dev->mc_list_lock);
-        while ((i = in_dev->mc_list) != NULL) {
-                in_dev->mc_list = i->next;
+        while ((i = rtnl_dereference(in_dev->mc_list)) != NULL) {
+                in_dev->mc_list = i->next_rcu;
                 in_dev->mc_count--;
-                write_unlock_bh(&in_dev->mc_list_lock);
+
                 igmp_group_dropped(i);
                 ip_ma_put(i);
-
-                write_lock_bh(&in_dev->mc_list_lock);
         }
-        write_unlock_bh(&in_dev->mc_list_lock);
 }
 
 /* RTNL is locked */
 static struct in_device *ip_mc_find_dev(struct net *net, struct ip_mreqn *imr)
 {
-        struct flowi fl = { .nl_u = { .ip4_u =
-                                      { .daddr = imr->imr_multiaddr.s_addr } } };
+        struct flowi fl = { .fl4_dst = imr->imr_multiaddr.s_addr };
         struct rtable *rt;
         struct net_device *dev = NULL;
         struct in_device *idev = NULL;
@@ -1513,18 +1530,18 @@ static int ip_mc_del_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
 
         if (!in_dev)
                 return -ENODEV;
-        read_lock(&in_dev->mc_list_lock);
-        for (pmc=in_dev->mc_list; pmc; pmc=pmc->next) {
+        rcu_read_lock();
+        for_each_pmc_rcu(in_dev, pmc) {
                 if (*pmca == pmc->multiaddr)
                         break;
         }
         if (!pmc) {
                 /* MCA not found?? bug */
-                read_unlock(&in_dev->mc_list_lock);
+                rcu_read_unlock();
                 return -ESRCH;
         }
         spin_lock_bh(&pmc->lock);
-        read_unlock(&in_dev->mc_list_lock);
+        rcu_read_unlock();
 #ifdef CONFIG_IP_MULTICAST
         sf_markstate(pmc);
 #endif
@@ -1685,18 +1702,18 @@ static int ip_mc_add_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
 
         if (!in_dev)
                 return -ENODEV;
-        read_lock(&in_dev->mc_list_lock);
-        for (pmc=in_dev->mc_list; pmc; pmc=pmc->next) {
+        rcu_read_lock();
+        for_each_pmc_rcu(in_dev, pmc) {
                 if (*pmca == pmc->multiaddr)
                         break;
         }
         if (!pmc) {
                 /* MCA not found?? bug */
-                read_unlock(&in_dev->mc_list_lock);
+                rcu_read_unlock();
                 return -ESRCH;
         }
         spin_lock_bh(&pmc->lock);
-        read_unlock(&in_dev->mc_list_lock);
+        rcu_read_unlock();
 
 #ifdef CONFIG_IP_MULTICAST
         sf_markstate(pmc);
@@ -1793,7 +1810,7 @@ int ip_mc_join_group(struct sock *sk , struct ip_mreqn *imr)
 
         err = -EADDRINUSE;
         ifindex = imr->imr_ifindex;
-        for (i = inet->mc_list; i; i = i->next) {
+        for_each_pmc_rtnl(inet, i) {
                 if (i->multi.imr_multiaddr.s_addr == addr &&
                     i->multi.imr_ifindex == ifindex)
                         goto done;
@@ -1807,7 +1824,7 @@ int ip_mc_join_group(struct sock *sk , struct ip_mreqn *imr)
                 goto done;
 
         memcpy(&iml->multi, imr, sizeof(*imr));
-        iml->next = inet->mc_list;
+        iml->next_rcu = inet->mc_list;
         iml->sflist = NULL;
         iml->sfmode = MCAST_EXCLUDE;
         rcu_assign_pointer(inet->mc_list, iml);
@@ -1821,17 +1838,14 @@ EXPORT_SYMBOL(ip_mc_join_group);
 
 static void ip_sf_socklist_reclaim(struct rcu_head *rp)
 {
-        struct ip_sf_socklist *psf;
-
-        psf = container_of(rp, struct ip_sf_socklist, rcu);
+        kfree(container_of(rp, struct ip_sf_socklist, rcu));
         /* sk_omem_alloc should have been decreased by the caller*/
-        kfree(psf);
 }
 
 static int ip_mc_leave_src(struct sock *sk, struct ip_mc_socklist *iml,
                            struct in_device *in_dev)
 {
-        struct ip_sf_socklist *psf = iml->sflist;
+        struct ip_sf_socklist *psf = rtnl_dereference(iml->sflist);
         int err;
 
         if (psf == NULL) {
@@ -1851,11 +1865,8 @@ static int ip_mc_leave_src(struct sock *sk, struct ip_mc_socklist *iml,
 
 static void ip_mc_socklist_reclaim(struct rcu_head *rp)
 {
-        struct ip_mc_socklist *iml;
-
-        iml = container_of(rp, struct ip_mc_socklist, rcu);
+        kfree(container_of(rp, struct ip_mc_socklist, rcu));
         /* sk_omem_alloc should have been decreased by the caller*/
-        kfree(iml);
 }
 
 
@@ -1866,7 +1877,8 @@ static void ip_mc_socklist_reclaim(struct rcu_head *rp)
 int ip_mc_leave_group(struct sock *sk, struct ip_mreqn *imr)
 {
         struct inet_sock *inet = inet_sk(sk);
-        struct ip_mc_socklist *iml, **imlp;
+        struct ip_mc_socklist *iml;
+        struct ip_mc_socklist __rcu **imlp;
         struct in_device *in_dev;
         struct net *net = sock_net(sk);
         __be32 group = imr->imr_multiaddr.s_addr;
@@ -1876,7 +1888,9 @@ int ip_mc_leave_group(struct sock *sk, struct ip_mreqn *imr)
         rtnl_lock();
         in_dev = ip_mc_find_dev(net, imr);
         ifindex = imr->imr_ifindex;
-        for (imlp = &inet->mc_list; (iml = *imlp) != NULL; imlp = &iml->next) {
+        for (imlp = &inet->mc_list;
+             (iml = rtnl_dereference(*imlp)) != NULL;
+             imlp = &iml->next_rcu) {
                 if (iml->multi.imr_multiaddr.s_addr != group)
                         continue;
                 if (ifindex) {
@@ -1888,7 +1902,7 @@ int ip_mc_leave_group(struct sock *sk, struct ip_mreqn *imr)
 
                 (void) ip_mc_leave_src(sk, iml, in_dev);
 
-                rcu_assign_pointer(*imlp, iml->next);
+                *imlp = iml->next_rcu;
 
                 if (in_dev)
                         ip_mc_dec_group(in_dev, group);
@@ -1934,7 +1948,7 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
         }
         err = -EADDRNOTAVAIL;
 
-        for (pmc=inet->mc_list; pmc; pmc=pmc->next) {
+        for_each_pmc_rtnl(inet, pmc) {
                 if ((pmc->multi.imr_multiaddr.s_addr ==
                      imr.imr_multiaddr.s_addr) &&
                     (pmc->multi.imr_ifindex == imr.imr_ifindex))
@@ -1958,7 +1972,7 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
                 pmc->sfmode = omode;
         }
 
-        psl = pmc->sflist;
+        psl = rtnl_dereference(pmc->sflist);
         if (!add) {
                 if (!psl)
                         goto done;      /* err = -EADDRNOTAVAIL */
@@ -2077,7 +2091,7 @@ int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex)
                 goto done;
         }
 
-        for (pmc=inet->mc_list; pmc; pmc=pmc->next) {
+        for_each_pmc_rtnl(inet, pmc) {
                 if (pmc->multi.imr_multiaddr.s_addr == msf->imsf_multiaddr &&
                     pmc->multi.imr_ifindex == imr.imr_ifindex)
                         break;
@@ -2107,7 +2121,7 @@ int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex)
                 (void) ip_mc_add_src(in_dev, &msf->imsf_multiaddr,
                                      msf->imsf_fmode, 0, NULL, 0);
         }
-        psl = pmc->sflist;
+        psl = rtnl_dereference(pmc->sflist);
         if (psl) {
                 (void) ip_mc_del_src(in_dev, &msf->imsf_multiaddr, pmc->sfmode,
                         psl->sl_count, psl->sl_addr, 0);
@@ -2155,7 +2169,7 @@ int ip_mc_msfget(struct sock *sk, struct ip_msfilter *msf,
         }
         err = -EADDRNOTAVAIL;
 
-        for (pmc=inet->mc_list; pmc; pmc=pmc->next) {
+        for_each_pmc_rtnl(inet, pmc) {
                 if (pmc->multi.imr_multiaddr.s_addr == msf->imsf_multiaddr &&
                     pmc->multi.imr_ifindex == imr.imr_ifindex)
                         break;
@@ -2163,7 +2177,7 @@ int ip_mc_msfget(struct sock *sk, struct ip_msfilter *msf,
         if (!pmc)               /* must have a prior join */
                 goto done;
         msf->imsf_fmode = pmc->sfmode;
-        psl = pmc->sflist;
+        psl = rtnl_dereference(pmc->sflist);
         rtnl_unlock();
         if (!psl) {
                 len = 0;
@@ -2208,7 +2222,7 @@ int ip_mc_gsfget(struct sock *sk, struct group_filter *gsf,
 
         err = -EADDRNOTAVAIL;
 
-        for (pmc=inet->mc_list; pmc; pmc=pmc->next) {
+        for_each_pmc_rtnl(inet, pmc) {
                 if (pmc->multi.imr_multiaddr.s_addr == addr &&
                     pmc->multi.imr_ifindex == gsf->gf_interface)
                         break;
@@ -2216,7 +2230,7 @@ int ip_mc_gsfget(struct sock *sk, struct group_filter *gsf,
         if (!pmc)               /* must have a prior join */
                 goto done;
         gsf->gf_fmode = pmc->sfmode;
-        psl = pmc->sflist;
+        psl = rtnl_dereference(pmc->sflist);
         rtnl_unlock();
         count = psl ? psl->sl_count : 0;
         copycount = count < gsf->gf_numsrc ? count : gsf->gf_numsrc;
@@ -2257,7 +2271,7 @@ int ip_mc_sf_allow(struct sock *sk, __be32 loc_addr, __be32 rmt_addr, int dif)
                 goto out;
 
         rcu_read_lock();
-        for (pmc=rcu_dereference(inet->mc_list); pmc; pmc=rcu_dereference(pmc->next)) {
+        for_each_pmc_rcu(inet, pmc) {
                 if (pmc->multi.imr_multiaddr.s_addr == loc_addr &&
                     pmc->multi.imr_ifindex == dif)
                         break;
@@ -2265,7 +2279,7 @@ int ip_mc_sf_allow(struct sock *sk, __be32 loc_addr, __be32 rmt_addr, int dif)
         ret = inet->mc_all;
         if (!pmc)
                 goto unlock;
-        psl = pmc->sflist;
+        psl = rcu_dereference(pmc->sflist);
         ret = (pmc->sfmode == MCAST_EXCLUDE);
         if (!psl)
                 goto unlock;
@@ -2300,10 +2314,10 @@ void ip_mc_drop_socket(struct sock *sk)
                 return;
 
         rtnl_lock();
-        while ((iml = inet->mc_list) != NULL) {
+        while ((iml = rtnl_dereference(inet->mc_list)) != NULL) {
                 struct in_device *in_dev;
-                rcu_assign_pointer(inet->mc_list, iml->next);
 
+                inet->mc_list = iml->next_rcu;
                 in_dev = inetdev_by_index(net, iml->multi.imr_ifindex);
                 (void) ip_mc_leave_src(sk, iml, in_dev);
                 if (in_dev != NULL)
@@ -2321,8 +2335,8 @@ int ip_check_mc(struct in_device *in_dev, __be32 mc_addr, __be32 src_addr, u16 p
         struct ip_sf_list *psf;
         int rv = 0;
 
-        read_lock(&in_dev->mc_list_lock);
-        for (im=in_dev->mc_list; im; im=im->next) {
+        rcu_read_lock();
+        for_each_pmc_rcu(in_dev, im) {
                 if (im->multiaddr == mc_addr)
                         break;
         }
@@ -2343,7 +2357,7 @@ int ip_check_mc(struct in_device *in_dev, __be32 mc_addr, __be32 src_addr, u16 p
                 } else
                         rv = 1; /* unspecified source; tentatively allow */
         }
-        read_unlock(&in_dev->mc_list_lock);
+        rcu_read_unlock();
         return rv;
 }
 
@@ -2369,13 +2383,11 @@ static inline struct ip_mc_list *igmp_mc_get_first(struct seq_file *seq)
                 in_dev = __in_dev_get_rcu(state->dev);
                 if (!in_dev)
                         continue;
-                read_lock(&in_dev->mc_list_lock);
-                im = in_dev->mc_list;
+                im = rcu_dereference(in_dev->mc_list);
                 if (im) {
                         state->in_dev = in_dev;
                         break;
                 }
-                read_unlock(&in_dev->mc_list_lock);
         }
         return im;
 }
@@ -2383,11 +2395,9 @@ static inline struct ip_mc_list *igmp_mc_get_first(struct seq_file *seq)
 static struct ip_mc_list *igmp_mc_get_next(struct seq_file *seq, struct ip_mc_list *im)
 {
         struct igmp_mc_iter_state *state = igmp_mc_seq_private(seq);
-        im = im->next;
-        while (!im) {
-                if (likely(state->in_dev != NULL))
-                        read_unlock(&state->in_dev->mc_list_lock);
 
+        im = rcu_dereference(im->next_rcu);
+        while (!im) {
                 state->dev = next_net_device_rcu(state->dev);
                 if (!state->dev) {
                         state->in_dev = NULL;
@@ -2396,8 +2406,7 @@ static struct ip_mc_list *igmp_mc_get_next(struct seq_file *seq, struct ip_mc_li
                 state->in_dev = __in_dev_get_rcu(state->dev);
                 if (!state->in_dev)
                         continue;
-                read_lock(&state->in_dev->mc_list_lock);
-                im = state->in_dev->mc_list;
+                im = rcu_dereference(state->in_dev->mc_list);
         }
         return im;
 }
@@ -2433,10 +2442,8 @@ static void igmp_mc_seq_stop(struct seq_file *seq, void *v)
         __releases(rcu)
 {
         struct igmp_mc_iter_state *state = igmp_mc_seq_private(seq);
-        if (likely(state->in_dev != NULL)) {
-                read_unlock(&state->in_dev->mc_list_lock);
-                state->in_dev = NULL;
-        }
+
+        state->in_dev = NULL;
         state->dev = NULL;
         rcu_read_unlock();
 }
@@ -2458,7 +2465,7 @@ static int igmp_mc_seq_show(struct seq_file *seq, void *v)
                 querier = "NONE";
 #endif
 
-                if (state->in_dev->mc_list == im) {
+                if (rcu_dereference(state->in_dev->mc_list) == im) {
                         seq_printf(seq, "%d\t%-10s: %5d %7s\n",
                                    state->dev->ifindex, state->dev->name, state->in_dev->mc_count, querier);
                 }
@@ -2517,8 +2524,7 @@ static inline struct ip_sf_list *igmp_mcf_get_first(struct seq_file *seq)
                 idev = __in_dev_get_rcu(state->dev);
                 if (unlikely(idev == NULL))
                         continue;
-                read_lock(&idev->mc_list_lock);
-                im = idev->mc_list;
+                im = rcu_dereference(idev->mc_list);
                 if (likely(im != NULL)) {
                         spin_lock_bh(&im->lock);
                         psf = im->sources;
@@ -2529,7 +2535,6 @@ static inline struct ip_sf_list *igmp_mcf_get_first(struct seq_file *seq)
                         }
                         spin_unlock_bh(&im->lock);
                 }
-                read_unlock(&idev->mc_list_lock);
         }
         return psf;
 }
@@ -2543,9 +2548,6 @@ static struct ip_sf_list *igmp_mcf_get_next(struct seq_file *seq, struct ip_sf_l
                 spin_unlock_bh(&state->im->lock);
                 state->im = state->im->next;
                 while (!state->im) {
-                        if (likely(state->idev != NULL))
-                                read_unlock(&state->idev->mc_list_lock);
-
                         state->dev = next_net_device_rcu(state->dev);
                         if (!state->dev) {
                                 state->idev = NULL;
@@ -2554,8 +2556,7 @@ static struct ip_sf_list *igmp_mcf_get_next(struct seq_file *seq, struct ip_sf_l
                         state->idev = __in_dev_get_rcu(state->dev);
                         if (!state->idev)
                                 continue;
-                        read_lock(&state->idev->mc_list_lock);
-                        state->im = state->idev->mc_list;
+                        state->im = rcu_dereference(state->idev->mc_list);
                 }
                 if (!state->im)
                         break;
@@ -2601,10 +2602,7 @@ static void igmp_mcf_seq_stop(struct seq_file *seq, void *v)
                 spin_unlock_bh(&state->im->lock);
                 state->im = NULL;
         }
-        if (likely(state->idev != NULL)) {
-                read_unlock(&state->idev->mc_list_lock);
-                state->idev = NULL;
-        }
+        state->idev = NULL;
         state->dev = NULL;
         rcu_read_unlock();
 }
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 7174370b119..06f5f8f482f 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -358,17 +358,14 @@ struct dst_entry *inet_csk_route_req(struct sock *sk,
         struct ip_options *opt = inet_rsk(req)->opt;
         struct flowi fl = { .oif = sk->sk_bound_dev_if,
                             .mark = sk->sk_mark,
-                            .nl_u = { .ip4_u =
-                                      { .daddr = ((opt && opt->srr) ?
-                                                  opt->faddr :
-                                                  ireq->rmt_addr),
-                                        .saddr = ireq->loc_addr,
-                                        .tos = RT_CONN_FLAGS(sk) } },
+                            .fl4_dst = ((opt && opt->srr) ?
+                                          opt->faddr : ireq->rmt_addr),
+                            .fl4_src = ireq->loc_addr,
+                            .fl4_tos = RT_CONN_FLAGS(sk),
                             .proto = sk->sk_protocol,
                             .flags = inet_sk_flowi_flags(sk),
-                            .uli_u = { .ports =
-                                       { .sport = inet_sk(sk)->inet_sport,
-                                         .dport = ireq->rmt_port } } };
+                            .fl_ip_sport = inet_sk(sk)->inet_sport,
+                            .fl_ip_dport = ireq->rmt_port };
         struct net *net = sock_net(sk);
 
         security_req_classify_flow(req, &fl);
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index 9e94d7cf4f8..d9bc85751c7 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -63,7 +63,7 @@
  *              refcnt: atomically against modifications on other CPU;
  *                 usually under some other lock to prevent node disappearing
  *              dtime: unused node list lock
- *              v4daddr: unchangeable
+ *              daddr: unchangeable
  *              ip_id_count: atomic value (no lock needed)
  */
 
@@ -79,15 +79,24 @@ static const struct inet_peer peer_fake_node = {
         .avl_height     = 0
 };
 
-static struct {
+struct inet_peer_base {
         struct inet_peer __rcu *root;
         spinlock_t      lock;
         int             total;
-} peers = {
+};
+
+static struct inet_peer_base v4_peers = {
+        .root           = peer_avl_empty_rcu,
+        .lock           = __SPIN_LOCK_UNLOCKED(v4_peers.lock),
+        .total          = 0,
+};
+
+static struct inet_peer_base v6_peers = {
         .root           = peer_avl_empty_rcu,
-        .lock           = __SPIN_LOCK_UNLOCKED(peers.lock),
+        .lock           = __SPIN_LOCK_UNLOCKED(v6_peers.lock),
         .total          = 0,
 };
+
 #define PEER_MAXDEPTH 40 /* sufficient for about 2^27 nodes */
 
 /* Exported for sysctl_net_ipv4.  */
@@ -152,28 +161,45 @@ static void unlink_from_unused(struct inet_peer *p)
         }
 }
 
+static int addr_compare(const struct inetpeer_addr *a,
+                        const struct inetpeer_addr *b)
+{
+        int i, n = (a->family == AF_INET ? 1 : 4);
+
+        for (i = 0; i < n; i++) {
+                if (a->a6[i] == b->a6[i])
+                        continue;
+                if (a->a6[i] < b->a6[i])
+                        return -1;
+                return 1;
+        }
+
+        return 0;
+}
+
 /*
  * Called with local BH disabled and the pool lock held.
  */
-#define lookup(_daddr, _stack)                                  \
+#define lookup(_daddr, _stack, _base)                           \
 ({                                                              \
         struct inet_peer *u;                                    \
         struct inet_peer __rcu **v;                             \
                                                                 \
         stackptr = _stack;                                      \
-        *stackptr++ = &peers.root;                              \
-        for (u = rcu_dereference_protected(peers.root,          \
-                        lockdep_is_held(&peers.lock));          \
+        *stackptr++ = &_base->root;                             \
+        for (u = rcu_dereference_protected(_base->root,         \
+                        lockdep_is_held(&_base->lock));         \
              u != peer_avl_empty; ) {                           \
-                if (_daddr == u->v4daddr)                       \
+                int cmp = addr_compare(_daddr, &u->daddr);      \
+                if (cmp == 0)                                   \
                         break;                                  \
-                if ((__force __u32)_daddr < (__force __u32)u->v4daddr)  \
+                if (cmp == -1)                                  \
                         v = &u->avl_left;                       \
                 else                                            \
                         v = &u->avl_right;                      \
                 *stackptr++ = v;                                \
                 u = rcu_dereference_protected(*v,               \
-                        lockdep_is_held(&peers.lock));          \
+                        lockdep_is_held(&_base->lock));         \
         }                                                       \
         u;                                                      \
 })
@@ -185,13 +211,15 @@ static void unlink_from_unused(struct inet_peer *p)
  * But every pointer we follow is guaranteed to be valid thanks to RCU.
  * We exit from this function if number of links exceeds PEER_MAXDEPTH
  */
-static struct inet_peer *lookup_rcu_bh(__be32 daddr)
+static struct inet_peer *lookup_rcu_bh(const struct inetpeer_addr *daddr,
+                                       struct inet_peer_base *base)
 {
-        struct inet_peer *u = rcu_dereference_bh(peers.root);
+        struct inet_peer *u = rcu_dereference_bh(base->root);
         int count = 0;
 
         while (u != peer_avl_empty) {
-                if (daddr == u->v4daddr) {
+                int cmp = addr_compare(daddr, &u->daddr);
+                if (cmp == 0) {
                         /* Before taking a reference, check if this entry was
                          * deleted, unlink_from_pool() sets refcnt=-1 to make
                          * distinction between an unused entry (refcnt=0) and
@@ -201,7 +229,7 @@ static struct inet_peer *lookup_rcu_bh(__be32 daddr)
                                 u = NULL;
                         return u;
                 }
-                if ((__force __u32)daddr < (__force __u32)u->v4daddr)
+                if (cmp == -1)
                         u = rcu_dereference_bh(u->avl_left);
                 else
                         u = rcu_dereference_bh(u->avl_right);
@@ -212,19 +240,19 @@ static struct inet_peer *lookup_rcu_bh(__be32 daddr)
 }
 
 /* Called with local BH disabled and the pool lock held. */
-#define lookup_rightempty(start)                                \
+#define lookup_rightempty(start, base)                          \
 ({                                                              \
         struct inet_peer *u;                                    \
         struct inet_peer __rcu **v;                             \
         *stackptr++ = &start->avl_left;                         \
         v = &start->avl_left;                                   \
         for (u = rcu_dereference_protected(*v,                  \
-                        lockdep_is_held(&peers.lock));          \
+                        lockdep_is_held(&base->lock));          \
              u->avl_right != peer_avl_empty_rcu; ) {            \
                 v = &u->avl_right;                              \
                 *stackptr++ = v;                                \
                 u = rcu_dereference_protected(*v,               \
-                        lockdep_is_held(&peers.lock));          \
+                        lockdep_is_held(&base->lock));          \
         }                                                       \
         u;                                                      \
 })
@@ -234,7 +262,8 @@ static struct inet_peer *lookup_rcu_bh(__be32 daddr)
  * Look into mm/map_avl.c for more detail description of the ideas.
  */
 static void peer_avl_rebalance(struct inet_peer __rcu **stack[],
-                struct inet_peer __rcu ***stackend)
+                               struct inet_peer __rcu ***stackend,
+                               struct inet_peer_base *base)
 {
         struct inet_peer __rcu **nodep;
         struct inet_peer *node, *l, *r;
@@ -243,20 +272,20 @@ static void peer_avl_rebalance(struct inet_peer __rcu **stack[],
         while (stackend > stack) {
                 nodep = *--stackend;
                 node = rcu_dereference_protected(*nodep,
-                                lockdep_is_held(&peers.lock));
+                                lockdep_is_held(&base->lock));
                 l = rcu_dereference_protected(node->avl_left,
-                                lockdep_is_held(&peers.lock));
+                                lockdep_is_held(&base->lock));
                 r = rcu_dereference_protected(node->avl_right,
-                                lockdep_is_held(&peers.lock));
+                                lockdep_is_held(&base->lock));
                 lh = node_height(l);
                 rh = node_height(r);
                 if (lh > rh + 1) { /* l: RH+2 */
                         struct inet_peer *ll, *lr, *lrl, *lrr;
                         int lrh;
                         ll = rcu_dereference_protected(l->avl_left,
-                                lockdep_is_held(&peers.lock));
+                                lockdep_is_held(&base->lock));
                         lr = rcu_dereference_protected(l->avl_right,
-                                lockdep_is_held(&peers.lock));
+                                lockdep_is_held(&base->lock));
                         lrh = node_height(lr);
                         if (lrh <= node_height(ll)) {   /* ll: RH+1 */
                                 RCU_INIT_POINTER(node->avl_left, lr);   /* lr: RH or RH+1 */
@@ -268,9 +297,9 @@ static void peer_avl_rebalance(struct inet_peer __rcu **stack[],
                                 RCU_INIT_POINTER(*nodep, l);
                         } else { /* ll: RH, lr: RH+1 */
                                 lrl = rcu_dereference_protected(lr->avl_left,
-                                        lockdep_is_held(&peers.lock));  /* lrl: RH or RH-1 */
+                                        lockdep_is_held(&base->lock));  /* lrl: RH or RH-1 */
                                 lrr = rcu_dereference_protected(lr->avl_right,
-                                        lockdep_is_held(&peers.lock));  /* lrr: RH or RH-1 */
+                                        lockdep_is_held(&base->lock));  /* lrr: RH or RH-1 */
                                 RCU_INIT_POINTER(node->avl_left, lrr);  /* lrr: RH or RH-1 */
                                 RCU_INIT_POINTER(node->avl_right, r);   /* r: RH */
                                 node->avl_height = rh + 1; /* node: RH+1 */
@@ -286,9 +315,9 @@ static void peer_avl_rebalance(struct inet_peer __rcu **stack[],
                         struct inet_peer *rr, *rl, *rlr, *rll;
                         int rlh;
                         rr = rcu_dereference_protected(r->avl_right,
-                                lockdep_is_held(&peers.lock));
+                                lockdep_is_held(&base->lock));
                         rl = rcu_dereference_protected(r->avl_left,
-                                lockdep_is_held(&peers.lock));
+                                lockdep_is_held(&base->lock));
                         rlh = node_height(rl);
                         if (rlh <= node_height(rr)) {   /* rr: LH+1 */
                                 RCU_INIT_POINTER(node->avl_right, rl);  /* rl: LH or LH+1 */
@@ -300,9 +329,9 @@ static void peer_avl_rebalance(struct inet_peer __rcu **stack[],
                                 RCU_INIT_POINTER(*nodep, r);
                         } else { /* rr: RH, rl: RH+1 */
                                 rlr = rcu_dereference_protected(rl->avl_right,
-                                        lockdep_is_held(&peers.lock));  /* rlr: LH or LH-1 */
+                                        lockdep_is_held(&base->lock));  /* rlr: LH or LH-1 */
                                 rll = rcu_dereference_protected(rl->avl_left,
-                                        lockdep_is_held(&peers.lock));  /* rll: LH or LH-1 */
+                                        lockdep_is_held(&base->lock));  /* rll: LH or LH-1 */
                                 RCU_INIT_POINTER(node->avl_right, rll); /* rll: LH or LH-1 */
                                 RCU_INIT_POINTER(node->avl_left, l);    /* l: LH */
                                 node->avl_height = lh + 1; /* node: LH+1 */
@@ -321,14 +350,14 @@ static void peer_avl_rebalance(struct inet_peer __rcu **stack[],
 }
 
 /* Called with local BH disabled and the pool lock held. */
-#define link_to_pool(n)                                         \
+#define link_to_pool(n, base)                                   \
 do {                                                            \
         n->avl_height = 1;                                      \
         n->avl_left = peer_avl_empty_rcu;                       \
         n->avl_right = peer_avl_empty_rcu;                      \
         /* lockless readers can catch us now */                 \
         rcu_assign_pointer(**--stackptr, n);                    \
-        peer_avl_rebalance(stack, stackptr);                    \
+        peer_avl_rebalance(stack, stackptr, base);              \
 } while (0)
 
 static void inetpeer_free_rcu(struct rcu_head *head)
@@ -337,13 +366,13 @@ static void inetpeer_free_rcu(struct rcu_head *head)
 }
 
 /* May be called with local BH enabled. */
-static void unlink_from_pool(struct inet_peer *p)
+static void unlink_from_pool(struct inet_peer *p, struct inet_peer_base *base)
 {
         int do_free;
 
         do_free = 0;
 
-        spin_lock_bh(&peers.lock);
+        spin_lock_bh(&base->lock);
         /* Check the reference counter.  It was artificially incremented by 1
          * in cleanup() function to prevent sudden disappearing.  If we can
          * atomically (because of lockless readers) take this last reference,
@@ -353,7 +382,7 @@ static void unlink_from_pool(struct inet_peer *p)
         if (atomic_cmpxchg(&p->refcnt, 1, -1) == 1) {
                 struct inet_peer __rcu **stack[PEER_MAXDEPTH];
                 struct inet_peer __rcu ***stackptr, ***delp;
-                if (lookup(p->v4daddr, stack) != p)
+                if (lookup(&p->daddr, stack, base) != p)
                         BUG();
                 delp = stackptr - 1; /* *delp[0] == p */
                 if (p->avl_left == peer_avl_empty_rcu) {
@@ -362,11 +391,11 @@ static void unlink_from_pool(struct inet_peer *p)
                 } else {
                         /* look for a node to insert instead of p */
                         struct inet_peer *t;
-                        t = lookup_rightempty(p);
+                        t = lookup_rightempty(p, base);
                         BUG_ON(rcu_dereference_protected(*stackptr[-1],
-                                        lockdep_is_held(&peers.lock)) != t);
+                                        lockdep_is_held(&base->lock)) != t);
                         **--stackptr = t->avl_left;
-                        /* t is removed, t->v4daddr > x->v4daddr for any
+                        /* t is removed, t->daddr > x->daddr for any
                          * x in p->avl_left subtree.
                          * Put t in the old place of p. */
                         RCU_INIT_POINTER(*delp[0], t);
@@ -376,11 +405,11 @@ static void unlink_from_pool(struct inet_peer *p)
                         BUG_ON(delp[1] != &p->avl_left);
                         delp[1] = &t->avl_left; /* was &p->avl_left */
                 }
-                peer_avl_rebalance(stack, stackptr);
-                peers.total--;
+                peer_avl_rebalance(stack, stackptr, base);
+                base->total--;
                 do_free = 1;
         }
-        spin_unlock_bh(&peers.lock);
+        spin_unlock_bh(&base->lock);
 
         if (do_free)
                 call_rcu_bh(&p->rcu, inetpeer_free_rcu);
@@ -395,6 +424,16 @@ static void unlink_from_pool(struct inet_peer *p)
                 inet_putpeer(p);
 }
 
+static struct inet_peer_base *family_to_base(int family)
+{
+        return (family == AF_INET ? &v4_peers : &v6_peers);
+}
+
+static struct inet_peer_base *peer_to_base(struct inet_peer *p)
+{
+        return family_to_base(p->daddr.family);
+}
+
 /* May be called with local BH enabled. */
 static int cleanup_once(unsigned long ttl)
 {
@@ -428,21 +467,22 @@ static int cleanup_once(unsigned long ttl)
                  * happen because of entry limits in route cache. */
                 return -1;
 
-        unlink_from_pool(p);
+        unlink_from_pool(p, peer_to_base(p));
         return 0;
 }
 
 /* Called with or without local BH being disabled. */
-struct inet_peer *inet_getpeer(__be32 daddr, int create)
+struct inet_peer *inet_getpeer(struct inetpeer_addr *daddr, int create)
 {
-        struct inet_peer *p;
         struct inet_peer __rcu **stack[PEER_MAXDEPTH], ***stackptr;
+        struct inet_peer_base *base = family_to_base(AF_INET);
+        struct inet_peer *p;
 
         /* Look up for the address quickly, lockless.
          * Because of a concurrent writer, we might not find an existing entry.
          */
         rcu_read_lock_bh();
-        p = lookup_rcu_bh(daddr);
+        p = lookup_rcu_bh(daddr, base);
         rcu_read_unlock_bh();
 
         if (p) {
@@ -456,50 +496,57 @@ struct inet_peer *inet_getpeer(__be32 daddr, int create)
         /* retry an exact lookup, taking the lock before.
          * At least, nodes should be hot in our cache.
          */
-        spin_lock_bh(&peers.lock);
-        p = lookup(daddr, stack);
+        spin_lock_bh(&base->lock);
+        p = lookup(daddr, stack, base);
         if (p != peer_avl_empty) {
                 atomic_inc(&p->refcnt);
-                spin_unlock_bh(&peers.lock);
+                spin_unlock_bh(&base->lock);
                 /* Remove the entry from unused list if it was there. */
                 unlink_from_unused(p);
                 return p;
         }
         p = create ? kmem_cache_alloc(peer_cachep, GFP_ATOMIC) : NULL;
         if (p) {
-                p->v4daddr = daddr;
+                p->daddr = *daddr;
                 atomic_set(&p->refcnt, 1);
                 atomic_set(&p->rid, 0);
-                atomic_set(&p->ip_id_count, secure_ip_id(daddr));
+                atomic_set(&p->ip_id_count, secure_ip_id(daddr->a4));
                 p->tcp_ts_stamp = 0;
                 INIT_LIST_HEAD(&p->unused);
 
 
                 /* Link the node. */
-                link_to_pool(p);
-                peers.total++;
+                link_to_pool(p, base);
+                base->total++;
         }
-        spin_unlock_bh(&peers.lock);
+        spin_unlock_bh(&base->lock);
 
-        if (peers.total >= inet_peer_threshold)
+        if (base->total >= inet_peer_threshold)
                 /* Remove one less-recently-used entry. */
                 cleanup_once(0);
 
         return p;
 }
 
+static int compute_total(void)
+{
+        return v4_peers.total + v6_peers.total;
+}
+EXPORT_SYMBOL_GPL(inet_getpeer);
+
 /* Called with local BH disabled. */
 static void peer_check_expire(unsigned long dummy)
 {
         unsigned long now = jiffies;
-        int ttl;
+        int ttl, total;
 
-        if (peers.total >= inet_peer_threshold)
+        total = compute_total();
+        if (total >= inet_peer_threshold)
                 ttl = inet_peer_minttl;
         else
                 ttl = inet_peer_maxttl
                                 - (inet_peer_maxttl - inet_peer_minttl) / HZ *
-                                        peers.total / inet_peer_threshold * HZ;
+                                        total / inet_peer_threshold * HZ;
         while (!cleanup_once(ttl)) {
                 if (jiffies != now)
                         break;
@@ -508,13 +555,14 @@ static void peer_check_expire(unsigned long dummy)
         /* Trigger the timer after inet_peer_gc_mintime .. inet_peer_gc_maxtime
          * interval depending on the total number of entries (more entries,
          * less interval). */
-        if (peers.total >= inet_peer_threshold)
+        total = compute_total();
+        if (total >= inet_peer_threshold)
                 peer_periodic_timer.expires = jiffies + inet_peer_gc_mintime;
         else
                 peer_periodic_timer.expires = jiffies
                         + inet_peer_gc_maxtime
                         - (inet_peer_gc_maxtime - inet_peer_gc_mintime) / HZ *
-                                peers.total / inet_peer_threshold * HZ;
+                                total / inet_peer_threshold * HZ;
         add_timer(&peer_periodic_timer);
 }
 
@@ -530,3 +578,4 @@ void inet_putpeer(struct inet_peer *p)
 
         local_bh_enable();
 }
+EXPORT_SYMBOL_GPL(inet_putpeer);
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 168440834ad..e6215bdd96c 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -141,7 +141,7 @@ static void ip4_frag_init(struct inet_frag_queue *q, void *a)
         qp->daddr = arg->iph->daddr;
         qp->user = arg->user;
         qp->peer = sysctl_ipfrag_max_dist ?
-                inet_getpeer(arg->iph->saddr, 1) : NULL;
+                inet_getpeer_v4(arg->iph->saddr, 1) : NULL;
 }
 
 static __inline__ void ip4_frag_free(struct inet_frag_queue *q)
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 70ff77f02ee..258c98d5fa7 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -405,11 +405,11 @@ static struct ip_tunnel *ipgre_tunnel_locate(struct net *net,
         if (parms->name[0])
                 strlcpy(name, parms->name, IFNAMSIZ);
         else
-                sprintf(name, "gre%%d");
+                strcpy(name, "gre%d");
 
         dev = alloc_netdev(sizeof(*t), name, ipgre_tunnel_setup);
         if (!dev)
-          return NULL;
+                return NULL;
 
         dev_net_set(dev, net);
 
@@ -634,7 +634,7 @@ static int ipgre_rcv(struct sk_buff *skb)
 #ifdef CONFIG_NET_IPGRE_BROADCAST
                 if (ipv4_is_multicast(iph->daddr)) {
                         /* Looped back packet, drop it! */
-                        if (skb_rtable(skb)->fl.iif == 0)
+                        if (rt_is_output_route(skb_rtable(skb)))
                                 goto drop;
                         tunnel->dev->stats.multicast++;
                         skb->pkt_type = PACKET_BROADCAST;
@@ -772,16 +772,11 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
         {
                 struct flowi fl = {
                         .oif = tunnel->parms.link,
-                        .nl_u = {
-                                .ip4_u = {
-                                        .daddr = dst,
-                                        .saddr = tiph->saddr,
-                                        .tos = RT_TOS(tos)
-                                }
-                        },
-                        .proto = IPPROTO_GRE
-                }
-;
+                        .fl4_dst = dst,
+                        .fl4_src = tiph->saddr,
+                        .fl4_tos = RT_TOS(tos),
+                        .fl_gre_key = tunnel->parms.o_key
+                };
                 if (ip_route_output_key(dev_net(dev), &rt, &fl)) {
                         dev->stats.tx_carrier_errors++;
                         goto tx_error;
@@ -951,14 +946,11 @@ static int ipgre_tunnel_bind_dev(struct net_device *dev)
         if (iph->daddr) {
                 struct flowi fl = {
                         .oif = tunnel->parms.link,
-                        .nl_u = {
-                                .ip4_u = {
-                                        .daddr = iph->daddr,
-                                        .saddr = iph->saddr,
-                                        .tos = RT_TOS(iph->tos)
-                                }
-                        },
-                        .proto = IPPROTO_GRE
+                        .fl4_dst = iph->daddr,
+                        .fl4_src = iph->saddr,
+                        .fl4_tos = RT_TOS(iph->tos),
+                        .proto = IPPROTO_GRE,
+                        .fl_gre_key = tunnel->parms.o_key
                 };
                 struct rtable *rt;
 
@@ -1216,14 +1208,11 @@ static int ipgre_open(struct net_device *dev)
         if (ipv4_is_multicast(t->parms.iph.daddr)) {
                 struct flowi fl = {
                         .oif = t->parms.link,
-                        .nl_u = {
-                                .ip4_u = {
-                                        .daddr = t->parms.iph.daddr,
-                                        .saddr = t->parms.iph.saddr,
-                                        .tos = RT_TOS(t->parms.iph.tos)
-                                }
-                        },
-                        .proto = IPPROTO_GRE
+                        .fl4_dst = t->parms.iph.daddr,
+                        .fl4_src = t->parms.iph.saddr,
+                        .fl4_tos = RT_TOS(t->parms.iph.tos),
+                        .proto = IPPROTO_GRE,
+                        .fl_gre_key = t->parms.o_key
                 };
                 struct rtable *rt;
 
@@ -1775,3 +1764,4 @@ module_exit(ipgre_fini);
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_RTNL_LINK("gre");
 MODULE_ALIAS_RTNL_LINK("gretap");
+MODULE_ALIAS("gre0");
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 439d2a34ee4..5090c7ff525 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -341,15 +341,13 @@ int ip_queue_xmit(struct sk_buff *skb)
                 {
                         struct flowi fl = { .oif = sk->sk_bound_dev_if,
                                             .mark = sk->sk_mark,
-                                            .nl_u = { .ip4_u =
-                                                      { .daddr = daddr,
-                                                        .saddr = inet->inet_saddr,
-                                                        .tos = RT_CONN_FLAGS(sk) } },
+                                            .fl4_dst = daddr,
+                                            .fl4_src = inet->inet_saddr,
+                                            .fl4_tos = RT_CONN_FLAGS(sk),
                                             .proto = sk->sk_protocol,
                                             .flags = inet_sk_flowi_flags(sk),
-                                            .uli_u = { .ports =
-                                                       { .sport = inet->inet_sport,
-                                                         .dport = inet->inet_dport } } };
+                                            .fl_ip_sport = inet->inet_sport,
+                                            .fl_ip_dport = inet->inet_dport };
 
                         /* If this fails, retransmit mechanism of transport layer will
                          * keep trying until route appears or the connection times
@@ -1404,14 +1402,11 @@ void ip_send_reply(struct sock *sk, struct sk_buff *skb, struct ip_reply_arg *ar
 
         {
                 struct flowi fl = { .oif = arg->bound_dev_if,
-                                    .nl_u = { .ip4_u =
-                                              { .daddr = daddr,
-                                                .saddr = rt->rt_spec_dst,
-                                                .tos = RT_TOS(ip_hdr(skb)->tos) } },
-                                    /* Not quite clean, but right. */
-                                    .uli_u = { .ports =
-                                               { .sport = tcp_hdr(skb)->dest,
-                                                 .dport = tcp_hdr(skb)->source } },
+                                    .fl4_dst = daddr,
+                                    .fl4_src = rt->rt_spec_dst,
+                                    .fl4_tos = RT_TOS(ip_hdr(skb)->tos),
+                                    .fl_ip_sport = tcp_hdr(skb)->dest,
+                                    .fl_ip_dport = tcp_hdr(skb)->source,
                                     .proto = sk->sk_protocol,
                                     .flags = ip_reply_arg_flowi_flags(arg) };
                 security_skb_classify_flow(skb, &fl);
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index 3a6e1ec5e9a..2b097752426 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -1191,13 +1191,13 @@ static int __init ic_dynamic(void)
                     (ic_proto_enabled & IC_USE_DHCP) &&
                     ic_dhcp_msgtype != DHCPACK) {
                         ic_got_reply = 0;
-                        printk(",");
+                        printk(KERN_CONT ",");
                         continue;
                 }
 #endif /* IPCONFIG_DHCP */
 
                 if (ic_got_reply) {
-                        printk(" OK\n");
+                        printk(KERN_CONT " OK\n");
                         break;
                 }
 
@@ -1205,7 +1205,7 @@ static int __init ic_dynamic(void)
                         continue;
 
                 if (! --retries) {
-                        printk(" timed out!\n");
+                        printk(KERN_CONT " timed out!\n");
                         break;
                 }
 
@@ -1215,7 +1215,7 @@ static int __init ic_dynamic(void)
                 if (timeout > CONF_TIMEOUT_MAX)
                         timeout = CONF_TIMEOUT_MAX;
 
-                printk(".");
+                printk(KERN_CONT ".");
         }
 
 #ifdef IPCONFIG_BOOTP
@@ -1236,7 +1236,7 @@ static int __init ic_dynamic(void)
                 ((ic_got_reply & IC_RARP) ? "RARP"
                  : (ic_proto_enabled & IC_USE_DHCP) ? "DHCP" : "BOOTP"),
                 &ic_servaddr);
-        printk("my address is %pI4\n", &ic_myaddr);
+        printk(KERN_CONT "my address is %pI4\n", &ic_myaddr);
 
         return 0;
 }
@@ -1468,19 +1468,19 @@ static int __init ip_auto_config(void)
         /*
          * Clue in the operator.
          */
-        printk("IP-Config: Complete:");
-        printk("\n     device=%s", ic_dev->name);
-        printk(", addr=%pI4", &ic_myaddr);
-        printk(", mask=%pI4", &ic_netmask);
-        printk(", gw=%pI4", &ic_gateway);
-        printk(",\n     host=%s, domain=%s, nis-domain=%s",
+        printk("IP-Config: Complete:\n");
+        printk("     device=%s", ic_dev->name);
+        printk(KERN_CONT ", addr=%pI4", &ic_myaddr);
+        printk(KERN_CONT ", mask=%pI4", &ic_netmask);
+        printk(KERN_CONT ", gw=%pI4", &ic_gateway);
+        printk(KERN_CONT ",\n     host=%s, domain=%s, nis-domain=%s",
                utsname()->nodename, ic_domain, utsname()->domainname);
-        printk(",\n     bootserver=%pI4", &ic_servaddr);
-        printk(", rootserver=%pI4", &root_server_addr);
-        printk(", rootpath=%s", root_server_path);
+        printk(KERN_CONT ",\n     bootserver=%pI4", &ic_servaddr);
+        printk(KERN_CONT ", rootserver=%pI4", &root_server_addr);
+        printk(KERN_CONT ", rootpath=%s", root_server_path);
         if (ic_dev_mtu)
-                printk(", mtu=%d", ic_dev_mtu);
-        printk("\n");
+                printk(KERN_CONT ", mtu=%d", ic_dev_mtu);
+        printk(KERN_CONT "\n");
 #endif /* !SILENT */
 
         return 0;
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index cd300aaee78..988f52fba54 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -463,13 +463,9 @@ static netdev_tx_t ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
         {
                 struct flowi fl = {
                         .oif = tunnel->parms.link,
-                        .nl_u = {
-                                .ip4_u = {
-                                        .daddr = dst,
-                                        .saddr = tiph->saddr,
-                                        .tos = RT_TOS(tos)
-                                }
-                        },
+                        .fl4_dst = dst,
+                        .fl4_src= tiph->saddr,
+                        .fl4_tos = RT_TOS(tos),
                         .proto = IPPROTO_IPIP
                 };
 
@@ -589,13 +585,9 @@ static void ipip_tunnel_bind_dev(struct net_device *dev)
         if (iph->daddr) {
                 struct flowi fl = {
                         .oif = tunnel->parms.link,
-                        .nl_u = {
-                                .ip4_u = {
-                                        .daddr = iph->daddr,
-                                        .saddr = iph->saddr,
-                                        .tos = RT_TOS(iph->tos)
-                                }
-                        },
+                        .fl4_dst = iph->daddr,
+                        .fl4_src = iph->saddr,
+                        .fl4_tos = RT_TOS(iph->tos),
                         .proto = IPPROTO_IPIP
                 };
                 struct rtable *rt;
@@ -921,3 +913,4 @@ static void __exit ipip_fini(void)
 module_init(ipip_init);
 module_exit(ipip_fini);
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("tunl0");
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 86dd5691af4..3f3a9afd73e 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -1537,13 +1537,9 @@ static void ipmr_queue_xmit(struct net *net, struct mr_table *mrt,
         if (vif->flags & VIFF_TUNNEL) {
                 struct flowi fl = {
                         .oif = vif->link,
-                        .nl_u = {
-                                .ip4_u = {
-                                        .daddr = vif->remote,
-                                        .saddr = vif->local,
-                                        .tos = RT_TOS(iph->tos)
-                                }
-                        },
+                        .fl4_dst = vif->remote,
+                        .fl4_src = vif->local,
+                        .fl4_tos = RT_TOS(iph->tos),
                         .proto = IPPROTO_IPIP
                 };
 
@@ -1553,12 +1549,8 @@ static void ipmr_queue_xmit(struct net *net, struct mr_table *mrt,
         } else {
                 struct flowi fl = {
                         .oif = vif->link,
-                        .nl_u = {
-                                .ip4_u = {
-                                        .daddr = iph->daddr,
-                                        .tos = RT_TOS(iph->tos)
-                                }
-                        },
+                        .fl4_dst = iph->daddr,
+                        .fl4_tos = RT_TOS(iph->tos),
                         .proto = IPPROTO_IPIP
                 };
 
@@ -1654,7 +1646,7 @@ static int ip_mr_forward(struct net *net, struct mr_table *mrt,
         if (mrt->vif_table[vif].dev != skb->dev) {
                 int true_vifi;
 
-                if (skb_rtable(skb)->fl.iif == 0) {
+                if (rt_is_output_route(skb_rtable(skb))) {
                         /* It is our own packet, looped back.
                          * Very complicated situation...
                          *
diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c
index d88a46c54fd..994a1f29ebb 100644
--- a/net/ipv4/netfilter.c
+++ b/net/ipv4/netfilter.c
@@ -31,10 +31,10 @@ int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type)
          * packets with foreign saddr to appear on the NF_INET_LOCAL_OUT hook.
          */
         if (addr_type == RTN_LOCAL) {
-                fl.nl_u.ip4_u.daddr = iph->daddr;
+                fl.fl4_dst = iph->daddr;
                 if (type == RTN_LOCAL)
-                        fl.nl_u.ip4_u.saddr = iph->saddr;
-                fl.nl_u.ip4_u.tos = RT_TOS(iph->tos);
+                        fl.fl4_src = iph->saddr;
+                fl.fl4_tos = RT_TOS(iph->tos);
                 fl.oif = skb->sk ? skb->sk->sk_bound_dev_if : 0;
                 fl.mark = skb->mark;
                 fl.flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : 0;
@@ -47,7 +47,7 @@ int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type)
         } else {
                 /* non-local src, find valid iif to satisfy
                  * rp-filter when calling ip_route_input. */
-                fl.nl_u.ip4_u.daddr = iph->saddr;
+                fl.fl4_dst = iph->saddr;
                 if (ip_route_output_key(net, &rt, &fl) != 0)
                         return -1;
 
diff --git a/net/ipv4/netfilter/Makefile b/net/ipv4/netfilter/Makefile
index 48111594ee9..19eb59d0103 100644
--- a/net/ipv4/netfilter/Makefile
+++ b/net/ipv4/netfilter/Makefile
@@ -3,15 +3,15 @@
 #
 
 # objects for l3 independent conntrack
-nf_conntrack_ipv4-objs  :=  nf_conntrack_l3proto_ipv4.o nf_conntrack_proto_icmp.o
+nf_conntrack_ipv4-y     :=  nf_conntrack_l3proto_ipv4.o nf_conntrack_proto_icmp.o
 ifeq ($(CONFIG_NF_CONNTRACK_PROC_COMPAT),y)
 ifeq ($(CONFIG_PROC_FS),y)
 nf_conntrack_ipv4-objs  += nf_conntrack_l3proto_ipv4_compat.o
 endif
 endif
 
-nf_nat-objs             := nf_nat_core.o nf_nat_helper.o nf_nat_proto_unknown.o nf_nat_proto_common.o nf_nat_proto_tcp.o nf_nat_proto_udp.o nf_nat_proto_icmp.o
-iptable_nat-objs        := nf_nat_rule.o nf_nat_standalone.o
+nf_nat-y                := nf_nat_core.o nf_nat_helper.o nf_nat_proto_unknown.o nf_nat_proto_common.o nf_nat_proto_tcp.o nf_nat_proto_udp.o nf_nat_proto_icmp.o
+iptable_nat-y   := nf_nat_rule.o nf_nat_standalone.o
 
 # connection tracking
 obj-$(CONFIG_NF_CONNTRACK_IPV4) += nf_conntrack_ipv4.o
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 1f85ef28989..a3d5ab786e8 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -549,10 +549,9 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         {
                 struct flowi fl = { .oif = ipc.oif,
                                     .mark = sk->sk_mark,
-                                    .nl_u = { .ip4_u =
-                                              { .daddr = daddr,
-                                                .saddr = saddr,
-                                                .tos = tos } },
+                                    .fl4_dst = daddr,
+                                    .fl4_src = saddr,
+                                    .fl4_tos = tos,
                                     .proto = inet->hdrincl ? IPPROTO_RAW :
                                                              sk->sk_protocol,
                                   };
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 987bf9adb31..3843c2dfde8 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -140,13 +140,15 @@ static unsigned long expires_ljiffies;
 
 static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie);
 static void              ipv4_dst_destroy(struct dst_entry *dst);
-static void              ipv4_dst_ifdown(struct dst_entry *dst,
-                                         struct net_device *dev, int how);
 static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst);
 static void              ipv4_link_failure(struct sk_buff *skb);
 static void              ip_rt_update_pmtu(struct dst_entry *dst, u32 mtu);
 static int rt_garbage_collect(struct dst_ops *ops);
 
+static void ipv4_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
+                            int how)
+{
+}
 
 static struct dst_ops ipv4_dst_ops = {
         .family =               AF_INET,
@@ -621,7 +623,7 @@ static inline int rt_fast_clean(struct rtable *rth)
         /* Kill broadcast/multicast entries very aggresively, if they
            collide in hash table with more useful entries */
         return (rth->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST)) &&
-                rth->fl.iif && rth->dst.rt_next;
+                rt_is_input_route(rth) && rth->dst.rt_next;
 }
 
 static inline int rt_valuable(struct rtable *rth)
@@ -666,7 +668,7 @@ static inline u32 rt_score(struct rtable *rt)
         if (rt_valuable(rt))
                 score |= (1<<31);
 
-        if (!rt->fl.iif ||
+        if (rt_is_output_route(rt) ||
             !(rt->rt_flags & (RTCF_BROADCAST|RTCF_MULTICAST|RTCF_LOCAL)))
                 score |= (1<<30);
 
@@ -682,17 +684,17 @@ static inline bool rt_caching(const struct net *net)
 static inline bool compare_hash_inputs(const struct flowi *fl1,
                                         const struct flowi *fl2)
 {
-        return ((((__force u32)fl1->nl_u.ip4_u.daddr ^ (__force u32)fl2->nl_u.ip4_u.daddr) |
-                ((__force u32)fl1->nl_u.ip4_u.saddr ^ (__force u32)fl2->nl_u.ip4_u.saddr) |
+        return ((((__force u32)fl1->fl4_dst ^ (__force u32)fl2->fl4_dst) |
+                ((__force u32)fl1->fl4_src ^ (__force u32)fl2->fl4_src) |
                 (fl1->iif ^ fl2->iif)) == 0);
 }
 
 static inline int compare_keys(struct flowi *fl1, struct flowi *fl2)
 {
-        return (((__force u32)fl1->nl_u.ip4_u.daddr ^ (__force u32)fl2->nl_u.ip4_u.daddr) |
-                ((__force u32)fl1->nl_u.ip4_u.saddr ^ (__force u32)fl2->nl_u.ip4_u.saddr) |
+        return (((__force u32)fl1->fl4_dst ^ (__force u32)fl2->fl4_dst) |
+                ((__force u32)fl1->fl4_src ^ (__force u32)fl2->fl4_src) |
                 (fl1->mark ^ fl2->mark) |
-                (*(u16 *)&fl1->nl_u.ip4_u.tos ^ *(u16 *)&fl2->nl_u.ip4_u.tos) |
+                (*(u16 *)&fl1->fl4_tos ^ *(u16 *)&fl2->fl4_tos) |
                 (fl1->oif ^ fl2->oif) |
                 (fl1->iif ^ fl2->iif)) == 0;
 }
@@ -1124,7 +1126,7 @@ restart:
                  */
 
                 rt->dst.flags |= DST_NOCACHE;
-                if (rt->rt_type == RTN_UNICAST || rt->fl.iif == 0) {
+                if (rt->rt_type == RTN_UNICAST || rt_is_output_route(rt)) {
                         int err = arp_bind_neighbour(&rt->dst);
                         if (err) {
                                 if (net_ratelimit())
@@ -1222,7 +1224,7 @@ restart:
         /* Try to bind route to arp only if it is output
            route or unicast forwarding path.
          */
-        if (rt->rt_type == RTN_UNICAST || rt->fl.iif == 0) {
+        if (rt->rt_type == RTN_UNICAST || rt_is_output_route(rt)) {
                 int err = arp_bind_neighbour(&rt->dst);
                 if (err) {
                         spin_unlock_bh(rt_hash_lock_addr(hash));
@@ -1287,7 +1289,7 @@ void rt_bind_peer(struct rtable *rt, int create)
 {
         struct inet_peer *peer;
 
-        peer = inet_getpeer(rt->rt_dst, create);
+        peer = inet_getpeer_v4(rt->rt_dst, create);
 
         if (peer && cmpxchg(&rt->peer, NULL, peer) != NULL)
                 inet_putpeer(peer);
@@ -1404,7 +1406,7 @@ void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
                                 if (rth->fl.fl4_dst != daddr ||
                                     rth->fl.fl4_src != skeys[i] ||
                                     rth->fl.oif != ikeys[k] ||
-                                    rth->fl.iif != 0 ||
+                                    rt_is_input_route(rth) ||
                                     rt_is_expired(rth) ||
                                     !net_eq(dev_net(rth->dst.dev), net)) {
                                         rthp = &rth->dst.rt_next;
@@ -1433,8 +1435,6 @@ void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
                                 rt->dst.child           = NULL;
                                 if (rt->dst.dev)
                                         dev_hold(rt->dst.dev);
-                                if (rt->idev)
-                                        in_dev_hold(rt->idev);
                                 rt->dst.obsolete        = -1;
                                 rt->dst.lastuse = jiffies;
                                 rt->dst.path            = &rt->dst;
@@ -1666,7 +1666,7 @@ unsigned short ip_rt_frag_needed(struct net *net, struct iphdr *iph,
                                     rth->rt_dst != daddr ||
                                     rth->rt_src != iph->saddr ||
                                     rth->fl.oif != ikeys[k] ||
-                                    rth->fl.iif != 0 ||
+                                    rt_is_input_route(rth) ||
                                     dst_metric_locked(&rth->dst, RTAX_MTU) ||
                                     !net_eq(dev_net(rth->dst.dev), net) ||
                                     rt_is_expired(rth))
@@ -1728,33 +1728,13 @@ static void ipv4_dst_destroy(struct dst_entry *dst)
 {
         struct rtable *rt = (struct rtable *) dst;
         struct inet_peer *peer = rt->peer;
-        struct in_device *idev = rt->idev;
 
         if (peer) {
                 rt->peer = NULL;
                 inet_putpeer(peer);
         }
-
-        if (idev) {
-                rt->idev = NULL;
-                in_dev_put(idev);
-        }
 }
 
-static void ipv4_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
-                            int how)
-{
-        struct rtable *rt = (struct rtable *) dst;
-        struct in_device *idev = rt->idev;
-        if (dev != dev_net(dev)->loopback_dev && idev && idev->dev == dev) {
-                struct in_device *loopback_idev =
-                        in_dev_get(dev_net(dev)->loopback_dev);
-                if (loopback_idev) {
-                        rt->idev = loopback_idev;
-                        in_dev_put(idev);
-                }
-        }
-}
 
 static void ipv4_link_failure(struct sk_buff *skb)
 {
@@ -1790,7 +1770,7 @@ void ip_rt_get_source(u8 *addr, struct rtable *rt)
         __be32 src;
         struct fib_result res;
 
-        if (rt->fl.iif == 0)
+        if (rt_is_output_route(rt))
                 src = rt->rt_src;
         else {
                 rcu_read_lock();
@@ -1910,7 +1890,6 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
         rth->fl.iif     = dev->ifindex;
         rth->dst.dev    = init_net.loopback_dev;
         dev_hold(rth->dst.dev);
-        rth->idev       = in_dev_get(rth->dst.dev);
         rth->fl.oif     = 0;
         rth->rt_gateway = daddr;
         rth->rt_spec_dst= spec_dst;
@@ -2050,7 +2029,6 @@ static int __mkroute_input(struct sk_buff *skb,
                 rth->fl.iif     = in_dev->dev->ifindex;
         rth->dst.dev    = (out_dev)->dev;
         dev_hold(rth->dst.dev);
-        rth->idev       = in_dev_get(rth->dst.dev);
         rth->fl.oif     = 0;
         rth->rt_spec_dst= spec_dst;
 
@@ -2111,12 +2089,10 @@ static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
 {
         struct fib_result res;
         struct in_device *in_dev = __in_dev_get_rcu(dev);
-        struct flowi fl = { .nl_u = { .ip4_u =
-                                      { .daddr = daddr,
-                                        .saddr = saddr,
-                                        .tos = tos,
-                                        .scope = RT_SCOPE_UNIVERSE,
-                                      } },
+        struct flowi fl = { .fl4_dst    = daddr,
+                            .fl4_src    = saddr,
+                            .fl4_tos    = tos,
+                            .fl4_scope  = RT_SCOPE_UNIVERSE,
                             .mark = skb->mark,
                             .iif = dev->ifindex };
         unsigned        flags = 0;
@@ -2231,7 +2207,6 @@ local_input:
         rth->fl.iif     = dev->ifindex;
         rth->dst.dev    = net->loopback_dev;
         dev_hold(rth->dst.dev);
-        rth->idev       = in_dev_get(rth->dst.dev);
         rth->rt_gateway = daddr;
         rth->rt_spec_dst= spec_dst;
         rth->dst.input= ip_local_deliver;
@@ -2417,9 +2392,6 @@ static int __mkroute_output(struct rtable **result,
         if (!rth)
                 return -ENOBUFS;
 
-        in_dev_hold(in_dev);
-        rth->idev = in_dev;
-
         atomic_set(&rth->dst.__refcnt, 1);
         rth->dst.flags= DST_HOST;
         if (IN_DEV_CONF_GET(in_dev, NOXFRM))
@@ -2506,14 +2478,11 @@ static int ip_route_output_slow(struct net *net, struct rtable **rp,
                                 const struct flowi *oldflp)
 {
         u32 tos = RT_FL_TOS(oldflp);
-        struct flowi fl = { .nl_u = { .ip4_u =
-                                      { .daddr = oldflp->fl4_dst,
-                                        .saddr = oldflp->fl4_src,
-                                        .tos = tos & IPTOS_RT_MASK,
-                                        .scope = ((tos & RTO_ONLINK) ?
-                                                  RT_SCOPE_LINK :
-                                                  RT_SCOPE_UNIVERSE),
-                                      } },
+        struct flowi fl = { .fl4_dst = oldflp->fl4_dst,
+                            .fl4_src = oldflp->fl4_src,
+                            .fl4_tos = tos & IPTOS_RT_MASK,
+                            .fl4_scope = ((tos & RTO_ONLINK) ?
+                                          RT_SCOPE_LINK : RT_SCOPE_UNIVERSE),
                             .mark = oldflp->mark,
                             .iif = net->loopback_dev->ifindex,
                             .oif = oldflp->oif };
@@ -2695,7 +2664,7 @@ int __ip_route_output_key(struct net *net, struct rtable **rp,
                 rth = rcu_dereference_bh(rth->dst.rt_next)) {
                 if (rth->fl.fl4_dst == flp->fl4_dst &&
                     rth->fl.fl4_src == flp->fl4_src &&
-                    rth->fl.iif == 0 &&
+                    rt_is_output_route(rth) &&
                     rth->fl.oif == flp->oif &&
                     rth->fl.mark == flp->mark &&
                     !((rth->fl.fl4_tos ^ flp->fl4_tos) &
@@ -2759,9 +2728,6 @@ static int ipv4_dst_blackhole(struct net *net, struct rtable **rp, struct flowi
 
                 rt->fl = ort->fl;
 
-                rt->idev = ort->idev;
-                if (rt->idev)
-                        in_dev_hold(rt->idev);
                 rt->rt_genid = rt_genid(net);
                 rt->rt_flags = ort->rt_flags;
                 rt->rt_type = ort->rt_type;
@@ -2853,7 +2819,7 @@ static int rt_fill_info(struct net *net,
         if (rt->dst.tclassid)
                 NLA_PUT_U32(skb, RTA_FLOW, rt->dst.tclassid);
 #endif
-        if (rt->fl.iif)
+        if (rt_is_input_route(rt))
                 NLA_PUT_BE32(skb, RTA_PREFSRC, rt->rt_spec_dst);
         else if (rt->rt_src != rt->fl.fl4_src)
                 NLA_PUT_BE32(skb, RTA_PREFSRC, rt->rt_src);
@@ -2878,7 +2844,7 @@ static int rt_fill_info(struct net *net,
                 }
         }
 
-        if (rt->fl.iif) {
+        if (rt_is_input_route(rt)) {
 #ifdef CONFIG_IP_MROUTE
                 __be32 dst = rt->rt_dst;
 
@@ -2973,13 +2939,9 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void
                         err = -rt->dst.error;
         } else {
                 struct flowi fl = {
-                        .nl_u = {
-                                .ip4_u = {
-                                        .daddr = dst,
-                                        .saddr = src,
-                                        .tos = rtm->rtm_tos,
-                                },
-                        },
+                        .fl4_dst = dst,
+                        .fl4_src = src,
+                        .fl4_tos = rtm->rtm_tos,
                         .oif = tb[RTA_OIF] ? nla_get_u32(tb[RTA_OIF]) : 0,
                         .mark = mark,
                 };
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index 650cace2180..47519205a01 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -346,17 +346,14 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
          */
         {
                 struct flowi fl = { .mark = sk->sk_mark,
-                                    .nl_u = { .ip4_u =
-                                              { .daddr = ((opt && opt->srr) ?
-                                                          opt->faddr :
-                                                          ireq->rmt_addr),
-                                                .saddr = ireq->loc_addr,
-                                                .tos = RT_CONN_FLAGS(sk) } },
+                                    .fl4_dst = ((opt && opt->srr) ?
+                                                opt->faddr : ireq->rmt_addr),
+                                    .fl4_src = ireq->loc_addr,
+                                    .fl4_tos = RT_CONN_FLAGS(sk),
                                     .proto = IPPROTO_TCP,
                                     .flags = inet_sk_flowi_flags(sk),
-                                    .uli_u = { .ports =
-                                               { .sport = th->dest,
-                                                 .dport = th->source } } };
+                                    .fl_ip_sport = th->dest,
+                                    .fl_ip_dport = th->source };
                 security_req_classify_flow(req, &fl);
                 if (ip_route_output_key(sock_net(sk), &rt, &fl)) {
                         reqsk_free(req);
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index f15c36a706e..6c11eece262 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1193,7 +1193,7 @@ void tcp_cleanup_rbuf(struct sock *sk, int copied)
         struct sk_buff *skb = skb_peek(&sk->sk_receive_queue);
 
         WARN(skb && !before(tp->copied_seq, TCP_SKB_CB(skb)->end_seq),
-             KERN_INFO "cleanup rbuf bug: copied %X seq %X rcvnxt %X\n",
+             "cleanup rbuf bug: copied %X seq %X rcvnxt %X\n",
              tp->copied_seq, TCP_SKB_CB(skb)->end_seq, tp->rcv_nxt);
 #endif
 
@@ -1477,10 +1477,9 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                          * shouldn't happen.
                          */
                         if (WARN(before(*seq, TCP_SKB_CB(skb)->seq),
-                             KERN_INFO "recvmsg bug: copied %X "
-                                       "seq %X rcvnxt %X fl %X\n", *seq,
-                                       TCP_SKB_CB(skb)->seq, tp->rcv_nxt,
-                                       flags))
+                                 "recvmsg bug: copied %X seq %X rcvnxt %X fl %X\n",
+                                 *seq, TCP_SKB_CB(skb)->seq, tp->rcv_nxt,
+                                 flags))
                                 break;
 
                         offset = *seq - TCP_SKB_CB(skb)->seq;
@@ -1490,10 +1489,9 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                                 goto found_ok_skb;
                         if (tcp_hdr(skb)->fin)
                                 goto found_fin_ok;
-                        WARN(!(flags & MSG_PEEK), KERN_INFO "recvmsg bug 2: "
-                                        "copied %X seq %X rcvnxt %X fl %X\n",
-                                        *seq, TCP_SKB_CB(skb)->seq,
-                                        tp->rcv_nxt, flags);
+                        WARN(!(flags & MSG_PEEK),
+                             "recvmsg bug 2: copied %X seq %X rcvnxt %X fl %X\n",
+                             *seq, TCP_SKB_CB(skb)->seq, tp->rcv_nxt, flags);
                 }
 
                 /* Well, if we have backlog, try to process it now yet. */
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index e13da6de1fc..4fc3387aa99 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1210,12 +1210,6 @@ static const struct tcp_request_sock_ops tcp_request_sock_ipv4_ops = {
 };
 #endif
 
-static struct timewait_sock_ops tcp_timewait_sock_ops = {
-        .twsk_obj_size  = sizeof(struct tcp_timewait_sock),
-        .twsk_unique    = tcp_twsk_unique,
-        .twsk_destructor= tcp_twsk_destructor,
-};
-
 int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
 {
         struct tcp_extend_values tmp_ext;
@@ -1347,7 +1341,7 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
                     tcp_death_row.sysctl_tw_recycle &&
                     (dst = inet_csk_route_req(sk, req)) != NULL &&
                     (peer = rt_get_peer((struct rtable *)dst)) != NULL &&
-                    peer->v4daddr == saddr) {
+                    peer->daddr.a4 == saddr) {
                         inet_peer_refcheck(peer);
                         if ((u32)get_seconds() - peer->tcp_ts_stamp < TCP_PAWS_MSL &&
                             (s32)(peer->tcp_ts - req->ts_recent) >
@@ -1763,64 +1757,40 @@ do_time_wait:
         goto discard_it;
 }
 
-/* VJ's idea. Save last timestamp seen from this destination
- * and hold it at least for normal timewait interval to use for duplicate
- * segment detection in subsequent connections, before they enter synchronized
- * state.
- */
-
-int tcp_v4_remember_stamp(struct sock *sk)
+struct inet_peer *tcp_v4_get_peer(struct sock *sk, bool *release_it)
 {
+        struct rtable *rt = (struct rtable *) __sk_dst_get(sk);
         struct inet_sock *inet = inet_sk(sk);
-        struct tcp_sock *tp = tcp_sk(sk);
-        struct rtable *rt = (struct rtable *)__sk_dst_get(sk);
-        struct inet_peer *peer = NULL;
-        int release_it = 0;
+        struct inet_peer *peer;
 
         if (!rt || rt->rt_dst != inet->inet_daddr) {
-                peer = inet_getpeer(inet->inet_daddr, 1);
-                release_it = 1;
+                peer = inet_getpeer_v4(inet->inet_daddr, 1);
+                *release_it = true;
         } else {
                 if (!rt->peer)
                         rt_bind_peer(rt, 1);
                 peer = rt->peer;
+                *release_it = false;
         }
 
-        if (peer) {
-                if ((s32)(peer->tcp_ts - tp->rx_opt.ts_recent) <= 0 ||
-                    ((u32)get_seconds() - peer->tcp_ts_stamp > TCP_PAWS_MSL &&
-                     peer->tcp_ts_stamp <= (u32)tp->rx_opt.ts_recent_stamp)) {
-                        peer->tcp_ts_stamp = (u32)tp->rx_opt.ts_recent_stamp;
-                        peer->tcp_ts = tp->rx_opt.ts_recent;
-                }
-                if (release_it)
-                        inet_putpeer(peer);
-                return 1;
-        }
-
-        return 0;
+        return peer;
 }
-EXPORT_SYMBOL(tcp_v4_remember_stamp);
+EXPORT_SYMBOL(tcp_v4_get_peer);
 
-int tcp_v4_tw_remember_stamp(struct inet_timewait_sock *tw)
+void *tcp_v4_tw_get_peer(struct sock *sk)
 {
-        struct inet_peer *peer = inet_getpeer(tw->tw_daddr, 1);
-
-        if (peer) {
-                const struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
-
-                if ((s32)(peer->tcp_ts - tcptw->tw_ts_recent) <= 0 ||
-                    ((u32)get_seconds() - peer->tcp_ts_stamp > TCP_PAWS_MSL &&
-                     peer->tcp_ts_stamp <= (u32)tcptw->tw_ts_recent_stamp)) {
-                        peer->tcp_ts_stamp = (u32)tcptw->tw_ts_recent_stamp;
-                        peer->tcp_ts       = tcptw->tw_ts_recent;
-                }
-                inet_putpeer(peer);
-                return 1;
-        }
+        struct inet_timewait_sock *tw = inet_twsk(sk);
 
-        return 0;
+        return inet_getpeer_v4(tw->tw_daddr, 1);
 }
+EXPORT_SYMBOL(tcp_v4_tw_get_peer);
+
+static struct timewait_sock_ops tcp_timewait_sock_ops = {
+        .twsk_obj_size  = sizeof(struct tcp_timewait_sock),
+        .twsk_unique    = tcp_twsk_unique,
+        .twsk_destructor= tcp_twsk_destructor,
+        .twsk_getpeer   = tcp_v4_tw_get_peer,
+};
 
 const struct inet_connection_sock_af_ops ipv4_specific = {
         .queue_xmit        = ip_queue_xmit,
@@ -1828,7 +1798,7 @@ const struct inet_connection_sock_af_ops ipv4_specific = {
         .rebuild_header    = inet_sk_rebuild_header,
         .conn_request      = tcp_v4_conn_request,
         .syn_recv_sock     = tcp_v4_syn_recv_sock,
-        .remember_stamp    = tcp_v4_remember_stamp,
+        .get_peer          = tcp_v4_get_peer,
         .net_header_len    = sizeof(struct iphdr),
         .setsockopt        = ip_setsockopt,
         .getsockopt        = ip_getsockopt,
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index a66735f7596..80b1f80759a 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -49,6 +49,56 @@ struct inet_timewait_death_row tcp_death_row = {
 };
 EXPORT_SYMBOL_GPL(tcp_death_row);
 
+/* VJ's idea. Save last timestamp seen from this destination
+ * and hold it at least for normal timewait interval to use for duplicate
+ * segment detection in subsequent connections, before they enter synchronized
+ * state.
+ */
+
+static int tcp_remember_stamp(struct sock *sk)
+{
+        const struct inet_connection_sock *icsk = inet_csk(sk);
+        struct tcp_sock *tp = tcp_sk(sk);
+        struct inet_peer *peer;
+        bool release_it;
+
+        peer = icsk->icsk_af_ops->get_peer(sk, &release_it);
+        if (peer) {
+                if ((s32)(peer->tcp_ts - tp->rx_opt.ts_recent) <= 0 ||
+                    ((u32)get_seconds() - peer->tcp_ts_stamp > TCP_PAWS_MSL &&
+                     peer->tcp_ts_stamp <= (u32)tp->rx_opt.ts_recent_stamp)) {
+                        peer->tcp_ts_stamp = (u32)tp->rx_opt.ts_recent_stamp;
+                        peer->tcp_ts = tp->rx_opt.ts_recent;
+                }
+                if (release_it)
+                        inet_putpeer(peer);
+                return 1;
+        }
+
+        return 0;
+}
+
+static int tcp_tw_remember_stamp(struct inet_timewait_sock *tw)
+{
+        struct sock *sk = (struct sock *) tw;
+        struct inet_peer *peer;
+
+        peer = twsk_getpeer(sk);
+        if (peer) {
+                const struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
+
+                if ((s32)(peer->tcp_ts - tcptw->tw_ts_recent) <= 0 ||
+                    ((u32)get_seconds() - peer->tcp_ts_stamp > TCP_PAWS_MSL &&
+                     peer->tcp_ts_stamp <= (u32)tcptw->tw_ts_recent_stamp)) {
+                        peer->tcp_ts_stamp = (u32)tcptw->tw_ts_recent_stamp;
+                        peer->tcp_ts       = tcptw->tw_ts_recent;
+                }
+                inet_putpeer(peer);
+                return 1;
+        }
+        return 0;
+}
+
 static __inline__ int tcp_in_window(u32 seq, u32 end_seq, u32 s_win, u32 e_win)
 {
         if (seq == s_win)
@@ -149,14 +199,9 @@ kill_with_rst:
                         tcptw->tw_ts_recent       = tmp_opt.rcv_tsval;
                 }
 
-                /* I am shamed, but failed to make it more elegant.
-                 * Yes, it is direct reference to IP, which is impossible
-                 * to generalize to IPv6. Taking into account that IPv6
-                 * do not understand recycling in any case, it not
-                 * a big problem in practice. --ANK */
-                if (tw->tw_family == AF_INET &&
-                    tcp_death_row.sysctl_tw_recycle && tcptw->tw_ts_recent_stamp &&
-                    tcp_v4_tw_remember_stamp(tw))
+                if (tcp_death_row.sysctl_tw_recycle &&
+                    tcptw->tw_ts_recent_stamp &&
+                    tcp_tw_remember_stamp(tw))
                         inet_twsk_schedule(tw, &tcp_death_row, tw->tw_timeout,
                                            TCP_TIMEWAIT_LEN);
                 else
@@ -274,7 +319,7 @@ void tcp_time_wait(struct sock *sk, int state, int timeo)
         int recycle_ok = 0;
 
         if (tcp_death_row.sysctl_tw_recycle && tp->rx_opt.ts_recent_stamp)
-                recycle_ok = icsk->icsk_af_ops->remember_stamp(sk);
+                recycle_ok = tcp_remember_stamp(sk);
 
         if (tcp_death_row.tw_count < tcp_death_row.sysctl_max_tw_buckets)
                 tw = inet_twsk_alloc(sk, state);
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 61c2463e275..97041f24cd2 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -55,7 +55,7 @@ int sysctl_tcp_workaround_signed_windows __read_mostly = 0;
 int sysctl_tcp_tso_win_divisor __read_mostly = 3;
 
 int sysctl_tcp_mtu_probing __read_mostly = 0;
-int sysctl_tcp_base_mss __read_mostly = 512;
+int sysctl_tcp_base_mss __read_mostly = TCP_BASE_MSS;
 
 /* By default, RFC2861 behavior.  */
 int sysctl_tcp_slow_start_after_idle __read_mostly = 1;
@@ -824,8 +824,11 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
                                                            &md5);
         tcp_header_size = tcp_options_size + sizeof(struct tcphdr);
 
-        if (tcp_packets_in_flight(tp) == 0)
+        if (tcp_packets_in_flight(tp) == 0) {
                 tcp_ca_event(sk, CA_EVENT_TX_START);
+                skb->ooo_okay = 1;
+        } else
+                skb->ooo_okay = 0;
 
         skb_push(skb, tcp_header_size);
         skb_reset_transport_header(skb);
@@ -2596,6 +2599,7 @@ int tcp_connect(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *buff;
+        int err;
 
         tcp_connect_init(sk);
 
@@ -2618,7 +2622,9 @@ int tcp_connect(struct sock *sk)
         sk->sk_wmem_queued += buff->truesize;
         sk_mem_charge(sk, buff->truesize);
         tp->packets_out += tcp_skb_pcount(buff);
-        tcp_transmit_skb(sk, buff, 1, sk->sk_allocation);
+        err = tcp_transmit_skb(sk, buff, 1, sk->sk_allocation);
+        if (err == -ECONNREFUSED)
+                return err;
 
         /* We change tp->snd_nxt after the tcp_transmit_skb() call
          * in order to make this packet get counted in tcpOutSegs.
diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
index 6211e211417..85ee7eb7e38 100644
--- a/net/ipv4/tcp_probe.c
+++ b/net/ipv4/tcp_probe.c
@@ -154,7 +154,7 @@ static int tcpprobe_sprint(char *tbuf, int n)
         struct timespec tv
                 = ktime_to_timespec(ktime_sub(p->tstamp, tcp_probe.start));
 
-        return snprintf(tbuf, n,
+        return scnprintf(tbuf, n,
                         "%lu.%09lu %pI4:%u %pI4:%u %d %#x %#x %u %u %u %u\n",
                         (unsigned long) tv.tv_sec,
                         (unsigned long) tv.tv_nsec,
@@ -174,7 +174,7 @@ static ssize_t tcpprobe_read(struct file *file, char __user *buf,
                 return -EINVAL;
 
         while (cnt < len) {
-                char tbuf[128];
+                char tbuf[164];
                 int width;
 
                 /* Wait for data in buffer */
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 5e0a3a582a5..b37181da487 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -430,7 +430,7 @@ begin:
 
         if (result) {
 exact_match:
-                if (unlikely(!atomic_inc_not_zero(&result->sk_refcnt)))
+                if (unlikely(!atomic_inc_not_zero_hint(&result->sk_refcnt, 2)))
                         result = NULL;
                 else if (unlikely(compute_score2(result, net, saddr, sport,
                                   daddr, hnum, dif) < badness)) {
@@ -500,7 +500,7 @@ begin:
                 goto begin;
 
         if (result) {
-                if (unlikely(!atomic_inc_not_zero(&result->sk_refcnt)))
+                if (unlikely(!atomic_inc_not_zero_hint(&result->sk_refcnt, 2)))
                         result = NULL;
                 else if (unlikely(compute_score(result, net, saddr, hnum, sport,
                                   daddr, dport, dif) < badness)) {
@@ -890,15 +890,13 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         if (rt == NULL) {
                 struct flowi fl = { .oif = ipc.oif,
                                     .mark = sk->sk_mark,
-                                    .nl_u = { .ip4_u =
-                                              { .daddr = faddr,
-                                                .saddr = saddr,
-                                                .tos = tos } },
+                                    .fl4_dst = faddr,
+                                    .fl4_src = saddr,
+                                    .fl4_tos = tos,
                                     .proto = sk->sk_protocol,
                                     .flags = inet_sk_flowi_flags(sk),
-                                    .uli_u = { .ports =
-                                               { .sport = inet->inet_sport,
-                                                 .dport = dport } } };
+                                    .fl_ip_sport = inet->inet_sport,
+                                    .fl_ip_dport = dport };
                 struct net *net = sock_net(sk);
 
                 security_sk_classify_flow(sk, &fl);
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 4464f3bff6a..b057d40adde 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -11,6 +11,7 @@
 #include <linux/err.h>
 #include <linux/kernel.h>
 #include <linux/inetdevice.h>
+#include <linux/if_tunnel.h>
 #include <net/dst.h>
 #include <net/xfrm.h>
 #include <net/ip.h>
@@ -22,12 +23,8 @@ static struct dst_entry *xfrm4_dst_lookup(struct net *net, int tos,
                                           xfrm_address_t *daddr)
 {
         struct flowi fl = {
-                .nl_u = {
-                        .ip4_u = {
-                                .tos = tos,
-                                .daddr = daddr->a4,
-                        },
-                },
+                .fl4_dst = daddr->a4,
+                .fl4_tos = tos,
         };
         struct dst_entry *dst;
         struct rtable *rt;
@@ -80,10 +77,6 @@ static int xfrm4_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
         xdst->u.dst.dev = dev;
         dev_hold(dev);
 
-        xdst->u.rt.idev = in_dev_get(dev);
-        if (!xdst->u.rt.idev)
-                return -ENODEV;
-
         xdst->u.rt.peer = rt->peer;
         if (rt->peer)
                 atomic_inc(&rt->peer->refcnt);
@@ -158,6 +151,20 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
                                 fl->fl_ipsec_spi = htonl(ntohs(ipcomp_hdr[1]));
                         }
                         break;
+
+                case IPPROTO_GRE:
+                        if (pskb_may_pull(skb, xprth + 12 - skb->data)) {
+                                __be16 *greflags = (__be16 *)xprth;
+                                __be32 *gre_hdr = (__be32 *)xprth;
+
+                                if (greflags[0] & GRE_KEY) {
+                                        if (greflags[0] & GRE_CSUM)
+                                                gre_hdr++;
+                                        fl->fl_gre_key = gre_hdr[1];
+                                }
+                        }
+                        break;
+
                 default:
                         fl->fl_ipsec_spi = 0;
                         break;
@@ -189,8 +196,6 @@ static void xfrm4_dst_destroy(struct dst_entry *dst)
 {
         struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
 
-        if (likely(xdst->u.rt.idev))
-                in_dev_put(xdst->u.rt.idev);
         if (likely(xdst->u.rt.peer))
                 inet_putpeer(xdst->u.rt.peer);
         xfrm_dst_destroy(xdst);
@@ -199,27 +204,9 @@ static void xfrm4_dst_destroy(struct dst_entry *dst)
 static void xfrm4_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
                              int unregister)
 {
-        struct xfrm_dst *xdst;
-
         if (!unregister)
                 return;
 
-        xdst = (struct xfrm_dst *)dst;
-        if (xdst->u.rt.idev->dev == dev) {
-                struct in_device *loopback_idev =
-                        in_dev_get(dev_net(dev)->loopback_dev);
-                BUG_ON(!loopback_idev);
-
-                do {
-                        in_dev_put(xdst->u.rt.idev);
-                        xdst->u.rt.idev = loopback_idev;
-                        in_dev_hold(loopback_idev);
-                        xdst = (struct xfrm_dst *)xdst->u.dst.child;
-                } while (xdst->u.dst.xfrm);
-
-                __in_dev_put(loopback_idev);
-        }
-
         xfrm_dst_ifdown(dst, dev);
 }
 
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 23cc8e1ce8d..1023ad0d2b1 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3836,6 +3836,15 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
         array[DEVCONF_FORCE_TLLAO] = cnf->force_tllao;
 }
 
+static inline size_t inet6_ifla6_size(void)
+{
+        return nla_total_size(4) /* IFLA_INET6_FLAGS */
+             + nla_total_size(sizeof(struct ifla_cacheinfo))
+             + nla_total_size(DEVCONF_MAX * 4) /* IFLA_INET6_CONF */
+             + nla_total_size(IPSTATS_MIB_MAX * 8) /* IFLA_INET6_STATS */
+             + nla_total_size(ICMP6_MIB_MAX * 8); /* IFLA_INET6_ICMP6STATS */
+}
+
 static inline size_t inet6_if_nlmsg_size(void)
 {
         return NLMSG_ALIGN(sizeof(struct ifinfomsg))
@@ -3843,13 +3852,7 @@ static inline size_t inet6_if_nlmsg_size(void)
                + nla_total_size(MAX_ADDR_LEN) /* IFLA_ADDRESS */
                + nla_total_size(4) /* IFLA_MTU */
                + nla_total_size(4) /* IFLA_LINK */
-               + nla_total_size( /* IFLA_PROTINFO */
-                        nla_total_size(4) /* IFLA_INET6_FLAGS */
-                        + nla_total_size(sizeof(struct ifla_cacheinfo))
-                        + nla_total_size(DEVCONF_MAX * 4) /* IFLA_INET6_CONF */
-                        + nla_total_size(IPSTATS_MIB_MAX * 8) /* IFLA_INET6_STATS */
-                        + nla_total_size(ICMP6_MIB_MAX * 8) /* IFLA_INET6_ICMP6STATS */
-                 );
+               + nla_total_size(inet6_ifla6_size()); /* IFLA_PROTINFO */
 }
 
 static inline void __snmp6_fill_stats(u64 *stats, void __percpu **mib,
@@ -3896,15 +3899,70 @@ static void snmp6_fill_stats(u64 *stats, struct inet6_dev *idev, int attrtype,
         }
 }
 
+static int inet6_fill_ifla6_attrs(struct sk_buff *skb, struct inet6_dev *idev)
+{
+        struct nlattr *nla;
+        struct ifla_cacheinfo ci;
+
+        NLA_PUT_U32(skb, IFLA_INET6_FLAGS, idev->if_flags);
+
+        ci.max_reasm_len = IPV6_MAXPLEN;
+        ci.tstamp = cstamp_delta(idev->tstamp);
+        ci.reachable_time = jiffies_to_msecs(idev->nd_parms->reachable_time);
+        ci.retrans_time = jiffies_to_msecs(idev->nd_parms->retrans_time);
+        NLA_PUT(skb, IFLA_INET6_CACHEINFO, sizeof(ci), &ci);
+
+        nla = nla_reserve(skb, IFLA_INET6_CONF, DEVCONF_MAX * sizeof(s32));
+        if (nla == NULL)
+                goto nla_put_failure;
+        ipv6_store_devconf(&idev->cnf, nla_data(nla), nla_len(nla));
+
+        /* XXX - MC not implemented */
+
+        nla = nla_reserve(skb, IFLA_INET6_STATS, IPSTATS_MIB_MAX * sizeof(u64));
+        if (nla == NULL)
+                goto nla_put_failure;
+        snmp6_fill_stats(nla_data(nla), idev, IFLA_INET6_STATS, nla_len(nla));
+
+        nla = nla_reserve(skb, IFLA_INET6_ICMP6STATS, ICMP6_MIB_MAX * sizeof(u64));
+        if (nla == NULL)
+                goto nla_put_failure;
+        snmp6_fill_stats(nla_data(nla), idev, IFLA_INET6_ICMP6STATS, nla_len(nla));
+
+        return 0;
+
+nla_put_failure:
+        return -EMSGSIZE;
+}
+
+static size_t inet6_get_link_af_size(const struct net_device *dev)
+{
+        if (!__in6_dev_get(dev))
+                return 0;
+
+        return inet6_ifla6_size();
+}
+
+static int inet6_fill_link_af(struct sk_buff *skb, const struct net_device *dev)
+{
+        struct inet6_dev *idev = __in6_dev_get(dev);
+
+        if (!idev)
+                return -ENODATA;
+
+        if (inet6_fill_ifla6_attrs(skb, idev) < 0)
+                return -EMSGSIZE;
+
+        return 0;
+}
+
 static int inet6_fill_ifinfo(struct sk_buff *skb, struct inet6_dev *idev,
                              u32 pid, u32 seq, int event, unsigned int flags)
 {
         struct net_device *dev = idev->dev;
-        struct nlattr *nla;
         struct ifinfomsg *hdr;
         struct nlmsghdr *nlh;
         void *protoinfo;
-        struct ifla_cacheinfo ci;
 
         nlh = nlmsg_put(skb, pid, seq, event, sizeof(*hdr), flags);
         if (nlh == NULL)
@@ -3931,30 +3989,8 @@ static int inet6_fill_ifinfo(struct sk_buff *skb, struct inet6_dev *idev,
         if (protoinfo == NULL)
                 goto nla_put_failure;
 
-        NLA_PUT_U32(skb, IFLA_INET6_FLAGS, idev->if_flags);
-
-        ci.max_reasm_len = IPV6_MAXPLEN;
-        ci.tstamp = cstamp_delta(idev->tstamp);
-        ci.reachable_time = jiffies_to_msecs(idev->nd_parms->reachable_time);
-        ci.retrans_time = jiffies_to_msecs(idev->nd_parms->retrans_time);
-        NLA_PUT(skb, IFLA_INET6_CACHEINFO, sizeof(ci), &ci);
-
-        nla = nla_reserve(skb, IFLA_INET6_CONF, DEVCONF_MAX * sizeof(s32));
-        if (nla == NULL)
-                goto nla_put_failure;
-        ipv6_store_devconf(&idev->cnf, nla_data(nla), nla_len(nla));
-
-        /* XXX - MC not implemented */
-
-        nla = nla_reserve(skb, IFLA_INET6_STATS, IPSTATS_MIB_MAX * sizeof(u64));
-        if (nla == NULL)
-                goto nla_put_failure;
-        snmp6_fill_stats(nla_data(nla), idev, IFLA_INET6_STATS, nla_len(nla));
-
-        nla = nla_reserve(skb, IFLA_INET6_ICMP6STATS, ICMP6_MIB_MAX * sizeof(u64));
-        if (nla == NULL)
+        if (inet6_fill_ifla6_attrs(skb, idev) < 0)
                 goto nla_put_failure;
-        snmp6_fill_stats(nla_data(nla), idev, IFLA_INET6_ICMP6STATS, nla_len(nla));
 
         nla_nest_end(skb, protoinfo);
         return nlmsg_end(skb, nlh);
@@ -4625,6 +4661,12 @@ int unregister_inet6addr_notifier(struct notifier_block *nb)
 }
 EXPORT_SYMBOL(unregister_inet6addr_notifier);
 
+static struct rtnl_af_ops inet6_ops = {
+        .family           = AF_INET6,
+        .fill_link_af     = inet6_fill_link_af,
+        .get_link_af_size = inet6_get_link_af_size,
+};
+
 /*
  *      Init / cleanup code
  */
@@ -4676,6 +4718,10 @@ int __init addrconf_init(void)
 
         addrconf_verify(0);
 
+        err = rtnl_af_register(&inet6_ops);
+        if (err < 0)
+                goto errout_af;
+
         err = __rtnl_register(PF_INET6, RTM_GETLINK, NULL, inet6_dump_ifinfo);
         if (err < 0)
                 goto errout;
@@ -4691,6 +4737,8 @@ int __init addrconf_init(void)
 
         return 0;
 errout:
+        rtnl_af_unregister(&inet6_ops);
+errout_af:
         unregister_netdevice_notifier(&ipv6_dev_notf);
 errlo:
         unregister_pernet_subsys(&addrconf_ops);
@@ -4711,6 +4759,8 @@ void addrconf_cleanup(void)
 
         rtnl_lock();
 
+        __rtnl_af_unregister(&inet6_ops);
+
         /* clean dev list */
         for_each_netdev(&init_net, dev) {
                 if (__in6_dev_get(dev) == NULL)
diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index 8a1628023bd..e46305d1815 100644
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -54,24 +54,54 @@ int inet6_csk_bind_conflict(const struct sock *sk,
 
 EXPORT_SYMBOL_GPL(inet6_csk_bind_conflict);
 
+struct dst_entry *inet6_csk_route_req(struct sock *sk,
+                                      const struct request_sock *req)
+{
+        struct inet6_request_sock *treq = inet6_rsk(req);
+        struct ipv6_pinfo *np = inet6_sk(sk);
+        struct in6_addr *final_p, final;
+        struct dst_entry *dst;
+        struct flowi fl;
+
+        memset(&fl, 0, sizeof(fl));
+        fl.proto = IPPROTO_TCP;
+        ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
+        final_p = fl6_update_dst(&fl, np->opt, &final);
+        ipv6_addr_copy(&fl.fl6_src, &treq->loc_addr);
+        fl.oif = sk->sk_bound_dev_if;
+        fl.mark = sk->sk_mark;
+        fl.fl_ip_dport = inet_rsk(req)->rmt_port;
+        fl.fl_ip_sport = inet_rsk(req)->loc_port;
+        security_req_classify_flow(req, &fl);
+
+        if (ip6_dst_lookup(sk, &dst, &fl))
+                return NULL;
+
+        if (final_p)
+                ipv6_addr_copy(&fl.fl6_dst, final_p);
+
+        if ((xfrm_lookup(sock_net(sk), &dst, &fl, sk, 0)) < 0)
+                return NULL;
+
+        return dst;
+}
+
 /*
  * request_sock (formerly open request) hash tables.
  */
 static u32 inet6_synq_hash(const struct in6_addr *raddr, const __be16 rport,
                            const u32 rnd, const u16 synq_hsize)
 {
-        u32 a = (__force u32)raddr->s6_addr32[0];
-        u32 b = (__force u32)raddr->s6_addr32[1];
-        u32 c = (__force u32)raddr->s6_addr32[2];
-
-        a += JHASH_GOLDEN_RATIO;
-        b += JHASH_GOLDEN_RATIO;
-        c += rnd;
-        __jhash_mix(a, b, c);
-
-        a += (__force u32)raddr->s6_addr32[3];
-        b += (__force u32)rport;
-        __jhash_mix(a, b, c);
+        u32 c;
+
+        c = jhash_3words((__force u32)raddr->s6_addr32[0],
+                         (__force u32)raddr->s6_addr32[1],
+                         (__force u32)raddr->s6_addr32[2],
+                         rnd);
+
+        c = jhash_2words((__force u32)raddr->s6_addr32[3],
+                         (__force u32)rport,
+                         c);
 
         return c & (synq_hsize - 1);
 }
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 70e891a20fb..4f4483e697b 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -58,8 +58,6 @@ MODULE_AUTHOR("Ville Nuorvala");
 MODULE_DESCRIPTION("IPv6 tunneling device");
 MODULE_LICENSE("GPL");
 
-#define IPV6_TLV_TEL_DST_SIZE 8
-
 #ifdef IP6_TNL_DEBUG
 #define IP6_TNL_TRACE(x...) printk(KERN_DEBUG "%s:" x "\n", __func__)
 #else
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 6f32ffce702..9fab274019c 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -1843,9 +1843,7 @@ static int ip6mr_forward2(struct net *net, struct mr6_table *mrt,
 
         fl = (struct flowi) {
                 .oif = vif->link,
-                .nl_u = { .ip6_u =
-                                { .daddr = ipv6h->daddr, }
-                }
+                .fl6_dst = ipv6h->daddr,
         };
 
         dst = ip6_route_output(net, NULL, &fl);
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index d1444b95ad7..49f986d626a 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -82,7 +82,7 @@ static void *__mld2_query_bugs[] __attribute__((__unused__)) = {
 static struct in6_addr mld2_all_mcr = MLD2_ALL_MCR_INIT;
 
 /* Big mc list lock for all the sockets */
-static DEFINE_RWLOCK(ipv6_sk_mc_lock);
+static DEFINE_SPINLOCK(ipv6_sk_mc_lock);
 
 static void igmp6_join_group(struct ifmcaddr6 *ma);
 static void igmp6_leave_group(struct ifmcaddr6 *ma);
@@ -123,6 +123,11 @@ int sysctl_mld_max_msf __read_mostly = IPV6_MLD_MAX_MSF;
  *      socket join on multicast group
  */
 
+#define for_each_pmc_rcu(np, pmc)                               \
+        for (pmc = rcu_dereference(np->ipv6_mc_list);           \
+             pmc != NULL;                                       \
+             pmc = rcu_dereference(pmc->next))
+
 int ipv6_sock_mc_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
 {
         struct net_device *dev = NULL;
@@ -134,15 +139,15 @@ int ipv6_sock_mc_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
         if (!ipv6_addr_is_multicast(addr))
                 return -EINVAL;
 
-        read_lock_bh(&ipv6_sk_mc_lock);
-        for (mc_lst=np->ipv6_mc_list; mc_lst; mc_lst=mc_lst->next) {
+        rcu_read_lock();
+        for_each_pmc_rcu(np, mc_lst) {
                 if ((ifindex == 0 || mc_lst->ifindex == ifindex) &&
                     ipv6_addr_equal(&mc_lst->addr, addr)) {
-                        read_unlock_bh(&ipv6_sk_mc_lock);
+                        rcu_read_unlock();
                         return -EADDRINUSE;
                 }
         }
-        read_unlock_bh(&ipv6_sk_mc_lock);
+        rcu_read_unlock();
 
         mc_lst = sock_kmalloc(sk, sizeof(struct ipv6_mc_socklist), GFP_KERNEL);
 
@@ -186,33 +191,41 @@ int ipv6_sock_mc_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
                 return err;
         }
 
-        write_lock_bh(&ipv6_sk_mc_lock);
+        spin_lock(&ipv6_sk_mc_lock);
         mc_lst->next = np->ipv6_mc_list;
-        np->ipv6_mc_list = mc_lst;
-        write_unlock_bh(&ipv6_sk_mc_lock);
+        rcu_assign_pointer(np->ipv6_mc_list, mc_lst);
+        spin_unlock(&ipv6_sk_mc_lock);
 
         rcu_read_unlock();
 
         return 0;
 }
 
+static void ipv6_mc_socklist_reclaim(struct rcu_head *head)
+{
+        kfree(container_of(head, struct ipv6_mc_socklist, rcu));
+}
 /*
  *      socket leave on multicast group
  */
 int ipv6_sock_mc_drop(struct sock *sk, int ifindex, const struct in6_addr *addr)
 {
         struct ipv6_pinfo *np = inet6_sk(sk);
-        struct ipv6_mc_socklist *mc_lst, **lnk;
+        struct ipv6_mc_socklist *mc_lst;
+        struct ipv6_mc_socklist __rcu **lnk;
         struct net *net = sock_net(sk);
 
-        write_lock_bh(&ipv6_sk_mc_lock);
-        for (lnk = &np->ipv6_mc_list; (mc_lst = *lnk) !=NULL ; lnk = &mc_lst->next) {
+        spin_lock(&ipv6_sk_mc_lock);
+        for (lnk = &np->ipv6_mc_list;
+             (mc_lst = rcu_dereference_protected(*lnk,
+                        lockdep_is_held(&ipv6_sk_mc_lock))) !=NULL ;
+              lnk = &mc_lst->next) {
                 if ((ifindex == 0 || mc_lst->ifindex == ifindex) &&
                     ipv6_addr_equal(&mc_lst->addr, addr)) {
                         struct net_device *dev;
 
                         *lnk = mc_lst->next;
-                        write_unlock_bh(&ipv6_sk_mc_lock);
+                        spin_unlock(&ipv6_sk_mc_lock);
 
                         rcu_read_lock();
                         dev = dev_get_by_index_rcu(net, mc_lst->ifindex);
@@ -225,11 +238,12 @@ int ipv6_sock_mc_drop(struct sock *sk, int ifindex, const struct in6_addr *addr)
                         } else
                                 (void) ip6_mc_leave_src(sk, mc_lst, NULL);
                         rcu_read_unlock();
-                        sock_kfree_s(sk, mc_lst, sizeof(*mc_lst));
+                        atomic_sub(sizeof(*mc_lst), &sk->sk_omem_alloc);
+                        call_rcu(&mc_lst->rcu, ipv6_mc_socklist_reclaim);
                         return 0;
                 }
         }
-        write_unlock_bh(&ipv6_sk_mc_lock);
+        spin_unlock(&ipv6_sk_mc_lock);
 
         return -EADDRNOTAVAIL;
 }
@@ -257,7 +271,7 @@ static struct inet6_dev *ip6_mc_find_dev_rcu(struct net *net,
                 return NULL;
         idev = __in6_dev_get(dev);
         if (!idev)
-                return NULL;;
+                return NULL;
         read_lock_bh(&idev->lock);
         if (idev->dead) {
                 read_unlock_bh(&idev->lock);
@@ -272,12 +286,13 @@ void ipv6_sock_mc_close(struct sock *sk)
         struct ipv6_mc_socklist *mc_lst;
         struct net *net = sock_net(sk);
 
-        write_lock_bh(&ipv6_sk_mc_lock);
-        while ((mc_lst = np->ipv6_mc_list) != NULL) {
+        spin_lock(&ipv6_sk_mc_lock);
+        while ((mc_lst = rcu_dereference_protected(np->ipv6_mc_list,
+                                lockdep_is_held(&ipv6_sk_mc_lock))) != NULL) {
                 struct net_device *dev;
 
                 np->ipv6_mc_list = mc_lst->next;
-                write_unlock_bh(&ipv6_sk_mc_lock);
+                spin_unlock(&ipv6_sk_mc_lock);
 
                 rcu_read_lock();
                 dev = dev_get_by_index_rcu(net, mc_lst->ifindex);
@@ -290,11 +305,13 @@ void ipv6_sock_mc_close(struct sock *sk)
                 } else
                         (void) ip6_mc_leave_src(sk, mc_lst, NULL);
                 rcu_read_unlock();
-                sock_kfree_s(sk, mc_lst, sizeof(*mc_lst));
 
-                write_lock_bh(&ipv6_sk_mc_lock);
+                atomic_sub(sizeof(*mc_lst), &sk->sk_omem_alloc);
+                call_rcu(&mc_lst->rcu, ipv6_mc_socklist_reclaim);
+
+                spin_lock(&ipv6_sk_mc_lock);
         }
-        write_unlock_bh(&ipv6_sk_mc_lock);
+        spin_unlock(&ipv6_sk_mc_lock);
 }
 
 int ip6_mc_source(int add, int omode, struct sock *sk,
@@ -328,8 +345,7 @@ int ip6_mc_source(int add, int omode, struct sock *sk,
 
         err = -EADDRNOTAVAIL;
 
-        read_lock(&ipv6_sk_mc_lock);
-        for (pmc=inet6->ipv6_mc_list; pmc; pmc=pmc->next) {
+        for_each_pmc_rcu(inet6, pmc) {
                 if (pgsr->gsr_interface && pmc->ifindex != pgsr->gsr_interface)
                         continue;
                 if (ipv6_addr_equal(&pmc->addr, group))
@@ -428,7 +444,6 @@ int ip6_mc_source(int add, int omode, struct sock *sk,
 done:
         if (pmclocked)
                 write_unlock(&pmc->sflock);
-        read_unlock(&ipv6_sk_mc_lock);
         read_unlock_bh(&idev->lock);
         rcu_read_unlock();
         if (leavegroup)
@@ -466,14 +481,13 @@ int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf)
         dev = idev->dev;
 
         err = 0;
-        read_lock(&ipv6_sk_mc_lock);
 
         if (gsf->gf_fmode == MCAST_INCLUDE && gsf->gf_numsrc == 0) {
                 leavegroup = 1;
                 goto done;
         }
 
-        for (pmc=inet6->ipv6_mc_list; pmc; pmc=pmc->next) {
+        for_each_pmc_rcu(inet6, pmc) {
                 if (pmc->ifindex != gsf->gf_interface)
                         continue;
                 if (ipv6_addr_equal(&pmc->addr, group))
@@ -521,7 +535,6 @@ int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf)
         write_unlock(&pmc->sflock);
         err = 0;
 done:
-        read_unlock(&ipv6_sk_mc_lock);
         read_unlock_bh(&idev->lock);
         rcu_read_unlock();
         if (leavegroup)
@@ -562,7 +575,7 @@ int ip6_mc_msfget(struct sock *sk, struct group_filter *gsf,
          * so reading the list is safe.
          */
 
-        for (pmc=inet6->ipv6_mc_list; pmc; pmc=pmc->next) {
+        for_each_pmc_rcu(inet6, pmc) {
                 if (pmc->ifindex != gsf->gf_interface)
                         continue;
                 if (ipv6_addr_equal(group, &pmc->addr))
@@ -612,13 +625,13 @@ int inet6_mc_check(struct sock *sk, const struct in6_addr *mc_addr,
         struct ip6_sf_socklist *psl;
         int rv = 1;
 
-        read_lock(&ipv6_sk_mc_lock);
-        for (mc = np->ipv6_mc_list; mc; mc = mc->next) {
+        rcu_read_lock();
+        for_each_pmc_rcu(np, mc) {
                 if (ipv6_addr_equal(&mc->addr, mc_addr))
                         break;
         }
         if (!mc) {
-                read_unlock(&ipv6_sk_mc_lock);
+                rcu_read_unlock();
                 return 1;
         }
         read_lock(&mc->sflock);
@@ -638,7 +651,7 @@ int inet6_mc_check(struct sock *sk, const struct in6_addr *mc_addr,
                         rv = 0;
         }
         read_unlock(&mc->sflock);
-        read_unlock(&ipv6_sk_mc_lock);
+        rcu_read_unlock();
 
         return rv;
 }
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 998d6d27e7c..e18f8413020 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -141,18 +141,18 @@ struct neigh_table nd_tbl = {
         .proxy_redo =   pndisc_redo,
         .id =           "ndisc_cache",
         .parms = {
-                .tbl =                  &nd_tbl,
-                .base_reachable_time =  30 * HZ,
-                .retrans_time =  1 * HZ,
-                .gc_staletime = 60 * HZ,
-                .reachable_time =               30 * HZ,
-                .delay_probe_time =      5 * HZ,
-                .queue_len =             3,
-                .ucast_probes =  3,
-                .mcast_probes =  3,
-                .anycast_delay =         1 * HZ,
-                .proxy_delay =          (8 * HZ) / 10,
-                .proxy_qlen =           64,
+                .tbl                    = &nd_tbl,
+                .base_reachable_time    = ND_REACHABLE_TIME,
+                .retrans_time           = ND_RETRANS_TIMER,
+                .gc_staletime           = 60 * HZ,
+                .reachable_time         = ND_REACHABLE_TIME,
+                .delay_probe_time       = 5 * HZ,
+                .queue_len              = 3,
+                .ucast_probes           = 3,
+                .mcast_probes           = 3,
+                .anycast_delay          = 1 * HZ,
+                .proxy_delay            = (8 * HZ) / 10,
+                .proxy_qlen             = 64,
         },
         .gc_interval =    30 * HZ,
         .gc_thresh1 =    128,
diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
index 7155b2451d7..35915e8617f 100644
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -18,10 +18,8 @@ int ip6_route_me_harder(struct sk_buff *skb)
         struct flowi fl = {
                 .oif = skb->sk ? skb->sk->sk_bound_dev_if : 0,
                 .mark = skb->mark,
-                .nl_u =
-                { .ip6_u =
-                  { .daddr = iph->daddr,
-                    .saddr = iph->saddr, } },
+                .fl6_dst = iph->daddr,
+                .fl6_src = iph->saddr,
         };
 
         dst = ip6_route_output(net, skb->sk, &fl);
diff --git a/net/ipv6/netfilter/Makefile b/net/ipv6/netfilter/Makefile
index 0a432c9b079..abfee91ce81 100644
--- a/net/ipv6/netfilter/Makefile
+++ b/net/ipv6/netfilter/Makefile
@@ -11,13 +11,13 @@ obj-$(CONFIG_IP6_NF_RAW) += ip6table_raw.o
 obj-$(CONFIG_IP6_NF_SECURITY) += ip6table_security.o
 
 # objects for l3 independent conntrack
-nf_conntrack_ipv6-objs  :=  nf_conntrack_l3proto_ipv6.o nf_conntrack_proto_icmpv6.o
+nf_conntrack_ipv6-y  :=  nf_conntrack_l3proto_ipv6.o nf_conntrack_proto_icmpv6.o
 
 # l3 independent conntrack
 obj-$(CONFIG_NF_CONNTRACK_IPV6) += nf_conntrack_ipv6.o nf_defrag_ipv6.o
 
 # defrag
-nf_defrag_ipv6-objs := nf_defrag_ipv6_hooks.o nf_conntrack_reasm.o
+nf_defrag_ipv6-y := nf_defrag_ipv6_hooks.o nf_conntrack_reasm.o
 obj-$(CONFIG_NF_DEFRAG_IPV6) += nf_defrag_ipv6.o
 
 # matches
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 0f276645375..07beeb06f75 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -104,26 +104,22 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
 unsigned int inet6_hash_frag(__be32 id, const struct in6_addr *saddr,
                              const struct in6_addr *daddr, u32 rnd)
 {
-        u32 a, b, c;
-
-        a = (__force u32)saddr->s6_addr32[0];
-        b = (__force u32)saddr->s6_addr32[1];
-        c = (__force u32)saddr->s6_addr32[2];
-
-        a += JHASH_GOLDEN_RATIO;
-        b += JHASH_GOLDEN_RATIO;
-        c += rnd;
-        __jhash_mix(a, b, c);
-
-        a += (__force u32)saddr->s6_addr32[3];
-        b += (__force u32)daddr->s6_addr32[0];
-        c += (__force u32)daddr->s6_addr32[1];
-        __jhash_mix(a, b, c);
-
-        a += (__force u32)daddr->s6_addr32[2];
-        b += (__force u32)daddr->s6_addr32[3];
-        c += (__force u32)id;
-        __jhash_mix(a, b, c);
+        u32 c;
+
+        c = jhash_3words((__force u32)saddr->s6_addr32[0],
+                         (__force u32)saddr->s6_addr32[1],
+                         (__force u32)saddr->s6_addr32[2],
+                         rnd);
+
+        c = jhash_3words((__force u32)saddr->s6_addr32[3],
+                         (__force u32)daddr->s6_addr32[0],
+                         (__force u32)daddr->s6_addr32[1],
+                         c);
+
+        c =  jhash_3words((__force u32)daddr->s6_addr32[2],
+                          (__force u32)daddr->s6_addr32[3],
+                          (__force u32)id,
+                          c);
 
         return c & (INETFRAGS_HASHSZ - 1);
 }
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 96455ffb76f..026caef0326 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -188,11 +188,29 @@ static void ip6_dst_destroy(struct dst_entry *dst)
 {
         struct rt6_info *rt = (struct rt6_info *)dst;
         struct inet6_dev *idev = rt->rt6i_idev;
+        struct inet_peer *peer = rt->rt6i_peer;
 
         if (idev != NULL) {
                 rt->rt6i_idev = NULL;
                 in6_dev_put(idev);
         }
+        if (peer) {
+                BUG_ON(!(rt->rt6i_flags & RTF_CACHE));
+                rt->rt6i_peer = NULL;
+                inet_putpeer(peer);
+        }
+}
+
+void rt6_bind_peer(struct rt6_info *rt, int create)
+{
+        struct inet_peer *peer;
+
+        if (WARN_ON(!(rt->rt6i_flags & RTF_CACHE)))
+                return;
+
+        peer = inet_getpeer_v6(&rt->rt6i_dst.addr, create);
+        if (peer && cmpxchg(&rt->rt6i_peer, NULL, peer) != NULL)
+                inet_putpeer(peer);
 }
 
 static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
@@ -558,11 +576,7 @@ struct rt6_info *rt6_lookup(struct net *net, const struct in6_addr *daddr,
 {
         struct flowi fl = {
                 .oif = oif,
-                .nl_u = {
-                        .ip6_u = {
-                                .daddr = *daddr,
-                        },
-                },
+                .fl6_dst = *daddr,
         };
         struct dst_entry *dst;
         int flags = strict ? RT6_LOOKUP_F_IFACE : 0;
@@ -778,13 +792,9 @@ void ip6_route_input(struct sk_buff *skb)
         int flags = RT6_LOOKUP_F_HAS_SADDR;
         struct flowi fl = {
                 .iif = skb->dev->ifindex,
-                .nl_u = {
-                        .ip6_u = {
-                                .daddr = iph->daddr,
-                                .saddr = iph->saddr,
-                                .flowlabel = (* (__be32 *) iph)&IPV6_FLOWINFO_MASK,
-                        },
-                },
+                .fl6_dst = iph->daddr,
+                .fl6_src = iph->saddr,
+                .fl6_flowlabel = (* (__be32 *) iph)&IPV6_FLOWINFO_MASK,
                 .mark = skb->mark,
                 .proto = iph->nexthdr,
         };
@@ -1463,12 +1473,8 @@ static struct rt6_info *ip6_route_redirect(struct in6_addr *dest,
         struct ip6rd_flowi rdfl = {
                 .fl = {
                         .oif = dev->ifindex,
-                        .nl_u = {
-                                .ip6_u = {
-                                        .daddr = *dest,
-                                        .saddr = *src,
-                                },
-                        },
+                        .fl6_dst = *dest,
+                        .fl6_src = *src,
                 },
         };
 
@@ -2465,8 +2471,6 @@ static int ip6_route_dev_notify(struct notifier_block *this,
 
 #ifdef CONFIG_PROC_FS
 
-#define RT6_INFO_LEN (32 + 4 + 32 + 4 + 32 + 40 + 5 + 1)
-
 struct rt6_proc_arg
 {
         char *buffer;
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 8c4d00c7cd2..8ce38f10a54 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -731,10 +731,9 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
         }
 
         {
-                struct flowi fl = { .nl_u = { .ip4_u =
-                                              { .daddr = dst,
-                                                .saddr = tiph->saddr,
-                                                .tos = RT_TOS(tos) } },
+                struct flowi fl = { .fl4_dst = dst,
+                                    .fl4_src = tiph->saddr,
+                                    .fl4_tos = RT_TOS(tos),
                                     .oif = tunnel->parms.link,
                                     .proto = IPPROTO_IPV6 };
                 if (ip_route_output_key(dev_net(dev), &rt, &fl)) {
@@ -856,10 +855,9 @@ static void ipip6_tunnel_bind_dev(struct net_device *dev)
         iph = &tunnel->parms.iph;
 
         if (iph->daddr) {
-                struct flowi fl = { .nl_u = { .ip4_u =
-                                              { .daddr = iph->daddr,
-                                                .saddr = iph->saddr,
-                                                .tos = RT_TOS(iph->tos) } },
+                struct flowi fl = { .fl4_dst = iph->daddr,
+                                    .fl4_src = iph->saddr,
+                                    .fl4_tos = RT_TOS(iph->tos),
                                     .oif = tunnel->parms.link,
                                     .proto = IPPROTO_IPV6 };
                 struct rtable *rt;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 7e41e2cbb85..319458558df 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -130,6 +130,7 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct tcp_sock *tp = tcp_sk(sk);
         struct in6_addr *saddr = NULL, *final_p, final;
+        struct rt6_info *rt;
         struct flowi fl;
         struct dst_entry *dst;
         int addr_type;
@@ -280,6 +281,26 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
         sk->sk_gso_type = SKB_GSO_TCPV6;
         __ip6_dst_store(sk, dst, NULL, NULL);
 
+        rt = (struct rt6_info *) dst;
+        if (tcp_death_row.sysctl_tw_recycle &&
+            !tp->rx_opt.ts_recent_stamp &&
+            ipv6_addr_equal(&rt->rt6i_dst.addr, &np->daddr)) {
+                struct inet_peer *peer = rt6_get_peer(rt);
+                /*
+                 * VJ's idea. We save last timestamp seen from
+                 * the destination in peer table, when entering state
+                 * TIME-WAIT * and initialize rx_opt.ts_recent from it,
+                 * when trying new connection.
+                 */
+                if (peer) {
+                        inet_peer_refcheck(peer);
+                        if ((u32)get_seconds() - peer->tcp_ts_stamp <= TCP_PAWS_MSL) {
+                                tp->rx_opt.ts_recent_stamp = peer->tcp_ts_stamp;
+                                tp->rx_opt.ts_recent = peer->tcp_ts;
+                        }
+                }
+        }
+
         icsk->icsk_ext_hdr_len = 0;
         if (np->opt)
                 icsk->icsk_ext_hdr_len = (np->opt->opt_flen +
@@ -906,12 +927,6 @@ static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 };
 #endif
 
-static struct timewait_sock_ops tcp6_timewait_sock_ops = {
-        .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
-        .twsk_unique    = tcp_twsk_unique,
-        .twsk_destructor= tcp_twsk_destructor,
-};
-
 static void __tcp_v6_send_check(struct sk_buff *skb,
                                 struct in6_addr *saddr, struct in6_addr *daddr)
 {
@@ -1176,6 +1191,7 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct tcp_sock *tp = tcp_sk(sk);
         __u32 isn = TCP_SKB_CB(skb)->when;
+        struct dst_entry *dst = NULL;
 #ifdef CONFIG_SYN_COOKIES
         int want_cookie = 0;
 #else
@@ -1273,6 +1289,8 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
                 TCP_ECN_create_request(req, tcp_hdr(skb));
 
         if (!isn) {
+                struct inet_peer *peer = NULL;
+
                 if (ipv6_opt_accepted(sk, skb) ||
                     np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
                     np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
@@ -1285,13 +1303,57 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
                 if (!sk->sk_bound_dev_if &&
                     ipv6_addr_type(&treq->rmt_addr) & IPV6_ADDR_LINKLOCAL)
                         treq->iif = inet6_iif(skb);
-                if (!want_cookie) {
-                        isn = tcp_v6_init_sequence(skb);
-                } else {
+
+                if (want_cookie) {
                         isn = cookie_v6_init_sequence(sk, skb, &req->mss);
                         req->cookie_ts = tmp_opt.tstamp_ok;
+                        goto have_isn;
                 }
+
+                /* VJ's idea. We save last timestamp seen
+                 * from the destination in peer table, when entering
+                 * state TIME-WAIT, and check against it before
+                 * accepting new connection request.
+                 *
+                 * If "isn" is not zero, this request hit alive
+                 * timewait bucket, so that all the necessary checks
+                 * are made in the function processing timewait state.
+                 */
+                if (tmp_opt.saw_tstamp &&
+                    tcp_death_row.sysctl_tw_recycle &&
+                    (dst = inet6_csk_route_req(sk, req)) != NULL &&
+                    (peer = rt6_get_peer((struct rt6_info *)dst)) != NULL &&
+                    ipv6_addr_equal((struct in6_addr *)peer->daddr.a6,
+                                    &treq->rmt_addr)) {
+                        inet_peer_refcheck(peer);
+                        if ((u32)get_seconds() - peer->tcp_ts_stamp < TCP_PAWS_MSL &&
+                            (s32)(peer->tcp_ts - req->ts_recent) >
+                                                        TCP_PAWS_WINDOW) {
+                                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSPASSIVEREJECTED);
+                                goto drop_and_release;
+                        }
+                }
+                /* Kill the following clause, if you dislike this way. */
+                else if (!sysctl_tcp_syncookies &&
+                         (sysctl_max_syn_backlog - inet_csk_reqsk_queue_len(sk) <
+                          (sysctl_max_syn_backlog >> 2)) &&
+                         (!peer || !peer->tcp_ts_stamp) &&
+                         (!dst || !dst_metric(dst, RTAX_RTT))) {
+                        /* Without syncookies last quarter of
+                         * backlog is filled with destinations,
+                         * proven to be alive.
+                         * It means that we continue to communicate
+                         * to destinations, already remembered
+                         * to the moment of synflood.
+                         */
+                        LIMIT_NETDEBUG(KERN_DEBUG "TCP: drop open request from %pI6/%u\n",
+                                       &treq->rmt_addr, ntohs(tcp_hdr(skb)->source));
+                        goto drop_and_release;
+                }
+
+                isn = tcp_v6_init_sequence(skb);
         }
+have_isn:
         tcp_rsk(req)->snt_isn = isn;
 
         security_inet_conn_request(sk, skb, req);
@@ -1304,6 +1366,8 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
         inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
         return 0;
 
+drop_and_release:
+        dst_release(dst);
 drop_and_free:
         reqsk_free(req);
 drop:
@@ -1382,28 +1446,9 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
         if (sk_acceptq_is_full(sk))
                 goto out_overflow;
 
-        if (dst == NULL) {
-                struct in6_addr *final_p, final;
-                struct flowi fl;
-
-                memset(&fl, 0, sizeof(fl));
-                fl.proto = IPPROTO_TCP;
-                ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
-                final_p = fl6_update_dst(&fl, opt, &final);
-                ipv6_addr_copy(&fl.fl6_src, &treq->loc_addr);
-                fl.oif = sk->sk_bound_dev_if;
-                fl.mark = sk->sk_mark;
-                fl.fl_ip_dport = inet_rsk(req)->rmt_port;
-                fl.fl_ip_sport = inet_rsk(req)->loc_port;
-                security_req_classify_flow(req, &fl);
-
-                if (ip6_dst_lookup(sk, &dst, &fl))
-                        goto out;
-
-                if (final_p)
-                        ipv6_addr_copy(&fl.fl6_dst, final_p);
-
-                if ((xfrm_lookup(sock_net(sk), &dst, &fl, sk, 0)) < 0)
+        if (!dst) {
+                dst = inet6_csk_route_req(sk, req);
+                if (!dst)
                         goto out;
         }
 
@@ -1818,19 +1863,51 @@ do_time_wait:
         goto discard_it;
 }
 
-static int tcp_v6_remember_stamp(struct sock *sk)
+static struct inet_peer *tcp_v6_get_peer(struct sock *sk, bool *release_it)
 {
-        /* Alas, not yet... */
-        return 0;
+        struct rt6_info *rt = (struct rt6_info *) __sk_dst_get(sk);
+        struct ipv6_pinfo *np = inet6_sk(sk);
+        struct inet_peer *peer;
+
+        if (!rt ||
+            !ipv6_addr_equal(&np->daddr, &rt->rt6i_dst.addr)) {
+                peer = inet_getpeer_v6(&np->daddr, 1);
+                *release_it = true;
+        } else {
+                if (!rt->rt6i_peer)
+                        rt6_bind_peer(rt, 1);
+                peer = rt->rt6i_peer;
+                *release_it = true;
+        }
+
+        return peer;
 }
 
+static void *tcp_v6_tw_get_peer(struct sock *sk)
+{
+        struct inet6_timewait_sock *tw6 = inet6_twsk(sk);
+        struct inet_timewait_sock *tw = inet_twsk(sk);
+
+        if (tw->tw_family == AF_INET)
+                return tcp_v4_tw_get_peer(sk);
+
+        return inet_getpeer_v6(&tw6->tw_v6_daddr, 1);
+}
+
+static struct timewait_sock_ops tcp6_timewait_sock_ops = {
+        .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
+        .twsk_unique    = tcp_twsk_unique,
+        .twsk_destructor= tcp_twsk_destructor,
+        .twsk_getpeer   = tcp_v6_tw_get_peer,
+};
+
 static const struct inet_connection_sock_af_ops ipv6_specific = {
         .queue_xmit        = inet6_csk_xmit,
         .send_check        = tcp_v6_send_check,
         .rebuild_header    = inet6_sk_rebuild_header,
         .conn_request      = tcp_v6_conn_request,
         .syn_recv_sock     = tcp_v6_syn_recv_sock,
-        .remember_stamp    = tcp_v6_remember_stamp,
+        .get_peer          = tcp_v6_get_peer,
         .net_header_len    = sizeof(struct ipv6hdr),
         .setsockopt        = ipv6_setsockopt,
         .getsockopt        = ipv6_getsockopt,
@@ -1862,7 +1939,7 @@ static const struct inet_connection_sock_af_ops ipv6_mapped = {
         .rebuild_header    = inet_sk_rebuild_header,
         .conn_request      = tcp_v6_conn_request,
         .syn_recv_sock     = tcp_v6_syn_recv_sock,
-        .remember_stamp    = tcp_v4_remember_stamp,
+        .get_peer          = tcp_v4_get_peer,
         .net_header_len    = sizeof(struct iphdr),
         .setsockopt        = ipv6_setsockopt,
         .getsockopt        = ipv6_getsockopt,
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 91def93bec8..b541a4e009f 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -227,7 +227,7 @@ begin:
 
         if (result) {
 exact_match:
-                if (unlikely(!atomic_inc_not_zero(&result->sk_refcnt)))
+                if (unlikely(!atomic_inc_not_zero_hint(&result->sk_refcnt, 2)))
                         result = NULL;
                 else if (unlikely(compute_score2(result, net, saddr, sport,
                                   daddr, hnum, dif) < badness)) {
@@ -294,7 +294,7 @@ begin:
                 goto begin;
 
         if (result) {
-                if (unlikely(!atomic_inc_not_zero(&result->sk_refcnt)))
+                if (unlikely(!atomic_inc_not_zero_hint(&result->sk_refcnt, 2)))
                         result = NULL;
                 else if (unlikely(compute_score(result, net, hnum, saddr, sport,
                                         daddr, dport, dif) < badness)) {
diff --git a/net/irda/ircomm/Makefile b/net/irda/ircomm/Makefile
index 48689458c08..ab23b5ba7e3 100644
--- a/net/irda/ircomm/Makefile
+++ b/net/irda/ircomm/Makefile
@@ -4,5 +4,5 @@
 
 obj-$(CONFIG_IRCOMM) += ircomm.o ircomm-tty.o
 
-ircomm-objs := ircomm_core.o ircomm_event.o ircomm_lmp.o ircomm_ttp.o
-ircomm-tty-objs := ircomm_tty.o ircomm_tty_attach.o ircomm_tty_ioctl.o ircomm_param.o
+ircomm-y := ircomm_core.o ircomm_event.o ircomm_lmp.o ircomm_ttp.o
+ircomm-tty-y := ircomm_tty.o ircomm_tty_attach.o ircomm_tty_ioctl.o ircomm_param.o
diff --git a/net/irda/irlan/Makefile b/net/irda/irlan/Makefile
index 77549bc8641..94eefbc8e6b 100644
--- a/net/irda/irlan/Makefile
+++ b/net/irda/irlan/Makefile
@@ -4,4 +4,4 @@
 
 obj-$(CONFIG_IRLAN) += irlan.o
 
-irlan-objs := irlan_common.o irlan_eth.o irlan_event.o irlan_client.o irlan_provider.o irlan_filter.o irlan_provider_event.o irlan_client_event.o
+irlan-y := irlan_common.o irlan_eth.o irlan_event.o irlan_client.o irlan_provider.o irlan_filter.o irlan_provider_event.o irlan_client_event.o
diff --git a/net/irda/irnet/Makefile b/net/irda/irnet/Makefile
index b3ee01e0def..61c365c8a2a 100644
--- a/net/irda/irnet/Makefile
+++ b/net/irda/irnet/Makefile
@@ -4,4 +4,4 @@
 
 obj-$(CONFIG_IRNET) += irnet.o
 
-irnet-objs := irnet_ppp.o irnet_irda.o
+irnet-y := irnet_ppp.o irnet_irda.o
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index 522e219f355..110efb704c9 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -476,15 +476,13 @@ static int l2tp_ip_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
 
                 {
                         struct flowi fl = { .oif = sk->sk_bound_dev_if,
-                                            .nl_u = { .ip4_u = {
-                                                        .daddr = daddr,
-                                                        .saddr = inet->inet_saddr,
-                                                        .tos = RT_CONN_FLAGS(sk) } },
+                                            .fl4_dst = daddr,
+                                            .fl4_src = inet->inet_saddr,
+                                            .fl4_tos = RT_CONN_FLAGS(sk),
                                             .proto = sk->sk_protocol,
                                             .flags = inet_sk_flowi_flags(sk),
-                                            .uli_u = { .ports = {
-                                                         .sport = inet->inet_sport,
-                                                         .dport = inet->inet_dport } } };
+                                            .fl_ip_sport = inet->inet_sport,
+                                            .fl_ip_dport = inet->inet_dport };
 
                         /* If this fails, retransmit mechanism of transport layer will
                          * keep trying until route appears or the connection times
diff --git a/net/lapb/Makefile b/net/lapb/Makefile
index 53f7c90db16..fff797dfc88 100644
--- a/net/lapb/Makefile
+++ b/net/lapb/Makefile
@@ -4,4 +4,4 @@
 
 obj-$(CONFIG_LAPB) += lapb.o
 
-lapb-objs := lapb_in.o lapb_out.o lapb_subr.o lapb_timer.o lapb_iface.o
+lapb-y := lapb_in.o lapb_out.o lapb_subr.o lapb_timer.o lapb_iface.o
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index e35dbe55f52..dfd3a648a55 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -316,7 +316,6 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
         if (unlikely(addr->sllc_family != AF_LLC))
                 goto out;
         rc = -ENODEV;
-        rtnl_lock();
         rcu_read_lock();
         if (sk->sk_bound_dev_if) {
                 llc->dev = dev_get_by_index_rcu(&init_net, sk->sk_bound_dev_if);
@@ -334,10 +333,11 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
                         }
                 }
         } else
-                llc->dev = dev_getbyhwaddr(&init_net, addr->sllc_arphrd,
+                llc->dev = dev_getbyhwaddr_rcu(&init_net, addr->sllc_arphrd,
                                            addr->sllc_mac);
+        if (llc->dev)
+                dev_hold(llc->dev);
         rcu_read_unlock();
-        rtnl_unlock();
         if (!llc->dev)
                 goto out;
         if (!addr->sllc_sap) {
diff --git a/net/mac80211/aes_ccm.c b/net/mac80211/aes_ccm.c
index d2b03e0851e..4bd6ef0be38 100644
--- a/net/mac80211/aes_ccm.c
+++ b/net/mac80211/aes_ccm.c
@@ -147,6 +147,5 @@ struct crypto_cipher *ieee80211_aes_key_setup_encrypt(const u8 key[])
 
 void ieee80211_aes_key_free(struct crypto_cipher *tfm)
 {
-        if (tfm)
-                crypto_free_cipher(tfm);
+        crypto_free_cipher(tfm);
 }
diff --git a/net/mac80211/aes_cmac.c b/net/mac80211/aes_cmac.c
index b4d66cca76d..d502b2684a6 100644
--- a/net/mac80211/aes_cmac.c
+++ b/net/mac80211/aes_cmac.c
@@ -128,6 +128,5 @@ struct crypto_cipher * ieee80211_aes_cmac_key_setup(const u8 key[])
 
 void ieee80211_aes_cmac_key_free(struct crypto_cipher *tfm)
 {
-        if (tfm)
-                crypto_free_cipher(tfm);
+        crypto_free_cipher(tfm);
 }
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 18bd0e55060..0c544074479 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1299,6 +1299,13 @@ static int ieee80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
         struct ieee80211_local *local = wiphy_priv(wiphy);
         int err;
 
+        if (changed & WIPHY_PARAM_FRAG_THRESHOLD) {
+                err = drv_set_frag_threshold(local, wiphy->frag_threshold);
+
+                if (err)
+                        return err;
+        }
+
         if (changed & WIPHY_PARAM_COVERAGE_CLASS) {
                 err = drv_set_coverage_class(local, wiphy->coverage_class);
 
@@ -1621,6 +1628,23 @@ static void ieee80211_mgmt_frame_register(struct wiphy *wiphy,
         ieee80211_queue_work(&local->hw, &local->reconfig_filter);
 }
 
+static int ieee80211_set_antenna(struct wiphy *wiphy, u32 tx_ant, u32 rx_ant)
+{
+        struct ieee80211_local *local = wiphy_priv(wiphy);
+
+        if (local->started)
+                return -EOPNOTSUPP;
+
+        return drv_set_antenna(local, tx_ant, rx_ant);
+}
+
+static int ieee80211_get_antenna(struct wiphy *wiphy, u32 *tx_ant, u32 *rx_ant)
+{
+        struct ieee80211_local *local = wiphy_priv(wiphy);
+
+        return drv_get_antenna(local, tx_ant, rx_ant);
+}
+
 struct cfg80211_ops mac80211_config_ops = {
         .add_virtual_intf = ieee80211_add_iface,
         .del_virtual_intf = ieee80211_del_iface,
@@ -1673,4 +1697,6 @@ struct cfg80211_ops mac80211_config_ops = {
         .mgmt_tx = ieee80211_mgmt_tx,
         .set_cqm_rssi_config = ieee80211_set_cqm_rssi_config,
         .mgmt_frame_register = ieee80211_mgmt_frame_register,
+        .set_antenna = ieee80211_set_antenna,
+        .get_antenna = ieee80211_get_antenna,
 };
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index 18260aa99c5..1f02e599a31 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -21,16 +21,30 @@ int mac80211_open_file_generic(struct inode *inode, struct file *file)
         return 0;
 }
 
-#define DEBUGFS_READONLY_FILE(name, buflen, fmt, value...)              \
+#define DEBUGFS_FORMAT_BUFFER_SIZE 100
+
+int mac80211_format_buffer(char __user *userbuf, size_t count,
+                                  loff_t *ppos, char *fmt, ...)
+{
+        va_list args;
+        char buf[DEBUGFS_FORMAT_BUFFER_SIZE];
+        int res;
+
+        va_start(args, fmt);
+        res = vscnprintf(buf, sizeof(buf), fmt, args);
+        va_end(args);
+
+        return simple_read_from_buffer(userbuf, count, ppos, buf, res);
+}
+
+#define DEBUGFS_READONLY_FILE(name, fmt, value...)                      \
 static ssize_t name## _read(struct file *file, char __user *userbuf,    \
                             size_t count, loff_t *ppos)                 \
 {                                                                       \
         struct ieee80211_local *local = file->private_data;             \
-        char buf[buflen];                                               \
-        int res;                                                        \
                                                                         \
-        res = scnprintf(buf, buflen, fmt "\n", ##value);                \
-        return simple_read_from_buffer(userbuf, count, ppos, buf, res); \
+        return mac80211_format_buffer(userbuf, count, ppos,             \
+                                      fmt "\n", ##value);               \
 }                                                                       \
                                                                         \
 static const struct file_operations name## _ops = {                     \
@@ -46,13 +60,13 @@ static const struct file_operations name## _ops = {			\
         debugfs_create_file(#name, mode, phyd, local, &name## _ops);
 
 
-DEBUGFS_READONLY_FILE(frequency, 20, "%d",
+DEBUGFS_READONLY_FILE(frequency, "%d",
                       local->hw.conf.channel->center_freq);
-DEBUGFS_READONLY_FILE(total_ps_buffered, 20, "%d",
+DEBUGFS_READONLY_FILE(total_ps_buffered, "%d",
                       local->total_ps_buffered);
-DEBUGFS_READONLY_FILE(wep_iv, 20, "%#08x",
+DEBUGFS_READONLY_FILE(wep_iv, "%#08x",
                       local->wep_iv & 0xffffff);
-DEBUGFS_READONLY_FILE(rate_ctrl_alg, 100, "%s",
+DEBUGFS_READONLY_FILE(rate_ctrl_alg, "%s",
         local->rate_ctrl ? local->rate_ctrl->ops->name : "hw/driver");
 
 static ssize_t tsf_read(struct file *file, char __user *user_buf,
@@ -60,13 +74,11 @@ static ssize_t tsf_read(struct file *file, char __user *user_buf,
 {
         struct ieee80211_local *local = file->private_data;
         u64 tsf;
-        char buf[100];
 
         tsf = drv_get_tsf(local);
 
-        snprintf(buf, sizeof(buf), "0x%016llx\n", (unsigned long long) tsf);
-
-        return simple_read_from_buffer(user_buf, count, ppos, buf, 19);
+        return mac80211_format_buffer(user_buf, count, ppos, "0x%016llx\n",
+                                      (unsigned long long) tsf);
 }
 
 static ssize_t tsf_write(struct file *file,
@@ -131,12 +143,9 @@ static ssize_t noack_read(struct file *file, char __user *user_buf,
                           size_t count, loff_t *ppos)
 {
         struct ieee80211_local *local = file->private_data;
-        int res;
-        char buf[10];
 
-        res = scnprintf(buf, sizeof(buf), "%d\n", local->wifi_wme_noack_test);
-
-        return simple_read_from_buffer(user_buf, count, ppos, buf, res);
+        return mac80211_format_buffer(user_buf, count, ppos, "%d\n",
+                                      local->wifi_wme_noack_test);
 }
 
 static ssize_t noack_write(struct file *file,
@@ -168,12 +177,8 @@ static ssize_t uapsd_queues_read(struct file *file, char __user *user_buf,
                                  size_t count, loff_t *ppos)
 {
         struct ieee80211_local *local = file->private_data;
-        int res;
-        char buf[10];
-
-        res = scnprintf(buf, sizeof(buf), "0x%x\n", local->uapsd_queues);
-
-        return simple_read_from_buffer(user_buf, count, ppos, buf, res);
+        return mac80211_format_buffer(user_buf, count, ppos, "0x%x\n",
+                                      local->uapsd_queues);
 }
 
 static ssize_t uapsd_queues_write(struct file *file,
@@ -215,12 +220,9 @@ static ssize_t uapsd_max_sp_len_read(struct file *file, char __user *user_buf,
                                      size_t count, loff_t *ppos)
 {
         struct ieee80211_local *local = file->private_data;
-        int res;
-        char buf[10];
 
-        res = scnprintf(buf, sizeof(buf), "0x%x\n", local->uapsd_max_sp_len);
-
-        return simple_read_from_buffer(user_buf, count, ppos, buf, res);
+        return mac80211_format_buffer(user_buf, count, ppos, "0x%x\n",
+                                      local->uapsd_max_sp_len);
 }
 
 static ssize_t uapsd_max_sp_len_write(struct file *file,
diff --git a/net/mac80211/debugfs.h b/net/mac80211/debugfs.h
index 09cc9be3479..7c87529630f 100644
--- a/net/mac80211/debugfs.h
+++ b/net/mac80211/debugfs.h
@@ -4,6 +4,8 @@
 #ifdef CONFIG_MAC80211_DEBUGFS
 extern void debugfs_hw_add(struct ieee80211_local *local);
 extern int mac80211_open_file_generic(struct inode *inode, struct file *file);
+extern int mac80211_format_buffer(char __user *userbuf, size_t count,
+                                  loff_t *ppos, char *fmt, ...);
 #else
 static inline void debugfs_hw_add(struct ieee80211_local *local)
 {
diff --git a/net/mac80211/debugfs_key.c b/net/mac80211/debugfs_key.c
index 1243d1db5c5..5822a6ce767 100644
--- a/net/mac80211/debugfs_key.c
+++ b/net/mac80211/debugfs_key.c
@@ -15,18 +15,17 @@
 #include "debugfs.h"
 #include "debugfs_key.h"
 
-#define KEY_READ(name, prop, buflen, format_string)                     \
+#define KEY_READ(name, prop, format_string)                             \
 static ssize_t key_##name##_read(struct file *file,                     \
                                  char __user *userbuf,                  \
                                  size_t count, loff_t *ppos)            \
 {                                                                       \
-        char buf[buflen];                                               \
         struct ieee80211_key *key = file->private_data;                 \
-        int res = scnprintf(buf, buflen, format_string, key->prop);     \
-        return simple_read_from_buffer(userbuf, count, ppos, buf, res); \
+        return mac80211_format_buffer(userbuf, count, ppos,             \
+                                      format_string, key->prop);        \
 }
-#define KEY_READ_D(name) KEY_READ(name, name, 20, "%d\n")
-#define KEY_READ_X(name) KEY_READ(name, name, 20, "0x%x\n")
+#define KEY_READ_D(name) KEY_READ(name, name, "%d\n")
+#define KEY_READ_X(name) KEY_READ(name, name, "0x%x\n")
 
 #define KEY_OPS(name)                                                   \
 static const struct file_operations key_ ##name## _ops = {              \
@@ -39,9 +38,9 @@ static const struct file_operations key_ ##name## _ops = {		\
                  KEY_READ_##format(name)                                \
                  KEY_OPS(name)
 
-#define KEY_CONF_READ(name, buflen, format_string)                      \
-        KEY_READ(conf_##name, conf.name, buflen, format_string)
-#define KEY_CONF_READ_D(name) KEY_CONF_READ(name, 20, "%d\n")
+#define KEY_CONF_READ(name, format_string)                              \
+        KEY_READ(conf_##name, conf.name, format_string)
+#define KEY_CONF_READ_D(name) KEY_CONF_READ(name, "%d\n")
 
 #define KEY_CONF_OPS(name)                                              \
 static const struct file_operations key_ ##name## _ops = {              \
@@ -59,7 +58,7 @@ KEY_CONF_FILE(keyidx, D);
 KEY_CONF_FILE(hw_key_idx, D);
 KEY_FILE(flags, X);
 KEY_FILE(tx_rx_count, D);
-KEY_READ(ifindex, sdata->name, IFNAMSIZ + 2, "%s\n");
+KEY_READ(ifindex, sdata->name, "%s\n");
 KEY_OPS(ifindex);
 
 static ssize_t key_algorithm_read(struct file *file,
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index 4601fea1784..f0fce37f406 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -17,20 +17,18 @@
 
 /* sta attributtes */
 
-#define STA_READ(name, buflen, field, format_string)                    \
+#define STA_READ(name, field, format_string)                            \
 static ssize_t sta_ ##name## _read(struct file *file,                   \
                                    char __user *userbuf,                \
                                    size_t count, loff_t *ppos)          \
 {                                                                       \
-        int res;                                                        \
         struct sta_info *sta = file->private_data;                      \
-        char buf[buflen];                                               \
-        res = scnprintf(buf, buflen, format_string, sta->field);        \
-        return simple_read_from_buffer(userbuf, count, ppos, buf, res); \
+        return mac80211_format_buffer(userbuf, count, ppos,             \
+                                      format_string, sta->field);       \
 }
-#define STA_READ_D(name, field) STA_READ(name, 20, field, "%d\n")
-#define STA_READ_U(name, field) STA_READ(name, 20, field, "%u\n")
-#define STA_READ_S(name, field) STA_READ(name, 20, field, "%s\n")
+#define STA_READ_D(name, field) STA_READ(name, field, "%d\n")
+#define STA_READ_U(name, field) STA_READ(name, field, "%u\n")
+#define STA_READ_S(name, field) STA_READ(name, field, "%s\n")
 
 #define STA_OPS(name)                                                   \
 static const struct file_operations sta_ ##name## _ops = {              \
@@ -79,22 +77,18 @@ static ssize_t sta_num_ps_buf_frames_read(struct file *file,
                                           char __user *userbuf,
                                           size_t count, loff_t *ppos)
 {
-        char buf[20];
         struct sta_info *sta = file->private_data;
-        int res = scnprintf(buf, sizeof(buf), "%u\n",
-                            skb_queue_len(&sta->ps_tx_buf));
-        return simple_read_from_buffer(userbuf, count, ppos, buf, res);
+        return mac80211_format_buffer(userbuf, count, ppos, "%u\n",
+                                      skb_queue_len(&sta->ps_tx_buf));
 }
 STA_OPS(num_ps_buf_frames);
 
 static ssize_t sta_inactive_ms_read(struct file *file, char __user *userbuf,
                                     size_t count, loff_t *ppos)
 {
-        char buf[20];
         struct sta_info *sta = file->private_data;
-        int res = scnprintf(buf, sizeof(buf), "%d\n",
-                            jiffies_to_msecs(jiffies - sta->last_rx));
-        return simple_read_from_buffer(userbuf, count, ppos, buf, res);
+        return mac80211_format_buffer(userbuf, count, ppos, "%d\n",
+                                      jiffies_to_msecs(jiffies - sta->last_rx));
 }
 STA_OPS(inactive_ms);
 
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 16983825f8e..4244554d218 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -233,6 +233,20 @@ static inline void drv_get_tkip_seq(struct ieee80211_local *local,
         trace_drv_get_tkip_seq(local, hw_key_idx, iv32, iv16);
 }
 
+static inline int drv_set_frag_threshold(struct ieee80211_local *local,
+                                        u32 value)
+{
+        int ret = 0;
+
+        might_sleep();
+
+        trace_drv_set_frag_threshold(local, value);
+        if (local->ops->set_frag_threshold)
+                ret = local->ops->set_frag_threshold(&local->hw, value);
+        trace_drv_return_int(local, ret);
+        return ret;
+}
+
 static inline int drv_set_rts_threshold(struct ieee80211_local *local,
                                         u32 value)
 {
@@ -428,4 +442,27 @@ static inline void drv_channel_switch(struct ieee80211_local *local,
         trace_drv_return_void(local);
 }
 
+
+static inline int drv_set_antenna(struct ieee80211_local *local,
+                                  u32 tx_ant, u32 rx_ant)
+{
+        int ret = -EOPNOTSUPP;
+        might_sleep();
+        if (local->ops->set_antenna)
+                ret = local->ops->set_antenna(&local->hw, tx_ant, rx_ant);
+        trace_drv_set_antenna(local, tx_ant, rx_ant, ret);
+        return ret;
+}
+
+static inline int drv_get_antenna(struct ieee80211_local *local,
+                                  u32 *tx_ant, u32 *rx_ant)
+{
+        int ret = -EOPNOTSUPP;
+        might_sleep();
+        if (local->ops->get_antenna)
+                ret = local->ops->get_antenna(&local->hw, tx_ant, rx_ant);
+        trace_drv_get_antenna(local, *tx_ant, *rx_ant, ret);
+        return ret;
+}
+
 #endif /* __MAC80211_DRIVER_OPS */
diff --git a/net/mac80211/driver-trace.h b/net/mac80211/driver-trace.h
index 6831fb1641c..c2772f23ac9 100644
--- a/net/mac80211/driver-trace.h
+++ b/net/mac80211/driver-trace.h
@@ -531,6 +531,27 @@ TRACE_EVENT(drv_get_tkip_seq,
         )
 );
 
+TRACE_EVENT(drv_set_frag_threshold,
+        TP_PROTO(struct ieee80211_local *local, u32 value),
+
+        TP_ARGS(local, value),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(u32, value)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->value = value;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT " value:%d",
+                LOCAL_PR_ARG, __entry->value
+        )
+);
+
 TRACE_EVENT(drv_set_rts_threshold,
         TP_PROTO(struct ieee80211_local *local, u32 value),
 
@@ -862,6 +883,56 @@ TRACE_EVENT(drv_channel_switch,
         )
 );
 
+TRACE_EVENT(drv_set_antenna,
+        TP_PROTO(struct ieee80211_local *local, u32 tx_ant, u32 rx_ant, int ret),
+
+        TP_ARGS(local, tx_ant, rx_ant, ret),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(u32, tx_ant)
+                __field(u32, rx_ant)
+                __field(int, ret)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->tx_ant = tx_ant;
+                __entry->rx_ant = rx_ant;
+                __entry->ret = ret;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT " tx_ant:%d rx_ant:%d ret:%d",
+                LOCAL_PR_ARG, __entry->tx_ant, __entry->rx_ant, __entry->ret
+        )
+);
+
+TRACE_EVENT(drv_get_antenna,
+        TP_PROTO(struct ieee80211_local *local, u32 tx_ant, u32 rx_ant, int ret),
+
+        TP_ARGS(local, tx_ant, rx_ant, ret),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(u32, tx_ant)
+                __field(u32, rx_ant)
+                __field(int, ret)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->tx_ant = tx_ant;
+                __entry->rx_ant = rx_ant;
+                __entry->ret = ret;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT " tx_ant:%d rx_ant:%d ret:%d",
+                LOCAL_PR_ARG, __entry->tx_ant, __entry->rx_ant, __entry->ret
+        )
+);
+
 /*
  * Tracing for API calls that drivers call.
  */
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 239c4836a94..410d104b134 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -915,6 +915,8 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
 
         sdata->u.ibss.privacy = params->privacy;
         sdata->u.ibss.basic_rates = params->basic_rates;
+        memcpy(sdata->vif.bss_conf.mcast_rate, params->mcast_rate,
+               sizeof(params->mcast_rate));
 
         sdata->vif.bss_conf.beacon_int = params->beacon_interval;
 
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index b80c3868992..5bc0745368f 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -349,6 +349,7 @@ struct ieee80211_if_managed {
         struct work_struct chswitch_work;
         struct work_struct beacon_connection_loss_work;
 
+        unsigned long beacon_timeout;
         unsigned long probe_timeout;
         int probe_send_count;
 
@@ -1264,6 +1265,8 @@ void ieee80211_send_nullfunc(struct ieee80211_local *local,
                              int powersave);
 void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
                              struct ieee80211_hdr *hdr);
+void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
+                             struct ieee80211_hdr *hdr);
 void ieee80211_beacon_connection_loss_work(struct work_struct *work);
 
 void ieee80211_wake_queues_by_reason(struct ieee80211_hw *hw,
@@ -1278,6 +1281,9 @@ void ieee80211_add_pending_skb(struct ieee80211_local *local,
                                struct sk_buff *skb);
 int ieee80211_add_pending_skbs(struct ieee80211_local *local,
                                struct sk_buff_head *skbs);
+int ieee80211_add_pending_skbs_fn(struct ieee80211_local *local,
+                                  struct sk_buff_head *skbs,
+                                  void (*fn)(void *data), void *data);
 
 void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
                          u16 transaction, u16 auth_alg,
@@ -1287,6 +1293,10 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
                              const u8 *ie, size_t ie_len,
                              enum ieee80211_band band, u32 rate_mask,
                              u8 channel);
+struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
+                                          u8 *dst,
+                                          const u8 *ssid, size_t ssid_len,
+                                          const u8 *ie, size_t ie_len);
 void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
                               const u8 *ssid, size_t ssid_len,
                               const u8 *ie, size_t ie_len);
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index ccd676b2f59..72df1ca7299 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -84,10 +84,17 @@ static int ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
                 goto out_unsupported;
 
         sdata = key->sdata;
-        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
+                /*
+                 * The driver doesn't know anything about VLAN interfaces.
+                 * Hence, don't send GTKs for VLAN interfaces to the driver.
+                 */
+                if (!(key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE))
+                        goto out_unsupported;
                 sdata = container_of(sdata->bss,
                                      struct ieee80211_sub_if_data,
                                      u.ap);
+        }
 
         ret = drv_set_key(key->local, SET_KEY, sdata, sta, &key->conf);
 
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index a3a9421555a..79480791494 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -28,13 +28,19 @@
 #include "rate.h"
 #include "led.h"
 
+#define IEEE80211_MAX_NULLFUNC_TRIES 2
 #define IEEE80211_MAX_PROBE_TRIES 5
 
 /*
- * beacon loss detection timeout
- * XXX: should depend on beacon interval
+ * Beacon loss timeout is calculated as N frames times the
+ * advertised beacon interval.  This may need to be somewhat
+ * higher than what hardware might detect to account for
+ * delays in the host processing frames. But since we also
+ * probe on beacon miss before declaring the connection lost
+ * default to what we want.
  */
-#define IEEE80211_BEACON_LOSS_TIME      (2 * HZ)
+#define IEEE80211_BEACON_LOSS_COUNT     7
+
 /*
  * Time the connection can be idle before we probe
  * it to see if we can still talk to the AP.
@@ -121,7 +127,7 @@ void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata)
                 return;
 
         mod_timer(&sdata->u.mgd.bcn_mon_timer,
-                  round_jiffies_up(jiffies + IEEE80211_BEACON_LOSS_TIME));
+                  round_jiffies_up(jiffies + sdata->u.mgd.beacon_timeout));
 }
 
 void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata)
@@ -871,6 +877,9 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
         bss_info_changed |= ieee80211_handle_bss_capability(sdata,
                 cbss->capability, bss->has_erp_value, bss->erp_value);
 
+        sdata->u.mgd.beacon_timeout = usecs_to_jiffies(ieee80211_tu_to_usec(
+                IEEE80211_BEACON_LOSS_COUNT * bss_conf->beacon_int));
+
         sdata->u.mgd.associated = cbss;
         memcpy(sdata->u.mgd.bssid, cbss->bssid, ETH_ALEN);
 
@@ -1026,6 +1035,51 @@ void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
         ieee80211_sta_reset_conn_monitor(sdata);
 }
 
+static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+
+        if (!(ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
+                              IEEE80211_STA_CONNECTION_POLL)))
+            return;
+
+        ifmgd->flags &= ~(IEEE80211_STA_CONNECTION_POLL |
+                          IEEE80211_STA_BEACON_POLL);
+        mutex_lock(&sdata->local->iflist_mtx);
+        ieee80211_recalc_ps(sdata->local, -1);
+        mutex_unlock(&sdata->local->iflist_mtx);
+
+        if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
+                return;
+
+        /*
+         * We've received a probe response, but are not sure whether
+         * we have or will be receiving any beacons or data, so let's
+         * schedule the timers again, just in case.
+         */
+        ieee80211_sta_reset_beacon_monitor(sdata);
+
+        mod_timer(&ifmgd->conn_mon_timer,
+                  round_jiffies_up(jiffies +
+                                   IEEE80211_CONNECTION_IDLE_TIME));
+}
+
+void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
+                             struct ieee80211_hdr *hdr)
+{
+        if (!ieee80211_is_data(hdr->frame_control) &&
+            !ieee80211_is_nullfunc(hdr->frame_control))
+            return;
+
+        ieee80211_sta_reset_conn_monitor(sdata);
+
+        if (ieee80211_is_nullfunc(hdr->frame_control) &&
+            sdata->u.mgd.probe_send_count > 0) {
+                sdata->u.mgd.probe_send_count = 0;
+                ieee80211_queue_work(&sdata->local->hw, &sdata->work);
+        }
+}
+
 static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
@@ -1041,8 +1095,19 @@ static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
         if (ifmgd->probe_send_count >= unicast_limit)
                 dst = NULL;
 
-        ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
-        ieee80211_send_probe_req(sdata, dst, ssid + 2, ssid[1], NULL, 0);
+        /*
+         * When the hardware reports an accurate Tx ACK status, it's
+         * better to send a nullfunc frame instead of a probe request,
+         * as it will kick us off the AP quickly if we aren't associated
+         * anymore. The timeout will be reset if the frame is ACKed by
+         * the AP.
+         */
+        if (sdata->local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
+                ieee80211_send_nullfunc(sdata->local, sdata, 0);
+        else {
+                ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
+                ieee80211_send_probe_req(sdata, dst, ssid + 2, ssid[1], NULL, 0);
+        }
 
         ifmgd->probe_send_count++;
         ifmgd->probe_timeout = jiffies + IEEE80211_PROBE_WAIT;
@@ -1108,6 +1173,30 @@ static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
         mutex_unlock(&ifmgd->mtx);
 }
 
+struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
+                                          struct ieee80211_vif *vif)
+{
+        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        struct sk_buff *skb;
+        const u8 *ssid;
+
+        if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
+                return NULL;
+
+        ASSERT_MGD_MTX(ifmgd);
+
+        if (!ifmgd->associated)
+                return NULL;
+
+        ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
+        skb = ieee80211_build_probe_req(sdata, ifmgd->associated->bssid,
+                                        ssid + 2, ssid[1], NULL, 0);
+
+        return skb;
+}
+EXPORT_SYMBOL(ieee80211_ap_probereq_get);
+
 static void __ieee80211_connection_loss(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
@@ -1485,29 +1574,8 @@ static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
         ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems, false);
 
         if (ifmgd->associated &&
-            memcmp(mgmt->bssid, ifmgd->associated->bssid, ETH_ALEN) == 0 &&
-            ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
-                            IEEE80211_STA_CONNECTION_POLL)) {
-                ifmgd->flags &= ~(IEEE80211_STA_CONNECTION_POLL |
-                                  IEEE80211_STA_BEACON_POLL);
-                mutex_lock(&sdata->local->iflist_mtx);
-                ieee80211_recalc_ps(sdata->local, -1);
-                mutex_unlock(&sdata->local->iflist_mtx);
-
-                if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
-                        return;
-
-                /*
-                 * We've received a probe response, but are not sure whether
-                 * we have or will be receiving any beacons or data, so let's
-                 * schedule the timers again, just in case.
-                 */
-                ieee80211_sta_reset_beacon_monitor(sdata);
-
-                mod_timer(&ifmgd->conn_mon_timer,
-                          round_jiffies_up(jiffies +
-                                           IEEE80211_CONNECTION_IDLE_TIME));
-        }
+            memcmp(mgmt->bssid, ifmgd->associated->bssid, ETH_ALEN) == 0)
+                ieee80211_reset_ap_probe(sdata);
 }
 
 /*
@@ -1857,12 +1925,23 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
                             IEEE80211_STA_CONNECTION_POLL) &&
             ifmgd->associated) {
                 u8 bssid[ETH_ALEN];
+                int max_tries;
 
                 memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
-                if (time_is_after_jiffies(ifmgd->probe_timeout))
+
+                if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
+                        max_tries = IEEE80211_MAX_NULLFUNC_TRIES;
+                else
+                        max_tries = IEEE80211_MAX_PROBE_TRIES;
+
+                /* ACK received for nullfunc probing frame */
+                if (!ifmgd->probe_send_count)
+                        ieee80211_reset_ap_probe(sdata);
+
+                else if (time_is_after_jiffies(ifmgd->probe_timeout))
                         run_again(ifmgd, ifmgd->probe_timeout);
 
-                else if (ifmgd->probe_send_count < IEEE80211_MAX_PROBE_TRIES) {
+                else if (ifmgd->probe_send_count < max_tries) {
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
                         wiphy_debug(local->hw.wiphy,
                                     "%s: No probe response from AP %pM"
@@ -1988,6 +2067,8 @@ void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
                 add_timer(&ifmgd->timer);
         if (test_and_clear_bit(TMR_RUNNING_CHANSW, &ifmgd->timers_running))
                 add_timer(&ifmgd->chswitch_timer);
+        ieee80211_sta_reset_beacon_monitor(sdata);
+        ieee80211_restart_sta_timer(sdata);
 }
 #endif
 
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index 33f76993da0..3d5a2cb835c 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -211,7 +211,8 @@ static bool rc_no_data_or_no_ack(struct ieee80211_tx_rate_control *txrc)
         return (info->flags & IEEE80211_TX_CTL_NO_ACK) || !ieee80211_is_data(fc);
 }
 
-static void rc_send_low_broadcast(s8 *idx, u32 basic_rates, u8 max_rate_idx)
+static void rc_send_low_broadcast(s8 *idx, u32 basic_rates,
+                                  struct ieee80211_supported_band *sband)
 {
         u8 i;
 
@@ -222,7 +223,7 @@ static void rc_send_low_broadcast(s8 *idx, u32 basic_rates, u8 max_rate_idx)
         if (basic_rates & (1 << *idx))
                 return; /* selected rate is a basic rate */
 
-        for (i = *idx + 1; i <= max_rate_idx; i++) {
+        for (i = *idx + 1; i <= sband->n_bitrates; i++) {
                 if (basic_rates & (1 << i)) {
                         *idx = i;
                         return;
@@ -237,16 +238,25 @@ bool rate_control_send_low(struct ieee80211_sta *sta,
                            struct ieee80211_tx_rate_control *txrc)
 {
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(txrc->skb);
+        struct ieee80211_supported_band *sband = txrc->sband;
+        int mcast_rate;
 
         if (!sta || !priv_sta || rc_no_data_or_no_ack(txrc)) {
                 info->control.rates[0].idx = rate_lowest_index(txrc->sband, sta);
                 info->control.rates[0].count =
                         (info->flags & IEEE80211_TX_CTL_NO_ACK) ?
                         1 : txrc->hw->max_rate_tries;
-                if (!sta && txrc->ap)
+                if (!sta && txrc->bss) {
+                        mcast_rate = txrc->bss_conf->mcast_rate[sband->band];
+                        if (mcast_rate > 0) {
+                                info->control.rates[0].idx = mcast_rate - 1;
+                                return true;
+                        }
+
                         rc_send_low_broadcast(&info->control.rates[0].idx,
                                               txrc->bss_conf->basic_rates,
-                                              txrc->sband->n_bitrates);
+                                              sband);
+                }
                 return true;
         }
         return false;
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index 2a18d6602d4..4ad7a362fcc 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -371,6 +371,9 @@ minstrel_aggr_check(struct minstrel_priv *mp, struct ieee80211_sta *pubsta, stru
         if (likely(sta->ampdu_mlme.tid_tx[tid]))
                 return;
 
+        if (skb_get_queue_mapping(skb) == IEEE80211_AC_VO)
+                return;
+
         ieee80211_start_tx_ba_session(pubsta, tid);
 }
 
@@ -407,8 +410,8 @@ minstrel_ht_tx_status(void *priv, struct ieee80211_supported_band *sband,
         mi->ampdu_len += info->status.ampdu_len;
 
         if (!mi->sample_wait && !mi->sample_tries && mi->sample_count > 0) {
-                mi->sample_wait = 4 + 2 * MINSTREL_TRUNC(mi->avg_ampdu_len);
-                mi->sample_tries = 3;
+                mi->sample_wait = 16 + 2 * MINSTREL_TRUNC(mi->avg_ampdu_len);
+                mi->sample_tries = 2;
                 mi->sample_count--;
         }
 
@@ -506,7 +509,9 @@ minstrel_ht_set_rate(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
         if (!mr->retry_updated)
                 minstrel_calc_retransmit(mp, mi, index);
 
-        if (mr->probability < MINSTREL_FRAC(20, 100))
+        if (sample)
+                rate->count = 1;
+        else if (mr->probability < MINSTREL_FRAC(20, 100))
                 rate->count = 2;
         else if (rtscts)
                 rate->count = mr->retry_count_rtscts;
@@ -562,7 +567,7 @@ minstrel_get_sample_rate(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
          */
         if (minstrel_get_duration(sample_idx) >
             minstrel_get_duration(mi->max_tp_rate)) {
-                if (mr->sample_skipped < 10)
+                if (mr->sample_skipped < 20)
                         goto next;
 
                 if (mi->sample_slow++ > 2)
@@ -586,6 +591,7 @@ minstrel_ht_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
         struct minstrel_ht_sta *mi = &msp->ht;
         struct minstrel_priv *mp = priv;
         int sample_idx;
+        bool sample = false;
 
         if (rate_control_send_low(sta, priv_sta, txrc))
                 return;
@@ -596,10 +602,11 @@ minstrel_ht_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
         info->flags |= mi->tx_flags;
         sample_idx = minstrel_get_sample_rate(mp, mi);
         if (sample_idx >= 0) {
+                sample = true;
                 minstrel_ht_set_rate(mp, mi, &ar[0], sample_idx,
                         txrc, true, false);
                 minstrel_ht_set_rate(mp, mi, &ar[1], mi->max_tp_rate,
-                        txrc, false, true);
+                        txrc, false, false);
                 info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
         } else {
                 minstrel_ht_set_rate(mp, mi, &ar[0], mi->max_tp_rate,
@@ -607,7 +614,7 @@ minstrel_ht_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
                 minstrel_ht_set_rate(mp, mi, &ar[1], mi->max_tp_rate2,
                         txrc, false, true);
         }
-        minstrel_ht_set_rate(mp, mi, &ar[2], mi->max_prob_rate, txrc, false, true);
+        minstrel_ht_set_rate(mp, mi, &ar[2], mi->max_prob_rate, txrc, false, !sample);
 
         ar[3].count = 0;
         ar[3].idx = -1;
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 54fb4a0e76f..55337709de4 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1102,8 +1102,6 @@ static void ap_sta_ps_end(struct sta_info *sta)
 
         atomic_dec(&sdata->bss->num_sta_ps);
 
-        clear_sta_flags(sta, WLAN_STA_PS_STA);
-
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
         printk(KERN_DEBUG "%s: STA %pM aid %d exits power save mode\n",
                sdata->name, sta->sta.addr, sta->sta.aid);
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 6d8f897d876..eff58571fd7 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -199,8 +199,11 @@ static void sta_unblock(struct work_struct *wk)
 
         if (!test_sta_flags(sta, WLAN_STA_PS_STA))
                 ieee80211_sta_ps_deliver_wakeup(sta);
-        else if (test_and_clear_sta_flags(sta, WLAN_STA_PSPOLL))
+        else if (test_and_clear_sta_flags(sta, WLAN_STA_PSPOLL)) {
+                clear_sta_flags(sta, WLAN_STA_PS_DRIVER);
                 ieee80211_sta_ps_deliver_poll_response(sta);
+        } else
+                clear_sta_flags(sta, WLAN_STA_PS_DRIVER);
 }
 
 static int sta_prepare_rate_control(struct ieee80211_local *local,
@@ -880,6 +883,13 @@ struct ieee80211_sta *ieee80211_find_sta(struct ieee80211_vif *vif,
 }
 EXPORT_SYMBOL(ieee80211_find_sta);
 
+static void clear_sta_ps_flags(void *_sta)
+{
+        struct sta_info *sta = _sta;
+
+        clear_sta_flags(sta, WLAN_STA_PS_DRIVER | WLAN_STA_PS_STA);
+}
+
 /* powersave support code */
 void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
 {
@@ -894,7 +904,8 @@ void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
 
         /* Send all buffered frames to the station */
         sent = ieee80211_add_pending_skbs(local, &sta->tx_filtered);
-        buffered = ieee80211_add_pending_skbs(local, &sta->ps_tx_buf);
+        buffered = ieee80211_add_pending_skbs_fn(local, &sta->ps_tx_buf,
+                                                 clear_sta_ps_flags, sta);
         sent += buffered;
         local->total_ps_buffered -= buffered;
 
@@ -973,7 +984,7 @@ void ieee80211_sta_block_awake(struct ieee80211_hw *hw,
 
         if (block)
                 set_sta_flags(sta, WLAN_STA_PS_DRIVER);
-        else
+        else if (test_sta_flags(sta, WLAN_STA_PS_DRIVER))
                 ieee80211_queue_work(hw, &sta->drv_unblock_wk);
 }
 EXPORT_SYMBOL(ieee80211_sta_block_awake);
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 9265acadef3..b562d9b6a70 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -248,6 +248,7 @@ enum plink_state {
  * @sta: station information we share with the driver
  * @dead: set to true when sta is unlinked
  * @uploaded: set to true when sta is uploaded to the driver
+ * @lost_packets: number of consecutive lost packets
  */
 struct sta_info {
         /* General information, mostly static */
@@ -335,6 +336,8 @@ struct sta_info {
         } debugfs;
 #endif
 
+        unsigned int lost_packets;
+
         /* keep last! */
         struct ieee80211_sta sta;
 };
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 3153c19893b..bed7e32ed90 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -155,8 +155,21 @@ static void ieee80211_frame_acked(struct sta_info *sta, struct sk_buff *skb)
 
                 ieee80211_queue_work(&local->hw, &local->recalc_smps);
         }
+
+        if ((sdata->vif.type == NL80211_IFTYPE_STATION) &&
+            (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS))
+                ieee80211_sta_tx_notify(sdata, (void *) skb->data);
 }
 
+/*
+ * Use a static threshold for now, best value to be determined
+ * by testing ...
+ * Should it depend on:
+ *  - on # of retransmissions
+ *  - current throughput (higher value for higher tpt)?
+ */
+#define STA_LOST_PKT_THRESHOLD  50
+
 void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
 {
         struct sk_buff *skb2;
@@ -243,6 +256,19 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                 if (!(info->flags & IEEE80211_TX_CTL_INJECTED) &&
                     (info->flags & IEEE80211_TX_STAT_ACK))
                         ieee80211_frame_acked(sta, skb);
+
+                if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) {
+                        if (info->flags & IEEE80211_TX_STAT_ACK) {
+                                if (sta->lost_packets)
+                                        sta->lost_packets = 0;
+                        } else if (++sta->lost_packets >= STA_LOST_PKT_THRESHOLD) {
+                                cfg80211_cqm_pktloss_notify(sta->sdata->dev,
+                                                            sta->sta.addr,
+                                                            sta->lost_packets,
+                                                            GFP_ATOMIC);
+                                sta->lost_packets = 0;
+                        }
+                }
         }
 
         rcu_read_unlock();
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index df6aac52353..2ba74265682 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -622,7 +622,8 @@ ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
                 txrc.max_rate_idx = -1;
         else
                 txrc.max_rate_idx = fls(txrc.rate_idx_mask) - 1;
-        txrc.ap = tx->sdata->vif.type == NL80211_IFTYPE_AP;
+        txrc.bss = (tx->sdata->vif.type == NL80211_IFTYPE_AP ||
+                    tx->sdata->vif.type == NL80211_IFTYPE_ADHOC);
 
         /* set up RTS protection if desired */
         if (len > tx->local->hw.wiphy->rts_threshold) {
@@ -1033,6 +1034,7 @@ static bool __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
         struct ieee80211_radiotap_header *rthdr =
                 (struct ieee80211_radiotap_header *) skb->data;
         struct ieee80211_supported_band *sband;
+        bool hw_frag;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         int ret = ieee80211_radiotap_iterator_init(&iterator, rthdr, skb->len,
                                                    NULL);
@@ -1042,6 +1044,9 @@ static bool __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
         info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
         tx->flags &= ~IEEE80211_TX_FRAGMENTED;
 
+        /* packet is fragmented in HW if we have a non-NULL driver callback */
+        hw_frag = (tx->local->ops->set_frag_threshold != NULL);
+
         /*
          * for every radiotap entry that is present
          * (ieee80211_radiotap_iterator_next returns -ENOENT when no more
@@ -1078,7 +1083,8 @@ static bool __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
                         }
                         if (*iterator.this_arg & IEEE80211_RADIOTAP_F_WEP)
                                 info->flags &= ~IEEE80211_TX_INTFL_DONT_ENCRYPT;
-                        if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FRAG)
+                        if ((*iterator.this_arg & IEEE80211_RADIOTAP_F_FRAG) &&
+                                                                !hw_frag)
                                 tx->flags |= IEEE80211_TX_FRAGMENTED;
                         break;
 
@@ -1181,8 +1187,10 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
         /*
          * Set this flag (used below to indicate "automatic fragmentation"),
          * it will be cleared/left by radiotap as desired.
+         * Only valid when fragmentation is done by the stack.
          */
-        tx->flags |= IEEE80211_TX_FRAGMENTED;
+        if (!local->ops->set_frag_threshold)
+                tx->flags |= IEEE80211_TX_FRAGMENTED;
 
         /* process and remove the injection radiotap header */
         if (unlikely(info->flags & IEEE80211_TX_INTFL_HAS_RADIOTAP)) {
@@ -2306,7 +2314,7 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                 txrc.max_rate_idx = -1;
         else
                 txrc.max_rate_idx = fls(txrc.rate_idx_mask) - 1;
-        txrc.ap = true;
+        txrc.bss = true;
         rate_control_get_rate(sdata, NULL, &txrc);
 
         info->control.vif = vif;
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 0b6fc92bc0d..e497476174c 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -368,8 +368,9 @@ void ieee80211_add_pending_skb(struct ieee80211_local *local,
         spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 }
 
-int ieee80211_add_pending_skbs(struct ieee80211_local *local,
-                               struct sk_buff_head *skbs)
+int ieee80211_add_pending_skbs_fn(struct ieee80211_local *local,
+                                  struct sk_buff_head *skbs,
+                                  void (*fn)(void *data), void *data)
 {
         struct ieee80211_hw *hw = &local->hw;
         struct sk_buff *skb;
@@ -394,6 +395,9 @@ int ieee80211_add_pending_skbs(struct ieee80211_local *local,
                 __skb_queue_tail(&local->pending[queue], skb);
         }
 
+        if (fn)
+                fn(data);
+
         for (i = 0; i < hw->queues; i++)
                 __ieee80211_wake_queue(hw, i,
                         IEEE80211_QUEUE_STOP_REASON_SKB_ADD);
@@ -402,6 +406,12 @@ int ieee80211_add_pending_skbs(struct ieee80211_local *local,
         return ret;
 }
 
+int ieee80211_add_pending_skbs(struct ieee80211_local *local,
+                               struct sk_buff_head *skbs)
+{
+        return ieee80211_add_pending_skbs_fn(local, skbs, NULL, NULL);
+}
+
 void ieee80211_stop_queues_by_reason(struct ieee80211_hw *hw,
                                     enum queue_stop_reason reason)
 {
@@ -1011,9 +1021,10 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
         return pos - buffer;
 }
 
-void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
-                              const u8 *ssid, size_t ssid_len,
-                              const u8 *ie, size_t ie_len)
+struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
+                                          u8 *dst,
+                                          const u8 *ssid, size_t ssid_len,
+                                          const u8 *ie, size_t ie_len)
 {
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb;
@@ -1027,7 +1038,7 @@ void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
         if (!buf) {
                 printk(KERN_DEBUG "%s: failed to allocate temporary IE "
                        "buffer\n", sdata->name);
-                return;
+                return NULL;
         }
 
         chan = ieee80211_frequency_to_channel(
@@ -1050,8 +1061,20 @@ void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
         }
 
         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
-        ieee80211_tx_skb(sdata, skb);
         kfree(buf);
+
+        return skb;
+}
+
+void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
+                              const u8 *ssid, size_t ssid_len,
+                              const u8 *ie, size_t ie_len)
+{
+        struct sk_buff *skb;
+
+        skb = ieee80211_build_probe_req(sdata, dst, ssid, ssid_len, ie, ie_len);
+        if (skb)
+                ieee80211_tx_skb(sdata, skb);
 }
 
 u32 ieee80211_sta_get_rates(struct ieee80211_local *local,
@@ -1152,6 +1175,9 @@ int ieee80211_reconfig(struct ieee80211_local *local)
         }
         mutex_unlock(&local->sta_mtx);
 
+        /* setup fragmentation threshold */
+        drv_set_frag_threshold(local, hw->wiphy->frag_threshold);
+
         /* setup RTS threshold */
         drv_set_rts_threshold(local, hw->wiphy->rts_threshold);
 
diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c
index 34e6d02da77..58e75bbc1f9 100644
--- a/net/mac80211/wme.c
+++ b/net/mac80211/wme.c
@@ -21,7 +21,16 @@
 /* Default mapping in classifier to work with default
  * queue setup.
  */
-const int ieee802_1d_to_ac[8] = { 2, 3, 3, 2, 1, 1, 0, 0 };
+const int ieee802_1d_to_ac[8] = {
+        IEEE80211_AC_BE,
+        IEEE80211_AC_BK,
+        IEEE80211_AC_BK,
+        IEEE80211_AC_BE,
+        IEEE80211_AC_VI,
+        IEEE80211_AC_VI,
+        IEEE80211_AC_VO,
+        IEEE80211_AC_VO
+};
 
 static int wme_downgrade_ac(struct sk_buff *skb)
 {
diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index 85dabb86be6..32fcbe290c0 100644
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -173,9 +173,11 @@ next_hook:
                              outdev, &elem, okfn, hook_thresh);
         if (verdict == NF_ACCEPT || verdict == NF_STOP) {
                 ret = 1;
-        } else if (verdict == NF_DROP) {
+        } else if ((verdict & NF_VERDICT_MASK) == NF_DROP) {
                 kfree_skb(skb);
-                ret = -EPERM;
+                ret = -(verdict >> NF_VERDICT_BITS);
+                if (ret == 0)
+                        ret = -EPERM;
         } else if ((verdict & NF_VERDICT_MASK) == NF_QUEUE) {
                 if (!nf_queue(skb, elem, pf, hook, indev, outdev, okfn,
                               verdict >> NF_VERDICT_BITS))
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 5f5daa30b0a..c6f29363922 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -110,10 +110,8 @@ static int __ip_vs_addr_is_local_v6(const struct in6_addr *addr)
         struct rt6_info *rt;
         struct flowi fl = {
                 .oif = 0,
-                .nl_u = {
-                        .ip6_u = {
-                                .daddr = *addr,
-                                .saddr = { .s6_addr32 = {0, 0, 0, 0} }, } },
+                .fl6_dst = *addr,
+                .fl6_src = { .s6_addr32 = {0, 0, 0, 0} },
         };
 
         rt = (struct rt6_info *)ip6_route_output(&init_net, NULL, &fl);
diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
index de04ea39cde..5325a3fbe4a 100644
--- a/net/netfilter/ipvs/ip_vs_xmit.c
+++ b/net/netfilter/ipvs/ip_vs_xmit.c
@@ -96,12 +96,8 @@ __ip_vs_get_out_rt(struct sk_buff *skb, struct ip_vs_dest *dest,
                 if (!(rt = (struct rtable *)
                       __ip_vs_dst_check(dest, rtos))) {
                         struct flowi fl = {
-                                .oif = 0,
-                                .nl_u = {
-                                        .ip4_u = {
-                                                .daddr = dest->addr.ip,
-                                                .saddr = 0,
-                                                .tos = rtos, } },
+                                .fl4_dst = dest->addr.ip,
+                                .fl4_tos = rtos,
                         };
 
                         if (ip_route_output_key(net, &rt, &fl)) {
@@ -118,12 +114,8 @@ __ip_vs_get_out_rt(struct sk_buff *skb, struct ip_vs_dest *dest,
                 spin_unlock(&dest->dst_lock);
         } else {
                 struct flowi fl = {
-                        .oif = 0,
-                        .nl_u = {
-                                .ip4_u = {
-                                        .daddr = daddr,
-                                        .saddr = 0,
-                                        .tos = rtos, } },
+                        .fl4_dst = daddr,
+                        .fl4_tos = rtos,
                 };
 
                 if (ip_route_output_key(net, &rt, &fl)) {
@@ -169,7 +161,7 @@ __ip_vs_reroute_locally(struct sk_buff *skb)
         struct net *net = dev_net(dev);
         struct iphdr *iph = ip_hdr(skb);
 
-        if (rt->fl.iif) {
+        if (rt_is_input_route(rt)) {
                 unsigned long orefdst = skb->_skb_refdst;
 
                 if (ip_route_input(skb, iph->daddr, iph->saddr,
@@ -178,14 +170,9 @@ __ip_vs_reroute_locally(struct sk_buff *skb)
                 refdst_drop(orefdst);
         } else {
                 struct flowi fl = {
-                        .oif = 0,
-                        .nl_u = {
-                                .ip4_u = {
-                                        .daddr = iph->daddr,
-                                        .saddr = iph->saddr,
-                                        .tos = RT_TOS(iph->tos),
-                                }
-                        },
+                        .fl4_dst = iph->daddr,
+                        .fl4_src = iph->saddr,
+                        .fl4_tos = RT_TOS(iph->tos),
                         .mark = skb->mark,
                 };
                 struct rtable *rt;
@@ -216,12 +203,7 @@ __ip_vs_route_output_v6(struct net *net, struct in6_addr *daddr,
 {
         struct dst_entry *dst;
         struct flowi fl = {
-                .oif = 0,
-                .nl_u = {
-                        .ip6_u = {
-                                .daddr = *daddr,
-                        },
-                },
+                .fl6_dst = *daddr,
         };
 
         dst = ip6_route_output(net, NULL, &fl);
@@ -552,7 +534,8 @@ ip_vs_nat_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
 #endif
 
         /* From world but DNAT to loopback address? */
-        if (local && ipv4_is_loopback(rt->rt_dst) && skb_rtable(skb)->fl.iif) {
+        if (local && ipv4_is_loopback(rt->rt_dst) &&
+            rt_is_input_route(skb_rtable(skb))) {
                 IP_VS_DBG_RL_PKT(1, AF_INET, pp, skb, 0, "ip_vs_nat_xmit(): "
                                  "stopping DNAT to loopback address");
                 goto tx_error_put;
@@ -1165,7 +1148,8 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
 #endif
 
         /* From world but DNAT to loopback address? */
-        if (local && ipv4_is_loopback(rt->rt_dst) && skb_rtable(skb)->fl.iif) {
+        if (local && ipv4_is_loopback(rt->rt_dst) &&
+            rt_is_input_route(skb_rtable(skb))) {
                 IP_VS_DBG(1, "%s(): "
                           "stopping DNAT to loopback %pI4\n",
                           __func__, &cp->daddr.ip);
diff --git a/net/netfilter/xt_TEE.c b/net/netfilter/xt_TEE.c
index 22a2d421e7e..5128a6c4cb2 100644
--- a/net/netfilter/xt_TEE.c
+++ b/net/netfilter/xt_TEE.c
@@ -70,9 +70,9 @@ tee_tg_route4(struct sk_buff *skb, const struct xt_tee_tginfo *info)
                         return false;
                 fl.oif = info->priv->oif;
         }
-        fl.nl_u.ip4_u.daddr = info->gw.ip;
-        fl.nl_u.ip4_u.tos   = RT_TOS(iph->tos);
-        fl.nl_u.ip4_u.scope = RT_SCOPE_UNIVERSE;
+        fl.fl4_dst = info->gw.ip;
+        fl.fl4_tos = RT_TOS(iph->tos);
+        fl.fl4_scope = RT_SCOPE_UNIVERSE;
         if (ip_route_output_key(net, &rt, &fl) != 0)
                 return false;
 
@@ -150,9 +150,9 @@ tee_tg_route6(struct sk_buff *skb, const struct xt_tee_tginfo *info)
                         return false;
                 fl.oif = info->priv->oif;
         }
-        fl.nl_u.ip6_u.daddr = info->gw.in6;
-        fl.nl_u.ip6_u.flowlabel = ((iph->flow_lbl[0] & 0xF) << 16) |
-                                  (iph->flow_lbl[1] << 8) | iph->flow_lbl[2];
+        fl.fl6_dst = info->gw.in6;
+        fl.fl6_flowlabel = ((iph->flow_lbl[0] & 0xF) << 16) |
+                           (iph->flow_lbl[1] << 8) | iph->flow_lbl[2];
         dst = ip6_route_output(net, NULL, &fl);
         if (dst == NULL)
                 return false;
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 8298e676f5a..246a04a1323 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -61,6 +61,7 @@
 #include <linux/kernel.h>
 #include <linux/kmod.h>
 #include <linux/slab.h>
+#include <linux/vmalloc.h>
 #include <net/net_namespace.h>
 #include <net/ip.h>
 #include <net/protocol.h>
@@ -163,8 +164,13 @@ struct packet_mreq_max {
 static int packet_set_ring(struct sock *sk, struct tpacket_req *req,
                 int closing, int tx_ring);
 
+#define PGV_FROM_VMALLOC 1
+struct pgv {
+        char *buffer;
+};
+
 struct packet_ring_buffer {
-        char                    **pg_vec;
+        struct pgv              *pg_vec;
         unsigned int            head;
         unsigned int            frames_per_block;
         unsigned int            frame_size;
@@ -217,6 +223,13 @@ struct packet_skb_cb {
 
 #define PACKET_SKB_CB(__skb)    ((struct packet_skb_cb *)((__skb)->cb))
 
+static inline __pure struct page *pgv_to_page(void *addr)
+{
+        if (is_vmalloc_addr(addr))
+                return vmalloc_to_page(addr);
+        return virt_to_page(addr);
+}
+
 static void __packet_set_status(struct packet_sock *po, void *frame, int status)
 {
         union {
@@ -229,11 +242,11 @@ static void __packet_set_status(struct packet_sock *po, void *frame, int status)
         switch (po->tp_version) {
         case TPACKET_V1:
                 h.h1->tp_status = status;
-                flush_dcache_page(virt_to_page(&h.h1->tp_status));
+                flush_dcache_page(pgv_to_page(&h.h1->tp_status));
                 break;
         case TPACKET_V2:
                 h.h2->tp_status = status;
-                flush_dcache_page(virt_to_page(&h.h2->tp_status));
+                flush_dcache_page(pgv_to_page(&h.h2->tp_status));
                 break;
         default:
                 pr_err("TPACKET version not supported\n");
@@ -256,10 +269,10 @@ static int __packet_get_status(struct packet_sock *po, void *frame)
         h.raw = frame;
         switch (po->tp_version) {
         case TPACKET_V1:
-                flush_dcache_page(virt_to_page(&h.h1->tp_status));
+                flush_dcache_page(pgv_to_page(&h.h1->tp_status));
                 return h.h1->tp_status;
         case TPACKET_V2:
-                flush_dcache_page(virt_to_page(&h.h2->tp_status));
+                flush_dcache_page(pgv_to_page(&h.h2->tp_status));
                 return h.h2->tp_status;
         default:
                 pr_err("TPACKET version not supported\n");
@@ -283,7 +296,8 @@ static void *packet_lookup_frame(struct packet_sock *po,
         pg_vec_pos = position / rb->frames_per_block;
         frame_offset = position % rb->frames_per_block;
 
-        h.raw = rb->pg_vec[pg_vec_pos] + (frame_offset * rb->frame_size);
+        h.raw = rb->pg_vec[pg_vec_pos].buffer +
+                (frame_offset * rb->frame_size);
 
         if (status != __packet_get_status(po, h.raw))
                 return NULL;
@@ -503,7 +517,8 @@ out_free:
         return err;
 }
 
-static inline unsigned int run_filter(struct sk_buff *skb, struct sock *sk,
+static inline unsigned int run_filter(const struct sk_buff *skb,
+                                      const struct sock *sk,
                                       unsigned int res)
 {
         struct sk_filter *filter;
@@ -511,22 +526,22 @@ static inline unsigned int run_filter(struct sk_buff *skb, struct sock *sk,
         rcu_read_lock_bh();
         filter = rcu_dereference_bh(sk->sk_filter);
         if (filter != NULL)
-                res = sk_run_filter(skb, filter->insns, filter->len);
+                res = sk_run_filter(skb, filter->insns);
         rcu_read_unlock_bh();
 
         return res;
 }
 
 /*
-   This function makes lazy skb cloning in hope that most of packets
-   are discarded by BPF.
-
-   Note tricky part: we DO mangle shared skb! skb->data, skb->len
-   and skb->cb are mangled. It works because (and until) packets
-   falling here are owned by current CPU. Output packets are cloned
-   by dev_queue_xmit_nit(), input packets are processed by net_bh
-   sequencially, so that if we return skb to original state on exit,
-   we will not harm anyone.
+ * This function makes lazy skb cloning in hope that most of packets
+ * are discarded by BPF.
+ *
+ * Note tricky part: we DO mangle shared skb! skb->data, skb->len
+ * and skb->cb are mangled. It works because (and until) packets
+ * falling here are owned by current CPU. Output packets are cloned
+ * by dev_queue_xmit_nit(), input packets are processed by net_bh
+ * sequencially, so that if we return skb to original state on exit,
+ * we will not harm anyone.
  */
 
 static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
@@ -552,11 +567,11 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
 
         if (dev->header_ops) {
                 /* The device has an explicit notion of ll header,
-                   exported to higher levels.
-
-                   Otherwise, the device hides datails of it frame
-                   structure, so that corresponding packet head
-                   never delivered to user.
+                 * exported to higher levels.
+                 *
+                 * Otherwise, the device hides details of its frame
+                 * structure, so that corresponding packet head is
+                 * never delivered to user.
                  */
                 if (sk->sk_type != SOCK_DGRAM)
                         skb_push(skb, skb->data - skb_mac_header(skb));
@@ -791,17 +806,15 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
 
         __packet_set_status(po, h.raw, status);
         smp_mb();
+#if ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE == 1
         {
-                struct page *p_start, *p_end;
-                u8 *h_end = h.raw + macoff + snaplen - 1;
-
-                p_start = virt_to_page(h.raw);
-                p_end = virt_to_page(h_end);
-                while (p_start <= p_end) {
-                        flush_dcache_page(p_start);
-                        p_start++;
-                }
+                u8 *start, *end;
+
+                end = (u8 *)PAGE_ALIGN((unsigned long)h.raw + macoff + snaplen);
+                for (start = h.raw; start < end; start += PAGE_SIZE)
+                        flush_dcache_page(pgv_to_page(start));
         }
+#endif
 
         sk->sk_data_ready(sk, 0);
 
@@ -907,7 +920,6 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
         }
 
         err = -EFAULT;
-        page = virt_to_page(data);
         offset = offset_in_page(data);
         len_max = PAGE_SIZE - offset;
         len = ((to_write > len_max) ? len_max : to_write);
@@ -926,11 +938,11 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
                         return -EFAULT;
                 }
 
+                page = pgv_to_page(data);
+                data += len;
                 flush_dcache_page(page);
                 get_page(page);
-                skb_fill_page_desc(skb,
-                                nr_frags,
-                                page++, offset, len);
+                skb_fill_page_desc(skb, nr_frags, page, offset, len);
                 to_write -= len;
                 offset = 0;
                 len_max = PAGE_SIZE;
@@ -2325,37 +2337,70 @@ static const struct vm_operations_struct packet_mmap_ops = {
         .close  =       packet_mm_close,
 };
 
-static void free_pg_vec(char **pg_vec, unsigned int order, unsigned int len)
+static void free_pg_vec(struct pgv *pg_vec, unsigned int order,
+                        unsigned int len)
 {
         int i;
 
         for (i = 0; i < len; i++) {
-                if (likely(pg_vec[i]))
-                        free_pages((unsigned long) pg_vec[i], order);
+                if (likely(pg_vec[i].buffer)) {
+                        if (is_vmalloc_addr(pg_vec[i].buffer))
+                                vfree(pg_vec[i].buffer);
+                        else
+                                free_pages((unsigned long)pg_vec[i].buffer,
+                                           order);
+                        pg_vec[i].buffer = NULL;
+                }
         }
         kfree(pg_vec);
 }
 
 static inline char *alloc_one_pg_vec_page(unsigned long order)
 {
-        gfp_t gfp_flags = GFP_KERNEL | __GFP_COMP | __GFP_ZERO | __GFP_NOWARN;
+        char *buffer = NULL;
+        gfp_t gfp_flags = GFP_KERNEL | __GFP_COMP |
+                          __GFP_ZERO | __GFP_NOWARN | __GFP_NORETRY;
 
-        return (char *) __get_free_pages(gfp_flags, order);
+        buffer = (char *) __get_free_pages(gfp_flags, order);
+
+        if (buffer)
+                return buffer;
+
+        /*
+         * __get_free_pages failed, fall back to vmalloc
+         */
+        buffer = vzalloc((1 << order) * PAGE_SIZE);
+
+        if (buffer)
+                return buffer;
+
+        /*
+         * vmalloc failed, lets dig into swap here
+         */
+        gfp_flags &= ~__GFP_NORETRY;
+        buffer = (char *)__get_free_pages(gfp_flags, order);
+        if (buffer)
+                return buffer;
+
+        /*
+         * complete and utter failure
+         */
+        return NULL;
 }
 
-static char **alloc_pg_vec(struct tpacket_req *req, int order)
+static struct pgv *alloc_pg_vec(struct tpacket_req *req, int order)
 {
         unsigned int block_nr = req->tp_block_nr;
-        char **pg_vec;
+        struct pgv *pg_vec;
         int i;
 
-        pg_vec = kzalloc(block_nr * sizeof(char *), GFP_KERNEL);
+        pg_vec = kcalloc(block_nr, sizeof(struct pgv), GFP_KERNEL);
         if (unlikely(!pg_vec))
                 goto out;
 
         for (i = 0; i < block_nr; i++) {
-                pg_vec[i] = alloc_one_pg_vec_page(order);
-                if (unlikely(!pg_vec[i]))
+                pg_vec[i].buffer = alloc_one_pg_vec_page(order);
+                if (unlikely(!pg_vec[i].buffer))
                         goto out_free_pgvec;
         }
 
@@ -2371,7 +2416,7 @@ out_free_pgvec:
 static int packet_set_ring(struct sock *sk, struct tpacket_req *req,
                 int closing, int tx_ring)
 {
-        char **pg_vec = NULL;
+        struct pgv *pg_vec = NULL;
         struct packet_sock *po = pkt_sk(sk);
         int was_running, order = 0;
         struct packet_ring_buffer *rb;
@@ -2533,15 +2578,17 @@ static int packet_mmap(struct file *file, struct socket *sock,
                         continue;
 
                 for (i = 0; i < rb->pg_vec_len; i++) {
-                        struct page *page = virt_to_page(rb->pg_vec[i]);
+                        struct page *page;
+                        void *kaddr = rb->pg_vec[i].buffer;
                         int pg_num;
 
-                        for (pg_num = 0; pg_num < rb->pg_vec_pages;
-                                        pg_num++, page++) {
+                        for (pg_num = 0; pg_num < rb->pg_vec_pages; pg_num++) {
+                                page = pgv_to_page(kaddr);
                                 err = vm_insert_page(vma, start, page);
                                 if (unlikely(err))
                                         goto out;
                                 start += PAGE_SIZE;
+                                kaddr += PAGE_SIZE;
                         }
                 }
         }
diff --git a/net/phonet/Makefile b/net/phonet/Makefile
index d62bbba649b..e10b1b182ce 100644
--- a/net/phonet/Makefile
+++ b/net/phonet/Makefile
@@ -1,6 +1,6 @@
 obj-$(CONFIG_PHONET) += phonet.o pn_pep.o
 
-phonet-objs := \
+phonet-y := \
         pn_dev.o \
         pn_netlink.o \
         socket.o \
@@ -8,4 +8,4 @@ phonet-objs := \
         sysctl.o \
         af_phonet.o
 
-pn_pep-objs := pep.o pep-gprs.o
+pn_pep-y := pep.o pep-gprs.o
diff --git a/net/rds/Makefile b/net/rds/Makefile
index b46eca10968..56d3f6023ce 100644
--- a/net/rds/Makefile
+++ b/net/rds/Makefile
@@ -4,7 +4,7 @@ rds-y :=	af_rds.o bind.o cong.o connection.o info.o message.o   \
                         loop.o page.o rdma.o
 
 obj-$(CONFIG_RDS_RDMA) += rds_rdma.o
-rds_rdma-objs :=        rdma_transport.o \
+rds_rdma-y :=   rdma_transport.o \
                         ib.o ib_cm.o ib_recv.o ib_ring.o ib_send.o ib_stats.o \
                         ib_sysctl.o ib_rdma.o \
                         iw.o iw_cm.o iw_recv.o iw_ring.o iw_send.o iw_stats.o \
@@ -12,10 +12,8 @@ rds_rdma-objs :=	rdma_transport.o \
 
 
 obj-$(CONFIG_RDS_TCP) += rds_tcp.o
-rds_tcp-objs :=         tcp.o tcp_connect.o tcp_listen.o tcp_recv.o \
+rds_tcp-y :=            tcp.o tcp_connect.o tcp_listen.o tcp_recv.o \
                         tcp_send.o tcp_stats.o
 
-ifeq ($(CONFIG_RDS_DEBUG), y)
-EXTRA_CFLAGS += -DDEBUG
-endif
+ccflags-$(CONFIG_RDS_DEBUG)     :=      -DDEBUG
 
diff --git a/net/rfkill/core.c b/net/rfkill/core.c
index 04f599089e6..0198191b756 100644
--- a/net/rfkill/core.c
+++ b/net/rfkill/core.c
@@ -149,20 +149,6 @@ static void rfkill_led_trigger_activate(struct led_classdev *led)
         rfkill_led_trigger_event(rfkill);
 }
 
-const char *rfkill_get_led_trigger_name(struct rfkill *rfkill)
-{
-        return rfkill->led_trigger.name;
-}
-EXPORT_SYMBOL(rfkill_get_led_trigger_name);
-
-void rfkill_set_led_trigger_name(struct rfkill *rfkill, const char *name)
-{
-        BUG_ON(!rfkill);
-
-        rfkill->ledtrigname = name;
-}
-EXPORT_SYMBOL(rfkill_set_led_trigger_name);
-
 static int rfkill_led_trigger_register(struct rfkill *rfkill)
 {
         rfkill->led_trigger.name = rfkill->ledtrigname
diff --git a/net/rxrpc/Makefile b/net/rxrpc/Makefile
index c46867c61c9..d1c3429b69e 100644
--- a/net/rxrpc/Makefile
+++ b/net/rxrpc/Makefile
@@ -2,7 +2,7 @@
 # Makefile for Linux kernel RxRPC
 #
 
-af-rxrpc-objs := \
+af-rxrpc-y := \
         af_rxrpc.o \
         ar-accept.o \
         ar-ack.o \
@@ -21,7 +21,7 @@ af-rxrpc-objs := \
         ar-transport.o
 
 ifeq ($(CONFIG_PROC_FS),y)
-af-rxrpc-objs += ar-proc.o
+af-rxrpc-y += ar-proc.o
 endif
 
 obj-$(CONFIG_AF_RXRPC) += af-rxrpc.o
diff --git a/net/rxrpc/ar-peer.c b/net/rxrpc/ar-peer.c
index 9f1729bd60d..a53fb25a64e 100644
--- a/net/rxrpc/ar-peer.c
+++ b/net/rxrpc/ar-peer.c
@@ -47,12 +47,12 @@ static void rxrpc_assess_MTU_size(struct rxrpc_peer *peer)
         case AF_INET:
                 fl.oif = 0;
                 fl.proto = IPPROTO_UDP,
-                fl.nl_u.ip4_u.saddr = 0;
-                fl.nl_u.ip4_u.daddr = peer->srx.transport.sin.sin_addr.s_addr;
-                fl.nl_u.ip4_u.tos = 0;
+                fl.fl4_dst = peer->srx.transport.sin.sin_addr.s_addr;
+                fl.fl4_src = 0;
+                fl.fl4_tos = 0;
                 /* assume AFS.CM talking to AFS.FS */
-                fl.uli_u.ports.sport = htons(7001);
-                fl.uli_u.ports.dport = htons(7000);
+                fl.fl_ip_sport = htons(7001);
+                fl.fl_ip_dport = htons(7000);
                 break;
         default:
                 BUG();
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 5dbb3cd96e5..0918834ee4a 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -60,8 +60,7 @@ static inline struct sk_buff *dequeue_skb(struct Qdisc *q)
 
                 /* check the reason of requeuing without tx lock first */
                 txq = netdev_get_tx_queue(dev, skb_get_queue_mapping(skb));
-                if (!netif_tx_queue_stopped(txq) &&
-                    !netif_tx_queue_frozen(txq)) {
+                if (!netif_tx_queue_frozen_or_stopped(txq)) {
                         q->gso_skb = NULL;
                         q->q.qlen--;
                 } else
@@ -122,7 +121,7 @@ int sch_direct_xmit(struct sk_buff *skb, struct Qdisc *q,
         spin_unlock(root_lock);
 
         HARD_TX_LOCK(dev, txq, smp_processor_id());
-        if (!netif_tx_queue_stopped(txq) && !netif_tx_queue_frozen(txq))
+        if (!netif_tx_queue_frozen_or_stopped(txq))
                 ret = dev_hard_start_xmit(skb, dev, txq);
 
         HARD_TX_UNLOCK(dev, txq);
@@ -144,8 +143,7 @@ int sch_direct_xmit(struct sk_buff *skb, struct Qdisc *q,
                 ret = dev_requeue_skb(skb, q);
         }
 
-        if (ret && (netif_tx_queue_stopped(txq) ||
-                    netif_tx_queue_frozen(txq)))
+        if (ret && netif_tx_queue_frozen_or_stopped(txq))
                 ret = 0;
 
         return ret;
@@ -555,7 +553,9 @@ struct Qdisc *qdisc_alloc(struct netdev_queue *dev_queue,
         size = QDISC_ALIGN(sizeof(*sch));
         size += ops->priv_size + (QDISC_ALIGNTO - 1);
 
-        p = kzalloc(size, GFP_KERNEL);
+        p = kzalloc_node(size, GFP_KERNEL,
+                         netdev_queue_numa_node_read(dev_queue));
+
         if (!p)
                 goto errout;
         sch = (struct Qdisc *) QDISC_ALIGN((unsigned long) p);
diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
index 401af959670..106479a7c94 100644
--- a/net/sched/sch_teql.c
+++ b/net/sched/sch_teql.c
@@ -309,8 +309,7 @@ restart:
                         if (__netif_tx_trylock(slave_txq)) {
                                 unsigned int length = qdisc_pkt_len(skb);
 
-                                if (!netif_tx_queue_stopped(slave_txq) &&
-                                    !netif_tx_queue_frozen(slave_txq) &&
+                                if (!netif_tx_queue_frozen_or_stopped(slave_txq) &&
                                     slave_ops->ndo_start_xmit(skb, slave) == NETDEV_TX_OK) {
                                         txq_trans_update(slave_txq);
                                         __netif_tx_unlock(slave_txq);
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 6bd554323a3..842c7f3650b 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -6047,7 +6047,7 @@ static struct sk_buff *sctp_skb_recv_datagram(struct sock *sk, int flags,
                  * will suddenly eat the receive_queue.
                  *
                  *  Look at current nfs client by the way...
-                 *  However, this function was corrent in any case. 8)
+                 *  However, this function was correct in any case. 8)
                  */
                 if (flags & MSG_PEEK) {
                         spin_lock_bh(&sk->sk_receive_queue.lock);
diff --git a/net/socket.c b/net/socket.c
index 3ca2fd9e372..c898df76e92 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -156,7 +156,7 @@ static const struct file_operations socket_file_ops = {
  */
 
 static DEFINE_SPINLOCK(net_family_lock);
-static const struct net_proto_family *net_families[NPROTO] __read_mostly;
+static const struct net_proto_family __rcu *net_families[NPROTO] __read_mostly;
 
 /*
  *      Statistics counters of the socket lists
@@ -1200,7 +1200,7 @@ int __sock_create(struct net *net, int family, int type, int protocol,
          * requested real, full-featured networking support upon configuration.
          * Otherwise module support will break!
          */
-        if (net_families[family] == NULL)
+        if (rcu_access_pointer(net_families[family]) == NULL)
                 request_module("net-pf-%d", family);
 #endif
 
@@ -2332,10 +2332,11 @@ int sock_register(const struct net_proto_family *ops)
         }
 
         spin_lock(&net_family_lock);
-        if (net_families[ops->family])
+        if (rcu_dereference_protected(net_families[ops->family],
+                                      lockdep_is_held(&net_family_lock)))
                 err = -EEXIST;
         else {
-                net_families[ops->family] = ops;
+                rcu_assign_pointer(net_families[ops->family], ops);
                 err = 0;
         }
         spin_unlock(&net_family_lock);
@@ -2363,7 +2364,7 @@ void sock_unregister(int family)
         BUG_ON(family < 0 || family >= NPROTO);
 
         spin_lock(&net_family_lock);
-        net_families[family] = NULL;
+        rcu_assign_pointer(net_families[family], NULL);
         spin_unlock(&net_family_lock);
 
         synchronize_rcu();
diff --git a/net/sunrpc/auth_gss/Makefile b/net/sunrpc/auth_gss/Makefile
index 7350d86a32e..9e4cb59ef9f 100644
--- a/net/sunrpc/auth_gss/Makefile
+++ b/net/sunrpc/auth_gss/Makefile
@@ -4,10 +4,10 @@
 
 obj-$(CONFIG_SUNRPC_GSS) += auth_rpcgss.o
 
-auth_rpcgss-objs := auth_gss.o gss_generic_token.o \
+auth_rpcgss-y := auth_gss.o gss_generic_token.o \
         gss_mech_switch.o svcauth_gss.o
 
 obj-$(CONFIG_RPCSEC_GSS_KRB5) += rpcsec_gss_krb5.o
 
-rpcsec_gss_krb5-objs := gss_krb5_mech.o gss_krb5_seal.o gss_krb5_unseal.o \
+rpcsec_gss_krb5-y := gss_krb5_mech.o gss_krb5_seal.o gss_krb5_unseal.o \
         gss_krb5_seqnum.o gss_krb5_wrap.o gss_krb5_crypto.o gss_krb5_keys.o
diff --git a/net/tipc/addr.c b/net/tipc/addr.c
index 8a2e89bffde..886715a7525 100644
--- a/net/tipc/addr.c
+++ b/net/tipc/addr.c
@@ -35,11 +35,9 @@
  */
 
 #include "core.h"
-#include "dbg.h"
 #include "addr.h"
 #include "zone.h"
 #include "cluster.h"
-#include "net.h"
 
 /**
  * tipc_addr_domain_valid - validates a network domain address
diff --git a/net/tipc/bcast.c b/net/tipc/bcast.c
index 22a60fc9839..6d828d9eda4 100644
--- a/net/tipc/bcast.c
+++ b/net/tipc/bcast.c
@@ -36,17 +36,9 @@
  */
 
 #include "core.h"
-#include "msg.h"
-#include "dbg.h"
 #include "link.h"
-#include "net.h"
-#include "node.h"
 #include "port.h"
-#include "addr.h"
-#include "node_subscr.h"
 #include "name_distr.h"
-#include "bearer.h"
-#include "name_table.h"
 #include "bcast.h"
 
 #define MAX_PKT_DEFAULT_MCAST 1500      /* bcast link max packet size (fixed) */
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index 9927d1d56c4..885da94be4a 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -36,12 +36,9 @@
 
 #include "core.h"
 #include "config.h"
-#include "dbg.h"
 #include "bearer.h"
-#include "link.h"
 #include "port.h"
 #include "discover.h"
-#include "bcast.h"
 
 #define MAX_ADDR_STR 32
 
@@ -625,7 +622,7 @@ int tipc_block_bearer(const char *name)
  * Note: This routine assumes caller holds tipc_net_lock.
  */
 
-static int bearer_disable(struct bearer *b_ptr)
+static void bearer_disable(struct bearer *b_ptr)
 {
         struct link *l_ptr;
         struct link *temp_l_ptr;
@@ -641,7 +638,6 @@ static int bearer_disable(struct bearer *b_ptr)
         }
         spin_unlock_bh(&b_ptr->publ.lock);
         memset(b_ptr, 0, sizeof(struct bearer));
-        return 0;
 }
 
 int tipc_disable_bearer(const char *name)
@@ -654,8 +650,10 @@ int tipc_disable_bearer(const char *name)
         if (b_ptr == NULL) {
                 warn("Attempt to disable unknown bearer <%s>\n", name);
                 res = -EINVAL;
-        } else
-                res = bearer_disable(b_ptr);
+        } else {
+                bearer_disable(b_ptr);
+                res = 0;
+        }
         write_unlock_bh(&tipc_net_lock);
         return res;
 }
diff --git a/net/tipc/bearer.h b/net/tipc/bearer.h
index a850b389663..85f451d5aac 100644
--- a/net/tipc/bearer.h
+++ b/net/tipc/bearer.h
@@ -37,12 +37,50 @@
 #ifndef _TIPC_BEARER_H
 #define _TIPC_BEARER_H
 
-#include "core.h"
 #include "bcast.h"
 
 #define MAX_BEARERS 8
 #define MAX_MEDIA 4
 
+/*
+ * Identifiers of supported TIPC media types
+ */
+#define TIPC_MEDIA_TYPE_ETH     1
+
+/*
+ * Destination address structure used by TIPC bearers when sending messages
+ *
+ * IMPORTANT: The fields of this structure MUST be stored using the specified
+ * byte order indicated below, as the structure is exchanged between nodes
+ * as part of a link setup process.
+ */
+struct tipc_media_addr {
+        __be32  type;                   /* bearer type (network byte order) */
+        union {
+                __u8   eth_addr[6];     /* 48 bit Ethernet addr (byte array) */
+        } dev_addr;
+};
+
+/**
+ * struct tipc_bearer - TIPC bearer info available to media code
+ * @usr_handle: pointer to additional media-specific information about bearer
+ * @mtu: max packet size bearer can support
+ * @blocked: non-zero if bearer is blocked
+ * @lock: spinlock for controlling access to bearer
+ * @addr: media-specific address associated with bearer
+ * @name: bearer name (format = media:interface)
+ *
+ * Note: TIPC initializes "name" and "lock" fields; media code is responsible
+ * for initialization all other fields when a bearer is enabled.
+ */
+struct tipc_bearer {
+        void *usr_handle;
+        u32 mtu;
+        int blocked;
+        spinlock_t lock;
+        struct tipc_media_addr addr;
+        char name[TIPC_MAX_BEARER_NAME];
+};
 
 /**
  * struct media - TIPC media information available to internal users
@@ -55,7 +93,7 @@
  * @priority: default link (and bearer) priority
  * @tolerance: default time (in ms) before declaring link failure
  * @window: default window (in packets) before declaring link congestion
- * @type_id: TIPC media identifier [defined in tipc_bearer.h]
+ * @type_id: TIPC media identifier
  * @name: media name
  */
 
@@ -116,6 +154,34 @@ struct link;
 
 extern struct bearer tipc_bearers[];
 
+/*
+ * TIPC routines available to supported media types
+ */
+int tipc_register_media(u32 media_type,
+                 char *media_name, int (*enable)(struct tipc_bearer *),
+                 void (*disable)(struct tipc_bearer *),
+                 int (*send_msg)(struct sk_buff *,
+                        struct tipc_bearer *, struct tipc_media_addr *),
+                 char *(*addr2str)(struct tipc_media_addr *a,
+                        char *str_buf, int str_size),
+                 struct tipc_media_addr *bcast_addr, const u32 bearer_priority,
+                 const u32 link_tolerance,  /* [ms] */
+                 const u32 send_window_limit);
+
+void tipc_recv_msg(struct sk_buff *buf, struct tipc_bearer *tb_ptr);
+
+int  tipc_block_bearer(const char *name);
+void tipc_continue(struct tipc_bearer *tb_ptr);
+
+int tipc_enable_bearer(const char *bearer_name, u32 bcast_scope, u32 priority);
+int tipc_disable_bearer(const char *name);
+
+/*
+ * Routines made available to TIPC by supported media types
+ */
+int  tipc_eth_media_start(void);
+void tipc_eth_media_stop(void);
+
 void tipc_media_addr_printf(struct print_buf *pb, struct tipc_media_addr *a);
 struct sk_buff *tipc_media_get_names(void);
 
@@ -126,7 +192,6 @@ void tipc_bearer_schedule(struct bearer *b_ptr, struct link *l_ptr);
 struct bearer *tipc_bearer_find_interface(const char *if_name);
 int tipc_bearer_resolve_congestion(struct bearer *b_ptr, struct link *l_ptr);
 int tipc_bearer_congested(struct bearer *b_ptr, struct link *l_ptr);
-int tipc_bearer_init(void);
 void tipc_bearer_stop(void);
 void tipc_bearer_lock_push(struct bearer *b_ptr);
 
diff --git a/net/tipc/cluster.c b/net/tipc/cluster.c
index 7fea14b98b9..405be87157b 100644
--- a/net/tipc/cluster.c
+++ b/net/tipc/cluster.c
@@ -36,17 +36,10 @@
 
 #include "core.h"
 #include "cluster.h"
-#include "addr.h"
-#include "node_subscr.h"
 #include "link.h"
-#include "node.h"
-#include "net.h"
-#include "msg.h"
-#include "bearer.h"
 
 static void tipc_cltr_multicast(struct cluster *c_ptr, struct sk_buff *buf,
                                 u32 lower, u32 upper);
-static struct sk_buff *tipc_cltr_prepare_routing_msg(u32 data_size, u32 dest);
 
 struct tipc_node **tipc_local_nodes = NULL;
 struct tipc_node_map tipc_cltr_bcast_nodes = {0,{0,}};
diff --git a/net/tipc/config.c b/net/tipc/config.c
index 50a6133a366..bdde39f0436 100644
--- a/net/tipc/config.c
+++ b/net/tipc/config.c
@@ -35,23 +35,11 @@
  */
 
 #include "core.h"
-#include "dbg.h"
-#include "bearer.h"
 #include "port.h"
 #include "link.h"
-#include "zone.h"
-#include "addr.h"
 #include "name_table.h"
-#include "node.h"
+#include "user_reg.h"
 #include "config.h"
-#include "discover.h"
-
-struct subscr_data {
-        char usr_handle[8];
-        u32 domain;
-        u32 port_ref;
-        struct list_head subd_list;
-};
 
 struct manager {
         u32 user_ref;
@@ -572,7 +560,7 @@ int tipc_cfg_init(void)
         struct tipc_name_seq seq;
         int res;
 
-        res = tipc_attach(&mng.user_ref, NULL, NULL);
+        res = tipc_attach(&mng.user_ref);
         if (res)
                 goto failed;
 
diff --git a/net/tipc/config.h b/net/tipc/config.h
index 481e12ece71..443159a166f 100644
--- a/net/tipc/config.h
+++ b/net/tipc/config.h
@@ -39,7 +39,6 @@
 
 /* ---------------------------------------------------------------------- */
 
-#include "core.h"
 #include "link.h"
 
 struct sk_buff *tipc_cfg_reply_alloc(int payload_size);
diff --git a/net/tipc/core.c b/net/tipc/core.c
index e2a09eb8efd..f5d62c174de 100644
--- a/net/tipc/core.c
+++ b/net/tipc/core.c
@@ -40,7 +40,6 @@
 #include <linux/random.h>
 
 #include "core.h"
-#include "dbg.h"
 #include "ref.h"
 #include "net.h"
 #include "user_reg.h"
@@ -236,43 +235,3 @@ module_exit(tipc_exit);
 MODULE_DESCRIPTION("TIPC: Transparent Inter Process Communication");
 MODULE_LICENSE("Dual BSD/GPL");
 MODULE_VERSION(TIPC_MOD_VER);
-
-/* Native TIPC API for kernel-space applications (see tipc.h) */
-
-EXPORT_SYMBOL(tipc_attach);
-EXPORT_SYMBOL(tipc_detach);
-EXPORT_SYMBOL(tipc_createport);
-EXPORT_SYMBOL(tipc_deleteport);
-EXPORT_SYMBOL(tipc_ownidentity);
-EXPORT_SYMBOL(tipc_portimportance);
-EXPORT_SYMBOL(tipc_set_portimportance);
-EXPORT_SYMBOL(tipc_portunreliable);
-EXPORT_SYMBOL(tipc_set_portunreliable);
-EXPORT_SYMBOL(tipc_portunreturnable);
-EXPORT_SYMBOL(tipc_set_portunreturnable);
-EXPORT_SYMBOL(tipc_publish);
-EXPORT_SYMBOL(tipc_withdraw);
-EXPORT_SYMBOL(tipc_connect2port);
-EXPORT_SYMBOL(tipc_disconnect);
-EXPORT_SYMBOL(tipc_shutdown);
-EXPORT_SYMBOL(tipc_send);
-EXPORT_SYMBOL(tipc_send2name);
-EXPORT_SYMBOL(tipc_send2port);
-EXPORT_SYMBOL(tipc_multicast);
-
-/* TIPC API for external bearers (see tipc_bearer.h) */
-
-EXPORT_SYMBOL(tipc_block_bearer);
-EXPORT_SYMBOL(tipc_continue);
-EXPORT_SYMBOL(tipc_disable_bearer);
-EXPORT_SYMBOL(tipc_enable_bearer);
-EXPORT_SYMBOL(tipc_recv_msg);
-EXPORT_SYMBOL(tipc_register_media);
-
-/* TIPC API for external APIs (see tipc_port.h) */
-
-EXPORT_SYMBOL(tipc_createport_raw);
-EXPORT_SYMBOL(tipc_reject_msg);
-EXPORT_SYMBOL(tipc_send_buf_fast);
-EXPORT_SYMBOL(tipc_acknowledge);
-
diff --git a/net/tipc/core.h b/net/tipc/core.h
index e19389e5722..ca7e171c104 100644
--- a/net/tipc/core.h
+++ b/net/tipc/core.h
@@ -39,10 +39,6 @@
 
 #include <linux/tipc.h>
 #include <linux/tipc_config.h>
-#include <net/tipc/tipc_msg.h>
-#include <net/tipc/tipc_port.h>
-#include <net/tipc/tipc_bearer.h>
-#include <net/tipc/tipc.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/errno.h>
@@ -62,6 +58,9 @@
 
 #define TIPC_MOD_VER "2.0.0"
 
+struct tipc_msg;        /* msg.h */
+struct print_buf;       /* dbg.h */
+
 /*
  * TIPC sanity test macros
  */
@@ -174,6 +173,13 @@ void tipc_dump_dbg(struct print_buf *, const char *fmt, ...);
 #define ELINKCONG EAGAIN        /* link congestion <=> resource unavailable */
 
 /*
+ * TIPC operating mode routines
+ */
+#define TIPC_NOT_RUNNING  0
+#define TIPC_NODE_MODE    1
+#define TIPC_NET_MODE     2
+
+/*
  * Global configuration variables
  */
 
diff --git a/net/tipc/discover.c b/net/tipc/discover.c
index 4a7cd3719b7..f2ce36baf42 100644
--- a/net/tipc/discover.c
+++ b/net/tipc/discover.c
@@ -35,9 +35,7 @@
  */
 
 #include "core.h"
-#include "dbg.h"
 #include "link.h"
-#include "zone.h"
 #include "discover.h"
 #include "port.h"
 #include "name_table.h"
diff --git a/net/tipc/discover.h b/net/tipc/discover.h
index f8e75063612..d2c3cffb79f 100644
--- a/net/tipc/discover.h
+++ b/net/tipc/discover.h
@@ -37,8 +37,6 @@
 #ifndef _TIPC_DISCOVER_H
 #define _TIPC_DISCOVER_H
 
-#include "core.h"
-
 struct link_req;
 
 struct link_req *tipc_disc_init_link_req(struct bearer *b_ptr,
diff --git a/net/tipc/eth_media.c b/net/tipc/eth_media.c
index 6e988ba485f..ee683cc8f4b 100644
--- a/net/tipc/eth_media.c
+++ b/net/tipc/eth_media.c
@@ -34,13 +34,13 @@
  * POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include <net/tipc/tipc.h>
-#include <net/tipc/tipc_bearer.h>
-#include <net/tipc/tipc_msg.h>
 #include <linux/netdevice.h>
 #include <linux/slab.h>
 #include <net/net_namespace.h>
 
+#include "core.h"
+#include "bearer.h"
+
 #define MAX_ETH_BEARERS         2
 #define ETH_LINK_PRIORITY       TIPC_DEF_LINK_PRI
 #define ETH_LINK_TOLERANCE      TIPC_DEF_LINK_TOL
diff --git a/net/tipc/link.c b/net/tipc/link.c
index b31992ccd5d..cf414cf05e7 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -35,19 +35,11 @@
  */
 
 #include "core.h"
-#include "dbg.h"
 #include "link.h"
-#include "net.h"
-#include "node.h"
 #include "port.h"
-#include "addr.h"
-#include "node_subscr.h"
 #include "name_distr.h"
-#include "bearer.h"
-#include "name_table.h"
 #include "discover.h"
 #include "config.h"
-#include "bcast.h"
 
 
 /*
@@ -57,12 +49,6 @@
 #define INVALID_SESSION 0x10000
 
 /*
- * Limit for deferred reception queue:
- */
-
-#define DEF_QUEUE_LIMIT 256u
-
-/*
  * Link state events:
  */
 
diff --git a/net/tipc/link.h b/net/tipc/link.h
index f98bc613de6..c562888d25d 100644
--- a/net/tipc/link.h
+++ b/net/tipc/link.h
@@ -39,7 +39,6 @@
 
 #include "dbg.h"
 #include "msg.h"
-#include "bearer.h"
 #include "node.h"
 
 #define PUSH_FAILED   1
diff --git a/net/tipc/msg.c b/net/tipc/msg.c
index ecb532fb035..ee6b4c68d4a 100644
--- a/net/tipc/msg.c
+++ b/net/tipc/msg.c
@@ -36,9 +36,7 @@
 
 #include "core.h"
 #include "addr.h"
-#include "dbg.h"
 #include "msg.h"
-#include "bearer.h"
 
 u32 tipc_msg_tot_importance(struct tipc_msg *m)
 {
diff --git a/net/tipc/msg.h b/net/tipc/msg.h
index 031aad18efc..aee53864d7a 100644
--- a/net/tipc/msg.h
+++ b/net/tipc/msg.h
@@ -37,10 +37,51 @@
 #ifndef _TIPC_MSG_H
 #define _TIPC_MSG_H
 
-#include "core.h"
+#include "bearer.h"
 
 #define TIPC_VERSION              2
 
+/*
+ *              TIPC user data message header format, version 2:
+ *
+ *
+ *     1 0 9 8 7 6 5 4|3 2 1 0 9 8 7 6|5 4 3 2 1 0 9 8|7 6 5 4 3 2 1 0
+ *    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * w0:|vers | user  |hdr sz |n|d|s|-|          message size           |
+ *    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * w1:|mstyp| error |rer cnt|lsc|opt p|      broadcast ack no         |
+ *    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * w2:|        link level ack no      |   broadcast/link level seq no |
+ *    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * w3:|                       previous node                           |
+ *    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * w4:|                      originating port                         |
+ *    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * w5:|                      destination port                         |
+ *    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * w6:|                      originating node                         |
+ *    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * w7:|                      destination node                         |
+ *    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * w8:|            name type / transport sequence number              |
+ *    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * w9:|              name instance/multicast lower bound              |
+ *    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * wA:|                    multicast upper bound                      |
+ *    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ *    /                                                               /
+ *    \                           options                             \
+ *    /                                                               /
+ *    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ *
+ */
+
+#define TIPC_CONN_MSG           0
+#define TIPC_MCAST_MSG          1
+#define TIPC_NAMED_MSG          2
+#define TIPC_DIRECT_MSG         3
+
+
 #define SHORT_H_SIZE              24    /* Connected, in-cluster messages */
 #define DIR_MSG_H_SIZE            32    /* Directly addressed messages */
 #define LONG_H_SIZE               40    /* Named messages */
@@ -52,20 +93,26 @@
 #define MAX_MSG_SIZE (MAX_H_SIZE + TIPC_MAX_USER_MSG_SIZE)
 
 
-/*
-                TIPC user data message header format, version 2
+struct tipc_msg {
+        __be32 hdr[15];
+};
 
-        - Fundamental definitions available to privileged TIPC users
-          are located in tipc_msg.h.
-        - Remaining definitions available to TIPC internal users appear below.
-*/
 
+static inline u32 msg_word(struct tipc_msg *m, u32 pos)
+{
+        return ntohl(m->hdr[pos]);
+}
 
 static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val)
 {
         m->hdr[w] = htonl(val);
 }
 
+static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask)
+{
+        return (msg_word(m, w) >> pos) & mask;
+}
+
 static inline void msg_set_bits(struct tipc_msg *m, u32 w,
                                 u32 pos, u32 mask, u32 val)
 {
@@ -112,16 +159,36 @@ static inline void msg_set_user(struct tipc_msg *m, u32 n)
         msg_set_bits(m, 0, 25, 0xf, n);
 }
 
+static inline u32 msg_importance(struct tipc_msg *m)
+{
+        return msg_bits(m, 0, 25, 0xf);
+}
+
 static inline void msg_set_importance(struct tipc_msg *m, u32 i)
 {
         msg_set_user(m, i);
 }
 
+static inline u32 msg_hdr_sz(struct tipc_msg *m)
+{
+        return msg_bits(m, 0, 21, 0xf) << 2;
+}
+
 static inline void msg_set_hdr_sz(struct tipc_msg *m,u32 n)
 {
         msg_set_bits(m, 0, 21, 0xf, n>>2);
 }
 
+static inline u32 msg_size(struct tipc_msg *m)
+{
+        return msg_bits(m, 0, 0, 0x1ffff);
+}
+
+static inline u32 msg_data_sz(struct tipc_msg *m)
+{
+        return msg_size(m) - msg_hdr_sz(m);
+}
+
 static inline int msg_non_seq(struct tipc_msg *m)
 {
         return msg_bits(m, 0, 20, 1);
@@ -162,11 +229,36 @@ static inline void msg_set_size(struct tipc_msg *m, u32 sz)
  * Word 1
  */
 
+static inline u32 msg_type(struct tipc_msg *m)
+{
+        return msg_bits(m, 1, 29, 0x7);
+}
+
 static inline void msg_set_type(struct tipc_msg *m, u32 n)
 {
         msg_set_bits(m, 1, 29, 0x7, n);
 }
 
+static inline u32 msg_named(struct tipc_msg *m)
+{
+        return msg_type(m) == TIPC_NAMED_MSG;
+}
+
+static inline u32 msg_mcast(struct tipc_msg *m)
+{
+        return msg_type(m) == TIPC_MCAST_MSG;
+}
+
+static inline u32 msg_connected(struct tipc_msg *m)
+{
+        return msg_type(m) == TIPC_CONN_MSG;
+}
+
+static inline u32 msg_errcode(struct tipc_msg *m)
+{
+        return msg_bits(m, 1, 25, 0xf);
+}
+
 static inline void msg_set_errcode(struct tipc_msg *m, u32 err)
 {
         msg_set_bits(m, 1, 25, 0xf, err);
@@ -257,31 +349,68 @@ static inline void msg_set_destnode_cache(struct tipc_msg *m, u32 dnode)
  */
 
 
+static inline u32 msg_prevnode(struct tipc_msg *m)
+{
+        return msg_word(m, 3);
+}
+
 static inline void msg_set_prevnode(struct tipc_msg *m, u32 a)
 {
         msg_set_word(m, 3, a);
 }
 
+static inline u32 msg_origport(struct tipc_msg *m)
+{
+        return msg_word(m, 4);
+}
+
 static inline void msg_set_origport(struct tipc_msg *m, u32 p)
 {
         msg_set_word(m, 4, p);
 }
 
+static inline u32 msg_destport(struct tipc_msg *m)
+{
+        return msg_word(m, 5);
+}
+
 static inline void msg_set_destport(struct tipc_msg *m, u32 p)
 {
         msg_set_word(m, 5, p);
 }
 
+static inline u32 msg_mc_netid(struct tipc_msg *m)
+{
+        return msg_word(m, 5);
+}
+
 static inline void msg_set_mc_netid(struct tipc_msg *m, u32 p)
 {
         msg_set_word(m, 5, p);
 }
 
+static inline int msg_short(struct tipc_msg *m)
+{
+        return msg_hdr_sz(m) == 24;
+}
+
+static inline u32 msg_orignode(struct tipc_msg *m)
+{
+        if (likely(msg_short(m)))
+                return msg_prevnode(m);
+        return msg_word(m, 6);
+}
+
 static inline void msg_set_orignode(struct tipc_msg *m, u32 a)
 {
         msg_set_word(m, 6, a);
 }
 
+static inline u32 msg_destnode(struct tipc_msg *m)
+{
+        return msg_word(m, 7);
+}
+
 static inline void msg_set_destnode(struct tipc_msg *m, u32 a)
 {
         msg_set_word(m, 7, a);
@@ -299,6 +428,11 @@ static inline u32 msg_routed(struct tipc_msg *m)
         return(msg_destnode(m) ^ msg_orignode(m)) >> 11;
 }
 
+static inline u32 msg_nametype(struct tipc_msg *m)
+{
+        return msg_word(m, 8);
+}
+
 static inline void msg_set_nametype(struct tipc_msg *m, u32 n)
 {
         msg_set_word(m, 8, n);
@@ -324,6 +458,16 @@ static inline void msg_set_transp_seqno(struct tipc_msg *m, u32 n)
         msg_set_word(m, 8, n);
 }
 
+static inline u32 msg_nameinst(struct tipc_msg *m)
+{
+        return msg_word(m, 9);
+}
+
+static inline u32 msg_namelower(struct tipc_msg *m)
+{
+        return msg_nameinst(m);
+}
+
 static inline void msg_set_namelower(struct tipc_msg *m, u32 n)
 {
         msg_set_word(m, 9, n);
@@ -334,11 +478,21 @@ static inline void msg_set_nameinst(struct tipc_msg *m, u32 n)
         msg_set_namelower(m, n);
 }
 
+static inline u32 msg_nameupper(struct tipc_msg *m)
+{
+        return msg_word(m, 10);
+}
+
 static inline void msg_set_nameupper(struct tipc_msg *m, u32 n)
 {
         msg_set_word(m, 10, n);
 }
 
+static inline unchar *msg_data(struct tipc_msg *m)
+{
+        return ((unchar *)m) + msg_hdr_sz(m);
+}
+
 static inline struct tipc_msg *msg_get_wrapped(struct tipc_msg *m)
 {
         return (struct tipc_msg *)msg_data(m);
diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c
index 7b907171f87..10ff48be3c0 100644
--- a/net/tipc/name_distr.c
+++ b/net/tipc/name_distr.c
@@ -36,9 +36,7 @@
 
 #include "core.h"
 #include "cluster.h"
-#include "dbg.h"
 #include "link.h"
-#include "msg.h"
 #include "name_distr.h"
 
 #define ITEM_SIZE sizeof(struct distr_item)
diff --git a/net/tipc/name_table.c b/net/tipc/name_table.c
index 3a8de4334da..d5adb045674 100644
--- a/net/tipc/name_table.c
+++ b/net/tipc/name_table.c
@@ -36,15 +36,10 @@
 
 #include "core.h"
 #include "config.h"
-#include "dbg.h"
 #include "name_table.h"
 #include "name_distr.h"
-#include "addr.h"
-#include "node_subscr.h"
 #include "subscr.h"
 #include "port.h"
-#include "cluster.h"
-#include "bcast.h"
 
 static int tipc_nametbl_size = 1024;            /* must be a power of 2 */
 
diff --git a/net/tipc/net.c b/net/tipc/net.c
index 1a621cfd660..c2b4b86c2e6 100644
--- a/net/tipc/net.c
+++ b/net/tipc/net.c
@@ -35,18 +35,13 @@
  */
 
 #include "core.h"
-#include "bearer.h"
 #include "net.h"
 #include "zone.h"
-#include "addr.h"
 #include "name_table.h"
 #include "name_distr.h"
 #include "subscr.h"
 #include "link.h"
-#include "msg.h"
 #include "port.h"
-#include "bcast.h"
-#include "discover.h"
 #include "config.h"
 
 /*
diff --git a/net/tipc/node.c b/net/tipc/node.c
index b4d87eb2dc5..df71dfc3a9a 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -37,16 +37,9 @@
 #include "core.h"
 #include "config.h"
 #include "node.h"
-#include "cluster.h"
-#include "net.h"
-#include "addr.h"
-#include "node_subscr.h"
-#include "link.h"
 #include "port.h"
-#include "bearer.h"
 #include "name_distr.h"
 
-void node_print(struct print_buf *buf, struct tipc_node *n_ptr, char *str);
 static void node_lost_contact(struct tipc_node *n_ptr);
 static void node_established_contact(struct tipc_node *n_ptr);
 
diff --git a/net/tipc/node_subscr.c b/net/tipc/node_subscr.c
index 19194d476a9..018a55332d9 100644
--- a/net/tipc/node_subscr.c
+++ b/net/tipc/node_subscr.c
@@ -35,10 +35,8 @@
  */
 
 #include "core.h"
-#include "dbg.h"
 #include "node_subscr.h"
 #include "node.h"
-#include "addr.h"
 
 /**
  * tipc_nodesub_subscribe - create "node down" subscription for specified node
diff --git a/net/tipc/port.c b/net/tipc/port.c
index 82092eaa153..7873283f496 100644
--- a/net/tipc/port.c
+++ b/net/tipc/port.c
@@ -36,15 +36,9 @@
 
 #include "core.h"
 #include "config.h"
-#include "dbg.h"
 #include "port.h"
-#include "addr.h"
-#include "link.h"
-#include "node.h"
 #include "name_table.h"
 #include "user_reg.h"
-#include "msg.h"
-#include "bcast.h"
 
 /* Connection management: */
 #define PROBING_INTERVAL 3600000        /* [ms] => 1 h */
@@ -94,7 +88,7 @@ static void port_incr_out_seqno(struct port *p_ptr)
  * tipc_multicast - send a multicast message to local and remote destinations
  */
 
-int tipc_multicast(u32 ref, struct tipc_name_seq const *seq, u32 domain,
+int tipc_multicast(u32 ref, struct tipc_name_seq const *seq,
                    u32 num_sect, struct iovec const *msg_sect)
 {
         struct tipc_msg *hdr;
@@ -989,13 +983,6 @@ int tipc_createport(u32 user_ref,
         return 0;
 }
 
-int tipc_ownidentity(u32 ref, struct tipc_portid *id)
-{
-        id->ref = ref;
-        id->node = tipc_own_addr;
-        return 0;
-}
-
 int tipc_portimportance(u32 ref, unsigned int *importance)
 {
         struct port *p_ptr;
@@ -1271,16 +1258,11 @@ int tipc_send(u32 ref, unsigned int num_sect, struct iovec const *msg_sect)
 }
 
 /**
- * tipc_forward2name - forward message sections to port name
+ * tipc_send2name - send message sections to port name
  */
 
-static int tipc_forward2name(u32 ref,
-                             struct tipc_name const *name,
-                             u32 domain,
-                             u32 num_sect,
-                             struct iovec const *msg_sect,
-                             struct tipc_portid const *orig,
-                             unsigned int importance)
+int tipc_send2name(u32 ref, struct tipc_name const *name, unsigned int domain,
+           unsigned int num_sect, struct iovec const *msg_sect)
 {
         struct port *p_ptr;
         struct tipc_msg *msg;
@@ -1294,14 +1276,12 @@ static int tipc_forward2name(u32 ref,
 
         msg = &p_ptr->publ.phdr;
         msg_set_type(msg, TIPC_NAMED_MSG);
-        msg_set_orignode(msg, orig->node);
-        msg_set_origport(msg, orig->ref);
+        msg_set_orignode(msg, tipc_own_addr);
+        msg_set_origport(msg, ref);
         msg_set_hdr_sz(msg, LONG_H_SIZE);
         msg_set_nametype(msg, name->type);
         msg_set_nameinst(msg, name->instance);
         msg_set_lookup_scope(msg, tipc_addr_scope(domain));
-        if (importance <= TIPC_CRITICAL_IMPORTANCE)
-                msg_set_importance(msg,importance);
         destport = tipc_nametbl_translate(name->type, name->instance, &destnode);
         msg_set_destnode(msg, destnode);
         msg_set_destport(msg, destport);
@@ -1325,33 +1305,11 @@ static int tipc_forward2name(u32 ref,
 }
 
 /**
- * tipc_send2name - send message sections to port name
- */
-
-int tipc_send2name(u32 ref,
-                   struct tipc_name const *name,
-                   unsigned int domain,
-                   unsigned int num_sect,
-                   struct iovec const *msg_sect)
-{
-        struct tipc_portid orig;
-
-        orig.ref = ref;
-        orig.node = tipc_own_addr;
-        return tipc_forward2name(ref, name, domain, num_sect, msg_sect, &orig,
-                                 TIPC_PORT_IMPORTANCE);
-}
-
-/**
- * tipc_forward2port - forward message sections to port identity
+ * tipc_send2port - send message sections to port identity
  */
 
-static int tipc_forward2port(u32 ref,
-                             struct tipc_portid const *dest,
-                             unsigned int num_sect,
-                             struct iovec const *msg_sect,
-                             struct tipc_portid const *orig,
-                             unsigned int importance)
+int tipc_send2port(u32 ref, struct tipc_portid const *dest,
+           unsigned int num_sect, struct iovec const *msg_sect)
 {
         struct port *p_ptr;
         struct tipc_msg *msg;
@@ -1363,13 +1321,11 @@ static int tipc_forward2port(u32 ref,
 
         msg = &p_ptr->publ.phdr;
         msg_set_type(msg, TIPC_DIRECT_MSG);
-        msg_set_orignode(msg, orig->node);
-        msg_set_origport(msg, orig->ref);
+        msg_set_orignode(msg, tipc_own_addr);
+        msg_set_origport(msg, ref);
         msg_set_destnode(msg, dest->node);
         msg_set_destport(msg, dest->ref);
         msg_set_hdr_sz(msg, DIR_MSG_H_SIZE);
-        if (importance <= TIPC_CRITICAL_IMPORTANCE)
-                msg_set_importance(msg, importance);
         p_ptr->sent++;
         if (dest->node == tipc_own_addr)
                 return tipc_port_recv_sections(p_ptr, num_sect, msg_sect);
@@ -1384,31 +1340,11 @@ static int tipc_forward2port(u32 ref,
 }
 
 /**
- * tipc_send2port - send message sections to port identity
+ * tipc_send_buf2port - send message buffer to port identity
  */
 
-int tipc_send2port(u32 ref,
-                   struct tipc_portid const *dest,
-                   unsigned int num_sect,
-                   struct iovec const *msg_sect)
-{
-        struct tipc_portid orig;
-
-        orig.ref = ref;
-        orig.node = tipc_own_addr;
-        return tipc_forward2port(ref, dest, num_sect, msg_sect, &orig,
-                                 TIPC_PORT_IMPORTANCE);
-}
-
-/**
- * tipc_forward_buf2port - forward message buffer to port identity
- */
-static int tipc_forward_buf2port(u32 ref,
-                                 struct tipc_portid const *dest,
-                                 struct sk_buff *buf,
-                                 unsigned int dsz,
-                                 struct tipc_portid const *orig,
-                                 unsigned int importance)
+int tipc_send_buf2port(u32 ref, struct tipc_portid const *dest,
+               struct sk_buff *buf, unsigned int dsz)
 {
         struct port *p_ptr;
         struct tipc_msg *msg;
@@ -1420,13 +1356,11 @@ static int tipc_forward_buf2port(u32 ref,
 
         msg = &p_ptr->publ.phdr;
         msg_set_type(msg, TIPC_DIRECT_MSG);
-        msg_set_orignode(msg, orig->node);
-        msg_set_origport(msg, orig->ref);
+        msg_set_orignode(msg, tipc_own_addr);
+        msg_set_origport(msg, ref);
         msg_set_destnode(msg, dest->node);
         msg_set_destport(msg, dest->ref);
         msg_set_hdr_sz(msg, DIR_MSG_H_SIZE);
-        if (importance <= TIPC_CRITICAL_IMPORTANCE)
-                msg_set_importance(msg, importance);
         msg_set_size(msg, DIR_MSG_H_SIZE + dsz);
         if (skb_cow(buf, DIR_MSG_H_SIZE))
                 return -ENOMEM;
@@ -1445,20 +1379,3 @@ static int tipc_forward_buf2port(u32 ref,
         return -ELINKCONG;
 }
 
-/**
- * tipc_send_buf2port - send message buffer to port identity
- */
-
-int tipc_send_buf2port(u32 ref,
-                       struct tipc_portid const *dest,
-                       struct sk_buff *buf,
-                       unsigned int dsz)
-{
-        struct tipc_portid orig;
-
-        orig.ref = ref;
-        orig.node = tipc_own_addr;
-        return tipc_forward_buf2port(ref, dest, buf, dsz, &orig,
-                                     TIPC_PORT_IMPORTANCE);
-}
-
diff --git a/net/tipc/port.h b/net/tipc/port.h
index 73bbf442b34..3a807fcec2b 100644
--- a/net/tipc/port.h
+++ b/net/tipc/port.h
@@ -37,13 +37,44 @@
 #ifndef _TIPC_PORT_H
 #define _TIPC_PORT_H
 
-#include "core.h"
 #include "ref.h"
 #include "net.h"
 #include "msg.h"
-#include "dbg.h"
 #include "node_subscr.h"
 
+#define TIPC_FLOW_CONTROL_WIN 512
+
+typedef void (*tipc_msg_err_event) (void *usr_handle, u32 portref,
+                struct sk_buff **buf, unsigned char const *data,
+                unsigned int size, int reason,
+                struct tipc_portid const *attmpt_destid);
+
+typedef void (*tipc_named_msg_err_event) (void *usr_handle, u32 portref,
+                struct sk_buff **buf, unsigned char const *data,
+                unsigned int size, int reason,
+                struct tipc_name_seq const *attmpt_dest);
+
+typedef void (*tipc_conn_shutdown_event) (void *usr_handle, u32 portref,
+                struct sk_buff **buf, unsigned char const *data,
+                unsigned int size, int reason);
+
+typedef void (*tipc_msg_event) (void *usr_handle, u32 portref,
+                struct sk_buff **buf, unsigned char const *data,
+                unsigned int size, unsigned int importance,
+                struct tipc_portid const *origin);
+
+typedef void (*tipc_named_msg_event) (void *usr_handle, u32 portref,
+                struct sk_buff **buf, unsigned char const *data,
+                unsigned int size, unsigned int importance,
+                struct tipc_portid const *orig,
+                struct tipc_name_seq const *dest);
+
+typedef void (*tipc_conn_msg_event) (void *usr_handle, u32 portref,
+                struct sk_buff **buf, unsigned char const *data,
+                unsigned int size);
+
+typedef void (*tipc_continue_event) (void *usr_handle, u32 portref);
+
 /**
  * struct user_port - TIPC user port (used with native API)
  * @user_ref: id of user who created user port
@@ -68,6 +99,34 @@ struct user_port {
 };
 
 /**
+ * struct tipc_port - TIPC port info available to socket API
+ * @usr_handle: pointer to additional user-defined information about port
+ * @lock: pointer to spinlock for controlling access to port
+ * @connected: non-zero if port is currently connected to a peer port
+ * @conn_type: TIPC type used when connection was established
+ * @conn_instance: TIPC instance used when connection was established
+ * @conn_unacked: number of unacknowledged messages received from peer port
+ * @published: non-zero if port has one or more associated names
+ * @congested: non-zero if cannot send because of link or port congestion
+ * @max_pkt: maximum packet size "hint" used when building messages sent by port
+ * @ref: unique reference to port in TIPC object registry
+ * @phdr: preformatted message header used when sending messages
+ */
+struct tipc_port {
+        void *usr_handle;
+        spinlock_t *lock;
+        int connected;
+        u32 conn_type;
+        u32 conn_instance;
+        u32 conn_unacked;
+        int published;
+        u32 congested;
+        u32 max_pkt;
+        u32 ref;
+        struct tipc_msg phdr;
+};
+
+/**
  * struct port - TIPC port structure
  * @publ: TIPC port info available to privileged users
  * @port_list: adjacent ports in TIPC's global list of ports
@@ -109,11 +168,76 @@ struct port {
 extern spinlock_t tipc_port_list_lock;
 struct port_list;
 
+/*
+ * TIPC port manipulation routines
+ */
+struct tipc_port *tipc_createport_raw(void *usr_handle,
+                u32 (*dispatcher)(struct tipc_port *, struct sk_buff *),
+                void (*wakeup)(struct tipc_port *), const u32 importance);
+
+int tipc_reject_msg(struct sk_buff *buf, u32 err);
+
+int tipc_send_buf_fast(struct sk_buff *buf, u32 destnode);
+
+void tipc_acknowledge(u32 port_ref, u32 ack);
+
+int tipc_createport(unsigned int tipc_user, void *usr_handle,
+                unsigned int importance, tipc_msg_err_event error_cb,
+                tipc_named_msg_err_event named_error_cb,
+                tipc_conn_shutdown_event conn_error_cb, tipc_msg_event msg_cb,
+                tipc_named_msg_event named_msg_cb,
+                tipc_conn_msg_event conn_msg_cb,
+                tipc_continue_event continue_event_cb, u32 *portref);
+
+int tipc_deleteport(u32 portref);
+
+int tipc_portimportance(u32 portref, unsigned int *importance);
+int tipc_set_portimportance(u32 portref, unsigned int importance);
+
+int tipc_portunreliable(u32 portref, unsigned int *isunreliable);
+int tipc_set_portunreliable(u32 portref, unsigned int isunreliable);
+
+int tipc_portunreturnable(u32 portref, unsigned int *isunreturnable);
+int tipc_set_portunreturnable(u32 portref, unsigned int isunreturnable);
+
+int tipc_publish(u32 portref, unsigned int scope,
+                struct tipc_name_seq const *name_seq);
+int tipc_withdraw(u32 portref, unsigned int scope,
+                struct tipc_name_seq const *name_seq);
+
+int tipc_connect2port(u32 portref, struct tipc_portid const *port);
+
+int tipc_disconnect(u32 portref);
+
+int tipc_shutdown(u32 ref);
+
+
+/*
+ * The following routines require that the port be locked on entry
+ */
+int tipc_disconnect_port(struct tipc_port *tp_ptr);
+
+/*
+ * TIPC messaging routines
+ */
+int tipc_send(u32 portref, unsigned int num_sect, struct iovec const *msg_sect);
+
+int tipc_send2name(u32 portref, struct tipc_name const *name, u32 domain,
+                unsigned int num_sect, struct iovec const *msg_sect);
+
+int tipc_send2port(u32 portref, struct tipc_portid const *dest,
+                unsigned int num_sect, struct iovec const *msg_sect);
+
+int tipc_send_buf2port(u32 portref, struct tipc_portid const *dest,
+                struct sk_buff *buf, unsigned int dsz);
+
+int tipc_multicast(u32 portref, struct tipc_name_seq const *seq,
+                unsigned int section_count, struct iovec const *msg);
+
 int tipc_port_reject_sections(struct port *p_ptr, struct tipc_msg *hdr,
                               struct iovec const *msg_sect, u32 num_sect,
                               int err);
 struct sk_buff *tipc_port_get_ports(void);
-struct sk_buff *port_show_stats(const void *req_tlv_area, int req_tlv_space);
 void tipc_port_recv_proto_msg(struct sk_buff *buf);
 void tipc_port_recv_mcast(struct sk_buff *buf, struct port_list *dp);
 void tipc_port_reinit(void);
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index e9f0d500448..cd0bb77f267 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -49,10 +49,9 @@
 
 #include <linux/tipc.h>
 #include <linux/tipc_config.h>
-#include <net/tipc/tipc_msg.h>
-#include <net/tipc/tipc_port.h>
 
 #include "core.h"
+#include "port.h"
 
 #define SS_LISTENING    -1      /* socket is listening */
 #define SS_READY        -2      /* socket is connectionless */
@@ -404,7 +403,8 @@ static int get_name(struct socket *sock, struct sockaddr *uaddr,
                 addr->addr.id.ref = tsock->peer_name.ref;
                 addr->addr.id.node = tsock->peer_name.node;
         } else {
-                tipc_ownidentity(tsock->p->ref, &addr->addr.id);
+                addr->addr.id.ref = tsock->p->ref;
+                addr->addr.id.node = tipc_own_addr;
         }
 
         *uaddr_len = sizeof(*addr);
@@ -597,7 +597,6 @@ static int send_msg(struct kiocb *iocb, struct socket *sock,
                                 break;
                         res = tipc_multicast(tport->ref,
                                              &dest->addr.nameseq,
-                                             0,
                                              m->msg_iovlen,
                                              m->msg_iov);
                 }
diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c
index 33313961d01..23f43d03980 100644
--- a/net/tipc/subscr.c
+++ b/net/tipc/subscr.c
@@ -35,10 +35,8 @@
  */
 
 #include "core.h"
-#include "dbg.h"
 #include "name_table.h"
-#include "port.h"
-#include "ref.h"
+#include "user_reg.h"
 #include "subscr.h"
 
 /**
@@ -544,14 +542,14 @@ static void subscr_named_msg_event(void *usr_handle,
 int tipc_subscr_start(void)
 {
         struct tipc_name_seq seq = {TIPC_TOP_SRV, TIPC_TOP_SRV, TIPC_TOP_SRV};
-        int res = -1;
+        int res;
 
         memset(&topsrv, 0, sizeof (topsrv));
         spin_lock_init(&topsrv.lock);
         INIT_LIST_HEAD(&topsrv.subscriber_list);
 
         spin_lock_bh(&topsrv.lock);
-        res = tipc_attach(&topsrv.user_ref, NULL, NULL);
+        res = tipc_attach(&topsrv.user_ref);
         if (res) {
                 spin_unlock_bh(&topsrv.lock);
                 return res;
diff --git a/net/tipc/user_reg.c b/net/tipc/user_reg.c
index 50692880316..2e2702e2049 100644
--- a/net/tipc/user_reg.c
+++ b/net/tipc/user_reg.c
@@ -50,15 +50,11 @@
 /**
  * struct tipc_user - registered TIPC user info
  * @next: index of next free registry entry (or -1 for an allocated entry)
- * @callback: ptr to routine to call when TIPC mode changes (NULL if none)
- * @usr_handle: user-defined value passed to callback routine
  * @ports: list of user ports owned by the user
  */
 
 struct tipc_user {
         int next;
-        tipc_mode_event callback;
-        void *usr_handle;
         struct list_head ports;
 };
 
@@ -95,41 +91,12 @@ static int reg_init(void)
 }
 
 /**
- * reg_callback - inform TIPC user about current operating mode
- */
-
-static void reg_callback(struct tipc_user *user_ptr)
-{
-        tipc_mode_event cb;
-        void *arg;
-
-        spin_lock_bh(&reg_lock);
-        cb = user_ptr->callback;
-        arg = user_ptr->usr_handle;
-        spin_unlock_bh(&reg_lock);
-
-        if (cb)
-                cb(arg, tipc_mode, tipc_own_addr);
-}
-
-/**
  * tipc_reg_start - activate TIPC user registry
  */
 
 int tipc_reg_start(void)
 {
-        u32 u;
-        int res;
-
-        if ((res = reg_init()))
-                return res;
-
-        for (u = 1; u <= MAX_USERID; u++) {
-                if (users[u].callback)
-                        tipc_k_signal((Handler)reg_callback,
-                                      (unsigned long)&users[u]);
-        }
-        return 0;
+        return reg_init();
 }
 
 /**
@@ -138,15 +105,9 @@ int tipc_reg_start(void)
 
 void tipc_reg_stop(void)
 {
-        int id;
-
         if (!users)
                 return;
 
-        for (id = 1; id <= MAX_USERID; id++) {
-                if (users[id].callback)
-                        reg_callback(&users[id]);
-        }
         kfree(users);
         users = NULL;
 }
@@ -157,12 +118,10 @@ void tipc_reg_stop(void)
  * NOTE: This routine may be called when TIPC is inactive.
  */
 
-int tipc_attach(u32 *userid, tipc_mode_event cb, void *usr_handle)
+int tipc_attach(u32 *userid)
 {
         struct tipc_user *user_ptr;
 
-        if ((tipc_mode == TIPC_NOT_RUNNING) && !cb)
-                return -ENOPROTOOPT;
         if (!users)
                 reg_init();
 
@@ -177,13 +136,9 @@ int tipc_attach(u32 *userid, tipc_mode_event cb, void *usr_handle)
         user_ptr->next = -1;
         spin_unlock_bh(&reg_lock);
 
-        user_ptr->callback = cb;
-        user_ptr->usr_handle = usr_handle;
         INIT_LIST_HEAD(&user_ptr->ports);
         atomic_inc(&tipc_user_count);
 
-        if (cb && (tipc_mode != TIPC_NOT_RUNNING))
-                tipc_k_signal((Handler)reg_callback, (unsigned long)user_ptr);
         return 0;
 }
 
@@ -207,7 +162,6 @@ void tipc_detach(u32 userid)
         }
 
         user_ptr = &users[userid];
-        user_ptr->callback = NULL;
         INIT_LIST_HEAD(&ports_temp);
         list_splice(&user_ptr->ports, &ports_temp);
         user_ptr->next = next_free_user;
diff --git a/net/tipc/user_reg.h b/net/tipc/user_reg.h
index 81dc12e2882..109eed0d6de 100644
--- a/net/tipc/user_reg.h
+++ b/net/tipc/user_reg.h
@@ -42,6 +42,9 @@
 int tipc_reg_start(void);
 void tipc_reg_stop(void);
 
+int tipc_attach(unsigned int *userref);
+void tipc_detach(unsigned int userref);
+
 int tipc_reg_add_port(struct user_port *up_ptr);
 int tipc_reg_remove_port(struct user_port *up_ptr);
 
diff --git a/net/tipc/zone.c b/net/tipc/zone.c
index 83f8b5e91fc..1b61ca8c48e 100644
--- a/net/tipc/zone.c
+++ b/net/tipc/zone.c
@@ -36,9 +36,6 @@
 
 #include "core.h"
 #include "zone.h"
-#include "net.h"
-#include "addr.h"
-#include "node_subscr.h"
 #include "cluster.h"
 #include "node.h"
 
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 2268e679812..417d7a6c36c 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -316,7 +316,8 @@ static void unix_write_space(struct sock *sk)
         if (unix_writable(sk)) {
                 wq = rcu_dereference(sk->sk_wq);
                 if (wq_has_sleeper(wq))
-                        wake_up_interruptible_sync(&wq->wait);
+                        wake_up_interruptible_sync_poll(&wq->wait,
+                                POLLOUT | POLLWRNORM | POLLWRBAND);
                 sk_wake_async(sk, SOCK_WAKE_SPACE, POLL_OUT);
         }
         rcu_read_unlock();
@@ -1736,7 +1737,8 @@ static int unix_dgram_recvmsg(struct kiocb *iocb, struct socket *sock,
                 goto out_unlock;
         }
 
-        wake_up_interruptible_sync(&u->peer_wait);
+        wake_up_interruptible_sync_poll(&u->peer_wait,
+                                        POLLOUT | POLLWRNORM | POLLWRBAND);
 
         if (msg->msg_name)
                 unix_copy_addr(msg, skb->sk);
@@ -2099,13 +2101,12 @@ static unsigned int unix_dgram_poll(struct file *file, struct socket *sock,
         if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
                 mask |= POLLERR;
         if (sk->sk_shutdown & RCV_SHUTDOWN)
-                mask |= POLLRDHUP;
+                mask |= POLLRDHUP | POLLIN | POLLRDNORM;
         if (sk->sk_shutdown == SHUTDOWN_MASK)
                 mask |= POLLHUP;
 
         /* readable? */
-        if (!skb_queue_empty(&sk->sk_receive_queue) ||
-            (sk->sk_shutdown & RCV_SHUTDOWN))
+        if (!skb_queue_empty(&sk->sk_receive_queue))
                 mask |= POLLIN | POLLRDNORM;
 
         /* Connection-based need to check for termination and startup */
@@ -2117,20 +2118,19 @@ static unsigned int unix_dgram_poll(struct file *file, struct socket *sock,
                         return mask;
         }
 
-        /* writable? */
-        writable = unix_writable(sk);
-        if (writable) {
-                other = unix_peer_get(sk);
-                if (other) {
-                        if (unix_peer(other) != sk) {
-                                sock_poll_wait(file, &unix_sk(other)->peer_wait,
-                                          wait);
-                                if (unix_recvq_full(other))
-                                        writable = 0;
-                        }
+        /* No write status requested, avoid expensive OUT tests. */
+        if (wait && !(wait->key & (POLLWRBAND | POLLWRNORM | POLLOUT)))
+                return mask;
 
-                        sock_put(other);
+        writable = unix_writable(sk);
+        other = unix_peer_get(sk);
+        if (other) {
+                if (unix_peer(other) != sk) {
+                        sock_poll_wait(file, &unix_sk(other)->peer_wait, wait);
+                        if (unix_recvq_full(other))
+                                writable = 0;
                 }
+                sock_put(other);
         }
 
         if (writable)
diff --git a/net/wanrouter/Makefile b/net/wanrouter/Makefile
index 9f188ab3dcd..4da14bc4807 100644
--- a/net/wanrouter/Makefile
+++ b/net/wanrouter/Makefile
@@ -4,4 +4,4 @@
 
 obj-$(CONFIG_WAN_ROUTER) += wanrouter.o
 
-wanrouter-objs :=  wanproc.o wanmain.o
+wanrouter-y :=  wanproc.o wanmain.o
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 9c21ebf9780..630bcf0a2f0 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -4,6 +4,8 @@
  * Copyright 2006-2010          Johannes Berg <johannes@sipsolutions.net>
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/if.h>
 #include <linux/module.h>
 #include <linux/err.h>
@@ -216,8 +218,7 @@ int cfg80211_dev_rename(struct cfg80211_registered_device *rdev,
                             rdev->wiphy.debugfsdir,
                             rdev->wiphy.debugfsdir->d_parent,
                             newname))
-                printk(KERN_ERR "cfg80211: failed to rename debugfs dir to %s!\n",
-                       newname);
+                pr_err("failed to rename debugfs dir to %s!\n", newname);
 
         nl80211_notify_dev_rename(rdev);
 
@@ -699,8 +700,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
 
                 if (sysfs_create_link(&dev->dev.kobj, &rdev->wiphy.dev.kobj,
                                       "phy80211")) {
-                        printk(KERN_ERR "wireless: failed to add phy80211 "
-                                "symlink to netdev!\n");
+                        pr_err("failed to add phy80211 symlink to netdev!\n");
                 }
                 wdev->netdev = dev;
                 wdev->sme_state = CFG80211_SME_IDLE;
diff --git a/net/wireless/lib80211.c b/net/wireless/lib80211.c
index 97d411f7450..3268fac5ab2 100644
--- a/net/wireless/lib80211.c
+++ b/net/wireless/lib80211.c
@@ -13,6 +13,8 @@
  *
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/ctype.h>
 #include <linux/ieee80211.h>
@@ -224,8 +226,8 @@ int lib80211_unregister_crypto_ops(struct lib80211_crypto_ops *ops)
         return -EINVAL;
 
       found:
-        printk(KERN_DEBUG "lib80211_crypt: unregistered algorithm "
-               "'%s'\n", ops->name);
+        printk(KERN_DEBUG "lib80211_crypt: unregistered algorithm '%s'\n",
+               ops->name);
         list_del(&alg->list);
         spin_unlock_irqrestore(&lib80211_crypto_lock, flags);
         kfree(alg);
@@ -270,7 +272,7 @@ static struct lib80211_crypto_ops lib80211_crypt_null = {
 
 static int __init lib80211_init(void)
 {
-        printk(KERN_INFO DRV_NAME ": " DRV_DESCRIPTION "\n");
+        pr_info(DRV_DESCRIPTION "\n");
         return lib80211_register_crypto_ops(&lib80211_crypt_null);
 }
 
diff --git a/net/wireless/lib80211_crypt_tkip.c b/net/wireless/lib80211_crypt_tkip.c
index 0fe40510e2c..7ea4f2b0770 100644
--- a/net/wireless/lib80211_crypt_tkip.c
+++ b/net/wireless/lib80211_crypt_tkip.c
@@ -10,6 +10,8 @@
  * more details.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/err.h>
 #include <linux/module.h>
 #include <linux/init.h>
@@ -99,8 +101,7 @@ static void *lib80211_tkip_init(int key_idx)
         priv->tx_tfm_arc4 = crypto_alloc_blkcipher("ecb(arc4)", 0,
                                                 CRYPTO_ALG_ASYNC);
         if (IS_ERR(priv->tx_tfm_arc4)) {
-                printk(KERN_DEBUG "lib80211_crypt_tkip: could not allocate "
-                       "crypto API arc4\n");
+                printk(KERN_DEBUG pr_fmt("could not allocate crypto API arc4\n"));
                 priv->tx_tfm_arc4 = NULL;
                 goto fail;
         }
@@ -108,8 +109,7 @@ static void *lib80211_tkip_init(int key_idx)
         priv->tx_tfm_michael = crypto_alloc_hash("michael_mic", 0,
                                                  CRYPTO_ALG_ASYNC);
         if (IS_ERR(priv->tx_tfm_michael)) {
-                printk(KERN_DEBUG "lib80211_crypt_tkip: could not allocate "
-                       "crypto API michael_mic\n");
+                printk(KERN_DEBUG pr_fmt("could not allocate crypto API michael_mic\n"));
                 priv->tx_tfm_michael = NULL;
                 goto fail;
         }
@@ -117,8 +117,7 @@ static void *lib80211_tkip_init(int key_idx)
         priv->rx_tfm_arc4 = crypto_alloc_blkcipher("ecb(arc4)", 0,
                                                 CRYPTO_ALG_ASYNC);
         if (IS_ERR(priv->rx_tfm_arc4)) {
-                printk(KERN_DEBUG "lib80211_crypt_tkip: could not allocate "
-                       "crypto API arc4\n");
+                printk(KERN_DEBUG pr_fmt("could not allocate crypto API arc4\n"));
                 priv->rx_tfm_arc4 = NULL;
                 goto fail;
         }
@@ -126,8 +125,7 @@ static void *lib80211_tkip_init(int key_idx)
         priv->rx_tfm_michael = crypto_alloc_hash("michael_mic", 0,
                                                  CRYPTO_ALG_ASYNC);
         if (IS_ERR(priv->rx_tfm_michael)) {
-                printk(KERN_DEBUG "lib80211_crypt_tkip: could not allocate "
-                       "crypto API michael_mic\n");
+                printk(KERN_DEBUG pr_fmt("could not allocate crypto API michael_mic\n"));
                 priv->rx_tfm_michael = NULL;
                 goto fail;
         }
@@ -536,7 +534,7 @@ static int michael_mic(struct crypto_hash *tfm_michael, u8 * key, u8 * hdr,
         struct scatterlist sg[2];
 
         if (tfm_michael == NULL) {
-                printk(KERN_WARNING "michael_mic: tfm_michael == NULL\n");
+                pr_warn("%s(): tfm_michael == NULL\n", __func__);
                 return -1;
         }
         sg_init_table(sg, 2);
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 26838d903b9..6980a0c315b 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -1028,3 +1028,15 @@ void cfg80211_cqm_rssi_notify(struct net_device *dev,
         nl80211_send_cqm_rssi_notify(rdev, dev, rssi_event, gfp);
 }
 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
+
+void cfg80211_cqm_pktloss_notify(struct net_device *dev,
+                                 const u8 *peer, u32 num_packets, gfp_t gfp)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct wiphy *wiphy = wdev->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+
+        /* Indicate roaming trigger event to user space */
+        nl80211_send_cqm_pktloss_notify(rdev, dev, peer, num_packets, gfp);
+}
+EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 4e78e3f2679..67ff7e92cb9 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -166,7 +166,13 @@ static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
 
         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
+
         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
+
+        [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
+        [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
+
+        [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 };
 
 /* policy for the key attributes */
@@ -526,7 +532,6 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                     dev->wiphy.rts_threshold);
         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
                     dev->wiphy.coverage_class);
-
         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
                    dev->wiphy.max_scan_ssids);
         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
@@ -545,6 +550,16 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
         if (dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL)
                 NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE);
 
+        if (dev->ops->get_antenna) {
+                u32 tx_ant = 0, rx_ant = 0;
+                int res;
+                res = dev->ops->get_antenna(&dev->wiphy, &tx_ant, &rx_ant);
+                if (!res) {
+                        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_TX, tx_ant);
+                        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_RX, rx_ant);
+                }
+        }
+
         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
         if (!nl_modes)
                 goto nla_put_failure;
@@ -1024,6 +1039,22 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
                         goto bad_res;
         }
 
+        if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
+            info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
+                u32 tx_ant, rx_ant;
+                if (!rdev->ops->set_antenna) {
+                        result = -EOPNOTSUPP;
+                        goto bad_res;
+                }
+
+                tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
+                rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
+
+                result = rdev->ops->set_antenna(&rdev->wiphy, tx_ant, rx_ant);
+                if (result)
+                        goto bad_res;
+        }
+
         changed = 0;
 
         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
@@ -3569,6 +3600,34 @@ static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
                                       local_state_change);
 }
 
+static bool
+nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
+                         int mcast_rate[IEEE80211_NUM_BANDS],
+                         int rateval)
+{
+        struct wiphy *wiphy = &rdev->wiphy;
+        bool found = false;
+        int band, i;
+
+        for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+                struct ieee80211_supported_band *sband;
+
+                sband = wiphy->bands[band];
+                if (!sband)
+                        continue;
+
+                for (i = 0; i < sband->n_bitrates; i++) {
+                        if (sband->bitrates[i].bitrate == rateval) {
+                                mcast_rate[band] = i + 1;
+                                found = true;
+                                break;
+                        }
+                }
+        }
+
+        return found;
+}
+
 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
 {
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
@@ -3653,6 +3712,11 @@ static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
                 }
         }
 
+        if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
+            !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
+                        nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
+                return -EINVAL;
+
         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
                 connkeys = nl80211_parse_connkeys(rdev,
                                         info->attrs[NL80211_ATTR_KEYS]);
@@ -5651,6 +5715,51 @@ nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
         nlmsg_free(msg);
 }
 
+void
+nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
+                                struct net_device *netdev, const u8 *peer,
+                                u32 num_packets, gfp_t gfp)
+{
+        struct sk_buff *msg;
+        struct nlattr *pinfoattr;
+        void *hdr;
+
+        msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
+        if (!msg)
+                return;
+
+        hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
+        if (!hdr) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
+        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
+        NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, peer);
+
+        pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
+        if (!pinfoattr)
+                goto nla_put_failure;
+
+        NLA_PUT_U32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets);
+
+        nla_nest_end(msg, pinfoattr);
+
+        if (genlmsg_end(msg, hdr) < 0) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+                                nl80211_mlme_mcgrp.id, gfp);
+        return;
+
+ nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        nlmsg_free(msg);
+}
+
 static int nl80211_netlink_notify(struct notifier_block * nb,
                                   unsigned long state,
                                   void *_notify)
diff --git a/net/wireless/nl80211.h b/net/wireless/nl80211.h
index 30d2f939150..16c2f719076 100644
--- a/net/wireless/nl80211.h
+++ b/net/wireless/nl80211.h
@@ -87,5 +87,9 @@ nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
                              struct net_device *netdev,
                              enum nl80211_cqm_rssi_threshold_event rssi_event,
                              gfp_t gfp);
+void
+nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
+                                struct net_device *netdev, const u8 *peer,
+                                u32 num_packets, gfp_t gfp);
 
 #endif /* __NET_WIRELESS_NL80211_H */
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 4b9f8912526..5ed615f94e0 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -32,6 +32,9 @@
  * rely on some SHA1 checksum of the regdomain for example.
  *
  */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/kernel.h>
 #include <linux/slab.h>
 #include <linux/list.h>
@@ -48,7 +51,7 @@
 #ifdef CONFIG_CFG80211_REG_DEBUG
 #define REG_DBG_PRINT(format, args...) \
         do { \
-                printk(KERN_DEBUG format , ## args); \
+                printk(KERN_DEBUG pr_fmt(format), ##args);      \
         } while (0)
 #else
 #define REG_DBG_PRINT(args...)
@@ -96,6 +99,9 @@ struct reg_beacon {
         struct ieee80211_channel chan;
 };
 
+static void reg_todo(struct work_struct *work);
+static DECLARE_WORK(reg_work, reg_todo);
+
 /* We keep a static world regulatory domain in case of the absence of CRDA */
 static const struct ieee80211_regdomain world_regdom = {
         .n_reg_rules = 5,
@@ -367,11 +373,10 @@ static int call_crda(const char *alpha2)
         };
 
         if (!is_world_regdom((char *) alpha2))
-                printk(KERN_INFO "cfg80211: Calling CRDA for country: %c%c\n",
+                pr_info("Calling CRDA for country: %c%c\n",
                         alpha2[0], alpha2[1]);
         else
-                printk(KERN_INFO "cfg80211: Calling CRDA to update world "
-                        "regulatory domain\n");
+                pr_info("Calling CRDA to update world regulatory domain\n");
 
         /* query internal regulatory database (if it exists) */
         reg_regdb_query(alpha2);
@@ -711,6 +716,60 @@ int freq_reg_info(struct wiphy *wiphy,
 }
 EXPORT_SYMBOL(freq_reg_info);
 
+#ifdef CONFIG_CFG80211_REG_DEBUG
+static const char *reg_initiator_name(enum nl80211_reg_initiator initiator)
+{
+        switch (initiator) {
+        case NL80211_REGDOM_SET_BY_CORE:
+                return "Set by core";
+        case NL80211_REGDOM_SET_BY_USER:
+                return "Set by user";
+        case NL80211_REGDOM_SET_BY_DRIVER:
+                return "Set by driver";
+        case NL80211_REGDOM_SET_BY_COUNTRY_IE:
+                return "Set by country IE";
+        default:
+                WARN_ON(1);
+                return "Set by bug";
+        }
+}
+
+static void chan_reg_rule_print_dbg(struct ieee80211_channel *chan,
+                                    u32 desired_bw_khz,
+                                    const struct ieee80211_reg_rule *reg_rule)
+{
+        const struct ieee80211_power_rule *power_rule;
+        const struct ieee80211_freq_range *freq_range;
+        char max_antenna_gain[32];
+
+        power_rule = &reg_rule->power_rule;
+        freq_range = &reg_rule->freq_range;
+
+        if (!power_rule->max_antenna_gain)
+                snprintf(max_antenna_gain, 32, "N/A");
+        else
+                snprintf(max_antenna_gain, 32, "%d", power_rule->max_antenna_gain);
+
+        REG_DBG_PRINT("Updating information on frequency %d MHz "
+                      "for %d a MHz width channel with regulatory rule:\n",
+                      chan->center_freq,
+                      KHZ_TO_MHZ(desired_bw_khz));
+
+        REG_DBG_PRINT("%d KHz - %d KHz @  KHz), (%s mBi, %d mBm)\n",
+                      freq_range->start_freq_khz,
+                      freq_range->end_freq_khz,
+                      max_antenna_gain,
+                      power_rule->max_eirp);
+}
+#else
+static void chan_reg_rule_print_dbg(struct ieee80211_channel *chan,
+                                    u32 desired_bw_khz,
+                                    const struct ieee80211_reg_rule *reg_rule)
+{
+        return;
+}
+#endif
+
 /*
  * Note that right now we assume the desired channel bandwidth
  * is always 20 MHz for each individual channel (HT40 uses 20 MHz
@@ -720,7 +779,9 @@ EXPORT_SYMBOL(freq_reg_info);
  * on the wiphy with the target_bw specified. Then we can simply use
  * that below for the desired_bw_khz below.
  */
-static void handle_channel(struct wiphy *wiphy, enum ieee80211_band band,
+static void handle_channel(struct wiphy *wiphy,
+                           enum nl80211_reg_initiator initiator,
+                           enum ieee80211_band band,
                            unsigned int chan_idx)
 {
         int r;
@@ -748,8 +809,27 @@ static void handle_channel(struct wiphy *wiphy, enum ieee80211_band band,
                           desired_bw_khz,
                           &reg_rule);
 
-        if (r)
+        if (r) {
+                /*
+                 * We will disable all channels that do not match our
+                 * recieved regulatory rule unless the hint is coming
+                 * from a Country IE and the Country IE had no information
+                 * about a band. The IEEE 802.11 spec allows for an AP
+                 * to send only a subset of the regulatory rules allowed,
+                 * so an AP in the US that only supports 2.4 GHz may only send
+                 * a country IE with information for the 2.4 GHz band
+                 * while 5 GHz is still supported.
+                 */
+                if (initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE &&
+                    r == -ERANGE)
+                        return;
+
+                REG_DBG_PRINT("Disabling freq %d MHz\n", chan->center_freq);
+                chan->flags = IEEE80211_CHAN_DISABLED;
                 return;
+        }
+
+        chan_reg_rule_print_dbg(chan, desired_bw_khz, reg_rule);
 
         power_rule = &reg_rule->power_rule;
         freq_range = &reg_rule->freq_range;
@@ -784,7 +864,9 @@ static void handle_channel(struct wiphy *wiphy, enum ieee80211_band band,
                 chan->max_power = (int) MBM_TO_DBM(power_rule->max_eirp);
 }
 
-static void handle_band(struct wiphy *wiphy, enum ieee80211_band band)
+static void handle_band(struct wiphy *wiphy,
+                        enum ieee80211_band band,
+                        enum nl80211_reg_initiator initiator)
 {
         unsigned int i;
         struct ieee80211_supported_band *sband;
@@ -793,24 +875,42 @@ static void handle_band(struct wiphy *wiphy, enum ieee80211_band band)
         sband = wiphy->bands[band];
 
         for (i = 0; i < sband->n_channels; i++)
-                handle_channel(wiphy, band, i);
+                handle_channel(wiphy, initiator, band, i);
 }
 
 static bool ignore_reg_update(struct wiphy *wiphy,
                               enum nl80211_reg_initiator initiator)
 {
-        if (!last_request)
+        if (!last_request) {
+                REG_DBG_PRINT("Ignoring regulatory request %s since "
+                              "last_request is not set\n",
+                              reg_initiator_name(initiator));
                 return true;
+        }
+
         if (initiator == NL80211_REGDOM_SET_BY_CORE &&
-            wiphy->flags & WIPHY_FLAG_CUSTOM_REGULATORY)
+            wiphy->flags & WIPHY_FLAG_CUSTOM_REGULATORY) {
+                REG_DBG_PRINT("Ignoring regulatory request %s "
+                              "since the driver uses its own custom "
+                              "regulatory domain ",
+                              reg_initiator_name(initiator));
                 return true;
+        }
+
         /*
          * wiphy->regd will be set once the device has its own
          * desired regulatory domain set
          */
         if (wiphy->flags & WIPHY_FLAG_STRICT_REGULATORY && !wiphy->regd &&
-            !is_world_regdom(last_request->alpha2))
+            initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE &&
+            !is_world_regdom(last_request->alpha2)) {
+                REG_DBG_PRINT("Ignoring regulatory request %s "
+                              "since the driver requires its own regulaotry "
+                              "domain to be set first",
+                              reg_initiator_name(initiator));
                 return true;
+        }
+
         return false;
 }
 
@@ -1030,7 +1130,7 @@ void wiphy_update_regulatory(struct wiphy *wiphy,
                 goto out;
         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                 if (wiphy->bands[band])
-                        handle_band(wiphy, band);
+                        handle_band(wiphy, band, initiator);
         }
 out:
         reg_process_beacons(wiphy);
@@ -1066,10 +1166,17 @@ static void handle_channel_custom(struct wiphy *wiphy,
                                regd);
 
         if (r) {
+                REG_DBG_PRINT("Disabling freq %d MHz as custom "
+                              "regd has no rule that fits a %d MHz "
+                              "wide channel\n",
+                              chan->center_freq,
+                              KHZ_TO_MHZ(desired_bw_khz));
                 chan->flags = IEEE80211_CHAN_DISABLED;
                 return;
         }
 
+        chan_reg_rule_print_dbg(chan, desired_bw_khz, reg_rule);
+
         power_rule = &reg_rule->power_rule;
         freq_range = &reg_rule->freq_range;
 
@@ -1215,6 +1322,21 @@ static int ignore_request(struct wiphy *wiphy,
         return -EINVAL;
 }
 
+static void reg_set_request_processed(void)
+{
+        bool need_more_processing = false;
+
+        last_request->processed = true;
+
+        spin_lock(&reg_requests_lock);
+        if (!list_empty(&reg_requests_list))
+                need_more_processing = true;
+        spin_unlock(&reg_requests_lock);
+
+        if (need_more_processing)
+                schedule_work(&reg_work);
+}
+
 /**
  * __regulatory_hint - hint to the wireless core a regulatory domain
  * @wiphy: if the hint comes from country information from an AP, this
@@ -1290,8 +1412,10 @@ new_request:
                  * have applied the requested regulatory domain before we just
                  * inform userspace we have processed the request
                  */
-                if (r == -EALREADY)
+                if (r == -EALREADY) {
                         nl80211_send_reg_change_event(last_request);
+                        reg_set_request_processed();
+                }
                 return r;
         }
 
@@ -1307,16 +1431,13 @@ static void reg_process_hint(struct regulatory_request *reg_request)
 
         BUG_ON(!reg_request->alpha2);
 
-        mutex_lock(&cfg80211_mutex);
-        mutex_lock(&reg_mutex);
-
         if (wiphy_idx_valid(reg_request->wiphy_idx))
                 wiphy = wiphy_idx_to_wiphy(reg_request->wiphy_idx);
 
         if (reg_request->initiator == NL80211_REGDOM_SET_BY_DRIVER &&
             !wiphy) {
                 kfree(reg_request);
-                goto out;
+                return;
         }
 
         r = __regulatory_hint(wiphy, reg_request);
@@ -1324,28 +1445,46 @@ static void reg_process_hint(struct regulatory_request *reg_request)
         if (r == -EALREADY && wiphy &&
             wiphy->flags & WIPHY_FLAG_STRICT_REGULATORY)
                 wiphy_update_regulatory(wiphy, initiator);
-out:
-        mutex_unlock(&reg_mutex);
-        mutex_unlock(&cfg80211_mutex);
 }
 
-/* Processes regulatory hints, this is all the NL80211_REGDOM_SET_BY_* */
+/*
+ * Processes regulatory hints, this is all the NL80211_REGDOM_SET_BY_*
+ * Regulatory hints come on a first come first serve basis and we
+ * must process each one atomically.
+ */
 static void reg_process_pending_hints(void)
-        {
+{
         struct regulatory_request *reg_request;
 
+        mutex_lock(&cfg80211_mutex);
+        mutex_lock(&reg_mutex);
+
+        /* When last_request->processed becomes true this will be rescheduled */
+        if (last_request && !last_request->processed) {
+                REG_DBG_PRINT("Pending regulatory request, waiting "
+                              "for it to be processed...");
+                goto out;
+        }
+
         spin_lock(&reg_requests_lock);
-        while (!list_empty(&reg_requests_list)) {
-                reg_request = list_first_entry(&reg_requests_list,
-                                               struct regulatory_request,
-                                               list);
-                list_del_init(&reg_request->list);
 
+        if (list_empty(&reg_requests_list)) {
                 spin_unlock(&reg_requests_lock);
-                reg_process_hint(reg_request);
-                spin_lock(&reg_requests_lock);
+                goto out;
         }
+
+        reg_request = list_first_entry(&reg_requests_list,
+                                       struct regulatory_request,
+                                       list);
+        list_del_init(&reg_request->list);
+
         spin_unlock(&reg_requests_lock);
+
+        reg_process_hint(reg_request);
+
+out:
+        mutex_unlock(&reg_mutex);
+        mutex_unlock(&cfg80211_mutex);
 }
 
 /* Processes beacon hints -- this has nothing to do with country IEs */
@@ -1392,8 +1531,6 @@ static void reg_todo(struct work_struct *work)
         reg_process_pending_beacon_hints();
 }
 
-static DECLARE_WORK(reg_work, reg_todo);
-
 static void queue_regulatory_request(struct regulatory_request *request)
 {
         if (isalpha(request->alpha2[0]))
@@ -1428,12 +1565,7 @@ static int regulatory_hint_core(const char *alpha2)
         request->alpha2[1] = alpha2[1];
         request->initiator = NL80211_REGDOM_SET_BY_CORE;
 
-        /*
-         * This ensures last_request is populated once modules
-         * come swinging in and calling regulatory hints and
-         * wiphy_apply_custom_regulatory().
-         */
-        reg_process_hint(request);
+        queue_regulatory_request(request);
 
         return 0;
 }
@@ -1559,7 +1691,7 @@ static void restore_alpha2(char *alpha2, bool reset_user)
         if (is_user_regdom_saved()) {
                 /* Unless we're asked to ignore it and reset it */
                 if (reset_user) {
-                        REG_DBG_PRINT("cfg80211: Restoring regulatory settings "
+                        REG_DBG_PRINT("Restoring regulatory settings "
                                "including user preference\n");
                         user_alpha2[0] = '9';
                         user_alpha2[1] = '7';
@@ -1570,7 +1702,7 @@ static void restore_alpha2(char *alpha2, bool reset_user)
                          * back as they were for a full restore.
                          */
                         if (!is_world_regdom(ieee80211_regdom)) {
-                                REG_DBG_PRINT("cfg80211: Keeping preference on "
+                                REG_DBG_PRINT("Keeping preference on "
                                        "module parameter ieee80211_regdom: %c%c\n",
                                        ieee80211_regdom[0],
                                        ieee80211_regdom[1]);
@@ -1578,7 +1710,7 @@ static void restore_alpha2(char *alpha2, bool reset_user)
                                 alpha2[1] = ieee80211_regdom[1];
                         }
                 } else {
-                        REG_DBG_PRINT("cfg80211: Restoring regulatory settings "
+                        REG_DBG_PRINT("Restoring regulatory settings "
                                "while preserving user preference for: %c%c\n",
                                user_alpha2[0],
                                user_alpha2[1]);
@@ -1586,14 +1718,14 @@ static void restore_alpha2(char *alpha2, bool reset_user)
                         alpha2[1] = user_alpha2[1];
                 }
         } else if (!is_world_regdom(ieee80211_regdom)) {
-                REG_DBG_PRINT("cfg80211: Keeping preference on "
+                REG_DBG_PRINT("Keeping preference on "
                        "module parameter ieee80211_regdom: %c%c\n",
                        ieee80211_regdom[0],
                        ieee80211_regdom[1]);
                 alpha2[0] = ieee80211_regdom[0];
                 alpha2[1] = ieee80211_regdom[1];
         } else
-                REG_DBG_PRINT("cfg80211: Restoring regulatory settings\n");
+                REG_DBG_PRINT("Restoring regulatory settings\n");
 }
 
 /*
@@ -1661,7 +1793,7 @@ static void restore_regulatory_settings(bool reset_user)
 
 void regulatory_hint_disconnect(void)
 {
-        REG_DBG_PRINT("cfg80211: All devices are disconnected, going to "
+        REG_DBG_PRINT("All devices are disconnected, going to "
                       "restore regulatory settings\n");
         restore_regulatory_settings(false);
 }
@@ -1691,7 +1823,7 @@ int regulatory_hint_found_beacon(struct wiphy *wiphy,
         if (!reg_beacon)
                 return -ENOMEM;
 
-        REG_DBG_PRINT("cfg80211: Found new beacon on "
+        REG_DBG_PRINT("Found new beacon on "
                       "frequency: %d MHz (Ch %d) on %s\n",
                       beacon_chan->center_freq,
                       ieee80211_frequency_to_channel(beacon_chan->center_freq),
@@ -1721,8 +1853,7 @@ static void print_rd_rules(const struct ieee80211_regdomain *rd)
         const struct ieee80211_freq_range *freq_range = NULL;
         const struct ieee80211_power_rule *power_rule = NULL;
 
-        printk(KERN_INFO "    (start_freq - end_freq @ bandwidth), "
-                "(max_antenna_gain, max_eirp)\n");
+        pr_info("    (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)\n");
 
         for (i = 0; i < rd->n_reg_rules; i++) {
                 reg_rule = &rd->reg_rules[i];
@@ -1734,16 +1865,14 @@ static void print_rd_rules(const struct ieee80211_regdomain *rd)
                  * in certain regions
                  */
                 if (power_rule->max_antenna_gain)
-                        printk(KERN_INFO "    (%d KHz - %d KHz @ %d KHz), "
-                                "(%d mBi, %d mBm)\n",
+                        pr_info("    (%d KHz - %d KHz @ %d KHz), (%d mBi, %d mBm)\n",
                                 freq_range->start_freq_khz,
                                 freq_range->end_freq_khz,
                                 freq_range->max_bandwidth_khz,
                                 power_rule->max_antenna_gain,
                                 power_rule->max_eirp);
                 else
-                        printk(KERN_INFO "    (%d KHz - %d KHz @ %d KHz), "
-                                "(N/A, %d mBm)\n",
+                        pr_info("    (%d KHz - %d KHz @ %d KHz), (N/A, %d mBm)\n",
                                 freq_range->start_freq_khz,
                                 freq_range->end_freq_khz,
                                 freq_range->max_bandwidth_khz,
@@ -1762,27 +1891,20 @@ static void print_regdomain(const struct ieee80211_regdomain *rd)
                         rdev = cfg80211_rdev_by_wiphy_idx(
                                 last_request->wiphy_idx);
                         if (rdev) {
-                                printk(KERN_INFO "cfg80211: Current regulatory "
-                                        "domain updated by AP to: %c%c\n",
+                                pr_info("Current regulatory domain updated by AP to: %c%c\n",
                                         rdev->country_ie_alpha2[0],
                                         rdev->country_ie_alpha2[1]);
                         } else
-                                printk(KERN_INFO "cfg80211: Current regulatory "
-                                        "domain intersected:\n");
+                                pr_info("Current regulatory domain intersected:\n");
                 } else
-                        printk(KERN_INFO "cfg80211: Current regulatory "
-                                "domain intersected:\n");
+                        pr_info("Current regulatory domain intersected:\n");
         } else if (is_world_regdom(rd->alpha2))
-                printk(KERN_INFO "cfg80211: World regulatory "
-                        "domain updated:\n");
+                pr_info("World regulatory domain updated:\n");
         else {
                 if (is_unknown_alpha2(rd->alpha2))
-                        printk(KERN_INFO "cfg80211: Regulatory domain "
-                                "changed to driver built-in settings "
-                                "(unknown country)\n");
+                        pr_info("Regulatory domain changed to driver built-in settings (unknown country)\n");
                 else
-                        printk(KERN_INFO "cfg80211: Regulatory domain "
-                                "changed to country: %c%c\n",
+                        pr_info("Regulatory domain changed to country: %c%c\n",
                                 rd->alpha2[0], rd->alpha2[1]);
         }
         print_rd_rules(rd);
@@ -1790,8 +1912,7 @@ static void print_regdomain(const struct ieee80211_regdomain *rd)
 
 static void print_regdomain_info(const struct ieee80211_regdomain *rd)
 {
-        printk(KERN_INFO "cfg80211: Regulatory domain: %c%c\n",
-                rd->alpha2[0], rd->alpha2[1]);
+        pr_info("Regulatory domain: %c%c\n", rd->alpha2[0], rd->alpha2[1]);
         print_rd_rules(rd);
 }
 
@@ -1842,8 +1963,7 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
                 return -EINVAL;
 
         if (!is_valid_rd(rd)) {
-                printk(KERN_ERR "cfg80211: Invalid "
-                        "regulatory domain detected:\n");
+                pr_err("Invalid regulatory domain detected:\n");
                 print_regdomain_info(rd);
                 return -EINVAL;
         }
@@ -1959,6 +2079,8 @@ int set_regdom(const struct ieee80211_regdomain *rd)
 
         nl80211_send_reg_change_event(last_request);
 
+        reg_set_request_processed();
+
         mutex_unlock(&reg_mutex);
 
         return r;
@@ -2015,8 +2137,7 @@ int __init regulatory_init(void)
                  * early boot for call_usermodehelper(). For now treat these
                  * errors as non-fatal.
                  */
-                printk(KERN_ERR "cfg80211: kobject_uevent_env() was unable "
-                        "to call CRDA during init");
+                pr_err("kobject_uevent_env() was unable to call CRDA during init\n");
 #ifdef CONFIG_CFG80211_REG_DEBUG
                 /* We want to find out exactly why when debugging */
                 WARN_ON(err);
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 76120aeda57..fee020b15a4 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -502,7 +502,7 @@ int ieee80211_data_from_8023(struct sk_buff *skb, const u8 *addr,
                         skb_orphan(skb);
 
                 if (pskb_expand_head(skb, head_need, 0, GFP_ATOMIC)) {
-                        printk(KERN_ERR "failed to reallocate Tx buffer\n");
+                        pr_err("failed to reallocate Tx buffer\n");
                         return -ENOMEM;
                 }
                 skb->truesize += head_need;
@@ -685,20 +685,17 @@ void cfg80211_upload_connect_keys(struct wireless_dev *wdev)
                         continue;
                 if (rdev->ops->add_key(wdev->wiphy, dev, i, false, NULL,
                                         &wdev->connect_keys->params[i])) {
-                        printk(KERN_ERR "%s: failed to set key %d\n",
-                                dev->name, i);
+                        netdev_err(dev, "failed to set key %d\n", i);
                         continue;
                 }
                 if (wdev->connect_keys->def == i)
                         if (rdev->ops->set_default_key(wdev->wiphy, dev, i)) {
-                                printk(KERN_ERR "%s: failed to set defkey %d\n",
-                                        dev->name, i);
+                                netdev_err(dev, "failed to set defkey %d\n", i);
                                 continue;
                         }
                 if (wdev->connect_keys->defmgmt == i)
                         if (rdev->ops->set_default_mgmt_key(wdev->wiphy, dev, i))
-                                printk(KERN_ERR "%s: failed to set mgtdef %d\n",
-                                        dev->name, i);
+                                netdev_err(dev, "failed to set mgtdef %d\n", i);
         }
 
         kfree(wdev->connect_keys);
diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
index dc675a3daa3..fdbc23c10d8 100644
--- a/net/wireless/wext-core.c
+++ b/net/wireless/wext-core.c
@@ -467,8 +467,8 @@ void wireless_send_event(struct net_device *	dev,
                  * The best the driver could do is to log an error message.
                  * We will do it ourselves instead...
                  */
-                printk(KERN_ERR "%s (WE) : Invalid/Unknown Wireless Event (0x%04X)\n",
-                       dev->name, cmd);
+                netdev_err(dev, "(WE) : Invalid/Unknown Wireless Event (0x%04X)\n",
+                           cmd);
                 return;
         }
 
@@ -476,11 +476,13 @@ void wireless_send_event(struct net_device *	dev,
         if (descr->header_type == IW_HEADER_TYPE_POINT) {
                 /* Check if number of token fits within bounds */
                 if (wrqu->data.length > descr->max_tokens) {
-                        printk(KERN_ERR "%s (WE) : Wireless Event too big (%d)\n", dev->name, wrqu->data.length);
+                        netdev_err(dev, "(WE) : Wireless Event too big (%d)\n",
+                                   wrqu->data.length);
                         return;
                 }
                 if (wrqu->data.length < descr->min_tokens) {
-                        printk(KERN_ERR "%s (WE) : Wireless Event too small (%d)\n", dev->name, wrqu->data.length);
+                        netdev_err(dev, "(WE) : Wireless Event too small (%d)\n",
+                                   wrqu->data.length);
                         return;
                 }
                 /* Calculate extra_len - extra is NULL for restricted events */
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index f7af98dff40..ad96ee90fe2 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -1357,11 +1357,11 @@ static int x25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
         void __user *argp = (void __user *)arg;
         int rc;
 
-        lock_kernel();
         switch (cmd) {
                 case TIOCOUTQ: {
-                        int amount = sk->sk_sndbuf - sk_wmem_alloc_get(sk);
+                        int amount;
 
+                        amount = sk->sk_sndbuf - sk_wmem_alloc_get(sk);
                         if (amount < 0)
                                 amount = 0;
                         rc = put_user(amount, (unsigned int __user *)argp);
@@ -1375,8 +1375,10 @@ static int x25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                          * These two are safe on a single CPU system as
                          * only user tasks fiddle here
                          */
+                        lock_sock(sk);
                         if ((skb = skb_peek(&sk->sk_receive_queue)) != NULL)
                                 amount = skb->len;
+                        release_sock(sk);
                         rc = put_user(amount, (unsigned int __user *)argp);
                         break;
                 }
@@ -1422,9 +1424,11 @@ static int x25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                         rc = x25_subscr_ioctl(cmd, argp);
                         break;
                 case SIOCX25GFACILITIES: {
-                        struct x25_facilities fac = x25->facilities;
-                        rc = copy_to_user(argp, &fac,
-                                          sizeof(fac)) ? -EFAULT : 0;
+                        lock_sock(sk);
+                        rc = copy_to_user(argp, &x25->facilities,
+                                                sizeof(x25->facilities))
+                                                ? -EFAULT : 0;
+                        release_sock(sk);
                         break;
                 }
 
@@ -1435,18 +1439,19 @@ static int x25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                                            sizeof(facilities)))
                                 break;
                         rc = -EINVAL;
+                        lock_sock(sk);
                         if (sk->sk_state != TCP_LISTEN &&
                             sk->sk_state != TCP_CLOSE)
-                                break;
+                                goto out_fac_release;
                         if (facilities.pacsize_in < X25_PS16 ||
                             facilities.pacsize_in > X25_PS4096)
-                                break;
+                                goto out_fac_release;
                         if (facilities.pacsize_out < X25_PS16 ||
                             facilities.pacsize_out > X25_PS4096)
-                                break;
+                                goto out_fac_release;
                         if (facilities.winsize_in < 1 ||
                             facilities.winsize_in > 127)
-                                break;
+                                goto out_fac_release;
                         if (facilities.throughput) {
                                 int out = facilities.throughput & 0xf0;
                                 int in  = facilities.throughput & 0x0f;
@@ -1454,24 +1459,28 @@ static int x25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                                         facilities.throughput |=
                                                 X25_DEFAULT_THROUGHPUT << 4;
                                 else if (out < 0x30 || out > 0xD0)
-                                        break;
+                                        goto out_fac_release;
                                 if (!in)
                                         facilities.throughput |=
                                                 X25_DEFAULT_THROUGHPUT;
                                 else if (in < 0x03 || in > 0x0D)
-                                        break;
+                                        goto out_fac_release;
                         }
                         if (facilities.reverse &&
                                 (facilities.reverse & 0x81) != 0x81)
-                                break;
+                                goto out_fac_release;
                         x25->facilities = facilities;
                         rc = 0;
+out_fac_release:
+                        release_sock(sk);
                         break;
                 }
 
                 case SIOCX25GDTEFACILITIES: {
+                        lock_sock(sk);
                         rc = copy_to_user(argp, &x25->dte_facilities,
                                                 sizeof(x25->dte_facilities));
+                        release_sock(sk);
                         if (rc)
                                 rc = -EFAULT;
                         break;
@@ -1483,26 +1492,31 @@ static int x25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                         if (copy_from_user(&dtefacs, argp, sizeof(dtefacs)))
                                 break;
                         rc = -EINVAL;
+                        lock_sock(sk);
                         if (sk->sk_state != TCP_LISTEN &&
                                         sk->sk_state != TCP_CLOSE)
-                                break;
+                                goto out_dtefac_release;
                         if (dtefacs.calling_len > X25_MAX_AE_LEN)
-                                break;
+                                goto out_dtefac_release;
                         if (dtefacs.calling_ae == NULL)
-                                break;
+                                goto out_dtefac_release;
                         if (dtefacs.called_len > X25_MAX_AE_LEN)
-                                break;
+                                goto out_dtefac_release;
                         if (dtefacs.called_ae == NULL)
-                                break;
+                                goto out_dtefac_release;
                         x25->dte_facilities = dtefacs;
                         rc = 0;
+out_dtefac_release:
+                        release_sock(sk);
                         break;
                 }
 
                 case SIOCX25GCALLUSERDATA: {
-                        struct x25_calluserdata cud = x25->calluserdata;
-                        rc = copy_to_user(argp, &cud,
-                                          sizeof(cud)) ? -EFAULT : 0;
+                        lock_sock(sk);
+                        rc = copy_to_user(argp, &x25->calluserdata,
+                                        sizeof(x25->calluserdata))
+                                        ? -EFAULT : 0;
+                        release_sock(sk);
                         break;
                 }
 
@@ -1516,16 +1530,19 @@ static int x25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                         rc = -EINVAL;
                         if (calluserdata.cudlength > X25_MAX_CUD_LEN)
                                 break;
+                        lock_sock(sk);
                         x25->calluserdata = calluserdata;
+                        release_sock(sk);
                         rc = 0;
                         break;
                 }
 
                 case SIOCX25GCAUSEDIAG: {
-                        struct x25_causediag causediag;
-                        causediag = x25->causediag;
-                        rc = copy_to_user(argp, &causediag,
-                                          sizeof(causediag)) ? -EFAULT : 0;
+                        lock_sock(sk);
+                        rc = copy_to_user(argp, &x25->causediag,
+                                        sizeof(x25->causediag))
+                                        ? -EFAULT : 0;
+                        release_sock(sk);
                         break;
                 }
 
@@ -1534,7 +1551,9 @@ static int x25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                         rc = -EFAULT;
                         if (copy_from_user(&causediag, argp, sizeof(causediag)))
                                 break;
+                        lock_sock(sk);
                         x25->causediag = causediag;
+                        release_sock(sk);
                         rc = 0;
                         break;
 
@@ -1543,31 +1562,37 @@ static int x25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                 case SIOCX25SCUDMATCHLEN: {
                         struct x25_subaddr sub_addr;
                         rc = -EINVAL;
+                        lock_sock(sk);
                         if(sk->sk_state != TCP_CLOSE)
-                                break;
+                                goto out_cud_release;
                         rc = -EFAULT;
                         if (copy_from_user(&sub_addr, argp,
                                         sizeof(sub_addr)))
-                                break;
+                                goto out_cud_release;
                         rc = -EINVAL;
                         if(sub_addr.cudmatchlength > X25_MAX_CUD_LEN)
-                                break;
+                                goto out_cud_release;
                         x25->cudmatchlength = sub_addr.cudmatchlength;
                         rc = 0;
+out_cud_release:
+                        release_sock(sk);
                         break;
                 }
 
                 case SIOCX25CALLACCPTAPPRV: {
                         rc = -EINVAL;
+                        lock_kernel();
                         if (sk->sk_state != TCP_CLOSE)
                                 break;
                         clear_bit(X25_ACCPT_APPRV_FLAG, &x25->flags);
+                        unlock_kernel();
                         rc = 0;
                         break;
                 }
 
                 case SIOCX25SENDCALLACCPT:  {
                         rc = -EINVAL;
+                        lock_kernel();
                         if (sk->sk_state != TCP_ESTABLISHED)
                                 break;
                         /* must call accptapprv above */
@@ -1575,6 +1600,7 @@ static int x25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                                 break;
                         x25_write_internal(sk, X25_CALL_ACCEPTED);
                         x25->state = X25_STATE_3;
+                        unlock_kernel();
                         rc = 0;
                         break;
                 }
@@ -1583,7 +1609,6 @@ static int x25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                         rc = -ENOIOCTLCMD;
                         break;
         }
-        unlock_kernel();
 
         return rc;
 }
@@ -1619,16 +1644,20 @@ static int compat_x25_subscr_ioctl(unsigned int cmd,
         dev_put(dev);
 
         if (cmd == SIOCX25GSUBSCRIP) {
+                read_lock_bh(&x25_neigh_list_lock);
                 x25_subscr.extended = nb->extended;
                 x25_subscr.global_facil_mask = nb->global_facil_mask;
+                read_unlock_bh(&x25_neigh_list_lock);
                 rc = copy_to_user(x25_subscr32, &x25_subscr,
                                 sizeof(*x25_subscr32)) ? -EFAULT : 0;
         } else {
                 rc = -EINVAL;
                 if (x25_subscr.extended == 0 || x25_subscr.extended == 1) {
                         rc = 0;
+                        write_lock_bh(&x25_neigh_list_lock);
                         nb->extended = x25_subscr.extended;
                         nb->global_facil_mask = x25_subscr.global_facil_mask;
+                        write_unlock_bh(&x25_neigh_list_lock);
                 }
         }
         x25_neigh_put(nb);
@@ -1654,19 +1683,15 @@ static int compat_x25_ioctl(struct socket *sock, unsigned int cmd,
                 break;
         case SIOCGSTAMP:
                 rc = -EINVAL;
-                lock_kernel();
                 if (sk)
                         rc = compat_sock_get_timestamp(sk,
                                         (struct timeval __user*)argp);
-                unlock_kernel();
                 break;
         case SIOCGSTAMPNS:
                 rc = -EINVAL;
-                lock_kernel();
                 if (sk)
                         rc = compat_sock_get_timestampns(sk,
                                         (struct timespec __user*)argp);
-                unlock_kernel();
                 break;
         case SIOCGIFADDR:
         case SIOCSIFADDR:
@@ -1685,22 +1710,16 @@ static int compat_x25_ioctl(struct socket *sock, unsigned int cmd,
                 rc = -EPERM;
                 if (!capable(CAP_NET_ADMIN))
                         break;
-                lock_kernel();
                 rc = x25_route_ioctl(cmd, argp);
-                unlock_kernel();
                 break;
         case SIOCX25GSUBSCRIP:
-                lock_kernel();
                 rc = compat_x25_subscr_ioctl(cmd, argp);
-                unlock_kernel();
                 break;
         case SIOCX25SSUBSCRIP:
                 rc = -EPERM;
                 if (!capable(CAP_NET_ADMIN))
                         break;
-                lock_kernel();
                 rc = compat_x25_subscr_ioctl(cmd, argp);
-                unlock_kernel();
                 break;
         case SIOCX25GFACILITIES:
         case SIOCX25SFACILITIES:
diff --git a/net/x25/x25_link.c b/net/x25/x25_link.c
index b25c6463c3e..4cbc942f762 100644
--- a/net/x25/x25_link.c
+++ b/net/x25/x25_link.c
@@ -31,8 +31,8 @@
 #include <linux/init.h>
 #include <net/x25.h>
 
-static LIST_HEAD(x25_neigh_list);
-static DEFINE_RWLOCK(x25_neigh_list_lock);
+LIST_HEAD(x25_neigh_list);
+DEFINE_RWLOCK(x25_neigh_list_lock);
 
 static void x25_t20timer_expiry(unsigned long);
 
@@ -360,16 +360,20 @@ int x25_subscr_ioctl(unsigned int cmd, void __user *arg)
         dev_put(dev);
 
         if (cmd == SIOCX25GSUBSCRIP) {
+                read_lock_bh(&x25_neigh_list_lock);
                 x25_subscr.extended          = nb->extended;
                 x25_subscr.global_facil_mask = nb->global_facil_mask;
+                read_unlock_bh(&x25_neigh_list_lock);
                 rc = copy_to_user(arg, &x25_subscr,
                                   sizeof(x25_subscr)) ? -EFAULT : 0;
         } else {
                 rc = -EINVAL;
                 if (!(x25_subscr.extended && x25_subscr.extended != 1)) {
                         rc = 0;
+                        write_lock_bh(&x25_neigh_list_lock);
                         nb->extended         = x25_subscr.extended;
                         nb->global_facil_mask = x25_subscr.global_facil_mask;
+                        write_unlock_bh(&x25_neigh_list_lock);
                 }
         }
         x25_neigh_put(nb);
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index d9154cf90ae..156ef93d6f7 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -4524,11 +4524,11 @@ static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
         if (selinux_secmark_enabled())
                 if (avc_has_perm(sksec->sid, skb->secmark,
                                  SECCLASS_PACKET, PACKET__SEND, &ad))
-                        return NF_DROP;
+                        return NF_DROP_ERR(-ECONNREFUSED);
 
         if (selinux_policycap_netpeer)
                 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
-                        return NF_DROP;
+                        return NF_DROP_ERR(-ECONNREFUSED);
 
         return NF_ACCEPT;
 }
@@ -4585,7 +4585,7 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
                                 secmark_perm = PACKET__SEND;
                         break;
                 default:
-                        return NF_DROP;
+                        return NF_DROP_ERR(-ECONNREFUSED);
                 }
                 if (secmark_perm == PACKET__FORWARD_OUT) {
                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
@@ -4607,7 +4607,7 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
         if (secmark_active)
                 if (avc_has_perm(peer_sid, skb->secmark,
                                  SECCLASS_PACKET, secmark_perm, &ad))
-                        return NF_DROP;
+                        return NF_DROP_ERR(-ECONNREFUSED);
 
         if (peerlbl_active) {
                 u32 if_sid;
@@ -4617,13 +4617,13 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
                         return NF_DROP;
                 if (avc_has_perm(peer_sid, if_sid,
                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
-                        return NF_DROP;
+                        return NF_DROP_ERR(-ECONNREFUSED);
 
                 if (sel_netnode_sid(addrp, family, &node_sid))
                         return NF_DROP;
                 if (avc_has_perm(peer_sid, node_sid,
                                  SECCLASS_NODE, NODE__SENDTO, &ad))
-                        return NF_DROP;
+                        return NF_DROP_ERR(-ECONNREFUSED);
         }
 
         return NF_ACCEPT;