35 files changed, 2765 insertions, 1431 deletions

diff --git a/drivers/net/wireless/wl12xx/Kconfig b/drivers/net/wireless/wl12xx/Kconfig
index 785e0244e30..337fc7bec5a 100644
--- a/drivers/net/wireless/wl12xx/Kconfig
+++ b/drivers/net/wireless/wl12xx/Kconfig
@@ -51,3 +51,27 @@ config WL1271
 
           If you choose to build a module, it'll be called wl1271. Say N if
           unsure.
+
+config WL1271_SPI
+        tristate "TI wl1271 SPI support"
+        depends on WL1271 && SPI_MASTER
+        ---help---
+          This module adds support for the SPI interface of adapters using
+          TI wl1271 chipset.  Select this if your platform is using
+          the SPI bus.
+
+          If you choose to build a module, it'll be called wl1251_spi.
+          Say N if unsure.
+
+config WL1271_SDIO
+        tristate "TI wl1271 SDIO support"
+        depends on WL1271 && MMC && ARM
+        ---help---
+          This module adds support for the SDIO interface of adapters using
+          TI wl1271 chipset.  Select this if your platform is using
+          the SDIO bus.
+
+          If you choose to build a module, it'll be called
+          wl1271_sdio. Say N if unsure.
+
+
diff --git a/drivers/net/wireless/wl12xx/Makefile b/drivers/net/wireless/wl12xx/Makefile
index f47ec94c16d..27ddd2be0a9 100644
--- a/drivers/net/wireless/wl12xx/Makefile
+++ b/drivers/net/wireless/wl12xx/Makefile
@@ -7,10 +7,12 @@ obj-$(CONFIG_WL1251)	+= wl1251.o
 obj-$(CONFIG_WL1251_SPI)        += wl1251_spi.o
 obj-$(CONFIG_WL1251_SDIO)       += wl1251_sdio.o
 
-wl1271-objs             = wl1271_main.o  wl1271_spi.o wl1271_cmd.o  \
+wl1271-objs             = wl1271_main.o  wl1271_cmd.o wl1271_io.o \
                           wl1271_event.o wl1271_tx.o  wl1271_rx.o   \
                           wl1271_ps.o    wl1271_acx.o wl1271_boot.o \
-                          wl1271_init.o  wl1271_debugfs.o wl1271_io.o
+                          wl1271_init.o  wl1271_debugfs.o
 
 wl1271-$(CONFIG_NL80211_TESTMODE)       += wl1271_testmode.o
 obj-$(CONFIG_WL1271)    += wl1271.o
+obj-$(CONFIG_WL1271_SPI)        += wl1271_spi.o
+obj-$(CONFIG_WL1271_SDIO)       += wl1271_sdio.o
diff --git a/drivers/net/wireless/wl12xx/wl1251.h b/drivers/net/wireless/wl12xx/wl1251.h
index 37c61c19cae..4f5f02a26e6 100644
--- a/drivers/net/wireless/wl12xx/wl1251.h
+++ b/drivers/net/wireless/wl12xx/wl1251.h
@@ -256,6 +256,8 @@ struct wl1251_debugfs {
 struct wl1251_if_operations {
         void (*read)(struct wl1251 *wl, int addr, void *buf, size_t len);
         void (*write)(struct wl1251 *wl, int addr, void *buf, size_t len);
+        void (*read_elp)(struct wl1251 *wl, int addr, u32 *val);
+        void (*write_elp)(struct wl1251 *wl, int addr, u32 val);
         void (*reset)(struct wl1251 *wl);
         void (*enable_irq)(struct wl1251 *wl);
         void (*disable_irq)(struct wl1251 *wl);
diff --git a/drivers/net/wireless/wl12xx/wl1251_boot.c b/drivers/net/wireless/wl12xx/wl1251_boot.c
index d5ac79aeaa7..2545123931e 100644
--- a/drivers/net/wireless/wl12xx/wl1251_boot.c
+++ b/drivers/net/wireless/wl12xx/wl1251_boot.c
@@ -497,7 +497,8 @@ int wl1251_boot(struct wl1251 *wl)
         /* 2. start processing NVS file */
         if (wl->use_eeprom) {
                 wl1251_reg_write32(wl, ACX_REG_EE_START, START_EEPROM_MGR);
-                msleep(4000);
+                /* Wait for EEPROM NVS burst read to complete */
+                msleep(40);
                 wl1251_reg_write32(wl, ACX_EEPROMLESS_IND_REG, USE_EEPROM);
         } else {
                 ret = wl1251_boot_upload_nvs(wl);
diff --git a/drivers/net/wireless/wl12xx/wl1251_io.h b/drivers/net/wireless/wl12xx/wl1251_io.h
index b89d2ac62ef..c545e9d5f51 100644
--- a/drivers/net/wireless/wl12xx/wl1251_io.h
+++ b/drivers/net/wireless/wl12xx/wl1251_io.h
@@ -48,6 +48,26 @@ static inline void wl1251_write32(struct wl1251 *wl, int addr, u32 val)
         wl->if_ops->write(wl, addr, &val, sizeof(u32));
 }
 
+static inline u32 wl1251_read_elp(struct wl1251 *wl, int addr)
+{
+        u32 response;
+
+        if (wl->if_ops->read_elp)
+                wl->if_ops->read_elp(wl, addr, &response);
+        else
+                wl->if_ops->read(wl, addr, &response, sizeof(u32));
+
+        return response;
+}
+
+static inline void wl1251_write_elp(struct wl1251 *wl, int addr, u32 val)
+{
+        if (wl->if_ops->write_elp)
+                wl->if_ops->write_elp(wl, addr, val);
+        else
+                wl->if_ops->write(wl, addr, &val, sizeof(u32));
+}
+
 /* Memory target IO, address is translated to partition 0 */
 void wl1251_mem_read(struct wl1251 *wl, int addr, void *buf, size_t len);
 void wl1251_mem_write(struct wl1251 *wl, int addr, void *buf, size_t len);
diff --git a/drivers/net/wireless/wl12xx/wl1251_main.c b/drivers/net/wireless/wl12xx/wl1251_main.c
index 1c8226eee40..00b24282fc7 100644
--- a/drivers/net/wireless/wl12xx/wl1251_main.c
+++ b/drivers/net/wireless/wl12xx/wl1251_main.c
@@ -147,8 +147,8 @@ static void wl1251_fw_wakeup(struct wl1251 *wl)
         u32 elp_reg;
 
         elp_reg = ELPCTRL_WAKE_UP;
-        wl1251_write32(wl, HW_ACCESS_ELP_CTRL_REG_ADDR, elp_reg);
-        elp_reg = wl1251_read32(wl, HW_ACCESS_ELP_CTRL_REG_ADDR);
+        wl1251_write_elp(wl, HW_ACCESS_ELP_CTRL_REG_ADDR, elp_reg);
+        elp_reg = wl1251_read_elp(wl, HW_ACCESS_ELP_CTRL_REG_ADDR);
 
         if (!(elp_reg & ELPCTRL_WLAN_READY))
                 wl1251_warning("WLAN not ready");
@@ -202,8 +202,8 @@ static int wl1251_chip_wakeup(struct wl1251 *wl)
                         goto out;
         }
 
-        /* No NVS from netlink, try to get it from the filesystem */
-        if (wl->nvs == NULL) {
+        if (wl->nvs == NULL && !wl->use_eeprom) {
+                /* No NVS from netlink, try to get it from the filesystem */
                 ret = wl1251_fetch_nvs(wl);
                 if (ret < 0)
                         goto out;
@@ -857,6 +857,7 @@ out:
 }
 
 static int wl1251_op_hw_scan(struct ieee80211_hw *hw,
+                             struct ieee80211_vif *vif,
                              struct cfg80211_scan_request *req)
 {
         struct wl1251 *wl = hw->priv;
@@ -1196,6 +1197,66 @@ static const struct ieee80211_ops wl1251_ops = {
         .conf_tx = wl1251_op_conf_tx,
 };
 
+static int wl1251_read_eeprom_byte(struct wl1251 *wl, off_t offset, u8 *data)
+{
+        unsigned long timeout;
+
+        wl1251_reg_write32(wl, EE_ADDR, offset);
+        wl1251_reg_write32(wl, EE_CTL, EE_CTL_READ);
+
+        /* EE_CTL_READ clears when data is ready */
+        timeout = jiffies + msecs_to_jiffies(100);
+        while (1) {
+                if (!(wl1251_reg_read32(wl, EE_CTL) & EE_CTL_READ))
+                        break;
+
+                if (time_after(jiffies, timeout))
+                        return -ETIMEDOUT;
+
+                msleep(1);
+        }
+
+        *data = wl1251_reg_read32(wl, EE_DATA);
+        return 0;
+}
+
+static int wl1251_read_eeprom(struct wl1251 *wl, off_t offset,
+                              u8 *data, size_t len)
+{
+        size_t i;
+        int ret;
+
+        wl1251_reg_write32(wl, EE_START, 0);
+
+        for (i = 0; i < len; i++) {
+                ret = wl1251_read_eeprom_byte(wl, offset + i, &data[i]);
+                if (ret < 0)
+                        return ret;
+        }
+
+        return 0;
+}
+
+static int wl1251_read_eeprom_mac(struct wl1251 *wl)
+{
+        u8 mac[ETH_ALEN];
+        int i, ret;
+
+        wl1251_set_partition(wl, 0, 0, REGISTERS_BASE, REGISTERS_DOWN_SIZE);
+
+        ret = wl1251_read_eeprom(wl, 0x1c, mac, sizeof(mac));
+        if (ret < 0) {
+                wl1251_warning("failed to read MAC address from EEPROM");
+                return ret;
+        }
+
+        /* MAC is stored in reverse order */
+        for (i = 0; i < ETH_ALEN; i++)
+                wl->mac_addr[i] = mac[ETH_ALEN - i - 1];
+
+        return 0;
+}
+
 static int wl1251_register_hw(struct wl1251 *wl)
 {
         int ret;
@@ -1231,7 +1292,6 @@ int wl1251_init_ieee80211(struct wl1251 *wl)
         wl->hw->channel_change_time = 10000;
 
         wl->hw->flags = IEEE80211_HW_SIGNAL_DBM |
-                IEEE80211_HW_NOISE_DBM |
                 IEEE80211_HW_SUPPORTS_PS |
                 IEEE80211_HW_BEACON_FILTER |
                 IEEE80211_HW_SUPPORTS_UAPSD;
@@ -1242,6 +1302,9 @@ int wl1251_init_ieee80211(struct wl1251 *wl)
 
         wl->hw->queues = 4;
 
+        if (wl->use_eeprom)
+                wl1251_read_eeprom_mac(wl);
+
         ret = wl1251_register_hw(wl);
         if (ret)
                 goto out;
diff --git a/drivers/net/wireless/wl12xx/wl1251_ps.c b/drivers/net/wireless/wl12xx/wl1251_ps.c
index 851dfb65e47..b55cb2bd459 100644
--- a/drivers/net/wireless/wl12xx/wl1251_ps.c
+++ b/drivers/net/wireless/wl12xx/wl1251_ps.c
@@ -45,7 +45,7 @@ void wl1251_elp_work(struct work_struct *work)
                 goto out;
 
         wl1251_debug(DEBUG_PSM, "chip to elp");
-        wl1251_write32(wl, HW_ACCESS_ELP_CTRL_REG_ADDR, ELPCTRL_SLEEP);
+        wl1251_write_elp(wl, HW_ACCESS_ELP_CTRL_REG_ADDR, ELPCTRL_SLEEP);
         wl->elp = true;
 
 out:
@@ -79,9 +79,9 @@ int wl1251_ps_elp_wakeup(struct wl1251 *wl)
         start = jiffies;
         timeout = jiffies + msecs_to_jiffies(WL1251_WAKEUP_TIMEOUT);
 
-        wl1251_write32(wl, HW_ACCESS_ELP_CTRL_REG_ADDR, ELPCTRL_WAKE_UP);
+        wl1251_write_elp(wl, HW_ACCESS_ELP_CTRL_REG_ADDR, ELPCTRL_WAKE_UP);
 
-        elp_reg = wl1251_read32(wl, HW_ACCESS_ELP_CTRL_REG_ADDR);
+        elp_reg = wl1251_read_elp(wl, HW_ACCESS_ELP_CTRL_REG_ADDR);
 
         /*
          * FIXME: we should wait for irq from chip but, as a temporary
@@ -93,7 +93,7 @@ int wl1251_ps_elp_wakeup(struct wl1251 *wl)
                         return -ETIMEDOUT;
                 }
                 msleep(1);
-                elp_reg = wl1251_read32(wl, HW_ACCESS_ELP_CTRL_REG_ADDR);
+                elp_reg = wl1251_read_elp(wl, HW_ACCESS_ELP_CTRL_REG_ADDR);
         }
 
         wl1251_debug(DEBUG_PSM, "wakeup time: %u ms",
diff --git a/drivers/net/wireless/wl12xx/wl1251_reg.h b/drivers/net/wireless/wl12xx/wl1251_reg.h
index 0ca3b432605..d16edd9bf06 100644
--- a/drivers/net/wireless/wl12xx/wl1251_reg.h
+++ b/drivers/net/wireless/wl12xx/wl1251_reg.h
@@ -46,7 +46,14 @@
 #define SOR_CFG                        (REGISTERS_BASE + 0x0800)
 #define ECPU_CTRL                      (REGISTERS_BASE + 0x0804)
 #define HI_CFG                         (REGISTERS_BASE + 0x0808)
+
+/* EEPROM registers */
 #define EE_START                       (REGISTERS_BASE + 0x080C)
+#define EE_CTL                         (REGISTERS_BASE + 0x2000)
+#define EE_DATA                        (REGISTERS_BASE + 0x2004)
+#define EE_ADDR                        (REGISTERS_BASE + 0x2008)
+
+#define EE_CTL_READ                   2
 
 #define CHIP_ID_B                      (REGISTERS_BASE + 0x5674)
 
diff --git a/drivers/net/wireless/wl12xx/wl1251_rx.c b/drivers/net/wireless/wl12xx/wl1251_rx.c
index 6f229e0990f..851515836a7 100644
--- a/drivers/net/wireless/wl12xx/wl1251_rx.c
+++ b/drivers/net/wireless/wl12xx/wl1251_rx.c
@@ -74,12 +74,6 @@ static void wl1251_rx_status(struct wl1251 *wl,
 
         status->signal = desc->rssi;
 
-        /*
-         * FIXME: guessing that snr needs to be divided by two, otherwise
-         * the values don't make any sense
-         */
-        status->noise = desc->rssi - desc->snr / 2;
-
         status->freq = ieee80211_channel_to_frequency(desc->channel);
 
         status->flag |= RX_FLAG_TSFT;
@@ -189,6 +183,4 @@ void wl1251_rx(struct wl1251 *wl)
 
         /* Finally, we need to ACK the RX */
         wl1251_rx_ack(wl);
-
-        return;
 }
diff --git a/drivers/net/wireless/wl12xx/wl1251_sdio.c b/drivers/net/wireless/wl12xx/wl1251_sdio.c
index 9423f22bdce..d234285c2c8 100644
--- a/drivers/net/wireless/wl12xx/wl1251_sdio.c
+++ b/drivers/net/wireless/wl12xx/wl1251_sdio.c
@@ -20,20 +20,14 @@
  * Copyright (C) 2009 Bob Copeland (me@bobcopeland.com)
  */
 #include <linux/module.h>
-#include <linux/crc7.h>
 #include <linux/mod_devicetable.h>
-#include <linux/irq.h>
 #include <linux/mmc/sdio_func.h>
 #include <linux/mmc/sdio_ids.h>
 #include <linux/platform_device.h>
+#include <linux/spi/wl12xx.h>
+#include <linux/irq.h>
 
 #include "wl1251.h"
-#include "wl12xx_80211.h"
-#include "wl1251_reg.h"
-#include "wl1251_ps.h"
-#include "wl1251_io.h"
-#include "wl1251_tx.h"
-#include "wl1251_debugfs.h"
 
 #ifndef SDIO_VENDOR_ID_TI
 #define SDIO_VENDOR_ID_TI               0x104c
@@ -43,6 +37,8 @@
 #define SDIO_DEVICE_ID_TI_WL1251        0x9066
 #endif
 
+static struct wl12xx_platform_data *wl12xx_board_data;
+
 static struct sdio_func *wl_to_func(struct wl1251 *wl)
 {
         return wl->if_priv;
@@ -65,7 +61,8 @@ static const struct sdio_device_id wl1251_devices[] = {
 MODULE_DEVICE_TABLE(sdio, wl1251_devices);
 
 
-void wl1251_sdio_read(struct wl1251 *wl, int addr, void *buf, size_t len)
+static void wl1251_sdio_read(struct wl1251 *wl, int addr,
+                             void *buf, size_t len)
 {
         int ret;
         struct sdio_func *func = wl_to_func(wl);
@@ -77,7 +74,8 @@ void wl1251_sdio_read(struct wl1251 *wl, int addr, void *buf, size_t len)
         sdio_release_host(func);
 }
 
-void wl1251_sdio_write(struct wl1251 *wl, int addr, void *buf, size_t len)
+static void wl1251_sdio_write(struct wl1251 *wl, int addr,
+                              void *buf, size_t len)
 {
         int ret;
         struct sdio_func *func = wl_to_func(wl);
@@ -89,7 +87,33 @@ void wl1251_sdio_write(struct wl1251 *wl, int addr, void *buf, size_t len)
         sdio_release_host(func);
 }
 
-void wl1251_sdio_reset(struct wl1251 *wl)
+static void wl1251_sdio_read_elp(struct wl1251 *wl, int addr, u32 *val)
+{
+        int ret = 0;
+        struct sdio_func *func = wl_to_func(wl);
+
+        sdio_claim_host(func);
+        *val = sdio_readb(func, addr, &ret);
+        sdio_release_host(func);
+
+        if (ret)
+                wl1251_error("sdio_readb failed (%d)", ret);
+}
+
+static void wl1251_sdio_write_elp(struct wl1251 *wl, int addr, u32 val)
+{
+        int ret = 0;
+        struct sdio_func *func = wl_to_func(wl);
+
+        sdio_claim_host(func);
+        sdio_writeb(func, val, addr, &ret);
+        sdio_release_host(func);
+
+        if (ret)
+                wl1251_error("sdio_writeb failed (%d)", ret);
+}
+
+static void wl1251_sdio_reset(struct wl1251 *wl)
 {
 }
 
@@ -111,19 +135,64 @@ static void wl1251_sdio_disable_irq(struct wl1251 *wl)
         sdio_release_host(func);
 }
 
-void wl1251_sdio_set_power(bool enable)
+/* Interrupts when using dedicated WLAN_IRQ pin */
+static irqreturn_t wl1251_line_irq(int irq, void *cookie)
+{
+        struct wl1251 *wl = cookie;
+
+        ieee80211_queue_work(wl->hw, &wl->irq_work);
+
+        return IRQ_HANDLED;
+}
+
+static void wl1251_enable_line_irq(struct wl1251 *wl)
 {
+        return enable_irq(wl->irq);
 }
 
-struct wl1251_if_operations wl1251_sdio_ops = {
+static void wl1251_disable_line_irq(struct wl1251 *wl)
+{
+        return disable_irq(wl->irq);
+}
+
+static void wl1251_sdio_set_power(bool enable)
+{
+}
+
+static struct wl1251_if_operations wl1251_sdio_ops = {
         .read = wl1251_sdio_read,
         .write = wl1251_sdio_write,
+        .write_elp = wl1251_sdio_write_elp,
+        .read_elp = wl1251_sdio_read_elp,
         .reset = wl1251_sdio_reset,
-        .enable_irq = wl1251_sdio_enable_irq,
-        .disable_irq = wl1251_sdio_disable_irq,
 };
 
-int wl1251_sdio_probe(struct sdio_func *func, const struct sdio_device_id *id)
+static int wl1251_platform_probe(struct platform_device *pdev)
+{
+        if (pdev->id != -1) {
+                wl1251_error("can only handle single device");
+                return -ENODEV;
+        }
+
+        wl12xx_board_data = pdev->dev.platform_data;
+        return 0;
+}
+
+/*
+ * Dummy platform_driver for passing platform_data to this driver,
+ * until we have a way to pass this through SDIO subsystem or
+ * some other way.
+ */
+static struct platform_driver wl1251_platform_driver = {
+        .driver = {
+                .name   = "wl1251_data",
+                .owner  = THIS_MODULE,
+        },
+        .probe  = wl1251_platform_probe,
+};
+
+static int wl1251_sdio_probe(struct sdio_func *func,
+                             const struct sdio_device_id *id)
 {
         int ret;
         struct wl1251 *wl;
@@ -141,20 +210,50 @@ int wl1251_sdio_probe(struct sdio_func *func, const struct sdio_device_id *id)
                 goto release;
 
         sdio_set_block_size(func, 512);
+        sdio_release_host(func);
 
         SET_IEEE80211_DEV(hw, &func->dev);
         wl->if_priv = func;
         wl->if_ops = &wl1251_sdio_ops;
         wl->set_power = wl1251_sdio_set_power;
 
-        sdio_release_host(func);
+        if (wl12xx_board_data != NULL) {
+                wl->set_power = wl12xx_board_data->set_power;
+                wl->irq = wl12xx_board_data->irq;
+                wl->use_eeprom = wl12xx_board_data->use_eeprom;
+        }
+
+        if (wl->irq) {
+                ret = request_irq(wl->irq, wl1251_line_irq, 0, "wl1251", wl);
+                if (ret < 0) {
+                        wl1251_error("request_irq() failed: %d", ret);
+                        goto disable;
+                }
+
+                set_irq_type(wl->irq, IRQ_TYPE_EDGE_RISING);
+                disable_irq(wl->irq);
+
+                wl1251_sdio_ops.enable_irq = wl1251_enable_line_irq;
+                wl1251_sdio_ops.disable_irq = wl1251_disable_line_irq;
+
+                wl1251_info("using dedicated interrupt line");
+        } else {
+                wl1251_sdio_ops.enable_irq = wl1251_sdio_enable_irq;
+                wl1251_sdio_ops.disable_irq = wl1251_sdio_disable_irq;
+
+                wl1251_info("using SDIO interrupt");
+        }
+
         ret = wl1251_init_ieee80211(wl);
         if (ret)
-                goto disable;
+                goto out_free_irq;
 
         sdio_set_drvdata(func, wl);
         return ret;
 
+out_free_irq:
+        if (wl->irq)
+                free_irq(wl->irq, wl);
 disable:
         sdio_claim_host(func);
         sdio_disable_func(func);
@@ -167,6 +266,8 @@ static void __devexit wl1251_sdio_remove(struct sdio_func *func)
 {
         struct wl1251 *wl = sdio_get_drvdata(func);
 
+        if (wl->irq)
+                free_irq(wl->irq, wl);
         wl1251_free_hw(wl);
 
         sdio_claim_host(func);
@@ -186,6 +287,12 @@ static int __init wl1251_sdio_init(void)
 {
         int err;
 
+        err = platform_driver_register(&wl1251_platform_driver);
+        if (err) {
+                wl1251_error("failed to register platform driver: %d", err);
+                return err;
+        }
+
         err = sdio_register_driver(&wl1251_sdio_driver);
         if (err)
                 wl1251_error("failed to register sdio driver: %d", err);
@@ -195,6 +302,7 @@ static int __init wl1251_sdio_init(void)
 static void __exit wl1251_sdio_exit(void)
 {
         sdio_unregister_driver(&wl1251_sdio_driver);
+        platform_driver_unregister(&wl1251_platform_driver);
         wl1251_notice("unloaded");
 }
 
diff --git a/drivers/net/wireless/wl12xx/wl1251_spi.c b/drivers/net/wireless/wl12xx/wl1251_spi.c
index 3bfb59bd463..e81474203a2 100644
--- a/drivers/net/wireless/wl12xx/wl1251_spi.c
+++ b/drivers/net/wireless/wl12xx/wl1251_spi.c
@@ -310,7 +310,7 @@ static int __devexit wl1251_spi_remove(struct spi_device *spi)
 
 static struct spi_driver wl1251_spi_driver = {
         .driver = {
-                .name           = "wl1251",
+                .name           = DRIVER_NAME,
                 .bus            = &spi_bus_type,
                 .owner          = THIS_MODULE,
         },
diff --git a/drivers/net/wireless/wl12xx/wl1271.h b/drivers/net/wireless/wl12xx/wl1271.h
index 97ea5096bc8..6f1b6b5640c 100644
--- a/drivers/net/wireless/wl12xx/wl1271.h
+++ b/drivers/net/wireless/wl12xx/wl1271.h
@@ -53,6 +53,9 @@ enum {
         DEBUG_MAC80211  = BIT(11),
         DEBUG_CMD       = BIT(12),
         DEBUG_ACX       = BIT(13),
+        DEBUG_SDIO      = BIT(14),
+        DEBUG_FILTERS   = BIT(15),
+        DEBUG_ADHOC     = BIT(16),
         DEBUG_ALL       = ~0,
 };
 
@@ -110,6 +113,9 @@ enum {
 #define WL1271_FW_NAME "wl1271-fw.bin"
 #define WL1271_NVS_NAME "wl1271-nvs.bin"
 
+#define WL1271_TX_SECURITY_LO16(s) ((u16)((s) & 0xffff))
+#define WL1271_TX_SECURITY_HI32(s) ((u32)(((s) >> 16) & 0xffffffff))
+
 /* NVS data structure */
 #define WL1271_NVS_SECTION_SIZE                  468
 
@@ -142,14 +148,7 @@ struct wl1271_nvs_file {
  */
 #undef WL1271_80211A_ENABLED
 
-/*
- * FIXME: for the wl1271, a busy word count of 1 here will result in a more
- * optimal SPI interface. There is some SPI bug however, causing RXS time outs
- * with this mode occasionally on boot, so lets have three for now. A value of
- * three should make sure, that the chipset will always be ready, though this
- * will impact throughput and latencies slightly.
- */
-#define WL1271_BUSY_WORD_CNT 3
+#define WL1271_BUSY_WORD_CNT 1
 #define WL1271_BUSY_WORD_LEN (WL1271_BUSY_WORD_CNT * sizeof(u32))
 
 #define WL1271_ELP_HW_STATE_ASLEEP 0
@@ -334,11 +333,27 @@ struct wl1271_scan {
         u8 probe_requests;
 };
 
+struct wl1271_if_operations {
+        void (*read)(struct wl1271 *wl, int addr, void *buf, size_t len,
+                     bool fixed);
+        void (*write)(struct wl1271 *wl, int addr, void *buf, size_t len,
+                     bool fixed);
+        void (*reset)(struct wl1271 *wl);
+        void (*init)(struct wl1271 *wl);
+        void (*power)(struct wl1271 *wl, bool enable);
+        struct device* (*dev)(struct wl1271 *wl);
+        void (*enable_irq)(struct wl1271 *wl);
+        void (*disable_irq)(struct wl1271 *wl);
+};
+
 struct wl1271 {
+        struct platform_device *plat_dev;
         struct ieee80211_hw *hw;
         bool mac80211_registered;
 
-        struct spi_device *spi;
+        void *if_priv;
+
+        struct wl1271_if_operations *if_ops;
 
         void (*set_power)(bool enable);
         int irq;
@@ -357,6 +372,9 @@ struct wl1271 {
 #define WL1271_FLAG_IN_ELP             (6)
 #define WL1271_FLAG_PSM                (7)
 #define WL1271_FLAG_PSM_REQUESTED      (8)
+#define WL1271_FLAG_IRQ_PENDING        (9)
+#define WL1271_FLAG_IRQ_RUNNING       (10)
+#define WL1271_FLAG_IDLE              (11)
         unsigned long flags;
 
         struct wl1271_partition_set part;
@@ -370,9 +388,12 @@ struct wl1271 {
         size_t fw_len;
         struct wl1271_nvs_file *nvs;
 
+        s8 hw_pg_ver;
+
         u8 bssid[ETH_ALEN];
         u8 mac_addr[ETH_ALEN];
         u8 bss_type;
+        u8 set_bss_type;
         u8 ssid[IW_ESSID_MAX_SIZE + 1];
         u8 ssid_len;
         int channel;
@@ -382,13 +403,13 @@ struct wl1271 {
         /* Accounting for allocated / available TX blocks on HW */
         u32 tx_blocks_freed[NUM_TX_QUEUES];
         u32 tx_blocks_available;
-        u8 tx_results_count;
+        u32 tx_results_count;
 
         /* Transmitted TX packets counter for chipset interface */
-        int tx_packets_count;
+        u32 tx_packets_count;
 
         /* Time-offset between host and chipset clocks */
-        int time_offset;
+        s64 time_offset;
 
         /* Session counter for the chipset */
         int session_counter;
@@ -403,8 +424,7 @@ struct wl1271 {
 
         /* Security sequence number counters */
         u8 tx_security_last_seq;
-        u16 tx_security_seq_16;
-        u32 tx_security_seq_32;
+        s64 tx_security_seq;
 
         /* FW Rx counter */
         u32 rx_counter;
@@ -430,14 +450,19 @@ struct wl1271 {
         /* currently configured rate set */
         u32 sta_rate_set;
         u32 basic_rate_set;
+        u32 basic_rate;
         u32 rate_set;
 
         /* The current band */
         enum ieee80211_band band;
 
+        /* Beaconing interval (needed for ad-hoc) */
+        u32 beacon_int;
+
         /* Default key (for WEP) */
         u32 default_key;
 
+        unsigned int filters;
         unsigned int rx_config;
         unsigned int rx_filter;
 
@@ -450,10 +475,13 @@ struct wl1271 {
         /* in dBm */
         int power_level;
 
+        int rssi_thold;
+        int last_rssi_event;
+
         struct wl1271_stats stats;
         struct wl1271_debugfs debugfs;
 
-        u32 buffer_32;
+        __le32 buffer_32;
         u32 buffer_cmd;
         u32 buffer_busyword[WL1271_BUSY_WORD_CNT];
 
@@ -465,6 +493,8 @@ struct wl1271 {
         /* Current chipset configuration */
         struct conf_drv_settings conf;
 
+        bool sg_enabled;
+
         struct list_head list;
 };
 
@@ -477,7 +507,8 @@ int wl1271_plt_stop(struct wl1271 *wl);
 
 #define WL1271_DEFAULT_POWER_LEVEL 0
 
-#define WL1271_TX_QUEUE_MAX_LENGTH 20
+#define WL1271_TX_QUEUE_LOW_WATERMARK  10
+#define WL1271_TX_QUEUE_HIGH_WATERMARK 25
 
 /* WL1271 needs a 200ms sleep after power on, and a 20ms sleep before power
    on in case is has been shut down shortly before */
diff --git a/drivers/net/wireless/wl12xx/wl1271_acx.c b/drivers/net/wireless/wl12xx/wl1271_acx.c
index 308782421fc..e19e2f8f1e5 100644
--- a/drivers/net/wireless/wl12xx/wl1271_acx.c
+++ b/drivers/net/wireless/wl12xx/wl1271_acx.c
@@ -32,7 +32,6 @@
 #include "wl1271.h"
 #include "wl12xx_80211.h"
 #include "wl1271_reg.h"
-#include "wl1271_spi.h"
 #include "wl1271_ps.h"
 
 int wl1271_acx_wake_up_conditions(struct wl1271 *wl)
@@ -137,12 +136,7 @@ int wl1271_acx_tx_power(struct wl1271 *wl, int power)
                 goto out;
         }
 
-        /*
-         * FIXME: This is a workaround needed while we don't the correct
-         * calibration, to avoid distortions
-         */
-        /* acx->current_tx_power = power * 10; */
-        acx->current_tx_power = 120;
+        acx->current_tx_power = power * 10;
 
         ret = wl1271_cmd_configure(wl, DOT11_CUR_TX_PWR, acx, sizeof(*acx));
         if (ret < 0) {
@@ -511,12 +505,17 @@ out:
         return ret;
 }
 
-int wl1271_acx_conn_monit_params(struct wl1271 *wl)
+#define ACX_CONN_MONIT_DISABLE_VALUE  0xffffffff
+
+int wl1271_acx_conn_monit_params(struct wl1271 *wl, bool enable)
 {
         struct acx_conn_monit_params *acx;
+        u32 threshold = ACX_CONN_MONIT_DISABLE_VALUE;
+        u32 timeout = ACX_CONN_MONIT_DISABLE_VALUE;
         int ret;
 
-        wl1271_debug(DEBUG_ACX, "acx connection monitor parameters");
+        wl1271_debug(DEBUG_ACX, "acx connection monitor parameters: %s",
+                     enable ? "enabled" : "disabled");
 
         acx = kzalloc(sizeof(*acx), GFP_KERNEL);
         if (!acx) {
@@ -524,8 +523,13 @@ int wl1271_acx_conn_monit_params(struct wl1271 *wl)
                 goto out;
         }
 
-        acx->synch_fail_thold = cpu_to_le32(wl->conf.conn.synch_fail_thold);
-        acx->bss_lose_timeout = cpu_to_le32(wl->conf.conn.bss_lose_timeout);
+        if (enable) {
+                threshold = wl->conf.conn.synch_fail_thold;
+                timeout = wl->conf.conn.bss_lose_timeout;
+        }
+
+        acx->synch_fail_thold = cpu_to_le32(threshold);
+        acx->bss_lose_timeout = cpu_to_le32(timeout);
 
         ret = wl1271_cmd_configure(wl, ACX_CONN_MONIT_PARAMS,
                                    acx, sizeof(*acx));
@@ -541,7 +545,7 @@ out:
 }
 
 
-int wl1271_acx_sg_enable(struct wl1271 *wl)
+int wl1271_acx_sg_enable(struct wl1271 *wl, bool enable)
 {
         struct acx_bt_wlan_coex *pta;
         int ret;
@@ -554,7 +558,10 @@ int wl1271_acx_sg_enable(struct wl1271 *wl)
                 goto out;
         }
 
-        pta->enable = SG_ENABLE;
+        if (enable)
+                pta->enable = wl->conf.sg.state;
+        else
+                pta->enable = CONF_SG_DISABLE;
 
         ret = wl1271_cmd_configure(wl, ACX_SG_ENABLE, pta, sizeof(*pta));
         if (ret < 0) {
@@ -571,7 +578,7 @@ int wl1271_acx_sg_cfg(struct wl1271 *wl)
 {
         struct acx_bt_wlan_coex_param *param;
         struct conf_sg_settings *c = &wl->conf.sg;
-        int ret;
+        int i, ret;
 
         wl1271_debug(DEBUG_ACX, "acx sg cfg");
 
@@ -582,19 +589,9 @@ int wl1271_acx_sg_cfg(struct wl1271 *wl)
         }
 
         /* BT-WLAN coext parameters */
-        param->per_threshold = cpu_to_le32(c->per_threshold);
-        param->max_scan_compensation_time =
-                cpu_to_le32(c->max_scan_compensation_time);
-        param->nfs_sample_interval = cpu_to_le16(c->nfs_sample_interval);
-        param->load_ratio = c->load_ratio;
-        param->auto_ps_mode = c->auto_ps_mode;
-        param->probe_req_compensation = c->probe_req_compensation;
-        param->scan_window_compensation = c->scan_window_compensation;
-        param->antenna_config = c->antenna_config;
-        param->beacon_miss_threshold = c->beacon_miss_threshold;
-        param->rate_adaptation_threshold =
-                cpu_to_le32(c->rate_adaptation_threshold);
-        param->rate_adaptation_snr = c->rate_adaptation_snr;
+        for (i = 0; i < CONF_SG_PARAMS_MAX; i++)
+                param->params[i] = cpu_to_le32(c->params[i]);
+        param->param_idx = CONF_SG_PARAMS_ALL;
 
         ret = wl1271_cmd_configure(wl, ACX_SG_CFG, param, sizeof(*param));
         if (ret < 0) {
@@ -806,7 +803,7 @@ int wl1271_acx_rate_policies(struct wl1271 *wl)
 
         /* configure one basic rate class */
         idx = ACX_TX_BASIC_RATE;
-        acx->rate_class[idx].enabled_rates = cpu_to_le32(wl->basic_rate_set);
+        acx->rate_class[idx].enabled_rates = cpu_to_le32(wl->basic_rate);
         acx->rate_class[idx].short_retry_limit = c->short_retry_limit;
         acx->rate_class[idx].long_retry_limit = c->long_retry_limit;
         acx->rate_class[idx].aflags = c->aflags;
@@ -1143,3 +1140,129 @@ out:
         kfree(acx);
         return ret;
 }
+
+int wl1271_acx_keep_alive_mode(struct wl1271 *wl, bool enable)
+{
+        struct wl1271_acx_keep_alive_mode *acx = NULL;
+        int ret = 0;
+
+        wl1271_debug(DEBUG_ACX, "acx keep alive mode: %d", enable);
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        acx->enabled = enable;
+
+        ret = wl1271_cmd_configure(wl, ACX_KEEP_ALIVE_MODE, acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1271_warning("acx keep alive mode failed: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
+
+int wl1271_acx_keep_alive_config(struct wl1271 *wl, u8 index, u8 tpl_valid)
+{
+        struct wl1271_acx_keep_alive_config *acx = NULL;
+        int ret = 0;
+
+        wl1271_debug(DEBUG_ACX, "acx keep alive config");
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        acx->period = cpu_to_le32(wl->conf.conn.keep_alive_interval);
+        acx->index = index;
+        acx->tpl_validation = tpl_valid;
+        acx->trigger = ACX_KEEP_ALIVE_NO_TX;
+
+        ret = wl1271_cmd_configure(wl, ACX_SET_KEEP_ALIVE_CONFIG,
+                                   acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1271_warning("acx keep alive config failed: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
+
+int wl1271_acx_rssi_snr_trigger(struct wl1271 *wl, bool enable,
+                                s16 thold, u8 hyst)
+{
+        struct wl1271_acx_rssi_snr_trigger *acx = NULL;
+        int ret = 0;
+
+        wl1271_debug(DEBUG_ACX, "acx rssi snr trigger");
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        wl->last_rssi_event = -1;
+
+        acx->pacing = cpu_to_le16(wl->conf.roam_trigger.trigger_pacing);
+        acx->metric = WL1271_ACX_TRIG_METRIC_RSSI_BEACON;
+        acx->type = WL1271_ACX_TRIG_TYPE_EDGE;
+        if (enable)
+                acx->enable = WL1271_ACX_TRIG_ENABLE;
+        else
+                acx->enable = WL1271_ACX_TRIG_DISABLE;
+
+        acx->index = WL1271_ACX_TRIG_IDX_RSSI;
+        acx->dir = WL1271_ACX_TRIG_DIR_BIDIR;
+        acx->threshold = cpu_to_le16(thold);
+        acx->hysteresis = hyst;
+
+        ret = wl1271_cmd_configure(wl, ACX_RSSI_SNR_TRIGGER, acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1271_warning("acx rssi snr trigger setting failed: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
+
+int wl1271_acx_rssi_snr_avg_weights(struct wl1271 *wl)
+{
+        struct wl1271_acx_rssi_snr_avg_weights *acx = NULL;
+        struct conf_roam_trigger_settings *c = &wl->conf.roam_trigger;
+        int ret = 0;
+
+        wl1271_debug(DEBUG_ACX, "acx rssi snr avg weights");
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        acx->rssi_beacon = c->avg_weight_rssi_beacon;
+        acx->rssi_data = c->avg_weight_rssi_data;
+        acx->snr_beacon = c->avg_weight_snr_beacon;
+        acx->snr_data = c->avg_weight_snr_data;
+
+        ret = wl1271_cmd_configure(wl, ACX_RSSI_SNR_WEIGHTS, acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1271_warning("acx rssi snr trigger weights failed: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
diff --git a/drivers/net/wireless/wl12xx/wl1271_acx.h b/drivers/net/wireless/wl12xx/wl1271_acx.h
index aeccc98581e..420e7e2fc02 100644
--- a/drivers/net/wireless/wl12xx/wl1271_acx.h
+++ b/drivers/net/wireless/wl12xx/wl1271_acx.h
@@ -392,81 +392,27 @@ struct acx_conn_monit_params {
        __le32 bss_lose_timeout; /* number of TU's from synch fail */
 } __attribute__ ((packed));
 
-enum {
-        SG_ENABLE = 0,
-        SG_DISABLE,
-        SG_SENSE_NO_ACTIVITY,
-        SG_SENSE_ACTIVE
-};
-
 struct acx_bt_wlan_coex {
         struct acx_header header;
 
-        /*
-         * 0 -> PTA enabled
-         * 1 -> PTA disabled
-         * 2 -> sense no active mode, i.e.
-         *      an interrupt is sent upon
-         *      BT activity.
-         * 3 -> PTA is switched on in response
-         *      to the interrupt sending.
-         */
         u8 enable;
         u8 pad[3];
 } __attribute__ ((packed));
 
-struct acx_dco_itrim_params {
+struct acx_bt_wlan_coex_param {
         struct acx_header header;
 
-        u8 enable;
+        __le32 params[CONF_SG_PARAMS_MAX];
+        u8 param_idx;
         u8 padding[3];
-        __le32 timeout;
 } __attribute__ ((packed));
 
-#define PTA_ANTENNA_TYPE_DEF              (0)
-#define PTA_BT_HP_MAXTIME_DEF             (2000)
-#define PTA_WLAN_HP_MAX_TIME_DEF          (5000)
-#define PTA_SENSE_DISABLE_TIMER_DEF       (1350)
-#define PTA_PROTECTIVE_RX_TIME_DEF        (1500)
-#define PTA_PROTECTIVE_TX_TIME_DEF        (1500)
-#define PTA_TIMEOUT_NEXT_BT_LP_PACKET_DEF (3000)
-#define PTA_SIGNALING_TYPE_DEF            (1)
-#define PTA_AFH_LEVERAGE_ON_DEF           (0)
-#define PTA_NUMBER_QUIET_CYCLE_DEF        (0)
-#define PTA_MAX_NUM_CTS_DEF               (3)
-#define PTA_NUMBER_OF_WLAN_PACKETS_DEF    (2)
-#define PTA_NUMBER_OF_BT_PACKETS_DEF      (2)
-#define PTA_PROTECTIVE_RX_TIME_FAST_DEF   (1500)
-#define PTA_PROTECTIVE_TX_TIME_FAST_DEF   (3000)
-#define PTA_CYCLE_TIME_FAST_DEF           (8700)
-#define PTA_RX_FOR_AVALANCHE_DEF          (5)
-#define PTA_ELP_HP_DEF                    (0)
-#define PTA_ANTI_STARVE_PERIOD_DEF        (500)
-#define PTA_ANTI_STARVE_NUM_CYCLE_DEF     (4)
-#define PTA_ALLOW_PA_SD_DEF               (1)
-#define PTA_TIME_BEFORE_BEACON_DEF        (6300)
-#define PTA_HPDM_MAX_TIME_DEF             (1600)
-#define PTA_TIME_OUT_NEXT_WLAN_DEF        (2550)
-#define PTA_AUTO_MODE_NO_CTS_DEF          (0)
-#define PTA_BT_HP_RESPECTED_DEF           (3)
-#define PTA_WLAN_RX_MIN_RATE_DEF          (24)
-#define PTA_ACK_MODE_DEF                  (1)
-
-struct acx_bt_wlan_coex_param {
+struct acx_dco_itrim_params {
         struct acx_header header;
 
-        __le32 per_threshold;
-        __le32 max_scan_compensation_time;
-        __le16 nfs_sample_interval;
-        u8 load_ratio;
-        u8 auto_ps_mode;
-        u8 probe_req_compensation;
-        u8 scan_window_compensation;
-        u8 antenna_config;
-        u8 beacon_miss_threshold;
-        __le32 rate_adaptation_threshold;
-        s8 rate_adaptation_snr;
+        u8 enable;
         u8 padding[3];
+        __le32 timeout;
 } __attribute__ ((packed));
 
 struct acx_energy_detection {
@@ -969,6 +915,84 @@ struct wl1271_acx_pm_config {
         u8 padding[3];
 } __attribute__ ((packed));
 
+struct wl1271_acx_keep_alive_mode {
+        struct acx_header header;
+
+        u8 enabled;
+        u8 padding[3];
+} __attribute__ ((packed));
+
+enum {
+        ACX_KEEP_ALIVE_NO_TX = 0,
+        ACX_KEEP_ALIVE_PERIOD_ONLY
+};
+
+enum {
+        ACX_KEEP_ALIVE_TPL_INVALID = 0,
+        ACX_KEEP_ALIVE_TPL_VALID
+};
+
+struct wl1271_acx_keep_alive_config {
+        struct acx_header header;
+
+        __le32 period;
+        u8 index;
+        u8 tpl_validation;
+        u8 trigger;
+        u8 padding;
+} __attribute__ ((packed));
+
+enum {
+        WL1271_ACX_TRIG_TYPE_LEVEL = 0,
+        WL1271_ACX_TRIG_TYPE_EDGE,
+};
+
+enum {
+        WL1271_ACX_TRIG_DIR_LOW = 0,
+        WL1271_ACX_TRIG_DIR_HIGH,
+        WL1271_ACX_TRIG_DIR_BIDIR,
+};
+
+enum {
+        WL1271_ACX_TRIG_ENABLE = 1,
+        WL1271_ACX_TRIG_DISABLE,
+};
+
+enum {
+        WL1271_ACX_TRIG_METRIC_RSSI_BEACON = 0,
+        WL1271_ACX_TRIG_METRIC_RSSI_DATA,
+        WL1271_ACX_TRIG_METRIC_SNR_BEACON,
+        WL1271_ACX_TRIG_METRIC_SNR_DATA,
+};
+
+enum {
+        WL1271_ACX_TRIG_IDX_RSSI = 0,
+        WL1271_ACX_TRIG_COUNT = 8,
+};
+
+struct wl1271_acx_rssi_snr_trigger {
+        struct acx_header header;
+
+        __le16 threshold;
+        __le16 pacing; /* 0 - 60000 ms */
+        u8 metric;
+        u8 type;
+        u8 dir;
+        u8 hysteresis;
+        u8 index;
+        u8 enable;
+        u8 padding[2];
+};
+
+struct wl1271_acx_rssi_snr_avg_weights {
+        struct acx_header header;
+
+        u8 rssi_beacon;
+        u8 rssi_data;
+        u8 snr_beacon;
+        u8 snr_data;
+};
+
 enum {
         ACX_WAKE_UP_CONDITIONS      = 0x0002,
         ACX_MEM_CFG                 = 0x0003,
@@ -1017,8 +1041,8 @@ enum {
         ACX_FRAG_CFG                = 0x004F,
         ACX_BET_ENABLE              = 0x0050,
         ACX_RSSI_SNR_TRIGGER        = 0x0051,
-        ACX_RSSI_SNR_WEIGHTS        = 0x0051,
-        ACX_KEEP_ALIVE_MODE         = 0x0052,
+        ACX_RSSI_SNR_WEIGHTS        = 0x0052,
+        ACX_KEEP_ALIVE_MODE         = 0x0053,
         ACX_SET_KEEP_ALIVE_CONFIG   = 0x0054,
         ACX_BA_SESSION_RESPONDER_POLICY = 0x0055,
         ACX_BA_SESSION_INITIATOR_POLICY = 0x0056,
@@ -1058,8 +1082,8 @@ int wl1271_acx_rts_threshold(struct wl1271 *wl, u16 rts_threshold);
 int wl1271_acx_dco_itrim_params(struct wl1271 *wl);
 int wl1271_acx_beacon_filter_opt(struct wl1271 *wl, bool enable_filter);
 int wl1271_acx_beacon_filter_table(struct wl1271 *wl);
-int wl1271_acx_conn_monit_params(struct wl1271 *wl);
-int wl1271_acx_sg_enable(struct wl1271 *wl);
+int wl1271_acx_conn_monit_params(struct wl1271 *wl, bool enable);
+int wl1271_acx_sg_enable(struct wl1271 *wl, bool enable);
 int wl1271_acx_sg_cfg(struct wl1271 *wl);
 int wl1271_acx_cca_threshold(struct wl1271 *wl);
 int wl1271_acx_bcn_dtim_options(struct wl1271 *wl);
@@ -1085,5 +1109,10 @@ int wl1271_acx_bet_enable(struct wl1271 *wl, bool enable);
 int wl1271_acx_arp_ip_filter(struct wl1271 *wl, bool enable, u8 *address,
                              u8 version);
 int wl1271_acx_pm_config(struct wl1271 *wl);
+int wl1271_acx_keep_alive_mode(struct wl1271 *wl, bool enable);
+int wl1271_acx_keep_alive_config(struct wl1271 *wl, u8 index, u8 tpl_valid);
+int wl1271_acx_rssi_snr_trigger(struct wl1271 *wl, bool enable,
+                                s16 thold, u8 hyst);
+int wl1271_acx_rssi_snr_avg_weights(struct wl1271 *wl);
 
 #endif /* __WL1271_ACX_H__ */
diff --git a/drivers/net/wireless/wl12xx/wl1271_boot.c b/drivers/net/wireless/wl12xx/wl1271_boot.c
index 02435626306..1a36d8a2196 100644
--- a/drivers/net/wireless/wl12xx/wl1271_boot.c
+++ b/drivers/net/wireless/wl12xx/wl1271_boot.c
@@ -1,7 +1,7 @@
 /*
  * This file is part of wl1271
  *
- * Copyright (C) 2008-2009 Nokia Corporation
+ * Copyright (C) 2008-2010 Nokia Corporation
  *
  * Contact: Luciano Coelho <luciano.coelho@nokia.com>
  *
@@ -27,7 +27,6 @@
 #include "wl1271_acx.h"
 #include "wl1271_reg.h"
 #include "wl1271_boot.h"
-#include "wl1271_spi.h"
 #include "wl1271_io.h"
 #include "wl1271_event.h"
 
@@ -230,6 +229,14 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
         nvs_len = sizeof(wl->nvs->nvs);
         nvs_ptr = (u8 *)wl->nvs->nvs;
 
+        /* update current MAC address to NVS */
+        nvs_ptr[11] = wl->mac_addr[0];
+        nvs_ptr[10] = wl->mac_addr[1];
+        nvs_ptr[6] = wl->mac_addr[2];
+        nvs_ptr[5] = wl->mac_addr[3];
+        nvs_ptr[4] = wl->mac_addr[4];
+        nvs_ptr[3] = wl->mac_addr[5];
+
         /*
          * Layout before the actual NVS tables:
          * 1 byte : burst length.
@@ -300,7 +307,7 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
 
 static void wl1271_boot_enable_interrupts(struct wl1271 *wl)
 {
-        enable_irq(wl->irq);
+        wl1271_enable_interrupts(wl);
         wl1271_write32(wl, ACX_REG_INTERRUPT_MASK,
                        WL1271_ACX_INTR_ALL & ~(WL1271_INTR_MASK));
         wl1271_write32(wl, HI_CFG, HI_CFG_DEF_VAL);
@@ -344,7 +351,7 @@ static int wl1271_boot_soft_reset(struct wl1271 *wl)
 static int wl1271_boot_run_firmware(struct wl1271 *wl)
 {
         int loop, ret;
-        u32 chip_id, interrupt;
+        u32 chip_id, intr;
 
         wl1271_boot_set_ecpu_ctrl(wl, ECPU_CONTROL_HALT);
 
@@ -361,15 +368,15 @@ static int wl1271_boot_run_firmware(struct wl1271 *wl)
         loop = 0;
         while (loop++ < INIT_LOOP) {
                 udelay(INIT_LOOP_DELAY);
-                interrupt = wl1271_read32(wl, ACX_REG_INTERRUPT_NO_CLEAR);
+                intr = wl1271_read32(wl, ACX_REG_INTERRUPT_NO_CLEAR);
 
-                if (interrupt == 0xffffffff) {
+                if (intr == 0xffffffff) {
                         wl1271_error("error reading hardware complete "
                                      "init indication");
                         return -EIO;
                 }
                 /* check that ACX_INTR_INIT_COMPLETE is enabled */
-                else if (interrupt & WL1271_ACX_INTR_INIT_COMPLETE) {
+                else if (intr & WL1271_ACX_INTR_INIT_COMPLETE) {
                         wl1271_write32(wl, ACX_REG_INTERRUPT_ACK,
                                        WL1271_ACX_INTR_INIT_COMPLETE);
                         break;
@@ -404,7 +411,10 @@ static int wl1271_boot_run_firmware(struct wl1271 *wl)
         /* unmask required mbox events  */
         wl->event_mask = BSS_LOSE_EVENT_ID |
                 SCAN_COMPLETE_EVENT_ID |
-                PS_REPORT_EVENT_ID;
+                PS_REPORT_EVENT_ID |
+                JOIN_EVENT_COMPLETE_ID |
+                DISCONNECT_EVENT_COMPLETE_ID |
+                RSSI_SNR_TRIGGER_0_EVENT_ID;
 
         ret = wl1271_event_unmask(wl);
         if (ret < 0) {
@@ -431,11 +441,23 @@ static int wl1271_boot_write_irq_polarity(struct wl1271 *wl)
         return 0;
 }
 
+static void wl1271_boot_hw_version(struct wl1271 *wl)
+{
+        u32 fuse;
+
+        fuse = wl1271_top_reg_read(wl, REG_FUSE_DATA_2_1);
+        fuse = (fuse & PG_VER_MASK) >> PG_VER_OFFSET;
+
+        wl->hw_pg_ver = (s8)fuse;
+}
+
 int wl1271_boot(struct wl1271 *wl)
 {
         int ret = 0;
         u32 tmp, clk, pause;
 
+        wl1271_boot_hw_version(wl);
+
         if (REF_CLOCK == 0 || REF_CLOCK == 2 || REF_CLOCK == 4)
                 /* ref clk: 19.2/38.4/38.4-XTAL */
                 clk = 0x3;
@@ -445,11 +467,15 @@ int wl1271_boot(struct wl1271 *wl)
 
         if (REF_CLOCK != 0) {
                 u16 val;
-                /* Set clock type */
+                /* Set clock type (open drain) */
                 val = wl1271_top_reg_read(wl, OCP_REG_CLK_TYPE);
                 val &= FREF_CLK_TYPE_BITS;
-                val |= CLK_REQ_PRCM;
                 wl1271_top_reg_write(wl, OCP_REG_CLK_TYPE, val);
+
+                /* Set clock pull mode (no pull) */
+                val = wl1271_top_reg_read(wl, OCP_REG_CLK_PULL);
+                val |= NO_PULL;
+                wl1271_top_reg_write(wl, OCP_REG_CLK_PULL, val);
         } else {
                 u16 val;
                 /* Set clock polarity */
diff --git a/drivers/net/wireless/wl12xx/wl1271_boot.h b/drivers/net/wireless/wl12xx/wl1271_boot.h
index 412443ee655..f829699d597 100644
--- a/drivers/net/wireless/wl12xx/wl1271_boot.h
+++ b/drivers/net/wireless/wl12xx/wl1271_boot.h
@@ -53,10 +53,16 @@ struct wl1271_static_data {
 #define OCP_REG_POLARITY     0x0064
 #define OCP_REG_CLK_TYPE     0x0448
 #define OCP_REG_CLK_POLARITY 0x0cb2
+#define OCP_REG_CLK_PULL     0x0cb4
 
-#define CMD_MBOX_ADDRESS 0x407B4
+#define REG_FUSE_DATA_2_1    0x050a
+#define PG_VER_MASK          0x3c
+#define PG_VER_OFFSET        2
 
-#define POLARITY_LOW BIT(1)
+#define CMD_MBOX_ADDRESS     0x407B4
+
+#define POLARITY_LOW         BIT(1)
+#define NO_PULL              (BIT(14) | BIT(15))
 
 #define FREF_CLK_TYPE_BITS     0xfffffe7f
 #define CLK_REQ_PRCM           0x100
diff --git a/drivers/net/wireless/wl12xx/wl1271_cmd.c b/drivers/net/wireless/wl12xx/wl1271_cmd.c
index e7832f3318e..19393e236e2 100644
--- a/drivers/net/wireless/wl12xx/wl1271_cmd.c
+++ b/drivers/net/wireless/wl12xx/wl1271_cmd.c
@@ -1,7 +1,7 @@
 /*
  * This file is part of wl1271
  *
- * Copyright (C) 2009 Nokia Corporation
+ * Copyright (C) 2009-2010 Nokia Corporation
  *
  * Contact: Luciano Coelho <luciano.coelho@nokia.com>
  *
@@ -26,15 +26,18 @@
 #include <linux/crc7.h>
 #include <linux/spi/spi.h>
 #include <linux/etherdevice.h>
+#include <linux/ieee80211.h>
 #include <linux/slab.h>
 
 #include "wl1271.h"
 #include "wl1271_reg.h"
-#include "wl1271_spi.h"
 #include "wl1271_io.h"
 #include "wl1271_acx.h"
 #include "wl12xx_80211.h"
 #include "wl1271_cmd.h"
+#include "wl1271_event.h"
+
+#define WL1271_CMD_FAST_POLL_COUNT       50
 
 /*
  * send command to firmware
@@ -52,6 +55,7 @@ int wl1271_cmd_send(struct wl1271 *wl, u16 id, void *buf, size_t len,
         u32 intr;
         int ret = 0;
         u16 status;
+        u16 poll_count = 0;
 
         cmd = buf;
         cmd->id = cpu_to_le16(id);
@@ -73,7 +77,11 @@ int wl1271_cmd_send(struct wl1271 *wl, u16 id, void *buf, size_t len,
                         goto out;
                 }
 
-                msleep(1);
+                poll_count++;
+                if (poll_count < WL1271_CMD_FAST_POLL_COUNT)
+                        udelay(10);
+                else
+                        msleep(1);
 
                 intr = wl1271_read32(wl, ACX_REG_INTERRUPT_NO_CLEAR);
         }
@@ -249,7 +257,36 @@ int wl1271_cmd_radio_parms(struct wl1271 *wl)
         return ret;
 }
 
-int wl1271_cmd_join(struct wl1271 *wl)
+/*
+ * Poll the mailbox event field until any of the bits in the mask is set or a
+ * timeout occurs (WL1271_EVENT_TIMEOUT in msecs)
+ */
+static int wl1271_cmd_wait_for_event(struct wl1271 *wl, u32 mask)
+{
+        u32 events_vector, event;
+        unsigned long timeout;
+
+        timeout = jiffies + msecs_to_jiffies(WL1271_EVENT_TIMEOUT);
+
+        do {
+                if (time_after(jiffies, timeout))
+                        return -ETIMEDOUT;
+
+                msleep(1);
+
+                /* read from both event fields */
+                wl1271_read(wl, wl->mbox_ptr[0], &events_vector,
+                            sizeof(events_vector), false);
+                event = events_vector & mask;
+                wl1271_read(wl, wl->mbox_ptr[1], &events_vector,
+                            sizeof(events_vector), false);
+                event |= events_vector & mask;
+        } while (!event);
+
+        return 0;
+}
+
+int wl1271_cmd_join(struct wl1271 *wl, u8 bss_type)
 {
         static bool do_cal = true;
         struct wl1271_cmd_join *join;
@@ -280,30 +317,13 @@ int wl1271_cmd_join(struct wl1271 *wl)
 
         join->rx_config_options = cpu_to_le32(wl->rx_config);
         join->rx_filter_options = cpu_to_le32(wl->rx_filter);
-        join->bss_type = wl->bss_type;
+        join->bss_type = bss_type;
+        join->basic_rate_set = cpu_to_le32(wl->basic_rate_set);
 
-        /*
-         * FIXME: disable temporarily all filters because after commit
-         * 9cef8737 "mac80211: fix managed mode BSSID handling" broke
-         * association. The filter logic needs to be implemented properly
-         * and once that is done, this hack can be removed.
-         */
-        join->rx_config_options = cpu_to_le32(0);
-        join->rx_filter_options = cpu_to_le32(WL1271_DEFAULT_RX_FILTER);
-
-        if (wl->band == IEEE80211_BAND_2GHZ)
-                join->basic_rate_set = cpu_to_le32(CONF_HW_BIT_RATE_1MBPS   |
-                                                   CONF_HW_BIT_RATE_2MBPS   |
-                                                   CONF_HW_BIT_RATE_5_5MBPS |
-                                                   CONF_HW_BIT_RATE_11MBPS);
-        else {
+        if (wl->band == IEEE80211_BAND_5GHZ)
                 join->bss_type |= WL1271_JOIN_CMD_BSS_TYPE_5GHZ;
-                join->basic_rate_set = cpu_to_le32(CONF_HW_BIT_RATE_6MBPS  |
-                                                   CONF_HW_BIT_RATE_12MBPS |
-                                                   CONF_HW_BIT_RATE_24MBPS);
-        }
 
-        join->beacon_interval = cpu_to_le16(WL1271_DEFAULT_BEACON_INT);
+        join->beacon_interval = cpu_to_le16(wl->beacon_int);
         join->dtim_interval = WL1271_DEFAULT_DTIM_PERIOD;
 
         join->channel = wl->channel;
@@ -320,8 +340,7 @@ int wl1271_cmd_join(struct wl1271 *wl)
 
         /* reset TX security counters */
         wl->tx_security_last_seq = 0;
-        wl->tx_security_seq_16 = 0;
-        wl->tx_security_seq_32 = 0;
+        wl->tx_security_seq = 0;
 
         ret = wl1271_cmd_send(wl, CMD_START_JOIN, join, sizeof(*join), 0);
         if (ret < 0) {
@@ -329,11 +348,9 @@ int wl1271_cmd_join(struct wl1271 *wl)
                 goto out_free;
         }
 
-        /*
-         * ugly hack: we should wait for JOIN_EVENT_COMPLETE_ID but to
-         * simplify locking we just sleep instead, for now
-         */
-        msleep(10);
+        ret = wl1271_cmd_wait_for_event(wl, JOIN_EVENT_COMPLETE_ID);
+        if (ret < 0)
+                wl1271_error("cmd join event completion error");
 
 out_free:
         kfree(join);
@@ -465,7 +482,7 @@ int wl1271_cmd_data_path(struct wl1271 *wl, bool enable)
         if (ret < 0) {
                 wl1271_error("tx %s cmd for channel %d failed",
                              enable ? "start" : "stop", cmd->channel);
-                return ret;
+                goto out;
         }
 
         wl1271_debug(DEBUG_BOOT, "tx %s cmd channel %d",
@@ -499,7 +516,7 @@ int wl1271_cmd_ps_mode(struct wl1271 *wl, u8 ps_mode, bool send)
         ps_params->ps_mode = ps_mode;
         ps_params->send_null_data = send;
         ps_params->retries = 5;
-        ps_params->hang_over_period = 128;
+        ps_params->hang_over_period = 1;
         ps_params->null_data_rate = cpu_to_le32(1); /* 1 Mbps */
 
         ret = wl1271_cmd_send(wl, CMD_SET_PS_MODE, ps_params,
@@ -549,25 +566,29 @@ out:
         return ret;
 }
 
-int wl1271_cmd_scan(struct wl1271 *wl, u8 *ssid, size_t len,
-                    u8 active_scan, u8 high_prio, u8 band,
-                    u8 probe_requests)
+int wl1271_cmd_scan(struct wl1271 *wl, const u8 *ssid, size_t ssid_len,
+                    const u8 *ie, size_t ie_len, u8 active_scan,
+                    u8 high_prio, u8 band, u8 probe_requests)
 {
 
         struct wl1271_cmd_trigger_scan_to *trigger = NULL;
         struct wl1271_cmd_scan *params = NULL;
         struct ieee80211_channel *channels;
+        u32 rate;
         int i, j, n_ch, ret;
         u16 scan_options = 0;
         u8 ieee_band;
 
-        if (band == WL1271_SCAN_BAND_2_4_GHZ)
+        if (band == WL1271_SCAN_BAND_2_4_GHZ) {
                 ieee_band = IEEE80211_BAND_2GHZ;
-        else if (band == WL1271_SCAN_BAND_DUAL && wl1271_11a_enabled())
+                rate = wl->conf.tx.basic_rate;
+        } else if (band == WL1271_SCAN_BAND_DUAL && wl1271_11a_enabled()) {
                 ieee_band = IEEE80211_BAND_2GHZ;
-        else if (band == WL1271_SCAN_BAND_5_GHZ && wl1271_11a_enabled())
+                rate = wl->conf.tx.basic_rate;
+        } else if (band == WL1271_SCAN_BAND_5_GHZ && wl1271_11a_enabled()) {
                 ieee_band = IEEE80211_BAND_5GHZ;
-        else
+                rate = wl->conf.tx.basic_rate_5;
+        } else
                 return -EINVAL;
 
         if (wl->hw->wiphy->bands[ieee_band]->channels == NULL)
@@ -594,8 +615,7 @@ int wl1271_cmd_scan(struct wl1271 *wl, u8 *ssid, size_t len,
         params->params.scan_options = cpu_to_le16(scan_options);
 
         params->params.num_probe_requests = probe_requests;
-        /* Let the fw autodetect suitable tx_rate for probes */
-        params->params.tx_rate = 0;
+        params->params.tx_rate = cpu_to_le32(rate);
         params->params.tid_trigger = 0;
         params->params.scan_tag = WL1271_SCAN_DEFAULT_TAG;
 
@@ -622,12 +642,13 @@ int wl1271_cmd_scan(struct wl1271 *wl, u8 *ssid, size_t len,
 
         params->params.num_channels = j;
 
-        if (len && ssid) {
-                params->params.ssid_len = len;
-                memcpy(params->params.ssid, ssid, len);
+        if (ssid_len && ssid) {
+                params->params.ssid_len = ssid_len;
+                memcpy(params->params.ssid, ssid, ssid_len);
         }
 
-        ret = wl1271_cmd_build_probe_req(wl, ssid, len, ieee_band);
+        ret = wl1271_cmd_build_probe_req(wl, ssid, ssid_len,
+                                         ie, ie_len, ieee_band);
         if (ret < 0) {
                 wl1271_error("PROBE request template failed");
                 goto out;
@@ -658,9 +679,9 @@ int wl1271_cmd_scan(struct wl1271 *wl, u8 *ssid, size_t len,
                         wl->scan.active = active_scan;
                         wl->scan.high_prio = high_prio;
                         wl->scan.probe_requests = probe_requests;
-                        if (len && ssid) {
-                                wl->scan.ssid_len = len;
-                                memcpy(wl->scan.ssid, ssid, len);
+                        if (ssid_len && ssid) {
+                                wl->scan.ssid_len = ssid_len;
+                                memcpy(wl->scan.ssid, ssid, ssid_len);
                         } else
                                 wl->scan.ssid_len = 0;
                 }
@@ -675,11 +696,12 @@ int wl1271_cmd_scan(struct wl1271 *wl, u8 *ssid, size_t len,
 
 out:
         kfree(params);
+        kfree(trigger);
         return ret;
 }
 
 int wl1271_cmd_template_set(struct wl1271 *wl, u16 template_id,
-                            void *buf, size_t buf_len)
+                            void *buf, size_t buf_len, int index, u32 rates)
 {
         struct wl1271_cmd_template_set *cmd;
         int ret = 0;
@@ -697,9 +719,10 @@ int wl1271_cmd_template_set(struct wl1271 *wl, u16 template_id,
 
         cmd->len = cpu_to_le16(buf_len);
         cmd->template_type = template_id;
-        cmd->enabled_rates = cpu_to_le32(wl->conf.tx.rc_conf.enabled_rates);
+        cmd->enabled_rates = cpu_to_le32(rates);
         cmd->short_retry_limit = wl->conf.tx.rc_conf.short_retry_limit;
         cmd->long_retry_limit = wl->conf.tx.rc_conf.long_retry_limit;
+        cmd->index = index;
 
         if (buf)
                 memcpy(cmd->template_data, buf, buf_len);
@@ -717,155 +740,129 @@ out:
         return ret;
 }
 
-static int wl1271_build_basic_rates(u8 *rates, u8 band)
+int wl1271_cmd_build_null_data(struct wl1271 *wl)
 {
-        u8 index = 0;
-
-        if (band == IEEE80211_BAND_2GHZ) {
-                rates[index++] =
-                        IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_1MB;
-                rates[index++] =
-                        IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_2MB;
-                rates[index++] =
-                        IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_5MB;
-                rates[index++] =
-                        IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_11MB;
-        } else if (band == IEEE80211_BAND_5GHZ) {
-                rates[index++] =
-                        IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_6MB;
-                rates[index++] =
-                        IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_12MB;
-                rates[index++] =
-                        IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_24MB;
-        } else {
-                wl1271_error("build_basic_rates invalid band: %d", band);
-        }
+        struct sk_buff *skb = NULL;
+        int size;
+        void *ptr;
+        int ret = -ENOMEM;
 
-        return index;
-}
 
-static int wl1271_build_extended_rates(u8 *rates, u8 band)
-{
-        u8 index = 0;
-
-        if (band == IEEE80211_BAND_2GHZ) {
-                rates[index++] = IEEE80211_OFDM_RATE_6MB;
-                rates[index++] = IEEE80211_OFDM_RATE_9MB;
-                rates[index++] = IEEE80211_OFDM_RATE_12MB;
-                rates[index++] = IEEE80211_OFDM_RATE_18MB;
-                rates[index++] = IEEE80211_OFDM_RATE_24MB;
-                rates[index++] = IEEE80211_OFDM_RATE_36MB;
-                rates[index++] = IEEE80211_OFDM_RATE_48MB;
-                rates[index++] = IEEE80211_OFDM_RATE_54MB;
-        } else if (band == IEEE80211_BAND_5GHZ) {
-                rates[index++] =
-                        IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_9MB;
-                rates[index++] =
-                        IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_18MB;
-                rates[index++] =
-                        IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_24MB;
-                rates[index++] =
-                        IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_36MB;
-                rates[index++] =
-                        IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_48MB;
-                rates[index++] =
-                        IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_54MB;
+        if (wl->bss_type == BSS_TYPE_IBSS) {
+                size = sizeof(struct wl12xx_null_data_template);
+                ptr = NULL;
         } else {
-                wl1271_error("build_basic_rates invalid band: %d", band);
+                skb = ieee80211_nullfunc_get(wl->hw, wl->vif);
+                if (!skb)
+                        goto out;
+                size = skb->len;
+                ptr = skb->data;
         }
 
-        return index;
+        ret = wl1271_cmd_template_set(wl, CMD_TEMPL_NULL_DATA, ptr, size, 0,
+                                      WL1271_RATE_AUTOMATIC);
+
+out:
+        dev_kfree_skb(skb);
+        if (ret)
+                wl1271_warning("cmd buld null data failed %d", ret);
+
+        return ret;
+
 }
 
-int wl1271_cmd_build_null_data(struct wl1271 *wl)
+int wl1271_cmd_build_klv_null_data(struct wl1271 *wl)
 {
-        struct wl12xx_null_data_template template;
+        struct sk_buff *skb = NULL;
+        int ret = -ENOMEM;
 
-        if (!is_zero_ether_addr(wl->bssid)) {
-                memcpy(template.header.da, wl->bssid, ETH_ALEN);
-                memcpy(template.header.bssid, wl->bssid, ETH_ALEN);
-        } else {
-                memset(template.header.da, 0xff, ETH_ALEN);
-                memset(template.header.bssid, 0xff, ETH_ALEN);
-        }
+        skb = ieee80211_nullfunc_get(wl->hw, wl->vif);
+        if (!skb)
+                goto out;
+
+        ret = wl1271_cmd_template_set(wl, CMD_TEMPL_KLV,
+                                      skb->data, skb->len,
+                                      CMD_TEMPL_KLV_IDX_NULL_DATA,
+                                      WL1271_RATE_AUTOMATIC);
 
-        memcpy(template.header.sa, wl->mac_addr, ETH_ALEN);
-        template.header.frame_ctl = cpu_to_le16(IEEE80211_FTYPE_DATA |
-                                                IEEE80211_STYPE_NULLFUNC |
-                                                IEEE80211_FCTL_TODS);
+out:
+        dev_kfree_skb(skb);
+        if (ret)
+                wl1271_warning("cmd build klv null data failed %d", ret);
 
-        return wl1271_cmd_template_set(wl, CMD_TEMPL_NULL_DATA, &template,
-                                       sizeof(template));
+        return ret;
 
 }
 
 int wl1271_cmd_build_ps_poll(struct wl1271 *wl, u16 aid)
 {
-        struct wl12xx_ps_poll_template template;
-
-        memcpy(template.bssid, wl->bssid, ETH_ALEN);
-        memcpy(template.ta, wl->mac_addr, ETH_ALEN);
-
-        /* aid in PS-Poll has its two MSBs each set to 1 */
-        template.aid = cpu_to_le16(1 << 15 | 1 << 14 | aid);
+        struct sk_buff *skb;
+        int ret = 0;
 
-        template.fc = cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_PSPOLL);
+        skb = ieee80211_pspoll_get(wl->hw, wl->vif);
+        if (!skb)
+                goto out;
 
-        return wl1271_cmd_template_set(wl, CMD_TEMPL_PS_POLL, &template,
-                                       sizeof(template));
+        ret = wl1271_cmd_template_set(wl, CMD_TEMPL_PS_POLL, skb->data,
+                                      skb->len, 0, wl->basic_rate);
 
+out:
+        dev_kfree_skb(skb);
+        return ret;
 }
 
-int wl1271_cmd_build_probe_req(struct wl1271 *wl, u8 *ssid, size_t ssid_len,
-                               u8 band)
+int wl1271_cmd_build_probe_req(struct wl1271 *wl,
+                               const u8 *ssid, size_t ssid_len,
+                               const u8 *ie, size_t ie_len, u8 band)
 {
-        struct wl12xx_probe_req_template template;
-        struct wl12xx_ie_rates *rates;
-        char *ptr;
-        u16 size;
+        struct sk_buff *skb;
         int ret;
 
-        ptr = (char *)&template;
-        size = sizeof(struct ieee80211_header);
-
-        memset(template.header.da, 0xff, ETH_ALEN);
-        memset(template.header.bssid, 0xff, ETH_ALEN);
-        memcpy(template.header.sa, wl->mac_addr, ETH_ALEN);
-        template.header.frame_ctl = cpu_to_le16(IEEE80211_STYPE_PROBE_REQ);
-
-        /* IEs */
-        /* SSID */
-        template.ssid.header.id = WLAN_EID_SSID;
-        template.ssid.header.len = ssid_len;
-        if (ssid_len && ssid)
-                memcpy(template.ssid.ssid, ssid, ssid_len);
-        size += sizeof(struct wl12xx_ie_header) + ssid_len;
-        ptr += size;
-
-        /* Basic Rates */
-        rates = (struct wl12xx_ie_rates *)ptr;
-        rates->header.id = WLAN_EID_SUPP_RATES;
-        rates->header.len = wl1271_build_basic_rates(rates->rates, band);
-        size += sizeof(struct wl12xx_ie_header) + rates->header.len;
-        ptr += sizeof(struct wl12xx_ie_header) + rates->header.len;
-
-        /* Extended rates */
-        rates = (struct wl12xx_ie_rates *)ptr;
-        rates->header.id = WLAN_EID_EXT_SUPP_RATES;
-        rates->header.len = wl1271_build_extended_rates(rates->rates, band);
-        size += sizeof(struct wl12xx_ie_header) + rates->header.len;
-
-        wl1271_dump(DEBUG_SCAN, "PROBE REQ: ", &template, size);
+        skb = ieee80211_probereq_get(wl->hw, wl->vif, ssid, ssid_len,
+                                     ie, ie_len);
+        if (!skb) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        wl1271_dump(DEBUG_SCAN, "PROBE REQ: ", skb->data, skb->len);
 
         if (band == IEEE80211_BAND_2GHZ)
                 ret = wl1271_cmd_template_set(wl, CMD_TEMPL_CFG_PROBE_REQ_2_4,
-                                              &template, size);
+                                              skb->data, skb->len, 0,
+                                              wl->conf.tx.basic_rate);
         else
                 ret = wl1271_cmd_template_set(wl, CMD_TEMPL_CFG_PROBE_REQ_5,
-                                              &template, size);
+                                              skb->data, skb->len, 0,
+                                              wl->conf.tx.basic_rate_5);
+
+out:
+        dev_kfree_skb(skb);
         return ret;
 }
 
+int wl1271_build_qos_null_data(struct wl1271 *wl)
+{
+        struct ieee80211_qos_hdr template;
+
+        memset(&template, 0, sizeof(template));
+
+        memcpy(template.addr1, wl->bssid, ETH_ALEN);
+        memcpy(template.addr2, wl->mac_addr, ETH_ALEN);
+        memcpy(template.addr3, wl->bssid, ETH_ALEN);
+
+        template.frame_control = cpu_to_le16(IEEE80211_FTYPE_DATA |
+                                             IEEE80211_STYPE_QOS_NULLFUNC |
+                                             IEEE80211_FCTL_TODS);
+
+        /* FIXME: not sure what priority to use here */
+        template.qos_ctrl = cpu_to_le16(0);
+
+        return wl1271_cmd_template_set(wl, CMD_TEMPL_QOS_NULL_DATA, &template,
+                                       sizeof(template), 0,
+                                       WL1271_RATE_AUTOMATIC);
+}
+
 int wl1271_cmd_set_default_wep_key(struct wl1271 *wl, u8 id)
 {
         struct wl1271_cmd_set_keys *cmd;
@@ -976,6 +973,10 @@ int wl1271_cmd_disconnect(struct wl1271 *wl)
                 goto out_free;
         }
 
+        ret = wl1271_cmd_wait_for_event(wl, DISCONNECT_EVENT_COMPLETE_ID);
+        if (ret < 0)
+                wl1271_error("cmd disconnect event completion error");
+
 out_free:
         kfree(cmd);
 
diff --git a/drivers/net/wireless/wl12xx/wl1271_cmd.h b/drivers/net/wireless/wl12xx/wl1271_cmd.h
index 2dc06c73532..f2820b42a94 100644
--- a/drivers/net/wireless/wl12xx/wl1271_cmd.h
+++ b/drivers/net/wireless/wl12xx/wl1271_cmd.h
@@ -33,7 +33,7 @@ int wl1271_cmd_send(struct wl1271 *wl, u16 id, void *buf, size_t len,
                     size_t res_len);
 int wl1271_cmd_general_parms(struct wl1271 *wl);
 int wl1271_cmd_radio_parms(struct wl1271 *wl);
-int wl1271_cmd_join(struct wl1271 *wl);
+int wl1271_cmd_join(struct wl1271 *wl, u8 bss_type);
 int wl1271_cmd_test(struct wl1271 *wl, void *buf, size_t buf_len, u8 answer);
 int wl1271_cmd_interrogate(struct wl1271 *wl, u16 id, void *buf, size_t len);
 int wl1271_cmd_configure(struct wl1271 *wl, u16 id, void *buf, size_t len);
@@ -41,15 +41,18 @@ int wl1271_cmd_data_path(struct wl1271 *wl, bool enable);
 int wl1271_cmd_ps_mode(struct wl1271 *wl, u8 ps_mode, bool send);
 int wl1271_cmd_read_memory(struct wl1271 *wl, u32 addr, void *answer,
                            size_t len);
-int wl1271_cmd_scan(struct wl1271 *wl, u8 *ssid, size_t len,
-                    u8 active_scan, u8 high_prio, u8 band,
-                    u8 probe_requests);
+int wl1271_cmd_scan(struct wl1271 *wl, const u8 *ssid, size_t ssid_len,
+                    const u8 *ie, size_t ie_len, u8 active_scan,
+                    u8 high_prio, u8 band, u8 probe_requests);
 int wl1271_cmd_template_set(struct wl1271 *wl, u16 template_id,
-                            void *buf, size_t buf_len);
+                            void *buf, size_t buf_len, int index, u32 rates);
 int wl1271_cmd_build_null_data(struct wl1271 *wl);
 int wl1271_cmd_build_ps_poll(struct wl1271 *wl, u16 aid);
-int wl1271_cmd_build_probe_req(struct wl1271 *wl, u8 *ssid, size_t ssid_len,
-                               u8 band);
+int wl1271_cmd_build_probe_req(struct wl1271 *wl,
+                               const u8 *ssid, size_t ssid_len,
+                               const u8 *ie, size_t ie_len, u8 band);
+int wl1271_build_qos_null_data(struct wl1271 *wl);
+int wl1271_cmd_build_klv_null_data(struct wl1271 *wl);
 int wl1271_cmd_set_default_wep_key(struct wl1271 *wl, u8 id);
 int wl1271_cmd_set_key(struct wl1271 *wl, u16 action, u8 id, u8 key_type,
                        u8 key_size, const u8 *key, const u8 *addr,
@@ -99,6 +102,11 @@ enum wl1271_commands {
 
 #define MAX_CMD_PARAMS 572
 
+enum {
+        CMD_TEMPL_KLV_IDX_NULL_DATA = 0,
+        CMD_TEMPL_KLV_IDX_MAX = 4
+};
+
 enum cmd_templ {
         CMD_TEMPL_NULL_DATA = 0,
         CMD_TEMPL_BEACON,
@@ -121,6 +129,7 @@ enum cmd_templ {
 /* unit ms */
 #define WL1271_COMMAND_TIMEOUT     2000
 #define WL1271_CMD_TEMPL_MAX_SIZE  252
+#define WL1271_EVENT_TIMEOUT       750
 
 struct wl1271_cmd_header {
         __le16 id;
@@ -243,6 +252,8 @@ struct cmd_enabledisable_path {
         u8 padding[3];
 } __attribute__ ((packed));
 
+#define WL1271_RATE_AUTOMATIC  0
+
 struct wl1271_cmd_template_set {
         struct wl1271_cmd_header header;
 
@@ -509,6 +520,8 @@ enum wl1271_disconnect_type {
 };
 
 struct wl1271_cmd_disconnect {
+        struct wl1271_cmd_header header;
+
         __le32 rx_config_options;
         __le32 rx_filter_options;
 
diff --git a/drivers/net/wireless/wl12xx/wl1271_conf.h b/drivers/net/wireless/wl12xx/wl1271_conf.h
index 6f9e75cc564..d046d044b5b 100644
--- a/drivers/net/wireless/wl12xx/wl1271_conf.h
+++ b/drivers/net/wireless/wl12xx/wl1271_conf.h
@@ -65,110 +65,344 @@ enum {
         CONF_HW_RATE_INDEX_MAX     = CONF_HW_RATE_INDEX_54MBPS,
 };
 
-struct conf_sg_settings {
+enum {
+        CONF_HW_RXTX_RATE_MCS7 = 0,
+        CONF_HW_RXTX_RATE_MCS6,
+        CONF_HW_RXTX_RATE_MCS5,
+        CONF_HW_RXTX_RATE_MCS4,
+        CONF_HW_RXTX_RATE_MCS3,
+        CONF_HW_RXTX_RATE_MCS2,
+        CONF_HW_RXTX_RATE_MCS1,
+        CONF_HW_RXTX_RATE_MCS0,
+        CONF_HW_RXTX_RATE_54,
+        CONF_HW_RXTX_RATE_48,
+        CONF_HW_RXTX_RATE_36,
+        CONF_HW_RXTX_RATE_24,
+        CONF_HW_RXTX_RATE_22,
+        CONF_HW_RXTX_RATE_18,
+        CONF_HW_RXTX_RATE_12,
+        CONF_HW_RXTX_RATE_11,
+        CONF_HW_RXTX_RATE_9,
+        CONF_HW_RXTX_RATE_6,
+        CONF_HW_RXTX_RATE_5_5,
+        CONF_HW_RXTX_RATE_2,
+        CONF_HW_RXTX_RATE_1,
+        CONF_HW_RXTX_RATE_MAX,
+        CONF_HW_RXTX_RATE_UNSUPPORTED = 0xff
+};
+
+enum {
+        CONF_SG_DISABLE = 0,
+        CONF_SG_PROTECTIVE,
+        CONF_SG_OPPORTUNISTIC
+};
+
+enum {
         /*
-         * Defines the PER threshold in PPM of the BT voice of which reaching
-         * this value will trigger raising the priority of the BT voice by
-         * the BT IP until next NFS sample interval time as defined in
-         * nfs_sample_interval.
+         * PER threshold in PPM of the BT voice
          *
-         * Unit: PER value in PPM (parts per million)
-         * #Error_packets / #Total_packets
+         * Range: 0 - 10000000
+         */
+        CONF_SG_BT_PER_THRESHOLD = 0,
 
-         * Range: u32
+        /*
+         * Number of consequent RX_ACTIVE activities to override BT voice
+         * frames to ensure WLAN connection
+         *
+         * Range: 0 - 100
+         */
+        CONF_SG_HV3_MAX_OVERRIDE,
+
+        /*
+         * Defines the PER threshold of the BT voice
+         *
+         * Range: 0 - 65000
+         */
+        CONF_SG_BT_NFS_SAMPLE_INTERVAL,
+
+        /*
+         * Defines the load ratio of BT
+         *
+         * Range: 0 - 100 (%)
+         */
+        CONF_SG_BT_LOAD_RATIO,
+
+        /*
+         * Defines whether the SG will force WLAN host to enter/exit PSM
+         *
+         * Range: 1 - SG can force, 0 - host handles PSM
+         */
+        CONF_SG_AUTO_PS_MODE,
+
+        /*
+         * Compensation percentage of probe requests when scan initiated
+         * during BT voice/ACL link.
+         *
+         * Range: 0 - 255 (%)
+         */
+        CONF_SG_AUTO_SCAN_PROBE_REQ,
+
+        /*
+         * Compensation percentage of probe requests when active scan initiated
+         * during BT voice
+         *
+         * Range: 0 - 255 (%)
+         */
+        CONF_SG_ACTIVE_SCAN_DURATION_FACTOR_HV3,
+
+        /*
+         * Defines antenna configuration (single/dual antenna)
+         *
+         * Range: 0 - single antenna, 1 - dual antenna
+         */
+        CONF_SG_ANTENNA_CONFIGURATION,
+
+        /*
+         * The threshold (percent) of max consequtive beacon misses before
+         * increasing priority of beacon reception.
+         *
+         * Range: 0 - 100 (%)
+         */
+        CONF_SG_BEACON_MISS_PERCENT,
+
+        /*
+         * The rate threshold below which receiving a data frame from the AP
+         * will increase the priority of the data frame above BT traffic.
+         *
+         * Range: 0,2, 5(=5.5), 6, 9, 11, 12, 18, 24, 36, 48, 54
+         */
+        CONF_SG_RATE_ADAPT_THRESH,
+
+        /*
+         * Not used currently.
+         *
+         * Range: 0
+         */
+        CONF_SG_RATE_ADAPT_SNR,
+
+        /*
+         * Configure the min and max time BT gains the antenna
+         * in WLAN PSM / BT master basic rate
+         *
+         * Range: 0 - 255 (ms)
+         */
+        CONF_SG_WLAN_PS_BT_ACL_MASTER_MIN_BR,
+        CONF_SG_WLAN_PS_BT_ACL_MASTER_MAX_BR,
+
+        /*
+         * The time after it expires no new WLAN trigger frame is trasmitted
+         * in WLAN PSM / BT master basic rate
+         *
+         * Range: 0 - 255 (ms)
+         */
+        CONF_SG_WLAN_PS_MAX_BT_ACL_MASTER_BR,
+
+        /*
+         * Configure the min and max time BT gains the antenna
+         * in WLAN PSM / BT slave basic rate
+         *
+         * Range: 0 - 255 (ms)
+         */
+        CONF_SG_WLAN_PS_BT_ACL_SLAVE_MIN_BR,
+        CONF_SG_WLAN_PS_BT_ACL_SLAVE_MAX_BR,
+
+        /*
+         * The time after it expires no new WLAN trigger frame is trasmitted
+         * in WLAN PSM / BT slave basic rate
+         *
+         * Range: 0 - 255 (ms)
+         */
+        CONF_SG_WLAN_PS_MAX_BT_ACL_SLAVE_BR,
+
+        /*
+         * Configure the min and max time BT gains the antenna
+         * in WLAN PSM / BT master EDR
+         *
+         * Range: 0 - 255 (ms)
+         */
+        CONF_SG_WLAN_PS_BT_ACL_MASTER_MIN_EDR,
+        CONF_SG_WLAN_PS_BT_ACL_MASTER_MAX_EDR,
+
+        /*
+         * The time after it expires no new WLAN trigger frame is trasmitted
+         * in WLAN PSM / BT master EDR
+         *
+         * Range: 0 - 255 (ms)
+         */
+        CONF_SG_WLAN_PS_MAX_BT_ACL_MASTER_EDR,
+
+        /*
+         * Configure the min and max time BT gains the antenna
+         * in WLAN PSM / BT slave EDR
+         *
+         * Range: 0 - 255 (ms)
+         */
+        CONF_SG_WLAN_PS_BT_ACL_SLAVE_MIN_EDR,
+        CONF_SG_WLAN_PS_BT_ACL_SLAVE_MAX_EDR,
+
+        /*
+         * The time after it expires no new WLAN trigger frame is trasmitted
+         * in WLAN PSM / BT slave EDR
+         *
+         * Range: 0 - 255 (ms)
+         */
+        CONF_SG_WLAN_PS_MAX_BT_ACL_SLAVE_EDR,
+
+        /*
+         * RX guard time before the beginning of a new BT voice frame during
+         * which no new WLAN trigger frame is transmitted.
+         *
+         * Range: 0 - 100000 (us)
+         */
+        CONF_SG_RXT,
+
+        /*
+         * TX guard time before the beginning of a new BT voice frame during
+         * which no new WLAN frame is transmitted.
+         *
+         * Range: 0 - 100000 (us)
+         */
+
+        CONF_SG_TXT,
+
+        /*
+         * Enable adaptive RXT/TXT algorithm. If disabled, the host values
+         * will be utilized.
+         *
+         * Range: 0 - disable, 1 - enable
+         */
+        CONF_SG_ADAPTIVE_RXT_TXT,
+
+        /*
+         * The used WLAN legacy service period during active BT ACL link
+         *
+         * Range: 0 - 255 (ms)
+         */
+        CONF_SG_PS_POLL_TIMEOUT,
+
+        /*
+         * The used WLAN UPSD service period during active BT ACL link
+         *
+         * Range: 0 - 255 (ms)
          */
-        u32 per_threshold;
+        CONF_SG_UPSD_TIMEOUT,
 
         /*
-         * This value is an absolute time in micro-seconds to limit the
-         * maximum scan duration compensation while in SG
+         * Configure the min and max time BT gains the antenna
+         * in WLAN Active / BT master EDR
+         *
+         * Range: 0 - 255 (ms)
          */
-        u32 max_scan_compensation_time;
+        CONF_SG_WLAN_ACTIVE_BT_ACL_MASTER_MIN_EDR,
+        CONF_SG_WLAN_ACTIVE_BT_ACL_MASTER_MAX_EDR,
 
-        /* Defines the PER threshold of the BT voice of which reaching this
-         * value will trigger raising the priority of the BT voice until next
-         * NFS sample interval time as defined in sample_interval.
+        /*
+         * The maximum time WLAN can gain the antenna for
+         * in WLAN Active / BT master EDR
          *
-         * Unit: msec
-         * Range: 1-65000
+         * Range: 0 - 255 (ms)
          */
-        u16 nfs_sample_interval;
+        CONF_SG_WLAN_ACTIVE_MAX_BT_ACL_MASTER_EDR,
 
         /*
-         * Defines the load ratio for the BT.
-         * The WLAN ratio is: 100 - load_ratio
+         * Configure the min and max time BT gains the antenna
+         * in WLAN Active / BT slave EDR
          *
-         * Unit: Percent
-         * Range: 0-100
+         * Range: 0 - 255 (ms)
          */
-        u8 load_ratio;
+        CONF_SG_WLAN_ACTIVE_BT_ACL_SLAVE_MIN_EDR,
+        CONF_SG_WLAN_ACTIVE_BT_ACL_SLAVE_MAX_EDR,
 
         /*
-         * true - Co-ex is allowed to enter/exit P.S automatically and
-         *        transparently to the host
+         * The maximum time WLAN can gain the antenna for
+         * in WLAN Active / BT slave EDR
          *
-         * false - Co-ex is disallowed to enter/exit P.S and will trigger an
-         *         event to the host to notify for the need to enter/exit P.S
-         *         due to BT change state
+         * Range: 0 - 255 (ms)
+         */
+        CONF_SG_WLAN_ACTIVE_MAX_BT_ACL_SLAVE_EDR,
+
+        /*
+         * Configure the min and max time BT gains the antenna
+         * in WLAN Active / BT basic rate
+         *
+         * Range: 0 - 255 (ms)
+         */
+        CONF_SG_WLAN_ACTIVE_BT_ACL_MIN_BR,
+        CONF_SG_WLAN_ACTIVE_BT_ACL_MAX_BR,
+
+        /*
+         * The maximum time WLAN can gain the antenna for
+         * in WLAN Active / BT basic rate
          *
+         * Range: 0 - 255 (ms)
          */
-        u8 auto_ps_mode;
+        CONF_SG_WLAN_ACTIVE_MAX_BT_ACL_BR,
 
         /*
-         * This parameter defines the compensation percentage of num of probe
-         * requests in case scan is initiated during BT voice/BT ACL
-         * guaranteed link.
+         * Compensation percentage of WLAN passive scan window if initiated
+         * during BT voice
          *
-         * Unit: Percent
-         * Range: 0-255 (0 - No compensation)
+         * Range: 0 - 1000 (%)
          */
-        u8 probe_req_compensation;
+        CONF_SG_PASSIVE_SCAN_DURATION_FACTOR_HV3,
 
         /*
-         * This parameter defines the compensation percentage of scan window
-         * size in case scan is initiated during BT voice/BT ACL Guaranteed
-         * link.
+         * Compensation percentage of WLAN passive scan window if initiated
+         * during BT A2DP
          *
-         * Unit: Percent
-         * Range: 0-255 (0 - No compensation)
+         * Range: 0 - 1000 (%)
          */
-        u8 scan_window_compensation;
+        CONF_SG_PASSIVE_SCAN_DURATION_FACTOR_A2DP,
 
         /*
-         * Defines the antenna configuration.
+         * Fixed time ensured for BT traffic to gain the antenna during WLAN
+         * passive scan.
          *
-         * Range: 0 - Single Antenna; 1 - Dual Antenna
+         * Range: 0 - 1000 ms
          */
-        u8 antenna_config;
+        CONF_SG_PASSIVE_SCAN_A2DP_BT_TIME,
 
         /*
-         * The percent out of the Max consecutive beacon miss roaming trigger
-         * which is the threshold for raising the priority of beacon
-         * reception.
+         * Fixed time ensured for WLAN traffic to gain the antenna during WLAN
+         * passive scan.
          *
-         * Range: 1-100
-         * N = MaxConsecutiveBeaconMiss
-         * P = coexMaxConsecutiveBeaconMissPrecent
-         * Threshold = MIN( N-1, round(N * P / 100))
+         * Range: 0 - 1000 ms
          */
-        u8 beacon_miss_threshold;
+        CONF_SG_PASSIVE_SCAN_A2DP_WLAN_TIME,
 
         /*
-         * The RX rate threshold below which rate adaptation is assumed to be
-         * occurring at the AP which will raise priority for ACTIVE_RX and RX
-         * SP.
+         * Number of consequent BT voice frames not interrupted by WLAN
          *
-         * Range: HW_BIT_RATE_*
+         * Range: 0 - 100
          */
-        u32 rate_adaptation_threshold;
+        CONF_SG_HV3_MAX_SERVED,
 
         /*
-         * The SNR above which the RX rate threshold indicating AP rate
-         * adaptation is valid
+         * Protection time of the DHCP procedure.
          *
-         * Range: -128 - 127
+         * Range: 0 - 100000 (ms)
          */
-        s8 rate_adaptation_snr;
+        CONF_SG_DHCP_TIME,
+
+        /*
+         * Compensation percentage of WLAN active scan window if initiated
+         * during BT A2DP
+         *
+         * Range: 0 - 1000 (%)
+         */
+        CONF_SG_ACTIVE_SCAN_DURATION_FACTOR_A2DP,
+        CONF_SG_TEMP_PARAM_1,
+        CONF_SG_TEMP_PARAM_2,
+        CONF_SG_TEMP_PARAM_3,
+        CONF_SG_TEMP_PARAM_4,
+        CONF_SG_TEMP_PARAM_5,
+        CONF_SG_PARAMS_MAX,
+        CONF_SG_PARAMS_ALL = 0xff
+};
+
+struct conf_sg_settings {
+        u32 params[CONF_SG_PARAMS_MAX];
+        u8 state;
 };
 
 enum conf_rx_queue_type {
@@ -440,6 +674,19 @@ struct conf_tx_settings {
          */
         u16 tx_compl_threshold;
 
+        /*
+         * The rate used for control messages and scanning on the 2.4GHz band
+         *
+         * Range: CONF_HW_BIT_RATE_* bit mask
+         */
+        u32 basic_rate;
+
+        /*
+         * The rate used for control messages and scanning on the 5GHz band
+         *
+         * Range: CONF_HW_BIT_RATE_* bit mask
+         */
+        u32 basic_rate_5;
 };
 
 enum {
@@ -509,65 +756,6 @@ enum {
         CONF_TRIG_EVENT_DIR_BIDIR
 };
 
-
-struct conf_sig_trigger {
-        /*
-         * The RSSI / SNR threshold value.
-         *
-         * FIXME: what is the range?
-         */
-        s16 threshold;
-
-        /*
-         * Minimum delay between two trigger events for this trigger in ms.
-         *
-         * Range: 0 - 60000
-         */
-        u16 pacing;
-
-        /*
-         * The measurement data source for this trigger.
-         *
-         * Range: CONF_TRIG_METRIC_*
-         */
-        u8 metric;
-
-        /*
-         * The trigger type of this trigger.
-         *
-         * Range: CONF_TRIG_EVENT_TYPE_*
-         */
-        u8 type;
-
-        /*
-         * The direction of the trigger.
-         *
-         * Range: CONF_TRIG_EVENT_DIR_*
-         */
-        u8 direction;
-
-        /*
-         * Hysteresis range of the trigger around the threshold (in dB)
-         *
-         * Range: u8
-         */
-        u8 hysteresis;
-
-        /*
-         * Index of the trigger rule.
-         *
-         * Range: 0 - CONF_MAX_RSSI_SNR_TRIGGERS-1
-         */
-        u8 index;
-
-        /*
-         * Enable / disable this rule (to use for clearing rules.)
-         *
-         * Range: 1 - Enabled, 2 - Not enabled
-         */
-        u8 enable;
-};
-
 struct conf_sig_weights {
 
         /*
@@ -686,12 +874,6 @@ struct conf_conn_settings {
         u8 ps_poll_threshold;
 
         /*
-         * Configuration of signal (rssi/snr) triggers.
-         */
-        u8 sig_trigger_count;
-        struct conf_sig_trigger sig_trigger[CONF_MAX_RSSI_SNR_TRIGGERS];
-
-        /*
          * Configuration of signal average weights.
          */
         struct conf_sig_weights sig_weights;
@@ -721,6 +903,22 @@ struct conf_conn_settings {
          * Range 0 - 255
          */
         u8 psm_entry_retries;
+
+        /*
+         *
+         * Specifies the interval of the connection keep-alive null-func
+         * frame in ms.
+         *
+         * Range: 1000 - 3600000
+         */
+        u32 keep_alive_interval;
+
+        /*
+         * Maximum listen interval supported by the driver in units of beacons.
+         *
+         * Range: u16
+         */
+        u8 max_listen_interval;
 };
 
 enum {
@@ -782,6 +980,43 @@ struct conf_pm_config_settings {
         bool host_fast_wakeup_support;
 };
 
+struct conf_roam_trigger_settings {
+        /*
+         * The minimum interval between two trigger events.
+         *
+         * Range: 0 - 60000 ms
+         */
+        u16 trigger_pacing;
+
+        /*
+         * The weight for rssi/beacon average calculation
+         *
+         * Range: 0 - 255
+         */
+        u8 avg_weight_rssi_beacon;
+
+        /*
+         * The weight for rssi/data frame average calculation
+         *
+         * Range: 0 - 255
+         */
+        u8 avg_weight_rssi_data;
+
+        /*
+         * The weight for snr/beacon average calculation
+         *
+         * Range: 0 - 255
+         */
+        u8 avg_weight_snr_beacon;
+
+        /*
+         * The weight for snr/data frame average calculation
+         *
+         * Range: 0 - 255
+         */
+        u8 avg_weight_snr_data;
+};
+
 struct conf_drv_settings {
         struct conf_sg_settings sg;
         struct conf_rx_settings rx;
@@ -790,6 +1025,7 @@ struct conf_drv_settings {
         struct conf_init_settings init;
         struct conf_itrim_settings itrim;
         struct conf_pm_config_settings pm_config;
+        struct conf_roam_trigger_settings roam_trigger;
 };
 
 #endif
diff --git a/drivers/net/wireless/wl12xx/wl1271_debugfs.c b/drivers/net/wireless/wl12xx/wl1271_debugfs.c
index 3f7ff8d0cf5..c239ef4d0b8 100644
--- a/drivers/net/wireless/wl12xx/wl1271_debugfs.c
+++ b/drivers/net/wireless/wl12xx/wl1271_debugfs.c
@@ -29,6 +29,7 @@
 #include "wl1271.h"
 #include "wl1271_acx.h"
 #include "wl1271_ps.h"
+#include "wl1271_io.h"
 
 /* ms */
 #define WL1271_DEBUGFS_STATS_LIFETIME 1000
@@ -277,13 +278,10 @@ static ssize_t gpio_power_write(struct file *file,
                 goto out;
         }
 
-        if (value) {
-                wl->set_power(true);
-                set_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);
-        } else {
-                wl->set_power(false);
-                clear_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);
-        }
+        if (value)
+                wl1271_power_on(wl);
+        else
+                wl1271_power_off(wl);
 
 out:
         mutex_unlock(&wl->mutex);
diff --git a/drivers/net/wireless/wl12xx/wl1271_event.c b/drivers/net/wireless/wl12xx/wl1271_event.c
index 7468ef10194..cf37aa6eb13 100644
--- a/drivers/net/wireless/wl12xx/wl1271_event.c
+++ b/drivers/net/wireless/wl12xx/wl1271_event.c
@@ -23,7 +23,6 @@
 
 #include "wl1271.h"
 #include "wl1271_reg.h"
-#include "wl1271_spi.h"
 #include "wl1271_io.h"
 #include "wl1271_event.h"
 #include "wl1271_ps.h"
@@ -32,34 +31,24 @@
 static int wl1271_event_scan_complete(struct wl1271 *wl,
                                       struct event_mailbox *mbox)
 {
-        int size = sizeof(struct wl12xx_probe_req_template);
         wl1271_debug(DEBUG_EVENT, "status: 0x%x",
                      mbox->scheduled_scan_status);
 
         if (test_bit(WL1271_FLAG_SCANNING, &wl->flags)) {
                 if (wl->scan.state == WL1271_SCAN_BAND_DUAL) {
-                        wl1271_cmd_template_set(wl, CMD_TEMPL_CFG_PROBE_REQ_2_4,
-                                                NULL, size);
                         /* 2.4 GHz band scanned, scan 5 GHz band, pretend
                          * to the wl1271_cmd_scan function that we are not
                          * scanning as it checks that.
                          */
                         clear_bit(WL1271_FLAG_SCANNING, &wl->flags);
+                        /* FIXME: ie missing! */
                         wl1271_cmd_scan(wl, wl->scan.ssid, wl->scan.ssid_len,
+                                                NULL, 0,
                                                 wl->scan.active,
                                                 wl->scan.high_prio,
                                                 WL1271_SCAN_BAND_5_GHZ,
                                                 wl->scan.probe_requests);
                 } else {
-                        if (wl->scan.state == WL1271_SCAN_BAND_2_4_GHZ)
-                                wl1271_cmd_template_set(wl,
-                                                CMD_TEMPL_CFG_PROBE_REQ_2_4,
-                                                NULL, size);
-                        else
-                                wl1271_cmd_template_set(wl,
-                                                CMD_TEMPL_CFG_PROBE_REQ_5,
-                                                NULL, size);
-
                         mutex_unlock(&wl->mutex);
                         ieee80211_scan_completed(wl->hw, false);
                         mutex_lock(&wl->mutex);
@@ -92,16 +81,9 @@ static int wl1271_event_ps_report(struct wl1271 *wl,
                         ret = wl1271_ps_set_mode(wl, STATION_POWER_SAVE_MODE,
                                                  true);
                 } else {
-                        wl1271_error("PSM entry failed, giving up.\n");
-                        /* FIXME: this may need to be reconsidered. for now it
-                           is not possible to indicate to the mac80211
-                           afterwards that PSM entry failed. To maximize
-                           functionality (receiving data and remaining
-                           associated) make sure that we are in sync with the
-                           AP in regard of PSM mode. */
-                        ret = wl1271_ps_set_mode(wl, STATION_ACTIVE_MODE,
-                                                 false);
+                        wl1271_info("No ack to nullfunc from AP.");
                         wl->psm_entry_retry = 0;
+                        *beacon_loss = true;
                 }
                 break;
         case EVENT_ENTER_POWER_SAVE_SUCCESS:
@@ -143,6 +125,24 @@ static int wl1271_event_ps_report(struct wl1271 *wl,
         return ret;
 }
 
+static void wl1271_event_rssi_trigger(struct wl1271 *wl,
+                                      struct event_mailbox *mbox)
+{
+        enum nl80211_cqm_rssi_threshold_event event;
+        s8 metric = mbox->rssi_snr_trigger_metric[0];
+
+        wl1271_debug(DEBUG_EVENT, "RSSI trigger metric: %d", metric);
+
+        if (metric <= wl->rssi_thold)
+                event = NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW;
+        else
+                event = NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH;
+
+        if (event != wl->last_rssi_event)
+                ieee80211_cqm_rssi_notify(wl->vif, event, GFP_KERNEL);
+        wl->last_rssi_event = event;
+}
+
 static void wl1271_event_mbox_dump(struct event_mailbox *mbox)
 {
         wl1271_debug(DEBUG_EVENT, "MBOX DUMP:");
@@ -172,10 +172,13 @@ static int wl1271_event_process(struct wl1271 *wl, struct event_mailbox *mbox)
          * The BSS_LOSE_EVENT_ID is only needed while psm (and hence beacon
          * filtering) is enabled. Without PSM, the stack will receive all
          * beacons and can detect beacon loss by itself.
+         *
+         * As there's possibility that the driver disables PSM before receiving
+         * BSS_LOSE_EVENT, beacon loss has to be reported to the stack.
+         *
          */
-        if (vector & BSS_LOSE_EVENT_ID &&
-            test_bit(WL1271_FLAG_PSM, &wl->flags)) {
-                wl1271_debug(DEBUG_EVENT, "BSS_LOSE_EVENT");
+        if (vector & BSS_LOSE_EVENT_ID) {
+                wl1271_info("Beacon loss detected.");
 
                 /* indicate to the stack, that beacons have been lost */
                 beacon_loss = true;
@@ -188,17 +191,15 @@ static int wl1271_event_process(struct wl1271 *wl, struct event_mailbox *mbox)
                         return ret;
         }
 
-        if (wl->vif && beacon_loss) {
-                /* Obviously, it's dangerous to release the mutex while
-                   we are holding many of the variables in the wl struct.
-                   That's why it's done last in the function, and care must
-                   be taken that nothing more is done after this function
-                   returns. */
-                mutex_unlock(&wl->mutex);
-                ieee80211_beacon_loss(wl->vif);
-                mutex_lock(&wl->mutex);
+        if (vector & RSSI_SNR_TRIGGER_0_EVENT_ID) {
+                wl1271_debug(DEBUG_EVENT, "RSSI_SNR_TRIGGER_0_EVENT");
+                if (wl->vif)
+                        wl1271_event_rssi_trigger(wl, mbox);
         }
 
+        if (wl->vif && beacon_loss)
+                ieee80211_connection_loss(wl->vif);
+
         return 0;
 }
 
diff --git a/drivers/net/wireless/wl12xx/wl1271_event.h b/drivers/net/wireless/wl12xx/wl1271_event.h
index 278f9206aa5..58371008f27 100644
--- a/drivers/net/wireless/wl12xx/wl1271_event.h
+++ b/drivers/net/wireless/wl12xx/wl1271_event.h
@@ -38,6 +38,14 @@
  */
 
 enum {
+        RSSI_SNR_TRIGGER_0_EVENT_ID              = BIT(0),
+        RSSI_SNR_TRIGGER_1_EVENT_ID              = BIT(1),
+        RSSI_SNR_TRIGGER_2_EVENT_ID              = BIT(2),
+        RSSI_SNR_TRIGGER_3_EVENT_ID              = BIT(3),
+        RSSI_SNR_TRIGGER_4_EVENT_ID              = BIT(4),
+        RSSI_SNR_TRIGGER_5_EVENT_ID              = BIT(5),
+        RSSI_SNR_TRIGGER_6_EVENT_ID              = BIT(6),
+        RSSI_SNR_TRIGGER_7_EVENT_ID              = BIT(7),
         MEASUREMENT_START_EVENT_ID               = BIT(8),
         MEASUREMENT_COMPLETE_EVENT_ID            = BIT(9),
         SCAN_COMPLETE_EVENT_ID                   = BIT(10),
diff --git a/drivers/net/wireless/wl12xx/wl1271_init.c b/drivers/net/wireless/wl12xx/wl1271_init.c
index d189e8fe05a..4447af1557f 100644
--- a/drivers/net/wireless/wl12xx/wl1271_init.c
+++ b/drivers/net/wireless/wl12xx/wl1271_init.c
@@ -52,50 +52,65 @@ static int wl1271_init_hwenc_config(struct wl1271 *wl)
 
 int wl1271_init_templates_config(struct wl1271 *wl)
 {
-        int ret;
+        int ret, i;
 
         /* send empty templates for fw memory reservation */
         ret = wl1271_cmd_template_set(wl, CMD_TEMPL_CFG_PROBE_REQ_2_4, NULL,
-                                      sizeof(struct wl12xx_probe_req_template));
+                                      sizeof(struct wl12xx_probe_req_template),
+                                      0, WL1271_RATE_AUTOMATIC);
         if (ret < 0)
                 return ret;
 
         if (wl1271_11a_enabled()) {
+                size_t size = sizeof(struct wl12xx_probe_req_template);
                 ret = wl1271_cmd_template_set(wl, CMD_TEMPL_CFG_PROBE_REQ_5,
-                                NULL,
-                                sizeof(struct wl12xx_probe_req_template));
+                                              NULL, size, 0,
+                                              WL1271_RATE_AUTOMATIC);
                 if (ret < 0)
                         return ret;
         }
 
         ret = wl1271_cmd_template_set(wl, CMD_TEMPL_NULL_DATA, NULL,
-                                      sizeof(struct wl12xx_null_data_template));
+                                      sizeof(struct wl12xx_null_data_template),
+                                      0, WL1271_RATE_AUTOMATIC);
         if (ret < 0)
                 return ret;
 
         ret = wl1271_cmd_template_set(wl, CMD_TEMPL_PS_POLL, NULL,
-                                      sizeof(struct wl12xx_ps_poll_template));
+                                      sizeof(struct wl12xx_ps_poll_template),
+                                      0, WL1271_RATE_AUTOMATIC);
         if (ret < 0)
                 return ret;
 
         ret = wl1271_cmd_template_set(wl, CMD_TEMPL_QOS_NULL_DATA, NULL,
                                       sizeof
-                                      (struct wl12xx_qos_null_data_template));
+                                      (struct wl12xx_qos_null_data_template),
+                                      0, WL1271_RATE_AUTOMATIC);
         if (ret < 0)
                 return ret;
 
         ret = wl1271_cmd_template_set(wl, CMD_TEMPL_PROBE_RESPONSE, NULL,
                                       sizeof
-                                      (struct wl12xx_probe_resp_template));
+                                      (struct wl12xx_probe_resp_template),
+                                      0, WL1271_RATE_AUTOMATIC);
         if (ret < 0)
                 return ret;
 
         ret = wl1271_cmd_template_set(wl, CMD_TEMPL_BEACON, NULL,
                                       sizeof
-                                      (struct wl12xx_beacon_template));
+                                      (struct wl12xx_beacon_template),
+                                      0, WL1271_RATE_AUTOMATIC);
         if (ret < 0)
                 return ret;
 
+        for (i = 0; i < CMD_TEMPL_KLV_IDX_MAX; i++) {
+                ret = wl1271_cmd_template_set(wl, CMD_TEMPL_KLV, NULL,
+                                              WL1271_CMD_TEMPL_MAX_SIZE, i,
+                                              WL1271_RATE_AUTOMATIC);
+                if (ret < 0)
+                        return ret;
+        }
+
         return 0;
 }
 
@@ -161,11 +176,11 @@ int wl1271_init_pta(struct wl1271 *wl)
 {
         int ret;
 
-        ret = wl1271_acx_sg_enable(wl);
+        ret = wl1271_acx_sg_cfg(wl);
         if (ret < 0)
                 return ret;
 
-        ret = wl1271_acx_sg_cfg(wl);
+        ret = wl1271_acx_sg_enable(wl, wl->sg_enabled);
         if (ret < 0)
                 return ret;
 
@@ -237,7 +252,7 @@ int wl1271_hw_init(struct wl1271 *wl)
                 goto out_free_memmap;
 
         /* Initialize connection monitoring thresholds */
-        ret = wl1271_acx_conn_monit_params(wl);
+        ret = wl1271_acx_conn_monit_params(wl, false);
         if (ret < 0)
                 goto out_free_memmap;
 
@@ -325,6 +340,24 @@ int wl1271_hw_init(struct wl1271 *wl)
         if (ret < 0)
                 goto out_free_memmap;
 
+        /* disable all keep-alive templates */
+        for (i = 0; i < CMD_TEMPL_KLV_IDX_MAX; i++) {
+                ret = wl1271_acx_keep_alive_config(wl, i,
+                                                   ACX_KEEP_ALIVE_TPL_INVALID);
+                if (ret < 0)
+                        goto out_free_memmap;
+        }
+
+        /* disable the keep-alive feature */
+        ret = wl1271_acx_keep_alive_mode(wl, false);
+        if (ret < 0)
+                goto out_free_memmap;
+
+        /* Configure rssi/snr averaging weights */
+        ret = wl1271_acx_rssi_snr_avg_weights(wl);
+        if (ret < 0)
+                goto out_free_memmap;
+
         return 0;
 
  out_free_memmap:
diff --git a/drivers/net/wireless/wl12xx/wl1271_io.c b/drivers/net/wireless/wl12xx/wl1271_io.c
index 5cd94d5666c..c8759acef13 100644
--- a/drivers/net/wireless/wl12xx/wl1271_io.c
+++ b/drivers/net/wireless/wl12xx/wl1271_io.c
@@ -28,30 +28,29 @@
 
 #include "wl1271.h"
 #include "wl12xx_80211.h"
-#include "wl1271_spi.h"
 #include "wl1271_io.h"
 
-static int wl1271_translate_addr(struct wl1271 *wl, int addr)
+#define OCP_CMD_LOOP  32
+
+#define OCP_CMD_WRITE 0x1
+#define OCP_CMD_READ  0x2
+
+#define OCP_READY_MASK  BIT(18)
+#define OCP_STATUS_MASK (BIT(16) | BIT(17))
+
+#define OCP_STATUS_NO_RESP    0x00000
+#define OCP_STATUS_OK         0x10000
+#define OCP_STATUS_REQ_FAILED 0x20000
+#define OCP_STATUS_RESP_ERROR 0x30000
+
+void wl1271_disable_interrupts(struct wl1271 *wl)
 {
-        /*
-         * To translate, first check to which window of addresses the
-         * particular address belongs. Then subtract the starting address
-         * of that window from the address. Then, add offset of the
-         * translated region.
-         *
-         * The translated regions occur next to each other in physical device
-         * memory, so just add the sizes of the preceeding address regions to
-         * get the offset to the new region.
-         *
-         * Currently, only the two first regions are addressed, and the
-         * assumption is that all addresses will fall into either of those
-         * two.
-         */
-        if ((addr >= wl->part.reg.start) &&
-            (addr < wl->part.reg.start + wl->part.reg.size))
-                return addr - wl->part.reg.start + wl->part.mem.size;
-        else
-                return addr - wl->part.mem.start;
+        wl->if_ops->disable_irq(wl);
+}
+
+void wl1271_enable_interrupts(struct wl1271 *wl)
+{
+        wl->if_ops->enable_irq(wl);
 }
 
 /* Set the SPI partitions to access the chip addresses
@@ -117,54 +116,12 @@ int wl1271_set_partition(struct wl1271 *wl,
 
 void wl1271_io_reset(struct wl1271 *wl)
 {
-        wl1271_spi_reset(wl);
+        wl->if_ops->reset(wl);
 }
 
 void wl1271_io_init(struct wl1271 *wl)
 {
-        wl1271_spi_init(wl);
-}
-
-void wl1271_raw_write(struct wl1271 *wl, int addr, void *buf,
-                      size_t len, bool fixed)
-{
-        wl1271_spi_raw_write(wl, addr, buf, len, fixed);
-}
-
-void wl1271_raw_read(struct wl1271 *wl, int addr, void *buf,
-                     size_t len, bool fixed)
-{
-        wl1271_spi_raw_read(wl, addr, buf, len, fixed);
-}
-
-void wl1271_read(struct wl1271 *wl, int addr, void *buf, size_t len,
-                     bool fixed)
-{
-        int physical;
-
-        physical = wl1271_translate_addr(wl, addr);
-
-        wl1271_spi_raw_read(wl, physical, buf, len, fixed);
-}
-
-void wl1271_write(struct wl1271 *wl, int addr, void *buf, size_t len,
-                  bool fixed)
-{
-        int physical;
-
-        physical = wl1271_translate_addr(wl, addr);
-
-        wl1271_spi_raw_write(wl, physical, buf, len, fixed);
-}
-
-u32 wl1271_read32(struct wl1271 *wl, int addr)
-{
-        return wl1271_raw_read32(wl, wl1271_translate_addr(wl, addr));
-}
-
-void wl1271_write32(struct wl1271 *wl, int addr, u32 val)
-{
-        wl1271_raw_write32(wl, wl1271_translate_addr(wl, addr), val);
+        wl->if_ops->init(wl);
 }
 
 void wl1271_top_reg_write(struct wl1271 *wl, int addr, u16 val)
diff --git a/drivers/net/wireless/wl12xx/wl1271_io.h b/drivers/net/wireless/wl12xx/wl1271_io.h
index fa9a0b35788..bc806c74c63 100644
--- a/drivers/net/wireless/wl12xx/wl1271_io.h
+++ b/drivers/net/wireless/wl12xx/wl1271_io.h
@@ -25,44 +25,145 @@
 #ifndef __WL1271_IO_H__
 #define __WL1271_IO_H__
 
+#include "wl1271_reg.h"
+
+#define HW_ACCESS_MEMORY_MAX_RANGE      0x1FFC0
+
+#define HW_PARTITION_REGISTERS_ADDR     0x1FFC0
+#define HW_PART0_SIZE_ADDR              (HW_PARTITION_REGISTERS_ADDR)
+#define HW_PART0_START_ADDR             (HW_PARTITION_REGISTERS_ADDR + 4)
+#define HW_PART1_SIZE_ADDR              (HW_PARTITION_REGISTERS_ADDR + 8)
+#define HW_PART1_START_ADDR             (HW_PARTITION_REGISTERS_ADDR + 12)
+#define HW_PART2_SIZE_ADDR              (HW_PARTITION_REGISTERS_ADDR + 16)
+#define HW_PART2_START_ADDR             (HW_PARTITION_REGISTERS_ADDR + 20)
+#define HW_PART3_START_ADDR             (HW_PARTITION_REGISTERS_ADDR + 24)
+
+#define HW_ACCESS_REGISTER_SIZE         4
+
+#define HW_ACCESS_PRAM_MAX_RANGE        0x3c000
+
 struct wl1271;
 
+void wl1271_disable_interrupts(struct wl1271 *wl);
+void wl1271_enable_interrupts(struct wl1271 *wl);
+
 void wl1271_io_reset(struct wl1271 *wl);
 void wl1271_io_init(struct wl1271 *wl);
 
-/* Raw target IO, address is not translated */
-void wl1271_raw_write(struct wl1271 *wl, int addr, void *buf,
-                      size_t len, bool fixed);
-void wl1271_raw_read(struct wl1271 *wl, int addr, void *buf,
-                     size_t len, bool fixed);
+static inline struct device *wl1271_wl_to_dev(struct wl1271 *wl)
+{
+        return wl->if_ops->dev(wl);
+}
 
-/* Translated target IO */
-void wl1271_read(struct wl1271 *wl, int addr, void *buf, size_t len,
-                     bool fixed);
-void wl1271_write(struct wl1271 *wl, int addr, void *buf, size_t len,
-                      bool fixed);
-u32 wl1271_read32(struct wl1271 *wl, int addr);
-void wl1271_write32(struct wl1271 *wl, int addr, u32 val);
 
-/* Top Register IO */
-void wl1271_top_reg_write(struct wl1271 *wl, int addr, u16 val);
-u16 wl1271_top_reg_read(struct wl1271 *wl, int addr);
+/* Raw target IO, address is not translated */
+static inline void wl1271_raw_write(struct wl1271 *wl, int addr, void *buf,
+                                    size_t len, bool fixed)
+{
+        wl->if_ops->write(wl, addr, buf, len, fixed);
+}
 
-int wl1271_set_partition(struct wl1271 *wl,
-                         struct wl1271_partition_set *p);
+static inline void wl1271_raw_read(struct wl1271 *wl, int addr, void *buf,
+                                   size_t len, bool fixed)
+{
+        wl->if_ops->read(wl, addr, buf, len, fixed);
+}
 
 static inline u32 wl1271_raw_read32(struct wl1271 *wl, int addr)
 {
         wl1271_raw_read(wl, addr, &wl->buffer_32,
                             sizeof(wl->buffer_32), false);
 
-        return wl->buffer_32;
+        return le32_to_cpu(wl->buffer_32);
 }
 
 static inline void wl1271_raw_write32(struct wl1271 *wl, int addr, u32 val)
 {
-        wl->buffer_32 = val;
+        wl->buffer_32 = cpu_to_le32(val);
         wl1271_raw_write(wl, addr, &wl->buffer_32,
                              sizeof(wl->buffer_32), false);
 }
+
+/* Translated target IO */
+static inline int wl1271_translate_addr(struct wl1271 *wl, int addr)
+{
+        /*
+         * To translate, first check to which window of addresses the
+         * particular address belongs. Then subtract the starting address
+         * of that window from the address. Then, add offset of the
+         * translated region.
+         *
+         * The translated regions occur next to each other in physical device
+         * memory, so just add the sizes of the preceeding address regions to
+         * get the offset to the new region.
+         *
+         * Currently, only the two first regions are addressed, and the
+         * assumption is that all addresses will fall into either of those
+         * two.
+         */
+        if ((addr >= wl->part.reg.start) &&
+            (addr < wl->part.reg.start + wl->part.reg.size))
+                return addr - wl->part.reg.start + wl->part.mem.size;
+        else
+                return addr - wl->part.mem.start;
+}
+
+static inline void wl1271_read(struct wl1271 *wl, int addr, void *buf,
+                               size_t len, bool fixed)
+{
+        int physical;
+
+        physical = wl1271_translate_addr(wl, addr);
+
+        wl1271_raw_read(wl, physical, buf, len, fixed);
+}
+
+static inline void wl1271_write(struct wl1271 *wl, int addr, void *buf,
+                                size_t len, bool fixed)
+{
+        int physical;
+
+        physical = wl1271_translate_addr(wl, addr);
+
+        wl1271_raw_write(wl, physical, buf, len, fixed);
+}
+
+static inline u32 wl1271_read32(struct wl1271 *wl, int addr)
+{
+        return wl1271_raw_read32(wl, wl1271_translate_addr(wl, addr));
+}
+
+static inline void wl1271_write32(struct wl1271 *wl, int addr, u32 val)
+{
+        wl1271_raw_write32(wl, wl1271_translate_addr(wl, addr), val);
+}
+
+static inline void wl1271_power_off(struct wl1271 *wl)
+{
+        wl->if_ops->power(wl, false);
+        clear_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);
+}
+
+static inline void wl1271_power_on(struct wl1271 *wl)
+{
+        wl->if_ops->power(wl, true);
+        set_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);
+}
+
+
+/* Top Register IO */
+void wl1271_top_reg_write(struct wl1271 *wl, int addr, u16 val);
+u16 wl1271_top_reg_read(struct wl1271 *wl, int addr);
+
+int wl1271_set_partition(struct wl1271 *wl,
+                         struct wl1271_partition_set *p);
+
+/* Functions from wl1271_main.c */
+
+int wl1271_register_hw(struct wl1271 *wl);
+void wl1271_unregister_hw(struct wl1271 *wl);
+int wl1271_init_ieee80211(struct wl1271 *wl);
+struct ieee80211_hw *wl1271_alloc_hw(void);
+int wl1271_free_hw(struct wl1271 *wl);
+
 #endif
diff --git a/drivers/net/wireless/wl12xx/wl1271_main.c b/drivers/net/wireless/wl12xx/wl1271_main.c
index 65a1aeba241..b7d9137851a 100644
--- a/drivers/net/wireless/wl12xx/wl1271_main.c
+++ b/drivers/net/wireless/wl12xx/wl1271_main.c
@@ -22,23 +22,19 @@
  */
 
 #include <linux/module.h>
-#include <linux/platform_device.h>
-#include <linux/interrupt.h>
 #include <linux/firmware.h>
 #include <linux/delay.h>
-#include <linux/irq.h>
 #include <linux/spi/spi.h>
 #include <linux/crc32.h>
 #include <linux/etherdevice.h>
 #include <linux/vmalloc.h>
-#include <linux/spi/wl12xx.h>
 #include <linux/inetdevice.h>
+#include <linux/platform_device.h>
 #include <linux/slab.h>
 
 #include "wl1271.h"
 #include "wl12xx_80211.h"
 #include "wl1271_reg.h"
-#include "wl1271_spi.h"
 #include "wl1271_io.h"
 #include "wl1271_event.h"
 #include "wl1271_tx.h"
@@ -54,17 +50,57 @@
 
 static struct conf_drv_settings default_conf = {
         .sg = {
-                .per_threshold               = 7500,
-                .max_scan_compensation_time  = 120000,
-                .nfs_sample_interval         = 400,
-                .load_ratio                  = 50,
-                .auto_ps_mode                = 0,
-                .probe_req_compensation      = 170,
-                .scan_window_compensation    = 50,
-                .antenna_config              = 0,
-                .beacon_miss_threshold       = 60,
-                .rate_adaptation_threshold   = CONF_HW_BIT_RATE_12MBPS,
-                .rate_adaptation_snr         = 0
+                .params = {
+                        [CONF_SG_BT_PER_THRESHOLD]                  = 7500,
+                        [CONF_SG_HV3_MAX_OVERRIDE]                  = 0,
+                        [CONF_SG_BT_NFS_SAMPLE_INTERVAL]            = 400,
+                        [CONF_SG_BT_LOAD_RATIO]                     = 50,
+                        [CONF_SG_AUTO_PS_MODE]                      = 0,
+                        [CONF_SG_AUTO_SCAN_PROBE_REQ]               = 170,
+                        [CONF_SG_ACTIVE_SCAN_DURATION_FACTOR_HV3]   = 50,
+                        [CONF_SG_ANTENNA_CONFIGURATION]             = 0,
+                        [CONF_SG_BEACON_MISS_PERCENT]               = 60,
+                        [CONF_SG_RATE_ADAPT_THRESH]                 = 12,
+                        [CONF_SG_RATE_ADAPT_SNR]                    = 0,
+                        [CONF_SG_WLAN_PS_BT_ACL_MASTER_MIN_BR]      = 10,
+                        [CONF_SG_WLAN_PS_BT_ACL_MASTER_MAX_BR]      = 30,
+                        [CONF_SG_WLAN_PS_MAX_BT_ACL_MASTER_BR]      = 8,
+                        [CONF_SG_WLAN_PS_BT_ACL_SLAVE_MIN_BR]       = 20,
+                        [CONF_SG_WLAN_PS_BT_ACL_SLAVE_MAX_BR]       = 50,
+                        /* Note: with UPSD, this should be 4 */
+                        [CONF_SG_WLAN_PS_MAX_BT_ACL_SLAVE_BR]       = 8,
+                        [CONF_SG_WLAN_PS_BT_ACL_MASTER_MIN_EDR]     = 7,
+                        [CONF_SG_WLAN_PS_BT_ACL_MASTER_MAX_EDR]     = 25,
+                        [CONF_SG_WLAN_PS_MAX_BT_ACL_MASTER_EDR]     = 20,
+                        /* Note: with UPDS, this should be 15 */
+                        [CONF_SG_WLAN_PS_BT_ACL_SLAVE_MIN_EDR]      = 8,
+                        /* Note: with UPDS, this should be 50 */
+                        [CONF_SG_WLAN_PS_BT_ACL_SLAVE_MAX_EDR]      = 40,
+                        /* Note: with UPDS, this should be 10 */
+                        [CONF_SG_WLAN_PS_MAX_BT_ACL_SLAVE_EDR]      = 20,
+                        [CONF_SG_RXT]                               = 1200,
+                        [CONF_SG_TXT]                               = 1000,
+                        [CONF_SG_ADAPTIVE_RXT_TXT]                  = 1,
+                        [CONF_SG_PS_POLL_TIMEOUT]                   = 10,
+                        [CONF_SG_UPSD_TIMEOUT]                      = 10,
+                        [CONF_SG_WLAN_ACTIVE_BT_ACL_MASTER_MIN_EDR] = 7,
+                        [CONF_SG_WLAN_ACTIVE_BT_ACL_MASTER_MAX_EDR] = 15,
+                        [CONF_SG_WLAN_ACTIVE_MAX_BT_ACL_MASTER_EDR] = 15,
+                        [CONF_SG_WLAN_ACTIVE_BT_ACL_SLAVE_MIN_EDR]  = 8,
+                        [CONF_SG_WLAN_ACTIVE_BT_ACL_SLAVE_MAX_EDR]  = 20,
+                        [CONF_SG_WLAN_ACTIVE_MAX_BT_ACL_SLAVE_EDR]  = 15,
+                        [CONF_SG_WLAN_ACTIVE_BT_ACL_MIN_BR]         = 20,
+                        [CONF_SG_WLAN_ACTIVE_BT_ACL_MAX_BR]         = 50,
+                        [CONF_SG_WLAN_ACTIVE_MAX_BT_ACL_BR]         = 10,
+                        [CONF_SG_PASSIVE_SCAN_DURATION_FACTOR_HV3]  = 200,
+                        [CONF_SG_PASSIVE_SCAN_DURATION_FACTOR_A2DP] = 800,
+                        [CONF_SG_PASSIVE_SCAN_A2DP_BT_TIME]         = 75,
+                        [CONF_SG_PASSIVE_SCAN_A2DP_WLAN_TIME]       = 15,
+                        [CONF_SG_HV3_MAX_SERVED]                    = 6,
+                        [CONF_SG_DHCP_TIME]                         = 5000,
+                        [CONF_SG_ACTIVE_SCAN_DURATION_FACTOR_A2DP]  = 100,
+                },
+                .state = CONF_SG_PROTECTIVE,
         },
         .rx = {
                 .rx_msdu_life_time           = 512000,
@@ -81,8 +117,7 @@ static struct conf_drv_settings default_conf = {
         .tx = {
                 .tx_energy_detection         = 0,
                 .rc_conf                     = {
-                        .enabled_rates       = CONF_HW_BIT_RATE_1MBPS |
-                                               CONF_HW_BIT_RATE_2MBPS,
+                        .enabled_rates       = 0,
                         .short_retry_limit   = 10,
                         .long_retry_limit    = 10,
                         .aflags              = 0
@@ -179,11 +214,13 @@ static struct conf_drv_settings default_conf = {
                 },
                 .frag_threshold              = IEEE80211_MAX_FRAG_THRESHOLD,
                 .tx_compl_timeout            = 700,
-                .tx_compl_threshold          = 4
+                .tx_compl_threshold          = 4,
+                .basic_rate                  = CONF_HW_BIT_RATE_1MBPS,
+                .basic_rate_5                = CONF_HW_BIT_RATE_6MBPS,
         },
         .conn = {
                 .wake_up_event               = CONF_WAKE_UP_EVENT_DTIM,
-                .listen_interval             = 0,
+                .listen_interval             = 1,
                 .bcn_filt_mode               = CONF_BCN_FILT_MODE_ENABLED,
                 .bcn_filt_ie_count           = 1,
                 .bcn_filt_ie = {
@@ -198,38 +235,11 @@ static struct conf_drv_settings default_conf = {
                 .broadcast_timeout           = 20000,
                 .rx_broadcast_in_ps          = 1,
                 .ps_poll_threshold           = 20,
-                .sig_trigger_count           = 2,
-                .sig_trigger = {
-                        [0] = {
-                                .threshold   = -75,
-                                .pacing      = 500,
-                                .metric      = CONF_TRIG_METRIC_RSSI_BEACON,
-                                .type        = CONF_TRIG_EVENT_TYPE_EDGE,
-                                .direction   = CONF_TRIG_EVENT_DIR_LOW,
-                                .hysteresis  = 2,
-                                .index       = 0,
-                                .enable      = 1
-                        },
-                        [1] = {
-                                .threshold   = -75,
-                                .pacing      = 500,
-                                .metric      = CONF_TRIG_METRIC_RSSI_BEACON,
-                                .type        = CONF_TRIG_EVENT_TYPE_EDGE,
-                                .direction   = CONF_TRIG_EVENT_DIR_HIGH,
-                                .hysteresis  = 2,
-                                .index       = 1,
-                                .enable      = 1
-                        }
-                },
-                .sig_weights = {
-                        .rssi_bcn_avg_weight = 10,
-                        .rssi_pkt_avg_weight = 10,
-                        .snr_bcn_avg_weight  = 10,
-                        .snr_pkt_avg_weight  = 10
-                },
                 .bet_enable                  = CONF_BET_MODE_ENABLE,
                 .bet_max_consecutive         = 10,
-                .psm_entry_retries           = 3
+                .psm_entry_retries           = 3,
+                .keep_alive_interval         = 55000,
+                .max_listen_interval         = 20,
         },
         .init = {
                 .radioparam = {
@@ -243,9 +253,32 @@ static struct conf_drv_settings default_conf = {
         .pm_config = {
                 .host_clk_settling_time = 5000,
                 .host_fast_wakeup_support = false
+        },
+        .roam_trigger = {
+                /* FIXME: due to firmware bug, must use value 1 for now */
+                .trigger_pacing               = 1,
+                .avg_weight_rssi_beacon       = 20,
+                .avg_weight_rssi_data         = 10,
+                .avg_weight_snr_beacon        = 20,
+                .avg_weight_snr_data          = 10
         }
 };
 
+static void wl1271_device_release(struct device *dev)
+{
+
+}
+
+static struct platform_device wl1271_device = {
+        .name           = "wl1271",
+        .id             = -1,
+
+        /* device model insists to have a release function */
+        .dev            = {
+                .release = wl1271_device_release,
+        },
+};
+
 static LIST_HEAD(wl_list);
 
 static void wl1271_conf_init(struct wl1271 *wl)
@@ -298,7 +331,7 @@ static int wl1271_plt_init(struct wl1271 *wl)
                 goto out_free_memmap;
 
         /* Initialize connection monitoring thresholds */
-        ret = wl1271_acx_conn_monit_params(wl);
+        ret = wl1271_acx_conn_monit_params(wl, false);
         if (ret < 0)
                 goto out_free_memmap;
 
@@ -365,30 +398,14 @@ static int wl1271_plt_init(struct wl1271 *wl)
         return ret;
 }
 
-static void wl1271_disable_interrupts(struct wl1271 *wl)
-{
-        disable_irq(wl->irq);
-}
-
-static void wl1271_power_off(struct wl1271 *wl)
-{
-        wl->set_power(false);
-        clear_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);
-}
-
-static void wl1271_power_on(struct wl1271 *wl)
-{
-        wl->set_power(true);
-        set_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);
-}
-
 static void wl1271_fw_status(struct wl1271 *wl,
                              struct wl1271_fw_status *status)
 {
+        struct timespec ts;
         u32 total = 0;
         int i;
 
-        wl1271_read(wl, FW_STATUS_ADDR, status, sizeof(*status), false);
+        wl1271_raw_read(wl, FW_STATUS_ADDR, status, sizeof(*status), false);
 
         wl1271_debug(DEBUG_IRQ, "intr: 0x%x (fw_rx_counter = %d, "
                      "drv_rx_counter = %d, tx_results_counter = %d)",
@@ -413,14 +430,19 @@ static void wl1271_fw_status(struct wl1271 *wl,
                 ieee80211_queue_work(wl->hw, &wl->tx_work);
 
         /* update the host-chipset time offset */
-        wl->time_offset = jiffies_to_usecs(jiffies) -
-                le32_to_cpu(status->fw_localtime);
+        getnstimeofday(&ts);
+        wl->time_offset = (timespec_to_ns(&ts) >> 10) -
+                (s64)le32_to_cpu(status->fw_localtime);
 }
 
+#define WL1271_IRQ_MAX_LOOPS 10
+
 static void wl1271_irq_work(struct work_struct *work)
 {
         int ret;
         u32 intr;
+        int loopcount = WL1271_IRQ_MAX_LOOPS;
+        unsigned long flags;
         struct wl1271 *wl =
                 container_of(work, struct wl1271, irq_work);
 
@@ -428,91 +450,78 @@ static void wl1271_irq_work(struct work_struct *work)
 
         wl1271_debug(DEBUG_IRQ, "IRQ work");
 
-        if (wl->state == WL1271_STATE_OFF)
+        if (unlikely(wl->state == WL1271_STATE_OFF))
                 goto out;
 
         ret = wl1271_ps_elp_wakeup(wl, true);
         if (ret < 0)
                 goto out;
 
-        wl1271_write32(wl, ACX_REG_INTERRUPT_MASK, WL1271_ACX_INTR_ALL);
-
-        wl1271_fw_status(wl, wl->fw_status);
-        intr = le32_to_cpu(wl->fw_status->intr);
-        if (!intr) {
-                wl1271_debug(DEBUG_IRQ, "Zero interrupt received.");
-                goto out_sleep;
-        }
+        spin_lock_irqsave(&wl->wl_lock, flags);
+        while (test_bit(WL1271_FLAG_IRQ_PENDING, &wl->flags) && loopcount) {
+                clear_bit(WL1271_FLAG_IRQ_PENDING, &wl->flags);
+                spin_unlock_irqrestore(&wl->wl_lock, flags);
+                loopcount--;
+
+                wl1271_fw_status(wl, wl->fw_status);
+                intr = le32_to_cpu(wl->fw_status->intr);
+                if (!intr) {
+                        wl1271_debug(DEBUG_IRQ, "Zero interrupt received.");
+                        spin_lock_irqsave(&wl->wl_lock, flags);
+                        continue;
+                }
 
-        intr &= WL1271_INTR_MASK;
+                intr &= WL1271_INTR_MASK;
 
-        if (intr & WL1271_ACX_INTR_EVENT_A) {
-                wl1271_debug(DEBUG_IRQ, "WL1271_ACX_INTR_EVENT_A");
-                wl1271_event_handle(wl, 0);
-        }
+                if (intr & WL1271_ACX_INTR_DATA) {
+                        wl1271_debug(DEBUG_IRQ, "WL1271_ACX_INTR_DATA");
 
-        if (intr & WL1271_ACX_INTR_EVENT_B) {
-                wl1271_debug(DEBUG_IRQ, "WL1271_ACX_INTR_EVENT_B");
-                wl1271_event_handle(wl, 1);
-        }
+                        /* check for tx results */
+                        if (wl->fw_status->tx_results_counter !=
+                            (wl->tx_results_count & 0xff))
+                                wl1271_tx_complete(wl);
 
-        if (intr & WL1271_ACX_INTR_INIT_COMPLETE)
-                wl1271_debug(DEBUG_IRQ,
-                             "WL1271_ACX_INTR_INIT_COMPLETE");
+                        wl1271_rx(wl, wl->fw_status);
+                }
 
-        if (intr & WL1271_ACX_INTR_HW_AVAILABLE)
-                wl1271_debug(DEBUG_IRQ, "WL1271_ACX_INTR_HW_AVAILABLE");
+                if (intr & WL1271_ACX_INTR_EVENT_A) {
+                        wl1271_debug(DEBUG_IRQ, "WL1271_ACX_INTR_EVENT_A");
+                        wl1271_event_handle(wl, 0);
+                }
 
-        if (intr & WL1271_ACX_INTR_DATA) {
-                u8 tx_res_cnt = wl->fw_status->tx_results_counter -
-                        wl->tx_results_count;
+                if (intr & WL1271_ACX_INTR_EVENT_B) {
+                        wl1271_debug(DEBUG_IRQ, "WL1271_ACX_INTR_EVENT_B");
+                        wl1271_event_handle(wl, 1);
+                }
 
-                wl1271_debug(DEBUG_IRQ, "WL1271_ACX_INTR_DATA");
+                if (intr & WL1271_ACX_INTR_INIT_COMPLETE)
+                        wl1271_debug(DEBUG_IRQ,
+                                     "WL1271_ACX_INTR_INIT_COMPLETE");
 
-                /* check for tx results */
-                if (tx_res_cnt)
-                        wl1271_tx_complete(wl, tx_res_cnt);
+                if (intr & WL1271_ACX_INTR_HW_AVAILABLE)
+                        wl1271_debug(DEBUG_IRQ, "WL1271_ACX_INTR_HW_AVAILABLE");
 
-                wl1271_rx(wl, wl->fw_status);
+                spin_lock_irqsave(&wl->wl_lock, flags);
         }
 
-out_sleep:
-        wl1271_write32(wl, ACX_REG_INTERRUPT_MASK,
-                       WL1271_ACX_INTR_ALL & ~(WL1271_INTR_MASK));
+        if (test_bit(WL1271_FLAG_IRQ_PENDING, &wl->flags))
+                ieee80211_queue_work(wl->hw, &wl->irq_work);
+        else
+                clear_bit(WL1271_FLAG_IRQ_RUNNING, &wl->flags);
+        spin_unlock_irqrestore(&wl->wl_lock, flags);
+
         wl1271_ps_elp_sleep(wl);
 
 out:
         mutex_unlock(&wl->mutex);
 }
 
-static irqreturn_t wl1271_irq(int irq, void *cookie)
-{
-        struct wl1271 *wl;
-        unsigned long flags;
-
-        wl1271_debug(DEBUG_IRQ, "IRQ");
-
-        wl = cookie;
-
-        /* complete the ELP completion */
-        spin_lock_irqsave(&wl->wl_lock, flags);
-        if (wl->elp_compl) {
-                complete(wl->elp_compl);
-                wl->elp_compl = NULL;
-        }
-
-        ieee80211_queue_work(wl->hw, &wl->irq_work);
-        spin_unlock_irqrestore(&wl->wl_lock, flags);
-
-        return IRQ_HANDLED;
-}
-
 static int wl1271_fetch_firmware(struct wl1271 *wl)
 {
         const struct firmware *fw;
         int ret;
 
-        ret = request_firmware(&fw, WL1271_FW_NAME, &wl->spi->dev);
+        ret = request_firmware(&fw, WL1271_FW_NAME, wl1271_wl_to_dev(wl));
 
         if (ret < 0) {
                 wl1271_error("could not get firmware: %d", ret);
@@ -545,46 +554,12 @@ out:
         return ret;
 }
 
-static int wl1271_update_mac_addr(struct wl1271 *wl)
-{
-        int ret = 0;
-        u8 *nvs_ptr = (u8 *)wl->nvs->nvs;
-
-        /* get mac address from the NVS */
-        wl->mac_addr[0] = nvs_ptr[11];
-        wl->mac_addr[1] = nvs_ptr[10];
-        wl->mac_addr[2] = nvs_ptr[6];
-        wl->mac_addr[3] = nvs_ptr[5];
-        wl->mac_addr[4] = nvs_ptr[4];
-        wl->mac_addr[5] = nvs_ptr[3];
-
-        /* FIXME: if it is a zero-address, we should bail out. Now, instead,
-           we randomize an address */
-        if (is_zero_ether_addr(wl->mac_addr)) {
-                static const u8 nokia_oui[3] = {0x00, 0x1f, 0xdf};
-                memcpy(wl->mac_addr, nokia_oui, 3);
-                get_random_bytes(wl->mac_addr + 3, 3);
-
-                /* update this address to the NVS */
-                nvs_ptr[11] = wl->mac_addr[0];
-                nvs_ptr[10] = wl->mac_addr[1];
-                nvs_ptr[6] = wl->mac_addr[2];
-                nvs_ptr[5] = wl->mac_addr[3];
-                nvs_ptr[4] = wl->mac_addr[4];
-                nvs_ptr[3] = wl->mac_addr[5];
-        }
-
-        SET_IEEE80211_PERM_ADDR(wl->hw, wl->mac_addr);
-
-        return ret;
-}
-
 static int wl1271_fetch_nvs(struct wl1271 *wl)
 {
         const struct firmware *fw;
         int ret;
 
-        ret = request_firmware(&fw, WL1271_NVS_NAME, &wl->spi->dev);
+        ret = request_firmware(&fw, WL1271_NVS_NAME, wl1271_wl_to_dev(wl));
 
         if (ret < 0) {
                 wl1271_error("could not get nvs file: %d", ret);
@@ -608,8 +583,6 @@ static int wl1271_fetch_nvs(struct wl1271 *wl)
 
         memcpy(wl->nvs, fw->data, sizeof(struct wl1271_nvs_file));
 
-        ret = wl1271_update_mac_addr(wl);
-
 out:
         release_firmware(fw);
 
@@ -826,15 +799,13 @@ static int wl1271_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
          * The workqueue is slow to process the tx_queue and we need stop
          * the queue here, otherwise the queue will get too long.
          */
-        if (skb_queue_len(&wl->tx_queue) >= WL1271_TX_QUEUE_MAX_LENGTH) {
-                ieee80211_stop_queues(wl->hw);
+        if (skb_queue_len(&wl->tx_queue) >= WL1271_TX_QUEUE_HIGH_WATERMARK) {
+                wl1271_debug(DEBUG_TX, "op_tx: stopping queues");
 
-                /*
-                 * FIXME: this is racy, the variable is not properly
-                 * protected. Maybe fix this by removing the stupid
-                 * variable altogether and checking the real queue state?
-                 */
+                spin_lock_irqsave(&wl->wl_lock, flags);
+                ieee80211_stop_queues(wl->hw);
                 set_bit(WL1271_FLAG_TX_QUEUE_STOPPED, &wl->flags);
+                spin_unlock_irqrestore(&wl->wl_lock, flags);
         }
 
         return NETDEV_TX_OK;
@@ -882,7 +853,7 @@ static int wl1271_dev_notify(struct notifier_block *me, unsigned long what,
                 if (wl == wl_temp)
                         break;
         }
-        if (wl == NULL)
+        if (wl != wl_temp)
                 return NOTIFY_DONE;
 
         /* Get the interface IP address for the device. "ifa" will become
@@ -929,13 +900,60 @@ static struct notifier_block wl1271_dev_notifier = {
 
 static int wl1271_op_start(struct ieee80211_hw *hw)
 {
+        wl1271_debug(DEBUG_MAC80211, "mac80211 start");
+
+        /*
+         * We have to delay the booting of the hardware because
+         * we need to know the local MAC address before downloading and
+         * initializing the firmware. The MAC address cannot be changed
+         * after boot, and without the proper MAC address, the firmware
+         * will not function properly.
+         *
+         * The MAC address is first known when the corresponding interface
+         * is added. That is where we will initialize the hardware.
+         */
+
+        return 0;
+}
+
+static void wl1271_op_stop(struct ieee80211_hw *hw)
+{
+        wl1271_debug(DEBUG_MAC80211, "mac80211 stop");
+}
+
+static int wl1271_op_add_interface(struct ieee80211_hw *hw,
+                                   struct ieee80211_vif *vif)
+{
         struct wl1271 *wl = hw->priv;
         int retries = WL1271_BOOT_RETRIES;
         int ret = 0;
 
-        wl1271_debug(DEBUG_MAC80211, "mac80211 start");
+        wl1271_debug(DEBUG_MAC80211, "mac80211 add interface type %d mac %pM",
+                     vif->type, vif->addr);
 
         mutex_lock(&wl->mutex);
+        if (wl->vif) {
+                ret = -EBUSY;
+                goto out;
+        }
+
+        wl->vif = vif;
+
+        switch (vif->type) {
+        case NL80211_IFTYPE_STATION:
+                wl->bss_type = BSS_TYPE_STA_BSS;
+                wl->set_bss_type = BSS_TYPE_STA_BSS;
+                break;
+        case NL80211_IFTYPE_ADHOC:
+                wl->bss_type = BSS_TYPE_IBSS;
+                wl->set_bss_type = BSS_TYPE_STA_BSS;
+                break;
+        default:
+                ret = -EOPNOTSUPP;
+                goto out;
+        }
+
+        memcpy(wl->mac_addr, vif->addr, ETH_ALEN);
 
         if (wl->state != WL1271_STATE_OFF) {
                 wl1271_error("cannot start because not in off state: %d",
@@ -991,19 +1009,20 @@ out:
         return ret;
 }
 
-static void wl1271_op_stop(struct ieee80211_hw *hw)
+static void wl1271_op_remove_interface(struct ieee80211_hw *hw,
+                                       struct ieee80211_vif *vif)
 {
         struct wl1271 *wl = hw->priv;
         int i;
 
-        wl1271_info("down");
-
-        wl1271_debug(DEBUG_MAC80211, "mac80211 stop");
-
         unregister_inetaddr_notifier(&wl1271_dev_notifier);
-        list_del(&wl->list);
 
         mutex_lock(&wl->mutex);
+        wl1271_debug(DEBUG_MAC80211, "mac80211 remove interface");
+
+        wl1271_info("down");
+
+        list_del(&wl->list);
 
         WARN_ON(wl->state != WL1271_STATE_ON);
 
@@ -1032,6 +1051,7 @@ static void wl1271_op_stop(struct ieee80211_hw *hw)
         memset(wl->ssid, 0, IW_ESSID_MAX_SIZE + 1);
         wl->ssid_len = 0;
         wl->bss_type = MAX_BSS_TYPE;
+        wl->set_bss_type = MAX_BSS_TYPE;
         wl->band = IEEE80211_BAND_2GHZ;
 
         wl->rx_counter = 0;
@@ -1041,163 +1061,142 @@ static void wl1271_op_stop(struct ieee80211_hw *hw)
         wl->tx_results_count = 0;
         wl->tx_packets_count = 0;
         wl->tx_security_last_seq = 0;
-        wl->tx_security_seq_16 = 0;
-        wl->tx_security_seq_32 = 0;
+        wl->tx_security_seq = 0;
         wl->time_offset = 0;
         wl->session_counter = 0;
         wl->rate_set = CONF_TX_RATE_MASK_BASIC;
         wl->sta_rate_set = 0;
         wl->flags = 0;
+        wl->vif = NULL;
+        wl->filters = 0;
 
         for (i = 0; i < NUM_TX_QUEUES; i++)
                 wl->tx_blocks_freed[i] = 0;
 
         wl1271_debugfs_reset(wl);
+
+        kfree(wl->fw_status);
+        wl->fw_status = NULL;
+        kfree(wl->tx_res_if);
+        wl->tx_res_if = NULL;
+        kfree(wl->target_mem_map);
+        wl->target_mem_map = NULL;
+
         mutex_unlock(&wl->mutex);
 }
 
-static int wl1271_op_add_interface(struct ieee80211_hw *hw,
-                                   struct ieee80211_vif *vif)
+static void wl1271_configure_filters(struct wl1271 *wl, unsigned int filters)
 {
-        struct wl1271 *wl = hw->priv;
-        int ret = 0;
+        wl->rx_config = WL1271_DEFAULT_RX_CONFIG;
+        wl->rx_filter = WL1271_DEFAULT_RX_FILTER;
 
-        wl1271_debug(DEBUG_MAC80211, "mac80211 add interface type %d mac %pM",
-                     vif->type, vif->addr);
+        /* combine requested filters with current filter config */
+        filters = wl->filters | filters;
 
-        mutex_lock(&wl->mutex);
-        if (wl->vif) {
-                ret = -EBUSY;
-                goto out;
+        wl1271_debug(DEBUG_FILTERS, "RX filters set: ");
+
+        if (filters & FIF_PROMISC_IN_BSS) {
+                wl1271_debug(DEBUG_FILTERS, " - FIF_PROMISC_IN_BSS");
+                wl->rx_config &= ~CFG_UNI_FILTER_EN;
+                wl->rx_config |= CFG_BSSID_FILTER_EN;
+        }
+        if (filters & FIF_BCN_PRBRESP_PROMISC) {
+                wl1271_debug(DEBUG_FILTERS, " - FIF_BCN_PRBRESP_PROMISC");
+                wl->rx_config &= ~CFG_BSSID_FILTER_EN;
+                wl->rx_config &= ~CFG_SSID_FILTER_EN;
         }
+        if (filters & FIF_OTHER_BSS) {
+                wl1271_debug(DEBUG_FILTERS, " - FIF_OTHER_BSS");
+                wl->rx_config &= ~CFG_BSSID_FILTER_EN;
+        }
+        if (filters & FIF_CONTROL) {
+                wl1271_debug(DEBUG_FILTERS, " - FIF_CONTROL");
+                wl->rx_filter |= CFG_RX_CTL_EN;
+        }
+        if (filters & FIF_FCSFAIL) {
+                wl1271_debug(DEBUG_FILTERS, " - FIF_FCSFAIL");
+                wl->rx_filter |= CFG_RX_FCS_ERROR;
+        }
+}
 
-        wl->vif = vif;
+static int wl1271_dummy_join(struct wl1271 *wl)
+{
+        int ret = 0;
+        /* we need to use a dummy BSSID for now */
+        static const u8 dummy_bssid[ETH_ALEN] = { 0x0b, 0xad, 0xde,
+                                                  0xad, 0xbe, 0xef };
 
-        switch (vif->type) {
-        case NL80211_IFTYPE_STATION:
-                wl->bss_type = BSS_TYPE_STA_BSS;
-                break;
-        case NL80211_IFTYPE_ADHOC:
-                wl->bss_type = BSS_TYPE_IBSS;
-                break;
-        default:
-                ret = -EOPNOTSUPP;
+        memcpy(wl->bssid, dummy_bssid, ETH_ALEN);
+
+        /* pass through frames from all BSS */
+        wl1271_configure_filters(wl, FIF_OTHER_BSS);
+
+        ret = wl1271_cmd_join(wl, wl->set_bss_type);
+        if (ret < 0)
                 goto out;
-        }
 
-        /* FIXME: what if conf->mac_addr changes? */
+        set_bit(WL1271_FLAG_JOINED, &wl->flags);
 
 out:
-        mutex_unlock(&wl->mutex);
         return ret;
 }
 
-static void wl1271_op_remove_interface(struct ieee80211_hw *hw,
-                                         struct ieee80211_vif *vif)
-{
-        struct wl1271 *wl = hw->priv;
-
-        mutex_lock(&wl->mutex);
-        wl1271_debug(DEBUG_MAC80211, "mac80211 remove interface");
-        wl->vif = NULL;
-        mutex_unlock(&wl->mutex);
-}
-
-#if 0
-static int wl1271_op_config_interface(struct ieee80211_hw *hw,
-                                      struct ieee80211_vif *vif,
-                                      struct ieee80211_if_conf *conf)
+static int wl1271_join(struct wl1271 *wl, bool set_assoc)
 {
-        struct wl1271 *wl = hw->priv;
-        struct sk_buff *beacon;
         int ret;
 
-        wl1271_debug(DEBUG_MAC80211, "mac80211 config_interface bssid %pM",
-                     conf->bssid);
-        wl1271_dump_ascii(DEBUG_MAC80211, "ssid: ", conf->ssid,
-                          conf->ssid_len);
+        /*
+         * One of the side effects of the JOIN command is that is clears
+         * WPA/WPA2 keys from the chipset. Performing a JOIN while associated
+         * to a WPA/WPA2 access point will therefore kill the data-path.
+         * Currently there is no supported scenario for JOIN during
+         * association - if it becomes a supported scenario, the WPA/WPA2 keys
+         * must be handled somehow.
+         *
+         */
+        if (test_bit(WL1271_FLAG_STA_ASSOCIATED, &wl->flags))
+                wl1271_info("JOIN while associated.");
 
-        mutex_lock(&wl->mutex);
+        if (set_assoc)
+                set_bit(WL1271_FLAG_STA_ASSOCIATED, &wl->flags);
 
-        ret = wl1271_ps_elp_wakeup(wl, false);
+        ret = wl1271_cmd_join(wl, wl->set_bss_type);
         if (ret < 0)
                 goto out;
 
-        if (memcmp(wl->bssid, conf->bssid, ETH_ALEN)) {
-                wl1271_debug(DEBUG_MAC80211, "bssid changed");
-
-                memcpy(wl->bssid, conf->bssid, ETH_ALEN);
-
-                ret = wl1271_cmd_join(wl);
-                if (ret < 0)
-                        goto out_sleep;
-
-                ret = wl1271_cmd_build_null_data(wl);
-                if (ret < 0)
-                        goto out_sleep;
-        }
-
-        wl->ssid_len = conf->ssid_len;
-        if (wl->ssid_len)
-                memcpy(wl->ssid, conf->ssid, wl->ssid_len);
-
-        if (conf->changed & IEEE80211_IFCC_BEACON) {
-                beacon = ieee80211_beacon_get(hw, vif);
-                ret = wl1271_cmd_template_set(wl, CMD_TEMPL_BEACON,
-                                              beacon->data, beacon->len);
-
-                if (ret < 0) {
-                        dev_kfree_skb(beacon);
-                        goto out_sleep;
-                }
-
-                ret = wl1271_cmd_template_set(wl, CMD_TEMPL_PROBE_RESPONSE,
-                                              beacon->data, beacon->len);
-
-                dev_kfree_skb(beacon);
-
-                if (ret < 0)
-                        goto out_sleep;
-        }
-
-out_sleep:
-        wl1271_ps_elp_sleep(wl);
-
-out:
-        mutex_unlock(&wl->mutex);
-
-        return ret;
-}
-#endif
-
-static int wl1271_join_channel(struct wl1271 *wl, int channel)
-{
-        int ret = 0;
-        /* we need to use a dummy BSSID for now */
-        static const u8 dummy_bssid[ETH_ALEN] = { 0x0b, 0xad, 0xde,
-                                                  0xad, 0xbe, 0xef };
+        set_bit(WL1271_FLAG_JOINED, &wl->flags);
 
-        /* the dummy join is not required for ad-hoc */
-        if (wl->bss_type == BSS_TYPE_IBSS)
+        if (!test_bit(WL1271_FLAG_STA_ASSOCIATED, &wl->flags))
                 goto out;
 
-        /* disable mac filter, so we hear everything */
-        wl->rx_config &= ~CFG_BSSID_FILTER_EN;
+        /*
+         * The join command disable the keep-alive mode, shut down its process,
+         * and also clear the template config, so we need to reset it all after
+         * the join. The acx_aid starts the keep-alive process, and the order
+         * of the commands below is relevant.
+         */
+        ret = wl1271_acx_keep_alive_mode(wl, true);
+        if (ret < 0)
+                goto out;
 
-        wl->channel = channel;
-        memcpy(wl->bssid, dummy_bssid, ETH_ALEN);
+        ret = wl1271_acx_aid(wl, wl->aid);
+        if (ret < 0)
+                goto out;
 
-        ret = wl1271_cmd_join(wl);
+        ret = wl1271_cmd_build_klv_null_data(wl);
         if (ret < 0)
                 goto out;
 
-        set_bit(WL1271_FLAG_JOINED, &wl->flags);
+        ret = wl1271_acx_keep_alive_config(wl, CMD_TEMPL_KLV_IDX_NULL_DATA,
+                                           ACX_KEEP_ALIVE_TPL_VALID);
+        if (ret < 0)
+                goto out;
 
 out:
         return ret;
 }
 
-static int wl1271_unjoin_channel(struct wl1271 *wl)
+static int wl1271_unjoin(struct wl1271 *wl)
 {
         int ret;
 
@@ -1207,14 +1206,41 @@ static int wl1271_unjoin_channel(struct wl1271 *wl)
                 goto out;
 
         clear_bit(WL1271_FLAG_JOINED, &wl->flags);
-        wl->channel = 0;
         memset(wl->bssid, 0, ETH_ALEN);
-        wl->rx_config = WL1271_DEFAULT_RX_CONFIG;
+
+        /* stop filterting packets based on bssid */
+        wl1271_configure_filters(wl, FIF_OTHER_BSS);
 
 out:
         return ret;
 }
 
+static void wl1271_set_band_rate(struct wl1271 *wl)
+{
+        if (wl->band == IEEE80211_BAND_2GHZ)
+                wl->basic_rate_set = wl->conf.tx.basic_rate;
+        else
+                wl->basic_rate_set = wl->conf.tx.basic_rate_5;
+}
+
+static u32 wl1271_min_rate_get(struct wl1271 *wl)
+{
+        int i;
+        u32 rate = 0;
+
+        if (!wl->basic_rate_set) {
+                WARN_ON(1);
+                wl->basic_rate_set = wl->conf.tx.basic_rate;
+        }
+
+        for (i = 0; !rate; i++) {
+                if ((wl->basic_rate_set >> i) & 0x1)
+                        rate = 1 << i;
+        }
+
+        return rate;
+}
+
 static int wl1271_op_config(struct ieee80211_hw *hw, u32 changed)
 {
         struct wl1271 *wl = hw->priv;
@@ -1231,38 +1257,62 @@ static int wl1271_op_config(struct ieee80211_hw *hw, u32 changed)
 
         mutex_lock(&wl->mutex);
 
-        wl->band = conf->channel->band;
+        if (unlikely(wl->state == WL1271_STATE_OFF))
+                goto out;
 
         ret = wl1271_ps_elp_wakeup(wl, false);
         if (ret < 0)
                 goto out;
 
+        /* if the channel changes while joined, join again */
+        if (changed & IEEE80211_CONF_CHANGE_CHANNEL &&
+            ((wl->band != conf->channel->band) ||
+             (wl->channel != channel))) {
+                wl->band = conf->channel->band;
+                wl->channel = channel;
+
+                /*
+                 * FIXME: the mac80211 should really provide a fixed rate
+                 * to use here. for now, just use the smallest possible rate
+                 * for the band as a fixed rate for association frames and
+                 * other control messages.
+                 */
+                if (!test_bit(WL1271_FLAG_STA_ASSOCIATED, &wl->flags))
+                        wl1271_set_band_rate(wl);
+
+                wl->basic_rate = wl1271_min_rate_get(wl);
+                ret = wl1271_acx_rate_policies(wl);
+                if (ret < 0)
+                        wl1271_warning("rate policy for update channel "
+                                       "failed %d", ret);
+
+                if (test_bit(WL1271_FLAG_JOINED, &wl->flags)) {
+                        ret = wl1271_join(wl, false);
+                        if (ret < 0)
+                                wl1271_warning("cmd join to update channel "
+                                               "failed %d", ret);
+                }
+        }
+
         if (changed & IEEE80211_CONF_CHANGE_IDLE) {
                 if (conf->flags & IEEE80211_CONF_IDLE &&
                     test_bit(WL1271_FLAG_JOINED, &wl->flags))
-                        wl1271_unjoin_channel(wl);
+                        wl1271_unjoin(wl);
                 else if (!(conf->flags & IEEE80211_CONF_IDLE))
-                        wl1271_join_channel(wl, channel);
+                        wl1271_dummy_join(wl);
 
                 if (conf->flags & IEEE80211_CONF_IDLE) {
-                        wl->rate_set = CONF_TX_RATE_MASK_BASIC;
+                        wl->rate_set = wl1271_min_rate_get(wl);
                         wl->sta_rate_set = 0;
                         wl1271_acx_rate_policies(wl);
-                }
+                        wl1271_acx_keep_alive_config(
+                                wl, CMD_TEMPL_KLV_IDX_NULL_DATA,
+                                ACX_KEEP_ALIVE_TPL_INVALID);
+                        set_bit(WL1271_FLAG_IDLE, &wl->flags);
+                } else
+                        clear_bit(WL1271_FLAG_IDLE, &wl->flags);
         }
 
-        /* if the channel changes while joined, join again */
-        if (channel != wl->channel &&
-            test_bit(WL1271_FLAG_JOINED, &wl->flags)) {
-                wl->channel = channel;
-                /* FIXME: maybe use CMD_CHANNEL_SWITCH for this? */
-                ret = wl1271_cmd_join(wl);
-                if (ret < 0)
-                        wl1271_warning("cmd join to update channel failed %d",
-                                       ret);
-        } else
-                wl->channel = channel;
-
         if (conf->flags & IEEE80211_CONF_PS &&
             !test_bit(WL1271_FLAG_PSM_REQUESTED, &wl->flags)) {
                 set_bit(WL1271_FLAG_PSM_REQUESTED, &wl->flags);
@@ -1273,13 +1323,13 @@ static int wl1271_op_config(struct ieee80211_hw *hw, u32 changed)
                  * through the bss_info_changed() hook.
                  */
                 if (test_bit(WL1271_FLAG_STA_ASSOCIATED, &wl->flags)) {
-                        wl1271_info("psm enabled");
+                        wl1271_debug(DEBUG_PSM, "psm enabled");
                         ret = wl1271_ps_set_mode(wl, STATION_POWER_SAVE_MODE,
                                                  true);
                 }
         } else if (!(conf->flags & IEEE80211_CONF_PS) &&
                    test_bit(WL1271_FLAG_PSM_REQUESTED, &wl->flags)) {
-                wl1271_info("psm disabled");
+                wl1271_debug(DEBUG_PSM, "psm disabled");
 
                 clear_bit(WL1271_FLAG_PSM_REQUESTED, &wl->flags);
 
@@ -1311,11 +1361,15 @@ struct wl1271_filter_params {
         u8 mc_list[ACX_MC_ADDRESS_GROUP_MAX][ETH_ALEN];
 };
 
-static u64 wl1271_op_prepare_multicast(struct ieee80211_hw *hw, int mc_count,
-                                       struct dev_addr_list *mc_list)
+static u64 wl1271_op_prepare_multicast(struct ieee80211_hw *hw,
+                                       struct netdev_hw_addr_list *mc_list)
 {
         struct wl1271_filter_params *fp;
-        int i;
+        struct netdev_hw_addr *ha;
+        struct wl1271 *wl = hw->priv;
+
+        if (unlikely(wl->state == WL1271_STATE_OFF))
+                return 0;
 
         fp = kzalloc(sizeof(*fp), GFP_ATOMIC);
         if (!fp) {
@@ -1324,21 +1378,16 @@ static u64 wl1271_op_prepare_multicast(struct ieee80211_hw *hw, int mc_count,
         }
 
         /* update multicast filtering parameters */
-        fp->enabled = true;
-        if (mc_count > ACX_MC_ADDRESS_GROUP_MAX) {
-                mc_count = 0;
-                fp->enabled = false;
-        }
-
         fp->mc_list_length = 0;
-        for (i = 0; i < mc_count; i++) {
-                if (mc_list->da_addrlen == ETH_ALEN) {
+        if (netdev_hw_addr_list_count(mc_list) > ACX_MC_ADDRESS_GROUP_MAX) {
+                fp->enabled = false;
+        } else {
+                fp->enabled = true;
+                netdev_hw_addr_list_for_each(ha, mc_list) {
                         memcpy(fp->mc_list[fp->mc_list_length],
-                               mc_list->da_addr, ETH_ALEN);
+                                        ha->addr, ETH_ALEN);
                         fp->mc_list_length++;
-                } else
-                        wl1271_warning("Unknown mc address length.");
-                mc_list = mc_list->next;
+                }
         }
 
         return (u64)(unsigned long)fp;
@@ -1363,15 +1412,16 @@ static void wl1271_op_configure_filter(struct ieee80211_hw *hw,
 
         mutex_lock(&wl->mutex);
 
-        if (wl->state == WL1271_STATE_OFF)
+        *total &= WL1271_SUPPORTED_FILTERS;
+        changed &= WL1271_SUPPORTED_FILTERS;
+
+        if (unlikely(wl->state == WL1271_STATE_OFF))
                 goto out;
 
         ret = wl1271_ps_elp_wakeup(wl, false);
         if (ret < 0)
                 goto out;
 
-        *total &= WL1271_SUPPORTED_FILTERS;
-        changed &= WL1271_SUPPORTED_FILTERS;
 
         if (*total & FIF_ALLMULTI)
                 ret = wl1271_acx_group_address_tbl(wl, false, NULL, 0);
@@ -1382,14 +1432,14 @@ static void wl1271_op_configure_filter(struct ieee80211_hw *hw,
         if (ret < 0)
                 goto out_sleep;
 
-        kfree(fp);
-
-        /* FIXME: We still need to set our filters properly */
-
         /* determine, whether supported filter values have changed */
         if (changed == 0)
                 goto out_sleep;
 
+        /* configure filters */
+        wl->filters = *total;
+        wl1271_configure_filters(wl, 0);
+
         /* apply configured filters */
         ret = wl1271_acx_rx_config(wl, wl->rx_config, wl->rx_filter);
         if (ret < 0)
@@ -1400,6 +1450,7 @@ out_sleep:
 
 out:
         mutex_unlock(&wl->mutex);
+        kfree(fp);
 }
 
 static int wl1271_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
@@ -1450,15 +1501,15 @@ static int wl1271_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                 key_type = KEY_TKIP;
 
                 key_conf->hw_key_idx = key_conf->keyidx;
-                tx_seq_32 = wl->tx_security_seq_32;
-                tx_seq_16 = wl->tx_security_seq_16;
+                tx_seq_32 = WL1271_TX_SECURITY_HI32(wl->tx_security_seq);
+                tx_seq_16 = WL1271_TX_SECURITY_LO16(wl->tx_security_seq);
                 break;
         case ALG_CCMP:
                 key_type = KEY_AES;
 
                 key_conf->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
-                tx_seq_32 = wl->tx_security_seq_32;
-                tx_seq_16 = wl->tx_security_seq_16;
+                tx_seq_32 = WL1271_TX_SECURITY_HI32(wl->tx_security_seq);
+                tx_seq_16 = WL1271_TX_SECURITY_LO16(wl->tx_security_seq);
                 break;
         default:
                 wl1271_error("Unknown key algo 0x%x", key_conf->alg);
@@ -1508,8 +1559,6 @@ static int wl1271_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
         default:
                 wl1271_error("Unsupported key cmd 0x%x", cmd);
                 ret = -EOPNOTSUPP;
-                goto out_sleep;
-
                 break;
         }
 
@@ -1524,6 +1573,7 @@ out:
 }
 
 static int wl1271_op_hw_scan(struct ieee80211_hw *hw,
+                             struct ieee80211_vif *vif,
                              struct cfg80211_scan_request *req)
 {
         struct wl1271 *wl = hw->priv;
@@ -1545,10 +1595,12 @@ static int wl1271_op_hw_scan(struct ieee80211_hw *hw,
                 goto out;
 
         if (wl1271_11a_enabled())
-                ret = wl1271_cmd_scan(hw->priv, ssid, len, 1, 0,
+                ret = wl1271_cmd_scan(hw->priv, ssid, len,
+                                      req->ie, req->ie_len, 1, 0,
                                       WL1271_SCAN_BAND_DUAL, 3);
         else
-                ret = wl1271_cmd_scan(hw->priv, ssid, len, 1, 0,
+                ret = wl1271_cmd_scan(hw->priv, ssid, len,
+                                      req->ie, req->ie_len, 1, 0,
                                       WL1271_SCAN_BAND_2_4_GHZ, 3);
 
         wl1271_ps_elp_sleep(wl);
@@ -1562,10 +1614,13 @@ out:
 static int wl1271_op_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
 {
         struct wl1271 *wl = hw->priv;
-        int ret;
+        int ret = 0;
 
         mutex_lock(&wl->mutex);
 
+        if (unlikely(wl->state == WL1271_STATE_OFF))
+                goto out;
+
         ret = wl1271_ps_elp_wakeup(wl, false);
         if (ret < 0)
                 goto out;
@@ -1607,6 +1662,7 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
         enum wl1271_cmd_ps_mode mode;
         struct wl1271 *wl = hw->priv;
         bool do_join = false;
+        bool set_assoc = false;
         int ret;
 
         wl1271_debug(DEBUG_MAC80211, "mac80211 bss info changed");
@@ -1617,20 +1673,29 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
         if (ret < 0)
                 goto out;
 
-        if (wl->bss_type == BSS_TYPE_IBSS) {
-                /* FIXME: This implements rudimentary ad-hoc support -
-                   proper templates are on the wish list and notification
-                   on when they change. This patch will update the templates
-                   on every call to this function. */
+        if ((changed && BSS_CHANGED_BEACON_INT) &&
+            (wl->bss_type == BSS_TYPE_IBSS)) {
+                wl1271_debug(DEBUG_ADHOC, "ad-hoc beacon interval updated: %d",
+                        bss_conf->beacon_int);
+
+                wl->beacon_int = bss_conf->beacon_int;
+                do_join = true;
+        }
+
+        if ((changed && BSS_CHANGED_BEACON) &&
+            (wl->bss_type == BSS_TYPE_IBSS)) {
                 struct sk_buff *beacon = ieee80211_beacon_get(hw, vif);
 
+                wl1271_debug(DEBUG_ADHOC, "ad-hoc beacon updated");
+
                 if (beacon) {
                         struct ieee80211_hdr *hdr;
 
                         wl1271_ssid_set(wl, beacon);
                         ret = wl1271_cmd_template_set(wl, CMD_TEMPL_BEACON,
                                                       beacon->data,
-                                                      beacon->len);
+                                                      beacon->len, 0,
+                                                      wl1271_min_rate_get(wl));
 
                         if (ret < 0) {
                                 dev_kfree_skb(beacon);
@@ -1645,7 +1710,8 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
                         ret = wl1271_cmd_template_set(wl,
                                                       CMD_TEMPL_PROBE_RESPONSE,
                                                       beacon->data,
-                                                      beacon->len);
+                                                      beacon->len, 0,
+                                                      wl1271_min_rate_get(wl));
                         dev_kfree_skb(beacon);
                         if (ret < 0)
                                 goto out_sleep;
@@ -1655,20 +1721,48 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
                 }
         }
 
+        if ((changed & BSS_CHANGED_BEACON_ENABLED) &&
+            (wl->bss_type == BSS_TYPE_IBSS)) {
+                wl1271_debug(DEBUG_ADHOC, "ad-hoc beaconing: %s",
+                             bss_conf->enable_beacon ? "enabled" : "disabled");
+
+                if (bss_conf->enable_beacon)
+                        wl->set_bss_type = BSS_TYPE_IBSS;
+                else
+                        wl->set_bss_type = BSS_TYPE_STA_BSS;
+                do_join = true;
+        }
+
+        if (changed & BSS_CHANGED_CQM) {
+                bool enable = false;
+                if (bss_conf->cqm_rssi_thold)
+                        enable = true;
+                ret = wl1271_acx_rssi_snr_trigger(wl, enable,
+                                                  bss_conf->cqm_rssi_thold,
+                                                  bss_conf->cqm_rssi_hyst);
+                if (ret < 0)
+                        goto out;
+                wl->rssi_thold = bss_conf->cqm_rssi_thold;
+        }
+
         if ((changed & BSS_CHANGED_BSSID) &&
             /*
              * Now we know the correct bssid, so we send a new join command
              * and enable the BSSID filter
              */
             memcmp(wl->bssid, bss_conf->bssid, ETH_ALEN)) {
-                        wl->rx_config |= CFG_BSSID_FILTER_EN;
                         memcpy(wl->bssid, bss_conf->bssid, ETH_ALEN);
+
                         ret = wl1271_cmd_build_null_data(wl);
-                        if (ret < 0) {
-                                wl1271_warning("cmd buld null data failed %d",
-                                               ret);
+                        if (ret < 0)
+                                goto out_sleep;
+
+                        ret = wl1271_build_qos_null_data(wl);
+                        if (ret < 0)
                                 goto out_sleep;
-                        }
+
+                        /* filter out all packets not from this BSSID */
+                        wl1271_configure_filters(wl, 0);
 
                         /* Need to update the BSSID (for filtering etc) */
                         do_join = true;
@@ -1676,8 +1770,21 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
 
         if (changed & BSS_CHANGED_ASSOC) {
                 if (bss_conf->assoc) {
+                        u32 rates;
                         wl->aid = bss_conf->aid;
-                        set_bit(WL1271_FLAG_STA_ASSOCIATED, &wl->flags);
+                        set_assoc = true;
+
+                        /*
+                         * use basic rates from AP, and determine lowest rate
+                         * to use with control frames.
+                         */
+                        rates = bss_conf->basic_rates;
+                        wl->basic_rate_set = wl1271_tx_enabled_rates_get(wl,
+                                                                         rates);
+                        wl->basic_rate = wl1271_min_rate_get(wl);
+                        ret = wl1271_acx_rate_policies(wl);
+                        if (ret < 0)
+                                goto out_sleep;
 
                         /*
                          * with wl1271, we don't need to update the
@@ -1689,7 +1796,17 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
                         if (ret < 0)
                                 goto out_sleep;
 
-                        ret = wl1271_acx_aid(wl, wl->aid);
+                        /*
+                         * The SSID is intentionally set to NULL here - the
+                         * firmware will set the probe request with a
+                         * broadcast SSID regardless of what we set in the
+                         * template.
+                         */
+                        ret = wl1271_cmd_build_probe_req(wl, NULL, 0,
+                                                         NULL, 0, wl->band);
+
+                        /* enable the connection monitoring feature */
+                        ret = wl1271_acx_conn_monit_params(wl, true);
                         if (ret < 0)
                                 goto out_sleep;
 
@@ -1705,6 +1822,22 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
                         /* use defaults when not associated */
                         clear_bit(WL1271_FLAG_STA_ASSOCIATED, &wl->flags);
                         wl->aid = 0;
+
+                        /* revert back to minimum rates for the current band */
+                        wl1271_set_band_rate(wl);
+                        wl->basic_rate = wl1271_min_rate_get(wl);
+                        ret = wl1271_acx_rate_policies(wl);
+                        if (ret < 0)
+                                goto out_sleep;
+
+                        /* disable connection monitor features */
+                        ret = wl1271_acx_conn_monit_params(wl, false);
+
+                        /* Disable the keep-alive feature */
+                        ret = wl1271_acx_keep_alive_mode(wl, false);
+
+                        if (ret < 0)
+                                goto out_sleep;
                 }
 
         }
@@ -1739,12 +1872,11 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
         }
 
         if (do_join) {
-                ret = wl1271_cmd_join(wl);
+                ret = wl1271_join(wl, set_assoc);
                 if (ret < 0) {
                         wl1271_warning("cmd join failed %d", ret);
                         goto out_sleep;
                 }
-                set_bit(WL1271_FLAG_JOINED, &wl->flags);
         }
 
 out_sleep:
@@ -1758,6 +1890,7 @@ static int wl1271_op_conf_tx(struct ieee80211_hw *hw, u16 queue,
                              const struct ieee80211_tx_queue_params *params)
 {
         struct wl1271 *wl = hw->priv;
+        u8 ps_scheme;
         int ret;
 
         mutex_lock(&wl->mutex);
@@ -1768,17 +1901,22 @@ static int wl1271_op_conf_tx(struct ieee80211_hw *hw, u16 queue,
         if (ret < 0)
                 goto out;
 
+        /* the txop is confed in units of 32us by the mac80211, we need us */
         ret = wl1271_acx_ac_cfg(wl, wl1271_tx_get_queue(queue),
                                 params->cw_min, params->cw_max,
-                                params->aifs, params->txop);
+                                params->aifs, params->txop << 5);
         if (ret < 0)
                 goto out_sleep;
 
+        if (params->uapsd)
+                ps_scheme = CONF_PS_SCHEME_UPSD_TRIGGER;
+        else
+                ps_scheme = CONF_PS_SCHEME_LEGACY;
+
         ret = wl1271_acx_tid_cfg(wl, wl1271_tx_get_queue(queue),
                                  CONF_CHANNEL_TYPE_EDCF,
                                  wl1271_tx_get_queue(queue),
-                                 CONF_PS_SCHEME_LEGACY_PSPOLL,
-                                 CONF_ACK_POLICY_LEGACY, 0, 0);
+                                 ps_scheme, CONF_ACK_POLICY_LEGACY, 0, 0);
         if (ret < 0)
                 goto out_sleep;
 
@@ -1852,6 +1990,36 @@ static struct ieee80211_channel wl1271_channels[] = {
         { .hw_value = 13, .center_freq = 2472, .max_power = 25 },
 };
 
+/* mapping to indexes for wl1271_rates */
+const static u8 wl1271_rate_to_idx_2ghz[] = {
+        /* MCS rates are used only with 11n */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS7 */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS6 */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS5 */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS4 */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS3 */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS2 */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS1 */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS0 */
+
+        11,                            /* CONF_HW_RXTX_RATE_54   */
+        10,                            /* CONF_HW_RXTX_RATE_48   */
+        9,                             /* CONF_HW_RXTX_RATE_36   */
+        8,                             /* CONF_HW_RXTX_RATE_24   */
+
+        /* TI-specific rate */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_22   */
+
+        7,                             /* CONF_HW_RXTX_RATE_18   */
+        6,                             /* CONF_HW_RXTX_RATE_12   */
+        3,                             /* CONF_HW_RXTX_RATE_11   */
+        5,                             /* CONF_HW_RXTX_RATE_9    */
+        4,                             /* CONF_HW_RXTX_RATE_6    */
+        2,                             /* CONF_HW_RXTX_RATE_5_5  */
+        1,                             /* CONF_HW_RXTX_RATE_2    */
+        0                              /* CONF_HW_RXTX_RATE_1    */
+};
+
 /* can't be const, mac80211 writes to this */
 static struct ieee80211_supported_band wl1271_band_2ghz = {
         .channels = wl1271_channels,
@@ -1934,6 +2102,35 @@ static struct ieee80211_channel wl1271_channels_5ghz[] = {
         { .hw_value = 165, .center_freq = 5825},
 };
 
+/* mapping to indexes for wl1271_rates_5ghz */
+const static u8 wl1271_rate_to_idx_5ghz[] = {
+        /* MCS rates are used only with 11n */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS7 */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS6 */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS5 */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS4 */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS3 */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS2 */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS1 */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS0 */
+
+        7,                             /* CONF_HW_RXTX_RATE_54   */
+        6,                             /* CONF_HW_RXTX_RATE_48   */
+        5,                             /* CONF_HW_RXTX_RATE_36   */
+        4,                             /* CONF_HW_RXTX_RATE_24   */
+
+        /* TI-specific rate */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_22   */
+
+        3,                             /* CONF_HW_RXTX_RATE_18   */
+        2,                             /* CONF_HW_RXTX_RATE_12   */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_11   */
+        1,                             /* CONF_HW_RXTX_RATE_9    */
+        0,                             /* CONF_HW_RXTX_RATE_6    */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_5_5  */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_2    */
+        CONF_HW_RXTX_RATE_UNSUPPORTED  /* CONF_HW_RXTX_RATE_1    */
+};
 
 static struct ieee80211_supported_band wl1271_band_5ghz = {
         .channels = wl1271_channels_5ghz,
@@ -1942,13 +2139,17 @@ static struct ieee80211_supported_band wl1271_band_5ghz = {
         .n_bitrates = ARRAY_SIZE(wl1271_rates_5ghz),
 };
 
+const static u8 *wl1271_band_rate_to_idx[] = {
+        [IEEE80211_BAND_2GHZ] = wl1271_rate_to_idx_2ghz,
+        [IEEE80211_BAND_5GHZ] = wl1271_rate_to_idx_5ghz
+};
+
 static const struct ieee80211_ops wl1271_ops = {
         .start = wl1271_op_start,
         .stop = wl1271_op_stop,
         .add_interface = wl1271_op_add_interface,
         .remove_interface = wl1271_op_remove_interface,
         .config = wl1271_op_config,
-/*      .config_interface = wl1271_op_config_interface, */
         .prepare_multicast = wl1271_op_prepare_multicast,
         .configure_filter = wl1271_op_configure_filter,
         .tx = wl1271_op_tx,
@@ -1960,7 +2161,113 @@ static const struct ieee80211_ops wl1271_ops = {
         CFG80211_TESTMODE_CMD(wl1271_tm_cmd)
 };
 
-static int wl1271_register_hw(struct wl1271 *wl)
+
+u8 wl1271_rate_to_idx(struct wl1271 *wl, int rate)
+{
+        u8 idx;
+
+        BUG_ON(wl->band >= sizeof(wl1271_band_rate_to_idx)/sizeof(u8 *));
+
+        if (unlikely(rate >= CONF_HW_RXTX_RATE_MAX)) {
+                wl1271_error("Illegal RX rate from HW: %d", rate);
+                return 0;
+        }
+
+        idx = wl1271_band_rate_to_idx[wl->band][rate];
+        if (unlikely(idx == CONF_HW_RXTX_RATE_UNSUPPORTED)) {
+                wl1271_error("Unsupported RX rate from HW: %d", rate);
+                return 0;
+        }
+
+        return idx;
+}
+
+static ssize_t wl1271_sysfs_show_bt_coex_state(struct device *dev,
+                                               struct device_attribute *attr,
+                                               char *buf)
+{
+        struct wl1271 *wl = dev_get_drvdata(dev);
+        ssize_t len;
+
+        /* FIXME: what's the maximum length of buf? page size?*/
+        len = 500;
+
+        mutex_lock(&wl->mutex);
+        len = snprintf(buf, len, "%d\n\n0 - off\n1 - on\n",
+                       wl->sg_enabled);
+        mutex_unlock(&wl->mutex);
+
+        return len;
+
+}
+
+static ssize_t wl1271_sysfs_store_bt_coex_state(struct device *dev,
+                                                struct device_attribute *attr,
+                                                const char *buf, size_t count)
+{
+        struct wl1271 *wl = dev_get_drvdata(dev);
+        unsigned long res;
+        int ret;
+
+        ret = strict_strtoul(buf, 10, &res);
+
+        if (ret < 0) {
+                wl1271_warning("incorrect value written to bt_coex_mode");
+                return count;
+        }
+
+        mutex_lock(&wl->mutex);
+
+        res = !!res;
+
+        if (res == wl->sg_enabled)
+                goto out;
+
+        wl->sg_enabled = res;
+
+        if (wl->state == WL1271_STATE_OFF)
+                goto out;
+
+        ret = wl1271_ps_elp_wakeup(wl, false);
+        if (ret < 0)
+                goto out;
+
+        wl1271_acx_sg_enable(wl, wl->sg_enabled);
+        wl1271_ps_elp_sleep(wl);
+
+ out:
+        mutex_unlock(&wl->mutex);
+        return count;
+}
+
+static DEVICE_ATTR(bt_coex_state, S_IRUGO | S_IWUSR,
+                   wl1271_sysfs_show_bt_coex_state,
+                   wl1271_sysfs_store_bt_coex_state);
+
+static ssize_t wl1271_sysfs_show_hw_pg_ver(struct device *dev,
+                                           struct device_attribute *attr,
+                                           char *buf)
+{
+        struct wl1271 *wl = dev_get_drvdata(dev);
+        ssize_t len;
+
+        /* FIXME: what's the maximum length of buf? page size?*/
+        len = 500;
+
+        mutex_lock(&wl->mutex);
+        if (wl->hw_pg_ver >= 0)
+                len = snprintf(buf, len, "%d\n", wl->hw_pg_ver);
+        else
+                len = snprintf(buf, len, "n/a\n");
+        mutex_unlock(&wl->mutex);
+
+        return len;
+}
+
+static DEVICE_ATTR(hw_pg_ver, S_IRUGO | S_IWUSR,
+                   wl1271_sysfs_show_hw_pg_ver, NULL);
+
+int wl1271_register_hw(struct wl1271 *wl)
 {
         int ret;
 
@@ -1981,8 +2288,17 @@ static int wl1271_register_hw(struct wl1271 *wl)
 
         return 0;
 }
+EXPORT_SYMBOL_GPL(wl1271_register_hw);
+
+void wl1271_unregister_hw(struct wl1271 *wl)
+{
+        ieee80211_unregister_hw(wl->hw);
+        wl->mac80211_registered = false;
+
+}
+EXPORT_SYMBOL_GPL(wl1271_unregister_hw);
 
-static int wl1271_init_ieee80211(struct wl1271 *wl)
+int wl1271_init_ieee80211(struct wl1271 *wl)
 {
         /* The tx descriptor buffer and the TKIP space. */
         wl->hw->extra_tx_headroom = WL1271_TKIP_IV_SPACE +
@@ -1991,11 +2307,15 @@ static int wl1271_init_ieee80211(struct wl1271 *wl)
         /* unit us */
         /* FIXME: find a proper value */
         wl->hw->channel_change_time = 10000;
+        wl->hw->max_listen_interval = wl->conf.conn.max_listen_interval;
 
         wl->hw->flags = IEEE80211_HW_SIGNAL_DBM |
-                IEEE80211_HW_NOISE_DBM |
                 IEEE80211_HW_BEACON_FILTER |
-                IEEE80211_HW_SUPPORTS_PS;
+                IEEE80211_HW_SUPPORTS_PS |
+                IEEE80211_HW_SUPPORTS_UAPSD |
+                IEEE80211_HW_HAS_RATE_CONTROL |
+                IEEE80211_HW_CONNECTION_MONITOR |
+                IEEE80211_HW_SUPPORTS_CQM_RSSI;
 
         wl->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
                 BIT(NL80211_IFTYPE_ADHOC);
@@ -2005,51 +2325,53 @@ static int wl1271_init_ieee80211(struct wl1271 *wl)
         if (wl1271_11a_enabled())
                 wl->hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &wl1271_band_5ghz;
 
-        SET_IEEE80211_DEV(wl->hw, &wl->spi->dev);
+        wl->hw->queues = 4;
+        wl->hw->max_rates = 1;
 
-        return 0;
-}
-
-static void wl1271_device_release(struct device *dev)
-{
+        SET_IEEE80211_DEV(wl->hw, wl1271_wl_to_dev(wl));
 
+        return 0;
 }
-
-static struct platform_device wl1271_device = {
-        .name           = "wl1271",
-        .id             = -1,
-
-        /* device model insists to have a release function */
-        .dev            = {
-                .release = wl1271_device_release,
-        },
-};
+EXPORT_SYMBOL_GPL(wl1271_init_ieee80211);
 
 #define WL1271_DEFAULT_CHANNEL 0
 
-static struct ieee80211_hw *wl1271_alloc_hw(void)
+struct ieee80211_hw *wl1271_alloc_hw(void)
 {
         struct ieee80211_hw *hw;
+        struct platform_device *plat_dev = NULL;
         struct wl1271 *wl;
-        int i;
+        int i, ret;
 
         hw = ieee80211_alloc_hw(sizeof(*wl), &wl1271_ops);
         if (!hw) {
                 wl1271_error("could not alloc ieee80211_hw");
-                return ERR_PTR(-ENOMEM);
+                ret = -ENOMEM;
+                goto err_hw_alloc;
+        }
+
+        plat_dev = kmalloc(sizeof(wl1271_device), GFP_KERNEL);
+        if (!plat_dev) {
+                wl1271_error("could not allocate platform_device");
+                ret = -ENOMEM;
+                goto err_plat_alloc;
         }
 
+        memcpy(plat_dev, &wl1271_device, sizeof(wl1271_device));
+
         wl = hw->priv;
         memset(wl, 0, sizeof(*wl));
 
         INIT_LIST_HEAD(&wl->list);
 
         wl->hw = hw;
+        wl->plat_dev = plat_dev;
 
         skb_queue_head_init(&wl->tx_queue);
 
         INIT_DELAYED_WORK(&wl->elp_work, wl1271_elp_work);
         wl->channel = WL1271_DEFAULT_CHANNEL;
+        wl->beacon_int = WL1271_DEFAULT_BEACON_INT;
         wl->default_key = 0;
         wl->rx_counter = 0;
         wl->rx_config = WL1271_DEFAULT_RX_CONFIG;
@@ -2057,11 +2379,14 @@ static struct ieee80211_hw *wl1271_alloc_hw(void)
         wl->psm_entry_retry = 0;
         wl->power_level = WL1271_DEFAULT_POWER_LEVEL;
         wl->basic_rate_set = CONF_TX_RATE_MASK_BASIC;
+        wl->basic_rate = CONF_TX_RATE_MASK_BASIC;
         wl->rate_set = CONF_TX_RATE_MASK_BASIC;
         wl->sta_rate_set = 0;
         wl->band = IEEE80211_BAND_2GHZ;
         wl->vif = NULL;
         wl->flags = 0;
+        wl->sg_enabled = true;
+        wl->hw_pg_ver = -1;
 
         for (i = 0; i < ACX_TX_DESCRIPTORS; i++)
                 wl->tx_frames[i] = NULL;
@@ -2074,167 +2399,72 @@ static struct ieee80211_hw *wl1271_alloc_hw(void)
         /* Apply default driver configuration. */
         wl1271_conf_init(wl);
 
-        return hw;
-}
-
-int wl1271_free_hw(struct wl1271 *wl)
-{
-        ieee80211_unregister_hw(wl->hw);
-
-        wl1271_debugfs_exit(wl);
-
-        kfree(wl->target_mem_map);
-        vfree(wl->fw);
-        wl->fw = NULL;
-        kfree(wl->nvs);
-        wl->nvs = NULL;
-
-        kfree(wl->fw_status);
-        kfree(wl->tx_res_if);
-
-        ieee80211_free_hw(wl->hw);
-
-        return 0;
-}
-
-static int __devinit wl1271_probe(struct spi_device *spi)
-{
-        struct wl12xx_platform_data *pdata;
-        struct ieee80211_hw *hw;
-        struct wl1271 *wl;
-        int ret;
+        wl1271_debugfs_init(wl);
 
-        pdata = spi->dev.platform_data;
-        if (!pdata) {
-                wl1271_error("no platform data");
-                return -ENODEV;
+        /* Register platform device */
+        ret = platform_device_register(wl->plat_dev);
+        if (ret) {
+                wl1271_error("couldn't register platform device");
+                goto err_hw;
         }
+        dev_set_drvdata(&wl->plat_dev->dev, wl);
 
-        hw = wl1271_alloc_hw();
-        if (IS_ERR(hw))
-                return PTR_ERR(hw);
-
-        wl = hw->priv;
-
-        dev_set_drvdata(&spi->dev, wl);
-        wl->spi = spi;
-
-        /* This is the only SPI value that we need to set here, the rest
-         * comes from the board-peripherals file */
-        spi->bits_per_word = 32;
-
-        ret = spi_setup(spi);
+        /* Create sysfs file to control bt coex state */
+        ret = device_create_file(&wl->plat_dev->dev, &dev_attr_bt_coex_state);
         if (ret < 0) {
-                wl1271_error("spi_setup failed");
-                goto out_free;
-        }
-
-        wl->set_power = pdata->set_power;
-        if (!wl->set_power) {
-                wl1271_error("set power function missing in platform data");
-                ret = -ENODEV;
-                goto out_free;
+                wl1271_error("failed to create sysfs file bt_coex_state");
+                goto err_platform;
         }
 
-        wl->irq = spi->irq;
-        if (wl->irq < 0) {
-                wl1271_error("irq missing in platform data");
-                ret = -ENODEV;
-                goto out_free;
-        }
-
-        ret = request_irq(wl->irq, wl1271_irq, 0, DRIVER_NAME, wl);
+        /* Create sysfs file to get HW PG version */
+        ret = device_create_file(&wl->plat_dev->dev, &dev_attr_hw_pg_ver);
         if (ret < 0) {
-                wl1271_error("request_irq() failed: %d", ret);
-                goto out_free;
-        }
-
-        set_irq_type(wl->irq, IRQ_TYPE_EDGE_RISING);
-
-        disable_irq(wl->irq);
-
-        ret = platform_device_register(&wl1271_device);
-        if (ret) {
-                wl1271_error("couldn't register platform device");
-                goto out_irq;
+                wl1271_error("failed to create sysfs file hw_pg_ver");
+                goto err_bt_coex_state;
         }
-        dev_set_drvdata(&wl1271_device.dev, wl);
-
-        ret = wl1271_init_ieee80211(wl);
-        if (ret)
-                goto out_platform;
-
-        ret = wl1271_register_hw(wl);
-        if (ret)
-                goto out_platform;
-
-        wl1271_debugfs_init(wl);
 
-        wl1271_notice("initialized");
+        return hw;
 
-        return 0;
+err_bt_coex_state:
+        device_remove_file(&wl->plat_dev->dev, &dev_attr_bt_coex_state);
 
- out_platform:
-        platform_device_unregister(&wl1271_device);
+err_platform:
+        platform_device_unregister(wl->plat_dev);
 
- out_irq:
-        free_irq(wl->irq, wl);
+err_hw:
+        wl1271_debugfs_exit(wl);
+        kfree(plat_dev);
 
- out_free:
+err_plat_alloc:
         ieee80211_free_hw(hw);
 
-        return ret;
-}
-
-static int __devexit wl1271_remove(struct spi_device *spi)
-{
-        struct wl1271 *wl = dev_get_drvdata(&spi->dev);
+err_hw_alloc:
 
-        platform_device_unregister(&wl1271_device);
-        free_irq(wl->irq, wl);
-
-        wl1271_free_hw(wl);
-
-        return 0;
+        return ERR_PTR(ret);
 }
+EXPORT_SYMBOL_GPL(wl1271_alloc_hw);
 
-
-static struct spi_driver wl1271_spi_driver = {
-        .driver = {
-                .name           = "wl1271",
-                .bus            = &spi_bus_type,
-                .owner          = THIS_MODULE,
-        },
-
-        .probe          = wl1271_probe,
-        .remove         = __devexit_p(wl1271_remove),
-};
-
-static int __init wl1271_init(void)
+int wl1271_free_hw(struct wl1271 *wl)
 {
-        int ret;
+        platform_device_unregister(wl->plat_dev);
+        kfree(wl->plat_dev);
 
-        ret = spi_register_driver(&wl1271_spi_driver);
-        if (ret < 0) {
-                wl1271_error("failed to register spi driver: %d", ret);
-                goto out;
-        }
+        wl1271_debugfs_exit(wl);
 
-out:
-        return ret;
-}
+        vfree(wl->fw);
+        wl->fw = NULL;
+        kfree(wl->nvs);
+        wl->nvs = NULL;
 
-static void __exit wl1271_exit(void)
-{
-        spi_unregister_driver(&wl1271_spi_driver);
+        kfree(wl->fw_status);
+        kfree(wl->tx_res_if);
 
-        wl1271_notice("unloaded");
-}
+        ieee80211_free_hw(wl->hw);
 
-module_init(wl1271_init);
-module_exit(wl1271_exit);
+        return 0;
+}
+EXPORT_SYMBOL_GPL(wl1271_free_hw);
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Luciano Coelho <luciano.coelho@nokia.com>");
 MODULE_AUTHOR("Juuso Oikarinen <juuso.oikarinen@nokia.com>");
-MODULE_FIRMWARE(WL1271_FW_NAME);
diff --git a/drivers/net/wireless/wl12xx/wl1271_ps.c b/drivers/net/wireless/wl12xx/wl1271_ps.c
index e2b1ebf096e..a5e60e0403e 100644
--- a/drivers/net/wireless/wl12xx/wl1271_ps.c
+++ b/drivers/net/wireless/wl12xx/wl1271_ps.c
@@ -23,7 +23,6 @@
 
 #include "wl1271_reg.h"
 #include "wl1271_ps.h"
-#include "wl1271_spi.h"
 #include "wl1271_io.h"
 
 #define WL1271_WAKEUP_TIMEOUT 500
@@ -41,7 +40,8 @@ void wl1271_elp_work(struct work_struct *work)
         mutex_lock(&wl->mutex);
 
         if (test_bit(WL1271_FLAG_IN_ELP, &wl->flags) ||
-            !test_bit(WL1271_FLAG_PSM, &wl->flags))
+            (!test_bit(WL1271_FLAG_PSM, &wl->flags) &&
+             !test_bit(WL1271_FLAG_IDLE, &wl->flags)))
                 goto out;
 
         wl1271_debug(DEBUG_PSM, "chip to elp");
@@ -57,7 +57,8 @@ out:
 /* Routines to toggle sleep mode while in ELP */
 void wl1271_ps_elp_sleep(struct wl1271 *wl)
 {
-        if (test_bit(WL1271_FLAG_PSM, &wl->flags)) {
+        if (test_bit(WL1271_FLAG_PSM, &wl->flags) ||
+            test_bit(WL1271_FLAG_IDLE, &wl->flags)) {
                 cancel_delayed_work(&wl->elp_work);
                 ieee80211_queue_delayed_work(wl->hw, &wl->elp_work,
                                         msecs_to_jiffies(ELP_ENTRY_DELAY));
diff --git a/drivers/net/wireless/wl12xx/wl1271_rx.c b/drivers/net/wireless/wl12xx/wl1271_rx.c
index c723d9c7e13..57f4bfd959c 100644
--- a/drivers/net/wireless/wl12xx/wl1271_rx.c
+++ b/drivers/net/wireless/wl12xx/wl1271_rx.c
@@ -27,7 +27,6 @@
 #include "wl1271_acx.h"
 #include "wl1271_reg.h"
 #include "wl1271_rx.h"
-#include "wl1271_spi.h"
 #include "wl1271_io.h"
 
 static u8 wl1271_rx_get_mem_block(struct wl1271_fw_status *status,
@@ -44,66 +43,6 @@ static u32 wl1271_rx_get_buf_size(struct wl1271_fw_status *status,
                 RX_BUF_SIZE_MASK) >> RX_BUF_SIZE_SHIFT_DIV;
 }
 
-/* The values of this table must match the wl1271_rates[] array */
-static u8 wl1271_rx_rate_to_idx[] = {
-        /* MCS rates are used only with 11n */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS7 */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS6 */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS5 */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS4 */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS3 */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS2 */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS1 */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS0 */
-
-        11,                         /* WL1271_RATE_54   */
-        10,                         /* WL1271_RATE_48   */
-        9,                          /* WL1271_RATE_36   */
-        8,                          /* WL1271_RATE_24   */
-
-        /* TI-specific rate */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_22   */
-
-        7,                          /* WL1271_RATE_18   */
-        6,                          /* WL1271_RATE_12   */
-        3,                          /* WL1271_RATE_11   */
-        5,                          /* WL1271_RATE_9    */
-        4,                          /* WL1271_RATE_6    */
-        2,                          /* WL1271_RATE_5_5  */
-        1,                          /* WL1271_RATE_2    */
-        0                           /* WL1271_RATE_1    */
-};
-
-/* The values of this table must match the wl1271_rates[] array */
-static u8 wl1271_5_ghz_rx_rate_to_idx[] = {
-        /* MCS rates are used only with 11n */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS7 */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS6 */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS5 */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS4 */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS3 */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS2 */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS1 */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS0 */
-
-        7,                          /* WL1271_RATE_54   */
-        6,                          /* WL1271_RATE_48   */
-        5,                          /* WL1271_RATE_36   */
-        4,                          /* WL1271_RATE_24   */
-
-        /* TI-specific rate */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_22   */
-
-        3,                          /* WL1271_RATE_18   */
-        2,                          /* WL1271_RATE_12   */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_11   */
-        1,                          /* WL1271_RATE_9    */
-        0,                          /* WL1271_RATE_6    */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_5_5  */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_2    */
-        WL1271_RX_RATE_UNSUPPORTED  /* WL1271_RATE_1    */
-};
-
 static void wl1271_rx_status(struct wl1271 *wl,
                              struct wl1271_rx_descriptor *desc,
                              struct ieee80211_rx_status *status,
@@ -111,20 +50,8 @@ static void wl1271_rx_status(struct wl1271 *wl,
 {
         memset(status, 0, sizeof(struct ieee80211_rx_status));
 
-        if ((desc->flags & WL1271_RX_DESC_BAND_MASK) ==
-            WL1271_RX_DESC_BAND_BG) {
-                status->band = IEEE80211_BAND_2GHZ;
-                status->rate_idx = wl1271_rx_rate_to_idx[desc->rate];
-        } else if ((desc->flags & WL1271_RX_DESC_BAND_MASK) ==
-                 WL1271_RX_DESC_BAND_A) {
-                status->band = IEEE80211_BAND_5GHZ;
-                status->rate_idx = wl1271_5_ghz_rx_rate_to_idx[desc->rate];
-        } else
-                wl1271_warning("unsupported band 0x%x",
-                               desc->flags & WL1271_RX_DESC_BAND_MASK);
-
-        if (unlikely(status->rate_idx == WL1271_RX_RATE_UNSUPPORTED))
-                wl1271_warning("unsupported rate");
+        status->band = wl->band;
+        status->rate_idx = wl1271_rate_to_idx(wl, desc->rate);
 
         /*
          * FIXME: Add mactime handling.  For IBSS (ad-hoc) we need to get the
@@ -134,13 +61,6 @@ static void wl1271_rx_status(struct wl1271 *wl,
          */
         status->signal = desc->rssi;
 
-        /*
-         * FIXME: In wl1251, the SNR should be divided by two.  In wl1271 we
-         * need to divide by two for now, but TI has been discussing about
-         * changing it.  This needs to be rechecked.
-         */
-        status->noise = desc->rssi - (desc->snr >> 1);
-
         status->freq = ieee80211_channel_to_frequency(desc->channel);
 
         if (desc->flags & WL1271_RX_DESC_ENCRYPT_MASK) {
@@ -162,6 +82,13 @@ static void wl1271_rx_handle_data(struct wl1271 *wl, u32 length)
         u8 *buf;
         u8 beacon = 0;
 
+        /*
+         * In PLT mode we seem to get frames and mac80211 warns about them,
+         * workaround this by not retrieving them at all.
+         */
+        if (unlikely(wl->state == WL1271_STATE_PLT))
+                return;
+
         skb = __dev_alloc_skb(length, GFP_KERNEL);
         if (!skb) {
                 wl1271_error("Couldn't allocate RX frame");
@@ -220,6 +147,7 @@ void wl1271_rx(struct wl1271 *wl, struct wl1271_fw_status *status)
 
                 wl->rx_counter++;
                 drv_rx_counter = wl->rx_counter & NUM_RX_PKT_DESC_MOD_MASK;
-                wl1271_write32(wl, RX_DRIVER_COUNTER_ADDRESS, wl->rx_counter);
         }
+
+        wl1271_write32(wl, RX_DRIVER_COUNTER_ADDRESS, wl->rx_counter);
 }
diff --git a/drivers/net/wireless/wl12xx/wl1271_rx.h b/drivers/net/wireless/wl12xx/wl1271_rx.h
index 1ae6d1783ed..b89be4758e7 100644
--- a/drivers/net/wireless/wl12xx/wl1271_rx.h
+++ b/drivers/net/wireless/wl12xx/wl1271_rx.h
@@ -43,7 +43,6 @@
 #define RX_MAX_PACKET_ID 3
 
 #define NUM_RX_PKT_DESC_MOD_MASK   7
-#define WL1271_RX_RATE_UNSUPPORTED 0xFF
 
 #define RX_DESC_VALID_FCS         0x0001
 #define RX_DESC_MATCH_RXADDR1     0x0002
@@ -117,5 +116,6 @@ struct wl1271_rx_descriptor {
 } __attribute__ ((packed));
 
 void wl1271_rx(struct wl1271 *wl, struct wl1271_fw_status *status);
+u8 wl1271_rate_to_idx(struct wl1271 *wl, int rate);
 
 #endif
diff --git a/drivers/net/wireless/wl12xx/wl1271_sdio.c b/drivers/net/wireless/wl12xx/wl1271_sdio.c
new file mode 100644
index 00000000000..d3d6f302f70
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/wl1271_sdio.c
@@ -0,0 +1,291 @@
+/*
+ * This file is part of wl1271
+ *
+ * Copyright (C) 2009-2010 Nokia Corporation
+ *
+ * Contact: Luciano Coelho <luciano.coelho@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include <linux/irq.h>
+#include <linux/module.h>
+#include <linux/crc7.h>
+#include <linux/vmalloc.h>
+#include <linux/mmc/sdio_func.h>
+#include <linux/mmc/sdio_ids.h>
+#include <linux/mmc/card.h>
+#include <plat/gpio.h>
+
+#include "wl1271.h"
+#include "wl12xx_80211.h"
+#include "wl1271_io.h"
+
+
+#define RX71_WL1271_IRQ_GPIO            42
+
+#ifndef SDIO_VENDOR_ID_TI
+#define SDIO_VENDOR_ID_TI               0x0097
+#endif
+
+#ifndef SDIO_DEVICE_ID_TI_WL1271
+#define SDIO_DEVICE_ID_TI_WL1271        0x4076
+#endif
+
+static const struct sdio_device_id wl1271_devices[] = {
+        { SDIO_DEVICE(SDIO_VENDOR_ID_TI, SDIO_DEVICE_ID_TI_WL1271) },
+        {}
+};
+MODULE_DEVICE_TABLE(sdio, wl1271_devices);
+
+static inline struct sdio_func *wl_to_func(struct wl1271 *wl)
+{
+        return wl->if_priv;
+}
+
+static struct device *wl1271_sdio_wl_to_dev(struct wl1271 *wl)
+{
+        return &(wl_to_func(wl)->dev);
+}
+
+static irqreturn_t wl1271_irq(int irq, void *cookie)
+{
+        struct wl1271 *wl = cookie;
+        unsigned long flags;
+
+        wl1271_debug(DEBUG_IRQ, "IRQ");
+
+        /* complete the ELP completion */
+        spin_lock_irqsave(&wl->wl_lock, flags);
+        if (wl->elp_compl) {
+                complete(wl->elp_compl);
+                wl->elp_compl = NULL;
+        }
+
+        if (!test_and_set_bit(WL1271_FLAG_IRQ_RUNNING, &wl->flags))
+                ieee80211_queue_work(wl->hw, &wl->irq_work);
+        set_bit(WL1271_FLAG_IRQ_PENDING, &wl->flags);
+        spin_unlock_irqrestore(&wl->wl_lock, flags);
+
+        return IRQ_HANDLED;
+}
+
+static void wl1271_sdio_disable_interrupts(struct wl1271 *wl)
+{
+        disable_irq(wl->irq);
+}
+
+static void wl1271_sdio_enable_interrupts(struct wl1271 *wl)
+{
+        enable_irq(wl->irq);
+}
+
+static void wl1271_sdio_reset(struct wl1271 *wl)
+{
+}
+
+static void wl1271_sdio_init(struct wl1271 *wl)
+{
+}
+
+static void wl1271_sdio_raw_read(struct wl1271 *wl, int addr, void *buf,
+                                 size_t len, bool fixed)
+{
+        int ret;
+        struct sdio_func *func = wl_to_func(wl);
+
+        if (unlikely(addr == HW_ACCESS_ELP_CTRL_REG_ADDR)) {
+                ((u8 *)buf)[0] = sdio_f0_readb(func, addr, &ret);
+                wl1271_debug(DEBUG_SDIO, "sdio read 52 addr 0x%x, byte 0x%02x",
+                             addr, ((u8 *)buf)[0]);
+        } else {
+                if (fixed)
+                        ret = sdio_readsb(func, buf, addr, len);
+                else
+                        ret = sdio_memcpy_fromio(func, buf, addr, len);
+
+                wl1271_debug(DEBUG_SDIO, "sdio read 53 addr 0x%x, %zu bytes",
+                             addr, len);
+                wl1271_dump_ascii(DEBUG_SDIO, "data: ", buf, len);
+        }
+
+        if (ret)
+                wl1271_error("sdio read failed (%d)", ret);
+
+}
+
+static void wl1271_sdio_raw_write(struct wl1271 *wl, int addr, void *buf,
+                                  size_t len, bool fixed)
+{
+        int ret;
+        struct sdio_func *func = wl_to_func(wl);
+
+        if (unlikely(addr == HW_ACCESS_ELP_CTRL_REG_ADDR)) {
+                sdio_f0_writeb(func, ((u8 *)buf)[0], addr, &ret);
+                wl1271_debug(DEBUG_SDIO, "sdio write 52 addr 0x%x, byte 0x%02x",
+                             addr, ((u8 *)buf)[0]);
+        } else {
+                wl1271_debug(DEBUG_SDIO, "sdio write 53 addr 0x%x, %zu bytes",
+                             addr, len);
+                wl1271_dump_ascii(DEBUG_SDIO, "data: ", buf, len);
+
+                if (fixed)
+                        ret = sdio_writesb(func, addr, buf, len);
+                else
+                        ret = sdio_memcpy_toio(func, addr, buf, len);
+        }
+        if (ret)
+                wl1271_error("sdio write failed (%d)", ret);
+
+}
+
+static void wl1271_sdio_set_power(struct wl1271 *wl, bool enable)
+{
+        struct sdio_func *func = wl_to_func(wl);
+
+        /* Let the SDIO stack handle wlan_enable control, so we
+         * keep host claimed while wlan is in use to keep wl1271
+         * alive.
+         */
+        if (enable) {
+                sdio_claim_host(func);
+                sdio_enable_func(func);
+        } else {
+                sdio_disable_func(func);
+                sdio_release_host(func);
+        }
+}
+
+static struct wl1271_if_operations sdio_ops = {
+        .read           = wl1271_sdio_raw_read,
+        .write          = wl1271_sdio_raw_write,
+        .reset          = wl1271_sdio_reset,
+        .init           = wl1271_sdio_init,
+        .power          = wl1271_sdio_set_power,
+        .dev            = wl1271_sdio_wl_to_dev,
+        .enable_irq     = wl1271_sdio_enable_interrupts,
+        .disable_irq    = wl1271_sdio_disable_interrupts
+};
+
+static int __devinit wl1271_probe(struct sdio_func *func,
+                                  const struct sdio_device_id *id)
+{
+        struct ieee80211_hw *hw;
+        struct wl1271 *wl;
+        int ret;
+
+        /* We are only able to handle the wlan function */
+        if (func->num != 0x02)
+                return -ENODEV;
+
+        hw = wl1271_alloc_hw();
+        if (IS_ERR(hw))
+                return PTR_ERR(hw);
+
+        wl = hw->priv;
+
+        wl->if_priv = func;
+        wl->if_ops = &sdio_ops;
+
+        /* Grab access to FN0 for ELP reg. */
+        func->card->quirks |= MMC_QUIRK_LENIENT_FN0;
+
+        wl->irq = gpio_to_irq(RX71_WL1271_IRQ_GPIO);
+        if (wl->irq < 0) {
+                ret = wl->irq;
+                wl1271_error("could not get irq!");
+                goto out_free;
+        }
+
+        ret = request_irq(wl->irq, wl1271_irq, 0, DRIVER_NAME, wl);
+        if (ret < 0) {
+                wl1271_error("request_irq() failed: %d", ret);
+                goto out_free;
+        }
+
+        set_irq_type(wl->irq, IRQ_TYPE_EDGE_RISING);
+
+        disable_irq(wl->irq);
+
+        ret = wl1271_init_ieee80211(wl);
+        if (ret)
+                goto out_irq;
+
+        ret = wl1271_register_hw(wl);
+        if (ret)
+                goto out_irq;
+
+        sdio_set_drvdata(func, wl);
+
+        wl1271_notice("initialized");
+
+        return 0;
+
+ out_irq:
+        free_irq(wl->irq, wl);
+
+
+ out_free:
+        wl1271_free_hw(wl);
+
+        return ret;
+}
+
+static void __devexit wl1271_remove(struct sdio_func *func)
+{
+        struct wl1271 *wl = sdio_get_drvdata(func);
+
+        free_irq(wl->irq, wl);
+
+        wl1271_unregister_hw(wl);
+        wl1271_free_hw(wl);
+}
+
+static struct sdio_driver wl1271_sdio_driver = {
+        .name           = "wl1271_sdio",
+        .id_table       = wl1271_devices,
+        .probe          = wl1271_probe,
+        .remove         = __devexit_p(wl1271_remove),
+};
+
+static int __init wl1271_init(void)
+{
+        int ret;
+
+        ret = sdio_register_driver(&wl1271_sdio_driver);
+        if (ret < 0) {
+                wl1271_error("failed to register sdio driver: %d", ret);
+                goto out;
+        }
+
+out:
+        return ret;
+}
+
+static void __exit wl1271_exit(void)
+{
+        sdio_unregister_driver(&wl1271_sdio_driver);
+
+        wl1271_notice("unloaded");
+}
+
+module_init(wl1271_init);
+module_exit(wl1271_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Luciano Coelho <luciano.coelho@nokia.com>");
+MODULE_AUTHOR("Juuso Oikarinen <juuso.oikarinen@nokia.com>");
+MODULE_FIRMWARE(WL1271_FW_NAME);
diff --git a/drivers/net/wireless/wl12xx/wl1271_spi.c b/drivers/net/wireless/wl12xx/wl1271_spi.c
index 053c84aceb4..5189b812f93 100644
--- a/drivers/net/wireless/wl12xx/wl1271_spi.c
+++ b/drivers/net/wireless/wl12xx/wl1271_spi.c
@@ -21,18 +21,69 @@
  *
  */
 
+#include <linux/irq.h>
 #include <linux/module.h>
-#include <linux/platform_device.h>
 #include <linux/crc7.h>
 #include <linux/spi/spi.h>
+#include <linux/spi/wl12xx.h>
 #include <linux/slab.h>
 
 #include "wl1271.h"
 #include "wl12xx_80211.h"
-#include "wl1271_spi.h"
+#include "wl1271_io.h"
+
+#include "wl1271_reg.h"
+
+#define WSPI_CMD_READ                 0x40000000
+#define WSPI_CMD_WRITE                0x00000000
+#define WSPI_CMD_FIXED                0x20000000
+#define WSPI_CMD_BYTE_LENGTH          0x1FFE0000
+#define WSPI_CMD_BYTE_LENGTH_OFFSET   17
+#define WSPI_CMD_BYTE_ADDR            0x0001FFFF
+
+#define WSPI_INIT_CMD_CRC_LEN       5
+
+#define WSPI_INIT_CMD_START         0x00
+#define WSPI_INIT_CMD_TX            0x40
+/* the extra bypass bit is sampled by the TNET as '1' */
+#define WSPI_INIT_CMD_BYPASS_BIT    0x80
+#define WSPI_INIT_CMD_FIXEDBUSY_LEN 0x07
+#define WSPI_INIT_CMD_EN_FIXEDBUSY  0x80
+#define WSPI_INIT_CMD_DIS_FIXEDBUSY 0x00
+#define WSPI_INIT_CMD_IOD           0x40
+#define WSPI_INIT_CMD_IP            0x20
+#define WSPI_INIT_CMD_CS            0x10
+#define WSPI_INIT_CMD_WS            0x08
+#define WSPI_INIT_CMD_WSPI          0x01
+#define WSPI_INIT_CMD_END           0x01
+
+#define WSPI_INIT_CMD_LEN           8
+
+#define HW_ACCESS_WSPI_FIXED_BUSY_LEN \
+                ((WL1271_BUSY_WORD_LEN - 4) / sizeof(u32))
+#define HW_ACCESS_WSPI_INIT_CMD_MASK  0
+
+static inline struct spi_device *wl_to_spi(struct wl1271 *wl)
+{
+        return wl->if_priv;
+}
 
+static struct device *wl1271_spi_wl_to_dev(struct wl1271 *wl)
+{
+        return &(wl_to_spi(wl)->dev);
+}
 
-void wl1271_spi_reset(struct wl1271 *wl)
+static void wl1271_spi_disable_interrupts(struct wl1271 *wl)
+{
+        disable_irq(wl->irq);
+}
+
+static void wl1271_spi_enable_interrupts(struct wl1271 *wl)
+{
+        enable_irq(wl->irq);
+}
+
+static void wl1271_spi_reset(struct wl1271 *wl)
 {
         u8 *cmd;
         struct spi_transfer t;
@@ -53,12 +104,13 @@ void wl1271_spi_reset(struct wl1271 *wl)
         t.len = WSPI_INIT_CMD_LEN;
         spi_message_add_tail(&t, &m);
 
-        spi_sync(wl->spi, &m);
+        spi_sync(wl_to_spi(wl), &m);
+        kfree(cmd);
 
         wl1271_dump(DEBUG_SPI, "spi reset -> ", cmd, WSPI_INIT_CMD_LEN);
 }
 
-void wl1271_spi_init(struct wl1271 *wl)
+static void wl1271_spi_init(struct wl1271 *wl)
 {
         u8 crc[WSPI_INIT_CMD_CRC_LEN], *cmd;
         struct spi_transfer t;
@@ -107,48 +159,25 @@ void wl1271_spi_init(struct wl1271 *wl)
         t.len = WSPI_INIT_CMD_LEN;
         spi_message_add_tail(&t, &m);
 
-        spi_sync(wl->spi, &m);
+        spi_sync(wl_to_spi(wl), &m);
+        kfree(cmd);
 
         wl1271_dump(DEBUG_SPI, "spi init -> ", cmd, WSPI_INIT_CMD_LEN);
 }
 
 #define WL1271_BUSY_WORD_TIMEOUT 1000
 
-/* FIXME: Check busy words, removed due to SPI bug */
-#if 0
-static void wl1271_spi_read_busy(struct wl1271 *wl, void *buf, size_t len)
+static int wl1271_spi_read_busy(struct wl1271 *wl)
 {
         struct spi_transfer t[1];
         struct spi_message m;
         u32 *busy_buf;
         int num_busy_bytes = 0;
 
-        wl1271_info("spi read BUSY!");
-
-        /*
-         * Look for the non-busy word in the read buffer, and if found,
-         * read in the remaining data into the buffer.
-         */
-        busy_buf = (u32 *)buf;
-        for (; (u32)busy_buf < (u32)buf + len; busy_buf++) {
-                num_busy_bytes += sizeof(u32);
-                if (*busy_buf & 0x1) {
-                        spi_message_init(&m);
-                        memset(t, 0, sizeof(t));
-                        memmove(buf, busy_buf, len - num_busy_bytes);
-                        t[0].rx_buf = buf + (len - num_busy_bytes);
-                        t[0].len = num_busy_bytes;
-                        spi_message_add_tail(&t[0], &m);
-                        spi_sync(wl->spi, &m);
-                        return;
-                }
-        }
-
         /*
          * Read further busy words from SPI until a non-busy word is
          * encountered, then read the data itself into the buffer.
          */
-        wl1271_info("spi read BUSY-polling needed!");
 
         num_busy_bytes = WL1271_BUSY_WORD_TIMEOUT;
         busy_buf = wl->buffer_busyword;
@@ -158,28 +187,21 @@ static void wl1271_spi_read_busy(struct wl1271 *wl, void *buf, size_t len)
                 memset(t, 0, sizeof(t));
                 t[0].rx_buf = busy_buf;
                 t[0].len = sizeof(u32);
+                t[0].cs_change = true;
                 spi_message_add_tail(&t[0], &m);
-                spi_sync(wl->spi, &m);
-
-                if (*busy_buf & 0x1) {
-                        spi_message_init(&m);
-                        memset(t, 0, sizeof(t));
-                        t[0].rx_buf = buf;
-                        t[0].len = len;
-                        spi_message_add_tail(&t[0], &m);
-                        spi_sync(wl->spi, &m);
-                        return;
-                }
+                spi_sync(wl_to_spi(wl), &m);
+
+                if (*busy_buf & 0x1)
+                        return 0;
         }
 
         /* The SPI bus is unresponsive, the read failed. */
-        memset(buf, 0, len);
         wl1271_error("SPI read busy-word timeout!\n");
+        return -ETIMEDOUT;
 }
-#endif
 
-void wl1271_spi_raw_read(struct wl1271 *wl, int addr, void *buf,
-                         size_t len, bool fixed)
+static void wl1271_spi_raw_read(struct wl1271 *wl, int addr, void *buf,
+                                size_t len, bool fixed)
 {
         struct spi_transfer t[3];
         struct spi_message m;
@@ -202,28 +224,38 @@ void wl1271_spi_raw_read(struct wl1271 *wl, int addr, void *buf,
 
         t[0].tx_buf = cmd;
         t[0].len = 4;
+        t[0].cs_change = true;
         spi_message_add_tail(&t[0], &m);
 
         /* Busy and non busy words read */
         t[1].rx_buf = busy_buf;
         t[1].len = WL1271_BUSY_WORD_LEN;
+        t[1].cs_change = true;
         spi_message_add_tail(&t[1], &m);
 
-        t[2].rx_buf = buf;
-        t[2].len = len;
-        spi_message_add_tail(&t[2], &m);
+        spi_sync(wl_to_spi(wl), &m);
 
-        spi_sync(wl->spi, &m);
+        if (!(busy_buf[WL1271_BUSY_WORD_CNT - 1] & 0x1) &&
+            wl1271_spi_read_busy(wl)) {
+                memset(buf, 0, len);
+                return;
+        }
 
-        /* FIXME: Check busy words, removed due to SPI bug */
-        /* if (!(busy_buf[WL1271_BUSY_WORD_CNT - 1] & 0x1))
-           wl1271_spi_read_busy(wl, buf, len); */
+        spi_message_init(&m);
+        memset(t, 0, sizeof(t));
+
+        t[0].rx_buf = buf;
+        t[0].len = len;
+        t[0].cs_change = true;
+        spi_message_add_tail(&t[0], &m);
+
+        spi_sync(wl_to_spi(wl), &m);
 
         wl1271_dump(DEBUG_SPI, "spi_read cmd -> ", cmd, sizeof(*cmd));
         wl1271_dump(DEBUG_SPI, "spi_read buf <- ", buf, len);
 }
 
-void wl1271_spi_raw_write(struct wl1271 *wl, int addr, void *buf,
+static void wl1271_spi_raw_write(struct wl1271 *wl, int addr, void *buf,
                           size_t len, bool fixed)
 {
         struct spi_transfer t[2];
@@ -251,8 +283,181 @@ void wl1271_spi_raw_write(struct wl1271 *wl, int addr, void *buf,
         t[1].len = len;
         spi_message_add_tail(&t[1], &m);
 
-        spi_sync(wl->spi, &m);
+        spi_sync(wl_to_spi(wl), &m);
 
         wl1271_dump(DEBUG_SPI, "spi_write cmd -> ", cmd, sizeof(*cmd));
         wl1271_dump(DEBUG_SPI, "spi_write buf -> ", buf, len);
 }
+
+static irqreturn_t wl1271_irq(int irq, void *cookie)
+{
+        struct wl1271 *wl;
+        unsigned long flags;
+
+        wl1271_debug(DEBUG_IRQ, "IRQ");
+
+        wl = cookie;
+
+        /* complete the ELP completion */
+        spin_lock_irqsave(&wl->wl_lock, flags);
+        if (wl->elp_compl) {
+                complete(wl->elp_compl);
+                wl->elp_compl = NULL;
+        }
+
+        if (!test_and_set_bit(WL1271_FLAG_IRQ_RUNNING, &wl->flags))
+                ieee80211_queue_work(wl->hw, &wl->irq_work);
+        set_bit(WL1271_FLAG_IRQ_PENDING, &wl->flags);
+        spin_unlock_irqrestore(&wl->wl_lock, flags);
+
+        return IRQ_HANDLED;
+}
+
+static void wl1271_spi_set_power(struct wl1271 *wl, bool enable)
+{
+        if (wl->set_power)
+                wl->set_power(enable);
+}
+
+static struct wl1271_if_operations spi_ops = {
+        .read           = wl1271_spi_raw_read,
+        .write          = wl1271_spi_raw_write,
+        .reset          = wl1271_spi_reset,
+        .init           = wl1271_spi_init,
+        .power          = wl1271_spi_set_power,
+        .dev            = wl1271_spi_wl_to_dev,
+        .enable_irq     = wl1271_spi_enable_interrupts,
+        .disable_irq    = wl1271_spi_disable_interrupts
+};
+
+static int __devinit wl1271_probe(struct spi_device *spi)
+{
+        struct wl12xx_platform_data *pdata;
+        struct ieee80211_hw *hw;
+        struct wl1271 *wl;
+        int ret;
+
+        pdata = spi->dev.platform_data;
+        if (!pdata) {
+                wl1271_error("no platform data");
+                return -ENODEV;
+        }
+
+        hw = wl1271_alloc_hw();
+        if (IS_ERR(hw))
+                return PTR_ERR(hw);
+
+        wl = hw->priv;
+
+        dev_set_drvdata(&spi->dev, wl);
+        wl->if_priv = spi;
+
+        wl->if_ops = &spi_ops;
+
+        /* This is the only SPI value that we need to set here, the rest
+         * comes from the board-peripherals file */
+        spi->bits_per_word = 32;
+
+        ret = spi_setup(spi);
+        if (ret < 0) {
+                wl1271_error("spi_setup failed");
+                goto out_free;
+        }
+
+        wl->set_power = pdata->set_power;
+        if (!wl->set_power) {
+                wl1271_error("set power function missing in platform data");
+                ret = -ENODEV;
+                goto out_free;
+        }
+
+        wl->irq = spi->irq;
+        if (wl->irq < 0) {
+                wl1271_error("irq missing in platform data");
+                ret = -ENODEV;
+                goto out_free;
+        }
+
+        ret = request_irq(wl->irq, wl1271_irq, 0, DRIVER_NAME, wl);
+        if (ret < 0) {
+                wl1271_error("request_irq() failed: %d", ret);
+                goto out_free;
+        }
+
+        set_irq_type(wl->irq, IRQ_TYPE_EDGE_RISING);
+
+        disable_irq(wl->irq);
+
+        ret = wl1271_init_ieee80211(wl);
+        if (ret)
+                goto out_irq;
+
+        ret = wl1271_register_hw(wl);
+        if (ret)
+                goto out_irq;
+
+        wl1271_notice("initialized");
+
+        return 0;
+
+ out_irq:
+        free_irq(wl->irq, wl);
+
+ out_free:
+        wl1271_free_hw(wl);
+
+        return ret;
+}
+
+static int __devexit wl1271_remove(struct spi_device *spi)
+{
+        struct wl1271 *wl = dev_get_drvdata(&spi->dev);
+
+        free_irq(wl->irq, wl);
+
+        wl1271_unregister_hw(wl);
+        wl1271_free_hw(wl);
+
+        return 0;
+}
+
+
+static struct spi_driver wl1271_spi_driver = {
+        .driver = {
+                .name           = "wl1271_spi",
+                .bus            = &spi_bus_type,
+                .owner          = THIS_MODULE,
+        },
+
+        .probe          = wl1271_probe,
+        .remove         = __devexit_p(wl1271_remove),
+};
+
+static int __init wl1271_init(void)
+{
+        int ret;
+
+        ret = spi_register_driver(&wl1271_spi_driver);
+        if (ret < 0) {
+                wl1271_error("failed to register spi driver: %d", ret);
+                goto out;
+        }
+
+out:
+        return ret;
+}
+
+static void __exit wl1271_exit(void)
+{
+        spi_unregister_driver(&wl1271_spi_driver);
+
+        wl1271_notice("unloaded");
+}
+
+module_init(wl1271_init);
+module_exit(wl1271_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Luciano Coelho <luciano.coelho@nokia.com>");
+MODULE_AUTHOR("Juuso Oikarinen <juuso.oikarinen@nokia.com>");
+MODULE_FIRMWARE(WL1271_FW_NAME);
diff --git a/drivers/net/wireless/wl12xx/wl1271_spi.h b/drivers/net/wireless/wl12xx/wl1271_spi.h
deleted file mode 100644
index a803596dad4..00000000000
--- a/drivers/net/wireless/wl12xx/wl1271_spi.h
+++ /dev/null
@@ -1,96 +0,0 @@
-/*
- * This file is part of wl1271
- *
- * Copyright (C) 1998-2009 Texas Instruments. All rights reserved.
- * Copyright (C) 2008-2009 Nokia Corporation
- *
- * Contact: Luciano Coelho <luciano.coelho@nokia.com>
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * version 2 as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
- * 02110-1301 USA
- *
- */
-
-#ifndef __WL1271_SPI_H__
-#define __WL1271_SPI_H__
-
-#include "wl1271_reg.h"
-
-#define HW_ACCESS_MEMORY_MAX_RANGE              0x1FFC0
-
-#define HW_PARTITION_REGISTERS_ADDR         0x1ffc0
-#define HW_PART0_SIZE_ADDR                  (HW_PARTITION_REGISTERS_ADDR)
-#define HW_PART0_START_ADDR                 (HW_PARTITION_REGISTERS_ADDR + 4)
-#define HW_PART1_SIZE_ADDR                  (HW_PARTITION_REGISTERS_ADDR + 8)
-#define HW_PART1_START_ADDR                 (HW_PARTITION_REGISTERS_ADDR + 12)
-#define HW_PART2_SIZE_ADDR                  (HW_PARTITION_REGISTERS_ADDR + 16)
-#define HW_PART2_START_ADDR                 (HW_PARTITION_REGISTERS_ADDR + 20)
-#define HW_PART3_START_ADDR                 (HW_PARTITION_REGISTERS_ADDR + 24)
-
-#define HW_ACCESS_REGISTER_SIZE             4
-
-#define HW_ACCESS_PRAM_MAX_RANGE                0x3c000
-
-#define WSPI_CMD_READ                 0x40000000
-#define WSPI_CMD_WRITE                0x00000000
-#define WSPI_CMD_FIXED                0x20000000
-#define WSPI_CMD_BYTE_LENGTH          0x1FFE0000
-#define WSPI_CMD_BYTE_LENGTH_OFFSET   17
-#define WSPI_CMD_BYTE_ADDR            0x0001FFFF
-
-#define WSPI_INIT_CMD_CRC_LEN       5
-
-#define WSPI_INIT_CMD_START         0x00
-#define WSPI_INIT_CMD_TX            0x40
-/* the extra bypass bit is sampled by the TNET as '1' */
-#define WSPI_INIT_CMD_BYPASS_BIT    0x80
-#define WSPI_INIT_CMD_FIXEDBUSY_LEN 0x07
-#define WSPI_INIT_CMD_EN_FIXEDBUSY  0x80
-#define WSPI_INIT_CMD_DIS_FIXEDBUSY 0x00
-#define WSPI_INIT_CMD_IOD           0x40
-#define WSPI_INIT_CMD_IP            0x20
-#define WSPI_INIT_CMD_CS            0x10
-#define WSPI_INIT_CMD_WS            0x08
-#define WSPI_INIT_CMD_WSPI          0x01
-#define WSPI_INIT_CMD_END           0x01
-
-#define WSPI_INIT_CMD_LEN           8
-
-#define HW_ACCESS_WSPI_FIXED_BUSY_LEN \
-                ((WL1271_BUSY_WORD_LEN - 4) / sizeof(u32))
-#define HW_ACCESS_WSPI_INIT_CMD_MASK  0
-
-#define OCP_CMD_LOOP  32
-
-#define OCP_CMD_WRITE 0x1
-#define OCP_CMD_READ  0x2
-
-#define OCP_READY_MASK  BIT(18)
-#define OCP_STATUS_MASK (BIT(16) | BIT(17))
-
-#define OCP_STATUS_NO_RESP    0x00000
-#define OCP_STATUS_OK         0x10000
-#define OCP_STATUS_REQ_FAILED 0x20000
-#define OCP_STATUS_RESP_ERROR 0x30000
-
-/* Raw target IO, address is not translated */
-void wl1271_spi_raw_write(struct wl1271 *wl, int addr, void *buf,
-                      size_t len, bool fixed);
-void wl1271_spi_raw_read(struct wl1271 *wl, int addr, void *buf,
-                     size_t len, bool fixed);
-
-/* INIT and RESET words */
-void wl1271_spi_reset(struct wl1271 *wl);
-void wl1271_spi_init(struct wl1271 *wl);
-#endif /* __WL1271_SPI_H__ */
diff --git a/drivers/net/wireless/wl12xx/wl1271_testmode.c b/drivers/net/wireless/wl12xx/wl1271_testmode.c
index 5c1c4f565fd..554deb4d024 100644
--- a/drivers/net/wireless/wl12xx/wl1271_testmode.c
+++ b/drivers/net/wireless/wl12xx/wl1271_testmode.c
@@ -26,7 +26,6 @@
 #include <net/genetlink.h>
 
 #include "wl1271.h"
-#include "wl1271_spi.h"
 #include "wl1271_acx.h"
 
 #define WL1271_TM_MAX_DATA_LENGTH 1024
diff --git a/drivers/net/wireless/wl12xx/wl1271_tx.c b/drivers/net/wireless/wl12xx/wl1271_tx.c
index 811e739d05b..62db79508dd 100644
--- a/drivers/net/wireless/wl12xx/wl1271_tx.c
+++ b/drivers/net/wireless/wl12xx/wl1271_tx.c
@@ -25,7 +25,6 @@
 #include <linux/module.h>
 
 #include "wl1271.h"
-#include "wl1271_spi.h"
 #include "wl1271_io.h"
 #include "wl1271_reg.h"
 #include "wl1271_ps.h"
@@ -47,7 +46,7 @@ static int wl1271_tx_allocate(struct wl1271 *wl, struct sk_buff *skb, u32 extra)
 {
         struct wl1271_tx_hw_descr *desc;
         u32 total_len = skb->len + sizeof(struct wl1271_tx_hw_descr) + extra;
-        u32 total_blocks, excluded;
+        u32 total_blocks;
         int id, ret = -EBUSY;
 
         /* allocate free identifier for the packet */
@@ -57,12 +56,8 @@ static int wl1271_tx_allocate(struct wl1271 *wl, struct sk_buff *skb, u32 extra)
 
         /* approximate the number of blocks required for this packet
            in the firmware */
-        /* FIXME: try to figure out what is done here and make it cleaner */
-        total_blocks = (total_len + 20) >> TX_HW_BLOCK_SHIFT_DIV;
-        excluded = (total_blocks << 2) + ((total_len + 20) & 0xff) + 34;
-        total_blocks += (excluded > 252) ? 2 : 1;
-        total_blocks += TX_HW_BLOCK_SPARE;
-
+        total_blocks = total_len + TX_HW_BLOCK_SIZE - 1;
+        total_blocks = total_blocks / TX_HW_BLOCK_SIZE + TX_HW_BLOCK_SPARE;
         if (total_blocks <= wl->tx_blocks_available) {
                 desc = (struct wl1271_tx_hw_descr *)skb_push(
                         skb, total_len - skb->len);
@@ -87,8 +82,10 @@ static int wl1271_tx_allocate(struct wl1271 *wl, struct sk_buff *skb, u32 extra)
 static int wl1271_tx_fill_hdr(struct wl1271 *wl, struct sk_buff *skb,
                               u32 extra, struct ieee80211_tx_info *control)
 {
+        struct timespec ts;
         struct wl1271_tx_hw_descr *desc;
         int pad, ac;
+        s64 hosttime;
         u16 tx_attr;
 
         desc = (struct wl1271_tx_hw_descr *) skb->data;
@@ -102,8 +99,9 @@ static int wl1271_tx_fill_hdr(struct wl1271 *wl, struct sk_buff *skb,
         }
 
         /* configure packet life time */
-        desc->start_time = cpu_to_le32(jiffies_to_usecs(jiffies) -
-                                       wl->time_offset);
+        getnstimeofday(&ts);
+        hosttime = (timespec_to_ns(&ts) >> 10);
+        desc->start_time = cpu_to_le32(hosttime - wl->time_offset);
         desc->life_time = cpu_to_le16(TX_HW_MGMT_PKT_LIFETIME_TU);
 
         /* configure the tx attributes */
@@ -170,7 +168,6 @@ static int wl1271_tx_send_packet(struct wl1271 *wl, struct sk_buff *skb,
 
         /* write packet new counter into the write access register */
         wl->tx_packets_count++;
-        wl1271_write32(wl, WL1271_HOST_WR_ACCESS, wl->tx_packets_count);
 
         desc = (struct wl1271_tx_hw_descr *) skb->data;
         wl1271_debug(DEBUG_TX, "tx id %u skb 0x%p payload %u (%u words)",
@@ -223,7 +220,7 @@ static int wl1271_tx_frame(struct wl1271 *wl, struct sk_buff *skb)
         return ret;
 }
 
-static u32 wl1271_tx_enabled_rates_get(struct wl1271 *wl, u32 rate_set)
+u32 wl1271_tx_enabled_rates_get(struct wl1271 *wl, u32 rate_set)
 {
         struct ieee80211_supported_band *band;
         u32 enabled_rates = 0;
@@ -245,6 +242,7 @@ void wl1271_tx_work(struct work_struct *work)
         struct sk_buff *skb;
         bool woken_up = false;
         u32 sta_rates = 0;
+        u32 prev_tx_packets_count;
         int ret;
 
         /* check if the rates supported by the AP have changed */
@@ -261,6 +259,8 @@ void wl1271_tx_work(struct work_struct *work)
         if (unlikely(wl->state == WL1271_STATE_OFF))
                 goto out;
 
+        prev_tx_packets_count = wl->tx_packets_count;
+
         /* if rates have changed, re-configure the rate policy */
         if (unlikely(sta_rates)) {
                 wl->rate_set = wl1271_tx_enabled_rates_get(wl, sta_rates);
@@ -271,31 +271,26 @@ void wl1271_tx_work(struct work_struct *work)
                 if (!woken_up) {
                         ret = wl1271_ps_elp_wakeup(wl, false);
                         if (ret < 0)
-                                goto out;
+                                goto out_ack;
                         woken_up = true;
                 }
 
                 ret = wl1271_tx_frame(wl, skb);
                 if (ret == -EBUSY) {
-                        /* firmware buffer is full, stop queues */
-                        wl1271_debug(DEBUG_TX, "tx_work: fw buffer full, "
-                                     "stop queues");
-                        ieee80211_stop_queues(wl->hw);
-                        set_bit(WL1271_FLAG_TX_QUEUE_STOPPED, &wl->flags);
+                        /* firmware buffer is full, lets stop transmitting. */
                         skb_queue_head(&wl->tx_queue, skb);
-                        goto out;
+                        goto out_ack;
                 } else if (ret < 0) {
                         dev_kfree_skb(skb);
-                        goto out;
-                } else if (test_and_clear_bit(WL1271_FLAG_TX_QUEUE_STOPPED,
-                                              &wl->flags)) {
-                        /* firmware buffer has space, restart queues */
-                        wl1271_debug(DEBUG_TX,
-                                     "complete_packet: waking queues");
-                        ieee80211_wake_queues(wl->hw);
+                        goto out_ack;
                 }
         }
 
+out_ack:
+        /* interrupt the firmware with the new packets */
+        if (prev_tx_packets_count != wl->tx_packets_count)
+                wl1271_write32(wl, WL1271_HOST_WR_ACCESS, wl->tx_packets_count);
+
 out:
         if (woken_up)
                 wl1271_ps_elp_sleep(wl);
@@ -308,11 +303,12 @@ static void wl1271_tx_complete_packet(struct wl1271 *wl,
 {
         struct ieee80211_tx_info *info;
         struct sk_buff *skb;
-        u16 seq;
         int id = result->id;
+        int rate = -1;
+        u8 retries = 0;
 
         /* check for id legality */
-        if (id >= ACX_TX_DESCRIPTORS || wl->tx_frames[id] == NULL) {
+        if (unlikely(id >= ACX_TX_DESCRIPTORS || wl->tx_frames[id] == NULL)) {
                 wl1271_warning("TX result illegal id: %d", id);
                 return;
         }
@@ -320,31 +316,29 @@ static void wl1271_tx_complete_packet(struct wl1271 *wl,
         skb = wl->tx_frames[id];
         info = IEEE80211_SKB_CB(skb);
 
-        /* update packet status */
-        if (!(info->flags & IEEE80211_TX_CTL_NO_ACK)) {
-                if (result->status == TX_SUCCESS)
+        /* update the TX status info */
+        if (result->status == TX_SUCCESS) {
+                if (!(info->flags & IEEE80211_TX_CTL_NO_ACK))
                         info->flags |= IEEE80211_TX_STAT_ACK;
-                if (result->status & TX_RETRY_EXCEEDED) {
-                        /* FIXME */
-                        /* info->status.excessive_retries = 1; */
-                        wl->stats.excessive_retries++;
-                }
+                rate = wl1271_rate_to_idx(wl, result->rate_class_index);
+                retries = result->ack_failures;
+        } else if (result->status == TX_RETRY_EXCEEDED) {
+                wl->stats.excessive_retries++;
+                retries = result->ack_failures;
         }
 
-        /* FIXME */
-        /* info->status.retry_count = result->ack_failures; */
+        info->status.rates[0].idx = rate;
+        info->status.rates[0].count = retries;
+        info->status.rates[0].flags = 0;
+        info->status.ack_signal = -1;
+
         wl->stats.retry_count += result->ack_failures;
 
         /* update security sequence number */
-        seq = wl->tx_security_seq_16 +
-                (result->lsb_security_sequence_number -
-                 wl->tx_security_last_seq);
+        wl->tx_security_seq += (result->lsb_security_sequence_number -
+                                wl->tx_security_last_seq);
         wl->tx_security_last_seq = result->lsb_security_sequence_number;
 
-        if (seq < wl->tx_security_seq_16)
-                wl->tx_security_seq_32++;
-        wl->tx_security_seq_16 = seq;
-
         /* remove private header from packet */
         skb_pull(skb, sizeof(struct wl1271_tx_hw_descr));
 
@@ -367,23 +361,29 @@ static void wl1271_tx_complete_packet(struct wl1271 *wl,
 }
 
 /* Called upon reception of a TX complete interrupt */
-void wl1271_tx_complete(struct wl1271 *wl, u32 count)
+void wl1271_tx_complete(struct wl1271 *wl)
 {
         struct wl1271_acx_mem_map *memmap =
                 (struct wl1271_acx_mem_map *)wl->target_mem_map;
+        u32 count, fw_counter;
         u32 i;
 
-        wl1271_debug(DEBUG_TX, "tx_complete received, packets: %d", count);
-
         /* read the tx results from the chipset */
         wl1271_read(wl, le32_to_cpu(memmap->tx_result),
                     wl->tx_res_if, sizeof(*wl->tx_res_if), false);
+        fw_counter = le32_to_cpu(wl->tx_res_if->tx_result_fw_counter);
+
+        /* write host counter to chipset (to ack) */
+        wl1271_write32(wl, le32_to_cpu(memmap->tx_result) +
+                       offsetof(struct wl1271_tx_hw_res_if,
+                                tx_result_host_counter), fw_counter);
+
+        count = fw_counter - wl->tx_results_count;
+        wl1271_debug(DEBUG_TX, "tx_complete received, packets: %d", count);
 
         /* verify that the result buffer is not getting overrun */
-        if (count > TX_HW_RESULT_QUEUE_LEN) {
+        if (unlikely(count > TX_HW_RESULT_QUEUE_LEN))
                 wl1271_warning("TX result overflow from chipset: %d", count);
-                count = TX_HW_RESULT_QUEUE_LEN;
-        }
 
         /* process the results */
         for (i = 0; i < count; i++) {
@@ -397,11 +397,18 @@ void wl1271_tx_complete(struct wl1271 *wl, u32 count)
                 wl->tx_results_count++;
         }
 
-        /* write host counter to chipset (to ack) */
-        wl1271_write32(wl, le32_to_cpu(memmap->tx_result) +
-                       offsetof(struct wl1271_tx_hw_res_if,
-                       tx_result_host_counter),
-                       le32_to_cpu(wl->tx_res_if->tx_result_fw_counter));
+        if (test_bit(WL1271_FLAG_TX_QUEUE_STOPPED, &wl->flags) &&
+            skb_queue_len(&wl->tx_queue) <= WL1271_TX_QUEUE_LOW_WATERMARK) {
+                unsigned long flags;
+
+                /* firmware buffer has space, restart queues */
+                wl1271_debug(DEBUG_TX, "tx_complete: waking queues");
+                spin_lock_irqsave(&wl->wl_lock, flags);
+                ieee80211_wake_queues(wl->hw);
+                clear_bit(WL1271_FLAG_TX_QUEUE_STOPPED, &wl->flags);
+                spin_unlock_irqrestore(&wl->wl_lock, flags);
+                ieee80211_queue_work(wl->hw, &wl->tx_work);
+        }
 }
 
 /* caller must hold wl->mutex */
@@ -409,31 +416,19 @@ void wl1271_tx_flush(struct wl1271 *wl)
 {
         int i;
         struct sk_buff *skb;
-        struct ieee80211_tx_info *info;
 
         /* TX failure */
 /*      control->flags = 0; FIXME */
 
         while ((skb = skb_dequeue(&wl->tx_queue))) {
-                info = IEEE80211_SKB_CB(skb);
-
                 wl1271_debug(DEBUG_TX, "flushing skb 0x%p", skb);
-
-                if (!(info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS))
-                                continue;
-
                 ieee80211_tx_status(wl->hw, skb);
         }
 
         for (i = 0; i < ACX_TX_DESCRIPTORS; i++)
                 if (wl->tx_frames[i] != NULL) {
                         skb = wl->tx_frames[i];
-                        info = IEEE80211_SKB_CB(skb);
-
-                        if (!(info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS))
-                                continue;
-
-                        ieee80211_tx_status(wl->hw, skb);
                         wl->tx_frames[i] = NULL;
+                        ieee80211_tx_status(wl->hw, skb);
                 }
 }
diff --git a/drivers/net/wireless/wl12xx/wl1271_tx.h b/drivers/net/wireless/wl12xx/wl1271_tx.h
index 17e405a09ca..3b8b7ac253f 100644
--- a/drivers/net/wireless/wl12xx/wl1271_tx.h
+++ b/drivers/net/wireless/wl12xx/wl1271_tx.h
@@ -26,7 +26,7 @@
 #define __WL1271_TX_H__
 
 #define TX_HW_BLOCK_SPARE                2
-#define TX_HW_BLOCK_SHIFT_DIV            8
+#define TX_HW_BLOCK_SIZE                 252
 
 #define TX_HW_MGMT_PKT_LIFETIME_TU       2000
 /* The chipset reference driver states, that the "aid" value 1
@@ -125,9 +125,6 @@ struct wl1271_tx_hw_res_if {
 
 static inline int wl1271_tx_get_queue(int queue)
 {
-        /* FIXME: use best effort until WMM is enabled */
-        return CONF_TX_AC_BE;
-
         switch (queue) {
         case 0:
                 return CONF_TX_AC_VO;
@@ -160,7 +157,9 @@ static inline int wl1271_tx_ac_to_tid(int ac)
 }
 
 void wl1271_tx_work(struct work_struct *work);
-void wl1271_tx_complete(struct wl1271 *wl, u32 count);
+void wl1271_tx_complete(struct wl1271 *wl);
 void wl1271_tx_flush(struct wl1271 *wl);
+u8 wl1271_rate_to_idx(struct wl1271 *wl, int rate);
+u32 wl1271_tx_enabled_rates_get(struct wl1271 *wl, u32 rate_set);
 
 #endif