Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6

125 files changed, 17180 insertions, 1883 deletions

diff --git a/drivers/net/wireless/Kconfig b/drivers/net/wireless/Kconfig
index 2d8434f409b6..91be3e7bf133 100644
--- a/drivers/net/wireless/Kconfig
+++ b/drivers/net/wireless/Kconfig
@@ -500,5 +500,6 @@ source "drivers/net/wireless/b43legacy/Kconfig"
 source "drivers/net/wireless/zd1211rw/Kconfig"
 source "drivers/net/wireless/rt2x00/Kconfig"
 source "drivers/net/wireless/orinoco/Kconfig"
+source "drivers/net/wireless/wl12xx/Kconfig"
 
 endmenu
diff --git a/drivers/net/wireless/Makefile b/drivers/net/wireless/Makefile
index 0625e91b5995..f2b1861e6bcb 100644
--- a/drivers/net/wireless/Makefile
+++ b/drivers/net/wireless/Makefile
@@ -58,3 +58,5 @@ obj-$(CONFIG_P54_COMMON)	+= p54/
 obj-$(CONFIG_ATH_COMMON)        += ath/
 
 obj-$(CONFIG_MAC80211_HWSIM)    += mac80211_hwsim.o
+
+obj-$(CONFIG_WL12XX)    += wl12xx/
diff --git a/drivers/net/wireless/adm8211.c b/drivers/net/wireless/adm8211.c
index f71821795018..2b9e379994a1 100644
--- a/drivers/net/wireless/adm8211.c
+++ b/drivers/net/wireless/adm8211.c
@@ -1311,18 +1311,20 @@ static int adm8211_config(struct ieee80211_hw *dev, u32 changed)
         return 0;
 }
 
-static int adm8211_config_interface(struct ieee80211_hw *dev,
-                                    struct ieee80211_vif *vif,
-                                    struct ieee80211_if_conf *conf)
+static void adm8211_bss_info_changed(struct ieee80211_hw *dev,
+                                     struct ieee80211_vif *vif,
+                                     struct ieee80211_bss_conf *conf,
+                                     u32 changes)
 {
         struct adm8211_priv *priv = dev->priv;
 
+        if (!(changes & BSS_CHANGED_BSSID))
+                return;
+
         if (memcmp(conf->bssid, priv->bssid, ETH_ALEN)) {
                 adm8211_set_bssid(dev, conf->bssid);
                 memcpy(priv->bssid, conf->bssid, ETH_ALEN);
         }
-
-        return 0;
 }
 
 static void adm8211_configure_filter(struct ieee80211_hw *dev,
@@ -1753,7 +1755,7 @@ static const struct ieee80211_ops adm8211_ops = {
         .add_interface          = adm8211_add_interface,
         .remove_interface       = adm8211_remove_interface,
         .config                 = adm8211_config,
-        .config_interface       = adm8211_config_interface,
+        .bss_info_changed       = adm8211_bss_info_changed,
         .configure_filter       = adm8211_configure_filter,
         .get_stats              = adm8211_get_stats,
         .get_tx_stats           = adm8211_get_tx_stats,
diff --git a/drivers/net/wireless/at76c50x-usb.c b/drivers/net/wireless/at76c50x-usb.c
index 55f947ac56d1..cea7f1466c54 100644
--- a/drivers/net/wireless/at76c50x-usb.c
+++ b/drivers/net/wireless/at76c50x-usb.c
@@ -1965,13 +1965,18 @@ static int at76_config(struct ieee80211_hw *hw, u32 changed)
         return 0;
 }
 
-static int at76_config_interface(struct ieee80211_hw *hw,
-                                 struct ieee80211_vif *vif,
-                                 struct ieee80211_if_conf *conf)
+static void at76_bss_info_changed(struct ieee80211_hw *hw,
+                                  struct ieee80211_vif *vif,
+                                  struct ieee80211_bss_conf *conf,
+                                  u32 changed)
 {
         struct at76_priv *priv = hw->priv;
 
         at76_dbg(DBG_MAC80211, "%s():", __func__);
+
+        if (!(changed & BSS_CHANGED_BSSID))
+                return;
+
         at76_dbg_dump(DBG_MAC80211, conf->bssid, ETH_ALEN, "bssid:");
 
         mutex_lock(&priv->mtx);
@@ -1983,8 +1988,6 @@ static int at76_config_interface(struct ieee80211_hw *hw,
                 at76_join(priv);
 
         mutex_unlock(&priv->mtx);
-
-        return 0;
 }
 
 /* must be atomic */
@@ -2076,7 +2079,7 @@ static const struct ieee80211_ops at76_ops = {
         .add_interface = at76_add_interface,
         .remove_interface = at76_remove_interface,
         .config = at76_config,
-        .config_interface = at76_config_interface,
+        .bss_info_changed = at76_bss_info_changed,
         .configure_filter = at76_configure_filter,
         .start = at76_mac80211_start,
         .stop = at76_mac80211_stop,
diff --git a/drivers/net/wireless/ath/ar9170/hw.h b/drivers/net/wireless/ath/ar9170/hw.h
index 95bf812d6fcc..3293e0fb24fb 100644
--- a/drivers/net/wireless/ath/ar9170/hw.h
+++ b/drivers/net/wireless/ath/ar9170/hw.h
@@ -207,6 +207,8 @@ enum ar9170_cmd {
 #define AR9170_MAC_REG_AC1_AC0_TXOP             (AR9170_MAC_REG_BASE + 0xB44)
 #define AR9170_MAC_REG_AC3_AC2_TXOP             (AR9170_MAC_REG_BASE + 0xB48)
 
+#define AR9170_MAC_REG_AMPDU_SET                (AR9170_MAC_REG_BASE + 0xba0)
+
 #define AR9170_MAC_REG_ACK_TABLE                (AR9170_MAC_REG_BASE + 0xC00)
 #define AR9170_MAC_REG_AMPDU_RX_THRESH          (AR9170_MAC_REG_BASE + 0xC50)
 
diff --git a/drivers/net/wireless/ath/ar9170/mac.c b/drivers/net/wireless/ath/ar9170/mac.c
index c8fa3073169f..43aeb69685d3 100644
--- a/drivers/net/wireless/ath/ar9170/mac.c
+++ b/drivers/net/wireless/ath/ar9170/mac.c
@@ -72,6 +72,24 @@ int ar9170_set_qos(struct ar9170 *ar)
         return ar9170_regwrite_result();
 }
 
+static int ar9170_set_ampdu_density(struct ar9170 *ar, u8 mpdudensity)
+{
+        u32 val;
+
+        /* don't allow AMPDU density > 8us */
+        if (mpdudensity > 6)
+                return -EINVAL;
+
+        /* Watch out! Otus uses slightly different density values. */
+        val = 0x140a00 | (mpdudensity ? (mpdudensity + 1) : 0);
+
+        ar9170_regwrite_begin(ar);
+        ar9170_regwrite(AR9170_MAC_REG_AMPDU_SET, val);
+        ar9170_regwrite_finish();
+
+        return ar9170_regwrite_result();
+}
+
 int ar9170_init_mac(struct ar9170 *ar)
 {
         ar9170_regwrite_begin(ar);
@@ -265,9 +283,9 @@ int ar9170_set_operating_mode(struct ar9170 *ar)
                 case NL80211_IFTYPE_ADHOC:
                         pm_mode |= AR9170_MAC_REG_POWERMGT_IBSS;
                         break;
-/*              case NL80211_IFTYPE_AP:
+                case NL80211_IFTYPE_AP:
                         pm_mode |= AR9170_MAC_REG_POWERMGT_AP;
-                        break;*/
+                        break;
                 case NL80211_IFTYPE_WDS:
                         pm_mode |= AR9170_MAC_REG_POWERMGT_AP_WDS;
                         break;
@@ -296,6 +314,11 @@ int ar9170_set_operating_mode(struct ar9170 *ar)
         if (err)
                 return err;
 
+        /* set AMPDU density to 8us. */
+        err = ar9170_set_ampdu_density(ar, 6);
+        if (err)
+                return err;
+
         ar9170_regwrite_begin(ar);
 
         ar9170_regwrite(AR9170_MAC_REG_POWERMANAGEMENT, pm_mode);
@@ -316,9 +339,9 @@ int ar9170_set_beacon_timers(struct ar9170 *ar)
         u32 v = 0;
         u32 pretbtt = 0;
 
-        v |= ar->hw->conf.beacon_int;
-
         if (ar->vif) {
+                v |= ar->vif->bss_conf.beacon_int;
+
                 switch (ar->vif->type) {
                 case NL80211_IFTYPE_MESH_POINT:
                 case NL80211_IFTYPE_ADHOC:
@@ -326,7 +349,7 @@ int ar9170_set_beacon_timers(struct ar9170 *ar)
                         break;
                 case NL80211_IFTYPE_AP:
                         v |= BIT(24);
-                        pretbtt = (ar->hw->conf.beacon_int - 6) << 16;
+                        pretbtt = (ar->vif->bss_conf.beacon_int - 6) << 16;
                         break;
                 default:
                         break;
diff --git a/drivers/net/wireless/ath/ar9170/main.c b/drivers/net/wireless/ath/ar9170/main.c
index 1b60906b80c9..4ef1d2fc859c 100644
--- a/drivers/net/wireless/ath/ar9170/main.c
+++ b/drivers/net/wireless/ath/ar9170/main.c
@@ -151,8 +151,8 @@ static struct ieee80211_channel ar9170_5ghz_chantable[] = {
                           IEEE80211_HT_CAP_SGI_40 |                     \
                           IEEE80211_HT_CAP_DSSSCCK40 |                  \
                           IEEE80211_HT_CAP_SM_PS,                       \
-        .ampdu_factor   = 3, /* ?? */                                   \
-        .ampdu_density  = 7, /* ?? */                                   \
+        .ampdu_factor   = 3,                                            \
+        .ampdu_density  = 6,                                            \
         .mcs            = {                                             \
                 .rx_mask = { 0xFF, 0xFF, 0, 0, 0, 0, 0, 0, 0, 0, },     \
         },                                                              \
@@ -1337,7 +1337,7 @@ static int ar9170_op_config(struct ieee80211_hw *hw, u32 changed)
                         goto out;
         }
 
-        if (changed & IEEE80211_CONF_CHANGE_BEACON_INTERVAL) {
+        if (changed & BSS_CHANGED_BEACON_INT) {
                 err = ar9170_set_beacon_timers(ar);
                 if (err)
                         goto out;
@@ -1360,33 +1360,6 @@ out:
         return err;
 }
 
-static int ar9170_op_config_interface(struct ieee80211_hw *hw,
-                                      struct ieee80211_vif *vif,
-                                      struct ieee80211_if_conf *conf)
-{
-        struct ar9170 *ar = hw->priv;
-        int err = 0;
-
-        mutex_lock(&ar->mutex);
-
-        if (conf->changed & IEEE80211_IFCC_BSSID) {
-                memcpy(ar->bssid, conf->bssid, ETH_ALEN);
-                err = ar9170_set_operating_mode(ar);
-        }
-
-        if (conf->changed & IEEE80211_IFCC_BEACON) {
-                err = ar9170_update_beacon(ar);
-
-                if (err)
-                        goto out;
-                err = ar9170_set_beacon_timers(ar);
-        }
-
-out:
-        mutex_unlock(&ar->mutex);
-        return err;
-}
-
 static void ar9170_set_filters(struct work_struct *work)
 {
         struct ar9170 *ar = container_of(work, struct ar9170,
@@ -1488,6 +1461,17 @@ static void ar9170_op_bss_info_changed(struct ieee80211_hw *hw,
 
         mutex_lock(&ar->mutex);
 
+        if (changed & BSS_CHANGED_BSSID) {
+                memcpy(ar->bssid, bss_conf->bssid, ETH_ALEN);
+                err = ar9170_set_operating_mode(ar);
+        }
+
+        if (changed & (BSS_CHANGED_BEACON | BSS_CHANGED_BEACON_ENABLED)) {
+                err = ar9170_update_beacon(ar);
+                if (!err)
+                        ar9170_set_beacon_timers(ar);
+        }
+
         ar9170_regwrite_begin(ar);
 
         if (changed & BSS_CHANGED_ASSOC) {
@@ -1499,6 +1483,9 @@ static void ar9170_op_bss_info_changed(struct ieee80211_hw *hw,
 #endif /* CONFIG_AR9170_LEDS */
         }
 
+        if (changed & BSS_CHANGED_BEACON_INT)
+                err = ar9170_set_beacon_timers(ar);
+
         if (changed & BSS_CHANGED_HT) {
                 /* TODO */
                 err = 0;
@@ -1793,7 +1780,6 @@ static const struct ieee80211_ops ar9170_ops = {
         .add_interface          = ar9170_op_add_interface,
         .remove_interface       = ar9170_op_remove_interface,
         .config                 = ar9170_op_config,
-        .config_interface       = ar9170_op_config_interface,
         .configure_filter       = ar9170_op_configure_filter,
         .conf_tx                = ar9170_conf_tx,
         .bss_info_changed       = ar9170_op_bss_info_changed,
diff --git a/drivers/net/wireless/ath/ar9170/usb.c b/drivers/net/wireless/ath/ar9170/usb.c
index fddda477095c..d7c13c0177ca 100644
--- a/drivers/net/wireless/ath/ar9170/usb.c
+++ b/drivers/net/wireless/ath/ar9170/usb.c
@@ -350,7 +350,7 @@ static int ar9170_usb_exec_cmd(struct ar9170 *ar, enum ar9170_cmd cmd,
                 goto err_unbuf;
         }
 
-        if (outlen >= 0 && aru->readlen != outlen) {
+        if (aru->readlen != outlen) {
                 err = -EMSGSIZE;
                 goto err_unbuf;
         }
@@ -689,6 +689,9 @@ static int ar9170_usb_probe(struct usb_interface *intf,
         aru->common.exec_cmd = ar9170_usb_exec_cmd;
         aru->common.callback_cmd = ar9170_usb_callback_cmd;
 
+#ifdef CONFIG_PM
+        udev->reset_resume = 1;
+#endif
         err = ar9170_usb_reset(aru);
         if (err)
                 goto err_freehw;
@@ -805,6 +808,7 @@ static struct usb_driver ar9170_driver = {
 #ifdef CONFIG_PM
         .suspend = ar9170_suspend,
         .resume = ar9170_resume,
+        .reset_resume = ar9170_resume,
 #endif /* CONFIG_PM */
 };
 
diff --git a/drivers/net/wireless/ath/ath5k/ath5k.h b/drivers/net/wireless/ath/ath5k/ath5k.h
index 60c6d2edc4b9..813718210338 100644
--- a/drivers/net/wireless/ath/ath5k/ath5k.h
+++ b/drivers/net/wireless/ath/ath5k/ath5k.h
@@ -209,7 +209,6 @@
 #define AR5K_TUNE_MAX_TXPOWER                   63
 #define AR5K_TUNE_DEFAULT_TXPOWER               25
 #define AR5K_TUNE_TPC_TXPOWER                   false
-#define AR5K_TUNE_ANT_DIVERSITY                 true
 #define AR5K_TUNE_HWTXTRIES                     4
 
 #define AR5K_INIT_CARR_SENSE_EN                 1
@@ -420,6 +419,17 @@ enum ath5k_driver_mode {
         AR5K_MODE_MAX           =       5
 };
 
+enum ath5k_ant_mode {
+        AR5K_ANTMODE_DEFAULT    = 0,    /* default antenna setup */
+        AR5K_ANTMODE_FIXED_A    = 1,    /* only antenna A is present */
+        AR5K_ANTMODE_FIXED_B    = 2,    /* only antenna B is present */
+        AR5K_ANTMODE_SINGLE_AP  = 3,    /* sta locked on a single ap */
+        AR5K_ANTMODE_SECTOR_AP  = 4,    /* AP with tx antenna set on tx desc */
+        AR5K_ANTMODE_SECTOR_STA = 5,    /* STA with tx antenna set on tx desc */
+        AR5K_ANTMODE_DEBUG      = 6,    /* Debug mode -A -> Rx, B-> Tx- */
+        AR5K_ANTMODE_MAX,
+};
+
 
 /****************\
   TX DEFINITIONS
@@ -1051,8 +1061,11 @@ struct ath5k_hw {
         bool                    ah_software_retry;
         u32                     ah_limit_tx_retries;
 
-        u32                     ah_antenna[AR5K_EEPROM_N_MODES][AR5K_ANT_MAX];
-        bool                    ah_ant_diversity;
+        /* Antenna Control */
+        u32                     ah_ant_ctl[AR5K_EEPROM_N_MODES][AR5K_ANT_MAX];
+        u8                      ah_ant_mode;
+        u8                      ah_tx_ant;
+        u8                      ah_def_ant;
 
         u8                      ah_sta_id[ETH_ALEN];
 
@@ -1100,11 +1113,12 @@ struct ath5k_hw {
                 /* Values in 0.25dB units */
                 s16             txp_min_pwr;
                 s16             txp_max_pwr;
+                /* Values in 0.5dB units */
                 s16             txp_offset;
                 s16             txp_ofdm;
-                /* Values in dB units */
-                s16             txp_cck_ofdm_pwr_delta;
                 s16             txp_cck_ofdm_gainf_delta;
+                /* Value in dB units */
+                s16             txp_cck_ofdm_pwr_delta;
         } ah_txpower;
 
         struct {
@@ -1264,14 +1278,21 @@ extern int ath5k_hw_channel(struct ath5k_hw *ah, struct ieee80211_channel *chann
 /* PHY calibration */
 extern int ath5k_hw_phy_calibrate(struct ath5k_hw *ah, struct ieee80211_channel *channel);
 extern int ath5k_hw_noise_floor_calibration(struct ath5k_hw *ah, short freq);
+/* Spur mitigation */
+bool ath5k_hw_chan_has_spur_noise(struct ath5k_hw *ah,
+                                struct ieee80211_channel *channel);
+void ath5k_hw_set_spur_mitigation_filter(struct ath5k_hw *ah,
+                                struct ieee80211_channel *channel);
 /* Misc PHY functions */
 extern u16 ath5k_hw_radio_revision(struct ath5k_hw *ah, unsigned int chan);
-extern void ath5k_hw_set_def_antenna(struct ath5k_hw *ah, unsigned int ant);
-extern unsigned int ath5k_hw_get_def_antenna(struct ath5k_hw *ah);
 extern int ath5k_hw_phy_disable(struct ath5k_hw *ah);
+/* Antenna control */
+extern void ath5k_hw_set_antenna_mode(struct ath5k_hw *ah, u8 ant_mode);
+extern void ath5k_hw_set_def_antenna(struct ath5k_hw *ah, u8 ant);
+extern unsigned int ath5k_hw_get_def_antenna(struct ath5k_hw *ah);
 /* TX power setup */
 extern int ath5k_hw_txpower(struct ath5k_hw *ah, struct ieee80211_channel *channel, u8 ee_mode, u8 txpower);
-extern int ath5k_hw_set_txpower_limit(struct ath5k_hw *ah, u8 ee_mode, u8 txpower);
+extern int ath5k_hw_set_txpower_limit(struct ath5k_hw *ah, u8 txpower);
 
 /*
  * Functions used internaly
diff --git a/drivers/net/wireless/ath/ath5k/attach.c b/drivers/net/wireless/ath/ath5k/attach.c
index 70d376c63aac..c41ef58393e7 100644
--- a/drivers/net/wireless/ath/ath5k/attach.c
+++ b/drivers/net/wireless/ath/ath5k/attach.c
@@ -133,7 +133,6 @@ struct ath5k_hw *ath5k_hw_attach(struct ath5k_softc *sc, u8 mac_version)
         ah->ah_cw_min = AR5K_TUNE_CWMIN;
         ah->ah_limit_tx_retries = AR5K_INIT_TX_RETRY;
         ah->ah_software_retry = false;
-        ah->ah_ant_diversity = AR5K_TUNE_ANT_DIVERSITY;
 
         /*
          * Set the mac version based on the pci id
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index c8c658bfcf9d..6789c5dfcc76 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -227,9 +227,6 @@ static int ath5k_add_interface(struct ieee80211_hw *hw,
 static void ath5k_remove_interface(struct ieee80211_hw *hw,
                 struct ieee80211_if_init_conf *conf);
 static int ath5k_config(struct ieee80211_hw *hw, u32 changed);
-static int ath5k_config_interface(struct ieee80211_hw *hw,
-                struct ieee80211_vif *vif,
-                struct ieee80211_if_conf *conf);
 static void ath5k_configure_filter(struct ieee80211_hw *hw,
                 unsigned int changed_flags,
                 unsigned int *new_flags,
@@ -259,7 +256,6 @@ static const struct ieee80211_ops ath5k_hw_ops = {
         .add_interface  = ath5k_add_interface,
         .remove_interface = ath5k_remove_interface,
         .config         = ath5k_config,
-        .config_interface = ath5k_config_interface,
         .configure_filter = ath5k_configure_filter,
         .set_key        = ath5k_set_key,
         .get_stats      = ath5k_get_stats,
@@ -520,6 +516,7 @@ ath5k_pci_probe(struct pci_dev *pdev,
                     IEEE80211_HW_NOISE_DBM;
 
         hw->wiphy->interface_modes =
+                BIT(NL80211_IFTYPE_AP) |
                 BIT(NL80211_IFTYPE_STATION) |
                 BIT(NL80211_IFTYPE_ADHOC) |
                 BIT(NL80211_IFTYPE_MESH_POINT);
@@ -1282,7 +1279,7 @@ ath5k_txbuf_setup(struct ath5k_softc *sc, struct ath5k_buf *bf)
                 ieee80211_get_hdrlen_from_skb(skb), AR5K_PKT_TYPE_NORMAL,
                 (sc->power_level * 2),
                 hw_rate,
-                info->control.rates[0].count, keyidx, 0, flags,
+                info->control.rates[0].count, keyidx, ah->ah_tx_ant, flags,
                 cts_rate, duration);
         if (ret)
                 goto err_unmap;
@@ -1742,35 +1739,6 @@ ath5k_check_ibss_tsf(struct ath5k_softc *sc, struct sk_buff *skb,
         }
 }
 
-static void ath5k_tasklet_beacon(unsigned long data)
-{
-        struct ath5k_softc *sc = (struct ath5k_softc *) data;
-
-        /*
-         * Software beacon alert--time to send a beacon.
-         *
-         * In IBSS mode we use this interrupt just to
-         * keep track of the next TBTT (target beacon
-         * transmission time) in order to detect wether
-         * automatic TSF updates happened.
-         */
-        if (sc->opmode == NL80211_IFTYPE_ADHOC) {
-                /* XXX: only if VEOL suppported */
-                u64 tsf = ath5k_hw_get_tsf64(sc->ah);
-                sc->nexttbtt += sc->bintval;
-                ATH5K_DBG(sc, ATH5K_DEBUG_BEACON,
-                                "SWBA nexttbtt: %x hw_tu: %x "
-                                "TSF: %llx\n",
-                                sc->nexttbtt,
-                                TSF_TO_TU(tsf),
-                                (unsigned long long) tsf);
-        } else {
-                spin_lock(&sc->block);
-                ath5k_beacon_send(sc);
-                spin_unlock(&sc->block);
-        }
-}
-
 static void
 ath5k_tasklet_rx(unsigned long data)
 {
@@ -2041,7 +2009,8 @@ ath5k_beacon_setup(struct ath5k_softc *sc, struct ath5k_buf *bf)
         struct  ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct ath5k_hw *ah = sc->ah;
         struct ath5k_desc *ds;
-        int ret, antenna = 0;
+        int ret = 0;
+        u8 antenna;
         u32 flags;
 
         bf->skbaddr = pci_map_single(sc->pdev, skb->data, skb->len,
@@ -2055,23 +2024,35 @@ ath5k_beacon_setup(struct ath5k_softc *sc, struct ath5k_buf *bf)
         }
 
         ds = bf->desc;
+        antenna = ah->ah_tx_ant;
 
         flags = AR5K_TXDESC_NOACK;
         if (sc->opmode == NL80211_IFTYPE_ADHOC && ath5k_hw_hasveol(ah)) {
                 ds->ds_link = bf->daddr;        /* self-linked */
                 flags |= AR5K_TXDESC_VEOL;
-                /*
-                 * Let hardware handle antenna switching if txantenna is not set
-                 */
-        } else {
+        } else
                 ds->ds_link = 0;
-                /*
-                 * Switch antenna every 4 beacons if txantenna is not set
-                 * XXX assumes two antennas
-                 */
-                if (antenna == 0)
-                        antenna = sc->bsent & 4 ? 2 : 1;
-        }
+
+        /*
+         * If we use multiple antennas on AP and use
+         * the Sectored AP scenario, switch antenna every
+         * 4 beacons to make sure everybody hears our AP.
+         * When a client tries to associate, hw will keep
+         * track of the tx antenna to be used for this client
+         * automaticaly, based on ACKed packets.
+         *
+         * Note: AP still listens and transmits RTS on the
+         * default antenna which is supposed to be an omni.
+         *
+         * Note2: On sectored scenarios it's possible to have
+         * multiple antennas (1omni -the default- and 14 sectors)
+         * so if we choose to actually support this mode we need
+         * to allow user to set how many antennas we have and tweak
+         * the code below to send beacons on all of them.
+         */
+        if (ah->ah_ant_mode == AR5K_ANTMODE_SECTOR_AP)
+                antenna = sc->bsent & 4 ? 2 : 1;
+
 
         /* FIXME: If we are in g mode and rate is a CCK rate
          * subtract ah->ah_txpower.txp_cck_ofdm_pwr_delta
@@ -2124,7 +2105,7 @@ ath5k_beacon_send(struct ath5k_softc *sc)
                 sc->bmisscount++;
                 ATH5K_DBG(sc, ATH5K_DEBUG_BEACON,
                         "missed %u consecutive beacons\n", sc->bmisscount);
-                if (sc->bmisscount > 3) {               /* NB: 3 is a guess */
+                if (sc->bmisscount > 10) {      /* NB: 10 is a guess */
                         ATH5K_DBG(sc, ATH5K_DEBUG_BEACON,
                                 "stuck beacon time (%u missed)\n",
                                 sc->bmisscount);
@@ -2145,10 +2126,12 @@ ath5k_beacon_send(struct ath5k_softc *sc)
          * are still pending on the queue.
          */
         if (unlikely(ath5k_hw_stop_tx_dma(ah, sc->bhalq))) {
-                ATH5K_WARN(sc, "beacon queue %u didn't stop?\n", sc->bhalq);
+                ATH5K_WARN(sc, "beacon queue %u didn't start/stop ?\n", sc->bhalq);
                 /* NB: hw still stops DMA, so proceed */
         }
 
+        /* Note: Beacon buffer is updated on beacon_update when mac80211
+         * calls config_interface */
         ath5k_hw_set_txdp(ah, sc->bhalq, bf->daddr);
         ath5k_hw_start_tx_dma(ah, sc->bhalq);
         ATH5K_DBG(sc, ATH5K_DEBUG_BEACON, "TXDP[%u] = %llx (%p)\n",
@@ -2305,6 +2288,35 @@ ath5k_beacon_config(struct ath5k_softc *sc)
         ath5k_hw_set_imr(ah, sc->imask);
 }
 
+static void ath5k_tasklet_beacon(unsigned long data)
+{
+        struct ath5k_softc *sc = (struct ath5k_softc *) data;
+
+        /*
+         * Software beacon alert--time to send a beacon.
+         *
+         * In IBSS mode we use this interrupt just to
+         * keep track of the next TBTT (target beacon
+         * transmission time) in order to detect wether
+         * automatic TSF updates happened.
+         */
+        if (sc->opmode == NL80211_IFTYPE_ADHOC) {
+                /* XXX: only if VEOL suppported */
+                u64 tsf = ath5k_hw_get_tsf64(sc->ah);
+                sc->nexttbtt += sc->bintval;
+                ATH5K_DBG(sc, ATH5K_DEBUG_BEACON,
+                                "SWBA nexttbtt: %x hw_tu: %x "
+                                "TSF: %llx\n",
+                                sc->nexttbtt,
+                                TSF_TO_TU(tsf),
+                                (unsigned long long) tsf);
+        } else {
+                spin_lock(&sc->block);
+                ath5k_beacon_send(sc);
+                spin_unlock(&sc->block);
+        }
+}
+
 
 /********************\
 * Interrupt handling *
@@ -2509,7 +2521,7 @@ ath5k_intr(int irq, void *dev_id)
                                 ath5k_hw_update_mib_counters(ah, &sc->ll_stats);
                         }
                 }
-        } while (ath5k_hw_is_intr_pending(ah) && counter-- > 0);
+        } while (ath5k_hw_is_intr_pending(ah) && --counter > 0);
 
         if (unlikely(!counter))
                 ATH5K_WARN(sc, "too many interrupts, giving up for now\n");
@@ -2751,56 +2763,47 @@ static int
 ath5k_config(struct ieee80211_hw *hw, u32 changed)
 {
         struct ath5k_softc *sc = hw->priv;
+        struct ath5k_hw *ah = sc->ah;
         struct ieee80211_conf *conf = &hw->conf;
-        int ret;
+        int ret = 0;
 
         mutex_lock(&sc->lock);
 
         sc->bintval = conf->beacon_int;
-        sc->power_level = conf->power_level;
 
         ret = ath5k_chan_set(sc, conf->channel);
+        if (ret < 0)
+                return ret;
 
-        mutex_unlock(&sc->lock);
-        return ret;
-}
-
-static int
-ath5k_config_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
-                        struct ieee80211_if_conf *conf)
-{
-        struct ath5k_softc *sc = hw->priv;
-        struct ath5k_hw *ah = sc->ah;
-        int ret = 0;
+        if ((changed & IEEE80211_CONF_CHANGE_POWER) &&
+        (sc->power_level != conf->power_level)) {
+                sc->power_level = conf->power_level;
 
-        mutex_lock(&sc->lock);
-        if (sc->vif != vif) {
-                ret = -EIO;
-                goto unlock;
-        }
-        if (conf->changed & IEEE80211_IFCC_BSSID && conf->bssid) {
-                /* Cache for later use during resets */
-                memcpy(ah->ah_bssid, conf->bssid, ETH_ALEN);
-                /* XXX: assoc id is set to 0 for now, mac80211 doesn't have
-                 * a clean way of letting us retrieve this yet. */
-                ath5k_hw_set_associd(ah, ah->ah_bssid, 0);
-                mmiowb();
-        }
-        if (conf->changed & IEEE80211_IFCC_BEACON &&
-                        (vif->type == NL80211_IFTYPE_ADHOC ||
-                         vif->type == NL80211_IFTYPE_MESH_POINT ||
-                         vif->type == NL80211_IFTYPE_AP)) {
-                struct sk_buff *beacon = ieee80211_beacon_get(hw, vif);
-                if (!beacon) {
-                        ret = -ENOMEM;
-                        goto unlock;
-                }
-                ath5k_beacon_update(sc, beacon);
+                /* Half dB steps */
+                ath5k_hw_set_txpower_limit(ah, (conf->power_level * 2));
         }
 
-unlock:
+        /* TODO:
+         * 1) Move this on config_interface and handle each case
+         * separately eg. when we have only one STA vif, use
+         * AR5K_ANTMODE_SINGLE_AP
+         *
+         * 2) Allow the user to change antenna mode eg. when only
+         * one antenna is present
+         *
+         * 3) Allow the user to set default/tx antenna when possible
+         *
+         * 4) Default mode should handle 90% of the cases, together
+         * with fixed a/b and single AP modes we should be able to
+         * handle 99%. Sectored modes are extreme cases and i still
+         * haven't found a usage for them. If we decide to support them,
+         * then we must allow the user to set how many tx antennas we
+         * have available
+         */
+        ath5k_hw_set_antenna_mode(ah, AR5K_ANTMODE_DEFAULT);
+
         mutex_unlock(&sc->lock);
-        return ret;
+        return 0;
 }
 
 #define SUPPORTED_FIF_FLAGS \
@@ -3083,11 +3086,40 @@ static void ath5k_bss_info_changed(struct ieee80211_hw *hw,
                                     u32 changes)
 {
         struct ath5k_softc *sc = hw->priv;
+        struct ath5k_hw *ah = sc->ah;
+
+        mutex_lock(&sc->lock);
+        if (WARN_ON(sc->vif != vif))
+                goto unlock;
+
+        if (changes & BSS_CHANGED_BSSID) {
+                /* Cache for later use during resets */
+                memcpy(ah->ah_bssid, bss_conf->bssid, ETH_ALEN);
+                /* XXX: assoc id is set to 0 for now, mac80211 doesn't have
+                 * a clean way of letting us retrieve this yet. */
+                ath5k_hw_set_associd(ah, ah->ah_bssid, 0);
+                mmiowb();
+        }
+
+        if (changes & BSS_CHANGED_BEACON_INT)
+                sc->bintval = bss_conf->beacon_int;
+
         if (changes & BSS_CHANGED_ASSOC) {
-                mutex_lock(&sc->lock);
                 sc->assoc = bss_conf->assoc;
                 if (sc->opmode == NL80211_IFTYPE_STATION)
                         set_beacon_filter(hw, sc->assoc);
-                mutex_unlock(&sc->lock);
         }
+
+        if (changes & BSS_CHANGED_BEACON &&
+            (vif->type == NL80211_IFTYPE_ADHOC ||
+             vif->type == NL80211_IFTYPE_MESH_POINT ||
+             vif->type == NL80211_IFTYPE_AP)) {
+                struct sk_buff *beacon = ieee80211_beacon_get(hw, vif);
+
+                if (beacon)
+                        ath5k_beacon_update(sc, beacon);
+        }
+
+ unlock:
+        mutex_unlock(&sc->lock);
 }
diff --git a/drivers/net/wireless/ath/ath5k/eeprom.c b/drivers/net/wireless/ath/ath5k/eeprom.c
index c0fb3b09ba45..c56b494d417a 100644
--- a/drivers/net/wireless/ath/ath5k/eeprom.c
+++ b/drivers/net/wireless/ath/ath5k/eeprom.c
@@ -156,6 +156,17 @@ ath5k_eeprom_init_header(struct ath5k_hw *ah)
                 ee->ee_db[AR5K_EEPROM_MODE_11G][0] = (val >> 3) & 0x7;
         }
 
+        AR5K_EEPROM_READ(AR5K_EEPROM_IS_HB63, val);
+
+        if ((ah->ah_mac_version == (AR5K_SREV_AR2425 >> 4)) && val)
+                ee->ee_is_hb63 = true;
+        else
+                ee->ee_is_hb63 = false;
+
+        AR5K_EEPROM_READ(AR5K_EEPROM_RFKILL, val);
+        ee->ee_rfkill_pin = (u8) AR5K_REG_MS(val, AR5K_EEPROM_RFKILL_GPIO_SEL);
+        ee->ee_rfkill_pol = val & AR5K_EEPROM_RFKILL_POLARITY ? true : false;
+
         return 0;
 }
 
@@ -197,16 +208,16 @@ static int ath5k_eeprom_read_ants(struct ath5k_hw *ah, u32 *offset,
         ee->ee_ant_control[mode][i++]   = (val >> 6) & 0x3f;
         ee->ee_ant_control[mode][i++]   = val & 0x3f;
 
-        /* Get antenna modes */
-        ah->ah_antenna[mode][0] =
+        /* Get antenna switch tables */
+        ah->ah_ant_ctl[mode][AR5K_ANT_CTL] =
             (ee->ee_ant_control[mode][0] << 4);
-        ah->ah_antenna[mode][AR5K_ANT_FIXED_A] =
+        ah->ah_ant_ctl[mode][AR5K_ANT_SWTABLE_A] =
              ee->ee_ant_control[mode][1]        |
             (ee->ee_ant_control[mode][2] << 6)  |
             (ee->ee_ant_control[mode][3] << 12) |
             (ee->ee_ant_control[mode][4] << 18) |
             (ee->ee_ant_control[mode][5] << 24);
-        ah->ah_antenna[mode][AR5K_ANT_FIXED_B] =
+        ah->ah_ant_ctl[mode][AR5K_ANT_SWTABLE_B] =
              ee->ee_ant_control[mode][6]        |
             (ee->ee_ant_control[mode][7] << 6)  |
             (ee->ee_ant_control[mode][8] << 12) |
@@ -640,9 +651,9 @@ ath5k_eeprom_init_11bg_2413(struct ath5k_hw *ah, unsigned int mode, int offset)
 static inline void
 ath5k_get_pcdac_intercepts(struct ath5k_hw *ah, u8 min, u8 max, u8 *vp)
 {
-        const static u16 intercepts3[] =
+        static const u16 intercepts3[] =
                 { 0, 5, 10, 20, 30, 50, 70, 85, 90, 95, 100 };
-        const static u16 intercepts3_2[] =
+        static const u16 intercepts3_2[] =
                 { 0, 10, 20, 30, 40, 50, 60, 70, 80, 90, 100 };
         const u16 *ip;
         int i;
@@ -1694,9 +1705,40 @@ ath5k_eeprom_read_ctl_info(struct ath5k_hw *ah)
         return 0;
 }
 
+static int
+ath5k_eeprom_read_spur_chans(struct ath5k_hw *ah)
+{
+        struct ath5k_eeprom_info *ee = &ah->ah_capabilities.cap_eeprom;
+        u32 offset;
+        u16 val;
+        int ret = 0, i;
+
+        offset = AR5K_EEPROM_CTL(ee->ee_version) +
+                                AR5K_EEPROM_N_CTLS(ee->ee_version);
+
+        if (ee->ee_version < AR5K_EEPROM_VERSION_5_3) {
+                /* No spur info for 5GHz */
+                ee->ee_spur_chans[0][0] = AR5K_EEPROM_NO_SPUR;
+                /* 2 channels for 2GHz (2464/2420) */
+                ee->ee_spur_chans[0][1] = AR5K_EEPROM_5413_SPUR_CHAN_1;
+                ee->ee_spur_chans[1][1] = AR5K_EEPROM_5413_SPUR_CHAN_2;
+                ee->ee_spur_chans[2][1] = AR5K_EEPROM_NO_SPUR;
+        } else if (ee->ee_version >= AR5K_EEPROM_VERSION_5_3) {
+                for (i = 0; i < AR5K_EEPROM_N_SPUR_CHANS; i++) {
+                        AR5K_EEPROM_READ(offset, val);
+                        ee->ee_spur_chans[i][0] = val;
+                        AR5K_EEPROM_READ(offset + AR5K_EEPROM_N_SPUR_CHANS,
+                                                                        val);
+                        ee->ee_spur_chans[i][1] = val;
+                        offset++;
+                }
+        }
+
+        return ret;
+}
 
 /*
- * Initialize eeprom power tables
+ * Initialize eeprom data structure
  */
 int
 ath5k_eeprom_init(struct ath5k_hw *ah)
@@ -1719,6 +1761,10 @@ ath5k_eeprom_init(struct ath5k_hw *ah)
         if (err < 0)
                 return err;
 
+        err = ath5k_eeprom_read_spur_chans(ah);
+        if (err < 0)
+                return err;
+
         return 0;
 }
 
@@ -1754,16 +1800,3 @@ int ath5k_eeprom_read_mac(struct ath5k_hw *ah, u8 *mac)
 
         return 0;
 }
-
-bool ath5k_eeprom_is_hb63(struct ath5k_hw *ah)
-{
-        u16 data;
-
-        ath5k_hw_eeprom_read(ah, AR5K_EEPROM_IS_HB63, &data);
-
-        if ((ah->ah_mac_version == (AR5K_SREV_AR2425 >> 4)) && data)
-                return true;
-        else
-                return false;
-}
-
diff --git a/drivers/net/wireless/ath/ath5k/eeprom.h b/drivers/net/wireless/ath/ath5k/eeprom.h
index b0c0606dea0b..64be73a5edae 100644
--- a/drivers/net/wireless/ath/ath5k/eeprom.h
+++ b/drivers/net/wireless/ath/ath5k/eeprom.h
@@ -26,6 +26,13 @@
 #define AR5K_EEPROM_MAGIC_5210          0x0000145a /* 5210 */
 
 #define AR5K_EEPROM_IS_HB63             0x000b  /* Talon detect */
+
+#define AR5K_EEPROM_RFKILL              0x0f
+#define AR5K_EEPROM_RFKILL_GPIO_SEL     0x0000001c
+#define AR5K_EEPROM_RFKILL_GPIO_SEL_S   2
+#define AR5K_EEPROM_RFKILL_POLARITY     0x00000002
+#define AR5K_EEPROM_RFKILL_POLARITY_S   1
+
 #define AR5K_EEPROM_REG_DOMAIN          0x00bf  /* EEPROM regdom */
 #define AR5K_EEPROM_CHECKSUM            0x00c0  /* EEPROM checksum */
 #define AR5K_EEPROM_INFO_BASE           0x00c0  /* EEPROM header */
@@ -66,11 +73,6 @@
 #define AR5K_EEPROM_HDR_RFKILL(_v)      (((_v) >> 14) & 0x1)    /* Device has RFKill support */
 #define AR5K_EEPROM_HDR_T_5GHZ_DIS(_v)  (((_v) >> 15) & 0x1)    /* Disable turbo for 5Ghz */
 
-#define AR5K_EEPROM_RFKILL_GPIO_SEL     0x0000001c
-#define AR5K_EEPROM_RFKILL_GPIO_SEL_S   2
-#define AR5K_EEPROM_RFKILL_POLARITY     0x00000002
-#define AR5K_EEPROM_RFKILL_POLARITY_S   1
-
 /* Newer EEPROMs are using a different offset */
 #define AR5K_EEPROM_OFF(_v, _v3_0, _v3_3) \
         (((_v) >= AR5K_EEPROM_VERSION_3_3) ? _v3_3 : _v3_0)
@@ -211,6 +213,23 @@
 #define AR5K_EEPROM_I_GAIN              10
 #define AR5K_EEPROM_CCK_OFDM_DELTA      15
 #define AR5K_EEPROM_N_IQ_CAL            2
+/* 5GHz/2GHz */
+enum ath5k_eeprom_freq_bands{
+        AR5K_EEPROM_BAND_5GHZ = 0,
+        AR5K_EEPROM_BAND_2GHZ = 1,
+        AR5K_EEPROM_N_FREQ_BANDS,
+};
+/* Spur chans per freq band */
+#define AR5K_EEPROM_N_SPUR_CHANS        5
+/* fbin value for chan 2464 x2 */
+#define AR5K_EEPROM_5413_SPUR_CHAN_1    1640
+/* fbin value for chan 2420 x2 */
+#define AR5K_EEPROM_5413_SPUR_CHAN_2    1200
+#define AR5K_EEPROM_SPUR_CHAN_MASK      0x3FFF
+#define AR5K_EEPROM_NO_SPUR             0x8000
+#define AR5K_SPUR_CHAN_WIDTH                    87
+#define AR5K_SPUR_SYMBOL_WIDTH_BASE_100Hz       3125
+#define AR5K_SPUR_SYMBOL_WIDTH_TURBO_100Hz      6250
 
 #define AR5K_EEPROM_READ(_o, _v) do {                   \
         ret = ath5k_hw_eeprom_read(ah, (_o), &(_v));    \
@@ -221,11 +240,11 @@
 #define AR5K_EEPROM_READ_HDR(_o, _v)                                    \
         AR5K_EEPROM_READ(_o, ah->ah_capabilities.cap_eeprom._v);        \
 
-enum ath5k_ant_setting {
-        AR5K_ANT_VARIABLE       = 0,    /* variable by programming */
-        AR5K_ANT_FIXED_A        = 1,    /* fixed to 11a frequencies */
-        AR5K_ANT_FIXED_B        = 2,    /* fixed to 11b frequencies */
-        AR5K_ANT_MAX            = 3,
+enum ath5k_ant_table {
+        AR5K_ANT_CTL            = 0,    /* Idle switch table settings */
+        AR5K_ANT_SWTABLE_A      = 1,    /* Switch table for antenna A */
+        AR5K_ANT_SWTABLE_B      = 2,    /* Switch table for antenna B */
+        AR5K_ANT_MAX,
 };
 
 enum ath5k_ctl_mode {
@@ -369,6 +388,9 @@ struct ath5k_eeprom_info {
         u16     ee_version;
         u16     ee_header;
         u16     ee_ant_gain;
+        u8      ee_rfkill_pin;
+        bool    ee_rfkill_pol;
+        bool    ee_is_hb63;
         u16     ee_misc0;
         u16     ee_misc1;
         u16     ee_misc2;
@@ -436,6 +458,10 @@ struct ath5k_eeprom_info {
         s8      ee_pga_desired_size_turbo[AR5K_EEPROM_N_MODES];
         s8      ee_pd_gain_overlap;
 
+        /* Spur mitigation data (fbin values for spur channels) */
+        u16     ee_spur_chans[AR5K_EEPROM_N_SPUR_CHANS][AR5K_EEPROM_N_FREQ_BANDS];
+
+        /* Antenna raw switch tables */
         u32     ee_antenna[AR5K_EEPROM_N_MODES][AR5K_ANT_MAX];
 };
 
diff --git a/drivers/net/wireless/ath/ath5k/led.c b/drivers/net/wireless/ath/ath5k/led.c
index cbdc0b308429..876725f08b6c 100644
--- a/drivers/net/wireless/ath/ath5k/led.c
+++ b/drivers/net/wireless/ath/ath5k/led.c
@@ -53,8 +53,6 @@
 
 /* Devices we match on for LED config info (typically laptops) */
 static const struct pci_device_id ath5k_led_devices[] = {
-        /* IBM-specific AR5212 */
-        { PCI_VDEVICE(ATHEROS, PCI_DEVICE_ID_ATHEROS_AR5212_IBM), ATH_LED(0, 0) },
         /* AR5211 */
         { PCI_VDEVICE(ATHEROS, PCI_DEVICE_ID_ATHEROS_AR5211), ATH_LED(0, 0) },
         /* HP Compaq nc6xx, nc4000, nx6000 */
@@ -69,6 +67,10 @@ static const struct pci_device_id ath5k_led_devices[] = {
         { ATH_SDEVICE(PCI_VENDOR_ID_QMI, 0x0105), ATH_LED(3, 0) },
         /* Fukato Datacask Jupiter 1014a (mrb74@gmx.at) */
         { ATH_SDEVICE(PCI_VENDOR_ID_AZWAVE, 0x1026), ATH_LED(3, 0) },
+        /* IBM ThinkPad AR5BXB6 (legovini@spiro.fisica.unipd.it) */
+        { ATH_SDEVICE(PCI_VENDOR_ID_IBM, 0x058a), ATH_LED(1, 0) },
+        /* IBM-specific AR5212 (all others) */
+        { PCI_VDEVICE(ATHEROS, PCI_DEVICE_ID_ATHEROS_AR5212_IBM), ATH_LED(0, 0) },
         { }
 };
 
diff --git a/drivers/net/wireless/ath/ath5k/pcu.c b/drivers/net/wireless/ath/ath5k/pcu.c
index 55122f1e1986..579aa0a96ab8 100644
--- a/drivers/net/wireless/ath/ath5k/pcu.c
+++ b/drivers/net/wireless/ath/ath5k/pcu.c
@@ -736,8 +736,8 @@ void ath5k_hw_init_beacon(struct ath5k_hw *ah, u32 next_beacon, u32 interval)
         /* When in AP mode zero timer0 to start TSF */
         if (ah->ah_op_mode == NL80211_IFTYPE_AP)
                 ath5k_hw_reg_write(ah, 0, AR5K_TIMER0);
-        else
-                ath5k_hw_reg_write(ah, next_beacon, AR5K_TIMER0);
+
+        ath5k_hw_reg_write(ah, next_beacon, AR5K_TIMER0);
         ath5k_hw_reg_write(ah, timer1, AR5K_TIMER1);
         ath5k_hw_reg_write(ah, timer2, AR5K_TIMER2);
         ath5k_hw_reg_write(ah, timer3, AR5K_TIMER3);
@@ -1003,7 +1003,7 @@ int ath5k_hw_reset_key(struct ath5k_hw *ah, u16 entry)
          * Note2: Windows driver (ndiswrapper) sets this to
          *        0x00000714 instead of 0x00000007
          */
-        if (ah->ah_version > AR5K_AR5211) {
+        if (ah->ah_version >= AR5K_AR5211) {
                 ath5k_hw_reg_write(ah, AR5K_KEYTABLE_TYPE_NULL,
                                 AR5K_KEYTABLE_TYPE(entry));
 
diff --git a/drivers/net/wireless/ath/ath5k/phy.c b/drivers/net/wireless/ath/ath5k/phy.c
index b48b29dca3d2..d0d1c350025a 100644
--- a/drivers/net/wireless/ath/ath5k/phy.c
+++ b/drivers/net/wireless/ath/ath5k/phy.c
@@ -168,9 +168,6 @@ int ath5k_hw_rfgain_opt_init(struct ath5k_hw *ah)
  * tx power and a Peak to Average Power Detector (PAPD) will try
  * to measure the gain.
  *
- * TODO: Use propper tx power setting for the probe packet so
- * that we don't observe a serious power drop on the receiver
- *
  * XXX:  How about forcing a tx packet (bypassing PCU arbitrator etc)
  * just after we enable the probe so that we don't mess with
  * standard traffic ? Maybe it's time to use sw interrupts and
@@ -186,7 +183,7 @@ static void ath5k_hw_request_rfgain_probe(struct ath5k_hw *ah)
 
         /* Send the packet with 2dB below max power as
          * patent doc suggest */
-        ath5k_hw_reg_write(ah, AR5K_REG_SM(ah->ah_txpower.txp_max_pwr - 4,
+        ath5k_hw_reg_write(ah, AR5K_REG_SM(ah->ah_txpower.txp_ofdm - 4,
                         AR5K_PHY_PAPD_PROBE_TXPOWER) |
                         AR5K_PHY_PAPD_PROBE_TX_NEXT, AR5K_PHY_PAPD_PROBE);
 
@@ -1356,6 +1353,257 @@ int ath5k_hw_phy_calibrate(struct ath5k_hw *ah,
         return ret;
 }
 
+/***************************\
+* Spur mitigation functions *
+\***************************/
+
+bool ath5k_hw_chan_has_spur_noise(struct ath5k_hw *ah,
+                                struct ieee80211_channel *channel)
+{
+        u8 refclk_freq;
+
+        if ((ah->ah_radio == AR5K_RF5112) ||
+        (ah->ah_radio == AR5K_RF5413) ||
+        (ah->ah_mac_version == (AR5K_SREV_AR2417 >> 4)))
+                refclk_freq = 40;
+        else
+                refclk_freq = 32;
+
+        if ((channel->center_freq % refclk_freq != 0) &&
+        ((channel->center_freq % refclk_freq < 10) ||
+        (channel->center_freq % refclk_freq > 22)))
+                return true;
+        else
+                return false;
+}
+
+void
+ath5k_hw_set_spur_mitigation_filter(struct ath5k_hw *ah,
+                                struct ieee80211_channel *channel)
+{
+        struct ath5k_eeprom_info *ee = &ah->ah_capabilities.cap_eeprom;
+        u32 mag_mask[4] = {0, 0, 0, 0};
+        u32 pilot_mask[2] = {0, 0};
+        /* Note: fbin values are scaled up by 2 */
+        u16 spur_chan_fbin, chan_fbin, symbol_width, spur_detection_window;
+        s32 spur_delta_phase, spur_freq_sigma_delta;
+        s32 spur_offset, num_symbols_x16;
+        u8 num_symbol_offsets, i, freq_band;
+
+        /* Convert current frequency to fbin value (the same way channels
+         * are stored on EEPROM, check out ath5k_eeprom_bin2freq) and scale
+         * up by 2 so we can compare it later */
+        if (channel->hw_value & CHANNEL_2GHZ) {
+                chan_fbin = (channel->center_freq - 2300) * 10;
+                freq_band = AR5K_EEPROM_BAND_2GHZ;
+        } else {
+                chan_fbin = (channel->center_freq - 4900) * 10;
+                freq_band = AR5K_EEPROM_BAND_5GHZ;
+        }
+
+        /* Check if any spur_chan_fbin from EEPROM is
+         * within our current channel's spur detection range */
+        spur_chan_fbin = AR5K_EEPROM_NO_SPUR;
+        spur_detection_window = AR5K_SPUR_CHAN_WIDTH;
+        /* XXX: Half/Quarter channels ?*/
+        if (channel->hw_value & CHANNEL_TURBO)
+                spur_detection_window *= 2;
+
+        for (i = 0; i < AR5K_EEPROM_N_SPUR_CHANS; i++) {
+                spur_chan_fbin = ee->ee_spur_chans[i][freq_band];
+
+                /* Note: mask cleans AR5K_EEPROM_NO_SPUR flag
+                 * so it's zero if we got nothing from EEPROM */
+                if (spur_chan_fbin == AR5K_EEPROM_NO_SPUR) {
+                        spur_chan_fbin &= AR5K_EEPROM_SPUR_CHAN_MASK;
+                        break;
+                }
+
+                if ((chan_fbin - spur_detection_window <=
+                (spur_chan_fbin & AR5K_EEPROM_SPUR_CHAN_MASK)) &&
+                (chan_fbin + spur_detection_window >=
+                (spur_chan_fbin & AR5K_EEPROM_SPUR_CHAN_MASK))) {
+                        spur_chan_fbin &= AR5K_EEPROM_SPUR_CHAN_MASK;
+                        break;
+                }
+        }
+
+        /* We need to enable spur filter for this channel */
+        if (spur_chan_fbin) {
+                spur_offset = spur_chan_fbin - chan_fbin;
+                /*
+                 * Calculate deltas:
+                 * spur_freq_sigma_delta -> spur_offset / sample_freq << 21
+                 * spur_delta_phase -> spur_offset / chip_freq << 11
+                 * Note: Both values have 100KHz resolution
+                 */
+                /* XXX: Half/Quarter rate channels ? */
+                switch (channel->hw_value) {
+                case CHANNEL_A:
+                        /* Both sample_freq and chip_freq are 40MHz */
+                        spur_delta_phase = (spur_offset << 17) / 25;
+                        spur_freq_sigma_delta = (spur_delta_phase >> 10);
+                        symbol_width = AR5K_SPUR_SYMBOL_WIDTH_BASE_100Hz;
+                        break;
+                case CHANNEL_G:
+                        /* sample_freq -> 40MHz chip_freq -> 44MHz
+                         * (for b compatibility) */
+                        spur_freq_sigma_delta = (spur_offset << 8) / 55;
+                        spur_delta_phase = (spur_offset << 17) / 25;
+                        symbol_width = AR5K_SPUR_SYMBOL_WIDTH_BASE_100Hz;
+                        break;
+                case CHANNEL_T:
+                case CHANNEL_TG:
+                        /* Both sample_freq and chip_freq are 80MHz */
+                        spur_delta_phase = (spur_offset << 16) / 25;
+                        spur_freq_sigma_delta = (spur_delta_phase >> 10);
+                        symbol_width = AR5K_SPUR_SYMBOL_WIDTH_TURBO_100Hz;
+                        break;
+                default:
+                        return;
+                }
+
+                /* Calculate pilot and magnitude masks */
+
+                /* Scale up spur_offset by 1000 to switch to 100HZ resolution
+                 * and divide by symbol_width to find how many symbols we have
+                 * Note: number of symbols is scaled up by 16 */
+                num_symbols_x16 = ((spur_offset * 1000) << 4) / symbol_width;
+
+                /* Spur is on a symbol if num_symbols_x16 % 16 is zero */
+                if (!(num_symbols_x16 & 0xF))
+                        /* _X_ */
+                        num_symbol_offsets = 3;
+                else
+                        /* _xx_ */
+                        num_symbol_offsets = 4;
+
+                for (i = 0; i < num_symbol_offsets; i++) {
+
+                        /* Calculate pilot mask */
+                        s32 curr_sym_off =
+                                (num_symbols_x16 / 16) + i + 25;
+
+                        /* Pilot magnitude mask seems to be a way to
+                         * declare the boundaries for our detection
+                         * window or something, it's 2 for the middle
+                         * value(s) where the symbol is expected to be
+                         * and 1 on the boundary values */
+                        u8 plt_mag_map =
+                                (i == 0 || i == (num_symbol_offsets - 1))
+                                                                ? 1 : 2;
+
+                        if (curr_sym_off >= 0 && curr_sym_off <= 32) {
+                                if (curr_sym_off <= 25)
+                                        pilot_mask[0] |= 1 << curr_sym_off;
+                                else if (curr_sym_off >= 27)
+                                        pilot_mask[0] |= 1 << (curr_sym_off - 1);
+                        } else if (curr_sym_off >= 33 && curr_sym_off <= 52)
+                                pilot_mask[1] |= 1 << (curr_sym_off - 33);
+
+                        /* Calculate magnitude mask (for viterbi decoder) */
+                        if (curr_sym_off >= -1 && curr_sym_off <= 14)
+                                mag_mask[0] |=
+                                        plt_mag_map << (curr_sym_off + 1) * 2;
+                        else if (curr_sym_off >= 15 && curr_sym_off <= 30)
+                                mag_mask[1] |=
+                                        plt_mag_map << (curr_sym_off - 15) * 2;
+                        else if (curr_sym_off >= 31 && curr_sym_off <= 46)
+                                mag_mask[2] |=
+                                        plt_mag_map << (curr_sym_off - 31) * 2;
+                        else if (curr_sym_off >= 46 && curr_sym_off <= 53)
+                                mag_mask[3] |=
+                                        plt_mag_map << (curr_sym_off - 47) * 2;
+
+                }
+
+                /* Write settings on hw to enable spur filter */
+                AR5K_REG_WRITE_BITS(ah, AR5K_PHY_BIN_MASK_CTL,
+                                        AR5K_PHY_BIN_MASK_CTL_RATE, 0xff);
+                /* XXX: Self correlator also ? */
+                AR5K_REG_ENABLE_BITS(ah, AR5K_PHY_IQ,
+                                        AR5K_PHY_IQ_PILOT_MASK_EN |
+                                        AR5K_PHY_IQ_CHAN_MASK_EN |
+                                        AR5K_PHY_IQ_SPUR_FILT_EN);
+
+                /* Set delta phase and freq sigma delta */
+                ath5k_hw_reg_write(ah,
+                                AR5K_REG_SM(spur_delta_phase,
+                                        AR5K_PHY_TIMING_11_SPUR_DELTA_PHASE) |
+                                AR5K_REG_SM(spur_freq_sigma_delta,
+                                AR5K_PHY_TIMING_11_SPUR_FREQ_SD) |
+                                AR5K_PHY_TIMING_11_USE_SPUR_IN_AGC,
+                                AR5K_PHY_TIMING_11);
+
+                /* Write pilot masks */
+                ath5k_hw_reg_write(ah, pilot_mask[0], AR5K_PHY_TIMING_7);
+                AR5K_REG_WRITE_BITS(ah, AR5K_PHY_TIMING_8,
+                                        AR5K_PHY_TIMING_8_PILOT_MASK_2,
+                                        pilot_mask[1]);
+
+                ath5k_hw_reg_write(ah, pilot_mask[0], AR5K_PHY_TIMING_9);
+                AR5K_REG_WRITE_BITS(ah, AR5K_PHY_TIMING_10,
+                                        AR5K_PHY_TIMING_10_PILOT_MASK_2,
+                                        pilot_mask[1]);
+
+                /* Write magnitude masks */
+                ath5k_hw_reg_write(ah, mag_mask[0], AR5K_PHY_BIN_MASK_1);
+                ath5k_hw_reg_write(ah, mag_mask[1], AR5K_PHY_BIN_MASK_2);
+                ath5k_hw_reg_write(ah, mag_mask[2], AR5K_PHY_BIN_MASK_3);
+                AR5K_REG_WRITE_BITS(ah, AR5K_PHY_BIN_MASK_CTL,
+                                        AR5K_PHY_BIN_MASK_CTL_MASK_4,
+                                        mag_mask[3]);
+
+                ath5k_hw_reg_write(ah, mag_mask[0], AR5K_PHY_BIN_MASK2_1);
+                ath5k_hw_reg_write(ah, mag_mask[1], AR5K_PHY_BIN_MASK2_2);
+                ath5k_hw_reg_write(ah, mag_mask[2], AR5K_PHY_BIN_MASK2_3);
+                AR5K_REG_WRITE_BITS(ah, AR5K_PHY_BIN_MASK2_4,
+                                        AR5K_PHY_BIN_MASK2_4_MASK_4,
+                                        mag_mask[3]);
+
+        } else if (ath5k_hw_reg_read(ah, AR5K_PHY_IQ) &
+        AR5K_PHY_IQ_SPUR_FILT_EN) {
+                /* Clean up spur mitigation settings and disable fliter */
+                AR5K_REG_WRITE_BITS(ah, AR5K_PHY_BIN_MASK_CTL,
+                                        AR5K_PHY_BIN_MASK_CTL_RATE, 0);
+                AR5K_REG_DISABLE_BITS(ah, AR5K_PHY_IQ,
+                                        AR5K_PHY_IQ_PILOT_MASK_EN |
+                                        AR5K_PHY_IQ_CHAN_MASK_EN |
+                                        AR5K_PHY_IQ_SPUR_FILT_EN);
+                ath5k_hw_reg_write(ah, 0, AR5K_PHY_TIMING_11);
+
+                /* Clear pilot masks */
+                ath5k_hw_reg_write(ah, 0, AR5K_PHY_TIMING_7);
+                AR5K_REG_WRITE_BITS(ah, AR5K_PHY_TIMING_8,
+                                        AR5K_PHY_TIMING_8_PILOT_MASK_2,
+                                        0);
+
+                ath5k_hw_reg_write(ah, 0, AR5K_PHY_TIMING_9);
+                AR5K_REG_WRITE_BITS(ah, AR5K_PHY_TIMING_10,
+                                        AR5K_PHY_TIMING_10_PILOT_MASK_2,
+                                        0);
+
+                /* Clear magnitude masks */
+                ath5k_hw_reg_write(ah, 0, AR5K_PHY_BIN_MASK_1);
+                ath5k_hw_reg_write(ah, 0, AR5K_PHY_BIN_MASK_2);
+                ath5k_hw_reg_write(ah, 0, AR5K_PHY_BIN_MASK_3);
+                AR5K_REG_WRITE_BITS(ah, AR5K_PHY_BIN_MASK_CTL,
+                                        AR5K_PHY_BIN_MASK_CTL_MASK_4,
+                                        0);
+
+                ath5k_hw_reg_write(ah, 0, AR5K_PHY_BIN_MASK2_1);
+                ath5k_hw_reg_write(ah, 0, AR5K_PHY_BIN_MASK2_2);
+                ath5k_hw_reg_write(ah, 0, AR5K_PHY_BIN_MASK2_3);
+                AR5K_REG_WRITE_BITS(ah, AR5K_PHY_BIN_MASK2_4,
+                                        AR5K_PHY_BIN_MASK2_4_MASK_4,
+                                        0);
+        }
+}
+
+/********************\
+  Misc PHY functions
+\********************/
+
 int ath5k_hw_phy_disable(struct ath5k_hw *ah)
 {
         ATH5K_TRACE(ah->ah_sc);
@@ -1365,10 +1613,6 @@ int ath5k_hw_phy_disable(struct ath5k_hw *ah)
         return 0;
 }
 
-/********************\
-  Misc PHY functions
-\********************/
-
 /*
  * Get the PHY Chip revision
  */
@@ -1417,25 +1661,189 @@ u16 ath5k_hw_radio_revision(struct ath5k_hw *ah, unsigned int chan)
         return ret;
 }
 
+/*****************\
+* Antenna control *
+\*****************/
+
 void /*TODO:Boundary check*/
-ath5k_hw_set_def_antenna(struct ath5k_hw *ah, unsigned int ant)
+ath5k_hw_set_def_antenna(struct ath5k_hw *ah, u8 ant)
 {
         ATH5K_TRACE(ah->ah_sc);
-        /*Just a try M.F.*/
+
         if (ah->ah_version != AR5K_AR5210)
-                ath5k_hw_reg_write(ah, ant, AR5K_DEFAULT_ANTENNA);
+                ath5k_hw_reg_write(ah, ant & 0x7, AR5K_DEFAULT_ANTENNA);
 }
 
 unsigned int ath5k_hw_get_def_antenna(struct ath5k_hw *ah)
 {
         ATH5K_TRACE(ah->ah_sc);
-        /*Just a try M.F.*/
+
         if (ah->ah_version != AR5K_AR5210)
-                return ath5k_hw_reg_read(ah, AR5K_DEFAULT_ANTENNA);
+                return ath5k_hw_reg_read(ah, AR5K_DEFAULT_ANTENNA) & 0x7;
 
         return false; /*XXX: What do we return for 5210 ?*/
 }
 
+/*
+ * Enable/disable fast rx antenna diversity
+ */
+static void
+ath5k_hw_set_fast_div(struct ath5k_hw *ah, u8 ee_mode, bool enable)
+{
+        switch (ee_mode) {
+        case AR5K_EEPROM_MODE_11G:
+                /* XXX: This is set to
+                 * disabled on initvals !!! */
+        case AR5K_EEPROM_MODE_11A:
+                if (enable)
+                        AR5K_REG_DISABLE_BITS(ah, AR5K_PHY_AGCCTL,
+                                        AR5K_PHY_AGCCTL_OFDM_DIV_DIS);
+                else
+                        AR5K_REG_ENABLE_BITS(ah, AR5K_PHY_AGCCTL,
+                                        AR5K_PHY_AGCCTL_OFDM_DIV_DIS);
+                break;
+        case AR5K_EEPROM_MODE_11B:
+                AR5K_REG_ENABLE_BITS(ah, AR5K_PHY_AGCCTL,
+                                        AR5K_PHY_AGCCTL_OFDM_DIV_DIS);
+                break;
+        default:
+                return;
+        }
+
+        if (enable) {
+                AR5K_REG_WRITE_BITS(ah, AR5K_PHY_RESTART,
+                                AR5K_PHY_RESTART_DIV_GC, 0xc);
+
+                AR5K_REG_ENABLE_BITS(ah, AR5K_PHY_FAST_ANT_DIV,
+                                        AR5K_PHY_FAST_ANT_DIV_EN);
+        } else {
+                AR5K_REG_WRITE_BITS(ah, AR5K_PHY_RESTART,
+                                AR5K_PHY_RESTART_DIV_GC, 0x8);
+
+                AR5K_REG_DISABLE_BITS(ah, AR5K_PHY_FAST_ANT_DIV,
+                                        AR5K_PHY_FAST_ANT_DIV_EN);
+        }
+}
+
+/*
+ * Set antenna operating mode
+ */
+void
+ath5k_hw_set_antenna_mode(struct ath5k_hw *ah, u8 ant_mode)
+{
+        struct ieee80211_channel *channel = &ah->ah_current_channel;
+        bool use_def_for_tx, update_def_on_tx, use_def_for_rts, fast_div;
+        bool use_def_for_sg;
+        u8 def_ant, tx_ant, ee_mode;
+        u32 sta_id1 = 0;
+
+        def_ant = ah->ah_def_ant;
+
+        ATH5K_TRACE(ah->ah_sc);
+
+        switch (channel->hw_value & CHANNEL_MODES) {
+        case CHANNEL_A:
+        case CHANNEL_T:
+        case CHANNEL_XR:
+                ee_mode = AR5K_EEPROM_MODE_11A;
+                break;
+        case CHANNEL_G:
+        case CHANNEL_TG:
+                ee_mode = AR5K_EEPROM_MODE_11G;
+                break;
+        case CHANNEL_B:
+                ee_mode = AR5K_EEPROM_MODE_11B;
+                break;
+        default:
+                ATH5K_ERR(ah->ah_sc,
+                        "invalid channel: %d\n", channel->center_freq);
+                return;
+        }
+
+        switch (ant_mode) {
+        case AR5K_ANTMODE_DEFAULT:
+                tx_ant = 0;
+                use_def_for_tx = false;
+                update_def_on_tx = false;
+                use_def_for_rts = false;
+                use_def_for_sg = false;
+                fast_div = true;
+                break;
+        case AR5K_ANTMODE_FIXED_A:
+                def_ant = 1;
+                tx_ant = 0;
+                use_def_for_tx = true;
+                update_def_on_tx = false;
+                use_def_for_rts = true;
+                use_def_for_sg = true;
+                fast_div = false;
+                break;
+        case AR5K_ANTMODE_FIXED_B:
+                def_ant = 2;
+                tx_ant = 0;
+                use_def_for_tx = true;
+                update_def_on_tx = false;
+                use_def_for_rts = true;
+                use_def_for_sg = true;
+                fast_div = false;
+                break;
+        case AR5K_ANTMODE_SINGLE_AP:
+                def_ant = 1;    /* updated on tx */
+                tx_ant = 0;
+                use_def_for_tx = true;
+                update_def_on_tx = true;
+                use_def_for_rts = true;
+                use_def_for_sg = true;
+                fast_div = true;
+                break;
+        case AR5K_ANTMODE_SECTOR_AP:
+                tx_ant = 1;     /* variable */
+                use_def_for_tx = false;
+                update_def_on_tx = false;
+                use_def_for_rts = true;
+                use_def_for_sg = false;
+                fast_div = false;
+                break;
+        case AR5K_ANTMODE_SECTOR_STA:
+                tx_ant = 1;     /* variable */
+                use_def_for_tx = true;
+                update_def_on_tx = false;
+                use_def_for_rts = true;
+                use_def_for_sg = false;
+                fast_div = true;
+                break;
+        case AR5K_ANTMODE_DEBUG:
+                def_ant = 1;
+                tx_ant = 2;
+                use_def_for_tx = false;
+                update_def_on_tx = false;
+                use_def_for_rts = false;
+                use_def_for_sg = false;
+                fast_div = false;
+                break;
+        default:
+                return;
+        }
+
+        ah->ah_tx_ant = tx_ant;
+        ah->ah_ant_mode = ant_mode;
+
+        sta_id1 |= use_def_for_tx ? AR5K_STA_ID1_DEFAULT_ANTENNA : 0;
+        sta_id1 |= update_def_on_tx ? AR5K_STA_ID1_DESC_ANTENNA : 0;
+        sta_id1 |= use_def_for_rts ? AR5K_STA_ID1_RTS_DEF_ANTENNA : 0;
+        sta_id1 |= use_def_for_sg ? AR5K_STA_ID1_SELFGEN_DEF_ANT : 0;
+
+        AR5K_REG_DISABLE_BITS(ah, AR5K_STA_ID1, AR5K_STA_ID1_ANTENNA_SETTINGS);
+
+        if (sta_id1)
+                AR5K_REG_ENABLE_BITS(ah, AR5K_STA_ID1, sta_id1);
+
+        /* Note: set diversity before default antenna
+         * because it won't work correctly */
+        ath5k_hw_set_fast_div(ah, ee_mode, fast_div);
+        ath5k_hw_set_def_antenna(ah, def_ant);
+}
+
 
 /****************\
 * TX power setup *
@@ -1750,8 +2158,6 @@ done:
  * Get the max edge power for this channel if
  * we have such data from EEPROM's Conformance Test
  * Limits (CTL), and limit max power if needed.
- *
- * FIXME: Only works for world regulatory domains
  */
 static void
 ath5k_get_max_ctl_power(struct ath5k_hw *ah,
@@ -1767,26 +2173,23 @@ ath5k_get_max_ctl_power(struct ath5k_hw *ah,
         u8 ctl_idx = 0xFF;
         u32 target = channel->center_freq;
 
-        /* Find out a CTL for our mode that's not mapped
-         * on a specific reg domain.
-         *
-         * TODO: Map our current reg domain to one of the 3 available
-         * reg domain ids so that we can support more CTLs. */
+        ctl_mode = ath_regd_get_band_ctl(&ah->ah_regulatory, channel->band);
+
         switch (channel->hw_value & CHANNEL_MODES) {
         case CHANNEL_A:
-                ctl_mode = AR5K_CTL_11A | AR5K_CTL_NO_REGDOMAIN;
+                ctl_mode |= AR5K_CTL_11A;
                 break;
         case CHANNEL_G:
-                ctl_mode = AR5K_CTL_11G | AR5K_CTL_NO_REGDOMAIN;
+                ctl_mode |= AR5K_CTL_11G;
                 break;
         case CHANNEL_B:
-                ctl_mode = AR5K_CTL_11B | AR5K_CTL_NO_REGDOMAIN;
+                ctl_mode |= AR5K_CTL_11B;
                 break;
         case CHANNEL_T:
-                ctl_mode = AR5K_CTL_TURBO | AR5K_CTL_NO_REGDOMAIN;
+                ctl_mode |= AR5K_CTL_TURBO;
                 break;
         case CHANNEL_TG:
-                ctl_mode = AR5K_CTL_TURBOG | AR5K_CTL_NO_REGDOMAIN;
+                ctl_mode |= AR5K_CTL_TURBOG;
                 break;
         case CHANNEL_XR:
                 /* Fall through */
@@ -2482,8 +2885,19 @@ ath5k_setup_rate_powertable(struct ath5k_hw *ah, u16 max_pwr,
                 for (i = 8; i <= 15; i++)
                         rates[i] -= ah->ah_txpower.txp_cck_ofdm_gainf_delta;
 
-        ah->ah_txpower.txp_min_pwr = rates[7];
-        ah->ah_txpower.txp_max_pwr = rates[0];
+        /* Now that we have all rates setup use table offset to
+         * match the power range set by user with the power indices
+         * on PCDAC/PDADC table */
+        for (i = 0; i < 16; i++) {
+                rates[i] += ah->ah_txpower.txp_offset;
+                /* Don't get out of bounds */
+                if (rates[i] > 63)
+                        rates[i] = 63;
+        }
+
+        /* Min/max in 0.25dB units */
+        ah->ah_txpower.txp_min_pwr = 2 * rates[7];
+        ah->ah_txpower.txp_max_pwr = 2 * rates[0];
         ah->ah_txpower.txp_ofdm = rates[7];
 }
 
@@ -2591,16 +3005,37 @@ ath5k_hw_txpower(struct ath5k_hw *ah, struct ieee80211_channel *channel,
         return 0;
 }
 
-int ath5k_hw_set_txpower_limit(struct ath5k_hw *ah, u8 mode, u8 txpower)
+int ath5k_hw_set_txpower_limit(struct ath5k_hw *ah, u8 txpower)
 {
         /*Just a try M.F.*/
         struct ieee80211_channel *channel = &ah->ah_current_channel;
+        u8 ee_mode;
 
         ATH5K_TRACE(ah->ah_sc);
+
+        switch (channel->hw_value & CHANNEL_MODES) {
+        case CHANNEL_A:
+        case CHANNEL_T:
+        case CHANNEL_XR:
+                ee_mode = AR5K_EEPROM_MODE_11A;
+                break;
+        case CHANNEL_G:
+        case CHANNEL_TG:
+                ee_mode = AR5K_EEPROM_MODE_11G;
+                break;
+        case CHANNEL_B:
+                ee_mode = AR5K_EEPROM_MODE_11B;
+                break;
+        default:
+                ATH5K_ERR(ah->ah_sc,
+                        "invalid channel: %d\n", channel->center_freq);
+                return -EINVAL;
+        }
+
         ATH5K_DBG(ah->ah_sc, ATH5K_DEBUG_TXPOWER,
                 "changing txpower to %d\n", txpower);
 
-        return ath5k_hw_txpower(ah, channel, mode, txpower);
+        return ath5k_hw_txpower(ah, channel, ee_mode, txpower);
 }
 
 #undef _ATH5K_PHY
diff --git a/drivers/net/wireless/ath/ath5k/qcu.c b/drivers/net/wireless/ath/ath5k/qcu.c
index 5094c394a4b2..73407b3f53ef 100644
--- a/drivers/net/wireless/ath/ath5k/qcu.c
+++ b/drivers/net/wireless/ath/ath5k/qcu.c
@@ -160,7 +160,8 @@ u32 ath5k_hw_num_tx_pending(struct ath5k_hw *ah, unsigned int queue)
         if (ah->ah_version == AR5K_AR5210)
                 return false;
 
-        pending = (AR5K_QUEUE_STATUS(queue) & AR5K_QCU_STS_FRMPENDCNT);
+        pending = ath5k_hw_reg_read(ah, AR5K_QUEUE_STATUS(queue));
+        pending &= AR5K_QCU_STS_FRMPENDCNT;
 
         /* It's possible to have no frames pending even if TXE
          * is set. To indicate that q has not stopped return
@@ -401,14 +402,16 @@ int ath5k_hw_reset_tx_queue(struct ath5k_hw *ah, unsigned int queue)
                         AR5K_REG_ENABLE_BITS(ah, AR5K_QUEUE_DFS_MISC(queue),
                                 (AR5K_DCU_MISC_ARBLOCK_CTL_GLOBAL <<
                                 AR5K_DCU_MISC_ARBLOCK_CTL_S) |
+                                AR5K_DCU_MISC_ARBLOCK_IGNORE |
                                 AR5K_DCU_MISC_POST_FR_BKOFF_DIS |
                                 AR5K_DCU_MISC_BCN_ENABLE);
                         break;
 
                 case AR5K_TX_QUEUE_CAB:
                         AR5K_REG_ENABLE_BITS(ah, AR5K_QUEUE_MISC(queue),
-                                AR5K_QCU_MISC_FRSHED_DBA_GT |
+                                AR5K_QCU_MISC_FRSHED_BCN_SENT_GT |
                                 AR5K_QCU_MISC_CBREXP_DIS |
+                                AR5K_QCU_MISC_RDY_VEOL_POLICY |
                                 AR5K_QCU_MISC_CBREXP_BCN_DIS);
 
                         ath5k_hw_reg_write(ah, ((AR5K_TUNE_BEACON_INTERVAL -
diff --git a/drivers/net/wireless/ath/ath5k/reg.h b/drivers/net/wireless/ath/ath5k/reg.h
index 7070d1543cdc..6809b54a2ad7 100644
--- a/drivers/net/wireless/ath/ath5k/reg.h
+++ b/drivers/net/wireless/ath/ath5k/reg.h
@@ -1148,6 +1148,11 @@
 #define AR5K_STA_ID1_CBCIV_ENDIAN       0x40000000      /* ??? */
 #define AR5K_STA_ID1_KEYSRCH_MCAST      0x80000000      /* Do key cache search for mcast frames */
 
+#define AR5K_STA_ID1_ANTENNA_SETTINGS   (AR5K_STA_ID1_DEFAULT_ANTENNA | \
+                                        AR5K_STA_ID1_DESC_ANTENNA | \
+                                        AR5K_STA_ID1_RTS_DEF_ANTENNA | \
+                                        AR5K_STA_ID1_SELFGEN_DEF_ANT)
+
 /*
  * First BSSID register (MAC address, lower 32bits)
  */
@@ -2028,7 +2033,9 @@
 #define AR5K_PHY_AGCCTL                 0x9860                  /* Register address */
 #define AR5K_PHY_AGCCTL_CAL             0x00000001      /* Enable PHY calibration */
 #define AR5K_PHY_AGCCTL_NF              0x00000002      /* Enable Noise Floor calibration */
+#define AR5K_PHY_AGCCTL_OFDM_DIV_DIS    0x00000008      /* Disable antenna diversity on OFDM modes */
 #define AR5K_PHY_AGCCTL_NF_EN           0x00008000      /* Enable nf calibration to happen (?) */
+#define AR5K_PHY_AGCTL_FLTR_CAL         0x00010000      /* Allow filter calibration (?) */
 #define AR5K_PHY_AGCCTL_NF_NOUPDATE     0x00020000      /* Don't update nf automaticaly */
 
 /*
@@ -2528,7 +2535,7 @@
  * PHY CCK Cross-correlator Barker RSSI threshold register [5212+]
  */
 #define AR5K_PHY_CCK_CROSSCORR                  0xa208
-#define AR5K_PHY_CCK_CROSSCORR_WEAK_SIG_THR     0x0000000f
+#define AR5K_PHY_CCK_CROSSCORR_WEAK_SIG_THR     0x0000003f
 #define AR5K_PHY_CCK_CROSSCORR_WEAK_SIG_THR_S   0
 
 /* Same address is used for antenna diversity activation */
diff --git a/drivers/net/wireless/ath/ath5k/reset.c b/drivers/net/wireless/ath/ath5k/reset.c
index 775fdf78554b..c1862f8a2e7b 100644
--- a/drivers/net/wireless/ath/ath5k/reset.c
+++ b/drivers/net/wireless/ath/ath5k/reset.c
@@ -507,7 +507,7 @@ static void ath5k_hw_set_sleep_clock(struct ath5k_hw *ah, bool enable)
 
                 if (ah->ah_mac_version == (AR5K_SREV_AR2417 >> 4))
                         scal = AR5K_PHY_SCAL_32MHZ_2417;
-                else if (ath5k_eeprom_is_hb63(ah))
+                else if (ee->ee_is_hb63)
                         scal = AR5K_PHY_SCAL_32MHZ_HB63;
                 else
                         scal = AR5K_PHY_SCAL_32MHZ;
@@ -536,26 +536,6 @@ static void ath5k_hw_set_sleep_clock(struct ath5k_hw *ah, bool enable)
         return;
 }
 
-static bool ath5k_hw_chan_has_spur_noise(struct ath5k_hw *ah,
-                                struct ieee80211_channel *channel)
-{
-        u8 refclk_freq;
-
-        if ((ah->ah_radio == AR5K_RF5112) ||
-        (ah->ah_radio == AR5K_RF5413) ||
-        (ah->ah_mac_version == (AR5K_SREV_AR2417 >> 4)))
-                refclk_freq = 40;
-        else
-                refclk_freq = 32;
-
-        if ((channel->center_freq % refclk_freq != 0) &&
-        ((channel->center_freq % refclk_freq < 10) ||
-        (channel->center_freq % refclk_freq > 22)))
-                return true;
-        else
-                return false;
-}
-
 /* TODO: Half/Quarter rate */
 static void ath5k_hw_tweak_initval_settings(struct ath5k_hw *ah,
                                 struct ieee80211_channel *channel)
@@ -598,9 +578,10 @@ static void ath5k_hw_tweak_initval_settings(struct ath5k_hw *ah,
         /* Set DAC/ADC delays */
         if (ah->ah_version == AR5K_AR5212) {
                 u32 scal;
+                struct ath5k_eeprom_info *ee = &ah->ah_capabilities.cap_eeprom;
                 if (ah->ah_mac_version == (AR5K_SREV_AR2417 >> 4))
                         scal = AR5K_PHY_SCAL_32MHZ_2417;
-                else if (ath5k_eeprom_is_hb63(ah))
+                else if (ee->ee_is_hb63)
                         scal = AR5K_PHY_SCAL_32MHZ_HB63;
                 else
                         scal = AR5K_PHY_SCAL_32MHZ;
@@ -697,13 +678,13 @@ static void ath5k_hw_commit_eeprom_settings(struct ath5k_hw *ah,
         /* Set antenna idle switch table */
         AR5K_REG_WRITE_BITS(ah, AR5K_PHY_ANT_CTL,
                         AR5K_PHY_ANT_CTL_SWTABLE_IDLE,
-                        (ah->ah_antenna[ee_mode][0] |
+                        (ah->ah_ant_ctl[ee_mode][0] |
                         AR5K_PHY_ANT_CTL_TXRX_EN));
 
-        /* Set antenna switch table */
-        ath5k_hw_reg_write(ah, ah->ah_antenna[ee_mode][ant[0]],
+        /* Set antenna switch tables */
+        ath5k_hw_reg_write(ah, ah->ah_ant_ctl[ee_mode][ant[0]],
                 AR5K_PHY_ANT_SWITCH_TABLE_0);
-        ath5k_hw_reg_write(ah, ah->ah_antenna[ee_mode][ant[1]],
+        ath5k_hw_reg_write(ah, ah->ah_ant_ctl[ee_mode][ant[1]],
                 AR5K_PHY_ANT_SWITCH_TABLE_1);
 
         /* Noise floor threshold */
@@ -997,10 +978,10 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum nl80211_iftype op_mode,
                 ath5k_hw_tweak_initval_settings(ah, channel);
 
                 /*
-                 * Set TX power (FIXME)
+                 * Set TX power
                  */
                 ret = ath5k_hw_txpower(ah, channel, ee_mode,
-                                        AR5K_TUNE_DEFAULT_TXPOWER);
+                                        ah->ah_txpower.txp_max_pwr / 2);
                 if (ret)
                         return ret;
 
@@ -1023,9 +1004,22 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum nl80211_iftype op_mode,
                 /* Write OFDM timings on 5212*/
                 if (ah->ah_version == AR5K_AR5212 &&
                         channel->hw_value & CHANNEL_OFDM) {
+                        struct ath5k_eeprom_info *ee =
+                                        &ah->ah_capabilities.cap_eeprom;
+
                         ret = ath5k_hw_write_ofdm_timings(ah, channel);
                         if (ret)
                                 return ret;
+
+                        /* Note: According to docs we can have a newer
+                         * EEPROM on old hardware, so we need to verify
+                         * that our hardware is new enough to have spur
+                         * mitigation registers (delta phase etc) */
+                        if (ah->ah_mac_srev >= AR5K_SREV_AR5424 ||
+                        (ah->ah_mac_srev >= AR5K_SREV_AR5424 &&
+                        ee->ee_version >= AR5K_EEPROM_VERSION_5_3))
+                                ath5k_hw_set_spur_mitigation_filter(ah,
+                                                                channel);
                 }
 
                 /*Enable/disable 802.11b mode on 5111
@@ -1041,17 +1035,15 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum nl80211_iftype op_mode,
 
                 /*
                  * In case a fixed antenna was set as default
-                 * write the same settings on both AR5K_PHY_ANT_SWITCH_TABLE
-                 * registers.
+                 * use the same switch table twice.
                  */
-                if (s_ant != 0) {
-                        if (s_ant == AR5K_ANT_FIXED_A) /* 1 - Main */
-                                ant[0] = ant[1] = AR5K_ANT_FIXED_A;
-                        else    /* 2 - Aux */
-                                ant[0] = ant[1] = AR5K_ANT_FIXED_B;
-                } else {
-                        ant[0] = AR5K_ANT_FIXED_A;
-                        ant[1] = AR5K_ANT_FIXED_B;
+                if (ah->ah_ant_mode == AR5K_ANTMODE_FIXED_A)
+                                ant[0] = ant[1] = AR5K_ANT_SWTABLE_A;
+                else if (ah->ah_ant_mode == AR5K_ANTMODE_FIXED_B)
+                                ant[0] = ant[1] = AR5K_ANT_SWTABLE_B;
+                else {
+                        ant[0] = AR5K_ANT_SWTABLE_A;
+                        ant[1] = AR5K_ANT_SWTABLE_B;
                 }
 
                 /* Commit values from EEPROM */
@@ -1259,6 +1251,8 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum nl80211_iftype op_mode,
          */
         ath5k_hw_noise_floor_calibration(ah, channel->center_freq);
 
+        /* Restore antenna mode */
+        ath5k_hw_set_antenna_mode(ah, ah->ah_ant_mode);
 
         /*
          * Configure QCUs/DCUs
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index c92d46fa9d51..10ffc9442859 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -576,8 +576,8 @@ struct ath_softc {
         struct ath_tx tx;
         struct ath_beacon beacon;
         struct ieee80211_rate rates[IEEE80211_NUM_BANDS][ATH_RATE_MAX];
-        struct ath_rate_table *hw_rate_table[ATH9K_MODE_MAX];
-        struct ath_rate_table *cur_rate_table;
+        const struct ath_rate_table *hw_rate_table[ATH9K_MODE_MAX];
+        const struct ath_rate_table *cur_rate_table;
         struct ieee80211_supported_band sbands[IEEE80211_NUM_BANDS];
 
         struct ath_led radio_led;
@@ -590,6 +590,8 @@ struct ath_softc {
         int led_on_cnt;
         int led_off_cnt;
 
+        int beacon_interval;
+
         struct ath_rfkill rf_kill;
         struct ath_ani ani;
         struct ath9k_node_stats nodestats;
@@ -695,36 +697,7 @@ void ath9k_wiphy_pause_all_forced(struct ath_softc *sc,
 bool ath9k_wiphy_scanning(struct ath_softc *sc);
 void ath9k_wiphy_work(struct work_struct *work);
 
-/*
- * Read and write, they both share the same lock. We do this to serialize
- * reads and writes on Atheros 802.11n PCI devices only. This is required
- * as the FIFO on these devices can only accept sanely 2 requests. After
- * that the device goes bananas. Serializing the reads/writes prevents this
- * from happening.
- */
-
-static inline void ath9k_iowrite32(struct ath_hw *ah, u32 reg_offset, u32 val)
-{
-        if (ah->config.serialize_regmode == SER_REG_MODE_ON) {
-                unsigned long flags;
-                spin_lock_irqsave(&ah->ah_sc->sc_serial_rw, flags);
-                iowrite32(val, ah->ah_sc->mem + reg_offset);
-                spin_unlock_irqrestore(&ah->ah_sc->sc_serial_rw, flags);
-        } else
-                iowrite32(val, ah->ah_sc->mem + reg_offset);
-}
-
-static inline unsigned int ath9k_ioread32(struct ath_hw *ah, u32 reg_offset)
-{
-        u32 val;
-        if (ah->config.serialize_regmode == SER_REG_MODE_ON) {
-                unsigned long flags;
-                spin_lock_irqsave(&ah->ah_sc->sc_serial_rw, flags);
-                val = ioread32(ah->ah_sc->mem + reg_offset);
-                spin_unlock_irqrestore(&ah->ah_sc->sc_serial_rw, flags);
-        } else
-                val = ioread32(ah->ah_sc->mem + reg_offset);
-        return val;
-}
+void ath9k_iowrite32(struct ath_hw *ah, u32 reg_offset, u32 val);
+unsigned int ath9k_ioread32(struct ath_hw *ah, u32 reg_offset);
 
 #endif /* ATH9K_H */
diff --git a/drivers/net/wireless/ath/ath9k/beacon.c b/drivers/net/wireless/ath/ath9k/beacon.c
index eb4759fc6a0d..3a7154beeae1 100644
--- a/drivers/net/wireless/ath/ath9k/beacon.c
+++ b/drivers/net/wireless/ath/ath9k/beacon.c
@@ -63,7 +63,7 @@ static void ath_beacon_setup(struct ath_softc *sc, struct ath_vif *avp,
         struct ath_hw *ah = sc->sc_ah;
         struct ath_desc *ds;
         struct ath9k_11n_rate_series series[4];
-        struct ath_rate_table *rt;
+        const struct ath_rate_table *rt;
         int flags, antenna, ctsrate = 0, ctsduration = 0;
         u8 rate;
 
@@ -320,8 +320,7 @@ int ath_beacon_alloc(struct ath_wiphy *aphy, struct ieee80211_vif *vif)
                 u64 tsfadjust;
                 int intval;
 
-                intval = sc->hw->conf.beacon_int ?
-                        sc->hw->conf.beacon_int : ATH_DEFAULT_BINTVAL;
+                intval = sc->beacon_interval ? : ATH_DEFAULT_BINTVAL;
 
                 /*
                  * Calculate the TSF offset for this beacon slot, i.e., the
@@ -431,8 +430,7 @@ void ath_beacon_tasklet(unsigned long data)
          * on the tsf to safeguard against missing an swba.
          */
 
-        intval = sc->hw->conf.beacon_int ?
-                sc->hw->conf.beacon_int : ATH_DEFAULT_BINTVAL;
+        intval = sc->beacon_interval ? : ATH_DEFAULT_BINTVAL;
 
         tsf = ath9k_hw_gettsf64(ah);
         tsftu = TSF_TO_TU(tsf>>32, tsf);
@@ -711,8 +709,7 @@ void ath_beacon_config(struct ath_softc *sc, struct ieee80211_vif *vif)
         /* Setup the beacon configuration parameters */
 
         memset(&conf, 0, sizeof(struct ath_beacon_config));
-        conf.beacon_interval = sc->hw->conf.beacon_int ?
-                sc->hw->conf.beacon_int : ATH_DEFAULT_BINTVAL;
+        conf.beacon_interval = sc->beacon_interval ? : ATH_DEFAULT_BINTVAL;
         conf.listen_interval = 1;
         conf.dtim_period = conf.beacon_interval;
         conf.dtim_count = 1;
diff --git a/drivers/net/wireless/ath/ath9k/calib.c b/drivers/net/wireless/ath/ath9k/calib.c
index a197041d76b5..a32d7e7fecbe 100644
--- a/drivers/net/wireless/ath/ath9k/calib.c
+++ b/drivers/net/wireless/ath/ath9k/calib.c
@@ -863,7 +863,7 @@ bool ath9k_hw_calibrate(struct ath_hw *ah, struct ath9k_channel *chan,
         }
 
         if (longcal) {
-                if (AR_SREV_9285(ah) && AR_SREV_9285_11_OR_LATER(ah))
+                if (AR_SREV_9285_11_OR_LATER(ah))
                         ath9k_hw_9285_pa_cal(ah);
 
                 if (OLC_FOR_AR9280_20_LATER)
@@ -917,7 +917,7 @@ static bool ar9285_clc(struct ath_hw *ah, struct ath9k_channel *chan)
 
 bool ath9k_hw_init_cal(struct ath_hw *ah, struct ath9k_channel *chan)
 {
-        if (AR_SREV_9285(ah) && AR_SREV_9285_12_OR_LATER(ah)) {
+        if (AR_SREV_9285_12_OR_LATER(ah)) {
                 if (!ar9285_clc(ah, chan))
                         return false;
         } else {
@@ -947,7 +947,7 @@ bool ath9k_hw_init_cal(struct ath_hw *ah, struct ath9k_channel *chan)
         }
 
         /* Do PA Calibration */
-        if (AR_SREV_9285(ah) && AR_SREV_9285_11_OR_LATER(ah))
+        if (AR_SREV_9285_11_OR_LATER(ah))
                 ath9k_hw_9285_pa_cal(ah);
 
         /* Do NF Calibration after DC offset and other calibrations */
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index ec2a7a40b00d..5879c731e9e7 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -84,6 +84,38 @@ static u32 ath9k_hw_mac_to_clks(struct ath_hw *ah, u32 usecs)
                 return ath9k_hw_mac_clks(ah, usecs);
 }
 
+/*
+ * Read and write, they both share the same lock. We do this to serialize
+ * reads and writes on Atheros 802.11n PCI devices only. This is required
+ * as the FIFO on these devices can only accept sanely 2 requests. After
+ * that the device goes bananas. Serializing the reads/writes prevents this
+ * from happening.
+ */
+
+void ath9k_iowrite32(struct ath_hw *ah, u32 reg_offset, u32 val)
+{
+        if (ah->config.serialize_regmode == SER_REG_MODE_ON) {
+                unsigned long flags;
+                spin_lock_irqsave(&ah->ah_sc->sc_serial_rw, flags);
+                iowrite32(val, ah->ah_sc->mem + reg_offset);
+                spin_unlock_irqrestore(&ah->ah_sc->sc_serial_rw, flags);
+        } else
+                iowrite32(val, ah->ah_sc->mem + reg_offset);
+}
+
+unsigned int ath9k_ioread32(struct ath_hw *ah, u32 reg_offset)
+{
+        u32 val;
+        if (ah->config.serialize_regmode == SER_REG_MODE_ON) {
+                unsigned long flags;
+                spin_lock_irqsave(&ah->ah_sc->sc_serial_rw, flags);
+                val = ioread32(ah->ah_sc->mem + reg_offset);
+                spin_unlock_irqrestore(&ah->ah_sc->sc_serial_rw, flags);
+        } else
+                val = ioread32(ah->ah_sc->mem + reg_offset);
+        return val;
+}
+
 bool ath9k_hw_wait(struct ath_hw *ah, u32 reg, u32 mask, u32 val, u32 timeout)
 {
         int i;
@@ -136,7 +168,7 @@ bool ath9k_get_channel_edges(struct ath_hw *ah,
 }
 
 u16 ath9k_hw_computetxtime(struct ath_hw *ah,
-                           struct ath_rate_table *rates,
+                           const struct ath_rate_table *rates,
                            u32 frameLen, u16 rateix,
                            bool shortPreamble)
 {
@@ -1313,8 +1345,7 @@ static int ath9k_hw_process_ini(struct ath_hw *ah,
         if (AR_SREV_9280(ah))
                 REG_WRITE_ARRAY(&ah->iniModesRxGain, modesIndex, regWrites);
 
-        if (AR_SREV_9280(ah) || (AR_SREV_9285(ah) &&
-            AR_SREV_9285_12_OR_LATER(ah)))
+        if (AR_SREV_9280(ah) || AR_SREV_9285_12_OR_LATER(ah))
                 REG_WRITE_ARRAY(&ah->iniModesTxGain, modesIndex, regWrites);
 
         for (i = 0; i < ah->iniCommon.ia_rows; i++) {
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index ab3412672e36..ddb24c47ebcf 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -580,7 +580,8 @@ bool ath9k_hw_setantennaswitch(struct ath_hw *ah,
 bool ath9k_hw_wait(struct ath_hw *ah, u32 reg, u32 mask, u32 val, u32 timeout);
 u32 ath9k_hw_reverse_bits(u32 val, u32 n);
 bool ath9k_get_channel_edges(struct ath_hw *ah, u16 flags, u16 *low, u16 *high);
-u16 ath9k_hw_computetxtime(struct ath_hw *ah, struct ath_rate_table *rates,
+u16 ath9k_hw_computetxtime(struct ath_hw *ah,
+                           const struct ath_rate_table *rates,
                            u32 frameLen, u16 rateix, bool shortPreamble);
 void ath9k_hw_get_channel_centers(struct ath_hw *ah,
                                   struct ath9k_channel *chan,
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 2398d4f45f28..bbbfdcde2727 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -189,7 +189,7 @@ static u8 parse_mpdudensity(u8 mpdudensity)
 
 static void ath_setup_rates(struct ath_softc *sc, enum ieee80211_band band)
 {
-        struct ath_rate_table *rate_table = NULL;
+        const struct ath_rate_table *rate_table = NULL;
         struct ieee80211_supported_band *sband;
         struct ieee80211_rate *rate;
         int i, maxrates;
@@ -2358,114 +2358,6 @@ skip_chan_change:
         if (changed & IEEE80211_CONF_CHANGE_POWER)
                 sc->config.txpowlimit = 2 * conf->power_level;
 
-        /*
-         * The HW TSF has to be reset when the beacon interval changes.
-         * We set the flag here, and ath_beacon_config_ap() would take this
-         * into account when it gets called through the subsequent
-         * config_interface() call - with IFCC_BEACON in the changed field.
-         */
-
-        if (changed & IEEE80211_CONF_CHANGE_BEACON_INTERVAL)
-                sc->sc_flags |= SC_OP_TSF_RESET;
-
-        mutex_unlock(&sc->mutex);
-
-        return 0;
-}
-
-static int ath9k_config_interface(struct ieee80211_hw *hw,
-                                  struct ieee80211_vif *vif,
-                                  struct ieee80211_if_conf *conf)
-{
-        struct ath_wiphy *aphy = hw->priv;
-        struct ath_softc *sc = aphy->sc;
-        struct ath_hw *ah = sc->sc_ah;
-        struct ath_vif *avp = (void *)vif->drv_priv;
-        u32 rfilt = 0;
-        int error, i;
-
-        mutex_lock(&sc->mutex);
-
-        /* TODO: Need to decide which hw opmode to use for multi-interface
-         * cases */
-        if (vif->type == NL80211_IFTYPE_AP &&
-            ah->opmode != NL80211_IFTYPE_AP) {
-                ah->opmode = NL80211_IFTYPE_STATION;
-                ath9k_hw_setopmode(ah);
-                memcpy(sc->curbssid, sc->sc_ah->macaddr, ETH_ALEN);
-                sc->curaid = 0;
-                ath9k_hw_write_associd(sc);
-                /* Request full reset to get hw opmode changed properly */
-                sc->sc_flags |= SC_OP_FULL_RESET;
-        }
-
-        if ((conf->changed & IEEE80211_IFCC_BSSID) &&
-            !is_zero_ether_addr(conf->bssid)) {
-                switch (vif->type) {
-                case NL80211_IFTYPE_STATION:
-                case NL80211_IFTYPE_ADHOC:
-                case NL80211_IFTYPE_MESH_POINT:
-                        /* Set BSSID */
-                        memcpy(sc->curbssid, conf->bssid, ETH_ALEN);
-                        memcpy(avp->bssid, conf->bssid, ETH_ALEN);
-                        sc->curaid = 0;
-                        ath9k_hw_write_associd(sc);
-
-                        /* Set aggregation protection mode parameters */
-                        sc->config.ath_aggr_prot = 0;
-
-                        DPRINTF(sc, ATH_DBG_CONFIG,
-                                "RX filter 0x%x bssid %pM aid 0x%x\n",
-                                rfilt, sc->curbssid, sc->curaid);
-
-                        /* need to reconfigure the beacon */
-                        sc->sc_flags &= ~SC_OP_BEACONS ;
-
-                        break;
-                default:
-                        break;
-                }
-        }
-
-        if ((vif->type == NL80211_IFTYPE_ADHOC) ||
-            (vif->type == NL80211_IFTYPE_AP) ||
-            (vif->type == NL80211_IFTYPE_MESH_POINT)) {
-                if ((conf->changed & IEEE80211_IFCC_BEACON) ||
-                    (conf->changed & IEEE80211_IFCC_BEACON_ENABLED &&
-                     conf->enable_beacon)) {
-                        /*
-                         * Allocate and setup the beacon frame.
-                         *
-                         * Stop any previous beacon DMA.  This may be
-                         * necessary, for example, when an ibss merge
-                         * causes reconfiguration; we may be called
-                         * with beacon transmission active.
-                         */
-                        ath9k_hw_stoptxdma(sc->sc_ah, sc->beacon.beaconq);
-
-                        error = ath_beacon_alloc(aphy, vif);
-                        if (error != 0) {
-                                mutex_unlock(&sc->mutex);
-                                return error;
-                        }
-
-                        ath_beacon_config(sc, vif);
-                }
-        }
-
-        /* Check for WLAN_CAPABILITY_PRIVACY ? */
-        if ((avp->av_opmode != NL80211_IFTYPE_STATION)) {
-                for (i = 0; i < IEEE80211_WEP_NKID; i++)
-                        if (ath9k_hw_keyisvalid(sc->sc_ah, (u16)i))
-                                ath9k_hw_keysetmac(sc->sc_ah,
-                                                   (u16)i,
-                                                   sc->curbssid);
-        }
-
-        /* Only legacy IBSS for now */
-        if (vif->type == NL80211_IFTYPE_ADHOC)
-                ath_update_chainmask(sc, 0);
-
         mutex_unlock(&sc->mutex);
 
         return 0;
@@ -2607,9 +2499,92 @@ static void ath9k_bss_info_changed(struct ieee80211_hw *hw,
 {
         struct ath_wiphy *aphy = hw->priv;
         struct ath_softc *sc = aphy->sc;
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_vif *avp = (void *)vif->drv_priv;
+        u32 rfilt = 0;
+        int error, i;
 
         mutex_lock(&sc->mutex);
 
+        /*
+         * TODO: Need to decide which hw opmode to use for
+         *       multi-interface cases
+         * XXX: This belongs into add_interface!
+         */
+        if (vif->type == NL80211_IFTYPE_AP &&
+            ah->opmode != NL80211_IFTYPE_AP) {
+                ah->opmode = NL80211_IFTYPE_STATION;
+                ath9k_hw_setopmode(ah);
+                memcpy(sc->curbssid, sc->sc_ah->macaddr, ETH_ALEN);
+                sc->curaid = 0;
+                ath9k_hw_write_associd(sc);
+                /* Request full reset to get hw opmode changed properly */
+                sc->sc_flags |= SC_OP_FULL_RESET;
+        }
+
+        if ((changed & BSS_CHANGED_BSSID) &&
+            !is_zero_ether_addr(bss_conf->bssid)) {
+                switch (vif->type) {
+                case NL80211_IFTYPE_STATION:
+                case NL80211_IFTYPE_ADHOC:
+                case NL80211_IFTYPE_MESH_POINT:
+                        /* Set BSSID */
+                        memcpy(sc->curbssid, bss_conf->bssid, ETH_ALEN);
+                        memcpy(avp->bssid, bss_conf->bssid, ETH_ALEN);
+                        sc->curaid = 0;
+                        ath9k_hw_write_associd(sc);
+
+                        /* Set aggregation protection mode parameters */
+                        sc->config.ath_aggr_prot = 0;
+
+                        DPRINTF(sc, ATH_DBG_CONFIG,
+                                "RX filter 0x%x bssid %pM aid 0x%x\n",
+                                rfilt, sc->curbssid, sc->curaid);
+
+                        /* need to reconfigure the beacon */
+                        sc->sc_flags &= ~SC_OP_BEACONS ;
+
+                        break;
+                default:
+                        break;
+                }
+        }
+
+        if ((vif->type == NL80211_IFTYPE_ADHOC) ||
+            (vif->type == NL80211_IFTYPE_AP) ||
+            (vif->type == NL80211_IFTYPE_MESH_POINT)) {
+                if ((changed & BSS_CHANGED_BEACON) ||
+                    (changed & BSS_CHANGED_BEACON_ENABLED &&
+                     bss_conf->enable_beacon)) {
+                        /*
+                         * Allocate and setup the beacon frame.
+                         *
+                         * Stop any previous beacon DMA.  This may be
+                         * necessary, for example, when an ibss merge
+                         * causes reconfiguration; we may be called
+                         * with beacon transmission active.
+                         */
+                        ath9k_hw_stoptxdma(sc->sc_ah, sc->beacon.beaconq);
+
+                        error = ath_beacon_alloc(aphy, vif);
+                        if (!error)
+                                ath_beacon_config(sc, vif);
+                }
+        }
+
+        /* Check for WLAN_CAPABILITY_PRIVACY ? */
+        if ((avp->av_opmode != NL80211_IFTYPE_STATION)) {
+                for (i = 0; i < IEEE80211_WEP_NKID; i++)
+                        if (ath9k_hw_keyisvalid(sc->sc_ah, (u16)i))
+                                ath9k_hw_keysetmac(sc->sc_ah,
+                                                   (u16)i,
+                                                   sc->curbssid);
+        }
+
+        /* Only legacy IBSS for now */
+        if (vif->type == NL80211_IFTYPE_ADHOC)
+                ath_update_chainmask(sc, 0);
+
         if (changed & BSS_CHANGED_ERP_PREAMBLE) {
                 DPRINTF(sc, ATH_DBG_CONFIG, "BSS Changed PREAMBLE %d\n",
                         bss_conf->use_short_preamble);
@@ -2635,6 +2610,18 @@ static void ath9k_bss_info_changed(struct ieee80211_hw *hw,
                 ath9k_bss_assoc_info(sc, vif, bss_conf);
         }
 
+        /*
+         * The HW TSF has to be reset when the beacon interval changes.
+         * We set the flag here, and ath_beacon_config_ap() would take this
+         * into account when it gets called through the subsequent
+         * config_interface() call - with IFCC_BEACON in the changed field.
+         */
+
+        if (changed & BSS_CHANGED_BEACON_INT) {
+                sc->sc_flags |= SC_OP_TSF_RESET;
+                sc->beacon_interval = bss_conf->beacon_int;
+        }
+
         mutex_unlock(&sc->mutex);
 }
 
@@ -2755,7 +2742,6 @@ struct ieee80211_ops ath9k_ops = {
         .add_interface      = ath9k_add_interface,
         .remove_interface   = ath9k_remove_interface,
         .config             = ath9k_config,
-        .config_interface   = ath9k_config_interface,
         .configure_filter   = ath9k_configure_filter,
         .sta_notify         = ath9k_sta_notify,
         .conf_tx            = ath9k_conf_tx,
diff --git a/drivers/net/wireless/ath/ath9k/rc.c b/drivers/net/wireless/ath/ath9k/rc.c
index 8f3cf10f65c4..ba06e78b2f50 100644
--- a/drivers/net/wireless/ath/ath9k/rc.c
+++ b/drivers/net/wireless/ath/ath9k/rc.c
@@ -17,7 +17,7 @@
 
 #include "ath9k.h"
 
-static struct ath_rate_table ar5416_11na_ratetable = {
+static const struct ath_rate_table ar5416_11na_ratetable = {
         42,
         {
                 { VALID, VALID, WLAN_RC_PHY_OFDM, 6000, /* 6 Mb */
@@ -155,7 +155,7 @@ static struct ath_rate_table ar5416_11na_ratetable = {
 /* 4ms frame limit not used for NG mode.  The values filled
  * for HT are the 64K max aggregate limit */
 
-static struct ath_rate_table ar5416_11ng_ratetable = {
+static const struct ath_rate_table ar5416_11ng_ratetable = {
         46,
         {
                 { VALID_ALL, VALID_ALL, WLAN_RC_PHY_CCK, 1000, /* 1 Mb */
@@ -302,7 +302,7 @@ static struct ath_rate_table ar5416_11ng_ratetable = {
         WLAN_RC_HT_FLAG,  /* Phy rates allowed initially */
 };
 
-static struct ath_rate_table ar5416_11a_ratetable = {
+static const struct ath_rate_table ar5416_11a_ratetable = {
         8,
         {
                 { VALID, VALID, WLAN_RC_PHY_OFDM, 6000, /* 6 Mb */
@@ -335,7 +335,7 @@ static struct ath_rate_table ar5416_11a_ratetable = {
         0,   /* Phy rates allowed initially */
 };
 
-static struct ath_rate_table ar5416_11g_ratetable = {
+static const struct ath_rate_table ar5416_11g_ratetable = {
         12,
         {
                 { VALID, VALID, WLAN_RC_PHY_CCK, 1000, /* 1 Mb */
@@ -380,7 +380,7 @@ static struct ath_rate_table ar5416_11g_ratetable = {
         0,   /* Phy rates allowed initially */
 };
 
-static struct ath_rate_table ar5416_11b_ratetable = {
+static const struct ath_rate_table ar5416_11b_ratetable = {
         4,
         {
                 { VALID, VALID, WLAN_RC_PHY_CCK, 1000, /* 1 Mb */
@@ -420,7 +420,7 @@ static inline int8_t median(int8_t a, int8_t b, int8_t c)
         }
 }
 
-static void ath_rc_sort_validrates(struct ath_rate_table *rate_table,
+static void ath_rc_sort_validrates(const struct ath_rate_table *rate_table,
                                    struct ath_rate_priv *ath_rc_priv)
 {
         u8 i, j, idx, idx_next;
@@ -461,10 +461,11 @@ static inline int ath_rc_isvalid_txmask(struct ath_rate_priv *ath_rc_priv,
         return ath_rc_priv->valid_rate_index[index];
 }
 
-static inline int ath_rc_get_nextvalid_txrate(struct ath_rate_table *rate_table,
-                                              struct ath_rate_priv *ath_rc_priv,
-                                              u8 cur_valid_txrate,
-                                              u8 *next_idx)
+static inline
+int ath_rc_get_nextvalid_txrate(const struct ath_rate_table *rate_table,
+                                struct ath_rate_priv *ath_rc_priv,
+                                u8 cur_valid_txrate,
+                                u8 *next_idx)
 {
         u8 i;
 
@@ -500,7 +501,7 @@ static int ath_rc_valid_phyrate(u32 phy, u32 capflag, int ignore_cw)
 }
 
 static inline int
-ath_rc_get_nextlowervalid_txrate(struct ath_rate_table *rate_table,
+ath_rc_get_nextlowervalid_txrate(const struct ath_rate_table *rate_table,
                                  struct ath_rate_priv *ath_rc_priv,
                                  u8 cur_valid_txrate, u8 *next_idx)
 {
@@ -517,7 +518,7 @@ ath_rc_get_nextlowervalid_txrate(struct ath_rate_table *rate_table,
 }
 
 static u8 ath_rc_init_validrates(struct ath_rate_priv *ath_rc_priv,
-                                 struct ath_rate_table *rate_table,
+                                 const struct ath_rate_table *rate_table,
                                  u32 capflag)
 {
         u8 i, hi = 0;
@@ -547,7 +548,7 @@ static u8 ath_rc_init_validrates(struct ath_rate_priv *ath_rc_priv,
 }
 
 static u8 ath_rc_setvalid_rates(struct ath_rate_priv *ath_rc_priv,
-                                struct ath_rate_table *rate_table,
+                                const struct ath_rate_table *rate_table,
                                 struct ath_rateset *rateset,
                                 u32 capflag)
 {
@@ -592,7 +593,7 @@ static u8 ath_rc_setvalid_rates(struct ath_rate_priv *ath_rc_priv,
 }
 
 static u8 ath_rc_setvalid_htrates(struct ath_rate_priv *ath_rc_priv,
-                                  struct ath_rate_table *rate_table,
+                                  const struct ath_rate_table *rate_table,
                                   u8 *mcs_set, u32 capflag)
 {
         struct ath_rateset *rateset = (struct ath_rateset *)mcs_set;
@@ -630,7 +631,7 @@ static u8 ath_rc_setvalid_htrates(struct ath_rate_priv *ath_rc_priv,
 
 static u8 ath_rc_ratefind_ht(struct ath_softc *sc,
                              struct ath_rate_priv *ath_rc_priv,
-                             struct ath_rate_table *rate_table,
+                             const struct ath_rate_table *rate_table,
                              int *is_probing)
 {
         u32 dt, best_thruput, this_thruput, now_msec;
@@ -748,7 +749,7 @@ static u8 ath_rc_ratefind_ht(struct ath_softc *sc,
         return rate;
 }
 
-static void ath_rc_rate_set_series(struct ath_rate_table *rate_table,
+static void ath_rc_rate_set_series(const struct ath_rate_table *rate_table,
                                    struct ieee80211_tx_rate *rate,
                                    struct ieee80211_tx_rate_control *txrc,
                                    u8 tries, u8 rix, int rtsctsenable)
@@ -769,7 +770,7 @@ static void ath_rc_rate_set_series(struct ath_rate_table *rate_table,
 }
 
 static void ath_rc_rate_set_rtscts(struct ath_softc *sc,
-                                   struct ath_rate_table *rate_table,
+                                   const struct ath_rate_table *rate_table,
                                    struct ieee80211_tx_info *tx_info)
 {
         struct ieee80211_tx_rate *rates = tx_info->control.rates;
@@ -807,7 +808,7 @@ static void ath_rc_rate_set_rtscts(struct ath_softc *sc,
 
 static u8 ath_rc_rate_getidx(struct ath_softc *sc,
                              struct ath_rate_priv *ath_rc_priv,
-                             struct ath_rate_table *rate_table,
+                             const struct ath_rate_table *rate_table,
                              u8 rix, u16 stepdown,
                              u16 min_rate)
 {
@@ -838,7 +839,7 @@ static void ath_rc_ratefind(struct ath_softc *sc,
                             struct ath_rate_priv *ath_rc_priv,
                             struct ieee80211_tx_rate_control *txrc)
 {
-        struct ath_rate_table *rate_table;
+        const struct ath_rate_table *rate_table;
         struct sk_buff *skb = txrc->skb;
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
         struct ieee80211_tx_rate *rates = tx_info->control.rates;
@@ -937,7 +938,7 @@ static void ath_rc_ratefind(struct ath_softc *sc,
 }
 
 static bool ath_rc_update_per(struct ath_softc *sc,
-                              struct ath_rate_table *rate_table,
+                              const struct ath_rate_table *rate_table,
                               struct ath_rate_priv *ath_rc_priv,
                               struct ath_tx_info_priv *tx_info_priv,
                               int tx_rate, int xretries, int retries,
@@ -1142,7 +1143,7 @@ static void ath_rc_update_ht(struct ath_softc *sc,
         int rate;
         u8 last_per;
         bool state_change = false;
-        struct ath_rate_table *rate_table = sc->cur_rate_table;
+        const struct ath_rate_table *rate_table = sc->cur_rate_table;
         int size = ath_rc_priv->rate_table_size;
 
         if ((tx_rate < 0) || (tx_rate > rate_table->rate_cnt))
@@ -1276,7 +1277,7 @@ static void ath_rc_update_ht(struct ath_softc *sc,
 #undef CHK_RSSI
 }
 
-static int ath_rc_get_rateindex(struct ath_rate_table *rate_table,
+static int ath_rc_get_rateindex(const struct ath_rate_table *rate_table,
                                 struct ieee80211_tx_rate *rate)
 {
         int rix;
@@ -1300,7 +1301,7 @@ static void ath_rc_tx_status(struct ath_softc *sc,
                              int final_ts_idx, int xretries, int long_retry)
 {
         struct ath_tx_info_priv *tx_info_priv = ATH_TX_INFO_PRIV(tx_info);
-        struct ath_rate_table *rate_table;
+        const struct ath_rate_table *rate_table;
         struct ieee80211_tx_rate *rates = tx_info->status.rates;
         u8 flags;
         u32 i = 0, rix;
@@ -1354,9 +1355,11 @@ static void ath_rc_tx_status(struct ath_softc *sc,
                          xretries, long_retry);
 }
 
-static struct ath_rate_table *ath_choose_rate_table(struct ath_softc *sc,
-                                                    enum ieee80211_band band,
-                                                    bool is_ht, bool is_cw_40)
+static const
+struct ath_rate_table *ath_choose_rate_table(struct ath_softc *sc,
+                                             enum ieee80211_band band,
+                                             bool is_ht,
+                                             bool is_cw_40)
 {
         int mode = 0;
 
@@ -1390,7 +1393,7 @@ static void ath_rc_init(struct ath_softc *sc,
                         struct ath_rate_priv *ath_rc_priv,
                         struct ieee80211_supported_band *sband,
                         struct ieee80211_sta *sta,
-                        struct ath_rate_table *rate_table)
+                        const struct ath_rate_table *rate_table)
 {
         struct ath_rateset *rateset = &ath_rc_priv->neg_rates;
         u8 *ht_mcs = (u8 *)&ath_rc_priv->neg_ht_rates;
@@ -1568,12 +1571,13 @@ static void ath_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
         struct ath_rate_priv *ath_rc_priv = priv_sta;
         __le16 fc = hdr->frame_control;
 
-        /* lowest rate for management and multicast/broadcast frames */
-        if (!ieee80211_is_data(fc) || is_multicast_ether_addr(hdr->addr1) ||
-            !sta) {
+        /* lowest rate for management and NO_ACK frames */
+        if (!ieee80211_is_data(fc) ||
+            tx_info->flags & IEEE80211_TX_CTL_NO_ACK || !sta) {
                 tx_info->control.rates[0].idx = rate_lowest_index(sband, sta);
                 tx_info->control.rates[0].count =
-                        is_multicast_ether_addr(hdr->addr1) ? 1 : ATH_MGT_TXMAXTRY;
+                        (tx_info->flags & IEEE80211_TX_CTL_NO_ACK) ?
+                                1 : ATH_MGT_TXMAXTRY;
                 return;
         }
 
@@ -1586,7 +1590,7 @@ static void ath_rate_init(void *priv, struct ieee80211_supported_band *sband,
 {
         struct ath_softc *sc = priv;
         struct ath_rate_priv *ath_rc_priv = priv_sta;
-        struct ath_rate_table *rate_table = NULL;
+        const struct ath_rate_table *rate_table = NULL;
         bool is_cw40, is_sgi40;
         int i, j = 0;
 
@@ -1635,7 +1639,7 @@ static void ath_rate_update(void *priv, struct ieee80211_supported_band *sband,
 {
         struct ath_softc *sc = priv;
         struct ath_rate_priv *ath_rc_priv = priv_sta;
-        struct ath_rate_table *rate_table = NULL;
+        const struct ath_rate_table *rate_table = NULL;
         bool oper_cw40 = false, oper_sgi40;
         bool local_cw40 = (ath_rc_priv->ht_cap & WLAN_RC_40_FLAG) ?
                 true : false;
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index faf2cab49ea3..41c42824a5ca 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -434,7 +434,7 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
 static u32 ath_lookup_rate(struct ath_softc *sc, struct ath_buf *bf,
                            struct ath_atx_tid *tid)
 {
-        struct ath_rate_table *rate_table = sc->cur_rate_table;
+        const struct ath_rate_table *rate_table = sc->cur_rate_table;
         struct sk_buff *skb;
         struct ieee80211_tx_info *tx_info;
         struct ieee80211_tx_rate *rates;
@@ -497,7 +497,7 @@ static u32 ath_lookup_rate(struct ath_softc *sc, struct ath_buf *bf,
 static int ath_compute_num_delims(struct ath_softc *sc, struct ath_atx_tid *tid,
                                   struct ath_buf *bf, u16 frmlen)
 {
-        struct ath_rate_table *rt = sc->cur_rate_table;
+        const struct ath_rate_table *rt = sc->cur_rate_table;
         struct sk_buff *skb = bf->bf_mpdu;
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
         u32 nsymbits, nsymbols, mpdudensity;
@@ -971,7 +971,7 @@ int ath_cabq_update(struct ath_softc *sc)
         else if (sc->config.cabqReadytime > ATH9K_READY_TIME_HI_BOUND)
                 sc->config.cabqReadytime = ATH9K_READY_TIME_HI_BOUND;
 
-        qi.tqi_readyTime = (sc->hw->conf.beacon_int *
+        qi.tqi_readyTime = (sc->beacon_interval *
                             sc->config.cabqReadytime) / 100;
         ath_txq_update(sc, qnum, &qi);
 
@@ -1407,7 +1407,7 @@ static int setup_tx_flags(struct ath_softc *sc, struct sk_buff *skb,
 static u32 ath_pkt_duration(struct ath_softc *sc, u8 rix, struct ath_buf *bf,
                             int width, int half_gi, bool shortPreamble)
 {
-        struct ath_rate_table *rate_table = sc->cur_rate_table;
+        const struct ath_rate_table *rate_table = sc->cur_rate_table;
         u32 nbits, nsymbits, duration, nsymbols;
         u8 rc;
         int streams, pktlen;
@@ -1439,7 +1439,7 @@ static u32 ath_pkt_duration(struct ath_softc *sc, u8 rix, struct ath_buf *bf,
 
 static void ath_buf_set_rate(struct ath_softc *sc, struct ath_buf *bf)
 {
-        struct ath_rate_table *rt = sc->cur_rate_table;
+        const struct ath_rate_table *rt = sc->cur_rate_table;
         struct ath9k_11n_rate_series series[4];
         struct sk_buff *skb;
         struct ieee80211_tx_info *tx_info;
diff --git a/drivers/net/wireless/atmel_cs.c b/drivers/net/wireless/atmel_cs.c
index 77406245dc7b..ddaa859c3491 100644
--- a/drivers/net/wireless/atmel_cs.c
+++ b/drivers/net/wireless/atmel_cs.c
@@ -279,7 +279,7 @@ static int atmel_config(struct pcmcia_device *link)
         struct pcmcia_device_id *did;
 
         dev = link->priv;
-        did = handle_to_dev(link).driver_data;
+        did = dev_get_drvdata(&handle_to_dev(link));
 
         DEBUG(0, "atmel_config(0x%p)\n", link);
 
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index a97c6ff0f12e..2615aaf7df6a 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -3468,11 +3468,6 @@ static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
         if (phy->ops->set_rx_antenna)
                 phy->ops->set_rx_antenna(dev, antenna);
 
-        /* Update templates for AP/mesh mode. */
-        if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
-            b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
-                b43_set_beacon_int(dev, conf->beacon_int);
-
         if (!!conf->radio_enabled != phy->radio_on) {
                 if (conf->radio_enabled) {
                         b43_software_rfkill(dev, RFKILL_STATE_UNBLOCKED);
@@ -3548,14 +3543,47 @@ static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
 {
         struct b43_wl *wl = hw_to_b43_wl(hw);
         struct b43_wldev *dev;
+        unsigned long flags;
 
         mutex_lock(&wl->mutex);
 
         dev = wl->current_dev;
         if (!dev || b43_status(dev) < B43_STAT_STARTED)
                 goto out_unlock_mutex;
+
+        B43_WARN_ON(wl->vif != vif);
+
+        if (changed & BSS_CHANGED_BSSID) {
+                spin_lock_irqsave(&wl->irq_lock, flags);
+                if (conf->bssid)
+                        memcpy(wl->bssid, conf->bssid, ETH_ALEN);
+                else
+                        memset(wl->bssid, 0, ETH_ALEN);
+
+                if (b43_status(dev) >= B43_STAT_INITIALIZED) {
+                        if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
+                            b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT)) {
+                                B43_WARN_ON(vif->type != wl->if_type);
+                                if (changed & BSS_CHANGED_BEACON)
+                                        b43_update_templates(wl);
+                        } else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC)) {
+                                if (changed & BSS_CHANGED_BEACON)
+                                        b43_update_templates(wl);
+                        }
+                        b43_write_mac_bssid_templates(dev);
+                }
+                spin_unlock_irqrestore(&wl->irq_lock, flags);
+        }
+
         b43_mac_suspend(dev);
 
+        /* Update templates for AP/mesh mode. */
+        if (changed & BSS_CHANGED_BEACON_INT &&
+            (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
+             b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
+             b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
+                b43_set_beacon_int(dev, conf->beacon_int);
+
         if (changed & BSS_CHANGED_BASIC_RATES)
                 b43_update_basic_rates(dev, conf->basic_rates);
 
@@ -3569,8 +3597,6 @@ static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
         b43_mac_enable(dev);
 out_unlock_mutex:
         mutex_unlock(&wl->mutex);
-
-        return;
 }
 
 static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
@@ -3728,41 +3754,6 @@ static void b43_op_configure_filter(struct ieee80211_hw *hw,
         spin_unlock_irqrestore(&wl->irq_lock, flags);
 }
 
-static int b43_op_config_interface(struct ieee80211_hw *hw,
-                                   struct ieee80211_vif *vif,
-                                   struct ieee80211_if_conf *conf)
-{
-        struct b43_wl *wl = hw_to_b43_wl(hw);
-        struct b43_wldev *dev = wl->current_dev;
-        unsigned long flags;
-
-        if (!dev)
-                return -ENODEV;
-        mutex_lock(&wl->mutex);
-        spin_lock_irqsave(&wl->irq_lock, flags);
-        B43_WARN_ON(wl->vif != vif);
-        if (conf->bssid)
-                memcpy(wl->bssid, conf->bssid, ETH_ALEN);
-        else
-                memset(wl->bssid, 0, ETH_ALEN);
-        if (b43_status(dev) >= B43_STAT_INITIALIZED) {
-                if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
-                    b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT)) {
-                        B43_WARN_ON(vif->type != wl->if_type);
-                        if (conf->changed & IEEE80211_IFCC_BEACON)
-                                b43_update_templates(wl);
-                } else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC)) {
-                        if (conf->changed & IEEE80211_IFCC_BEACON)
-                                b43_update_templates(wl);
-                }
-                b43_write_mac_bssid_templates(dev);
-        }
-        spin_unlock_irqrestore(&wl->irq_lock, flags);
-        mutex_unlock(&wl->mutex);
-
-        return 0;
-}
-
 /* Locking: wl->mutex */
 static void b43_wireless_core_stop(struct b43_wldev *dev)
 {
@@ -4432,7 +4423,6 @@ static const struct ieee80211_ops b43_hw_ops = {
         .remove_interface       = b43_op_remove_interface,
         .config                 = b43_op_config,
         .bss_info_changed       = b43_op_bss_info_changed,
-        .config_interface       = b43_op_config_interface,
         .configure_filter       = b43_op_configure_filter,
         .set_key                = b43_op_set_key,
         .get_stats              = b43_op_get_stats,
diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
index ee202b4f77b5..07c7898c87ac 100644
--- a/drivers/net/wireless/b43legacy/main.c
+++ b/drivers/net/wireless/b43legacy/main.c
@@ -2721,11 +2721,6 @@ static int b43legacy_op_dev_config(struct ieee80211_hw *hw,
         /* Antennas for RX and management frame TX. */
         b43legacy_mgmtframe_txantenna(dev, antenna_tx);
 
-        /* Update templates for AP mode. */
-        if (b43legacy_is_mode(wl, NL80211_IFTYPE_AP))
-                b43legacy_set_beacon_int(dev, conf->beacon_int);
-
-
         if (!!conf->radio_enabled != phy->radio_on) {
                 if (conf->radio_enabled) {
                         b43legacy_radio_turn_on(dev);
@@ -2809,6 +2804,7 @@ static void b43legacy_op_bss_info_changed(struct ieee80211_hw *hw,
         u32 savedirqs;
 
         mutex_lock(&wl->mutex);
+        B43legacy_WARN_ON(wl->vif != vif);
 
         dev = wl->current_dev;
         phy = &dev->phy;
@@ -2822,11 +2818,37 @@ static void b43legacy_op_bss_info_changed(struct ieee80211_hw *hw,
                 goto out_unlock_mutex;
         }
         savedirqs = b43legacy_interrupt_disable(dev, B43legacy_IRQ_ALL);
-        spin_unlock_irqrestore(&wl->irq_lock, flags);
-        b43legacy_synchronize_irq(dev);
+
+        if (changed & BSS_CHANGED_BSSID) {
+                spin_unlock_irqrestore(&wl->irq_lock, flags);
+                b43legacy_synchronize_irq(dev);
+
+                if (conf->bssid)
+                        memcpy(wl->bssid, conf->bssid, ETH_ALEN);
+                else
+                        memset(wl->bssid, 0, ETH_ALEN);
+
+                if (b43legacy_status(dev) >= B43legacy_STAT_INITIALIZED) {
+                        if (b43legacy_is_mode(wl, NL80211_IFTYPE_AP)) {
+                                B43legacy_WARN_ON(vif->type != NL80211_IFTYPE_AP);
+                                if (changed & BSS_CHANGED_BEACON)
+                                        b43legacy_update_templates(wl);
+                        } else if (b43legacy_is_mode(wl, NL80211_IFTYPE_ADHOC)) {
+                                if (changed & BSS_CHANGED_BEACON)
+                                        b43legacy_update_templates(wl);
+                        }
+                        b43legacy_write_mac_bssid_templates(dev);
+                }
+                spin_unlock_irqrestore(&wl->irq_lock, flags);
+        }
 
         b43legacy_mac_suspend(dev);
 
+        if (changed & BSS_CHANGED_BEACON_INT &&
+            (b43legacy_is_mode(wl, NL80211_IFTYPE_AP) ||
+             b43legacy_is_mode(wl, NL80211_IFTYPE_ADHOC)))
+                b43legacy_set_beacon_int(dev, conf->beacon_int);
+
         if (changed & BSS_CHANGED_BASIC_RATES)
                 b43legacy_update_basic_rates(dev, conf->basic_rates);
 
@@ -2846,8 +2868,6 @@ static void b43legacy_op_bss_info_changed(struct ieee80211_hw *hw,
         spin_unlock_irqrestore(&wl->irq_lock, flags);
  out_unlock_mutex:
         mutex_unlock(&wl->mutex);
-
-        return;
 }
 
 static void b43legacy_op_configure_filter(struct ieee80211_hw *hw,
@@ -2889,40 +2909,6 @@ static void b43legacy_op_configure_filter(struct ieee80211_hw *hw,
         spin_unlock_irqrestore(&wl->irq_lock, flags);
 }
 
-static int b43legacy_op_config_interface(struct ieee80211_hw *hw,
-                                         struct ieee80211_vif *vif,
-                                         struct ieee80211_if_conf *conf)
-{
-        struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
-        struct b43legacy_wldev *dev = wl->current_dev;
-        unsigned long flags;
-
-        if (!dev)
-                return -ENODEV;
-        mutex_lock(&wl->mutex);
-        spin_lock_irqsave(&wl->irq_lock, flags);
-        B43legacy_WARN_ON(wl->vif != vif);
-        if (conf->bssid)
-                memcpy(wl->bssid, conf->bssid, ETH_ALEN);
-        else
-                memset(wl->bssid, 0, ETH_ALEN);
-        if (b43legacy_status(dev) >= B43legacy_STAT_INITIALIZED) {
-                if (b43legacy_is_mode(wl, NL80211_IFTYPE_AP)) {
-                        B43legacy_WARN_ON(vif->type != NL80211_IFTYPE_AP);
-                        if (conf->changed & IEEE80211_IFCC_BEACON)
-                                b43legacy_update_templates(wl);
-                } else if (b43legacy_is_mode(wl, NL80211_IFTYPE_ADHOC)) {
-                        if (conf->changed & IEEE80211_IFCC_BEACON)
-                                b43legacy_update_templates(wl);
-                }
-                b43legacy_write_mac_bssid_templates(dev);
-        }
-        spin_unlock_irqrestore(&wl->irq_lock, flags);
-        mutex_unlock(&wl->mutex);
-
-        return 0;
-}
-
 /* Locking: wl->mutex */
 static void b43legacy_wireless_core_stop(struct b43legacy_wldev *dev)
 {
@@ -3563,7 +3549,6 @@ static const struct ieee80211_ops b43legacy_hw_ops = {
         .remove_interface       = b43legacy_op_remove_interface,
         .config                 = b43legacy_op_dev_config,
         .bss_info_changed       = b43legacy_op_bss_info_changed,
-        .config_interface       = b43legacy_op_config_interface,
         .configure_filter       = b43legacy_op_configure_filter,
         .get_stats              = b43legacy_op_get_stats,
         .get_tx_stats           = b43legacy_op_get_tx_stats,
diff --git a/drivers/net/wireless/ipw2x00/ipw2100.c b/drivers/net/wireless/ipw2x00/ipw2100.c
index 97e5647ff050..742432388ca3 100644
--- a/drivers/net/wireless/ipw2x00/ipw2100.c
+++ b/drivers/net/wireless/ipw2x00/ipw2100.c
@@ -3488,7 +3488,7 @@ static DEVICE_ATTR(pci, S_IRUGO, show_pci, NULL);
 static ssize_t show_cfg(struct device *d, struct device_attribute *attr,
                         char *buf)
 {
-        struct ipw2100_priv *p = d->driver_data;
+        struct ipw2100_priv *p = dev_get_drvdata(d);
         return sprintf(buf, "0x%08x\n", (int)p->config);
 }
 
@@ -3497,7 +3497,7 @@ static DEVICE_ATTR(cfg, S_IRUGO, show_cfg, NULL);
 static ssize_t show_status(struct device *d, struct device_attribute *attr,
                            char *buf)
 {
-        struct ipw2100_priv *p = d->driver_data;
+        struct ipw2100_priv *p = dev_get_drvdata(d);
         return sprintf(buf, "0x%08x\n", (int)p->status);
 }
 
@@ -3506,7 +3506,7 @@ static DEVICE_ATTR(status, S_IRUGO, show_status, NULL);
 static ssize_t show_capability(struct device *d, struct device_attribute *attr,
                                char *buf)
 {
-        struct ipw2100_priv *p = d->driver_data;
+        struct ipw2100_priv *p = dev_get_drvdata(d);
         return sprintf(buf, "0x%08x\n", (int)p->capability);
 }
 
@@ -4224,7 +4224,7 @@ static ssize_t show_rf_kill(struct device *d, struct device_attribute *attr,
            1 - SW based RF kill active (sysfs)
            2 - HW based RF kill active
            3 - Both HW and SW baed RF kill active */
-        struct ipw2100_priv *priv = (struct ipw2100_priv *)d->driver_data;
+        struct ipw2100_priv *priv = dev_get_drvdata(d);
         int val = ((priv->status & STATUS_RF_KILL_SW) ? 0x1 : 0x0) |
             (rf_kill_active(priv) ? 0x2 : 0x0);
         return sprintf(buf, "%i\n", val);
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index 9a123fbcc359..c3b3dfe43d1a 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -1527,7 +1527,7 @@ static DEVICE_ATTR(led, S_IWUSR | S_IRUGO, show_led, store_led);
 static ssize_t show_status(struct device *d,
                            struct device_attribute *attr, char *buf)
 {
-        struct ipw_priv *p = d->driver_data;
+        struct ipw_priv *p = dev_get_drvdata(d);
         return sprintf(buf, "0x%08x\n", (int)p->status);
 }
 
@@ -1536,7 +1536,7 @@ static DEVICE_ATTR(status, S_IRUGO, show_status, NULL);
 static ssize_t show_cfg(struct device *d, struct device_attribute *attr,
                         char *buf)
 {
-        struct ipw_priv *p = d->driver_data;
+        struct ipw_priv *p = dev_get_drvdata(d);
         return sprintf(buf, "0x%08x\n", (int)p->config);
 }
 
@@ -1545,7 +1545,7 @@ static DEVICE_ATTR(cfg, S_IRUGO, show_cfg, NULL);
 static ssize_t show_nic_type(struct device *d,
                              struct device_attribute *attr, char *buf)
 {
-        struct ipw_priv *priv = d->driver_data;
+        struct ipw_priv *priv = dev_get_drvdata(d);
         return sprintf(buf, "TYPE: %d\n", priv->nic_type);
 }
 
@@ -1555,7 +1555,7 @@ static ssize_t show_ucode_version(struct device *d,
                                   struct device_attribute *attr, char *buf)
 {
         u32 len = sizeof(u32), tmp = 0;
-        struct ipw_priv *p = d->driver_data;
+        struct ipw_priv *p = dev_get_drvdata(d);
 
         if (ipw_get_ordinal(p, IPW_ORD_STAT_UCODE_VERSION, &tmp, &len))
                 return 0;
@@ -1569,7 +1569,7 @@ static ssize_t show_rtc(struct device *d, struct device_attribute *attr,
                         char *buf)
 {
         u32 len = sizeof(u32), tmp = 0;
-        struct ipw_priv *p = d->driver_data;
+        struct ipw_priv *p = dev_get_drvdata(d);
 
         if (ipw_get_ordinal(p, IPW_ORD_STAT_RTC, &tmp, &len))
                 return 0;
@@ -1586,14 +1586,15 @@ static DEVICE_ATTR(rtc, S_IWUSR | S_IRUGO, show_rtc, NULL);
 static ssize_t show_eeprom_delay(struct device *d,
                                  struct device_attribute *attr, char *buf)
 {
-        int n = ((struct ipw_priv *)d->driver_data)->eeprom_delay;
+        struct ipw_priv *p = dev_get_drvdata(d);
+        int n = p->eeprom_delay;
         return sprintf(buf, "%i\n", n);
 }
 static ssize_t store_eeprom_delay(struct device *d,
                                   struct device_attribute *attr,
                                   const char *buf, size_t count)
 {
-        struct ipw_priv *p = d->driver_data;
+        struct ipw_priv *p = dev_get_drvdata(d);
         sscanf(buf, "%i", &p->eeprom_delay);
         return strnlen(buf, count);
 }
@@ -1605,7 +1606,7 @@ static ssize_t show_command_event_reg(struct device *d,
                                       struct device_attribute *attr, char *buf)
 {
         u32 reg = 0;
-        struct ipw_priv *p = d->driver_data;
+        struct ipw_priv *p = dev_get_drvdata(d);
 
         reg = ipw_read_reg32(p, IPW_INTERNAL_CMD_EVENT);
         return sprintf(buf, "0x%08x\n", reg);
@@ -1615,7 +1616,7 @@ static ssize_t store_command_event_reg(struct device *d,
                                        const char *buf, size_t count)
 {
         u32 reg;
-        struct ipw_priv *p = d->driver_data;
+        struct ipw_priv *p = dev_get_drvdata(d);
 
         sscanf(buf, "%x", &reg);
         ipw_write_reg32(p, IPW_INTERNAL_CMD_EVENT, reg);
@@ -1629,7 +1630,7 @@ static ssize_t show_mem_gpio_reg(struct device *d,
                                  struct device_attribute *attr, char *buf)
 {
         u32 reg = 0;
-        struct ipw_priv *p = d->driver_data;
+        struct ipw_priv *p = dev_get_drvdata(d);
 
         reg = ipw_read_reg32(p, 0x301100);
         return sprintf(buf, "0x%08x\n", reg);
@@ -1639,7 +1640,7 @@ static ssize_t store_mem_gpio_reg(struct device *d,
                                   const char *buf, size_t count)
 {
         u32 reg;
-        struct ipw_priv *p = d->driver_data;
+        struct ipw_priv *p = dev_get_drvdata(d);
 
         sscanf(buf, "%x", &reg);
         ipw_write_reg32(p, 0x301100, reg);
@@ -1653,7 +1654,7 @@ static ssize_t show_indirect_dword(struct device *d,
                                    struct device_attribute *attr, char *buf)
 {
         u32 reg = 0;
-        struct ipw_priv *priv = d->driver_data;
+        struct ipw_priv *priv = dev_get_drvdata(d);
 
         if (priv->status & STATUS_INDIRECT_DWORD)
                 reg = ipw_read_reg32(priv, priv->indirect_dword);
@@ -1666,7 +1667,7 @@ static ssize_t store_indirect_dword(struct device *d,
                                     struct device_attribute *attr,
                                     const char *buf, size_t count)
 {
-        struct ipw_priv *priv = d->driver_data;
+        struct ipw_priv *priv = dev_get_drvdata(d);
 
         sscanf(buf, "%x", &priv->indirect_dword);
         priv->status |= STATUS_INDIRECT_DWORD;
@@ -1680,7 +1681,7 @@ static ssize_t show_indirect_byte(struct device *d,
                                   struct device_attribute *attr, char *buf)
 {
         u8 reg = 0;
-        struct ipw_priv *priv = d->driver_data;
+        struct ipw_priv *priv = dev_get_drvdata(d);
 
         if (priv->status & STATUS_INDIRECT_BYTE)
                 reg = ipw_read_reg8(priv, priv->indirect_byte);
@@ -1693,7 +1694,7 @@ static ssize_t store_indirect_byte(struct device *d,
                                    struct device_attribute *attr,
                                    const char *buf, size_t count)
 {
-        struct ipw_priv *priv = d->driver_data;
+        struct ipw_priv *priv = dev_get_drvdata(d);
 
         sscanf(buf, "%x", &priv->indirect_byte);
         priv->status |= STATUS_INDIRECT_BYTE;
@@ -1707,7 +1708,7 @@ static ssize_t show_direct_dword(struct device *d,
                                  struct device_attribute *attr, char *buf)
 {
         u32 reg = 0;
-        struct ipw_priv *priv = d->driver_data;
+        struct ipw_priv *priv = dev_get_drvdata(d);
 
         if (priv->status & STATUS_DIRECT_DWORD)
                 reg = ipw_read32(priv, priv->direct_dword);
@@ -1720,7 +1721,7 @@ static ssize_t store_direct_dword(struct device *d,
                                   struct device_attribute *attr,
                                   const char *buf, size_t count)
 {
-        struct ipw_priv *priv = d->driver_data;
+        struct ipw_priv *priv = dev_get_drvdata(d);
 
         sscanf(buf, "%x", &priv->direct_dword);
         priv->status |= STATUS_DIRECT_DWORD;
@@ -1747,7 +1748,7 @@ static ssize_t show_rf_kill(struct device *d, struct device_attribute *attr,
            1 - SW based RF kill active (sysfs)
            2 - HW based RF kill active
            3 - Both HW and SW baed RF kill active */
-        struct ipw_priv *priv = d->driver_data;
+        struct ipw_priv *priv = dev_get_drvdata(d);
         int val = ((priv->status & STATUS_RF_KILL_SW) ? 0x1 : 0x0) |
             (rf_kill_active(priv) ? 0x2 : 0x0);
         return sprintf(buf, "%i\n", val);
@@ -1791,7 +1792,7 @@ static int ipw_radio_kill_sw(struct ipw_priv *priv, int disable_radio)
 static ssize_t store_rf_kill(struct device *d, struct device_attribute *attr,
                              const char *buf, size_t count)
 {
-        struct ipw_priv *priv = d->driver_data;
+        struct ipw_priv *priv = dev_get_drvdata(d);
 
         ipw_radio_kill_sw(priv, buf[0] == '1');
 
@@ -1803,7 +1804,7 @@ static DEVICE_ATTR(rf_kill, S_IWUSR | S_IRUGO, show_rf_kill, store_rf_kill);
 static ssize_t show_speed_scan(struct device *d, struct device_attribute *attr,
                                char *buf)
 {
-        struct ipw_priv *priv = (struct ipw_priv *)d->driver_data;
+        struct ipw_priv *priv = dev_get_drvdata(d);
         int pos = 0, len = 0;
         if (priv->config & CFG_SPEED_SCAN) {
                 while (priv->speed_scan[pos] != 0)
@@ -1818,7 +1819,7 @@ static ssize_t show_speed_scan(struct device *d, struct device_attribute *attr,
 static ssize_t store_speed_scan(struct device *d, struct device_attribute *attr,
                                 const char *buf, size_t count)
 {
-        struct ipw_priv *priv = (struct ipw_priv *)d->driver_data;
+        struct ipw_priv *priv = dev_get_drvdata(d);
         int channel, pos = 0;
         const char *p = buf;
 
@@ -1857,14 +1858,14 @@ static DEVICE_ATTR(speed_scan, S_IWUSR | S_IRUGO, show_speed_scan,
 static ssize_t show_net_stats(struct device *d, struct device_attribute *attr,
                               char *buf)
 {
-        struct ipw_priv *priv = (struct ipw_priv *)d->driver_data;
+        struct ipw_priv *priv = dev_get_drvdata(d);
         return sprintf(buf, "%c\n", (priv->config & CFG_NET_STATS) ? '1' : '0');
 }
 
 static ssize_t store_net_stats(struct device *d, struct device_attribute *attr,
                                const char *buf, size_t count)
 {
-        struct ipw_priv *priv = (struct ipw_priv *)d->driver_data;
+        struct ipw_priv *priv = dev_get_drvdata(d);
         if (buf[0] == '1')
                 priv->config |= CFG_NET_STATS;
         else
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-rs.c b/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
index f63a9c5ba262..814afaf6d10b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
@@ -683,11 +683,10 @@ static void rs_get_rate(void *priv_r, struct ieee80211_sta *sta,
         if (sta)
                 rate_mask = sta->supp_rates[sband->band];
 
-        /* Send management frames and broadcast/multicast data using lowest
-         * rate. */
+        /* Send management frames and NO_ACK data using lowest rate. */
         fc = le16_to_cpu(hdr->frame_control);
         if ((fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA ||
-            is_multicast_ether_addr(hdr->addr1) ||
+            info->flags & IEEE80211_TX_CTL_NO_ACK ||
             !sta || !priv_sta) {
                 IWL_DEBUG_RATE(priv, "leave: No STA priv data to update!\n");
                 if (!rate_mask)
@@ -696,6 +695,8 @@ static void rs_get_rate(void *priv_r, struct ieee80211_sta *sta,
                 else
                         info->control.rates[0].idx =
                                         rate_lowest_index(sband, sta);
+                if (info->flags & IEEE80211_TX_CTL_NO_ACK)
+                        info->control.rates[0].count = 1;
                 return;
         }
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
index 3504279c7586..0a71bb55d0ee 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
@@ -172,7 +172,7 @@ struct iwl_lq_sta {
 };
 
 static void rs_rate_scale_perform(struct iwl_priv *priv,
-                                   struct ieee80211_hdr *hdr,
+                                   struct sk_buff *skb,
                                    struct ieee80211_sta *sta,
                                    struct iwl_lq_sta *lq_sta);
 static void rs_fill_link_cmd(const struct iwl_priv *priv,
@@ -829,7 +829,7 @@ static void rs_tx_status(void *priv_r, struct ieee80211_supported_band *sband,
         IWL_DEBUG_RATE_LIMIT(priv, "get frame ack response, update rate scale window\n");
 
         if (!ieee80211_is_data(hdr->frame_control) ||
-            is_multicast_ether_addr(hdr->addr1))
+            info->flags & IEEE80211_TX_CTL_NO_ACK)
                 return;
 
         /* This packet was aggregated but doesn't carry rate scale info */
@@ -995,7 +995,7 @@ static void rs_tx_status(void *priv_r, struct ieee80211_supported_band *sband,
 
         /* See if there's a better rate or modulation mode to try. */
         if (sta && sta->supp_rates[sband->band])
-                rs_rate_scale_perform(priv, hdr, sta, lq_sta);
+                rs_rate_scale_perform(priv, skb, sta, lq_sta);
 out:
         return;
 }
@@ -1207,8 +1207,7 @@ static int rs_switch_to_mimo2(struct iwl_priv *priv,
         tbl->action = 0;
         rate_mask = lq_sta->active_mimo2_rate;
 
-        if (priv->current_ht_config.supported_chan_width
-                                        == IWL_CHANNEL_WIDTH_40MHZ)
+        if (iwl_is_fat_tx_allowed(priv, &sta->ht_cap))
                 tbl->is_fat = 1;
         else
                 tbl->is_fat = 0;
@@ -1273,8 +1272,7 @@ static int rs_switch_to_mimo3(struct iwl_priv *priv,
         tbl->action = 0;
         rate_mask = lq_sta->active_mimo3_rate;
 
-        if (priv->current_ht_config.supported_chan_width
-                                        == IWL_CHANNEL_WIDTH_40MHZ)
+        if (iwl_is_fat_tx_allowed(priv, &sta->ht_cap))
                 tbl->is_fat = 1;
         else
                 tbl->is_fat = 0;
@@ -1332,8 +1330,7 @@ static int rs_switch_to_siso(struct iwl_priv *priv,
         tbl->action = 0;
         rate_mask = lq_sta->active_siso_rate;
 
-        if (priv->current_ht_config.supported_chan_width
-            == IWL_CHANNEL_WIDTH_40MHZ)
+        if (iwl_is_fat_tx_allowed(priv, &sta->ht_cap))
                 tbl->is_fat = 1;
         else
                 tbl->is_fat = 0;
@@ -1975,12 +1972,14 @@ static void rs_stay_in_table(struct iwl_lq_sta *lq_sta)
  * Do rate scaling and search for new modulation mode.
  */
 static void rs_rate_scale_perform(struct iwl_priv *priv,
-                                  struct ieee80211_hdr *hdr,
+                                  struct sk_buff *skb,
                                   struct ieee80211_sta *sta,
                                   struct iwl_lq_sta *lq_sta)
 {
         struct ieee80211_hw *hw = priv->hw;
         struct ieee80211_conf *conf = &hw->conf;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         int low = IWL_RATE_INVALID;
         int high = IWL_RATE_INVALID;
         int index;
@@ -2006,11 +2005,10 @@ static void rs_rate_scale_perform(struct iwl_priv *priv,
 
         IWL_DEBUG_RATE(priv, "rate scale calculate new rate for skb\n");
 
-        /* Send management frames and broadcast/multicast data using
-         * lowest rate. */
+        /* Send management frames and NO_ACK data using lowest rate. */
         /* TODO: this could probably be improved.. */
         if (!ieee80211_is_data(hdr->frame_control) ||
-            is_multicast_ether_addr(hdr->addr1))
+            info->flags & IEEE80211_TX_CTL_NO_ACK)
                 return;
 
         if (!sta || !lq_sta)
@@ -2450,16 +2448,17 @@ static void rs_get_rate(void *priv_r, struct ieee80211_sta *sta, void *priv_sta,
         if (sta)
                 mask_bit = sta->supp_rates[sband->band];
 
-        /* Send management frames and broadcast/multicast data using lowest
-         * rate. */
+        /* Send management frames and NO_ACK data using lowest rate. */
         if (!ieee80211_is_data(hdr->frame_control) ||
-            is_multicast_ether_addr(hdr->addr1) || !sta || !lq_sta) {
+            info->flags & IEEE80211_TX_CTL_NO_ACK || !sta || !lq_sta) {
                 if (!mask_bit)
                         info->control.rates[0].idx =
                                         rate_lowest_index(sband, NULL);
                 else
                         info->control.rates[0].idx =
                                         rate_lowest_index(sband, sta);
+                if (info->flags & IEEE80211_TX_CTL_NO_ACK)
+                        info->control.rates[0].count = 1;
                 return;
         }
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 277dfc57fde9..6cdee0b4b486 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -567,7 +567,8 @@ static void iwl_setup_rxon_timing(struct iwl_priv *priv)
                 beacon_int = iwl_adjust_beacon_interval(priv->beacon_int);
                 priv->rxon_timing.atim_window = 0;
         } else {
-                beacon_int = iwl_adjust_beacon_interval(conf->beacon_int);
+                beacon_int = iwl_adjust_beacon_interval(
+                        priv->vif->bss_conf.beacon_int);
 
                 /* TODO: we need to get atim_window from upper stack
                  * for now we set to 0 */
@@ -2267,7 +2268,7 @@ static int iwl_mac_get_stats(struct ieee80211_hw *hw,
 static ssize_t show_debug_level(struct device *d,
                                 struct device_attribute *attr, char *buf)
 {
-        struct iwl_priv *priv = d->driver_data;
+        struct iwl_priv *priv = dev_get_drvdata(d);
 
         return sprintf(buf, "0x%08X\n", priv->debug_level);
 }
@@ -2275,7 +2276,7 @@ static ssize_t store_debug_level(struct device *d,
                                 struct device_attribute *attr,
                                  const char *buf, size_t count)
 {
-        struct iwl_priv *priv = d->driver_data;
+        struct iwl_priv *priv = dev_get_drvdata(d);
         unsigned long val;
         int ret;
 
@@ -2298,7 +2299,7 @@ static DEVICE_ATTR(debug_level, S_IWUSR | S_IRUGO,
 static ssize_t show_version(struct device *d,
                                 struct device_attribute *attr, char *buf)
 {
-        struct iwl_priv *priv = d->driver_data;
+        struct iwl_priv *priv = dev_get_drvdata(d);
         struct iwl_alive_resp *palive = &priv->card_alive;
         ssize_t pos = 0;
         u16 eeprom_ver;
@@ -2329,7 +2330,7 @@ static DEVICE_ATTR(version, S_IWUSR | S_IRUGO, show_version, NULL);
 static ssize_t show_temperature(struct device *d,
                                 struct device_attribute *attr, char *buf)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)d->driver_data;
+        struct iwl_priv *priv = dev_get_drvdata(d);
 
         if (!iwl_is_alive(priv))
                 return -EAGAIN;
@@ -2342,7 +2343,7 @@ static DEVICE_ATTR(temperature, S_IRUGO, show_temperature, NULL);
 static ssize_t show_tx_power(struct device *d,
                              struct device_attribute *attr, char *buf)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)d->driver_data;
+        struct iwl_priv *priv = dev_get_drvdata(d);
 
         if (!iwl_is_ready_rf(priv))
                 return sprintf(buf, "off\n");
@@ -2354,7 +2355,7 @@ static ssize_t store_tx_power(struct device *d,
                               struct device_attribute *attr,
                               const char *buf, size_t count)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)d->driver_data;
+        struct iwl_priv *priv = dev_get_drvdata(d);
         unsigned long val;
         int ret;
 
@@ -2372,7 +2373,7 @@ static DEVICE_ATTR(tx_power, S_IWUSR | S_IRUGO, show_tx_power, store_tx_power);
 static ssize_t show_flags(struct device *d,
                           struct device_attribute *attr, char *buf)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)d->driver_data;
+        struct iwl_priv *priv = dev_get_drvdata(d);
 
         return sprintf(buf, "0x%04X\n", priv->active_rxon.flags);
 }
@@ -2381,7 +2382,7 @@ static ssize_t store_flags(struct device *d,
                            struct device_attribute *attr,
                            const char *buf, size_t count)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)d->driver_data;
+        struct iwl_priv *priv = dev_get_drvdata(d);
         unsigned long val;
         u32 flags;
         int ret = strict_strtoul(buf, 0, &val);
@@ -2410,7 +2411,7 @@ static DEVICE_ATTR(flags, S_IWUSR | S_IRUGO, show_flags, store_flags);
 static ssize_t show_filter_flags(struct device *d,
                                  struct device_attribute *attr, char *buf)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)d->driver_data;
+        struct iwl_priv *priv = dev_get_drvdata(d);
 
         return sprintf(buf, "0x%04X\n",
                 le32_to_cpu(priv->active_rxon.filter_flags));
@@ -2420,7 +2421,7 @@ static ssize_t store_filter_flags(struct device *d,
                                   struct device_attribute *attr,
                                   const char *buf, size_t count)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)d->driver_data;
+        struct iwl_priv *priv = dev_get_drvdata(d);
         unsigned long val;
         u32 filter_flags;
         int ret = strict_strtoul(buf, 0, &val);
@@ -2622,7 +2623,6 @@ static struct ieee80211_ops iwl_hw_ops = {
         .add_interface = iwl_mac_add_interface,
         .remove_interface = iwl_mac_remove_interface,
         .config = iwl_mac_config,
-        .config_interface = iwl_mac_config_interface,
         .configure_filter = iwl_configure_filter,
         .set_key = iwl_mac_set_key,
         .update_tkip_key = iwl_mac_update_tkip_key,
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 3dec2d25fa3d..1366222bb50a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -1298,8 +1298,7 @@ int iwl_setup_mac(struct iwl_priv *priv)
         hw->flags = IEEE80211_HW_SIGNAL_DBM |
                     IEEE80211_HW_NOISE_DBM |
                     IEEE80211_HW_AMPDU_AGGREGATION |
-                    IEEE80211_HW_SPECTRUM_MGMT |
-                    IEEE80211_HW_SUPPORTS_PS;
+                    IEEE80211_HW_SPECTRUM_MGMT;
         hw->wiphy->interface_modes =
                 BIT(NL80211_IFTYPE_STATION) |
                 BIT(NL80211_IFTYPE_ADHOC);
@@ -1313,7 +1312,6 @@ int iwl_setup_mac(struct iwl_priv *priv)
         /* Default value; 4 EDCA QOS priorities */
         hw->queues = 4;
 
-        hw->conf.beacon_int = 100;
         hw->max_listen_interval = IWL_CONN_MAX_LISTEN_INTERVAL;
 
         if (priv->bands[IEEE80211_BAND_2GHZ].n_channels)
@@ -2239,15 +2237,69 @@ static void iwl_ht_conf(struct iwl_priv *priv,
 
 #define IWL_DELAY_NEXT_SCAN_AFTER_ASSOC (HZ*6)
 void iwl_bss_info_changed(struct ieee80211_hw *hw,
-                                     struct ieee80211_vif *vif,
-                                     struct ieee80211_bss_conf *bss_conf,
-                                     u32 changes)
+                          struct ieee80211_vif *vif,
+                          struct ieee80211_bss_conf *bss_conf,
+                          u32 changes)
 {
         struct iwl_priv *priv = hw->priv;
         int ret;
 
         IWL_DEBUG_MAC80211(priv, "changes = 0x%X\n", changes);
 
+        if (!iwl_is_alive(priv))
+                return;
+
+        mutex_lock(&priv->mutex);
+
+        if (changes & BSS_CHANGED_BEACON &&
+            priv->iw_mode == NL80211_IFTYPE_AP) {
+                dev_kfree_skb(priv->ibss_beacon);
+                priv->ibss_beacon = ieee80211_beacon_get(hw, vif);
+        }
+
+        if ((changes & BSS_CHANGED_BSSID) && !iwl_is_rfkill(priv)) {
+                /* If there is currently a HW scan going on in the background
+                 * then we need to cancel it else the RXON below will fail. */
+                if (iwl_scan_cancel_timeout(priv, 100)) {
+                        IWL_WARN(priv, "Aborted scan still in progress "
+                                    "after 100ms\n");
+                        IWL_DEBUG_MAC80211(priv, "leaving - scan abort failed.\n");
+                        mutex_unlock(&priv->mutex);
+                        return;
+                }
+                memcpy(priv->staging_rxon.bssid_addr,
+                       bss_conf->bssid, ETH_ALEN);
+
+                /* TODO: Audit driver for usage of these members and see
+                 * if mac80211 deprecates them (priv->bssid looks like it
+                 * shouldn't be there, but I haven't scanned the IBSS code
+                 * to verify) - jpk */
+                memcpy(priv->bssid, bss_conf->bssid, ETH_ALEN);
+
+                if (priv->iw_mode == NL80211_IFTYPE_AP)
+                        iwlcore_config_ap(priv);
+                else {
+                        int rc = iwlcore_commit_rxon(priv);
+                        if ((priv->iw_mode == NL80211_IFTYPE_STATION) && rc)
+                                iwl_rxon_add_station(
+                                        priv, priv->active_rxon.bssid_addr, 1);
+                }
+        } else if (!iwl_is_rfkill(priv)) {
+                iwl_scan_cancel_timeout(priv, 100);
+                priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
+                iwlcore_commit_rxon(priv);
+        }
+
+        if (priv->iw_mode == NL80211_IFTYPE_ADHOC &&
+            changes & BSS_CHANGED_BEACON) {
+                struct sk_buff *beacon = ieee80211_beacon_get(hw, vif);
+
+                if (beacon)
+                        iwl_mac_beacon_update(hw, beacon);
+        }
+
+        mutex_unlock(&priv->mutex);
+
         if (changes & BSS_CHANGED_ERP_PREAMBLE) {
                 IWL_DEBUG_MAC80211(priv, "ERP_PREAMBLE %d\n",
                                    bss_conf->use_short_preamble);
@@ -2306,7 +2358,7 @@ void iwl_bss_info_changed(struct ieee80211_hw *hw,
                                         &priv->staging_rxon,
                                         sizeof(struct iwl_rxon_cmd));
         }
-
+        IWL_DEBUG_MAC80211(priv, "leave\n");
 }
 EXPORT_SYMBOL(iwl_bss_info_changed);
 
@@ -2590,106 +2642,6 @@ out:
 }
 EXPORT_SYMBOL(iwl_mac_config);
 
-int iwl_mac_config_interface(struct ieee80211_hw *hw,
-                                        struct ieee80211_vif *vif,
-                                    struct ieee80211_if_conf *conf)
-{
-        struct iwl_priv *priv = hw->priv;
-        int rc;
-
-        if (conf == NULL)
-                return -EIO;
-
-        if (priv->vif != vif) {
-                IWL_DEBUG_MAC80211(priv, "leave - priv->vif != vif\n");
-                return 0;
-        }
-
-        if (priv->iw_mode == NL80211_IFTYPE_ADHOC &&
-            conf->changed & IEEE80211_IFCC_BEACON) {
-                struct sk_buff *beacon = ieee80211_beacon_get(hw, vif);
-                if (!beacon)
-                        return -ENOMEM;
-                mutex_lock(&priv->mutex);
-                rc = iwl_mac_beacon_update(hw, beacon);
-                mutex_unlock(&priv->mutex);
-                if (rc)
-                        return rc;
-        }
-
-        if (!iwl_is_alive(priv))
-                return -EAGAIN;
-
-        mutex_lock(&priv->mutex);
-
-        if (conf->bssid)
-                IWL_DEBUG_MAC80211(priv, "bssid: %pM\n", conf->bssid);
-
-/*
- * very dubious code was here; the probe filtering flag is never set:
- *
-        if (unlikely(test_bit(STATUS_SCANNING, &priv->status)) &&
-            !(priv->hw->flags & IEEE80211_HW_NO_PROBE_FILTERING)) {
- */
-
-        if (priv->iw_mode == NL80211_IFTYPE_AP) {
-                if (!conf->bssid) {
-                        conf->bssid = priv->mac_addr;
-                        memcpy(priv->bssid, priv->mac_addr, ETH_ALEN);
-                        IWL_DEBUG_MAC80211(priv, "bssid was set to: %pM\n",
-                                           conf->bssid);
-                }
-                if (priv->ibss_beacon)
-                        dev_kfree_skb(priv->ibss_beacon);
-
-                priv->ibss_beacon = ieee80211_beacon_get(hw, vif);
-        }
-
-        if (iwl_is_rfkill(priv))
-                goto done;
-
-        if (conf->bssid && !is_zero_ether_addr(conf->bssid) &&
-            !is_multicast_ether_addr(conf->bssid)) {
-                /* If there is currently a HW scan going on in the background
-                 * then we need to cancel it else the RXON below will fail. */
-                if (iwl_scan_cancel_timeout(priv, 100)) {
-                        IWL_WARN(priv, "Aborted scan still in progress "
-                                    "after 100ms\n");
-                        IWL_DEBUG_MAC80211(priv, "leaving - scan abort failed.\n");
-                        mutex_unlock(&priv->mutex);
-                        return -EAGAIN;
-                }
-                memcpy(priv->staging_rxon.bssid_addr, conf->bssid, ETH_ALEN);
-
-                /* TODO: Audit driver for usage of these members and see
-                 * if mac80211 deprecates them (priv->bssid looks like it
-                 * shouldn't be there, but I haven't scanned the IBSS code
-                 * to verify) - jpk */
-                memcpy(priv->bssid, conf->bssid, ETH_ALEN);
-
-                if (priv->iw_mode == NL80211_IFTYPE_AP)
-                        iwlcore_config_ap(priv);
-                else {
-                        rc = iwlcore_commit_rxon(priv);
-                        if ((priv->iw_mode == NL80211_IFTYPE_STATION) && rc)
-                                iwl_rxon_add_station(
-                                        priv, priv->active_rxon.bssid_addr, 1);
-                }
-
-        } else {
-                iwl_scan_cancel_timeout(priv, 100);
-                priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
-                iwlcore_commit_rxon(priv);
-        }
-
- done:
-        IWL_DEBUG_MAC80211(priv, "leave\n");
-        mutex_unlock(&priv->mutex);
-
-        return 0;
-}
-EXPORT_SYMBOL(iwl_mac_config_interface);
-
 int iwl_mac_get_tx_stats(struct ieee80211_hw *hw,
                          struct ieee80211_tx_queue_stats *stats)
 {
@@ -2751,7 +2703,7 @@ void iwl_mac_reset_tsf(struct ieee80211_hw *hw)
 
         priv->ibss_beacon = NULL;
 
-        priv->beacon_int = priv->hw->conf.beacon_int;
+        priv->beacon_int = priv->vif->bss_conf.beacon_int;
         priv->timestamp = 0;
         if ((priv->iw_mode == NL80211_IFTYPE_STATION))
                 priv->beacon_int = 0;
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
index d4c60afa2891..bd7f9d9616bc 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.h
+++ b/drivers/net/wireless/iwlwifi/iwl-core.h
@@ -281,9 +281,6 @@ void iwl_mac_remove_interface(struct ieee80211_hw *hw,
                                  struct ieee80211_if_init_conf *conf);
 int iwl_mac_config(struct ieee80211_hw *hw, u32 changed);
 void iwl_config_ap(struct iwl_priv *priv);
-int iwl_mac_config_interface(struct ieee80211_hw *hw,
-                                struct ieee80211_vif *vif,
-                                struct ieee80211_if_conf *conf);
 int iwl_mac_get_tx_stats(struct ieee80211_hw *hw,
                          struct ieee80211_tx_queue_stats *stats);
 void iwl_mac_reset_tsf(struct ieee80211_hw *hw);
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index 0072ea2c5361..0eb939c40ac1 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -490,7 +490,7 @@ void iwl_clear_stations_table(struct iwl_priv *priv)
         /* keep track of static keys */
         for (i = 0; i < WEP_KEYS_MAX ; i++) {
                 if (priv->wep_keys[i].key_size)
-                        test_and_set_bit(i, &priv->ucode_key_table);
+                        set_bit(i, &priv->ucode_key_table);
         }
 
         spin_unlock_irqrestore(&priv->sta_lock, flags);
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 6b42ea2a1f1d..f6c1489a0c4a 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -551,7 +551,8 @@ static void iwl3945_setup_rxon_timing(struct iwl_priv *priv)
                 priv->rxon_timing.atim_window = 0;
         } else {
                 priv->rxon_timing.beacon_interval =
-                        iwl3945_adjust_beacon_interval(conf->beacon_int);
+                        iwl3945_adjust_beacon_interval(
+                                priv->vif->bss_conf.beacon_int);
                 /* TODO: we need to get atim_window from upper stack
                  * for now we set to 0 */
                 priv->rxon_timing.atim_window = 0;
@@ -1343,15 +1344,24 @@ static void iwl3945_rx_allocate(struct iwl_priv *priv)
         struct list_head *element;
         struct iwl_rx_mem_buffer *rxb;
         unsigned long flags;
-        spin_lock_irqsave(&rxq->lock, flags);
-        while (!list_empty(&rxq->rx_used)) {
+
+        while (1) {
+                spin_lock_irqsave(&rxq->lock, flags);
+
+                if (list_empty(&rxq->rx_used)) {
+                        spin_unlock_irqrestore(&rxq->lock, flags);
+                        return;
+                }
+
                 element = rxq->rx_used.next;
                 rxb = list_entry(element, struct iwl_rx_mem_buffer, list);
+                list_del(element);
+                spin_unlock_irqrestore(&rxq->lock, flags);
 
                 /* Alloc a new receive buffer */
                 rxb->skb =
                     alloc_skb(priv->hw_params.rx_buf_size,
-                                __GFP_NOWARN | GFP_ATOMIC);
+                                GFP_KERNEL);
                 if (!rxb->skb) {
                         if (net_ratelimit())
                                 IWL_CRIT(priv, ": Can not allocate SKB buffers\n");
@@ -1369,18 +1379,18 @@ static void iwl3945_rx_allocate(struct iwl_priv *priv)
                  */
                 skb_reserve(rxb->skb, 4);
 
-                priv->alloc_rxb_skb++;
-                list_del(element);
-
                 /* Get physical address of RB/SKB */
                 rxb->real_dma_addr = pci_map_single(priv->pci_dev,
                                                 rxb->skb->data,
                                                 priv->hw_params.rx_buf_size,
                                                 PCI_DMA_FROMDEVICE);
+
+                spin_lock_irqsave(&rxq->lock, flags);
                 list_add_tail(&rxb->list, &rxq->rx_free);
+                priv->alloc_rxb_skb++;
                 rxq->free_count++;
+                spin_unlock_irqrestore(&rxq->lock, flags);
         }
-        spin_unlock_irqrestore(&rxq->lock, flags);
 }
 
 void iwl3945_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
@@ -1413,18 +1423,6 @@ void iwl3945_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
         spin_unlock_irqrestore(&rxq->lock, flags);
 }
 
-/*
- * this should be called while priv->lock is locked
- */
-static void __iwl3945_rx_replenish(void *data)
-{
-        struct iwl_priv *priv = data;
-
-        iwl3945_rx_allocate(priv);
-        iwl3945_rx_queue_restock(priv);
-}
-
-
 void iwl3945_rx_replenish(void *data)
 {
         struct iwl_priv *priv = data;
@@ -1642,7 +1640,7 @@ static void iwl3945_rx_handle(struct iwl_priv *priv)
                         count++;
                         if (count >= 8) {
                                 priv->rxq.read = i;
-                                __iwl3945_rx_replenish(priv);
+                                iwl3945_rx_queue_restock(priv);
                                 count = 0;
                         }
                 }
@@ -3596,7 +3594,7 @@ static int iwl3945_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
 static ssize_t show_debug_level(struct device *d,
                                 struct device_attribute *attr, char *buf)
 {
-        struct iwl_priv *priv = d->driver_data;
+        struct iwl_priv *priv = dev_get_drvdata(d);
 
         return sprintf(buf, "0x%08X\n", priv->debug_level);
 }
@@ -3604,7 +3602,7 @@ static ssize_t store_debug_level(struct device *d,
                                 struct device_attribute *attr,
                                  const char *buf, size_t count)
 {
-        struct iwl_priv *priv = d->driver_data;
+        struct iwl_priv *priv = dev_get_drvdata(d);
         unsigned long val;
         int ret;
 
@@ -3625,7 +3623,7 @@ static DEVICE_ATTR(debug_level, S_IWUSR | S_IRUGO,
 static ssize_t show_temperature(struct device *d,
                                 struct device_attribute *attr, char *buf)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)d->driver_data;
+        struct iwl_priv *priv = dev_get_drvdata(d);
 
         if (!iwl_is_alive(priv))
                 return -EAGAIN;
@@ -3638,7 +3636,7 @@ static DEVICE_ATTR(temperature, S_IRUGO, show_temperature, NULL);
 static ssize_t show_tx_power(struct device *d,
                              struct device_attribute *attr, char *buf)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)d->driver_data;
+        struct iwl_priv *priv = dev_get_drvdata(d);
         return sprintf(buf, "%d\n", priv->tx_power_user_lmt);
 }
 
@@ -3646,7 +3644,7 @@ static ssize_t store_tx_power(struct device *d,
                               struct device_attribute *attr,
                               const char *buf, size_t count)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)d->driver_data;
+        struct iwl_priv *priv = dev_get_drvdata(d);
         char *p = (char *)buf;
         u32 val;
 
@@ -3664,7 +3662,7 @@ static DEVICE_ATTR(tx_power, S_IWUSR | S_IRUGO, show_tx_power, store_tx_power);
 static ssize_t show_flags(struct device *d,
                           struct device_attribute *attr, char *buf)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)d->driver_data;
+        struct iwl_priv *priv = dev_get_drvdata(d);
 
         return sprintf(buf, "0x%04X\n", priv->active_rxon.flags);
 }
@@ -3673,7 +3671,7 @@ static ssize_t store_flags(struct device *d,
                            struct device_attribute *attr,
                            const char *buf, size_t count)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)d->driver_data;
+        struct iwl_priv *priv = dev_get_drvdata(d);
         u32 flags = simple_strtoul(buf, NULL, 0);
 
         mutex_lock(&priv->mutex);
@@ -3698,7 +3696,7 @@ static DEVICE_ATTR(flags, S_IWUSR | S_IRUGO, show_flags, store_flags);
 static ssize_t show_filter_flags(struct device *d,
                                  struct device_attribute *attr, char *buf)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)d->driver_data;
+        struct iwl_priv *priv = dev_get_drvdata(d);
 
         return sprintf(buf, "0x%04X\n",
                 le32_to_cpu(priv->active_rxon.filter_flags));
@@ -3708,7 +3706,7 @@ static ssize_t store_filter_flags(struct device *d,
                                   struct device_attribute *attr,
                                   const char *buf, size_t count)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)d->driver_data;
+        struct iwl_priv *priv = dev_get_drvdata(d);
         u32 filter_flags = simple_strtoul(buf, NULL, 0);
 
         mutex_lock(&priv->mutex);
@@ -3993,7 +3991,7 @@ static DEVICE_ATTR(antenna, S_IWUSR | S_IRUGO, show_antenna, store_antenna);
 static ssize_t show_status(struct device *d,
                            struct device_attribute *attr, char *buf)
 {
-        struct iwl_priv *priv = (struct iwl_priv *)d->driver_data;
+        struct iwl_priv *priv = dev_get_drvdata(d);
         if (!iwl_is_alive(priv))
                 return -EAGAIN;
         return sprintf(buf, "0x%08x\n", (int)priv->status);
@@ -4005,10 +4003,11 @@ static ssize_t dump_error_log(struct device *d,
                               struct device_attribute *attr,
                               const char *buf, size_t count)
 {
+        struct iwl_priv *priv = dev_get_drvdata(d);
         char *p = (char *)buf;
 
         if (p[0] == '1')
-                iwl3945_dump_nic_error_log((struct iwl_priv *)d->driver_data);
+                iwl3945_dump_nic_error_log(priv);
 
         return strnlen(buf, count);
 }
@@ -4019,10 +4018,11 @@ static ssize_t dump_event_log(struct device *d,
                               struct device_attribute *attr,
                               const char *buf, size_t count)
 {
+        struct iwl_priv *priv = dev_get_drvdata(d);
         char *p = (char *)buf;
 
         if (p[0] == '1')
-                iwl3945_dump_nic_event_log((struct iwl_priv *)d->driver_data);
+                iwl3945_dump_nic_event_log(priv);
 
         return strnlen(buf, count);
 }
@@ -4104,7 +4104,6 @@ static struct ieee80211_ops iwl3945_hw_ops = {
         .add_interface = iwl_mac_add_interface,
         .remove_interface = iwl_mac_remove_interface,
         .config = iwl_mac_config,
-        .config_interface = iwl_mac_config_interface,
         .configure_filter = iwl_configure_filter,
         .set_key = iwl3945_mac_set_key,
         .get_tx_stats = iwl_mac_get_tx_stats,
@@ -4210,8 +4209,6 @@ static int iwl3945_setup_mac(struct iwl_priv *priv)
         /* Default value; 4 EDCA QOS priorities */
         hw->queues = 4;
 
-        hw->conf.beacon_int = 100;
-
         if (priv->bands[IEEE80211_BAND_2GHZ].n_channels)
                 priv->hw->wiphy->bands[IEEE80211_BAND_2GHZ] =
                         &priv->bands[IEEE80211_BAND_2GHZ];
diff --git a/drivers/net/wireless/libertas_tf/main.c b/drivers/net/wireless/libertas_tf/main.c
index e7289e2e7f16..10a99e26d392 100644
--- a/drivers/net/wireless/libertas_tf/main.c
+++ b/drivers/net/wireless/libertas_tf/main.c
@@ -366,36 +366,6 @@ static int lbtf_op_config(struct ieee80211_hw *hw, u32 changed)
         return 0;
 }
 
-static int lbtf_op_config_interface(struct ieee80211_hw *hw,
-                        struct ieee80211_vif *vif,
-                        struct ieee80211_if_conf *conf)
-{
-        struct lbtf_private *priv = hw->priv;
-        struct sk_buff *beacon;
-
-        switch (priv->vif->type) {
-        case NL80211_IFTYPE_AP:
-        case NL80211_IFTYPE_MESH_POINT:
-                beacon = ieee80211_beacon_get(hw, vif);
-                if (beacon) {
-                        lbtf_beacon_set(priv, beacon);
-                        kfree_skb(beacon);
-                        lbtf_beacon_ctrl(priv, 1, hw->conf.beacon_int);
-                }
-                break;
-        default:
-                break;
-        }
-
-        if (conf->bssid) {
-                u8 null_bssid[ETH_ALEN] = {0};
-                bool activate = compare_ether_addr(conf->bssid, null_bssid);
-                lbtf_set_bssid(priv, activate, conf->bssid);
-        }
-
-        return 0;
-}
-
 #define SUPPORTED_FIF_FLAGS  (FIF_PROMISC_IN_BSS | FIF_ALLMULTI)
 static void lbtf_op_configure_filter(struct ieee80211_hw *hw,
                         unsigned int changed_flags,
@@ -451,6 +421,29 @@ static void lbtf_op_bss_info_changed(struct ieee80211_hw *hw,
                         u32 changes)
 {
         struct lbtf_private *priv = hw->priv;
+        struct sk_buff *beacon;
+
+        if (changes & (BSS_CHANGED_BEACON | BSS_CHANGED_BEACON_INT)) {
+                switch (priv->vif->type) {
+                case NL80211_IFTYPE_AP:
+                case NL80211_IFTYPE_MESH_POINT:
+                        beacon = ieee80211_beacon_get(hw, vif);
+                        if (beacon) {
+                                lbtf_beacon_set(priv, beacon);
+                                kfree_skb(beacon);
+                                lbtf_beacon_ctrl(priv, 1,
+                                                 bss_conf->beacon_int);
+                        }
+                        break;
+                default:
+                        break;
+                }
+        }
+
+        if (changes & BSS_CHANGED_BSSID) {
+                bool activate = !is_zero_ether_addr(bss_conf->bssid);
+                lbtf_set_bssid(priv, activate, bss_conf->bssid);
+        }
 
         if (changes & BSS_CHANGED_ERP_PREAMBLE) {
                 if (bss_conf->use_short_preamble)
@@ -459,8 +452,6 @@ static void lbtf_op_bss_info_changed(struct ieee80211_hw *hw,
                         priv->preamble = CMD_TYPE_LONG_PREAMBLE;
                 lbtf_set_radio_control(priv);
         }
-
-        return;
 }
 
 static const struct ieee80211_ops lbtf_ops = {
@@ -470,7 +461,6 @@ static const struct ieee80211_ops lbtf_ops = {
         .add_interface          = lbtf_op_add_interface,
         .remove_interface       = lbtf_op_remove_interface,
         .config                 = lbtf_op_config,
-        .config_interface       = lbtf_op_config_interface,
         .configure_filter       = lbtf_op_configure_filter,
         .bss_info_changed       = lbtf_op_bss_info_changed,
 };
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index d4fdc8b7d7d8..b1213b6a6b9f 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -553,18 +553,15 @@ static int mac80211_hwsim_config(struct ieee80211_hw *hw, u32 changed)
         struct mac80211_hwsim_data *data = hw->priv;
         struct ieee80211_conf *conf = &hw->conf;
 
-        printk(KERN_DEBUG "%s:%s (freq=%d radio_enabled=%d beacon_int=%d)\n",
+        printk(KERN_DEBUG "%s:%s (freq=%d radio_enabled=%d idle=%d ps=%d)\n",
                wiphy_name(hw->wiphy), __func__,
                conf->channel->center_freq, conf->radio_enabled,
-               conf->beacon_int);
+               !!(conf->flags & IEEE80211_CONF_IDLE),
+               !!(conf->flags & IEEE80211_CONF_PS));
 
         data->channel = conf->channel;
         data->radio_enabled = conf->radio_enabled;
-        data->beacon_int = 1024 * conf->beacon_int / 1000 * HZ / 1000;
-        if (data->beacon_int < 1)
-                data->beacon_int = 1;
-
-        if (!data->started || !data->radio_enabled)
+        if (!data->started || !data->radio_enabled || !data->beacon_int)
                 del_timer(&data->beacon_timer);
         else
                 mod_timer(&data->beacon_timer, jiffies + data->beacon_int);
@@ -592,35 +589,26 @@ static void mac80211_hwsim_configure_filter(struct ieee80211_hw *hw,
         *total_flags = data->rx_filter;
 }
 
-static int mac80211_hwsim_config_interface(struct ieee80211_hw *hw,
-                                           struct ieee80211_vif *vif,
-                                           struct ieee80211_if_conf *conf)
-{
-        struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
-
-        hwsim_check_magic(vif);
-        if (conf->changed & IEEE80211_IFCC_BSSID) {
-                DECLARE_MAC_BUF(mac);
-                printk(KERN_DEBUG "%s:%s: BSSID changed: %pM\n",
-                       wiphy_name(hw->wiphy), __func__,
-                       conf->bssid);
-                memcpy(vp->bssid, conf->bssid, ETH_ALEN);
-        }
-        return 0;
-}
-
 static void mac80211_hwsim_bss_info_changed(struct ieee80211_hw *hw,
                                             struct ieee80211_vif *vif,
                                             struct ieee80211_bss_conf *info,
                                             u32 changed)
 {
         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
+        struct mac80211_hwsim_data *data = hw->priv;
 
         hwsim_check_magic(vif);
 
         printk(KERN_DEBUG "%s:%s(changed=0x%x)\n",
                wiphy_name(hw->wiphy), __func__, changed);
 
+        if (changed & BSS_CHANGED_BSSID) {
+                printk(KERN_DEBUG "%s:%s: BSSID changed: %pM\n",
+                       wiphy_name(hw->wiphy), __func__,
+                       info->bssid);
+                memcpy(vp->bssid, info->bssid, ETH_ALEN);
+        }
+
         if (changed & BSS_CHANGED_ASSOC) {
                 printk(KERN_DEBUG "  %s: ASSOC: assoc=%d aid=%d\n",
                        wiphy_name(hw->wiphy), info->assoc, info->aid);
@@ -628,6 +616,14 @@ static void mac80211_hwsim_bss_info_changed(struct ieee80211_hw *hw,
                 vp->aid = info->aid;
         }
 
+        if (changed & BSS_CHANGED_BEACON_INT) {
+                printk(KERN_DEBUG "  %s: BCNINT: %d\n",
+                       wiphy_name(hw->wiphy), info->beacon_int);
+                data->beacon_int = 1024 * info->beacon_int / 1000 * HZ / 1000;
+                if (WARN_ON(!data->beacon_int))
+                        data->beacon_int = 1;
+        }
+
         if (changed & BSS_CHANGED_ERP_CTS_PROT) {
                 printk(KERN_DEBUG "  %s: ERP_CTS_PROT: %d\n",
                        wiphy_name(hw->wiphy), info->use_cts_prot);
@@ -704,7 +700,6 @@ static const struct ieee80211_ops mac80211_hwsim_ops =
         .remove_interface = mac80211_hwsim_remove_interface,
         .config = mac80211_hwsim_config,
         .configure_filter = mac80211_hwsim_configure_filter,
-        .config_interface = mac80211_hwsim_config_interface,
         .bss_info_changed = mac80211_hwsim_bss_info_changed,
         .sta_notify = mac80211_hwsim_sta_notify,
         .set_tim = mac80211_hwsim_set_tim,
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index a9a970469c2a..46b288dc8f4d 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -3089,19 +3089,6 @@ static int mwl8k_config(struct ieee80211_hw *hw, u32 changed)
         return rc ? -EINVAL : 0;
 }
 
-static int mwl8k_config_interface(struct ieee80211_hw *hw,
-                                  struct ieee80211_vif *vif,
-                                  struct ieee80211_if_conf *conf)
-{
-        struct mwl8k_vif *mv_vif = MWL8K_VIF(vif);
-        u32 changed = conf->changed;
-
-        if (changed & IEEE80211_IFCC_BSSID)
-                memcpy(mv_vif->bssid, conf->bssid, IEEE80211_ADDR_LEN);
-
-        return 0;
-}
-
 struct mwl8k_bss_info_changed_worker {
         struct mwl8k_work_struct header;
         struct ieee80211_vif *vif;
@@ -3183,8 +3170,12 @@ static void mwl8k_bss_info_changed(struct ieee80211_hw *hw,
 {
         struct mwl8k_bss_info_changed_worker *worker;
         struct mwl8k_priv *priv = hw->priv;
+        struct mwl8k_vif *mv_vif = MWL8K_VIF(vif);
         int rc;
 
+        if (changed & BSS_CHANGED_BSSID)
+                memcpy(mv_vif->bssid, info->bssid, IEEE80211_ADDR_LEN);
+
         if ((changed & BSS_CHANGED_ASSOC) == 0)
                 return;
 
@@ -3442,7 +3433,6 @@ static const struct ieee80211_ops mwl8k_ops = {
         .add_interface          = mwl8k_add_interface,
         .remove_interface       = mwl8k_remove_interface,
         .config                 = mwl8k_config,
-        .config_interface       = mwl8k_config_interface,
         .bss_info_changed       = mwl8k_bss_info_changed,
         .configure_filter       = mwl8k_configure_filter,
         .set_rts_threshold      = mwl8k_set_rts_threshold,
diff --git a/drivers/net/wireless/p54/p54.h b/drivers/net/wireless/p54/p54.h
index 7fda1a9e263b..db3df947d8ed 100644
--- a/drivers/net/wireless/p54/p54.h
+++ b/drivers/net/wireless/p54/p54.h
@@ -189,10 +189,10 @@ struct p54_common {
         unsigned long *used_rxkeys;
 
         /* LED management */
-#ifdef CONFIG_MAC80211_LEDS
+#ifdef CONFIG_P54_LEDS
         struct p54_led_dev leds[4];
         struct delayed_work led_work;
-#endif /* CONFIG_MAC80211_LEDS */
+#endif /* CONFIG_P54_LEDS */
         u16 softled_state;              /* bit field of glowing LEDs */
 
         /* statistics */
diff --git a/drivers/net/wireless/p54/p54common.c b/drivers/net/wireless/p54/p54common.c
index 71394968d450..48d81d98e12d 100644
--- a/drivers/net/wireless/p54/p54common.c
+++ b/drivers/net/wireless/p54/p54common.c
@@ -822,7 +822,6 @@ void p54_free_skb(struct ieee80211_hw *dev, struct sk_buff *skb)
         struct ieee80211_tx_info *info;
         struct p54_tx_info *range;
         unsigned long flags;
-        u32 freed = 0, last_addr = priv->rx_start;
 
         if (unlikely(!skb || !dev || !skb_queue_len(&priv->tx_queue)))
                 return;
@@ -842,7 +841,6 @@ void p54_free_skb(struct ieee80211_hw *dev, struct sk_buff *skb)
 
                 ni = IEEE80211_SKB_CB(skb->prev);
                 mr = (struct p54_tx_info *)ni->rate_driver_data;
-                last_addr = mr->end_addr;
         }
         if (skb->next != (struct sk_buff *)&priv->tx_queue) {
                 struct ieee80211_tx_info *ni;
@@ -850,16 +848,11 @@ void p54_free_skb(struct ieee80211_hw *dev, struct sk_buff *skb)
 
                 ni = IEEE80211_SKB_CB(skb->next);
                 mr = (struct p54_tx_info *)ni->rate_driver_data;
-                freed = mr->start_addr - last_addr;
-        } else
-                freed = priv->rx_end - last_addr;
+        }
         __skb_unlink(skb, &priv->tx_queue);
         spin_unlock_irqrestore(&priv->tx_queue.lock, flags);
         dev_kfree_skb_any(skb);
-
-        if (freed >= priv->headroom + sizeof(struct p54_hdr) + 48 +
-                     IEEE80211_MAX_RTS_THRESHOLD + priv->tailroom)
-                p54_wake_free_queues(dev);
+        p54_wake_free_queues(dev);
 }
 EXPORT_SYMBOL_GPL(p54_free_skb);
 
@@ -893,8 +886,6 @@ static void p54_rx_frame_sent(struct ieee80211_hw *dev, struct sk_buff *skb)
         struct sk_buff *entry;
         u32 addr = le32_to_cpu(hdr->req_id) - priv->headroom;
         struct p54_tx_info *range = NULL;
-        u32 freed = 0;
-        u32 last_addr = priv->rx_start;
         unsigned long flags;
         int count, idx;
 
@@ -908,7 +899,6 @@ static void p54_rx_frame_sent(struct ieee80211_hw *dev, struct sk_buff *skb)
 
                 range = (void *)info->rate_driver_data;
                 if (range->start_addr != addr) {
-                        last_addr = range->end_addr;
                         entry = entry->next;
                         continue;
                 }
@@ -919,11 +909,8 @@ static void p54_rx_frame_sent(struct ieee80211_hw *dev, struct sk_buff *skb)
 
                         ni = IEEE80211_SKB_CB(entry->next);
                         mr = (struct p54_tx_info *)ni->rate_driver_data;
-                        freed = mr->start_addr - last_addr;
-                } else
-                        freed = priv->rx_end - last_addr;
+                }
 
-                last_addr = range->end_addr;
                 __skb_unlink(entry, &priv->tx_queue);
                 spin_unlock_irqrestore(&priv->tx_queue.lock, flags);
 
@@ -1010,9 +997,7 @@ static void p54_rx_frame_sent(struct ieee80211_hw *dev, struct sk_buff *skb)
         spin_unlock_irqrestore(&priv->tx_queue.lock, flags);
 
 out:
-        if (freed >= priv->headroom + sizeof(struct p54_hdr) + 48 +
-                     IEEE80211_MAX_RTS_THRESHOLD + priv->tailroom)
-                p54_wake_free_queues(dev);
+        p54_wake_free_queues(dev);
 }
 
 static void p54_rx_eeprom_readback(struct ieee80211_hw *dev,
@@ -2204,41 +2189,6 @@ out:
         return ret;
 }
 
-static int p54_config_interface(struct ieee80211_hw *dev,
-                                struct ieee80211_vif *vif,
-                                struct ieee80211_if_conf *conf)
-{
-        struct p54_common *priv = dev->priv;
-        int ret = 0;
-
-        mutex_lock(&priv->conf_mutex);
-        if (conf->changed & IEEE80211_IFCC_BSSID) {
-                memcpy(priv->bssid, conf->bssid, ETH_ALEN);
-                ret = p54_setup_mac(dev);
-                if (ret)
-                        goto out;
-        }
-
-        if (conf->changed & IEEE80211_IFCC_BEACON) {
-                ret = p54_scan(dev, P54_SCAN_EXIT, 0);
-                if (ret)
-                        goto out;
-                ret = p54_setup_mac(dev);
-                if (ret)
-                        goto out;
-                ret = p54_beacon_update(dev, vif);
-                if (ret)
-                        goto out;
-                ret = p54_set_edcf(dev);
-                if (ret)
-                        goto out;
-        }
-
-out:
-        mutex_unlock(&priv->conf_mutex);
-        return ret;
-}
-
 static void p54_configure_filter(struct ieee80211_hw *dev,
                                  unsigned int changed_flags,
                                  unsigned int *total_flags,
@@ -2342,8 +2292,32 @@ static void p54_bss_info_changed(struct ieee80211_hw *dev,
                                  u32 changed)
 {
         struct p54_common *priv = dev->priv;
+        int ret;
+
+        mutex_lock(&priv->conf_mutex);
+        if (changed & BSS_CHANGED_BSSID) {
+                memcpy(priv->bssid, info->bssid, ETH_ALEN);
+                ret = p54_setup_mac(dev);
+                if (ret)
+                        goto out;
+        }
+
+        if (changed & BSS_CHANGED_BEACON) {
+                ret = p54_scan(dev, P54_SCAN_EXIT, 0);
+                if (ret)
+                        goto out;
+                ret = p54_setup_mac(dev);
+                if (ret)
+                        goto out;
+                ret = p54_beacon_update(dev, vif);
+                if (ret)
+                        goto out;
+        }
+        /* XXX: this mimics having two callbacks... clean up */
+ out:
+        mutex_unlock(&priv->conf_mutex);
 
-        if (changed & BSS_CHANGED_ERP_SLOT) {
+        if (changed & (BSS_CHANGED_ERP_SLOT | BSS_CHANGED_BEACON)) {
                 priv->use_short_slot = info->use_short_slot;
                 p54_set_edcf(dev);
         }
@@ -2364,7 +2338,6 @@ static void p54_bss_info_changed(struct ieee80211_hw *dev,
                         p54_setup_mac(dev);
                 }
         }
-
 }
 
 static int p54_set_key(struct ieee80211_hw *dev, enum set_key_cmd cmd,
@@ -2619,7 +2592,6 @@ static const struct ieee80211_ops p54_ops = {
         .sta_notify             = p54_sta_notify,
         .set_key                = p54_set_key,
         .config                 = p54_config,
-        .config_interface       = p54_config_interface,
         .bss_info_changed       = p54_bss_info_changed,
         .configure_filter       = p54_configure_filter,
         .conf_tx                = p54_conf_tx,
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index 6cc6cbc9234f..f40c0f468b27 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -81,6 +81,29 @@ static struct usb_device_id p54u_table[] __devinitdata = {
 
 MODULE_DEVICE_TABLE(usb, p54u_table);
 
+static const struct {
+        u32 intf;
+        enum p54u_hw_type type;
+        char fw[FIRMWARE_NAME_MAX];
+        char fw_legacy[FIRMWARE_NAME_MAX];
+        char hw[20];
+} p54u_fwlist[__NUM_P54U_HWTYPES] = {
+        {
+                .type = P54U_NET2280,
+                .intf = FW_LM86,
+                .fw = "isl3886usb",
+                .fw_legacy = "isl3890usb",
+                .hw = "ISL3886 + net2280",
+        },
+        {
+                .type = P54U_3887,
+                .intf = FW_LM87,
+                .fw = "isl3887usb",
+                .fw_legacy = "isl3887usb_bare",
+                .hw = "ISL3887",
+        },
+};
+
 static void p54u_rx_cb(struct urb *urb)
 {
         struct sk_buff *skb = (struct sk_buff *) urb->context;
@@ -125,11 +148,7 @@ static void p54u_rx_cb(struct urb *urb)
                 }
                 skb_reset_tail_pointer(skb);
                 skb_trim(skb, 0);
-                if (urb->transfer_buffer != skb_tail_pointer(skb)) {
-                        /* this should not happen */
-                        WARN_ON(1);
-                        urb->transfer_buffer = skb_tail_pointer(skb);
-                }
+                urb->transfer_buffer = skb_tail_pointer(skb);
         }
         skb_queue_tail(&priv->rx_queue, skb);
         usb_anchor_urb(urb, &priv->submitted);
@@ -206,53 +225,6 @@ static int p54u_init_urbs(struct ieee80211_hw *dev)
         return ret;
 }
 
-static void p54u_tx_3887(struct ieee80211_hw *dev, struct sk_buff *skb)
-{
-        struct p54u_priv *priv = dev->priv;
-        struct urb *addr_urb, *data_urb;
-        int err = 0;
-
-        addr_urb = usb_alloc_urb(0, GFP_ATOMIC);
-        if (!addr_urb)
-                return;
-
-        data_urb = usb_alloc_urb(0, GFP_ATOMIC);
-        if (!data_urb) {
-                usb_free_urb(addr_urb);
-                return;
-        }
-
-        usb_fill_bulk_urb(addr_urb, priv->udev,
-                          usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA),
-                          &((struct p54_hdr *)skb->data)->req_id, 4,
-                          p54u_tx_dummy_cb, dev);
-        usb_fill_bulk_urb(data_urb, priv->udev,
-                          usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA),
-                          skb->data, skb->len, FREE_AFTER_TX(skb) ?
-                          p54u_tx_cb : p54u_tx_dummy_cb, skb);
-        addr_urb->transfer_flags |= URB_ZERO_PACKET;
-        data_urb->transfer_flags |= URB_ZERO_PACKET;
-
-        usb_anchor_urb(addr_urb, &priv->submitted);
-        err = usb_submit_urb(addr_urb, GFP_ATOMIC);
-        if (err) {
-                usb_unanchor_urb(addr_urb);
-                goto out;
-        }
-
-        usb_anchor_urb(data_urb, &priv->submitted);
-        err = usb_submit_urb(data_urb, GFP_ATOMIC);
-        if (err)
-                usb_unanchor_urb(data_urb);
-
- out:
-        usb_free_urb(addr_urb);
-        usb_free_urb(data_urb);
-
-        if (err)
-                p54_free_skb(dev, skb);
-}
-
 static __le32 p54u_lm87_chksum(const __le32 *data, size_t length)
 {
         u32 chk = 0;
@@ -425,20 +397,16 @@ static int p54u_bulk_msg(struct p54u_priv *priv, unsigned int ep,
                             data, len, &alen, 2000);
 }
 
-static const char p54u_romboot_3887[] = "~~~~";
-static const char p54u_firmware_upload_3887[] = "<\r";
-
-static int p54u_device_reset_3887(struct ieee80211_hw *dev)
+static int p54u_device_reset(struct ieee80211_hw *dev)
 {
         struct p54u_priv *priv = dev->priv;
         int ret, lock = (priv->intf->condition != USB_INTERFACE_BINDING);
-        u8 buf[4];
 
         if (lock) {
                 ret = usb_lock_device_for_reset(priv->udev, priv->intf);
                 if (ret < 0) {
                         dev_err(&priv->udev->dev, "(p54usb) unable to lock "
-                                " device for reset: %d\n", ret);
+                                "device for reset (%d)!\n", ret);
                         return ret;
                 }
         }
@@ -447,26 +415,34 @@ static int p54u_device_reset_3887(struct ieee80211_hw *dev)
         if (lock)
                 usb_unlock_device(priv->udev);
 
-        if (ret) {
+        if (ret)
                 dev_err(&priv->udev->dev, "(p54usb) unable to reset "
-                        "device: %d\n", ret);
-                return ret;
-        }
+                        "device (%d)!\n", ret);
+
+        return ret;
+}
+
+static const char p54u_romboot_3887[] = "~~~~";
+static int p54u_firmware_reset_3887(struct ieee80211_hw *dev)
+{
+        struct p54u_priv *priv = dev->priv;
+        u8 buf[4];
+        int ret;
 
         memcpy(&buf, p54u_romboot_3887, sizeof(buf));
         ret = p54u_bulk_msg(priv, P54U_PIPE_DATA,
                             buf, sizeof(buf));
         if (ret)
                 dev_err(&priv->udev->dev, "(p54usb) unable to jump to "
-                        "boot ROM: %d\n", ret);
+                        "boot ROM (%d)!\n", ret);
 
         return ret;
 }
 
+static const char p54u_firmware_upload_3887[] = "<\r";
 static int p54u_upload_firmware_3887(struct ieee80211_hw *dev)
 {
         struct p54u_priv *priv = dev->priv;
-        const struct firmware *fw_entry = NULL;
         int err, alen;
         u8 carry = 0;
         u8 *buf, *tmp;
@@ -475,51 +451,29 @@ static int p54u_upload_firmware_3887(struct ieee80211_hw *dev)
         struct x2_header *hdr;
         unsigned long timeout;
 
+        err = p54u_firmware_reset_3887(dev);
+        if (err)
+                return err;
+
         tmp = buf = kmalloc(P54U_FW_BLOCK, GFP_KERNEL);
         if (!buf) {
                 dev_err(&priv->udev->dev, "(p54usb) cannot allocate firmware"
                                           "upload buffer!\n");
-                err = -ENOMEM;
-                goto err_bufalloc;
-        }
-
-        err = p54u_device_reset_3887(dev);
-        if (err)
-                goto err_reset;
-
-        err = request_firmware(&fw_entry, "isl3887usb", &priv->udev->dev);
-        if (err) {
-                dev_err(&priv->udev->dev, "p54usb: cannot find firmware "
-                                          "(isl3887usb)\n");
-                err = request_firmware(&fw_entry, "isl3887usb_bare",
-                        &priv->udev->dev);
-                if (err)
-                        goto err_req_fw_failed;
-        }
-
-        err = p54_parse_firmware(dev, fw_entry);
-        if (err)
-                goto err_upload_failed;
-
-        if (priv->common.fw_interface != FW_LM87) {
-                dev_err(&priv->udev->dev, "wrong firmware, "
-                        "please get a LM87 firmware and try again.\n");
-                err = -EINVAL;
-                goto err_upload_failed;
+                return -ENOMEM;
         }
 
-        left = block_size = min((size_t)P54U_FW_BLOCK, fw_entry->size);
+        left = block_size = min((size_t)P54U_FW_BLOCK, priv->fw->size);
         strcpy(buf, p54u_firmware_upload_3887);
         left -= strlen(p54u_firmware_upload_3887);
         tmp += strlen(p54u_firmware_upload_3887);
 
-        data = fw_entry->data;
-        remains = fw_entry->size;
+        data = priv->fw->data;
+        remains = priv->fw->size;
 
         hdr = (struct x2_header *)(buf + strlen(p54u_firmware_upload_3887));
         memcpy(hdr->signature, X2_SIGNATURE, X2_SIGNATURE_SIZE);
         hdr->fw_load_addr = cpu_to_le32(ISL38XX_DEV_FIRMWARE_ADDR);
-        hdr->fw_length = cpu_to_le32(fw_entry->size);
+        hdr->fw_length = cpu_to_le32(priv->fw->size);
         hdr->crc = cpu_to_le32(~crc32_le(~0, (void *)&hdr->fw_load_addr,
                                          sizeof(u32)*2));
         left -= sizeof(*hdr);
@@ -561,7 +515,8 @@ static int p54u_upload_firmware_3887(struct ieee80211_hw *dev)
                 left = block_size = min((unsigned int)P54U_FW_BLOCK, remains);
         }
 
-        *((__le32 *)buf) = cpu_to_le32(~crc32_le(~0, fw_entry->data, fw_entry->size));
+        *((__le32 *)buf) = cpu_to_le32(~crc32_le(~0, priv->fw->data,
+                                                 priv->fw->size));
         err = p54u_bulk_msg(priv, P54U_PIPE_DATA, buf, sizeof(u32));
         if (err) {
                 dev_err(&priv->udev->dev, "(p54usb) firmware upload failed!\n");
@@ -612,19 +567,14 @@ static int p54u_upload_firmware_3887(struct ieee80211_hw *dev)
         if (err)
                 goto err_upload_failed;
 
-  err_upload_failed:
-        release_firmware(fw_entry);
-  err_req_fw_failed:
-  err_reset:
+err_upload_failed:
         kfree(buf);
-  err_bufalloc:
         return err;
 }
 
 static int p54u_upload_firmware_net2280(struct ieee80211_hw *dev)
 {
         struct p54u_priv *priv = dev->priv;
-        const struct firmware *fw_entry = NULL;
         const struct p54p_csr *devreg = (const struct p54p_csr *) P54U_DEV_BASE;
         int err, alen;
         void *buf;
@@ -639,33 +589,6 @@ static int p54u_upload_firmware_net2280(struct ieee80211_hw *dev)
                 return -ENOMEM;
         }
 
-        err = request_firmware(&fw_entry, "isl3886usb", &priv->udev->dev);
-        if (err) {
-                dev_err(&priv->udev->dev, "(p54usb) cannot find firmware "
-                                          "(isl3886usb)\n");
-                err = request_firmware(&fw_entry, "isl3890usb",
-                        &priv->udev->dev);
-                if (err) {
-                        kfree(buf);
-                        return err;
-                        }
-        }
-
-        err = p54_parse_firmware(dev, fw_entry);
-        if (err) {
-                kfree(buf);
-                release_firmware(fw_entry);
-                return err;
-        }
-
-        if (priv->common.fw_interface != FW_LM86) {
-                dev_err(&priv->udev->dev, "wrong firmware, "
-                        "please get a LM86(USB) firmware and try again.\n");
-                kfree(buf);
-                release_firmware(fw_entry);
-                return -EINVAL;
-        }
-
 #define P54U_WRITE(type, addr, data) \
         do {\
                 err = p54u_write(priv, buf, type,\
@@ -765,8 +688,8 @@ static int p54u_upload_firmware_net2280(struct ieee80211_hw *dev)
         P54U_WRITE(NET2280_DEV_U32, &devreg->int_ack, reg);
 
         /* finally, we can upload firmware now! */
-        remains = fw_entry->size;
-        data = fw_entry->data;
+        remains = priv->fw->size;
+        data = priv->fw->data;
         offset = ISL38XX_DEV_FIRMWARE_ADDR;
 
         while (remains) {
@@ -875,12 +798,54 @@ static int p54u_upload_firmware_net2280(struct ieee80211_hw *dev)
 #undef P54U_WRITE
 #undef P54U_READ
 
- fail:
-        release_firmware(fw_entry);
+fail:
         kfree(buf);
         return err;
 }
 
+static int p54u_load_firmware(struct ieee80211_hw *dev)
+{
+        struct p54u_priv *priv = dev->priv;
+        int err, i;
+
+        BUILD_BUG_ON(ARRAY_SIZE(p54u_fwlist) != __NUM_P54U_HWTYPES);
+
+        for (i = 0; i < __NUM_P54U_HWTYPES; i++)
+                if (p54u_fwlist[i].type == priv->hw_type)
+                        break;
+
+        if (i == __NUM_P54U_HWTYPES)
+                return -EOPNOTSUPP;
+
+        err = request_firmware(&priv->fw, p54u_fwlist[i].fw, &priv->udev->dev);
+        if (err) {
+                dev_err(&priv->udev->dev, "(p54usb) cannot load firmware %s "
+                                          "(%d)!\n", p54u_fwlist[i].fw, err);
+
+                err = request_firmware(&priv->fw, p54u_fwlist[i].fw_legacy,
+                                       &priv->udev->dev);
+                if (err)
+                        return err;
+        }
+
+        err = p54_parse_firmware(dev, priv->fw);
+        if (err)
+                goto out;
+
+        if (priv->common.fw_interface != p54u_fwlist[i].intf) {
+                dev_err(&priv->udev->dev, "wrong firmware, please get "
+                        "a firmware for \"%s\" and try again.\n",
+                        p54u_fwlist[i].hw);
+                err = -EINVAL;
+        }
+
+out:
+        if (err)
+                release_firmware(priv->fw);
+
+        return err;
+}
+
 static int p54u_open(struct ieee80211_hw *dev)
 {
         struct p54u_priv *priv = dev->priv;
@@ -922,6 +887,7 @@ static int __devinit p54u_probe(struct usb_interface *intf,
         }
 
         priv = dev->priv;
+        priv->hw_type = P54U_INVALID_HW;
 
         SET_IEEE80211_DEV(dev, &intf->dev);
         usb_set_intfdata(intf, dev);
@@ -953,37 +919,48 @@ static int __devinit p54u_probe(struct usb_interface *intf,
         priv->common.open = p54u_open;
         priv->common.stop = p54u_stop;
         if (recognized_pipes < P54U_PIPE_NUMBER) {
+#ifdef CONFIG_PM
+                /* ISL3887 needs a full reset on resume */
+                udev->reset_resume = 1;
+                err = p54u_device_reset(dev);
+#endif
+
                 priv->hw_type = P54U_3887;
-                err = p54u_upload_firmware_3887(dev);
-                if (priv->common.fw_interface == FW_LM87) {
-                        dev->extra_tx_headroom += sizeof(struct lm87_tx_hdr);
-                        priv->common.tx_hdr_len = sizeof(struct lm87_tx_hdr);
-                        priv->common.tx = p54u_tx_lm87;
-                } else
-                        priv->common.tx = p54u_tx_3887;
+                dev->extra_tx_headroom += sizeof(struct lm87_tx_hdr);
+                priv->common.tx_hdr_len = sizeof(struct lm87_tx_hdr);
+                priv->common.tx = p54u_tx_lm87;
+                priv->upload_fw = p54u_upload_firmware_3887;
         } else {
                 priv->hw_type = P54U_NET2280;
                 dev->extra_tx_headroom += sizeof(struct net2280_tx_hdr);
                 priv->common.tx_hdr_len = sizeof(struct net2280_tx_hdr);
                 priv->common.tx = p54u_tx_net2280;
-                err = p54u_upload_firmware_net2280(dev);
+                priv->upload_fw = p54u_upload_firmware_net2280;
         }
+        err = p54u_load_firmware(dev);
         if (err)
                 goto err_free_dev;
 
+        err = priv->upload_fw(dev);
+        if (err)
+                goto err_free_fw;
+
         p54u_open(dev);
         err = p54_read_eeprom(dev);
         p54u_stop(dev);
         if (err)
-                goto err_free_dev;
+                goto err_free_fw;
 
         err = p54_register_common(dev, &udev->dev);
         if (err)
-                goto err_free_dev;
+                goto err_free_fw;
 
         return 0;
 
- err_free_dev:
+err_free_fw:
+        release_firmware(priv->fw);
+
+err_free_dev:
         ieee80211_free_hw(dev);
         usb_set_intfdata(intf, NULL);
         usb_put_dev(udev);
@@ -1002,20 +979,64 @@ static void __devexit p54u_disconnect(struct usb_interface *intf)
 
         priv = dev->priv;
         usb_put_dev(interface_to_usbdev(intf));
+        release_firmware(priv->fw);
         p54_free_common(dev);
         ieee80211_free_hw(dev);
 }
 
 static int p54u_pre_reset(struct usb_interface *intf)
 {
+        struct ieee80211_hw *dev = usb_get_intfdata(intf);
+
+        if (!dev)
+                return -ENODEV;
+
+        p54u_stop(dev);
         return 0;
 }
 
+static int p54u_resume(struct usb_interface *intf)
+{
+        struct ieee80211_hw *dev = usb_get_intfdata(intf);
+        struct p54u_priv *priv;
+
+        if (!dev)
+                return -ENODEV;
+
+        priv = dev->priv;
+        if (unlikely(!(priv->upload_fw && priv->fw)))
+                return 0;
+
+        return priv->upload_fw(dev);
+}
+
 static int p54u_post_reset(struct usb_interface *intf)
 {
+        struct ieee80211_hw *dev = usb_get_intfdata(intf);
+        struct p54u_priv *priv;
+        int err;
+
+        err = p54u_resume(intf);
+        if (err)
+                return err;
+
+        /* reinitialize old device state */
+        priv = dev->priv;
+        if (priv->common.mode != NL80211_IFTYPE_UNSPECIFIED)
+                ieee80211_restart_hw(dev);
+
         return 0;
 }
 
+#ifdef CONFIG_PM
+
+static int p54u_suspend(struct usb_interface *intf, pm_message_t message)
+{
+        return p54u_pre_reset(intf);
+}
+
+#endif /* CONFIG_PM */
+
 static struct usb_driver p54u_driver = {
         .name   = "p54usb",
         .id_table = p54u_table,
@@ -1023,6 +1044,11 @@ static struct usb_driver p54u_driver = {
         .disconnect = p54u_disconnect,
         .pre_reset = p54u_pre_reset,
         .post_reset = p54u_post_reset,
+#ifdef CONFIG_PM
+        .suspend = p54u_suspend,
+        .resume = p54u_resume,
+        .reset_resume = p54u_resume,
+#endif /* CONFIG_PM */
         .soft_unbind = 1,
 };
 
diff --git a/drivers/net/wireless/p54/p54usb.h b/drivers/net/wireless/p54/p54usb.h
index 8bc58982d8dd..e935b79f7f75 100644
--- a/drivers/net/wireless/p54/p54usb.h
+++ b/drivers/net/wireless/p54/p54usb.h
@@ -123,18 +123,26 @@ struct p54u_rx_info {
         struct ieee80211_hw *dev;
 };
 
+enum p54u_hw_type {
+        P54U_INVALID_HW,
+        P54U_NET2280,
+        P54U_3887,
+
+        /* keep last */
+        __NUM_P54U_HWTYPES,
+};
+
 struct p54u_priv {
         struct p54_common common;
         struct usb_device *udev;
         struct usb_interface *intf;
-        enum {
-                P54U_NET2280 = 0,
-                P54U_3887
-        } hw_type;
+        int (*upload_fw)(struct ieee80211_hw *dev);
 
+        enum p54u_hw_type hw_type;
         spinlock_t lock;
         struct sk_buff_head rx_queue;
         struct usb_anchor submitted;
+        const struct firmware *fw;
 };
 
 #endif /* P54USB_H */
diff --git a/drivers/net/wireless/rt2x00/Kconfig b/drivers/net/wireless/rt2x00/Kconfig
index bfc5d9cf716e..18ee7d6c4028 100644
--- a/drivers/net/wireless/rt2x00/Kconfig
+++ b/drivers/net/wireless/rt2x00/Kconfig
@@ -77,6 +77,20 @@ config RT73USB
 
           When compiled as a module, this driver will be called "rt73usb.ko".
 
+config RT2800USB
+        tristate "Ralink rt2800 (USB) support"
+        depends on USB
+        select RT2X00_LIB_USB
+        select RT2X00_LIB_HT
+        select RT2X00_LIB_FIRMWARE
+        select RT2X00_LIB_CRYPTO
+        select CRC_CCITT
+        ---help---
+          This adds support for rt2800 wireless chipset family.
+          Supported chips: RT2770, RT2870 & RT3070.
+
+          When compiled as a module, this driver will be called "rt2800usb.ko".
+
 config RT2X00_LIB_PCI
         tristate
         select RT2X00_LIB
@@ -88,6 +102,9 @@ config RT2X00_LIB_USB
 config RT2X00_LIB
         tristate
 
+config RT2X00_LIB_HT
+        boolean
+
 config RT2X00_LIB_FIRMWARE
         boolean
         select FW_LOADER
diff --git a/drivers/net/wireless/rt2x00/Makefile b/drivers/net/wireless/rt2x00/Makefile
index f22d808d8c51..bfc7226f0afe 100644
--- a/drivers/net/wireless/rt2x00/Makefile
+++ b/drivers/net/wireless/rt2x00/Makefile
@@ -8,6 +8,7 @@ rt2x00lib-$(CONFIG_RT2X00_LIB_CRYPTO)	+= rt2x00crypto.o
 rt2x00lib-$(CONFIG_RT2X00_LIB_RFKILL)   += rt2x00rfkill.o
 rt2x00lib-$(CONFIG_RT2X00_LIB_FIRMWARE) += rt2x00firmware.o
 rt2x00lib-$(CONFIG_RT2X00_LIB_LEDS)     += rt2x00leds.o
+rt2x00lib-$(CONFIG_RT2X00_LIB_HT)       += rt2x00ht.o
 
 obj-$(CONFIG_RT2X00_LIB)                += rt2x00lib.o
 obj-$(CONFIG_RT2X00_LIB_PCI)            += rt2x00pci.o
@@ -17,3 +18,4 @@ obj-$(CONFIG_RT2500PCI)			+= rt2500pci.o
 obj-$(CONFIG_RT61PCI)                   += rt61pci.o
 obj-$(CONFIG_RT2500USB)                 += rt2500usb.o
 obj-$(CONFIG_RT73USB)                   += rt73usb.o
+obj-$(CONFIG_RT2800USB)                 += rt2800usb.o
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.c b/drivers/net/wireless/rt2x00/rt2400pci.c
index 411eb9cbb4e5..6f39ba662188 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.c
+++ b/drivers/net/wireless/rt2x00/rt2400pci.c
@@ -1580,7 +1580,6 @@ static const struct ieee80211_ops rt2400pci_mac80211_ops = {
         .add_interface          = rt2x00mac_add_interface,
         .remove_interface       = rt2x00mac_remove_interface,
         .config                 = rt2x00mac_config,
-        .config_interface       = rt2x00mac_config_interface,
         .configure_filter       = rt2x00mac_configure_filter,
         .get_stats              = rt2x00mac_get_stats,
         .bss_info_changed       = rt2x00mac_bss_info_changed,
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index e1be67ca23d8..906960f67b6c 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -1879,7 +1879,6 @@ static const struct ieee80211_ops rt2500pci_mac80211_ops = {
         .add_interface          = rt2x00mac_add_interface,
         .remove_interface       = rt2x00mac_remove_interface,
         .config                 = rt2x00mac_config,
-        .config_interface       = rt2x00mac_config_interface,
         .configure_filter       = rt2x00mac_configure_filter,
         .get_stats              = rt2x00mac_get_stats,
         .bss_info_changed       = rt2x00mac_bss_info_changed,
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index 9e630e70fc97..1debb88bc60e 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -1559,7 +1559,7 @@ static int rt2500usb_init_eeprom(struct rt2x00_dev *rt2x00dev)
         rt2500usb_register_read(rt2x00dev, MAC_CSR0, &reg);
         rt2x00_set_chip(rt2x00dev, RT2570, value, reg);
 
-        if (!rt2x00_check_rev(&rt2x00dev->chip, 0)) {
+        if (!rt2x00_check_rev(&rt2x00dev->chip, 0x000ffff0, 0)) {
                 ERROR(rt2x00dev, "Invalid RT chipset detected.\n");
                 return -ENODEV;
         }
@@ -1908,7 +1908,6 @@ static const struct ieee80211_ops rt2500usb_mac80211_ops = {
         .add_interface          = rt2x00mac_add_interface,
         .remove_interface       = rt2x00mac_remove_interface,
         .config                 = rt2x00mac_config,
-        .config_interface       = rt2x00mac_config_interface,
         .configure_filter       = rt2x00mac_configure_filter,
         .set_key                = rt2x00mac_set_key,
         .get_stats              = rt2x00mac_get_stats,
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
new file mode 100644
index 000000000000..257bfb5483c9
--- /dev/null
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -0,0 +1,3071 @@
+/*
+        Copyright (C) 2004 - 2009 rt2x00 SourceForge Project
+        <http://rt2x00.serialmonkey.com>
+
+        This program is free software; you can redistribute it and/or modify
+        it under the terms of the GNU General Public License as published by
+        the Free Software Foundation; either version 2 of the License, or
+        (at your option) any later version.
+
+        This program is distributed in the hope that it will be useful,
+        but WITHOUT ANY WARRANTY; without even the implied warranty of
+        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+        GNU General Public License for more details.
+
+        You should have received a copy of the GNU General Public License
+        along with this program; if not, write to the
+        Free Software Foundation, Inc.,
+        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+/*
+        Module: rt2800usb
+        Abstract: rt2800usb device specific routines.
+        Supported chipsets: RT2800U.
+ */
+
+#include <linux/crc-ccitt.h>
+#include <linux/delay.h>
+#include <linux/etherdevice.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/usb.h>
+
+#include "rt2x00.h"
+#include "rt2x00usb.h"
+#include "rt2800usb.h"
+
+/*
+ * Allow hardware encryption to be disabled.
+ */
+static int modparam_nohwcrypt = 1;
+module_param_named(nohwcrypt, modparam_nohwcrypt, bool, S_IRUGO);
+MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
+
+/*
+ * Register access.
+ * All access to the CSR registers will go through the methods
+ * rt2x00usb_register_read and rt2x00usb_register_write.
+ * BBP and RF register require indirect register access,
+ * and use the CSR registers BBPCSR and RFCSR to achieve this.
+ * These indirect registers work with busy bits,
+ * and we will try maximal REGISTER_BUSY_COUNT times to access
+ * the register while taking a REGISTER_BUSY_DELAY us delay
+ * between each attampt. When the busy bit is still set at that time,
+ * the access attempt is considered to have failed,
+ * and we will print an error.
+ * The _lock versions must be used if you already hold the csr_mutex
+ */
+#define WAIT_FOR_BBP(__dev, __reg) \
+        rt2x00usb_regbusy_read((__dev), BBP_CSR_CFG, BBP_CSR_CFG_BUSY, (__reg))
+#define WAIT_FOR_RFCSR(__dev, __reg) \
+        rt2x00usb_regbusy_read((__dev), RF_CSR_CFG, RF_CSR_CFG_BUSY, (__reg))
+#define WAIT_FOR_RF(__dev, __reg) \
+        rt2x00usb_regbusy_read((__dev), RF_CSR_CFG0, RF_CSR_CFG0_BUSY, (__reg))
+#define WAIT_FOR_MCU(__dev, __reg) \
+        rt2x00usb_regbusy_read((__dev), H2M_MAILBOX_CSR, \
+                               H2M_MAILBOX_CSR_OWNER, (__reg))
+
+static void rt2800usb_bbp_write(struct rt2x00_dev *rt2x00dev,
+                                const unsigned int word, const u8 value)
+{
+        u32 reg;
+
+        mutex_lock(&rt2x00dev->csr_mutex);
+
+        /*
+         * Wait until the BBP becomes available, afterwards we
+         * can safely write the new data into the register.
+         */
+        if (WAIT_FOR_BBP(rt2x00dev, &reg)) {
+                reg = 0;
+                rt2x00_set_field32(&reg, BBP_CSR_CFG_VALUE, value);
+                rt2x00_set_field32(&reg, BBP_CSR_CFG_REGNUM, word);
+                rt2x00_set_field32(&reg, BBP_CSR_CFG_BUSY, 1);
+                rt2x00_set_field32(&reg, BBP_CSR_CFG_READ_CONTROL, 0);
+
+                rt2x00usb_register_write_lock(rt2x00dev, BBP_CSR_CFG, reg);
+        }
+
+        mutex_unlock(&rt2x00dev->csr_mutex);
+}
+
+static void rt2800usb_bbp_read(struct rt2x00_dev *rt2x00dev,
+                               const unsigned int word, u8 *value)
+{
+        u32 reg;
+
+        mutex_lock(&rt2x00dev->csr_mutex);
+
+        /*
+         * Wait until the BBP becomes available, afterwards we
+         * can safely write the read request into the register.
+         * After the data has been written, we wait until hardware
+         * returns the correct value, if at any time the register
+         * doesn't become available in time, reg will be 0xffffffff
+         * which means we return 0xff to the caller.
+         */
+        if (WAIT_FOR_BBP(rt2x00dev, &reg)) {
+                reg = 0;
+                rt2x00_set_field32(&reg, BBP_CSR_CFG_REGNUM, word);
+                rt2x00_set_field32(&reg, BBP_CSR_CFG_BUSY, 1);
+                rt2x00_set_field32(&reg, BBP_CSR_CFG_READ_CONTROL, 1);
+
+                rt2x00usb_register_write_lock(rt2x00dev, BBP_CSR_CFG, reg);
+
+                WAIT_FOR_BBP(rt2x00dev, &reg);
+        }
+
+        *value = rt2x00_get_field32(reg, BBP_CSR_CFG_VALUE);
+
+        mutex_unlock(&rt2x00dev->csr_mutex);
+}
+
+static void rt2800usb_rfcsr_write(struct rt2x00_dev *rt2x00dev,
+                                  const unsigned int word, const u8 value)
+{
+        u32 reg;
+
+        mutex_lock(&rt2x00dev->csr_mutex);
+
+        /*
+         * Wait until the RFCSR becomes available, afterwards we
+         * can safely write the new data into the register.
+         */
+        if (WAIT_FOR_RFCSR(rt2x00dev, &reg)) {
+                reg = 0;
+                rt2x00_set_field32(&reg, RF_CSR_CFG_DATA, value);
+                rt2x00_set_field32(&reg, RF_CSR_CFG_REGNUM, word);
+                rt2x00_set_field32(&reg, RF_CSR_CFG_WRITE, 1);
+                rt2x00_set_field32(&reg, RF_CSR_CFG_BUSY, 1);
+
+                rt2x00usb_register_write_lock(rt2x00dev, RF_CSR_CFG, reg);
+        }
+
+        mutex_unlock(&rt2x00dev->csr_mutex);
+}
+
+static void rt2800usb_rfcsr_read(struct rt2x00_dev *rt2x00dev,
+                                 const unsigned int word, u8 *value)
+{
+        u32 reg;
+
+        mutex_lock(&rt2x00dev->csr_mutex);
+
+        /*
+         * Wait until the RFCSR becomes available, afterwards we
+         * can safely write the read request into the register.
+         * After the data has been written, we wait until hardware
+         * returns the correct value, if at any time the register
+         * doesn't become available in time, reg will be 0xffffffff
+         * which means we return 0xff to the caller.
+         */
+        if (WAIT_FOR_RFCSR(rt2x00dev, &reg)) {
+                reg = 0;
+                rt2x00_set_field32(&reg, RF_CSR_CFG_REGNUM, word);
+                rt2x00_set_field32(&reg, RF_CSR_CFG_WRITE, 0);
+                rt2x00_set_field32(&reg, RF_CSR_CFG_BUSY, 1);
+
+                rt2x00usb_register_write_lock(rt2x00dev, BBP_CSR_CFG, reg);
+
+                WAIT_FOR_RFCSR(rt2x00dev, &reg);
+        }
+
+        *value = rt2x00_get_field32(reg, RF_CSR_CFG_DATA);
+
+        mutex_unlock(&rt2x00dev->csr_mutex);
+}
+
+static void rt2800usb_rf_write(struct rt2x00_dev *rt2x00dev,
+                               const unsigned int word, const u32 value)
+{
+        u32 reg;
+
+        mutex_lock(&rt2x00dev->csr_mutex);
+
+        /*
+         * Wait until the RF becomes available, afterwards we
+         * can safely write the new data into the register.
+         */
+        if (WAIT_FOR_RF(rt2x00dev, &reg)) {
+                reg = 0;
+                rt2x00_set_field32(&reg, RF_CSR_CFG0_REG_VALUE_BW, value);
+                rt2x00_set_field32(&reg, RF_CSR_CFG0_STANDBYMODE, 0);
+                rt2x00_set_field32(&reg, RF_CSR_CFG0_SEL, 0);
+                rt2x00_set_field32(&reg, RF_CSR_CFG0_BUSY, 1);
+
+                rt2x00usb_register_write_lock(rt2x00dev, RF_CSR_CFG0, reg);
+                rt2x00_rf_write(rt2x00dev, word, value);
+        }
+
+        mutex_unlock(&rt2x00dev->csr_mutex);
+}
+
+static void rt2800usb_mcu_request(struct rt2x00_dev *rt2x00dev,
+                                  const u8 command, const u8 token,
+                                  const u8 arg0, const u8 arg1)
+{
+        u32 reg;
+
+        mutex_lock(&rt2x00dev->csr_mutex);
+
+        /*
+         * Wait until the MCU becomes available, afterwards we
+         * can safely write the new data into the register.
+         */
+        if (WAIT_FOR_MCU(rt2x00dev, &reg)) {
+                rt2x00_set_field32(&reg, H2M_MAILBOX_CSR_OWNER, 1);
+                rt2x00_set_field32(&reg, H2M_MAILBOX_CSR_CMD_TOKEN, token);
+                rt2x00_set_field32(&reg, H2M_MAILBOX_CSR_ARG0, arg0);
+                rt2x00_set_field32(&reg, H2M_MAILBOX_CSR_ARG1, arg1);
+                rt2x00usb_register_write_lock(rt2x00dev, H2M_MAILBOX_CSR, reg);
+
+                reg = 0;
+                rt2x00_set_field32(&reg, HOST_CMD_CSR_HOST_COMMAND, command);
+                rt2x00usb_register_write_lock(rt2x00dev, HOST_CMD_CSR, reg);
+        }
+
+        mutex_unlock(&rt2x00dev->csr_mutex);
+}
+
+#ifdef CONFIG_RT2X00_LIB_DEBUGFS
+static const struct rt2x00debug rt2800usb_rt2x00debug = {
+        .owner  = THIS_MODULE,
+        .csr    = {
+                .read           = rt2x00usb_register_read,
+                .write          = rt2x00usb_register_write,
+                .flags          = RT2X00DEBUGFS_OFFSET,
+                .word_base      = CSR_REG_BASE,
+                .word_size      = sizeof(u32),
+                .word_count     = CSR_REG_SIZE / sizeof(u32),
+        },
+        .eeprom = {
+                .read           = rt2x00_eeprom_read,
+                .write          = rt2x00_eeprom_write,
+                .word_base      = EEPROM_BASE,
+                .word_size      = sizeof(u16),
+                .word_count     = EEPROM_SIZE / sizeof(u16),
+        },
+        .bbp    = {
+                .read           = rt2800usb_bbp_read,
+                .write          = rt2800usb_bbp_write,
+                .word_base      = BBP_BASE,
+                .word_size      = sizeof(u8),
+                .word_count     = BBP_SIZE / sizeof(u8),
+        },
+        .rf     = {
+                .read           = rt2x00_rf_read,
+                .write          = rt2800usb_rf_write,
+                .word_base      = RF_BASE,
+                .word_size      = sizeof(u32),
+                .word_count     = RF_SIZE / sizeof(u32),
+        },
+};
+#endif /* CONFIG_RT2X00_LIB_DEBUGFS */
+
+#ifdef CONFIG_RT2X00_LIB_RFKILL
+static int rt2800usb_rfkill_poll(struct rt2x00_dev *rt2x00dev)
+{
+        u32 reg;
+
+        rt2x00usb_register_read(rt2x00dev, GPIO_CTRL_CFG, &reg);
+        return rt2x00_get_field32(reg, GPIO_CTRL_CFG_BIT2);
+}
+#else
+#define rt2800usb_rfkill_poll   NULL
+#endif /* CONFIG_RT2X00_LIB_RFKILL */
+
+#ifdef CONFIG_RT2X00_LIB_LEDS
+static void rt2800usb_brightness_set(struct led_classdev *led_cdev,
+                                     enum led_brightness brightness)
+{
+        struct rt2x00_led *led =
+            container_of(led_cdev, struct rt2x00_led, led_dev);
+        unsigned int enabled = brightness != LED_OFF;
+        unsigned int bg_mode =
+            (enabled && led->rt2x00dev->curr_band == IEEE80211_BAND_2GHZ);
+        unsigned int polarity =
+                rt2x00_get_field16(led->rt2x00dev->led_mcu_reg,
+                                   EEPROM_FREQ_LED_POLARITY);
+        unsigned int ledmode =
+                rt2x00_get_field16(led->rt2x00dev->led_mcu_reg,
+                                   EEPROM_FREQ_LED_MODE);
+
+        if (led->type == LED_TYPE_RADIO) {
+                rt2800usb_mcu_request(led->rt2x00dev, MCU_LED, 0xff, ledmode,
+                                      enabled ? 0x20 : 0);
+        } else if (led->type == LED_TYPE_ASSOC) {
+                rt2800usb_mcu_request(led->rt2x00dev, MCU_LED, 0xff, ledmode,
+                                      enabled ? (bg_mode ? 0x60 : 0xa0) : 0x20);
+        } else if (led->type == LED_TYPE_QUALITY) {
+                /*
+                 * The brightness is divided into 6 levels (0 - 5),
+                 * The specs tell us the following levels:
+                 *      0, 1 ,3, 7, 15, 31
+                 * to determine the level in a simple way we can simply
+                 * work with bitshifting:
+                 *      (1 << level) - 1
+                 */
+                rt2800usb_mcu_request(led->rt2x00dev, MCU_LED_STRENGTH, 0xff,
+                                      (1 << brightness / (LED_FULL / 6)) - 1,
+                                      polarity);
+        }
+}
+
+static int rt2800usb_blink_set(struct led_classdev *led_cdev,
+                               unsigned long *delay_on,
+                               unsigned long *delay_off)
+{
+        struct rt2x00_led *led =
+            container_of(led_cdev, struct rt2x00_led, led_dev);
+        u32 reg;
+
+        rt2x00usb_register_read(led->rt2x00dev, LED_CFG, &reg);
+        rt2x00_set_field32(&reg, LED_CFG_ON_PERIOD, *delay_on);
+        rt2x00_set_field32(&reg, LED_CFG_OFF_PERIOD, *delay_off);
+        rt2x00_set_field32(&reg, LED_CFG_SLOW_BLINK_PERIOD, 3);
+        rt2x00_set_field32(&reg, LED_CFG_R_LED_MODE, 3);
+        rt2x00_set_field32(&reg, LED_CFG_G_LED_MODE, 12);
+        rt2x00_set_field32(&reg, LED_CFG_Y_LED_MODE, 3);
+        rt2x00_set_field32(&reg, LED_CFG_LED_POLAR, 1);
+        rt2x00usb_register_write(led->rt2x00dev, LED_CFG, reg);
+
+        return 0;
+}
+
+static void rt2800usb_init_led(struct rt2x00_dev *rt2x00dev,
+                               struct rt2x00_led *led,
+                               enum led_type type)
+{
+        led->rt2x00dev = rt2x00dev;
+        led->type = type;
+        led->led_dev.brightness_set = rt2800usb_brightness_set;
+        led->led_dev.blink_set = rt2800usb_blink_set;
+        led->flags = LED_INITIALIZED;
+}
+#endif /* CONFIG_RT2X00_LIB_LEDS */
+
+/*
+ * Configuration handlers.
+ */
+static void rt2800usb_config_wcid_attr(struct rt2x00_dev *rt2x00dev,
+                                       struct rt2x00lib_crypto *crypto,
+                                       struct ieee80211_key_conf *key)
+{
+        struct mac_wcid_entry wcid_entry;
+        struct mac_iveiv_entry iveiv_entry;
+        u32 offset;
+        u32 reg;
+
+        offset = MAC_WCID_ATTR_ENTRY(key->hw_key_idx);
+
+        rt2x00usb_register_read(rt2x00dev, offset, &reg);
+        rt2x00_set_field32(&reg, MAC_WCID_ATTRIBUTE_KEYTAB,
+                           !!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE));
+        rt2x00_set_field32(&reg, MAC_WCID_ATTRIBUTE_CIPHER,
+                           (crypto->cmd == SET_KEY) * crypto->cipher);
+        rt2x00_set_field32(&reg, MAC_WCID_ATTRIBUTE_BSS_IDX,
+                           (crypto->cmd == SET_KEY) * crypto->bssidx);
+        rt2x00_set_field32(&reg, MAC_WCID_ATTRIBUTE_RX_WIUDF, crypto->cipher);
+        rt2x00usb_register_write(rt2x00dev, offset, reg);
+
+        offset = MAC_IVEIV_ENTRY(key->hw_key_idx);
+
+        memset(&iveiv_entry, 0, sizeof(iveiv_entry));
+        if ((crypto->cipher == CIPHER_TKIP) ||
+            (crypto->cipher == CIPHER_TKIP_NO_MIC) ||
+            (crypto->cipher == CIPHER_AES))
+                iveiv_entry.iv[3] |= 0x20;
+        iveiv_entry.iv[3] |= key->keyidx << 6;
+        rt2x00usb_register_multiwrite(rt2x00dev, offset,
+                                      &iveiv_entry, sizeof(iveiv_entry));
+
+        offset = MAC_WCID_ENTRY(key->hw_key_idx);
+
+        memset(&wcid_entry, 0, sizeof(wcid_entry));
+        if (crypto->cmd == SET_KEY)
+                memcpy(&wcid_entry, crypto->address, ETH_ALEN);
+        rt2x00usb_register_multiwrite(rt2x00dev, offset,
+                                      &wcid_entry, sizeof(wcid_entry));
+}
+
+static int rt2800usb_config_shared_key(struct rt2x00_dev *rt2x00dev,
+                                       struct rt2x00lib_crypto *crypto,
+                                       struct ieee80211_key_conf *key)
+{
+        struct hw_key_entry key_entry;
+        struct rt2x00_field32 field;
+        int timeout;
+        u32 offset;
+        u32 reg;
+
+        if (crypto->cmd == SET_KEY) {
+                key->hw_key_idx = (4 * crypto->bssidx) + key->keyidx;
+
+                memcpy(key_entry.key, crypto->key,
+                       sizeof(key_entry.key));
+                memcpy(key_entry.tx_mic, crypto->tx_mic,
+                       sizeof(key_entry.tx_mic));
+                memcpy(key_entry.rx_mic, crypto->rx_mic,
+                       sizeof(key_entry.rx_mic));
+
+                offset = SHARED_KEY_ENTRY(key->hw_key_idx);
+                timeout = REGISTER_TIMEOUT32(sizeof(key_entry));
+                rt2x00usb_vendor_request_large_buff(rt2x00dev, USB_MULTI_WRITE,
+                                                    USB_VENDOR_REQUEST_OUT,
+                                                    offset, &key_entry,
+                                                    sizeof(key_entry),
+                                                    timeout);
+        }
+
+        /*
+         * The cipher types are stored over multiple registers
+         * starting with SHARED_KEY_MODE_BASE each word will have
+         * 32 bits and contains the cipher types for 2 bssidx each.
+         * Using the correct defines correctly will cause overhead,
+         * so just calculate the correct offset.
+         */
+        field.bit_offset = 4 * (key->hw_key_idx % 8);
+        field.bit_mask = 0x7 << field.bit_offset;
+
+        offset = SHARED_KEY_MODE_ENTRY(key->hw_key_idx / 8);
+
+        rt2x00usb_register_read(rt2x00dev, offset, &reg);
+        rt2x00_set_field32(&reg, field,
+                           (crypto->cmd == SET_KEY) * crypto->cipher);
+        rt2x00usb_register_write(rt2x00dev, offset, reg);
+
+        /*
+         * Update WCID information
+         */
+        rt2800usb_config_wcid_attr(rt2x00dev, crypto, key);
+
+        return 0;
+}
+
+static int rt2800usb_config_pairwise_key(struct rt2x00_dev *rt2x00dev,
+                                         struct rt2x00lib_crypto *crypto,
+                                         struct ieee80211_key_conf *key)
+{
+        struct hw_key_entry key_entry;
+        int timeout;
+        u32 offset;
+
+        if (crypto->cmd == SET_KEY) {
+                /*
+                 * 1 pairwise key is possible per AID, this means that the AID
+                 * equals our hw_key_idx. Make sure the WCID starts _after_ the
+                 * last possible shared key entry.
+                 */
+                if (crypto->aid > (256 - 32))
+                        return -ENOSPC;
+
+                key->hw_key_idx = 32 + crypto->aid;
+
+                memcpy(key_entry.key, crypto->key,
+                       sizeof(key_entry.key));
+                memcpy(key_entry.tx_mic, crypto->tx_mic,
+                       sizeof(key_entry.tx_mic));
+                memcpy(key_entry.rx_mic, crypto->rx_mic,
+                       sizeof(key_entry.rx_mic));
+
+                offset = PAIRWISE_KEY_ENTRY(key->hw_key_idx);
+                timeout = REGISTER_TIMEOUT32(sizeof(key_entry));
+                rt2x00usb_vendor_request_large_buff(rt2x00dev, USB_MULTI_WRITE,
+                                                    USB_VENDOR_REQUEST_OUT,
+                                                    offset, &key_entry,
+                                                    sizeof(key_entry),
+                                                    timeout);
+        }
+
+        /*
+         * Update WCID information
+         */
+        rt2800usb_config_wcid_attr(rt2x00dev, crypto, key);
+
+        return 0;
+}
+
+static void rt2800usb_config_filter(struct rt2x00_dev *rt2x00dev,
+                                    const unsigned int filter_flags)
+{
+        u32 reg;
+
+        /*
+         * Start configuration steps.
+         * Note that the version error will always be dropped
+         * and broadcast frames will always be accepted since
+         * there is no filter for it at this time.
+         */
+        rt2x00usb_register_read(rt2x00dev, RX_FILTER_CFG, &reg);
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_CRC_ERROR,
+                           !(filter_flags & FIF_FCSFAIL));
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_PHY_ERROR,
+                           !(filter_flags & FIF_PLCPFAIL));
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_NOT_TO_ME,
+                           !(filter_flags & FIF_PROMISC_IN_BSS));
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_NOT_MY_BSSD, 0);
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_VER_ERROR, 1);
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_MULTICAST,
+                           !(filter_flags & FIF_ALLMULTI));
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_BROADCAST, 0);
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_DUPLICATE, 1);
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_CF_END_ACK,
+                           !(filter_flags & FIF_CONTROL));
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_CF_END,
+                           !(filter_flags & FIF_CONTROL));
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_ACK,
+                           !(filter_flags & FIF_CONTROL));
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_CTS,
+                           !(filter_flags & FIF_CONTROL));
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_RTS,
+                           !(filter_flags & FIF_CONTROL));
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_PSPOLL,
+                           !(filter_flags & FIF_CONTROL));
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_BA, 1);
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_BAR, 0);
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_CNTL,
+                           !(filter_flags & FIF_CONTROL));
+        rt2x00usb_register_write(rt2x00dev, RX_FILTER_CFG, reg);
+}
+
+static void rt2800usb_config_intf(struct rt2x00_dev *rt2x00dev,
+                                  struct rt2x00_intf *intf,
+                                  struct rt2x00intf_conf *conf,
+                                  const unsigned int flags)
+{
+        unsigned int beacon_base;
+        u32 reg;
+
+        if (flags & CONFIG_UPDATE_TYPE) {
+                /*
+                 * Clear current synchronisation setup.
+                 * For the Beacon base registers we only need to clear
+                 * the first byte since that byte contains the VALID and OWNER
+                 * bits which (when set to 0) will invalidate the entire beacon.
+                 */
+                beacon_base = HW_BEACON_OFFSET(intf->beacon->entry_idx);
+                rt2x00usb_register_write(rt2x00dev, beacon_base, 0);
+
+                /*
+                 * Enable synchronisation.
+                 */
+                rt2x00usb_register_read(rt2x00dev, BCN_TIME_CFG, &reg);
+                rt2x00_set_field32(&reg, BCN_TIME_CFG_TSF_TICKING, 1);
+                rt2x00_set_field32(&reg, BCN_TIME_CFG_TSF_SYNC, conf->sync);
+                rt2x00_set_field32(&reg, BCN_TIME_CFG_TBTT_ENABLE, 1);
+                rt2x00usb_register_write(rt2x00dev, BCN_TIME_CFG, reg);
+        }
+
+        if (flags & CONFIG_UPDATE_MAC) {
+                reg = le32_to_cpu(conf->mac[1]);
+                rt2x00_set_field32(&reg, MAC_ADDR_DW1_UNICAST_TO_ME_MASK, 0xff);
+                conf->mac[1] = cpu_to_le32(reg);
+
+                rt2x00usb_register_multiwrite(rt2x00dev, MAC_ADDR_DW0,
+                                              conf->mac, sizeof(conf->mac));
+        }
+
+        if (flags & CONFIG_UPDATE_BSSID) {
+                reg = le32_to_cpu(conf->bssid[1]);
+                rt2x00_set_field32(&reg, MAC_BSSID_DW1_BSS_ID_MASK, 0);
+                rt2x00_set_field32(&reg, MAC_BSSID_DW1_BSS_BCN_NUM, 0);
+                conf->bssid[1] = cpu_to_le32(reg);
+
+                rt2x00usb_register_multiwrite(rt2x00dev, MAC_BSSID_DW0,
+                                              conf->bssid, sizeof(conf->bssid));
+        }
+}
+
+static void rt2800usb_config_erp(struct rt2x00_dev *rt2x00dev,
+                                 struct rt2x00lib_erp *erp)
+{
+        u32 reg;
+
+        rt2x00usb_register_read(rt2x00dev, TX_TIMEOUT_CFG, &reg);
+        rt2x00_set_field32(&reg, TX_TIMEOUT_CFG_RX_ACK_TIMEOUT,
+                           DIV_ROUND_UP(erp->ack_timeout, erp->slot_time));
+        rt2x00usb_register_write(rt2x00dev, TX_TIMEOUT_CFG, reg);
+
+        rt2x00usb_register_read(rt2x00dev, AUTO_RSP_CFG, &reg);
+        rt2x00_set_field32(&reg, AUTO_RSP_CFG_BAC_ACK_POLICY,
+                           !!erp->short_preamble);
+        rt2x00_set_field32(&reg, AUTO_RSP_CFG_AR_PREAMBLE,
+                           !!erp->short_preamble);
+        rt2x00usb_register_write(rt2x00dev, AUTO_RSP_CFG, reg);
+
+        rt2x00usb_register_read(rt2x00dev, OFDM_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, OFDM_PROT_CFG_PROTECT_CTRL,
+                           erp->cts_protection ? 2 : 0);
+        rt2x00usb_register_write(rt2x00dev, OFDM_PROT_CFG, reg);
+
+        rt2x00usb_register_write(rt2x00dev, LEGACY_BASIC_RATE,
+                                 erp->basic_rates);
+        rt2x00usb_register_write(rt2x00dev, HT_BASIC_RATE, 0x00008003);
+
+        rt2x00usb_register_read(rt2x00dev, BKOFF_SLOT_CFG, &reg);
+        rt2x00_set_field32(&reg, BKOFF_SLOT_CFG_SLOT_TIME, erp->slot_time);
+        rt2x00_set_field32(&reg, BKOFF_SLOT_CFG_CC_DELAY_TIME, 2);
+        rt2x00usb_register_write(rt2x00dev, BKOFF_SLOT_CFG, reg);
+
+        rt2x00usb_register_read(rt2x00dev, XIFS_TIME_CFG, &reg);
+        rt2x00_set_field32(&reg, XIFS_TIME_CFG_CCKM_SIFS_TIME, erp->sifs);
+        rt2x00_set_field32(&reg, XIFS_TIME_CFG_OFDM_SIFS_TIME, erp->sifs);
+        rt2x00_set_field32(&reg, XIFS_TIME_CFG_OFDM_XIFS_TIME, 4);
+        rt2x00_set_field32(&reg, XIFS_TIME_CFG_EIFS, erp->eifs);
+        rt2x00_set_field32(&reg, XIFS_TIME_CFG_BB_RXEND_ENABLE, 1);
+        rt2x00usb_register_write(rt2x00dev, XIFS_TIME_CFG, reg);
+}
+
+static void rt2800usb_config_ant(struct rt2x00_dev *rt2x00dev,
+                                 struct antenna_setup *ant)
+{
+        u8 r1;
+        u8 r3;
+
+        rt2800usb_bbp_read(rt2x00dev, 1, &r1);
+        rt2800usb_bbp_read(rt2x00dev, 3, &r3);
+
+        /*
+         * Configure the TX antenna.
+         */
+        switch ((int)ant->tx) {
+        case 1:
+                rt2x00_set_field8(&r1, BBP1_TX_ANTENNA, 0);
+                break;
+        case 2:
+                rt2x00_set_field8(&r1, BBP1_TX_ANTENNA, 2);
+                break;
+        case 3:
+                /* Do nothing */
+                break;
+        }
+
+        /*
+         * Configure the RX antenna.
+         */
+        switch ((int)ant->rx) {
+        case 1:
+                rt2x00_set_field8(&r3, BBP3_RX_ANTENNA, 0);
+                break;
+        case 2:
+                rt2x00_set_field8(&r3, BBP3_RX_ANTENNA, 1);
+                break;
+        case 3:
+                rt2x00_set_field8(&r3, BBP3_RX_ANTENNA, 2);
+                break;
+        }
+
+        rt2800usb_bbp_write(rt2x00dev, 3, r3);
+        rt2800usb_bbp_write(rt2x00dev, 1, r1);
+}
+
+static void rt2800usb_config_lna_gain(struct rt2x00_dev *rt2x00dev,
+                                      struct rt2x00lib_conf *libconf)
+{
+        u16 eeprom;
+        short lna_gain;
+
+        if (libconf->rf.channel <= 14) {
+                rt2x00_eeprom_read(rt2x00dev, EEPROM_LNA, &eeprom);
+                lna_gain = rt2x00_get_field16(eeprom, EEPROM_LNA_BG);
+        } else if (libconf->rf.channel <= 64) {
+                rt2x00_eeprom_read(rt2x00dev, EEPROM_LNA, &eeprom);
+                lna_gain = rt2x00_get_field16(eeprom, EEPROM_LNA_A0);
+        } else if (libconf->rf.channel <= 128) {
+                rt2x00_eeprom_read(rt2x00dev, EEPROM_RSSI_BG2, &eeprom);
+                lna_gain = rt2x00_get_field16(eeprom, EEPROM_RSSI_BG2_LNA_A1);
+        } else {
+                rt2x00_eeprom_read(rt2x00dev, EEPROM_RSSI_A2, &eeprom);
+                lna_gain = rt2x00_get_field16(eeprom, EEPROM_RSSI_A2_LNA_A2);
+        }
+
+        rt2x00dev->lna_gain = lna_gain;
+}
+
+static void rt2800usb_config_channel_rt2x(struct rt2x00_dev *rt2x00dev,
+                                          struct ieee80211_conf *conf,
+                                          struct rf_channel *rf,
+                                          struct channel_info *info)
+{
+        rt2x00_set_field32(&rf->rf4, RF4_FREQ_OFFSET, rt2x00dev->freq_offset);
+
+        if (rt2x00dev->default_ant.tx == 1)
+                rt2x00_set_field32(&rf->rf2, RF2_ANTENNA_TX1, 1);
+
+        if (rt2x00dev->default_ant.rx == 1) {
+                rt2x00_set_field32(&rf->rf2, RF2_ANTENNA_RX1, 1);
+                rt2x00_set_field32(&rf->rf2, RF2_ANTENNA_RX2, 1);
+        } else if (rt2x00dev->default_ant.rx == 2)
+                rt2x00_set_field32(&rf->rf2, RF2_ANTENNA_RX2, 1);
+
+        if (rf->channel > 14) {
+                /*
+                 * When TX power is below 0, we should increase it by 7 to
+                 * make it a positive value (Minumum value is -7).
+                 * However this means that values between 0 and 7 have
+                 * double meaning, and we should set a 7DBm boost flag.
+                 */
+                rt2x00_set_field32(&rf->rf3, RF3_TXPOWER_A_7DBM_BOOST,
+                                   (info->tx_power1 >= 0));
+
+                if (info->tx_power1 < 0)
+                        info->tx_power1 += 7;
+
+                rt2x00_set_field32(&rf->rf3, RF3_TXPOWER_A,
+                                   TXPOWER_A_TO_DEV(info->tx_power1));
+
+                rt2x00_set_field32(&rf->rf4, RF4_TXPOWER_A_7DBM_BOOST,
+                                   (info->tx_power2 >= 0));
+
+                if (info->tx_power2 < 0)
+                        info->tx_power2 += 7;
+
+                rt2x00_set_field32(&rf->rf4, RF4_TXPOWER_A,
+                                   TXPOWER_A_TO_DEV(info->tx_power2));
+        } else {
+                rt2x00_set_field32(&rf->rf3, RF3_TXPOWER_G,
+                                   TXPOWER_G_TO_DEV(info->tx_power1));
+                rt2x00_set_field32(&rf->rf4, RF4_TXPOWER_G,
+                                   TXPOWER_G_TO_DEV(info->tx_power2));
+        }
+
+        rt2x00_set_field32(&rf->rf4, RF4_HT40, conf_is_ht40(conf));
+
+        rt2800usb_rf_write(rt2x00dev, 1, rf->rf1);
+        rt2800usb_rf_write(rt2x00dev, 2, rf->rf2);
+        rt2800usb_rf_write(rt2x00dev, 3, rf->rf3 & ~0x00000004);
+        rt2800usb_rf_write(rt2x00dev, 4, rf->rf4);
+
+        udelay(200);
+
+        rt2800usb_rf_write(rt2x00dev, 1, rf->rf1);
+        rt2800usb_rf_write(rt2x00dev, 2, rf->rf2);
+        rt2800usb_rf_write(rt2x00dev, 3, rf->rf3 | 0x00000004);
+        rt2800usb_rf_write(rt2x00dev, 4, rf->rf4);
+
+        udelay(200);
+
+        rt2800usb_rf_write(rt2x00dev, 1, rf->rf1);
+        rt2800usb_rf_write(rt2x00dev, 2, rf->rf2);
+        rt2800usb_rf_write(rt2x00dev, 3, rf->rf3 & ~0x00000004);
+        rt2800usb_rf_write(rt2x00dev, 4, rf->rf4);
+}
+
+static void rt2800usb_config_channel_rt3x(struct rt2x00_dev *rt2x00dev,
+                                          struct ieee80211_conf *conf,
+                                          struct rf_channel *rf,
+                                          struct channel_info *info)
+{
+        u8 rfcsr;
+
+        rt2800usb_rfcsr_write(rt2x00dev, 2, rf->rf1);
+        rt2800usb_rfcsr_write(rt2x00dev, 2, rf->rf3);
+
+        rt2800usb_rfcsr_read(rt2x00dev, 6, &rfcsr);
+        rt2x00_set_field8(&rfcsr, RFCSR6_R, rf->rf2);
+        rt2800usb_rfcsr_write(rt2x00dev, 6, rfcsr);
+
+        rt2800usb_rfcsr_read(rt2x00dev, 12, &rfcsr);
+        rt2x00_set_field8(&rfcsr, RFCSR12_TX_POWER,
+                          TXPOWER_G_TO_DEV(info->tx_power1));
+        rt2800usb_rfcsr_write(rt2x00dev, 12, rfcsr);
+
+        rt2800usb_rfcsr_read(rt2x00dev, 23, &rfcsr);
+        rt2x00_set_field8(&rfcsr, RFCSR23_FREQ_OFFSET, rt2x00dev->freq_offset);
+        rt2800usb_rfcsr_write(rt2x00dev, 23, rfcsr);
+
+        rt2800usb_rfcsr_write(rt2x00dev, 24,
+                              rt2x00dev->calibration[conf_is_ht40(conf)]);
+
+        rt2800usb_rfcsr_read(rt2x00dev, 23, &rfcsr);
+        rt2x00_set_field8(&rfcsr, RFCSR7_RF_TUNING, 1);
+        rt2800usb_rfcsr_write(rt2x00dev, 23, rfcsr);
+}
+
+static void rt2800usb_config_channel(struct rt2x00_dev *rt2x00dev,
+                                     struct ieee80211_conf *conf,
+                                     struct rf_channel *rf,
+                                     struct channel_info *info)
+{
+        u32 reg;
+        unsigned int tx_pin;
+        u8 bbp;
+
+        if (rt2x00_rev(&rt2x00dev->chip) != RT3070_VERSION)
+                rt2800usb_config_channel_rt2x(rt2x00dev, conf, rf, info);
+        else
+                rt2800usb_config_channel_rt3x(rt2x00dev, conf, rf, info);
+
+        /*
+         * Change BBP settings
+         */
+        rt2800usb_bbp_write(rt2x00dev, 62, 0x37 - rt2x00dev->lna_gain);
+        rt2800usb_bbp_write(rt2x00dev, 63, 0x37 - rt2x00dev->lna_gain);
+        rt2800usb_bbp_write(rt2x00dev, 64, 0x37 - rt2x00dev->lna_gain);
+        rt2800usb_bbp_write(rt2x00dev, 86, 0);
+
+        if (rf->channel <= 14) {
+                if (test_bit(CONFIG_EXTERNAL_LNA_BG, &rt2x00dev->flags)) {
+                        rt2800usb_bbp_write(rt2x00dev, 82, 0x62);
+                        rt2800usb_bbp_write(rt2x00dev, 75, 0x46);
+                } else {
+                        rt2800usb_bbp_write(rt2x00dev, 82, 0x84);
+                        rt2800usb_bbp_write(rt2x00dev, 75, 0x50);
+                }
+        } else {
+                rt2800usb_bbp_write(rt2x00dev, 82, 0xf2);
+
+                if (test_bit(CONFIG_EXTERNAL_LNA_A, &rt2x00dev->flags))
+                        rt2800usb_bbp_write(rt2x00dev, 75, 0x46);
+                else
+                        rt2800usb_bbp_write(rt2x00dev, 75, 0x50);
+        }
+
+        rt2x00usb_register_read(rt2x00dev, TX_BAND_CFG, &reg);
+        rt2x00_set_field32(&reg, TX_BAND_CFG_HT40_PLUS, conf_is_ht40_plus(conf));
+        rt2x00_set_field32(&reg, TX_BAND_CFG_A, rf->channel > 14);
+        rt2x00_set_field32(&reg, TX_BAND_CFG_BG, rf->channel <= 14);
+        rt2x00usb_register_write(rt2x00dev, TX_BAND_CFG, reg);
+
+        tx_pin = 0;
+
+        /* Turn on unused PA or LNA when not using 1T or 1R */
+        if (rt2x00dev->default_ant.tx != 1) {
+                rt2x00_set_field32(&tx_pin, TX_PIN_CFG_PA_PE_A1_EN, 1);
+                rt2x00_set_field32(&tx_pin, TX_PIN_CFG_PA_PE_G1_EN, 1);
+        }
+
+        /* Turn on unused PA or LNA when not using 1T or 1R */
+        if (rt2x00dev->default_ant.rx != 1) {
+                rt2x00_set_field32(&tx_pin, TX_PIN_CFG_LNA_PE_A1_EN, 1);
+                rt2x00_set_field32(&tx_pin, TX_PIN_CFG_LNA_PE_G1_EN, 1);
+        }
+
+        rt2x00_set_field32(&tx_pin, TX_PIN_CFG_LNA_PE_A0_EN, 1);
+        rt2x00_set_field32(&tx_pin, TX_PIN_CFG_LNA_PE_G0_EN, 1);
+        rt2x00_set_field32(&tx_pin, TX_PIN_CFG_RFTR_EN, 1);
+        rt2x00_set_field32(&tx_pin, TX_PIN_CFG_TRSW_EN, 1);
+        rt2x00_set_field32(&tx_pin, TX_PIN_CFG_PA_PE_G0_EN, rf->channel <= 14);
+        rt2x00_set_field32(&tx_pin, TX_PIN_CFG_PA_PE_A0_EN, rf->channel > 14);
+
+        rt2x00usb_register_write(rt2x00dev, TX_PIN_CFG, tx_pin);
+
+        rt2800usb_bbp_read(rt2x00dev, 4, &bbp);
+        rt2x00_set_field8(&bbp, BBP4_BANDWIDTH, 2 * conf_is_ht40(conf));
+        rt2800usb_bbp_write(rt2x00dev, 4, bbp);
+
+        rt2800usb_bbp_read(rt2x00dev, 3, &bbp);
+        rt2x00_set_field8(&bbp, BBP3_HT40_PLUS, conf_is_ht40_plus(conf));
+        rt2800usb_bbp_write(rt2x00dev, 3, bbp);
+
+        if (rt2x00_rev(&rt2x00dev->chip) == RT2860C_VERSION) {
+                if (conf_is_ht40(conf)) {
+                        rt2800usb_bbp_write(rt2x00dev, 69, 0x1a);
+                        rt2800usb_bbp_write(rt2x00dev, 70, 0x0a);
+                        rt2800usb_bbp_write(rt2x00dev, 73, 0x16);
+                } else {
+                        rt2800usb_bbp_write(rt2x00dev, 69, 0x16);
+                        rt2800usb_bbp_write(rt2x00dev, 70, 0x08);
+                        rt2800usb_bbp_write(rt2x00dev, 73, 0x11);
+                }
+        }
+
+        msleep(1);
+}
+
+static void rt2800usb_config_txpower(struct rt2x00_dev *rt2x00dev,
+                                     const int txpower)
+{
+        u32 reg;
+        u32 value = TXPOWER_G_TO_DEV(txpower);
+        u8 r1;
+
+        rt2800usb_bbp_read(rt2x00dev, 1, &r1);
+        rt2x00_set_field8(&reg, BBP1_TX_POWER, 0);
+        rt2800usb_bbp_write(rt2x00dev, 1, r1);
+
+        rt2x00usb_register_read(rt2x00dev, TX_PWR_CFG_0, &reg);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_0_1MBS, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_0_2MBS, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_0_55MBS, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_0_11MBS, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_0_6MBS, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_0_9MBS, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_0_12MBS, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_0_18MBS, value);
+        rt2x00usb_register_write(rt2x00dev, TX_PWR_CFG_0, reg);
+
+        rt2x00usb_register_read(rt2x00dev, TX_PWR_CFG_1, &reg);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_1_24MBS, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_1_36MBS, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_1_48MBS, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_1_54MBS, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_1_MCS0, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_1_MCS1, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_1_MCS2, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_1_MCS3, value);
+        rt2x00usb_register_write(rt2x00dev, TX_PWR_CFG_1, reg);
+
+        rt2x00usb_register_read(rt2x00dev, TX_PWR_CFG_2, &reg);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_2_MCS4, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_2_MCS5, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_2_MCS6, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_2_MCS7, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_2_MCS8, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_2_MCS9, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_2_MCS10, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_2_MCS11, value);
+        rt2x00usb_register_write(rt2x00dev, TX_PWR_CFG_2, reg);
+
+        rt2x00usb_register_read(rt2x00dev, TX_PWR_CFG_3, &reg);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_3_MCS12, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_3_MCS13, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_3_MCS14, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_3_MCS15, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_3_UKNOWN1, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_3_UKNOWN2, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_3_UKNOWN3, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_3_UKNOWN4, value);
+        rt2x00usb_register_write(rt2x00dev, TX_PWR_CFG_3, reg);
+
+        rt2x00usb_register_read(rt2x00dev, TX_PWR_CFG_4, &reg);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_4_UKNOWN5, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_4_UKNOWN6, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_4_UKNOWN7, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_4_UKNOWN8, value);
+        rt2x00usb_register_write(rt2x00dev, TX_PWR_CFG_4, reg);
+}
+
+static void rt2800usb_config_retry_limit(struct rt2x00_dev *rt2x00dev,
+                                         struct rt2x00lib_conf *libconf)
+{
+        u32 reg;
+
+        rt2x00usb_register_read(rt2x00dev, TX_RTY_CFG, &reg);
+        rt2x00_set_field32(&reg, TX_RTY_CFG_SHORT_RTY_LIMIT,
+                           libconf->conf->short_frame_max_tx_count);
+        rt2x00_set_field32(&reg, TX_RTY_CFG_LONG_RTY_LIMIT,
+                           libconf->conf->long_frame_max_tx_count);
+        rt2x00_set_field32(&reg, TX_RTY_CFG_LONG_RTY_THRE, 2000);
+        rt2x00_set_field32(&reg, TX_RTY_CFG_NON_AGG_RTY_MODE, 0);
+        rt2x00_set_field32(&reg, TX_RTY_CFG_AGG_RTY_MODE, 0);
+        rt2x00_set_field32(&reg, TX_RTY_CFG_TX_AUTO_FB_ENABLE, 1);
+        rt2x00usb_register_write(rt2x00dev, TX_RTY_CFG, reg);
+}
+
+static void rt2800usb_config_duration(struct rt2x00_dev *rt2x00dev,
+                                      struct rt2x00lib_conf *libconf)
+{
+        u32 reg;
+
+        rt2x00usb_register_read(rt2x00dev, BCN_TIME_CFG, &reg);
+        rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_INTERVAL,
+                           libconf->conf->beacon_int * 16);
+        rt2x00usb_register_write(rt2x00dev, BCN_TIME_CFG, reg);
+}
+
+static void rt2800usb_config_ps(struct rt2x00_dev *rt2x00dev,
+                                struct rt2x00lib_conf *libconf)
+{
+        enum dev_state state =
+            (libconf->conf->flags & IEEE80211_CONF_PS) ?
+                STATE_SLEEP : STATE_AWAKE;
+        u32 reg;
+
+        if (state == STATE_SLEEP) {
+                rt2x00usb_register_write(rt2x00dev, AUTOWAKEUP_CFG, 0);
+
+                rt2x00usb_register_read(rt2x00dev, AUTOWAKEUP_CFG, &reg);
+                rt2x00_set_field32(&reg, AUTOWAKEUP_CFG_AUTO_LEAD_TIME, 5);
+                rt2x00_set_field32(&reg, AUTOWAKEUP_CFG_TBCN_BEFORE_WAKE,
+                                   libconf->conf->listen_interval - 1);
+                rt2x00_set_field32(&reg, AUTOWAKEUP_CFG_AUTOWAKE, 1);
+                rt2x00usb_register_write(rt2x00dev, AUTOWAKEUP_CFG, reg);
+
+                rt2x00dev->ops->lib->set_device_state(rt2x00dev, state);
+        } else {
+                rt2x00dev->ops->lib->set_device_state(rt2x00dev, state);
+
+                rt2x00usb_register_read(rt2x00dev, AUTOWAKEUP_CFG, &reg);
+                rt2x00_set_field32(&reg, AUTOWAKEUP_CFG_AUTO_LEAD_TIME, 0);
+                rt2x00_set_field32(&reg, AUTOWAKEUP_CFG_TBCN_BEFORE_WAKE, 0);
+                rt2x00_set_field32(&reg, AUTOWAKEUP_CFG_AUTOWAKE, 0);
+                rt2x00usb_register_write(rt2x00dev, AUTOWAKEUP_CFG, reg);
+        }
+}
+
+static void rt2800usb_config(struct rt2x00_dev *rt2x00dev,
+                             struct rt2x00lib_conf *libconf,
+                             const unsigned int flags)
+{
+        /* Always recalculate LNA gain before changing configuration */
+        rt2800usb_config_lna_gain(rt2x00dev, libconf);
+
+        if (flags & IEEE80211_CONF_CHANGE_CHANNEL)
+                rt2800usb_config_channel(rt2x00dev, libconf->conf,
+                                         &libconf->rf, &libconf->channel);
+        if (flags & IEEE80211_CONF_CHANGE_POWER)
+                rt2800usb_config_txpower(rt2x00dev, libconf->conf->power_level);
+        if (flags & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
+                rt2800usb_config_retry_limit(rt2x00dev, libconf);
+        if (flags & IEEE80211_CONF_CHANGE_BEACON_INTERVAL)
+                rt2800usb_config_duration(rt2x00dev, libconf);
+        if (flags & IEEE80211_CONF_CHANGE_PS)
+                rt2800usb_config_ps(rt2x00dev, libconf);
+}
+
+/*
+ * Link tuning
+ */
+static void rt2800usb_link_stats(struct rt2x00_dev *rt2x00dev,
+                                 struct link_qual *qual)
+{
+        u32 reg;
+
+        /*
+         * Update FCS error count from register.
+         */
+        rt2x00usb_register_read(rt2x00dev, RX_STA_CNT0, &reg);
+        qual->rx_failed = rt2x00_get_field32(reg, RX_STA_CNT0_CRC_ERR);
+}
+
+static u8 rt2800usb_get_default_vgc(struct rt2x00_dev *rt2x00dev)
+{
+        if (rt2x00dev->curr_band == IEEE80211_BAND_2GHZ) {
+                if (rt2x00_rev(&rt2x00dev->chip) == RT3070_VERSION)
+                        return 0x1c + (2 * rt2x00dev->lna_gain);
+                else
+                        return 0x2e + rt2x00dev->lna_gain;
+        }
+
+        if (!test_bit(CONFIG_CHANNEL_HT40, &rt2x00dev->flags))
+                return 0x32 + (rt2x00dev->lna_gain * 5) / 3;
+        else
+                return 0x3a + (rt2x00dev->lna_gain * 5) / 3;
+}
+
+static inline void rt2800usb_set_vgc(struct rt2x00_dev *rt2x00dev,
+                                     struct link_qual *qual, u8 vgc_level)
+{
+        if (qual->vgc_level != vgc_level) {
+                rt2800usb_bbp_write(rt2x00dev, 66, vgc_level);
+                qual->vgc_level = vgc_level;
+                qual->vgc_level_reg = vgc_level;
+        }
+}
+
+static void rt2800usb_reset_tuner(struct rt2x00_dev *rt2x00dev,
+                                  struct link_qual *qual)
+{
+        rt2800usb_set_vgc(rt2x00dev, qual,
+                          rt2800usb_get_default_vgc(rt2x00dev));
+}
+
+static void rt2800usb_link_tuner(struct rt2x00_dev *rt2x00dev,
+                                 struct link_qual *qual, const u32 count)
+{
+        if (rt2x00_rev(&rt2x00dev->chip) == RT2860C_VERSION)
+                return;
+
+        /*
+         * When RSSI is better then -80 increase VGC level with 0x10
+         */
+        rt2800usb_set_vgc(rt2x00dev, qual,
+                          rt2800usb_get_default_vgc(rt2x00dev) +
+                          ((qual->rssi > -80) * 0x10));
+}
+
+/*
+ * Firmware functions
+ */
+static char *rt2800usb_get_firmware_name(struct rt2x00_dev *rt2x00dev)
+{
+        return FIRMWARE_RT2870;
+}
+
+static bool rt2800usb_check_crc(const u8 *data, const size_t len)
+{
+        u16 fw_crc;
+        u16 crc;
+
+        /*
+         * The last 2 bytes in the firmware array are the crc checksum itself,
+         * this means that we should never pass those 2 bytes to the crc
+         * algorithm.
+         */
+        fw_crc = (data[len - 2] << 8 | data[len - 1]);
+
+        /*
+         * Use the crc ccitt algorithm.
+         * This will return the same value as the legacy driver which
+         * used bit ordering reversion on the both the firmware bytes
+         * before input input as well as on the final output.
+         * Obviously using crc ccitt directly is much more efficient.
+         */
+        crc = crc_ccitt(~0, data, len - 2);
+
+        /*
+         * There is a small difference between the crc-itu-t + bitrev and
+         * the crc-ccitt crc calculation. In the latter method the 2 bytes
+         * will be swapped, use swab16 to convert the crc to the correct
+         * value.
+         */
+        crc = swab16(crc);
+
+        return fw_crc == crc;
+}
+
+static int rt2800usb_check_firmware(struct rt2x00_dev *rt2x00dev,
+                                    const u8 *data, const size_t len)
+{
+        u16 chipset = (rt2x00_rev(&rt2x00dev->chip) >> 16) & 0xffff;
+        size_t offset = 0;
+
+        /*
+         * Firmware files:
+         * There are 2 variations of the rt2870 firmware.
+         * a) size: 4kb
+         * b) size: 8kb
+         * Note that (b) contains 2 seperate firmware blobs of 4k
+         * within the file. The first blob is the same firmware as (a),
+         * but the second blob is for the additional chipsets.
+         */
+        if (len != 4096 && len != 8192)
+                return FW_BAD_LENGTH;
+
+        /*
+         * Check if we need the upper 4kb firmware data or not.
+         */
+        if ((len == 4096) &&
+            (chipset != 0x2860) &&
+            (chipset != 0x2872) &&
+            (chipset != 0x3070))
+                return FW_BAD_VERSION;
+
+        /*
+         * 8kb firmware files must be checked as if it were
+         * 2 seperate firmware files.
+         */
+        while (offset < len) {
+                if (!rt2800usb_check_crc(data + offset, 4096))
+                        return FW_BAD_CRC;
+
+                offset += 4096;
+        }
+
+        return FW_OK;
+}
+
+static int rt2800usb_load_firmware(struct rt2x00_dev *rt2x00dev,
+                                   const u8 *data, const size_t len)
+{
+        unsigned int i;
+        int status;
+        u32 reg;
+        u32 offset;
+        u32 length;
+        u16 chipset = (rt2x00_rev(&rt2x00dev->chip) >> 16) & 0xffff;
+
+        /*
+         * Check which section of the firmware we need.
+         */
+        if ((chipset == 0x2860) ||
+            (chipset == 0x2872) ||
+            (chipset == 0x3070)) {
+                offset = 0;
+                length = 4096;
+        } else {
+                offset = 4096;
+                length = 4096;
+        }
+
+        /*
+         * Wait for stable hardware.
+         */
+        for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
+                rt2x00usb_register_read(rt2x00dev, MAC_CSR0, &reg);
+                if (reg && reg != ~0)
+                        break;
+                msleep(1);
+        }
+
+        if (i == REGISTER_BUSY_COUNT) {
+                ERROR(rt2x00dev, "Unstable hardware.\n");
+                return -EBUSY;
+        }
+
+        /*
+         * Write firmware to device.
+         */
+        rt2x00usb_vendor_request_large_buff(rt2x00dev, USB_MULTI_WRITE,
+                                            USB_VENDOR_REQUEST_OUT,
+                                            FIRMWARE_IMAGE_BASE,
+                                            data + offset, length,
+                                            REGISTER_TIMEOUT32(length));
+
+        rt2x00usb_register_write(rt2x00dev, H2M_MAILBOX_CID, ~0);
+        rt2x00usb_register_write(rt2x00dev, H2M_MAILBOX_STATUS, ~0);
+
+        /*
+         * Send firmware request to device to load firmware,
+         * we need to specify a long timeout time.
+         */
+        status = rt2x00usb_vendor_request_sw(rt2x00dev, USB_DEVICE_MODE,
+                                             0, USB_MODE_FIRMWARE,
+                                             REGISTER_TIMEOUT_FIRMWARE);
+        if (status < 0) {
+                ERROR(rt2x00dev, "Failed to write Firmware to device.\n");
+                return status;
+        }
+
+        msleep(10);
+        rt2x00usb_register_write(rt2x00dev, H2M_MAILBOX_CSR, 0);
+
+        /*
+         * Send signal to firmware during boot time.
+         */
+        rt2800usb_mcu_request(rt2x00dev, MCU_BOOT_SIGNAL, 0xff, 0, 0);
+
+        if ((chipset == 0x3070) ||
+            (chipset == 0x3071) ||
+            (chipset == 0x3572)) {
+                udelay(200);
+                rt2800usb_mcu_request(rt2x00dev, MCU_CURRENT, 0, 0, 0);
+                udelay(10);
+        }
+
+        /*
+         * Wait for device to stabilize.
+         */
+        for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
+                rt2x00usb_register_read(rt2x00dev, PBF_SYS_CTRL, &reg);
+                if (rt2x00_get_field32(reg, PBF_SYS_CTRL_READY))
+                        break;
+                msleep(1);
+        }
+
+        if (i == REGISTER_BUSY_COUNT) {
+                ERROR(rt2x00dev, "PBF system register not ready.\n");
+                return -EBUSY;
+        }
+
+        /*
+         * Initialize firmware.
+         */
+        rt2x00usb_register_write(rt2x00dev, H2M_BBP_AGENT, 0);
+        rt2x00usb_register_write(rt2x00dev, H2M_MAILBOX_CSR, 0);
+        msleep(1);
+
+        return 0;
+}
+
+/*
+ * Initialization functions.
+ */
+static int rt2800usb_init_registers(struct rt2x00_dev *rt2x00dev)
+{
+        u32 reg;
+        unsigned int i;
+
+        /*
+         * Wait untill BBP and RF are ready.
+         */
+        for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
+                rt2x00usb_register_read(rt2x00dev, MAC_CSR0, &reg);
+                if (reg && reg != ~0)
+                        break;
+                msleep(1);
+        }
+
+        if (i == REGISTER_BUSY_COUNT) {
+                ERROR(rt2x00dev, "Unstable hardware.\n");
+                return -EBUSY;
+        }
+
+        rt2x00usb_register_read(rt2x00dev, PBF_SYS_CTRL, &reg);
+        rt2x00usb_register_write(rt2x00dev, PBF_SYS_CTRL, reg & ~0x00002000);
+
+        rt2x00usb_register_read(rt2x00dev, MAC_SYS_CTRL, &reg);
+        rt2x00_set_field32(&reg, MAC_SYS_CTRL_RESET_CSR, 1);
+        rt2x00_set_field32(&reg, MAC_SYS_CTRL_RESET_BBP, 1);
+        rt2x00usb_register_write(rt2x00dev, MAC_SYS_CTRL, reg);
+
+        rt2x00usb_register_write(rt2x00dev, USB_DMA_CFG, 0x00000000);
+
+        rt2x00usb_vendor_request_sw(rt2x00dev, USB_DEVICE_MODE, 0,
+                                    USB_MODE_RESET, REGISTER_TIMEOUT);
+
+        rt2x00usb_register_write(rt2x00dev, MAC_SYS_CTRL, 0x00000000);
+
+        rt2x00usb_register_read(rt2x00dev, BCN_OFFSET0, &reg);
+        rt2x00_set_field32(&reg, BCN_OFFSET0_BCN0, 0xe0); /* 0x3800 */
+        rt2x00_set_field32(&reg, BCN_OFFSET0_BCN1, 0xe8); /* 0x3a00 */
+        rt2x00_set_field32(&reg, BCN_OFFSET0_BCN2, 0xf0); /* 0x3c00 */
+        rt2x00_set_field32(&reg, BCN_OFFSET0_BCN3, 0xf8); /* 0x3e00 */
+        rt2x00usb_register_write(rt2x00dev, BCN_OFFSET0, reg);
+
+        rt2x00usb_register_read(rt2x00dev, BCN_OFFSET1, &reg);
+        rt2x00_set_field32(&reg, BCN_OFFSET1_BCN4, 0xc8); /* 0x3200 */
+        rt2x00_set_field32(&reg, BCN_OFFSET1_BCN5, 0xd0); /* 0x3400 */
+        rt2x00_set_field32(&reg, BCN_OFFSET1_BCN6, 0x77); /* 0x1dc0 */
+        rt2x00_set_field32(&reg, BCN_OFFSET1_BCN7, 0x6f); /* 0x1bc0 */
+        rt2x00usb_register_write(rt2x00dev, BCN_OFFSET1, reg);
+
+        rt2x00usb_register_write(rt2x00dev, LEGACY_BASIC_RATE, 0x0000013f);
+        rt2x00usb_register_write(rt2x00dev, HT_BASIC_RATE, 0x00008003);
+
+        rt2x00usb_register_write(rt2x00dev, MAC_SYS_CTRL, 0x00000000);
+
+        rt2x00usb_register_read(rt2x00dev, BCN_TIME_CFG, &reg);
+        rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_INTERVAL, 0);
+        rt2x00_set_field32(&reg, BCN_TIME_CFG_TSF_TICKING, 0);
+        rt2x00_set_field32(&reg, BCN_TIME_CFG_TSF_SYNC, 0);
+        rt2x00_set_field32(&reg, BCN_TIME_CFG_TBTT_ENABLE, 0);
+        rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_GEN, 0);
+        rt2x00_set_field32(&reg, BCN_TIME_CFG_TX_TIME_COMPENSATE, 0);
+        rt2x00usb_register_write(rt2x00dev, BCN_TIME_CFG, reg);
+
+        if (rt2x00_rev(&rt2x00dev->chip) == RT3070_VERSION) {
+                rt2x00usb_register_write(rt2x00dev, TX_SW_CFG0, 0x00000400);
+                rt2x00usb_register_write(rt2x00dev, TX_SW_CFG1, 0x00000000);
+                rt2x00usb_register_write(rt2x00dev, TX_SW_CFG2, 0x00000000);
+        } else {
+                rt2x00usb_register_write(rt2x00dev, TX_SW_CFG0, 0x00000000);
+                rt2x00usb_register_write(rt2x00dev, TX_SW_CFG1, 0x00080606);
+        }
+
+        rt2x00usb_register_read(rt2x00dev, TX_LINK_CFG, &reg);
+        rt2x00_set_field32(&reg, TX_LINK_CFG_REMOTE_MFB_LIFETIME, 32);
+        rt2x00_set_field32(&reg, TX_LINK_CFG_MFB_ENABLE, 0);
+        rt2x00_set_field32(&reg, TX_LINK_CFG_REMOTE_UMFS_ENABLE, 0);
+        rt2x00_set_field32(&reg, TX_LINK_CFG_TX_MRQ_EN, 0);
+        rt2x00_set_field32(&reg, TX_LINK_CFG_TX_RDG_EN, 0);
+        rt2x00_set_field32(&reg, TX_LINK_CFG_TX_CF_ACK_EN, 1);
+        rt2x00_set_field32(&reg, TX_LINK_CFG_REMOTE_MFB, 0);
+        rt2x00_set_field32(&reg, TX_LINK_CFG_REMOTE_MFS, 0);
+        rt2x00usb_register_write(rt2x00dev, TX_LINK_CFG, reg);
+
+        rt2x00usb_register_read(rt2x00dev, TX_TIMEOUT_CFG, &reg);
+        rt2x00_set_field32(&reg, TX_TIMEOUT_CFG_MPDU_LIFETIME, 9);
+        rt2x00_set_field32(&reg, TX_TIMEOUT_CFG_TX_OP_TIMEOUT, 10);
+        rt2x00usb_register_write(rt2x00dev, TX_TIMEOUT_CFG, reg);
+
+        rt2x00usb_register_read(rt2x00dev, MAX_LEN_CFG, &reg);
+        rt2x00_set_field32(&reg, MAX_LEN_CFG_MAX_MPDU, AGGREGATION_SIZE);
+        if (rt2x00_rev(&rt2x00dev->chip) >= RT2880E_VERSION &&
+            rt2x00_rev(&rt2x00dev->chip) < RT3070_VERSION)
+                rt2x00_set_field32(&reg, MAX_LEN_CFG_MAX_PSDU, 2);
+        else
+                rt2x00_set_field32(&reg, MAX_LEN_CFG_MAX_PSDU, 1);
+        rt2x00_set_field32(&reg, MAX_LEN_CFG_MIN_PSDU, 0);
+        rt2x00_set_field32(&reg, MAX_LEN_CFG_MIN_MPDU, 0);
+        rt2x00usb_register_write(rt2x00dev, MAX_LEN_CFG, reg);
+
+        rt2x00usb_register_write(rt2x00dev, PBF_MAX_PCNT, 0x1f3fbf9f);
+
+        rt2x00usb_register_read(rt2x00dev, AUTO_RSP_CFG, &reg);
+        rt2x00_set_field32(&reg, AUTO_RSP_CFG_AUTORESPONDER, 1);
+        rt2x00_set_field32(&reg, AUTO_RSP_CFG_CTS_40_MMODE, 0);
+        rt2x00_set_field32(&reg, AUTO_RSP_CFG_CTS_40_MREF, 0);
+        rt2x00_set_field32(&reg, AUTO_RSP_CFG_DUAL_CTS_EN, 0);
+        rt2x00_set_field32(&reg, AUTO_RSP_CFG_ACK_CTS_PSM_BIT, 0);
+        rt2x00usb_register_write(rt2x00dev, AUTO_RSP_CFG, reg);
+
+        rt2x00usb_register_read(rt2x00dev, CCK_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, CCK_PROT_CFG_PROTECT_RATE, 8);
+        rt2x00_set_field32(&reg, CCK_PROT_CFG_PROTECT_CTRL, 0);
+        rt2x00_set_field32(&reg, CCK_PROT_CFG_PROTECT_NAV, 1);
+        rt2x00_set_field32(&reg, CCK_PROT_CFG_TX_OP_ALLOW_CCK, 1);
+        rt2x00_set_field32(&reg, CCK_PROT_CFG_TX_OP_ALLOW_OFDM, 1);
+        rt2x00_set_field32(&reg, CCK_PROT_CFG_TX_OP_ALLOW_MM20, 1);
+        rt2x00_set_field32(&reg, CCK_PROT_CFG_TX_OP_ALLOW_MM40, 1);
+        rt2x00_set_field32(&reg, CCK_PROT_CFG_TX_OP_ALLOW_GF20, 1);
+        rt2x00_set_field32(&reg, CCK_PROT_CFG_TX_OP_ALLOW_GF40, 1);
+        rt2x00usb_register_write(rt2x00dev, CCK_PROT_CFG, reg);
+
+        rt2x00usb_register_read(rt2x00dev, OFDM_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, OFDM_PROT_CFG_PROTECT_RATE, 8);
+        rt2x00_set_field32(&reg, OFDM_PROT_CFG_PROTECT_CTRL, 0);
+        rt2x00_set_field32(&reg, OFDM_PROT_CFG_PROTECT_NAV, 1);
+        rt2x00_set_field32(&reg, OFDM_PROT_CFG_TX_OP_ALLOW_CCK, 1);
+        rt2x00_set_field32(&reg, OFDM_PROT_CFG_TX_OP_ALLOW_OFDM, 1);
+        rt2x00_set_field32(&reg, OFDM_PROT_CFG_TX_OP_ALLOW_MM20, 1);
+        rt2x00_set_field32(&reg, OFDM_PROT_CFG_TX_OP_ALLOW_MM40, 1);
+        rt2x00_set_field32(&reg, OFDM_PROT_CFG_TX_OP_ALLOW_GF20, 1);
+        rt2x00_set_field32(&reg, OFDM_PROT_CFG_TX_OP_ALLOW_GF40, 1);
+        rt2x00usb_register_write(rt2x00dev, OFDM_PROT_CFG, reg);
+
+        rt2x00usb_register_read(rt2x00dev, MM20_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, MM20_PROT_CFG_PROTECT_RATE, 0x4004);
+        rt2x00_set_field32(&reg, MM20_PROT_CFG_PROTECT_CTRL, 0);
+        rt2x00_set_field32(&reg, MM20_PROT_CFG_PROTECT_NAV, 1);
+        rt2x00_set_field32(&reg, MM20_PROT_CFG_TX_OP_ALLOW_CCK, 1);
+        rt2x00_set_field32(&reg, MM20_PROT_CFG_TX_OP_ALLOW_OFDM, 1);
+        rt2x00_set_field32(&reg, MM20_PROT_CFG_TX_OP_ALLOW_MM20, 1);
+        rt2x00_set_field32(&reg, MM20_PROT_CFG_TX_OP_ALLOW_MM40, 0);
+        rt2x00_set_field32(&reg, MM20_PROT_CFG_TX_OP_ALLOW_GF20, 1);
+        rt2x00_set_field32(&reg, MM20_PROT_CFG_TX_OP_ALLOW_GF40, 0);
+        rt2x00usb_register_write(rt2x00dev, MM20_PROT_CFG, reg);
+
+        rt2x00usb_register_read(rt2x00dev, MM40_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, MM40_PROT_CFG_PROTECT_RATE, 0x4084);
+        rt2x00_set_field32(&reg, MM40_PROT_CFG_PROTECT_CTRL, 0);
+        rt2x00_set_field32(&reg, MM40_PROT_CFG_PROTECT_NAV, 1);
+        rt2x00_set_field32(&reg, MM40_PROT_CFG_TX_OP_ALLOW_CCK, 1);
+        rt2x00_set_field32(&reg, MM40_PROT_CFG_TX_OP_ALLOW_OFDM, 1);
+        rt2x00_set_field32(&reg, MM40_PROT_CFG_TX_OP_ALLOW_MM20, 1);
+        rt2x00_set_field32(&reg, MM40_PROT_CFG_TX_OP_ALLOW_MM40, 1);
+        rt2x00_set_field32(&reg, MM40_PROT_CFG_TX_OP_ALLOW_GF20, 1);
+        rt2x00_set_field32(&reg, MM40_PROT_CFG_TX_OP_ALLOW_GF40, 1);
+        rt2x00usb_register_write(rt2x00dev, MM40_PROT_CFG, reg);
+
+        rt2x00usb_register_read(rt2x00dev, GF20_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, GF20_PROT_CFG_PROTECT_RATE, 0x4004);
+        rt2x00_set_field32(&reg, GF20_PROT_CFG_PROTECT_CTRL, 0);
+        rt2x00_set_field32(&reg, GF20_PROT_CFG_PROTECT_NAV, 1);
+        rt2x00_set_field32(&reg, GF20_PROT_CFG_TX_OP_ALLOW_CCK, 1);
+        rt2x00_set_field32(&reg, GF20_PROT_CFG_TX_OP_ALLOW_OFDM, 1);
+        rt2x00_set_field32(&reg, GF20_PROT_CFG_TX_OP_ALLOW_MM20, 1);
+        rt2x00_set_field32(&reg, GF20_PROT_CFG_TX_OP_ALLOW_MM40, 0);
+        rt2x00_set_field32(&reg, GF20_PROT_CFG_TX_OP_ALLOW_GF20, 1);
+        rt2x00_set_field32(&reg, GF20_PROT_CFG_TX_OP_ALLOW_GF40, 0);
+        rt2x00usb_register_write(rt2x00dev, GF20_PROT_CFG, reg);
+
+        rt2x00usb_register_read(rt2x00dev, GF40_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, GF40_PROT_CFG_PROTECT_RATE, 0x4084);
+        rt2x00_set_field32(&reg, GF40_PROT_CFG_PROTECT_CTRL, 0);
+        rt2x00_set_field32(&reg, GF40_PROT_CFG_PROTECT_NAV, 1);
+        rt2x00_set_field32(&reg, GF40_PROT_CFG_TX_OP_ALLOW_CCK, 1);
+        rt2x00_set_field32(&reg, GF40_PROT_CFG_TX_OP_ALLOW_OFDM, 1);
+        rt2x00_set_field32(&reg, GF40_PROT_CFG_TX_OP_ALLOW_MM20, 1);
+        rt2x00_set_field32(&reg, GF40_PROT_CFG_TX_OP_ALLOW_MM40, 1);
+        rt2x00_set_field32(&reg, GF40_PROT_CFG_TX_OP_ALLOW_GF20, 1);
+        rt2x00_set_field32(&reg, GF40_PROT_CFG_TX_OP_ALLOW_GF40, 1);
+        rt2x00usb_register_write(rt2x00dev, GF40_PROT_CFG, reg);
+
+        rt2x00usb_register_write(rt2x00dev, PBF_CFG, 0xf40006);
+
+        rt2x00usb_register_read(rt2x00dev, WPDMA_GLO_CFG, &reg);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_TX_DMA, 0);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_TX_DMA_BUSY, 0);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_RX_DMA, 0);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_RX_DMA_BUSY, 0);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_WP_DMA_BURST_SIZE, 3);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_TX_WRITEBACK_DONE, 0);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_BIG_ENDIAN, 0);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_RX_HDR_SCATTER, 0);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_HDR_SEG_LEN, 0);
+        rt2x00usb_register_write(rt2x00dev, WPDMA_GLO_CFG, reg);
+
+        rt2x00usb_register_write(rt2x00dev, TXOP_CTRL_CFG, 0x0000583f);
+        rt2x00usb_register_write(rt2x00dev, TXOP_HLDR_ET, 0x00000002);
+
+        rt2x00usb_register_read(rt2x00dev, TX_RTS_CFG, &reg);
+        rt2x00_set_field32(&reg, TX_RTS_CFG_AUTO_RTS_RETRY_LIMIT, 32);
+        rt2x00_set_field32(&reg, TX_RTS_CFG_RTS_THRES,
+                           IEEE80211_MAX_RTS_THRESHOLD);
+        rt2x00_set_field32(&reg, TX_RTS_CFG_RTS_FBK_EN, 0);
+        rt2x00usb_register_write(rt2x00dev, TX_RTS_CFG, reg);
+
+        rt2x00usb_register_write(rt2x00dev, EXP_ACK_TIME, 0x002400ca);
+        rt2x00usb_register_write(rt2x00dev, PWR_PIN_CFG, 0x00000003);
+
+        /*
+         * ASIC will keep garbage value after boot, clear encryption keys.
+         */
+        for (i = 0; i < 256; i++) {
+                u32 wcid[2] = { 0xffffffff, 0x00ffffff };
+                rt2x00usb_register_multiwrite(rt2x00dev, MAC_WCID_ENTRY(i),
+                                              wcid, sizeof(wcid));
+
+                rt2x00usb_register_write(rt2x00dev, MAC_WCID_ATTR_ENTRY(i), 1);
+                rt2x00usb_register_write(rt2x00dev, MAC_IVEIV_ENTRY(i), 0);
+        }
+
+        for (i = 0; i < 16; i++)
+                rt2x00usb_register_write(rt2x00dev,
+                                         SHARED_KEY_MODE_ENTRY(i), 0);
+
+        /*
+         * Clear all beacons
+         * For the Beacon base registers we only need to clear
+         * the first byte since that byte contains the VALID and OWNER
+         * bits which (when set to 0) will invalidate the entire beacon.
+         */
+        rt2x00usb_register_write(rt2x00dev, HW_BEACON_BASE0, 0);
+        rt2x00usb_register_write(rt2x00dev, HW_BEACON_BASE1, 0);
+        rt2x00usb_register_write(rt2x00dev, HW_BEACON_BASE2, 0);
+        rt2x00usb_register_write(rt2x00dev, HW_BEACON_BASE3, 0);
+        rt2x00usb_register_write(rt2x00dev, HW_BEACON_BASE4, 0);
+        rt2x00usb_register_write(rt2x00dev, HW_BEACON_BASE5, 0);
+        rt2x00usb_register_write(rt2x00dev, HW_BEACON_BASE6, 0);
+        rt2x00usb_register_write(rt2x00dev, HW_BEACON_BASE7, 0);
+
+        rt2x00usb_register_read(rt2x00dev, USB_CYC_CFG, &reg);
+        rt2x00_set_field32(&reg, USB_CYC_CFG_CLOCK_CYCLE, 30);
+        rt2x00usb_register_write(rt2x00dev, USB_CYC_CFG, reg);
+
+        rt2x00usb_register_read(rt2x00dev, HT_FBK_CFG0, &reg);
+        rt2x00_set_field32(&reg, HT_FBK_CFG0_HTMCS0FBK, 0);
+        rt2x00_set_field32(&reg, HT_FBK_CFG0_HTMCS1FBK, 0);
+        rt2x00_set_field32(&reg, HT_FBK_CFG0_HTMCS2FBK, 1);
+        rt2x00_set_field32(&reg, HT_FBK_CFG0_HTMCS3FBK, 2);
+        rt2x00_set_field32(&reg, HT_FBK_CFG0_HTMCS4FBK, 3);
+        rt2x00_set_field32(&reg, HT_FBK_CFG0_HTMCS5FBK, 4);
+        rt2x00_set_field32(&reg, HT_FBK_CFG0_HTMCS6FBK, 5);
+        rt2x00_set_field32(&reg, HT_FBK_CFG0_HTMCS7FBK, 6);
+        rt2x00usb_register_write(rt2x00dev, HT_FBK_CFG0, reg);
+
+        rt2x00usb_register_read(rt2x00dev, HT_FBK_CFG1, &reg);
+        rt2x00_set_field32(&reg, HT_FBK_CFG1_HTMCS8FBK, 8);
+        rt2x00_set_field32(&reg, HT_FBK_CFG1_HTMCS9FBK, 8);
+        rt2x00_set_field32(&reg, HT_FBK_CFG1_HTMCS10FBK, 9);
+        rt2x00_set_field32(&reg, HT_FBK_CFG1_HTMCS11FBK, 10);
+        rt2x00_set_field32(&reg, HT_FBK_CFG1_HTMCS12FBK, 11);
+        rt2x00_set_field32(&reg, HT_FBK_CFG1_HTMCS13FBK, 12);
+        rt2x00_set_field32(&reg, HT_FBK_CFG1_HTMCS14FBK, 13);
+        rt2x00_set_field32(&reg, HT_FBK_CFG1_HTMCS15FBK, 14);
+        rt2x00usb_register_write(rt2x00dev, HT_FBK_CFG1, reg);
+
+        rt2x00usb_register_read(rt2x00dev, LG_FBK_CFG0, &reg);
+        rt2x00_set_field32(&reg, LG_FBK_CFG0_OFDMMCS0FBK, 8);
+        rt2x00_set_field32(&reg, LG_FBK_CFG0_OFDMMCS1FBK, 8);
+        rt2x00_set_field32(&reg, LG_FBK_CFG0_OFDMMCS2FBK, 3);
+        rt2x00_set_field32(&reg, LG_FBK_CFG0_OFDMMCS3FBK, 10);
+        rt2x00_set_field32(&reg, LG_FBK_CFG0_OFDMMCS4FBK, 11);
+        rt2x00_set_field32(&reg, LG_FBK_CFG0_OFDMMCS5FBK, 12);
+        rt2x00_set_field32(&reg, LG_FBK_CFG0_OFDMMCS6FBK, 13);
+        rt2x00_set_field32(&reg, LG_FBK_CFG0_OFDMMCS7FBK, 14);
+        rt2x00usb_register_write(rt2x00dev, LG_FBK_CFG0, reg);
+
+        rt2x00usb_register_read(rt2x00dev, LG_FBK_CFG1, &reg);
+        rt2x00_set_field32(&reg, LG_FBK_CFG0_CCKMCS0FBK, 0);
+        rt2x00_set_field32(&reg, LG_FBK_CFG0_CCKMCS1FBK, 0);
+        rt2x00_set_field32(&reg, LG_FBK_CFG0_CCKMCS2FBK, 1);
+        rt2x00_set_field32(&reg, LG_FBK_CFG0_CCKMCS3FBK, 2);
+        rt2x00usb_register_write(rt2x00dev, LG_FBK_CFG1, reg);
+
+        /*
+         * We must clear the error counters.
+         * These registers are cleared on read,
+         * so we may pass a useless variable to store the value.
+         */
+        rt2x00usb_register_read(rt2x00dev, RX_STA_CNT0, &reg);
+        rt2x00usb_register_read(rt2x00dev, RX_STA_CNT1, &reg);
+        rt2x00usb_register_read(rt2x00dev, RX_STA_CNT2, &reg);
+        rt2x00usb_register_read(rt2x00dev, TX_STA_CNT0, &reg);
+        rt2x00usb_register_read(rt2x00dev, TX_STA_CNT1, &reg);
+        rt2x00usb_register_read(rt2x00dev, TX_STA_CNT2, &reg);
+
+        return 0;
+}
+
+static int rt2800usb_wait_bbp_rf_ready(struct rt2x00_dev *rt2x00dev)
+{
+        unsigned int i;
+        u32 reg;
+
+        for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
+                rt2x00usb_register_read(rt2x00dev, MAC_STATUS_CFG, &reg);
+                if (!rt2x00_get_field32(reg, MAC_STATUS_CFG_BBP_RF_BUSY))
+                        return 0;
+
+                udelay(REGISTER_BUSY_DELAY);
+        }
+
+        ERROR(rt2x00dev, "BBP/RF register access failed, aborting.\n");
+        return -EACCES;
+}
+
+static int rt2800usb_wait_bbp_ready(struct rt2x00_dev *rt2x00dev)
+{
+        unsigned int i;
+        u8 value;
+
+        /*
+         * BBP was enabled after firmware was loaded,
+         * but we need to reactivate it now.
+         */
+        rt2x00usb_register_write(rt2x00dev, H2M_BBP_AGENT, 0);
+        rt2x00usb_register_write(rt2x00dev, H2M_MAILBOX_CSR, 0);
+        msleep(1);
+
+        for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
+                rt2800usb_bbp_read(rt2x00dev, 0, &value);
+                if ((value != 0xff) && (value != 0x00))
+                        return 0;
+                udelay(REGISTER_BUSY_DELAY);
+        }
+
+        ERROR(rt2x00dev, "BBP register access failed, aborting.\n");
+        return -EACCES;
+}
+
+static int rt2800usb_init_bbp(struct rt2x00_dev *rt2x00dev)
+{
+        unsigned int i;
+        u16 eeprom;
+        u8 reg_id;
+        u8 value;
+
+        if (unlikely(rt2800usb_wait_bbp_rf_ready(rt2x00dev) ||
+                     rt2800usb_wait_bbp_ready(rt2x00dev)))
+                return -EACCES;
+
+        rt2800usb_bbp_write(rt2x00dev, 65, 0x2c);
+        rt2800usb_bbp_write(rt2x00dev, 66, 0x38);
+        rt2800usb_bbp_write(rt2x00dev, 69, 0x12);
+        rt2800usb_bbp_write(rt2x00dev, 70, 0x0a);
+        rt2800usb_bbp_write(rt2x00dev, 73, 0x10);
+        rt2800usb_bbp_write(rt2x00dev, 81, 0x37);
+        rt2800usb_bbp_write(rt2x00dev, 82, 0x62);
+        rt2800usb_bbp_write(rt2x00dev, 83, 0x6a);
+        rt2800usb_bbp_write(rt2x00dev, 84, 0x99);
+        rt2800usb_bbp_write(rt2x00dev, 86, 0x00);
+        rt2800usb_bbp_write(rt2x00dev, 91, 0x04);
+        rt2800usb_bbp_write(rt2x00dev, 92, 0x00);
+        rt2800usb_bbp_write(rt2x00dev, 103, 0x00);
+        rt2800usb_bbp_write(rt2x00dev, 105, 0x05);
+
+        if (rt2x00_rev(&rt2x00dev->chip) == RT2860C_VERSION) {
+                rt2800usb_bbp_write(rt2x00dev, 69, 0x16);
+                rt2800usb_bbp_write(rt2x00dev, 73, 0x12);
+        }
+
+        if (rt2x00_rev(&rt2x00dev->chip) > RT2860D_VERSION) {
+                rt2800usb_bbp_write(rt2x00dev, 84, 0x19);
+        }
+
+        if (rt2x00_rev(&rt2x00dev->chip) == RT3070_VERSION) {
+                rt2800usb_bbp_write(rt2x00dev, 70, 0x0a);
+                rt2800usb_bbp_write(rt2x00dev, 84, 0x99);
+                rt2800usb_bbp_write(rt2x00dev, 105, 0x05);
+        }
+
+        for (i = 0; i < EEPROM_BBP_SIZE; i++) {
+                rt2x00_eeprom_read(rt2x00dev, EEPROM_BBP_START + i, &eeprom);
+
+                if (eeprom != 0xffff && eeprom != 0x0000) {
+                        reg_id = rt2x00_get_field16(eeprom, EEPROM_BBP_REG_ID);
+                        value = rt2x00_get_field16(eeprom, EEPROM_BBP_VALUE);
+                        rt2800usb_bbp_write(rt2x00dev, reg_id, value);
+                }
+        }
+
+        return 0;
+}
+
+static u8 rt2800usb_init_rx_filter(struct rt2x00_dev *rt2x00dev,
+                                   bool bw40, u8 rfcsr24, u8 filter_target)
+{
+        unsigned int i;
+        u8 bbp;
+        u8 rfcsr;
+        u8 passband;
+        u8 stopband;
+        u8 overtuned = 0;
+
+        rt2800usb_rfcsr_write(rt2x00dev, 24, rfcsr24);
+
+        rt2800usb_bbp_read(rt2x00dev, 4, &bbp);
+        rt2x00_set_field8(&bbp, BBP4_BANDWIDTH, 2 * bw40);
+        rt2800usb_bbp_write(rt2x00dev, 4, bbp);
+
+        rt2800usb_rfcsr_read(rt2x00dev, 22, &rfcsr);
+        rt2x00_set_field8(&rfcsr, RFCSR22_BASEBAND_LOOPBACK, 1);
+        rt2800usb_rfcsr_write(rt2x00dev, 22, rfcsr);
+
+        /*
+         * Set power & frequency of passband test tone
+         */
+        rt2800usb_bbp_write(rt2x00dev, 24, 0);
+
+        for (i = 0; i < 100; i++) {
+                rt2800usb_bbp_write(rt2x00dev, 25, 0x90);
+                msleep(1);
+
+                rt2800usb_bbp_read(rt2x00dev, 55, &passband);
+                if (passband)
+                        break;
+        }
+
+        /*
+         * Set power & frequency of stopband test tone
+         */
+        rt2800usb_bbp_write(rt2x00dev, 24, 0x06);
+
+        for (i = 0; i < 100; i++) {
+                rt2800usb_bbp_write(rt2x00dev, 25, 0x90);
+                msleep(1);
+
+                rt2800usb_bbp_read(rt2x00dev, 55, &stopband);
+
+                if ((passband - stopband) <= filter_target) {
+                        rfcsr24++;
+                        overtuned += ((passband - stopband) == filter_target);
+                } else
+                        break;
+
+                rt2800usb_rfcsr_write(rt2x00dev, 24, rfcsr24);
+        }
+
+        rfcsr24 -= !!overtuned;
+
+        rt2800usb_rfcsr_write(rt2x00dev, 24, rfcsr24);
+        return rfcsr24;
+}
+
+static int rt2800usb_init_rfcsr(struct rt2x00_dev *rt2x00dev)
+{
+        u8 rfcsr;
+        u8 bbp;
+
+        if (rt2x00_rev(&rt2x00dev->chip) != RT3070_VERSION)
+                return 0;
+
+        /*
+         * Init RF calibration.
+         */
+        rt2800usb_rfcsr_read(rt2x00dev, 30, &rfcsr);
+        rt2x00_set_field8(&rfcsr, RFCSR30_RF_CALIBRATION, 1);
+        rt2800usb_rfcsr_write(rt2x00dev, 30, rfcsr);
+        msleep(1);
+        rt2x00_set_field8(&rfcsr, RFCSR30_RF_CALIBRATION, 0);
+        rt2800usb_rfcsr_write(rt2x00dev, 30, rfcsr);
+
+        rt2800usb_rfcsr_write(rt2x00dev, 4, 0x40);
+        rt2800usb_rfcsr_write(rt2x00dev, 5, 0x03);
+        rt2800usb_rfcsr_write(rt2x00dev, 6, 0x02);
+        rt2800usb_rfcsr_write(rt2x00dev, 7, 0x70);
+        rt2800usb_rfcsr_write(rt2x00dev, 9, 0x0f);
+        rt2800usb_rfcsr_write(rt2x00dev, 10, 0x71);
+        rt2800usb_rfcsr_write(rt2x00dev, 11, 0x21);
+        rt2800usb_rfcsr_write(rt2x00dev, 12, 0x7b);
+        rt2800usb_rfcsr_write(rt2x00dev, 14, 0x90);
+        rt2800usb_rfcsr_write(rt2x00dev, 15, 0x58);
+        rt2800usb_rfcsr_write(rt2x00dev, 16, 0xb3);
+        rt2800usb_rfcsr_write(rt2x00dev, 17, 0x92);
+        rt2800usb_rfcsr_write(rt2x00dev, 18, 0x2c);
+        rt2800usb_rfcsr_write(rt2x00dev, 19, 0x02);
+        rt2800usb_rfcsr_write(rt2x00dev, 20, 0xba);
+        rt2800usb_rfcsr_write(rt2x00dev, 21, 0xdb);
+        rt2800usb_rfcsr_write(rt2x00dev, 24, 0x16);
+        rt2800usb_rfcsr_write(rt2x00dev, 25, 0x01);
+        rt2800usb_rfcsr_write(rt2x00dev, 27, 0x03);
+        rt2800usb_rfcsr_write(rt2x00dev, 29, 0x1f);
+
+        /*
+         * Set RX Filter calibration for 20MHz and 40MHz
+         */
+        rt2x00dev->calibration[0] =
+            rt2800usb_init_rx_filter(rt2x00dev, false, 0x07, 0x16);
+        rt2x00dev->calibration[1] =
+            rt2800usb_init_rx_filter(rt2x00dev, true, 0x27, 0x19);
+
+        /*
+         * Set back to initial state
+         */
+        rt2800usb_bbp_write(rt2x00dev, 24, 0);
+
+        rt2800usb_rfcsr_read(rt2x00dev, 22, &rfcsr);
+        rt2x00_set_field8(&rfcsr, RFCSR22_BASEBAND_LOOPBACK, 0);
+        rt2800usb_rfcsr_write(rt2x00dev, 22, rfcsr);
+
+        /*
+         * set BBP back to BW20
+         */
+        rt2800usb_bbp_read(rt2x00dev, 4, &bbp);
+        rt2x00_set_field8(&bbp, BBP4_BANDWIDTH, 0);
+        rt2800usb_bbp_write(rt2x00dev, 4, bbp);
+
+        return 0;
+}
+
+/*
+ * Device state switch handlers.
+ */
+static void rt2800usb_toggle_rx(struct rt2x00_dev *rt2x00dev,
+                                enum dev_state state)
+{
+        u32 reg;
+
+        rt2x00usb_register_read(rt2x00dev, MAC_SYS_CTRL, &reg);
+        rt2x00_set_field32(&reg, MAC_SYS_CTRL_ENABLE_RX,
+                           (state == STATE_RADIO_RX_ON) ||
+                           (state == STATE_RADIO_RX_ON_LINK));
+        rt2x00usb_register_write(rt2x00dev, MAC_SYS_CTRL, reg);
+}
+
+static int rt2800usb_wait_wpdma_ready(struct rt2x00_dev *rt2x00dev)
+{
+        unsigned int i;
+        u32 reg;
+
+        for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
+                rt2x00usb_register_read(rt2x00dev, WPDMA_GLO_CFG, &reg);
+                if (!rt2x00_get_field32(reg, WPDMA_GLO_CFG_TX_DMA_BUSY) &&
+                    !rt2x00_get_field32(reg, WPDMA_GLO_CFG_RX_DMA_BUSY))
+                        return 0;
+
+                msleep(1);
+        }
+
+        ERROR(rt2x00dev, "WPDMA TX/RX busy, aborting.\n");
+        return -EACCES;
+}
+
+static int rt2800usb_enable_radio(struct rt2x00_dev *rt2x00dev)
+{
+        u32 reg;
+        u16 word;
+
+        /*
+         * Initialize all registers.
+         */
+        if (unlikely(rt2800usb_wait_wpdma_ready(rt2x00dev) ||
+                     rt2800usb_init_registers(rt2x00dev) ||
+                     rt2800usb_init_bbp(rt2x00dev) ||
+                     rt2800usb_init_rfcsr(rt2x00dev)))
+                return -EIO;
+
+        rt2x00usb_register_read(rt2x00dev, MAC_SYS_CTRL, &reg);
+        rt2x00_set_field32(&reg, MAC_SYS_CTRL_ENABLE_TX, 1);
+        rt2x00usb_register_write(rt2x00dev, MAC_SYS_CTRL, reg);
+
+        udelay(50);
+
+        rt2x00usb_register_read(rt2x00dev, WPDMA_GLO_CFG, &reg);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_TX_WRITEBACK_DONE, 1);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_RX_DMA, 1);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_TX_DMA, 1);
+        rt2x00usb_register_write(rt2x00dev, WPDMA_GLO_CFG, reg);
+
+
+        rt2x00usb_register_read(rt2x00dev, USB_DMA_CFG, &reg);
+        rt2x00_set_field32(&reg, USB_DMA_CFG_PHY_CLEAR, 0);
+        /* Don't use bulk in aggregation when working with USB 1.1 */
+        rt2x00_set_field32(&reg, USB_DMA_CFG_RX_BULK_AGG_EN,
+                           (rt2x00dev->rx->usb_maxpacket == 512));
+        rt2x00_set_field32(&reg, USB_DMA_CFG_RX_BULK_AGG_TIMEOUT, 128);
+        /*
+         * Total room for RX frames in kilobytes, PBF might still exceed
+         * this limit so reduce the number to prevent errors.
+         */
+        rt2x00_set_field32(&reg, USB_DMA_CFG_RX_BULK_AGG_LIMIT,
+                           ((RX_ENTRIES * DATA_FRAME_SIZE) / 1024) - 3);
+        rt2x00_set_field32(&reg, USB_DMA_CFG_RX_BULK_EN, 1);
+        rt2x00_set_field32(&reg, USB_DMA_CFG_TX_BULK_EN, 1);
+        rt2x00usb_register_write(rt2x00dev, USB_DMA_CFG, reg);
+
+        rt2x00usb_register_read(rt2x00dev, MAC_SYS_CTRL, &reg);
+        rt2x00_set_field32(&reg, MAC_SYS_CTRL_ENABLE_TX, 1);
+        rt2x00_set_field32(&reg, MAC_SYS_CTRL_ENABLE_RX, 1);
+        rt2x00usb_register_write(rt2x00dev, MAC_SYS_CTRL, reg);
+
+        /*
+         * Initialize LED control
+         */
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_LED1, &word);
+        rt2800usb_mcu_request(rt2x00dev, MCU_LED_1, 0xff,
+                              word & 0xff, (word >> 8) & 0xff);
+
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_LED2, &word);
+        rt2800usb_mcu_request(rt2x00dev, MCU_LED_2, 0xff,
+                              word & 0xff, (word >> 8) & 0xff);
+
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_LED3, &word);
+        rt2800usb_mcu_request(rt2x00dev, MCU_LED_3, 0xff,
+                              word & 0xff, (word >> 8) & 0xff);
+
+        return 0;
+}
+
+static void rt2800usb_disable_radio(struct rt2x00_dev *rt2x00dev)
+{
+        u32 reg;
+
+        rt2x00usb_register_read(rt2x00dev, WPDMA_GLO_CFG, &reg);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_TX_DMA, 0);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_RX_DMA, 0);
+        rt2x00usb_register_write(rt2x00dev, WPDMA_GLO_CFG, reg);
+
+        rt2x00usb_register_write(rt2x00dev, MAC_SYS_CTRL, 0);
+        rt2x00usb_register_write(rt2x00dev, PWR_PIN_CFG, 0);
+        rt2x00usb_register_write(rt2x00dev, TX_PIN_CFG, 0);
+
+        /* Wait for DMA, ignore error */
+        rt2800usb_wait_wpdma_ready(rt2x00dev);
+
+        rt2x00usb_disable_radio(rt2x00dev);
+}
+
+static int rt2800usb_set_state(struct rt2x00_dev *rt2x00dev,
+                               enum dev_state state)
+{
+        if (state == STATE_AWAKE)
+                rt2800usb_mcu_request(rt2x00dev, MCU_WAKEUP, 0xff, 0, 0);
+        else
+                rt2800usb_mcu_request(rt2x00dev, MCU_SLEEP, 0xff, 0, 2);
+
+        return 0;
+}
+
+static int rt2800usb_set_device_state(struct rt2x00_dev *rt2x00dev,
+                                      enum dev_state state)
+{
+        int retval = 0;
+
+        switch (state) {
+        case STATE_RADIO_ON:
+                /*
+                 * Before the radio can be enabled, the device first has
+                 * to be woken up. After that it needs a bit of time
+                 * to be fully awake and the radio can be enabled.
+                 */
+                rt2800usb_set_state(rt2x00dev, STATE_AWAKE);
+                msleep(1);
+                retval = rt2800usb_enable_radio(rt2x00dev);
+                break;
+        case STATE_RADIO_OFF:
+                /*
+                 * After the radio has been disablee, the device should
+                 * be put to sleep for powersaving.
+                 */
+                rt2800usb_disable_radio(rt2x00dev);
+                rt2800usb_set_state(rt2x00dev, STATE_SLEEP);
+                break;
+        case STATE_RADIO_RX_ON:
+        case STATE_RADIO_RX_ON_LINK:
+        case STATE_RADIO_RX_OFF:
+        case STATE_RADIO_RX_OFF_LINK:
+                rt2800usb_toggle_rx(rt2x00dev, state);
+                break;
+        case STATE_RADIO_IRQ_ON:
+        case STATE_RADIO_IRQ_OFF:
+                /* No support, but no error either */
+                break;
+        case STATE_DEEP_SLEEP:
+        case STATE_SLEEP:
+        case STATE_STANDBY:
+        case STATE_AWAKE:
+                retval = rt2800usb_set_state(rt2x00dev, state);
+                break;
+        default:
+                retval = -ENOTSUPP;
+                break;
+        }
+
+        if (unlikely(retval))
+                ERROR(rt2x00dev, "Device failed to enter state %d (%d).\n",
+                      state, retval);
+
+        return retval;
+}
+
+/*
+ * TX descriptor initialization
+ */
+static void rt2800usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
+                                    struct sk_buff *skb,
+                                    struct txentry_desc *txdesc)
+{
+        struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
+        __le32 *txi = skbdesc->desc;
+        __le32 *txwi = &txi[TXINFO_DESC_SIZE / sizeof(__le32)];
+        u32 word;
+
+        /*
+         * Initialize TX Info descriptor
+         */
+        rt2x00_desc_read(txwi, 0, &word);
+        rt2x00_set_field32(&word, TXWI_W0_FRAG,
+                           test_bit(ENTRY_TXD_MORE_FRAG, &txdesc->flags));
+        rt2x00_set_field32(&word, TXWI_W0_MIMO_PS, 0);
+        rt2x00_set_field32(&word, TXWI_W0_CF_ACK, 0);
+        rt2x00_set_field32(&word, TXWI_W0_TS,
+                           test_bit(ENTRY_TXD_REQ_TIMESTAMP, &txdesc->flags));
+        rt2x00_set_field32(&word, TXWI_W0_AMPDU,
+                           test_bit(ENTRY_TXD_HT_AMPDU, &txdesc->flags));
+        rt2x00_set_field32(&word, TXWI_W0_MPDU_DENSITY, txdesc->mpdu_density);
+        rt2x00_set_field32(&word, TXWI_W0_TX_OP, txdesc->ifs);
+        rt2x00_set_field32(&word, TXWI_W0_MCS, txdesc->mcs);
+        rt2x00_set_field32(&word, TXWI_W0_BW,
+                           test_bit(ENTRY_TXD_HT_BW_40, &txdesc->flags));
+        rt2x00_set_field32(&word, TXWI_W0_SHORT_GI,
+                           test_bit(ENTRY_TXD_HT_SHORT_GI, &txdesc->flags));
+        rt2x00_set_field32(&word, TXWI_W0_STBC, txdesc->stbc);
+        rt2x00_set_field32(&word, TXWI_W0_PHYMODE, txdesc->rate_mode);
+        rt2x00_desc_write(txwi, 0, word);
+
+        rt2x00_desc_read(txwi, 1, &word);
+        rt2x00_set_field32(&word, TXWI_W1_ACK,
+                           test_bit(ENTRY_TXD_ACK, &txdesc->flags));
+        rt2x00_set_field32(&word, TXWI_W1_NSEQ,
+                           test_bit(ENTRY_TXD_GENERATE_SEQ, &txdesc->flags));
+        rt2x00_set_field32(&word, TXWI_W1_BW_WIN_SIZE, txdesc->ba_size);
+        rt2x00_set_field32(&word, TXWI_W1_WIRELESS_CLI_ID,
+                           test_bit(ENTRY_TXD_ENCRYPT, &txdesc->flags) ?
+                               txdesc->key_idx : 0xff);
+        rt2x00_set_field32(&word, TXWI_W1_MPDU_TOTAL_BYTE_COUNT,
+                           skb->len - txdesc->l2pad);
+        rt2x00_set_field32(&word, TXWI_W1_PACKETID,
+                           skbdesc->entry->entry_idx);
+        rt2x00_desc_write(txwi, 1, word);
+
+        /*
+         * Always write 0 to IV/EIV fields, hardware will insert the IV
+         * from the IVEIV register when TXINFO_W0_WIV is set to 0.
+         * When TXINFO_W0_WIV is set to 1 it will use the IV data
+         * from the descriptor. The TXWI_W1_WIRELESS_CLI_ID indicates which
+         * crypto entry in the registers should be used to encrypt the frame.
+         */
+        _rt2x00_desc_write(txwi, 2, 0 /* skbdesc->iv[0] */);
+        _rt2x00_desc_write(txwi, 3, 0 /* skbdesc->iv[1] */);
+
+        /*
+         * Initialize TX descriptor
+         */
+        rt2x00_desc_read(txi, 0, &word);
+        rt2x00_set_field32(&word, TXINFO_W0_USB_DMA_TX_PKT_LEN,
+                           skb->len + TXWI_DESC_SIZE);
+        rt2x00_set_field32(&word, TXINFO_W0_WIV,
+                           !test_bit(ENTRY_TXD_ENCRYPT_IV, &txdesc->flags));
+        rt2x00_set_field32(&word, TXINFO_W0_QSEL, 2);
+        rt2x00_set_field32(&word, TXINFO_W0_SW_USE_LAST_ROUND, 0);
+        rt2x00_set_field32(&word, TXINFO_W0_USB_DMA_NEXT_VALID, 0);
+        rt2x00_set_field32(&word, TXINFO_W0_USB_DMA_TX_BURST,
+                           test_bit(ENTRY_TXD_BURST, &txdesc->flags));
+        rt2x00_desc_write(txi, 0, word);
+}
+
+/*
+ * TX data initialization
+ */
+static void rt2800usb_write_beacon(struct queue_entry *entry)
+{
+        struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
+        struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
+        unsigned int beacon_base;
+        u32 reg;
+
+        /*
+         * Add the descriptor in front of the skb.
+         */
+        skb_push(entry->skb, entry->queue->desc_size);
+        memcpy(entry->skb->data, skbdesc->desc, skbdesc->desc_len);
+        skbdesc->desc = entry->skb->data;
+
+        /*
+         * Disable beaconing while we are reloading the beacon data,
+         * otherwise we might be sending out invalid data.
+         */
+        rt2x00usb_register_read(rt2x00dev, BCN_TIME_CFG, &reg);
+        rt2x00_set_field32(&reg, BCN_TIME_CFG_TSF_TICKING, 0);
+        rt2x00_set_field32(&reg, BCN_TIME_CFG_TBTT_ENABLE, 0);
+        rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_GEN, 0);
+        rt2x00usb_register_write(rt2x00dev, BCN_TIME_CFG, reg);
+
+        /*
+         * Write entire beacon with descriptor to register.
+         */
+        beacon_base = HW_BEACON_OFFSET(entry->entry_idx);
+        rt2x00usb_vendor_request_large_buff(rt2x00dev, USB_MULTI_WRITE,
+                                            USB_VENDOR_REQUEST_OUT, beacon_base,
+                                            entry->skb->data, entry->skb->len,
+                                            REGISTER_TIMEOUT32(entry->skb->len));
+
+        /*
+         * Clean up the beacon skb.
+         */
+        dev_kfree_skb(entry->skb);
+        entry->skb = NULL;
+}
+
+static int rt2800usb_get_tx_data_len(struct queue_entry *entry)
+{
+        int length;
+
+        /*
+         * The length _must_ include 4 bytes padding,
+         * it should always be multiple of 4,
+         * but it must _not_ be a multiple of the USB packet size.
+         */
+        length = roundup(entry->skb->len + 4, 4);
+        length += (4 * !(length % entry->queue->usb_maxpacket));
+
+        return length;
+}
+
+static void rt2800usb_kick_tx_queue(struct rt2x00_dev *rt2x00dev,
+                                    const enum data_queue_qid queue)
+{
+        u32 reg;
+
+        if (queue != QID_BEACON) {
+                rt2x00usb_kick_tx_queue(rt2x00dev, queue);
+                return;
+        }
+
+        rt2x00usb_register_read(rt2x00dev, BCN_TIME_CFG, &reg);
+        if (!rt2x00_get_field32(reg, BCN_TIME_CFG_BEACON_GEN)) {
+                rt2x00_set_field32(&reg, BCN_TIME_CFG_TSF_TICKING, 1);
+                rt2x00_set_field32(&reg, BCN_TIME_CFG_TBTT_ENABLE, 1);
+                rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_GEN, 1);
+                rt2x00usb_register_write(rt2x00dev, BCN_TIME_CFG, reg);
+        }
+}
+
+/*
+ * RX control handlers
+ */
+static void rt2800usb_fill_rxdone(struct queue_entry *entry,
+                                  struct rxdone_entry_desc *rxdesc)
+{
+        struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
+        struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
+        __le32 *rxd = (__le32 *)entry->skb->data;
+        __le32 *rxwi;
+        u32 rxd0;
+        u32 rxwi0;
+        u32 rxwi1;
+        u32 rxwi2;
+        u32 rxwi3;
+
+        /*
+         * Copy descriptor to the skbdesc->desc buffer, making it safe from
+         * moving of frame data in rt2x00usb.
+         */
+        memcpy(skbdesc->desc, rxd, skbdesc->desc_len);
+        rxd = (__le32 *)skbdesc->desc;
+        rxwi = &rxd[RXD_DESC_SIZE / sizeof(__le32)];
+
+        /*
+         * It is now safe to read the descriptor on all architectures.
+         */
+        rt2x00_desc_read(rxd, 0, &rxd0);
+        rt2x00_desc_read(rxwi, 0, &rxwi0);
+        rt2x00_desc_read(rxwi, 1, &rxwi1);
+        rt2x00_desc_read(rxwi, 2, &rxwi2);
+        rt2x00_desc_read(rxwi, 3, &rxwi3);
+
+        if (rt2x00_get_field32(rxd0, RXD_W0_CRC_ERROR))
+                rxdesc->flags |= RX_FLAG_FAILED_FCS_CRC;
+
+        if (test_bit(CONFIG_SUPPORT_HW_CRYPTO, &rt2x00dev->flags)) {
+                rxdesc->cipher = rt2x00_get_field32(rxwi0, RXWI_W0_UDF);
+                rxdesc->cipher_status =
+                    rt2x00_get_field32(rxd0, RXD_W0_CIPHER_ERROR);
+        }
+
+        if (rt2x00_get_field32(rxd0, RXD_W0_DECRYPTED)) {
+                /*
+                 * Hardware has stripped IV/EIV data from 802.11 frame during
+                 * decryption. Unfortunately the descriptor doesn't contain
+                 * any fields with the EIV/IV data either, so they can't
+                 * be restored by rt2x00lib.
+                 */
+                rxdesc->flags |= RX_FLAG_IV_STRIPPED;
+
+                if (rxdesc->cipher_status == RX_CRYPTO_SUCCESS)
+                        rxdesc->flags |= RX_FLAG_DECRYPTED;
+                else if (rxdesc->cipher_status == RX_CRYPTO_FAIL_MIC)
+                        rxdesc->flags |= RX_FLAG_MMIC_ERROR;
+        }
+
+        if (rt2x00_get_field32(rxd0, RXD_W0_MY_BSS))
+                rxdesc->dev_flags |= RXDONE_MY_BSS;
+
+        if (rt2x00_get_field32(rxd0, RXD_W0_L2PAD))
+                rxdesc->dev_flags |= RXDONE_L2PAD;
+
+        if (rt2x00_get_field32(rxwi1, RXWI_W1_SHORT_GI))
+                rxdesc->flags |= RX_FLAG_SHORT_GI;
+
+        if (rt2x00_get_field32(rxwi1, RXWI_W1_BW))
+                rxdesc->flags |= RX_FLAG_40MHZ;
+
+        /*
+         * Detect RX rate, always use MCS as signal type.
+         */
+        rxdesc->dev_flags |= RXDONE_SIGNAL_MCS;
+        rxdesc->rate_mode = rt2x00_get_field32(rxwi1, RXWI_W1_PHYMODE);
+        rxdesc->signal = rt2x00_get_field32(rxwi1, RXWI_W1_MCS);
+
+        /*
+         * Mask of 0x8 bit to remove the short preamble flag.
+         */
+        if (rxdesc->rate_mode == RATE_MODE_CCK)
+                rxdesc->signal &= ~0x8;
+
+        rxdesc->rssi =
+            (rt2x00_get_field32(rxwi2, RXWI_W2_RSSI0) +
+             rt2x00_get_field32(rxwi2, RXWI_W2_RSSI1)) / 2;
+
+        rxdesc->noise =
+            (rt2x00_get_field32(rxwi3, RXWI_W3_SNR0) +
+             rt2x00_get_field32(rxwi3, RXWI_W3_SNR1)) / 2;
+
+        rxdesc->size = rt2x00_get_field32(rxwi0, RXWI_W0_MPDU_TOTAL_BYTE_COUNT);
+
+        /*
+         * Remove RXWI descriptor from start of buffer.
+         */
+        skb_pull(entry->skb, skbdesc->desc_len);
+        skb_trim(entry->skb, rxdesc->size);
+}
+
+/*
+ * Device probe functions.
+ */
+static int rt2800usb_validate_eeprom(struct rt2x00_dev *rt2x00dev)
+{
+        u16 word;
+        u8 *mac;
+        u8 default_lna_gain;
+
+        rt2x00usb_eeprom_read(rt2x00dev, rt2x00dev->eeprom, EEPROM_SIZE);
+
+        /*
+         * Start validation of the data that has been read.
+         */
+        mac = rt2x00_eeprom_addr(rt2x00dev, EEPROM_MAC_ADDR_0);
+        if (!is_valid_ether_addr(mac)) {
+                DECLARE_MAC_BUF(macbuf);
+
+                random_ether_addr(mac);
+                EEPROM(rt2x00dev, "MAC: %s\n", print_mac(macbuf, mac));
+        }
+
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_ANTENNA, &word);
+        if (word == 0xffff) {
+                rt2x00_set_field16(&word, EEPROM_ANTENNA_RXPATH, 2);
+                rt2x00_set_field16(&word, EEPROM_ANTENNA_TXPATH, 1);
+                rt2x00_set_field16(&word, EEPROM_ANTENNA_RF_TYPE, RF2820);
+                rt2x00_eeprom_write(rt2x00dev, EEPROM_ANTENNA, word);
+                EEPROM(rt2x00dev, "Antenna: 0x%04x\n", word);
+        } else if (rt2x00_rev(&rt2x00dev->chip) < RT2883_VERSION) {
+                /*
+                 * There is a max of 2 RX streams for RT2870 series
+                 */
+                if (rt2x00_get_field16(word, EEPROM_ANTENNA_RXPATH) > 2)
+                        rt2x00_set_field16(&word, EEPROM_ANTENNA_RXPATH, 2);
+                rt2x00_eeprom_write(rt2x00dev, EEPROM_ANTENNA, word);
+        }
+
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_NIC, &word);
+        if (word == 0xffff) {
+                rt2x00_set_field16(&word, EEPROM_NIC_HW_RADIO, 0);
+                rt2x00_set_field16(&word, EEPROM_NIC_DYNAMIC_TX_AGC, 0);
+                rt2x00_set_field16(&word, EEPROM_NIC_EXTERNAL_LNA_BG, 0);
+                rt2x00_set_field16(&word, EEPROM_NIC_EXTERNAL_LNA_A, 0);
+                rt2x00_set_field16(&word, EEPROM_NIC_CARDBUS_ACCEL, 0);
+                rt2x00_set_field16(&word, EEPROM_NIC_BW40M_SB_BG, 0);
+                rt2x00_set_field16(&word, EEPROM_NIC_BW40M_SB_A, 0);
+                rt2x00_set_field16(&word, EEPROM_NIC_WPS_PBC, 0);
+                rt2x00_set_field16(&word, EEPROM_NIC_BW40M_BG, 0);
+                rt2x00_set_field16(&word, EEPROM_NIC_BW40M_A, 0);
+                rt2x00_eeprom_write(rt2x00dev, EEPROM_NIC, word);
+                EEPROM(rt2x00dev, "NIC: 0x%04x\n", word);
+        }
+
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_FREQ, &word);
+        if ((word & 0x00ff) == 0x00ff) {
+                rt2x00_set_field16(&word, EEPROM_FREQ_OFFSET, 0);
+                rt2x00_set_field16(&word, EEPROM_FREQ_LED_MODE,
+                                   LED_MODE_TXRX_ACTIVITY);
+                rt2x00_set_field16(&word, EEPROM_FREQ_LED_POLARITY, 0);
+                rt2x00_eeprom_write(rt2x00dev, EEPROM_FREQ, word);
+                rt2x00_eeprom_write(rt2x00dev, EEPROM_LED1, 0x5555);
+                rt2x00_eeprom_write(rt2x00dev, EEPROM_LED2, 0x2221);
+                rt2x00_eeprom_write(rt2x00dev, EEPROM_LED3, 0xa9f8);
+                EEPROM(rt2x00dev, "Freq: 0x%04x\n", word);
+        }
+
+        /*
+         * During the LNA validation we are going to use
+         * lna0 as correct value. Note that EEPROM_LNA
+         * is never validated.
+         */
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_LNA, &word);
+        default_lna_gain = rt2x00_get_field16(word, EEPROM_LNA_A0);
+
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_RSSI_BG, &word);
+        if (abs(rt2x00_get_field16(word, EEPROM_RSSI_BG_OFFSET0)) > 10)
+                rt2x00_set_field16(&word, EEPROM_RSSI_BG_OFFSET0, 0);
+        if (abs(rt2x00_get_field16(word, EEPROM_RSSI_BG_OFFSET1)) > 10)
+                rt2x00_set_field16(&word, EEPROM_RSSI_BG_OFFSET1, 0);
+        rt2x00_eeprom_write(rt2x00dev, EEPROM_RSSI_BG, word);
+
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_RSSI_BG2, &word);
+        if (abs(rt2x00_get_field16(word, EEPROM_RSSI_BG2_OFFSET2)) > 10)
+                rt2x00_set_field16(&word, EEPROM_RSSI_BG2_OFFSET2, 0);
+        if (rt2x00_get_field16(word, EEPROM_RSSI_BG2_LNA_A1) == 0x00 ||
+            rt2x00_get_field16(word, EEPROM_RSSI_BG2_LNA_A1) == 0xff)
+                rt2x00_set_field16(&word, EEPROM_RSSI_BG2_LNA_A1,
+                                   default_lna_gain);
+        rt2x00_eeprom_write(rt2x00dev, EEPROM_RSSI_BG2, word);
+
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_RSSI_A, &word);
+        if (abs(rt2x00_get_field16(word, EEPROM_RSSI_A_OFFSET0)) > 10)
+                rt2x00_set_field16(&word, EEPROM_RSSI_A_OFFSET0, 0);
+        if (abs(rt2x00_get_field16(word, EEPROM_RSSI_A_OFFSET1)) > 10)
+                rt2x00_set_field16(&word, EEPROM_RSSI_A_OFFSET1, 0);
+        rt2x00_eeprom_write(rt2x00dev, EEPROM_RSSI_A, word);
+
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_RSSI_A2, &word);
+        if (abs(rt2x00_get_field16(word, EEPROM_RSSI_A2_OFFSET2)) > 10)
+                rt2x00_set_field16(&word, EEPROM_RSSI_A2_OFFSET2, 0);
+        if (rt2x00_get_field16(word, EEPROM_RSSI_A2_LNA_A2) == 0x00 ||
+            rt2x00_get_field16(word, EEPROM_RSSI_A2_LNA_A2) == 0xff)
+                rt2x00_set_field16(&word, EEPROM_RSSI_A2_LNA_A2,
+                                   default_lna_gain);
+        rt2x00_eeprom_write(rt2x00dev, EEPROM_RSSI_A2, word);
+
+        return 0;
+}
+
+static int rt2800usb_init_eeprom(struct rt2x00_dev *rt2x00dev)
+{
+        u32 reg;
+        u16 value;
+        u16 eeprom;
+
+        /*
+         * Read EEPROM word for configuration.
+         */
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_ANTENNA, &eeprom);
+
+        /*
+         * Identify RF chipset.
+         */
+        value = rt2x00_get_field16(eeprom, EEPROM_ANTENNA_RF_TYPE);
+        rt2x00usb_register_read(rt2x00dev, MAC_CSR0, &reg);
+        rt2x00_set_chip(rt2x00dev, RT2870, value, reg);
+
+        /*
+         * The check for rt2860 is not a typo, some rt2870 hardware
+         * identifies itself as rt2860 in the CSR register.
+         */
+        if (!rt2x00_check_rev(&rt2x00dev->chip, 0xfff00000, 0x28600000) &&
+            !rt2x00_check_rev(&rt2x00dev->chip, 0xfff00000, 0x28700000) &&
+            !rt2x00_check_rev(&rt2x00dev->chip, 0xfff00000, 0x28800000) &&
+            !rt2x00_check_rev(&rt2x00dev->chip, 0xffff0000, 0x30700000)) {
+                ERROR(rt2x00dev, "Invalid RT chipset detected.\n");
+                return -ENODEV;
+        }
+
+        if (!rt2x00_rf(&rt2x00dev->chip, RF2820) &&
+            !rt2x00_rf(&rt2x00dev->chip, RF2850) &&
+            !rt2x00_rf(&rt2x00dev->chip, RF2720) &&
+            !rt2x00_rf(&rt2x00dev->chip, RF2750) &&
+            !rt2x00_rf(&rt2x00dev->chip, RF3020) &&
+            !rt2x00_rf(&rt2x00dev->chip, RF2020)) {
+                ERROR(rt2x00dev, "Invalid RF chipset detected.\n");
+                return -ENODEV;
+        }
+
+        /*
+         * Identify default antenna configuration.
+         */
+        rt2x00dev->default_ant.tx =
+            rt2x00_get_field16(eeprom, EEPROM_ANTENNA_TXPATH);
+        rt2x00dev->default_ant.rx =
+            rt2x00_get_field16(eeprom, EEPROM_ANTENNA_RXPATH);
+
+        /*
+         * Read frequency offset and RF programming sequence.
+         */
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_FREQ, &eeprom);
+        rt2x00dev->freq_offset = rt2x00_get_field16(eeprom, EEPROM_FREQ_OFFSET);
+
+        /*
+         * Read external LNA informations.
+         */
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_NIC, &eeprom);
+
+        if (rt2x00_get_field16(eeprom, EEPROM_NIC_EXTERNAL_LNA_A))
+                __set_bit(CONFIG_EXTERNAL_LNA_A, &rt2x00dev->flags);
+        if (rt2x00_get_field16(eeprom, EEPROM_NIC_EXTERNAL_LNA_BG))
+                __set_bit(CONFIG_EXTERNAL_LNA_BG, &rt2x00dev->flags);
+
+        /*
+         * Detect if this device has an hardware controlled radio.
+         */
+#ifdef CONFIG_RT2X00_LIB_RFKILL
+        if (rt2x00_get_field16(eeprom, EEPROM_NIC_HW_RADIO))
+                __set_bit(CONFIG_SUPPORT_HW_BUTTON, &rt2x00dev->flags);
+#endif /* CONFIG_RT2X00_LIB_RFKILL */
+
+        /*
+         * Store led settings, for correct led behaviour.
+         */
+#ifdef CONFIG_RT2X00_LIB_LEDS
+        rt2800usb_init_led(rt2x00dev, &rt2x00dev->led_radio, LED_TYPE_RADIO);
+        rt2800usb_init_led(rt2x00dev, &rt2x00dev->led_assoc, LED_TYPE_ASSOC);
+        rt2800usb_init_led(rt2x00dev, &rt2x00dev->led_qual, LED_TYPE_QUALITY);
+
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_FREQ,
+                           &rt2x00dev->led_mcu_reg);
+#endif /* CONFIG_RT2X00_LIB_LEDS */
+
+        return 0;
+}
+
+/*
+ * RF value list for rt2870
+ * Supports: 2.4 GHz (all) & 5.2 GHz (RF2850 & RF2750)
+ */
+static const struct rf_channel rf_vals[] = {
+        { 1,  0x18402ecc, 0x184c0786, 0x1816b455, 0x1800510b },
+        { 2,  0x18402ecc, 0x184c0786, 0x18168a55, 0x1800519f },
+        { 3,  0x18402ecc, 0x184c078a, 0x18168a55, 0x1800518b },
+        { 4,  0x18402ecc, 0x184c078a, 0x18168a55, 0x1800519f },
+        { 5,  0x18402ecc, 0x184c078e, 0x18168a55, 0x1800518b },
+        { 6,  0x18402ecc, 0x184c078e, 0x18168a55, 0x1800519f },
+        { 7,  0x18402ecc, 0x184c0792, 0x18168a55, 0x1800518b },
+        { 8,  0x18402ecc, 0x184c0792, 0x18168a55, 0x1800519f },
+        { 9,  0x18402ecc, 0x184c0796, 0x18168a55, 0x1800518b },
+        { 10, 0x18402ecc, 0x184c0796, 0x18168a55, 0x1800519f },
+        { 11, 0x18402ecc, 0x184c079a, 0x18168a55, 0x1800518b },
+        { 12, 0x18402ecc, 0x184c079a, 0x18168a55, 0x1800519f },
+        { 13, 0x18402ecc, 0x184c079e, 0x18168a55, 0x1800518b },
+        { 14, 0x18402ecc, 0x184c07a2, 0x18168a55, 0x18005193 },
+
+        /* 802.11 UNI / HyperLan 2 */
+        { 36, 0x18402ecc, 0x184c099a, 0x18158a55, 0x180ed1a3 },
+        { 38, 0x18402ecc, 0x184c099e, 0x18158a55, 0x180ed193 },
+        { 40, 0x18402ec8, 0x184c0682, 0x18158a55, 0x180ed183 },
+        { 44, 0x18402ec8, 0x184c0682, 0x18158a55, 0x180ed1a3 },
+        { 46, 0x18402ec8, 0x184c0686, 0x18158a55, 0x180ed18b },
+        { 48, 0x18402ec8, 0x184c0686, 0x18158a55, 0x180ed19b },
+        { 52, 0x18402ec8, 0x184c068a, 0x18158a55, 0x180ed193 },
+        { 54, 0x18402ec8, 0x184c068a, 0x18158a55, 0x180ed1a3 },
+        { 56, 0x18402ec8, 0x184c068e, 0x18158a55, 0x180ed18b },
+        { 60, 0x18402ec8, 0x184c0692, 0x18158a55, 0x180ed183 },
+        { 62, 0x18402ec8, 0x184c0692, 0x18158a55, 0x180ed193 },
+        { 64, 0x18402ec8, 0x184c0692, 0x18158a55, 0x180ed1a3 },
+
+        /* 802.11 HyperLan 2 */
+        { 100, 0x18402ec8, 0x184c06b2, 0x18178a55, 0x180ed783 },
+        { 102, 0x18402ec8, 0x184c06b2, 0x18578a55, 0x180ed793 },
+        { 104, 0x18402ec8, 0x185c06b2, 0x18578a55, 0x180ed1a3 },
+        { 108, 0x18402ecc, 0x185c0a32, 0x18578a55, 0x180ed193 },
+        { 110, 0x18402ecc, 0x184c0a36, 0x18178a55, 0x180ed183 },
+        { 112, 0x18402ecc, 0x184c0a36, 0x18178a55, 0x180ed19b },
+        { 116, 0x18402ecc, 0x184c0a3a, 0x18178a55, 0x180ed1a3 },
+        { 118, 0x18402ecc, 0x184c0a3e, 0x18178a55, 0x180ed193 },
+        { 120, 0x18402ec4, 0x184c0382, 0x18178a55, 0x180ed183 },
+        { 124, 0x18402ec4, 0x184c0382, 0x18178a55, 0x180ed193 },
+        { 126, 0x18402ec4, 0x184c0382, 0x18178a55, 0x180ed15b },
+        { 128, 0x18402ec4, 0x184c0382, 0x18178a55, 0x180ed1a3 },
+        { 132, 0x18402ec4, 0x184c0386, 0x18178a55, 0x180ed18b },
+        { 134, 0x18402ec4, 0x184c0386, 0x18178a55, 0x180ed193 },
+        { 136, 0x18402ec4, 0x184c0386, 0x18178a55, 0x180ed19b },
+        { 140, 0x18402ec4, 0x184c038a, 0x18178a55, 0x180ed183 },
+
+        /* 802.11 UNII */
+        { 149, 0x18402ec4, 0x184c038a, 0x18178a55, 0x180ed1a7 },
+        { 151, 0x18402ec4, 0x184c038e, 0x18178a55, 0x180ed187 },
+        { 153, 0x18402ec4, 0x184c038e, 0x18178a55, 0x180ed18f },
+        { 157, 0x18402ec4, 0x184c038e, 0x18178a55, 0x180ed19f },
+        { 159, 0x18402ec4, 0x184c038e, 0x18178a55, 0x180ed1a7 },
+        { 161, 0x18402ec4, 0x184c0392, 0x18178a55, 0x180ed187 },
+        { 165, 0x18402ec4, 0x184c0392, 0x18178a55, 0x180ed197 },
+        { 167, 0x18402ec4, 0x184c03d2, 0x18179855, 0x1815531f },
+        { 169, 0x18402ec4, 0x184c03d2, 0x18179855, 0x18155327 },
+        { 171, 0x18402ec4, 0x184c03d6, 0x18179855, 0x18155307 },
+        { 173, 0x18402ec4, 0x184c03d6, 0x18179855, 0x1815530f },
+
+        /* 802.11 Japan */
+        { 184, 0x15002ccc, 0x1500491e, 0x1509be55, 0x150c0a0b },
+        { 188, 0x15002ccc, 0x15004922, 0x1509be55, 0x150c0a13 },
+        { 192, 0x15002ccc, 0x15004926, 0x1509be55, 0x150c0a1b },
+        { 196, 0x15002ccc, 0x1500492a, 0x1509be55, 0x150c0a23 },
+        { 208, 0x15002ccc, 0x1500493a, 0x1509be55, 0x150c0a13 },
+        { 212, 0x15002ccc, 0x1500493e, 0x1509be55, 0x150c0a1b },
+        { 216, 0x15002ccc, 0x15004982, 0x1509be55, 0x150c0a23 },
+};
+
+/*
+ * RF value list for rt3070
+ * Supports: 2.4 GHz
+ */
+static const struct rf_channel rf_vals_3070[] = {
+        {1,  241, 2, 2 },
+        {2,  241, 2, 7 },
+        {3,  242, 2, 2 },
+        {4,  242, 2, 7 },
+        {5,  243, 2, 2 },
+        {6,  243, 2, 7 },
+        {7,  244, 2, 2 },
+        {8,  244, 2, 7 },
+        {9,  245, 2, 2 },
+        {10, 245, 2, 7 },
+        {11, 246, 2, 2 },
+        {12, 246, 2, 7 },
+        {13, 247, 2, 2 },
+        {14, 248, 2, 4 },
+};
+
+static int rt2800usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
+{
+        struct hw_mode_spec *spec = &rt2x00dev->spec;
+        struct channel_info *info;
+        char *tx_power1;
+        char *tx_power2;
+        unsigned int i;
+        u16 eeprom;
+
+        /*
+         * Initialize all hw fields.
+         */
+        rt2x00dev->hw->flags =
+            IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
+            IEEE80211_HW_SIGNAL_DBM |
+            IEEE80211_HW_SUPPORTS_PS |
+            IEEE80211_HW_PS_NULLFUNC_STACK;
+        rt2x00dev->hw->extra_tx_headroom = TXINFO_DESC_SIZE + TXWI_DESC_SIZE;
+
+        SET_IEEE80211_DEV(rt2x00dev->hw, rt2x00dev->dev);
+        SET_IEEE80211_PERM_ADDR(rt2x00dev->hw,
+                                rt2x00_eeprom_addr(rt2x00dev,
+                                                   EEPROM_MAC_ADDR_0));
+
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_ANTENNA, &eeprom);
+
+        /*
+         * Initialize HT information.
+         */
+        spec->ht.ht_supported = true;
+        spec->ht.cap =
+            IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
+            IEEE80211_HT_CAP_GRN_FLD |
+            IEEE80211_HT_CAP_SGI_20 |
+            IEEE80211_HT_CAP_SGI_40 |
+            IEEE80211_HT_CAP_TX_STBC |
+            IEEE80211_HT_CAP_RX_STBC |
+            IEEE80211_HT_CAP_PSMP_SUPPORT;
+        spec->ht.ampdu_factor = 3;
+        spec->ht.ampdu_density = 4;
+        spec->ht.mcs.tx_params =
+            IEEE80211_HT_MCS_TX_DEFINED |
+            IEEE80211_HT_MCS_TX_RX_DIFF |
+            ((rt2x00_get_field16(eeprom, EEPROM_ANTENNA_TXPATH) - 1) <<
+                IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT);
+
+        switch (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_RXPATH)) {
+        case 3:
+                spec->ht.mcs.rx_mask[2] = 0xff;
+        case 2:
+                spec->ht.mcs.rx_mask[1] = 0xff;
+        case 1:
+                spec->ht.mcs.rx_mask[0] = 0xff;
+                spec->ht.mcs.rx_mask[4] = 0x1; /* MCS32 */
+                break;
+        }
+
+        /*
+         * Initialize hw_mode information.
+         */
+        spec->supported_bands = SUPPORT_BAND_2GHZ;
+        spec->supported_rates = SUPPORT_RATE_CCK | SUPPORT_RATE_OFDM;
+
+        if (rt2x00_rf(&rt2x00dev->chip, RF2820) ||
+            rt2x00_rf(&rt2x00dev->chip, RF2720)) {
+                spec->num_channels = 14;
+                spec->channels = rf_vals;
+        } else if (rt2x00_rf(&rt2x00dev->chip, RF2850) ||
+                   rt2x00_rf(&rt2x00dev->chip, RF2750)) {
+                spec->supported_bands |= SUPPORT_BAND_5GHZ;
+                spec->num_channels = ARRAY_SIZE(rf_vals);
+                spec->channels = rf_vals;
+        } else if (rt2x00_rf(&rt2x00dev->chip, RF3020) ||
+                   rt2x00_rf(&rt2x00dev->chip, RF2020)) {
+                spec->num_channels = ARRAY_SIZE(rf_vals_3070);
+                spec->channels = rf_vals_3070;
+        }
+
+        /*
+         * Create channel information array
+         */
+        info = kzalloc(spec->num_channels * sizeof(*info), GFP_KERNEL);
+        if (!info)
+                return -ENOMEM;
+
+        spec->channels_info = info;
+
+        tx_power1 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_BG1);
+        tx_power2 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_BG2);
+
+        for (i = 0; i < 14; i++) {
+                info[i].tx_power1 = TXPOWER_G_FROM_DEV(tx_power1[i]);
+                info[i].tx_power2 = TXPOWER_G_FROM_DEV(tx_power2[i]);
+        }
+
+        if (spec->num_channels > 14) {
+                tx_power1 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A1);
+                tx_power2 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A2);
+
+                for (i = 14; i < spec->num_channels; i++) {
+                        info[i].tx_power1 = TXPOWER_A_FROM_DEV(tx_power1[i]);
+                        info[i].tx_power2 = TXPOWER_A_FROM_DEV(tx_power2[i]);
+                }
+        }
+
+        return 0;
+}
+
+static int rt2800usb_probe_hw(struct rt2x00_dev *rt2x00dev)
+{
+        int retval;
+
+        /*
+         * Allocate eeprom data.
+         */
+        retval = rt2800usb_validate_eeprom(rt2x00dev);
+        if (retval)
+                return retval;
+
+        retval = rt2800usb_init_eeprom(rt2x00dev);
+        if (retval)
+                return retval;
+
+        /*
+         * Initialize hw specifications.
+         */
+        retval = rt2800usb_probe_hw_mode(rt2x00dev);
+        if (retval)
+                return retval;
+
+        /*
+         * This device requires firmware.
+         */
+        __set_bit(DRIVER_REQUIRE_FIRMWARE, &rt2x00dev->flags);
+        __set_bit(DRIVER_REQUIRE_SCHEDULED, &rt2x00dev->flags);
+        __set_bit(DRIVER_REQUIRE_L2PAD, &rt2x00dev->flags);
+        if (!modparam_nohwcrypt)
+                __set_bit(CONFIG_SUPPORT_HW_CRYPTO, &rt2x00dev->flags);
+
+        /*
+         * Set the rssi offset.
+         */
+        rt2x00dev->rssi_offset = DEFAULT_RSSI_OFFSET;
+
+        return 0;
+}
+
+/*
+ * IEEE80211 stack callback functions.
+ */
+static void rt2800usb_get_tkip_seq(struct ieee80211_hw *hw, u8 hw_key_idx,
+                                   u32 *iv32, u16 *iv16)
+{
+        struct rt2x00_dev *rt2x00dev = hw->priv;
+        struct mac_iveiv_entry iveiv_entry;
+        u32 offset;
+
+        offset = MAC_IVEIV_ENTRY(hw_key_idx);
+        rt2x00usb_register_multiread(rt2x00dev, offset,
+                                      &iveiv_entry, sizeof(iveiv_entry));
+
+        memcpy(&iveiv_entry.iv[0], iv16, sizeof(iv16));
+        memcpy(&iveiv_entry.iv[4], iv32, sizeof(iv32));
+}
+
+static int rt2800usb_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
+{
+        struct rt2x00_dev *rt2x00dev = hw->priv;
+        u32 reg;
+        bool enabled = (value < IEEE80211_MAX_RTS_THRESHOLD);
+
+        rt2x00usb_register_read(rt2x00dev, TX_RTS_CFG, &reg);
+        rt2x00_set_field32(&reg, TX_RTS_CFG_RTS_THRES, value);
+        rt2x00usb_register_write(rt2x00dev, TX_RTS_CFG, reg);
+
+        rt2x00usb_register_read(rt2x00dev, CCK_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, CCK_PROT_CFG_RTS_TH_EN, enabled);
+        rt2x00usb_register_write(rt2x00dev, CCK_PROT_CFG, reg);
+
+        rt2x00usb_register_read(rt2x00dev, OFDM_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, OFDM_PROT_CFG_RTS_TH_EN, enabled);
+        rt2x00usb_register_write(rt2x00dev, OFDM_PROT_CFG, reg);
+
+        rt2x00usb_register_read(rt2x00dev, MM20_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, MM20_PROT_CFG_RTS_TH_EN, enabled);
+        rt2x00usb_register_write(rt2x00dev, MM20_PROT_CFG, reg);
+
+        rt2x00usb_register_read(rt2x00dev, MM40_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, MM40_PROT_CFG_RTS_TH_EN, enabled);
+        rt2x00usb_register_write(rt2x00dev, MM40_PROT_CFG, reg);
+
+        rt2x00usb_register_read(rt2x00dev, GF20_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, GF20_PROT_CFG_RTS_TH_EN, enabled);
+        rt2x00usb_register_write(rt2x00dev, GF20_PROT_CFG, reg);
+
+        rt2x00usb_register_read(rt2x00dev, GF40_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, GF40_PROT_CFG_RTS_TH_EN, enabled);
+        rt2x00usb_register_write(rt2x00dev, GF40_PROT_CFG, reg);
+
+        return 0;
+}
+
+static int rt2800usb_conf_tx(struct ieee80211_hw *hw, u16 queue_idx,
+                             const struct ieee80211_tx_queue_params *params)
+{
+        struct rt2x00_dev *rt2x00dev = hw->priv;
+        struct data_queue *queue;
+        struct rt2x00_field32 field;
+        int retval;
+        u32 reg;
+        u32 offset;
+
+        /*
+         * First pass the configuration through rt2x00lib, that will
+         * update the queue settings and validate the input. After that
+         * we are free to update the registers based on the value
+         * in the queue parameter.
+         */
+        retval = rt2x00mac_conf_tx(hw, queue_idx, params);
+        if (retval)
+                return retval;
+
+        /*
+         * We only need to perform additional register initialization
+         * for WMM queues/
+         */
+        if (queue_idx >= 4)
+                return 0;
+
+        queue = rt2x00queue_get_queue(rt2x00dev, queue_idx);
+
+        /* Update WMM TXOP register */
+        offset = WMM_TXOP0_CFG + (sizeof(u32) * (!!(queue_idx & 2)));
+        field.bit_offset = (queue_idx & 1) * 16;
+        field.bit_mask = 0xffff << field.bit_offset;
+
+        rt2x00usb_register_read(rt2x00dev, offset, &reg);
+        rt2x00_set_field32(&reg, field, queue->txop);
+        rt2x00usb_register_write(rt2x00dev, offset, reg);
+
+        /* Update WMM registers */
+        field.bit_offset = queue_idx * 4;
+        field.bit_mask = 0xf << field.bit_offset;
+
+        rt2x00usb_register_read(rt2x00dev, WMM_AIFSN_CFG, &reg);
+        rt2x00_set_field32(&reg, field, queue->aifs);
+        rt2x00usb_register_write(rt2x00dev, WMM_AIFSN_CFG, reg);
+
+        rt2x00usb_register_read(rt2x00dev, WMM_CWMIN_CFG, &reg);
+        rt2x00_set_field32(&reg, field, queue->cw_min);
+        rt2x00usb_register_write(rt2x00dev, WMM_CWMIN_CFG, reg);
+
+        rt2x00usb_register_read(rt2x00dev, WMM_CWMAX_CFG, &reg);
+        rt2x00_set_field32(&reg, field, queue->cw_max);
+        rt2x00usb_register_write(rt2x00dev, WMM_CWMAX_CFG, reg);
+
+        /* Update EDCA registers */
+        offset = EDCA_AC0_CFG + (sizeof(u32) * queue_idx);
+
+        rt2x00usb_register_read(rt2x00dev, offset, &reg);
+        rt2x00_set_field32(&reg, EDCA_AC0_CFG_TX_OP, queue->txop);
+        rt2x00_set_field32(&reg, EDCA_AC0_CFG_AIFSN, queue->aifs);
+        rt2x00_set_field32(&reg, EDCA_AC0_CFG_CWMIN, queue->cw_min);
+        rt2x00_set_field32(&reg, EDCA_AC0_CFG_CWMAX, queue->cw_max);
+        rt2x00usb_register_write(rt2x00dev, offset, reg);
+
+        return 0;
+}
+
+static u64 rt2800usb_get_tsf(struct ieee80211_hw *hw)
+{
+        struct rt2x00_dev *rt2x00dev = hw->priv;
+        u64 tsf;
+        u32 reg;
+
+        rt2x00usb_register_read(rt2x00dev, TSF_TIMER_DW1, &reg);
+        tsf = (u64) rt2x00_get_field32(reg, TSF_TIMER_DW1_HIGH_WORD) << 32;
+        rt2x00usb_register_read(rt2x00dev, TSF_TIMER_DW0, &reg);
+        tsf |= rt2x00_get_field32(reg, TSF_TIMER_DW0_LOW_WORD);
+
+        return tsf;
+}
+
+static const struct ieee80211_ops rt2800usb_mac80211_ops = {
+        .tx                     = rt2x00mac_tx,
+        .start                  = rt2x00mac_start,
+        .stop                   = rt2x00mac_stop,
+        .add_interface          = rt2x00mac_add_interface,
+        .remove_interface       = rt2x00mac_remove_interface,
+        .config                 = rt2x00mac_config,
+        .configure_filter       = rt2x00mac_configure_filter,
+        .set_key                = rt2x00mac_set_key,
+        .get_stats              = rt2x00mac_get_stats,
+        .get_tkip_seq           = rt2800usb_get_tkip_seq,
+        .set_rts_threshold      = rt2800usb_set_rts_threshold,
+        .bss_info_changed       = rt2x00mac_bss_info_changed,
+        .conf_tx                = rt2800usb_conf_tx,
+        .get_tx_stats           = rt2x00mac_get_tx_stats,
+        .get_tsf                = rt2800usb_get_tsf,
+};
+
+static const struct rt2x00lib_ops rt2800usb_rt2x00_ops = {
+        .probe_hw               = rt2800usb_probe_hw,
+        .get_firmware_name      = rt2800usb_get_firmware_name,
+        .check_firmware         = rt2800usb_check_firmware,
+        .load_firmware          = rt2800usb_load_firmware,
+        .initialize             = rt2x00usb_initialize,
+        .uninitialize           = rt2x00usb_uninitialize,
+        .clear_entry            = rt2x00usb_clear_entry,
+        .set_device_state       = rt2800usb_set_device_state,
+        .rfkill_poll            = rt2800usb_rfkill_poll,
+        .link_stats             = rt2800usb_link_stats,
+        .reset_tuner            = rt2800usb_reset_tuner,
+        .link_tuner             = rt2800usb_link_tuner,
+        .write_tx_desc          = rt2800usb_write_tx_desc,
+        .write_tx_data          = rt2x00usb_write_tx_data,
+        .write_beacon           = rt2800usb_write_beacon,
+        .get_tx_data_len        = rt2800usb_get_tx_data_len,
+        .kick_tx_queue          = rt2800usb_kick_tx_queue,
+        .kill_tx_queue          = rt2x00usb_kill_tx_queue,
+        .fill_rxdone            = rt2800usb_fill_rxdone,
+        .config_shared_key      = rt2800usb_config_shared_key,
+        .config_pairwise_key    = rt2800usb_config_pairwise_key,
+        .config_filter          = rt2800usb_config_filter,
+        .config_intf            = rt2800usb_config_intf,
+        .config_erp             = rt2800usb_config_erp,
+        .config_ant             = rt2800usb_config_ant,
+        .config                 = rt2800usb_config,
+};
+
+static const struct data_queue_desc rt2800usb_queue_rx = {
+        .entry_num              = RX_ENTRIES,
+        .data_size              = AGGREGATION_SIZE,
+        .desc_size              = RXD_DESC_SIZE + RXWI_DESC_SIZE,
+        .priv_size              = sizeof(struct queue_entry_priv_usb),
+};
+
+static const struct data_queue_desc rt2800usb_queue_tx = {
+        .entry_num              = TX_ENTRIES,
+        .data_size              = AGGREGATION_SIZE,
+        .desc_size              = TXINFO_DESC_SIZE + TXWI_DESC_SIZE,
+        .priv_size              = sizeof(struct queue_entry_priv_usb),
+};
+
+static const struct data_queue_desc rt2800usb_queue_bcn = {
+        .entry_num              = 8 * BEACON_ENTRIES,
+        .data_size              = MGMT_FRAME_SIZE,
+        .desc_size              = TXINFO_DESC_SIZE + TXWI_DESC_SIZE,
+        .priv_size              = sizeof(struct queue_entry_priv_usb),
+};
+
+static const struct rt2x00_ops rt2800usb_ops = {
+        .name           = KBUILD_MODNAME,
+        .max_sta_intf   = 1,
+        .max_ap_intf    = 8,
+        .eeprom_size    = EEPROM_SIZE,
+        .rf_size        = RF_SIZE,
+        .tx_queues      = NUM_TX_QUEUES,
+        .rx             = &rt2800usb_queue_rx,
+        .tx             = &rt2800usb_queue_tx,
+        .bcn            = &rt2800usb_queue_bcn,
+        .lib            = &rt2800usb_rt2x00_ops,
+        .hw             = &rt2800usb_mac80211_ops,
+#ifdef CONFIG_RT2X00_LIB_DEBUGFS
+        .debugfs        = &rt2800usb_rt2x00debug,
+#endif /* CONFIG_RT2X00_LIB_DEBUGFS */
+};
+
+/*
+ * rt2800usb module information.
+ */
+static struct usb_device_id rt2800usb_device_table[] = {
+        /* ??? */
+        { USB_DEVICE(0x177f, 0x0302), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Abocom */
+        { USB_DEVICE(0x07b8, 0x2870), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x07b8, 0x2770), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x07b8, 0x3070), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x07b8, 0x3071), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x07b8, 0x3072), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x1482, 0x3c09), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* AirTies */
+        { USB_DEVICE(0x1eda, 0x2310), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Amigo */
+        { USB_DEVICE(0x0e0b, 0x9031), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0e0b, 0x9041), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Amit */
+        { USB_DEVICE(0x15c5, 0x0008), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* ASUS */
+        { USB_DEVICE(0x0b05, 0x1731), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0b05, 0x1732), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0b05, 0x1742), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0b05, 0x1760), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0b05, 0x1761), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* AzureWave */
+        { USB_DEVICE(0x13d3, 0x3247), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x13d3, 0x3262), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x13d3, 0x3273), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x13d3, 0x3284), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Belkin */
+        { USB_DEVICE(0x050d, 0x8053), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x050d, 0x805c), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x050d, 0x815c), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Buffalo */
+        { USB_DEVICE(0x0411, 0x00e8), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0411, 0x012e), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Conceptronic */
+        { USB_DEVICE(0x14b2, 0x3c06), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x14b2, 0x3c07), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x14b2, 0x3c08), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x14b2, 0x3c09), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x14b2, 0x3c11), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x14b2, 0x3c12), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x14b2, 0x3c23), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x14b2, 0x3c25), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x14b2, 0x3c27), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x14b2, 0x3c28), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Corega */
+        { USB_DEVICE(0x07aa, 0x002f), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x07aa, 0x003c), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x07aa, 0x003f), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x18c5, 0x0008), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x18c5, 0x0012), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* D-Link */
+        { USB_DEVICE(0x07d1, 0x3c09), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x07d1, 0x3c0a), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x07d1, 0x3c0b), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x07d1, 0x3c11), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x07d1, 0x3c13), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Edimax */
+        { USB_DEVICE(0x7392, 0x7711), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x7392, 0x7717), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x7392, 0x7718), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* EnGenius */
+        { USB_DEVICE(0X1740, 0x9701), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x1740, 0x9702), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x1740, 0x9703), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x1740, 0x9705), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x1740, 0x9706), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x1740, 0x9801), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Gemtek */
+        { USB_DEVICE(0x15a9, 0x0010), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Gigabyte */
+        { USB_DEVICE(0x1044, 0x800b), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x1044, 0x800c), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x1044, 0x800d), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Hawking */
+        { USB_DEVICE(0x0e66, 0x0001), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0e66, 0x0003), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0e66, 0x0009), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0e66, 0x000b), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* LevelOne */
+        { USB_DEVICE(0x1740, 0x0605), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x1740, 0x0615), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Linksys */
+        { USB_DEVICE(0x1737, 0x0070), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x1737, 0x0071), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x1737, 0x0077), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Logitec */
+        { USB_DEVICE(0x0789, 0x0162), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0789, 0x0163), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0789, 0x0164), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Motorola */
+        { USB_DEVICE(0x100d, 0x9031), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x100d, 0x9032), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Ovislink */
+        { USB_DEVICE(0x1b75, 0x3072), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Pegatron */
+        { USB_DEVICE(0x1d4d, 0x0002), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x1d4d, 0x000c), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Philips */
+        { USB_DEVICE(0x0471, 0x200f), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Planex */
+        { USB_DEVICE(0x2019, 0xed06), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x2019, 0xab24), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x2019, 0xab25), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Qcom */
+        { USB_DEVICE(0x18e8, 0x6259), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Quanta */
+        { USB_DEVICE(0x1a32, 0x0304), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Ralink */
+        { USB_DEVICE(0x0db0, 0x6899), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x148f, 0x2070), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x148f, 0x2770), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x148f, 0x2870), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x148f, 0x3070), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x148f, 0x3071), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x148f, 0x3072), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x148f, 0x3572), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Samsung */
+        { USB_DEVICE(0x04e8, 0x2018), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Siemens */
+        { USB_DEVICE(0x129b, 0x1828), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Sitecom */
+        { USB_DEVICE(0x0df6, 0x0017), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0df6, 0x002b), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0df6, 0x002c), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0df6, 0x002d), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0df6, 0x0039), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0df6, 0x003b), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0df6, 0x003c), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0df6, 0x003d), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0df6, 0x003e), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0df6, 0x003f), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0df6, 0x0040), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* SMC */
+        { USB_DEVICE(0x083a, 0x6618), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x083a, 0x7511), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x083a, 0x7512), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x083a, 0x7522), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x083a, 0x8522), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x083a, 0xa512), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x083a, 0xa618), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x083a, 0xb522), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x083a, 0xc522), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Sparklan */
+        { USB_DEVICE(0x15a9, 0x0006), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* U-Media*/
+        { USB_DEVICE(0x157e, 0x300e), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* ZCOM */
+        { USB_DEVICE(0x0cde, 0x0022), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0cde, 0x0025), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Zinwell */
+        { USB_DEVICE(0x5a57, 0x0280), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x5a57, 0x0282), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Zyxel */
+        { USB_DEVICE(0x0586, 0x3416), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0586, 0x341a), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { 0, }
+};
+
+MODULE_AUTHOR(DRV_PROJECT);
+MODULE_VERSION(DRV_VERSION);
+MODULE_DESCRIPTION("Ralink RT2800 USB Wireless LAN driver.");
+MODULE_SUPPORTED_DEVICE("Ralink RT2870 USB chipset based cards");
+MODULE_DEVICE_TABLE(usb, rt2800usb_device_table);
+MODULE_FIRMWARE(FIRMWARE_RT2870);
+MODULE_LICENSE("GPL");
+
+static struct usb_driver rt2800usb_driver = {
+        .name           = KBUILD_MODNAME,
+        .id_table       = rt2800usb_device_table,
+        .probe          = rt2x00usb_probe,
+        .disconnect     = rt2x00usb_disconnect,
+        .suspend        = rt2x00usb_suspend,
+        .resume         = rt2x00usb_resume,
+};
+
+static int __init rt2800usb_init(void)
+{
+        return usb_register(&rt2800usb_driver);
+}
+
+static void __exit rt2800usb_exit(void)
+{
+        usb_deregister(&rt2800usb_driver);
+}
+
+module_init(rt2800usb_init);
+module_exit(rt2800usb_exit);
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.h b/drivers/net/wireless/rt2x00/rt2800usb.h
new file mode 100644
index 000000000000..61a8be61d3f5
--- /dev/null
+++ b/drivers/net/wireless/rt2x00/rt2800usb.h
@@ -0,0 +1,1945 @@
+/*
+        Copyright (C) 2004 - 2009 rt2x00 SourceForge Project
+        <http://rt2x00.serialmonkey.com>
+
+        This program is free software; you can redistribute it and/or modify
+        it under the terms of the GNU General Public License as published by
+        the Free Software Foundation; either version 2 of the License, or
+        (at your option) any later version.
+
+        This program is distributed in the hope that it will be useful,
+        but WITHOUT ANY WARRANTY; without even the implied warranty of
+        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+        GNU General Public License for more details.
+
+        You should have received a copy of the GNU General Public License
+        along with this program; if not, write to the
+        Free Software Foundation, Inc.,
+        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+/*
+        Module: rt2800usb
+        Abstract: Data structures and registers for the rt2800usb module.
+        Supported chipsets: RT2800U.
+ */
+
+#ifndef RT2800USB_H
+#define RT2800USB_H
+
+/*
+ * RF chip defines.
+ *
+ * RF2820 2.4G 2T3R
+ * RF2850 2.4G/5G 2T3R
+ * RF2720 2.4G 1T2R
+ * RF2750 2.4G/5G 1T2R
+ * RF3020 2.4G 1T1R
+ * RF2020 2.4G B/G
+ */
+#define RF2820                          0x0001
+#define RF2850                          0x0002
+#define RF2720                          0x0003
+#define RF2750                          0x0004
+#define RF3020                          0x0005
+#define RF2020                          0x0006
+
+/*
+ * RT2870 version
+ */
+#define RT2860C_VERSION                 0x28600100
+#define RT2860D_VERSION                 0x28600101
+#define RT2880E_VERSION                 0x28720200
+#define RT2883_VERSION                  0x28830300
+#define RT3070_VERSION                  0x30700200
+
+/*
+ * Signal information.
+ * Defaul offset is required for RSSI <-> dBm conversion.
+ */
+#define DEFAULT_RSSI_OFFSET             120 /* FIXME */
+
+/*
+ * Register layout information.
+ */
+#define CSR_REG_BASE                    0x1000
+#define CSR_REG_SIZE                    0x0800
+#define EEPROM_BASE                     0x0000
+#define EEPROM_SIZE                     0x0110
+#define BBP_BASE                        0x0000
+#define BBP_SIZE                        0x0080
+#define RF_BASE                         0x0004
+#define RF_SIZE                         0x0010
+
+/*
+ * Number of TX queues.
+ */
+#define NUM_TX_QUEUES                   4
+
+/*
+ * USB registers.
+ */
+
+/*
+ * HOST-MCU shared memory
+ */
+#define HOST_CMD_CSR                    0x0404
+#define HOST_CMD_CSR_HOST_COMMAND       FIELD32(0x000000ff)
+
+/*
+ * INT_SOURCE_CSR: Interrupt source register.
+ * Write one to clear corresponding bit.
+ * TX_FIFO_STATUS: FIFO Statistics is full, sw should read 0x171c
+ */
+#define INT_SOURCE_CSR                  0x0200
+#define INT_SOURCE_CSR_RXDELAYINT       FIELD32(0x00000001)
+#define INT_SOURCE_CSR_TXDELAYINT       FIELD32(0x00000002)
+#define INT_SOURCE_CSR_RX_DONE          FIELD32(0x00000004)
+#define INT_SOURCE_CSR_AC0_DMA_DONE     FIELD32(0x00000008)
+#define INT_SOURCE_CSR_AC1_DMA_DONE     FIELD32(0x00000010)
+#define INT_SOURCE_CSR_AC2_DMA_DONE     FIELD32(0x00000020)
+#define INT_SOURCE_CSR_AC3_DMA_DONE     FIELD32(0x00000040)
+#define INT_SOURCE_CSR_HCCA_DMA_DONE    FIELD32(0x00000080)
+#define INT_SOURCE_CSR_MGMT_DMA_DONE    FIELD32(0x00000100)
+#define INT_SOURCE_CSR_MCU_COMMAND      FIELD32(0x00000200)
+#define INT_SOURCE_CSR_RXTX_COHERENT    FIELD32(0x00000400)
+#define INT_SOURCE_CSR_TBTT             FIELD32(0x00000800)
+#define INT_SOURCE_CSR_PRE_TBTT         FIELD32(0x00001000)
+#define INT_SOURCE_CSR_TX_FIFO_STATUS   FIELD32(0x00002000)
+#define INT_SOURCE_CSR_AUTO_WAKEUP      FIELD32(0x00004000)
+#define INT_SOURCE_CSR_GPTIMER          FIELD32(0x00008000)
+#define INT_SOURCE_CSR_RX_COHERENT      FIELD32(0x00010000)
+#define INT_SOURCE_CSR_TX_COHERENT      FIELD32(0x00020000)
+
+/*
+ * INT_MASK_CSR: Interrupt MASK register. 1: the interrupt is mask OFF.
+ */
+#define INT_MASK_CSR                    0x0204
+#define INT_MASK_CSR_RXDELAYINT         FIELD32(0x00000001)
+#define INT_MASK_CSR_TXDELAYINT         FIELD32(0x00000002)
+#define INT_MASK_CSR_RX_DONE            FIELD32(0x00000004)
+#define INT_MASK_CSR_AC0_DMA_DONE       FIELD32(0x00000008)
+#define INT_MASK_CSR_AC1_DMA_DONE       FIELD32(0x00000010)
+#define INT_MASK_CSR_AC2_DMA_DONE       FIELD32(0x00000020)
+#define INT_MASK_CSR_AC3_DMA_DONE       FIELD32(0x00000040)
+#define INT_MASK_CSR_HCCA_DMA_DONE      FIELD32(0x00000080)
+#define INT_MASK_CSR_MGMT_DMA_DONE      FIELD32(0x00000100)
+#define INT_MASK_CSR_MCU_COMMAND        FIELD32(0x00000200)
+#define INT_MASK_CSR_RXTX_COHERENT      FIELD32(0x00000400)
+#define INT_MASK_CSR_TBTT               FIELD32(0x00000800)
+#define INT_MASK_CSR_PRE_TBTT           FIELD32(0x00001000)
+#define INT_MASK_CSR_TX_FIFO_STATUS     FIELD32(0x00002000)
+#define INT_MASK_CSR_AUTO_WAKEUP        FIELD32(0x00004000)
+#define INT_MASK_CSR_GPTIMER            FIELD32(0x00008000)
+#define INT_MASK_CSR_RX_COHERENT        FIELD32(0x00010000)
+#define INT_MASK_CSR_TX_COHERENT        FIELD32(0x00020000)
+
+/*
+ * WPDMA_GLO_CFG
+ */
+#define WPDMA_GLO_CFG                   0x0208
+#define WPDMA_GLO_CFG_ENABLE_TX_DMA     FIELD32(0x00000001)
+#define WPDMA_GLO_CFG_TX_DMA_BUSY       FIELD32(0x00000002)
+#define WPDMA_GLO_CFG_ENABLE_RX_DMA     FIELD32(0x00000004)
+#define WPDMA_GLO_CFG_RX_DMA_BUSY       FIELD32(0x00000008)
+#define WPDMA_GLO_CFG_WP_DMA_BURST_SIZE FIELD32(0x00000030)
+#define WPDMA_GLO_CFG_TX_WRITEBACK_DONE FIELD32(0x00000040)
+#define WPDMA_GLO_CFG_BIG_ENDIAN        FIELD32(0x00000080)
+#define WPDMA_GLO_CFG_RX_HDR_SCATTER    FIELD32(0x0000ff00)
+#define WPDMA_GLO_CFG_HDR_SEG_LEN       FIELD32(0xffff0000)
+
+/*
+ * WPDMA_RST_IDX
+ */
+#define WPDMA_RST_IDX                   0x020c
+#define WPDMA_RST_IDX_DTX_IDX0          FIELD32(0x00000001)
+#define WPDMA_RST_IDX_DTX_IDX1          FIELD32(0x00000002)
+#define WPDMA_RST_IDX_DTX_IDX2          FIELD32(0x00000004)
+#define WPDMA_RST_IDX_DTX_IDX3          FIELD32(0x00000008)
+#define WPDMA_RST_IDX_DTX_IDX4          FIELD32(0x00000010)
+#define WPDMA_RST_IDX_DTX_IDX5          FIELD32(0x00000020)
+#define WPDMA_RST_IDX_DRX_IDX0          FIELD32(0x00010000)
+
+/*
+ * DELAY_INT_CFG
+ */
+#define DELAY_INT_CFG                   0x0210
+#define DELAY_INT_CFG_RXMAX_PTIME       FIELD32(0x000000ff)
+#define DELAY_INT_CFG_RXMAX_PINT        FIELD32(0x00007f00)
+#define DELAY_INT_CFG_RXDLY_INT_EN      FIELD32(0x00008000)
+#define DELAY_INT_CFG_TXMAX_PTIME       FIELD32(0x00ff0000)
+#define DELAY_INT_CFG_TXMAX_PINT        FIELD32(0x7f000000)
+#define DELAY_INT_CFG_TXDLY_INT_EN      FIELD32(0x80000000)
+
+/*
+ * WMM_AIFSN_CFG: Aifsn for each EDCA AC
+ * AIFSN0: AC_BE
+ * AIFSN1: AC_BK
+ * AIFSN1: AC_VI
+ * AIFSN1: AC_VO
+ */
+#define WMM_AIFSN_CFG                   0x0214
+#define WMM_AIFSN_CFG_AIFSN0            FIELD32(0x0000000f)
+#define WMM_AIFSN_CFG_AIFSN1            FIELD32(0x000000f0)
+#define WMM_AIFSN_CFG_AIFSN2            FIELD32(0x00000f00)
+#define WMM_AIFSN_CFG_AIFSN3            FIELD32(0x0000f000)
+
+/*
+ * WMM_CWMIN_CSR: CWmin for each EDCA AC
+ * CWMIN0: AC_BE
+ * CWMIN1: AC_BK
+ * CWMIN1: AC_VI
+ * CWMIN1: AC_VO
+ */
+#define WMM_CWMIN_CFG                   0x0218
+#define WMM_CWMIN_CFG_CWMIN0            FIELD32(0x0000000f)
+#define WMM_CWMIN_CFG_CWMIN1            FIELD32(0x000000f0)
+#define WMM_CWMIN_CFG_CWMIN2            FIELD32(0x00000f00)
+#define WMM_CWMIN_CFG_CWMIN3            FIELD32(0x0000f000)
+
+/*
+ * WMM_CWMAX_CSR: CWmax for each EDCA AC
+ * CWMAX0: AC_BE
+ * CWMAX1: AC_BK
+ * CWMAX1: AC_VI
+ * CWMAX1: AC_VO
+ */
+#define WMM_CWMAX_CFG                   0x021c
+#define WMM_CWMAX_CFG_CWMAX0            FIELD32(0x0000000f)
+#define WMM_CWMAX_CFG_CWMAX1            FIELD32(0x000000f0)
+#define WMM_CWMAX_CFG_CWMAX2            FIELD32(0x00000f00)
+#define WMM_CWMAX_CFG_CWMAX3            FIELD32(0x0000f000)
+
+/*
+ * AC_TXOP0: AC_BK/AC_BE TXOP register
+ * AC0TXOP: AC_BK in unit of 32us
+ * AC1TXOP: AC_BE in unit of 32us
+ */
+#define WMM_TXOP0_CFG                   0x0220
+#define WMM_TXOP0_CFG_AC0TXOP           FIELD32(0x0000ffff)
+#define WMM_TXOP0_CFG_AC1TXOP           FIELD32(0xffff0000)
+
+/*
+ * AC_TXOP1: AC_VO/AC_VI TXOP register
+ * AC2TXOP: AC_VI in unit of 32us
+ * AC3TXOP: AC_VO in unit of 32us
+ */
+#define WMM_TXOP1_CFG                   0x0224
+#define WMM_TXOP1_CFG_AC2TXOP           FIELD32(0x0000ffff)
+#define WMM_TXOP1_CFG_AC3TXOP           FIELD32(0xffff0000)
+
+/*
+ * GPIO_CTRL_CFG:
+ */
+#define GPIO_CTRL_CFG                   0x0228
+#define GPIO_CTRL_CFG_BIT0              FIELD32(0x00000001)
+#define GPIO_CTRL_CFG_BIT1              FIELD32(0x00000002)
+#define GPIO_CTRL_CFG_BIT2              FIELD32(0x00000004)
+#define GPIO_CTRL_CFG_BIT3              FIELD32(0x00000008)
+#define GPIO_CTRL_CFG_BIT4              FIELD32(0x00000010)
+#define GPIO_CTRL_CFG_BIT5              FIELD32(0x00000020)
+#define GPIO_CTRL_CFG_BIT6              FIELD32(0x00000040)
+#define GPIO_CTRL_CFG_BIT7              FIELD32(0x00000080)
+#define GPIO_CTRL_CFG_BIT8              FIELD32(0x00000100)
+
+/*
+ * MCU_CMD_CFG
+ */
+#define MCU_CMD_CFG                     0x022c
+
+/*
+ * AC_BK register offsets
+ */
+#define TX_BASE_PTR0                    0x0230
+#define TX_MAX_CNT0                     0x0234
+#define TX_CTX_IDX0                     0x0238
+#define TX_DTX_IDX0                     0x023c
+
+/*
+ * AC_BE register offsets
+ */
+#define TX_BASE_PTR1                    0x0240
+#define TX_MAX_CNT1                     0x0244
+#define TX_CTX_IDX1                     0x0248
+#define TX_DTX_IDX1                     0x024c
+
+/*
+ * AC_VI register offsets
+ */
+#define TX_BASE_PTR2                    0x0250
+#define TX_MAX_CNT2                     0x0254
+#define TX_CTX_IDX2                     0x0258
+#define TX_DTX_IDX2                     0x025c
+
+/*
+ * AC_VO register offsets
+ */
+#define TX_BASE_PTR3                    0x0260
+#define TX_MAX_CNT3                     0x0264
+#define TX_CTX_IDX3                     0x0268
+#define TX_DTX_IDX3                     0x026c
+
+/*
+ * HCCA register offsets
+ */
+#define TX_BASE_PTR4                    0x0270
+#define TX_MAX_CNT4                     0x0274
+#define TX_CTX_IDX4                     0x0278
+#define TX_DTX_IDX4                     0x027c
+
+/*
+ * MGMT register offsets
+ */
+#define TX_BASE_PTR5                    0x0280
+#define TX_MAX_CNT5                     0x0284
+#define TX_CTX_IDX5                     0x0288
+#define TX_DTX_IDX5                     0x028c
+
+/*
+ * RX register offsets
+ */
+#define RX_BASE_PTR                     0x0290
+#define RX_MAX_CNT                      0x0294
+#define RX_CRX_IDX                      0x0298
+#define RX_DRX_IDX                      0x029c
+
+/*
+ * USB_DMA_CFG
+ * RX_BULK_AGG_TIMEOUT: Rx Bulk Aggregation TimeOut in unit of 33ns.
+ * RX_BULK_AGG_LIMIT: Rx Bulk Aggregation Limit in unit of 256 bytes.
+ * PHY_CLEAR: phy watch dog enable.
+ * TX_CLEAR: Clear USB DMA TX path.
+ * TXOP_HALT: Halt TXOP count down when TX buffer is full.
+ * RX_BULK_AGG_EN: Enable Rx Bulk Aggregation.
+ * RX_BULK_EN: Enable USB DMA Rx.
+ * TX_BULK_EN: Enable USB DMA Tx.
+ * EP_OUT_VALID: OUT endpoint data valid.
+ * RX_BUSY: USB DMA RX FSM busy.
+ * TX_BUSY: USB DMA TX FSM busy.
+ */
+#define USB_DMA_CFG                     0x02a0
+#define USB_DMA_CFG_RX_BULK_AGG_TIMEOUT FIELD32(0x000000ff)
+#define USB_DMA_CFG_RX_BULK_AGG_LIMIT   FIELD32(0x0000ff00)
+#define USB_DMA_CFG_PHY_CLEAR           FIELD32(0x00010000)
+#define USB_DMA_CFG_TX_CLEAR            FIELD32(0x00080000)
+#define USB_DMA_CFG_TXOP_HALT           FIELD32(0x00100000)
+#define USB_DMA_CFG_RX_BULK_AGG_EN      FIELD32(0x00200000)
+#define USB_DMA_CFG_RX_BULK_EN          FIELD32(0x00400000)
+#define USB_DMA_CFG_TX_BULK_EN          FIELD32(0x00800000)
+#define USB_DMA_CFG_EP_OUT_VALID        FIELD32(0x3f000000)
+#define USB_DMA_CFG_RX_BUSY             FIELD32(0x40000000)
+#define USB_DMA_CFG_TX_BUSY             FIELD32(0x80000000)
+
+/*
+ * USB_CYC_CFG
+ */
+#define USB_CYC_CFG                     0x02a4
+#define USB_CYC_CFG_CLOCK_CYCLE         FIELD32(0x000000ff)
+
+/*
+ * PBF_SYS_CTRL
+ * HOST_RAM_WRITE: enable Host program ram write selection
+ */
+#define PBF_SYS_CTRL                    0x0400
+#define PBF_SYS_CTRL_READY              FIELD32(0x00000080)
+#define PBF_SYS_CTRL_HOST_RAM_WRITE     FIELD32(0x00010000)
+
+/*
+ * PBF registers
+ * Most are for debug. Driver doesn't touch PBF register.
+ */
+#define PBF_CFG                         0x0408
+#define PBF_MAX_PCNT                    0x040c
+#define PBF_CTRL                        0x0410
+#define PBF_INT_STA                     0x0414
+#define PBF_INT_ENA                     0x0418
+
+/*
+ * BCN_OFFSET0:
+ */
+#define BCN_OFFSET0                     0x042c
+#define BCN_OFFSET0_BCN0                FIELD32(0x000000ff)
+#define BCN_OFFSET0_BCN1                FIELD32(0x0000ff00)
+#define BCN_OFFSET0_BCN2                FIELD32(0x00ff0000)
+#define BCN_OFFSET0_BCN3                FIELD32(0xff000000)
+
+/*
+ * BCN_OFFSET1:
+ */
+#define BCN_OFFSET1                     0x0430
+#define BCN_OFFSET1_BCN4                FIELD32(0x000000ff)
+#define BCN_OFFSET1_BCN5                FIELD32(0x0000ff00)
+#define BCN_OFFSET1_BCN6                FIELD32(0x00ff0000)
+#define BCN_OFFSET1_BCN7                FIELD32(0xff000000)
+
+/*
+ * PBF registers
+ * Most are for debug. Driver doesn't touch PBF register.
+ */
+#define TXRXQ_PCNT                      0x0438
+#define PBF_DBG                         0x043c
+
+/*
+ * RF registers
+ */
+#define RF_CSR_CFG                      0x0500
+#define RF_CSR_CFG_DATA                 FIELD32(0x000000ff)
+#define RF_CSR_CFG_REGNUM               FIELD32(0x00001f00)
+#define RF_CSR_CFG_WRITE                FIELD32(0x00010000)
+#define RF_CSR_CFG_BUSY                 FIELD32(0x00020000)
+
+/*
+ * MAC Control/Status Registers(CSR).
+ * Some values are set in TU, whereas 1 TU == 1024 us.
+ */
+
+/*
+ * MAC_CSR0: ASIC revision number.
+ * ASIC_REV: 0
+ * ASIC_VER: 2870
+ */
+#define MAC_CSR0                        0x1000
+#define MAC_CSR0_ASIC_REV               FIELD32(0x0000ffff)
+#define MAC_CSR0_ASIC_VER               FIELD32(0xffff0000)
+
+/*
+ * MAC_SYS_CTRL:
+ */
+#define MAC_SYS_CTRL                    0x1004
+#define MAC_SYS_CTRL_RESET_CSR          FIELD32(0x00000001)
+#define MAC_SYS_CTRL_RESET_BBP          FIELD32(0x00000002)
+#define MAC_SYS_CTRL_ENABLE_TX          FIELD32(0x00000004)
+#define MAC_SYS_CTRL_ENABLE_RX          FIELD32(0x00000008)
+#define MAC_SYS_CTRL_CONTINUOUS_TX      FIELD32(0x00000010)
+#define MAC_SYS_CTRL_LOOPBACK           FIELD32(0x00000020)
+#define MAC_SYS_CTRL_WLAN_HALT          FIELD32(0x00000040)
+#define MAC_SYS_CTRL_RX_TIMESTAMP       FIELD32(0x00000080)
+
+/*
+ * MAC_ADDR_DW0: STA MAC register 0
+ */
+#define MAC_ADDR_DW0                    0x1008
+#define MAC_ADDR_DW0_BYTE0              FIELD32(0x000000ff)
+#define MAC_ADDR_DW0_BYTE1              FIELD32(0x0000ff00)
+#define MAC_ADDR_DW0_BYTE2              FIELD32(0x00ff0000)
+#define MAC_ADDR_DW0_BYTE3              FIELD32(0xff000000)
+
+/*
+ * MAC_ADDR_DW1: STA MAC register 1
+ * UNICAST_TO_ME_MASK:
+ * Used to mask off bits from byte 5 of the MAC address
+ * to determine the UNICAST_TO_ME bit for RX frames.
+ * The full mask is complemented by BSS_ID_MASK:
+ *    MASK = BSS_ID_MASK & UNICAST_TO_ME_MASK
+ */
+#define MAC_ADDR_DW1                    0x100c
+#define MAC_ADDR_DW1_BYTE4              FIELD32(0x000000ff)
+#define MAC_ADDR_DW1_BYTE5              FIELD32(0x0000ff00)
+#define MAC_ADDR_DW1_UNICAST_TO_ME_MASK FIELD32(0x00ff0000)
+
+/*
+ * MAC_BSSID_DW0: BSSID register 0
+ */
+#define MAC_BSSID_DW0                   0x1010
+#define MAC_BSSID_DW0_BYTE0             FIELD32(0x000000ff)
+#define MAC_BSSID_DW0_BYTE1             FIELD32(0x0000ff00)
+#define MAC_BSSID_DW0_BYTE2             FIELD32(0x00ff0000)
+#define MAC_BSSID_DW0_BYTE3             FIELD32(0xff000000)
+
+/*
+ * MAC_BSSID_DW1: BSSID register 1
+ * BSS_ID_MASK:
+ *     0: 1-BSSID mode (BSS index = 0)
+ *     1: 2-BSSID mode (BSS index: Byte5, bit 0)
+ *     2: 4-BSSID mode (BSS index: byte5, bit 0 - 1)
+ *     3: 8-BSSID mode (BSS index: byte5, bit 0 - 2)
+ * This mask is used to mask off bits 0, 1 and 2 of byte 5 of the
+ * BSSID. This will make sure that those bits will be ignored
+ * when determining the MY_BSS of RX frames.
+ */
+#define MAC_BSSID_DW1                   0x1014
+#define MAC_BSSID_DW1_BYTE4             FIELD32(0x000000ff)
+#define MAC_BSSID_DW1_BYTE5             FIELD32(0x0000ff00)
+#define MAC_BSSID_DW1_BSS_ID_MASK       FIELD32(0x00030000)
+#define MAC_BSSID_DW1_BSS_BCN_NUM       FIELD32(0x001c0000)
+
+/*
+ * MAX_LEN_CFG: Maximum frame length register.
+ * MAX_MPDU: rt2860b max 16k bytes
+ * MAX_PSDU: Maximum PSDU length
+ *      (power factor) 0:2^13, 1:2^14, 2:2^15, 3:2^16
+ */
+#define MAX_LEN_CFG                     0x1018
+#define MAX_LEN_CFG_MAX_MPDU            FIELD32(0x00000fff)
+#define MAX_LEN_CFG_MAX_PSDU            FIELD32(0x00003000)
+#define MAX_LEN_CFG_MIN_PSDU            FIELD32(0x0000c000)
+#define MAX_LEN_CFG_MIN_MPDU            FIELD32(0x000f0000)
+
+/*
+ * BBP_CSR_CFG: BBP serial control register
+ * VALUE: Register value to program into BBP
+ * REG_NUM: Selected BBP register
+ * READ_CONTROL: 0 write BBP, 1 read BBP
+ * BUSY: ASIC is busy executing BBP commands
+ * BBP_PAR_DUR: 0 4 MAC clocks, 1 8 MAC clocks
+ * BBP_RW_MODE: 0 serial, 1 paralell
+ */
+#define BBP_CSR_CFG                     0x101c
+#define BBP_CSR_CFG_VALUE               FIELD32(0x000000ff)
+#define BBP_CSR_CFG_REGNUM              FIELD32(0x0000ff00)
+#define BBP_CSR_CFG_READ_CONTROL        FIELD32(0x00010000)
+#define BBP_CSR_CFG_BUSY                FIELD32(0x00020000)
+#define BBP_CSR_CFG_BBP_PAR_DUR         FIELD32(0x00040000)
+#define BBP_CSR_CFG_BBP_RW_MODE         FIELD32(0x00080000)
+
+/*
+ * RF_CSR_CFG0: RF control register
+ * REGID_AND_VALUE: Register value to program into RF
+ * BITWIDTH: Selected RF register
+ * STANDBYMODE: 0 high when standby, 1 low when standby
+ * SEL: 0 RF_LE0 activate, 1 RF_LE1 activate
+ * BUSY: ASIC is busy executing RF commands
+ */
+#define RF_CSR_CFG0                     0x1020
+#define RF_CSR_CFG0_REGID_AND_VALUE     FIELD32(0x00ffffff)
+#define RF_CSR_CFG0_BITWIDTH            FIELD32(0x1f000000)
+#define RF_CSR_CFG0_REG_VALUE_BW        FIELD32(0x1fffffff)
+#define RF_CSR_CFG0_STANDBYMODE         FIELD32(0x20000000)
+#define RF_CSR_CFG0_SEL                 FIELD32(0x40000000)
+#define RF_CSR_CFG0_BUSY                FIELD32(0x80000000)
+
+/*
+ * RF_CSR_CFG1: RF control register
+ * REGID_AND_VALUE: Register value to program into RF
+ * RFGAP: Gap between BB_CONTROL_RF and RF_LE
+ *        0: 3 system clock cycle (37.5usec)
+ *        1: 5 system clock cycle (62.5usec)
+ */
+#define RF_CSR_CFG1                     0x1024
+#define RF_CSR_CFG1_REGID_AND_VALUE     FIELD32(0x00ffffff)
+#define RF_CSR_CFG1_RFGAP               FIELD32(0x1f000000)
+
+/*
+ * RF_CSR_CFG2: RF control register
+ * VALUE: Register value to program into RF
+ * RFGAP: Gap between BB_CONTROL_RF and RF_LE
+ *        0: 3 system clock cycle (37.5usec)
+ *        1: 5 system clock cycle (62.5usec)
+ */
+#define RF_CSR_CFG2                     0x1028
+#define RF_CSR_CFG2_VALUE               FIELD32(0x00ffffff)
+
+/*
+ * LED_CFG: LED control
+ * color LED's:
+ *   0: off
+ *   1: blinking upon TX2
+ *   2: periodic slow blinking
+ *   3: always on
+ * LED polarity:
+ *   0: active low
+ *   1: active high
+ */
+#define LED_CFG                         0x102c
+#define LED_CFG_ON_PERIOD               FIELD32(0x000000ff)
+#define LED_CFG_OFF_PERIOD              FIELD32(0x0000ff00)
+#define LED_CFG_SLOW_BLINK_PERIOD       FIELD32(0x003f0000)
+#define LED_CFG_R_LED_MODE              FIELD32(0x03000000)
+#define LED_CFG_G_LED_MODE              FIELD32(0x0c000000)
+#define LED_CFG_Y_LED_MODE              FIELD32(0x30000000)
+#define LED_CFG_LED_POLAR               FIELD32(0x40000000)
+
+/*
+ * XIFS_TIME_CFG: MAC timing
+ * CCKM_SIFS_TIME: unit 1us. Applied after CCK RX/TX
+ * OFDM_SIFS_TIME: unit 1us. Applied after OFDM RX/TX
+ * OFDM_XIFS_TIME: unit 1us. Applied after OFDM RX
+ *      when MAC doesn't reference BBP signal BBRXEND
+ * EIFS: unit 1us
+ * BB_RXEND_ENABLE: reference RXEND signal to begin XIFS defer
+ *
+ */
+#define XIFS_TIME_CFG                   0x1100
+#define XIFS_TIME_CFG_CCKM_SIFS_TIME    FIELD32(0x000000ff)
+#define XIFS_TIME_CFG_OFDM_SIFS_TIME    FIELD32(0x0000ff00)
+#define XIFS_TIME_CFG_OFDM_XIFS_TIME    FIELD32(0x000f0000)
+#define XIFS_TIME_CFG_EIFS              FIELD32(0x1ff00000)
+#define XIFS_TIME_CFG_BB_RXEND_ENABLE   FIELD32(0x20000000)
+
+/*
+ * BKOFF_SLOT_CFG:
+ */
+#define BKOFF_SLOT_CFG                  0x1104
+#define BKOFF_SLOT_CFG_SLOT_TIME        FIELD32(0x000000ff)
+#define BKOFF_SLOT_CFG_CC_DELAY_TIME    FIELD32(0x0000ff00)
+
+/*
+ * NAV_TIME_CFG:
+ */
+#define NAV_TIME_CFG                    0x1108
+#define NAV_TIME_CFG_SIFS               FIELD32(0x000000ff)
+#define NAV_TIME_CFG_SLOT_TIME          FIELD32(0x0000ff00)
+#define NAV_TIME_CFG_EIFS               FIELD32(0x01ff0000)
+#define NAV_TIME_ZERO_SIFS              FIELD32(0x02000000)
+
+/*
+ * CH_TIME_CFG: count as channel busy
+ */
+#define CH_TIME_CFG                     0x110c
+
+/*
+ * PBF_LIFE_TIMER: TX/RX MPDU timestamp timer (free run) Unit: 1us
+ */
+#define PBF_LIFE_TIMER                  0x1110
+
+/*
+ * BCN_TIME_CFG:
+ * BEACON_INTERVAL: in unit of 1/16 TU
+ * TSF_TICKING: Enable TSF auto counting
+ * TSF_SYNC: Enable TSF sync, 00: disable, 01: infra mode, 10: ad-hoc mode
+ * BEACON_GEN: Enable beacon generator
+ */
+#define BCN_TIME_CFG                    0x1114
+#define BCN_TIME_CFG_BEACON_INTERVAL    FIELD32(0x0000ffff)
+#define BCN_TIME_CFG_TSF_TICKING        FIELD32(0x00010000)
+#define BCN_TIME_CFG_TSF_SYNC           FIELD32(0x00060000)
+#define BCN_TIME_CFG_TBTT_ENABLE        FIELD32(0x00080000)
+#define BCN_TIME_CFG_BEACON_GEN         FIELD32(0x00100000)
+#define BCN_TIME_CFG_TX_TIME_COMPENSATE FIELD32(0xf0000000)
+
+/*
+ * TBTT_SYNC_CFG:
+ */
+#define TBTT_SYNC_CFG                   0x1118
+
+/*
+ * TSF_TIMER_DW0: Local lsb TSF timer, read-only
+ */
+#define TSF_TIMER_DW0                   0x111c
+#define TSF_TIMER_DW0_LOW_WORD          FIELD32(0xffffffff)
+
+/*
+ * TSF_TIMER_DW1: Local msb TSF timer, read-only
+ */
+#define TSF_TIMER_DW1                   0x1120
+#define TSF_TIMER_DW1_HIGH_WORD         FIELD32(0xffffffff)
+
+/*
+ * TBTT_TIMER: TImer remains till next TBTT, read-only
+ */
+#define TBTT_TIMER                      0x1124
+
+/*
+ * INT_TIMER_CFG:
+ */
+#define INT_TIMER_CFG                   0x1128
+
+/*
+ * INT_TIMER_EN: GP-timer and pre-tbtt Int enable
+ */
+#define INT_TIMER_EN                    0x112c
+
+/*
+ * CH_IDLE_STA: channel idle time
+ */
+#define CH_IDLE_STA                     0x1130
+
+/*
+ * CH_BUSY_STA: channel busy time
+ */
+#define CH_BUSY_STA                     0x1134
+
+/*
+ * MAC_STATUS_CFG:
+ * BBP_RF_BUSY: When set to 0, BBP and RF are stable.
+ *      if 1 or higher one of the 2 registers is busy.
+ */
+#define MAC_STATUS_CFG                  0x1200
+#define MAC_STATUS_CFG_BBP_RF_BUSY      FIELD32(0x00000003)
+
+/*
+ * PWR_PIN_CFG:
+ */
+#define PWR_PIN_CFG                     0x1204
+
+/*
+ * AUTOWAKEUP_CFG: Manual power control / status register
+ * TBCN_BEFORE_WAKE: ForceWake has high privilege than PutToSleep when both set
+ * AUTOWAKE: 0:sleep, 1:awake
+ */
+#define AUTOWAKEUP_CFG                  0x1208
+#define AUTOWAKEUP_CFG_AUTO_LEAD_TIME   FIELD32(0x000000ff)
+#define AUTOWAKEUP_CFG_TBCN_BEFORE_WAKE FIELD32(0x00007f00)
+#define AUTOWAKEUP_CFG_AUTOWAKE         FIELD32(0x00008000)
+
+/*
+ * EDCA_AC0_CFG:
+ */
+#define EDCA_AC0_CFG                    0x1300
+#define EDCA_AC0_CFG_TX_OP              FIELD32(0x000000ff)
+#define EDCA_AC0_CFG_AIFSN              FIELD32(0x00000f00)
+#define EDCA_AC0_CFG_CWMIN              FIELD32(0x0000f000)
+#define EDCA_AC0_CFG_CWMAX              FIELD32(0x000f0000)
+
+/*
+ * EDCA_AC1_CFG:
+ */
+#define EDCA_AC1_CFG                    0x1304
+#define EDCA_AC1_CFG_TX_OP              FIELD32(0x000000ff)
+#define EDCA_AC1_CFG_AIFSN              FIELD32(0x00000f00)
+#define EDCA_AC1_CFG_CWMIN              FIELD32(0x0000f000)
+#define EDCA_AC1_CFG_CWMAX              FIELD32(0x000f0000)
+
+/*
+ * EDCA_AC2_CFG:
+ */
+#define EDCA_AC2_CFG                    0x1308
+#define EDCA_AC2_CFG_TX_OP              FIELD32(0x000000ff)
+#define EDCA_AC2_CFG_AIFSN              FIELD32(0x00000f00)
+#define EDCA_AC2_CFG_CWMIN              FIELD32(0x0000f000)
+#define EDCA_AC2_CFG_CWMAX              FIELD32(0x000f0000)
+
+/*
+ * EDCA_AC3_CFG:
+ */
+#define EDCA_AC3_CFG                    0x130c
+#define EDCA_AC3_CFG_TX_OP              FIELD32(0x000000ff)
+#define EDCA_AC3_CFG_AIFSN              FIELD32(0x00000f00)
+#define EDCA_AC3_CFG_CWMIN              FIELD32(0x0000f000)
+#define EDCA_AC3_CFG_CWMAX              FIELD32(0x000f0000)
+
+/*
+ * EDCA_TID_AC_MAP:
+ */
+#define EDCA_TID_AC_MAP                 0x1310
+
+/*
+ * TX_PWR_CFG_0:
+ */
+#define TX_PWR_CFG_0                    0x1314
+#define TX_PWR_CFG_0_1MBS               FIELD32(0x0000000f)
+#define TX_PWR_CFG_0_2MBS               FIELD32(0x000000f0)
+#define TX_PWR_CFG_0_55MBS              FIELD32(0x00000f00)
+#define TX_PWR_CFG_0_11MBS              FIELD32(0x0000f000)
+#define TX_PWR_CFG_0_6MBS               FIELD32(0x000f0000)
+#define TX_PWR_CFG_0_9MBS               FIELD32(0x00f00000)
+#define TX_PWR_CFG_0_12MBS              FIELD32(0x0f000000)
+#define TX_PWR_CFG_0_18MBS              FIELD32(0xf0000000)
+
+/*
+ * TX_PWR_CFG_1:
+ */
+#define TX_PWR_CFG_1                    0x1318
+#define TX_PWR_CFG_1_24MBS              FIELD32(0x0000000f)
+#define TX_PWR_CFG_1_36MBS              FIELD32(0x000000f0)
+#define TX_PWR_CFG_1_48MBS              FIELD32(0x00000f00)
+#define TX_PWR_CFG_1_54MBS              FIELD32(0x0000f000)
+#define TX_PWR_CFG_1_MCS0               FIELD32(0x000f0000)
+#define TX_PWR_CFG_1_MCS1               FIELD32(0x00f00000)
+#define TX_PWR_CFG_1_MCS2               FIELD32(0x0f000000)
+#define TX_PWR_CFG_1_MCS3               FIELD32(0xf0000000)
+
+/*
+ * TX_PWR_CFG_2:
+ */
+#define TX_PWR_CFG_2                    0x131c
+#define TX_PWR_CFG_2_MCS4               FIELD32(0x0000000f)
+#define TX_PWR_CFG_2_MCS5               FIELD32(0x000000f0)
+#define TX_PWR_CFG_2_MCS6               FIELD32(0x00000f00)
+#define TX_PWR_CFG_2_MCS7               FIELD32(0x0000f000)
+#define TX_PWR_CFG_2_MCS8               FIELD32(0x000f0000)
+#define TX_PWR_CFG_2_MCS9               FIELD32(0x00f00000)
+#define TX_PWR_CFG_2_MCS10              FIELD32(0x0f000000)
+#define TX_PWR_CFG_2_MCS11              FIELD32(0xf0000000)
+
+/*
+ * TX_PWR_CFG_3:
+ */
+#define TX_PWR_CFG_3                    0x1320
+#define TX_PWR_CFG_3_MCS12              FIELD32(0x0000000f)
+#define TX_PWR_CFG_3_MCS13              FIELD32(0x000000f0)
+#define TX_PWR_CFG_3_MCS14              FIELD32(0x00000f00)
+#define TX_PWR_CFG_3_MCS15              FIELD32(0x0000f000)
+#define TX_PWR_CFG_3_UKNOWN1            FIELD32(0x000f0000)
+#define TX_PWR_CFG_3_UKNOWN2            FIELD32(0x00f00000)
+#define TX_PWR_CFG_3_UKNOWN3            FIELD32(0x0f000000)
+#define TX_PWR_CFG_3_UKNOWN4            FIELD32(0xf0000000)
+
+/*
+ * TX_PWR_CFG_4:
+ */
+#define TX_PWR_CFG_4                    0x1324
+#define TX_PWR_CFG_4_UKNOWN5            FIELD32(0x0000000f)
+#define TX_PWR_CFG_4_UKNOWN6            FIELD32(0x000000f0)
+#define TX_PWR_CFG_4_UKNOWN7            FIELD32(0x00000f00)
+#define TX_PWR_CFG_4_UKNOWN8            FIELD32(0x0000f000)
+
+/*
+ * TX_PIN_CFG:
+ */
+#define TX_PIN_CFG                      0x1328
+#define TX_PIN_CFG_PA_PE_A0_EN          FIELD32(0x00000001)
+#define TX_PIN_CFG_PA_PE_G0_EN          FIELD32(0x00000002)
+#define TX_PIN_CFG_PA_PE_A1_EN          FIELD32(0x00000004)
+#define TX_PIN_CFG_PA_PE_G1_EN          FIELD32(0x00000008)
+#define TX_PIN_CFG_PA_PE_A0_POL         FIELD32(0x00000010)
+#define TX_PIN_CFG_PA_PE_G0_POL         FIELD32(0x00000020)
+#define TX_PIN_CFG_PA_PE_A1_POL         FIELD32(0x00000040)
+#define TX_PIN_CFG_PA_PE_G1_POL         FIELD32(0x00000080)
+#define TX_PIN_CFG_LNA_PE_A0_EN         FIELD32(0x00000100)
+#define TX_PIN_CFG_LNA_PE_G0_EN         FIELD32(0x00000200)
+#define TX_PIN_CFG_LNA_PE_A1_EN         FIELD32(0x00000400)
+#define TX_PIN_CFG_LNA_PE_G1_EN         FIELD32(0x00000800)
+#define TX_PIN_CFG_LNA_PE_A0_POL        FIELD32(0x00001000)
+#define TX_PIN_CFG_LNA_PE_G0_POL        FIELD32(0x00002000)
+#define TX_PIN_CFG_LNA_PE_A1_POL        FIELD32(0x00004000)
+#define TX_PIN_CFG_LNA_PE_G1_POL        FIELD32(0x00008000)
+#define TX_PIN_CFG_RFTR_EN              FIELD32(0x00010000)
+#define TX_PIN_CFG_RFTR_POL             FIELD32(0x00020000)
+#define TX_PIN_CFG_TRSW_EN              FIELD32(0x00040000)
+#define TX_PIN_CFG_TRSW_POL             FIELD32(0x00080000)
+
+/*
+ * TX_BAND_CFG: 0x1 use upper 20MHz, 0x0 use lower 20MHz
+ */
+#define TX_BAND_CFG                     0x132c
+#define TX_BAND_CFG_HT40_PLUS           FIELD32(0x00000001)
+#define TX_BAND_CFG_A                   FIELD32(0x00000002)
+#define TX_BAND_CFG_BG                  FIELD32(0x00000004)
+
+/*
+ * TX_SW_CFG0:
+ */
+#define TX_SW_CFG0                      0x1330
+
+/*
+ * TX_SW_CFG1:
+ */
+#define TX_SW_CFG1                      0x1334
+
+/*
+ * TX_SW_CFG2:
+ */
+#define TX_SW_CFG2                      0x1338
+
+/*
+ * TXOP_THRES_CFG:
+ */
+#define TXOP_THRES_CFG                  0x133c
+
+/*
+ * TXOP_CTRL_CFG:
+ */
+#define TXOP_CTRL_CFG                   0x1340
+
+/*
+ * TX_RTS_CFG:
+ * RTS_THRES: unit:byte
+ * RTS_FBK_EN: enable rts rate fallback
+ */
+#define TX_RTS_CFG                      0x1344
+#define TX_RTS_CFG_AUTO_RTS_RETRY_LIMIT FIELD32(0x000000ff)
+#define TX_RTS_CFG_RTS_THRES            FIELD32(0x00ffff00)
+#define TX_RTS_CFG_RTS_FBK_EN           FIELD32(0x01000000)
+
+/*
+ * TX_TIMEOUT_CFG:
+ * MPDU_LIFETIME: expiration time = 2^(9+MPDU LIFE TIME) us
+ * RX_ACK_TIMEOUT: unit:slot. Used for TX procedure
+ * TX_OP_TIMEOUT: TXOP timeout value for TXOP truncation.
+ *                it is recommended that:
+ *                (SLOT_TIME) > (TX_OP_TIMEOUT) > (RX_ACK_TIMEOUT)
+ */
+#define TX_TIMEOUT_CFG                  0x1348
+#define TX_TIMEOUT_CFG_MPDU_LIFETIME    FIELD32(0x000000f0)
+#define TX_TIMEOUT_CFG_RX_ACK_TIMEOUT   FIELD32(0x0000ff00)
+#define TX_TIMEOUT_CFG_TX_OP_TIMEOUT    FIELD32(0x00ff0000)
+
+/*
+ * TX_RTY_CFG:
+ * SHORT_RTY_LIMIT: short retry limit
+ * LONG_RTY_LIMIT: long retry limit
+ * LONG_RTY_THRE: Long retry threshoold
+ * NON_AGG_RTY_MODE: Non-Aggregate MPDU retry mode
+ *                   0:expired by retry limit, 1: expired by mpdu life timer
+ * AGG_RTY_MODE: Aggregate MPDU retry mode
+ *               0:expired by retry limit, 1: expired by mpdu life timer
+ * TX_AUTO_FB_ENABLE: Tx retry PHY rate auto fallback enable
+ */
+#define TX_RTY_CFG                      0x134c
+#define TX_RTY_CFG_SHORT_RTY_LIMIT      FIELD32(0x000000ff)
+#define TX_RTY_CFG_LONG_RTY_LIMIT       FIELD32(0x0000ff00)
+#define TX_RTY_CFG_LONG_RTY_THRE        FIELD32(0x0fff0000)
+#define TX_RTY_CFG_NON_AGG_RTY_MODE     FIELD32(0x10000000)
+#define TX_RTY_CFG_AGG_RTY_MODE         FIELD32(0x20000000)
+#define TX_RTY_CFG_TX_AUTO_FB_ENABLE    FIELD32(0x40000000)
+
+/*
+ * TX_LINK_CFG:
+ * REMOTE_MFB_LIFETIME: remote MFB life time. unit: 32us
+ * MFB_ENABLE: TX apply remote MFB 1:enable
+ * REMOTE_UMFS_ENABLE: remote unsolicit  MFB enable
+ *                     0: not apply remote remote unsolicit (MFS=7)
+ * TX_MRQ_EN: MCS request TX enable
+ * TX_RDG_EN: RDG TX enable
+ * TX_CF_ACK_EN: Piggyback CF-ACK enable
+ * REMOTE_MFB: remote MCS feedback
+ * REMOTE_MFS: remote MCS feedback sequence number
+ */
+#define TX_LINK_CFG                     0x1350
+#define TX_LINK_CFG_REMOTE_MFB_LIFETIME FIELD32(0x000000ff)
+#define TX_LINK_CFG_MFB_ENABLE          FIELD32(0x00000100)
+#define TX_LINK_CFG_REMOTE_UMFS_ENABLE  FIELD32(0x00000200)
+#define TX_LINK_CFG_TX_MRQ_EN           FIELD32(0x00000400)
+#define TX_LINK_CFG_TX_RDG_EN           FIELD32(0x00000800)
+#define TX_LINK_CFG_TX_CF_ACK_EN        FIELD32(0x00001000)
+#define TX_LINK_CFG_REMOTE_MFB          FIELD32(0x00ff0000)
+#define TX_LINK_CFG_REMOTE_MFS          FIELD32(0xff000000)
+
+/*
+ * HT_FBK_CFG0:
+ */
+#define HT_FBK_CFG0                     0x1354
+#define HT_FBK_CFG0_HTMCS0FBK           FIELD32(0x0000000f)
+#define HT_FBK_CFG0_HTMCS1FBK           FIELD32(0x000000f0)
+#define HT_FBK_CFG0_HTMCS2FBK           FIELD32(0x00000f00)
+#define HT_FBK_CFG0_HTMCS3FBK           FIELD32(0x0000f000)
+#define HT_FBK_CFG0_HTMCS4FBK           FIELD32(0x000f0000)
+#define HT_FBK_CFG0_HTMCS5FBK           FIELD32(0x00f00000)
+#define HT_FBK_CFG0_HTMCS6FBK           FIELD32(0x0f000000)
+#define HT_FBK_CFG0_HTMCS7FBK           FIELD32(0xf0000000)
+
+/*
+ * HT_FBK_CFG1:
+ */
+#define HT_FBK_CFG1                     0x1358
+#define HT_FBK_CFG1_HTMCS8FBK           FIELD32(0x0000000f)
+#define HT_FBK_CFG1_HTMCS9FBK           FIELD32(0x000000f0)
+#define HT_FBK_CFG1_HTMCS10FBK          FIELD32(0x00000f00)
+#define HT_FBK_CFG1_HTMCS11FBK          FIELD32(0x0000f000)
+#define HT_FBK_CFG1_HTMCS12FBK          FIELD32(0x000f0000)
+#define HT_FBK_CFG1_HTMCS13FBK          FIELD32(0x00f00000)
+#define HT_FBK_CFG1_HTMCS14FBK          FIELD32(0x0f000000)
+#define HT_FBK_CFG1_HTMCS15FBK          FIELD32(0xf0000000)
+
+/*
+ * LG_FBK_CFG0:
+ */
+#define LG_FBK_CFG0                     0x135c
+#define LG_FBK_CFG0_OFDMMCS0FBK         FIELD32(0x0000000f)
+#define LG_FBK_CFG0_OFDMMCS1FBK         FIELD32(0x000000f0)
+#define LG_FBK_CFG0_OFDMMCS2FBK         FIELD32(0x00000f00)
+#define LG_FBK_CFG0_OFDMMCS3FBK         FIELD32(0x0000f000)
+#define LG_FBK_CFG0_OFDMMCS4FBK         FIELD32(0x000f0000)
+#define LG_FBK_CFG0_OFDMMCS5FBK         FIELD32(0x00f00000)
+#define LG_FBK_CFG0_OFDMMCS6FBK         FIELD32(0x0f000000)
+#define LG_FBK_CFG0_OFDMMCS7FBK         FIELD32(0xf0000000)
+
+/*
+ * LG_FBK_CFG1:
+ */
+#define LG_FBK_CFG1                     0x1360
+#define LG_FBK_CFG0_CCKMCS0FBK          FIELD32(0x0000000f)
+#define LG_FBK_CFG0_CCKMCS1FBK          FIELD32(0x000000f0)
+#define LG_FBK_CFG0_CCKMCS2FBK          FIELD32(0x00000f00)
+#define LG_FBK_CFG0_CCKMCS3FBK          FIELD32(0x0000f000)
+
+/*
+ * CCK_PROT_CFG: CCK Protection
+ * PROTECT_RATE: Protection control frame rate for CCK TX(RTS/CTS/CFEnd)
+ * PROTECT_CTRL: Protection control frame type for CCK TX
+ *               0:none, 1:RTS/CTS, 2:CTS-to-self
+ * PROTECT_NAV: TXOP protection type for CCK TX
+ *              0:none, 1:ShortNAVprotect, 2:LongNAVProtect
+ * TX_OP_ALLOW_CCK: CCK TXOP allowance, 0:disallow
+ * TX_OP_ALLOW_OFDM: CCK TXOP allowance, 0:disallow
+ * TX_OP_ALLOW_MM20: CCK TXOP allowance, 0:disallow
+ * TX_OP_ALLOW_MM40: CCK TXOP allowance, 0:disallow
+ * TX_OP_ALLOW_GF20: CCK TXOP allowance, 0:disallow
+ * TX_OP_ALLOW_GF40: CCK TXOP allowance, 0:disallow
+ * RTS_TH_EN: RTS threshold enable on CCK TX
+ */
+#define CCK_PROT_CFG                    0x1364
+#define CCK_PROT_CFG_PROTECT_RATE       FIELD32(0x0000ffff)
+#define CCK_PROT_CFG_PROTECT_CTRL       FIELD32(0x00030000)
+#define CCK_PROT_CFG_PROTECT_NAV        FIELD32(0x000c0000)
+#define CCK_PROT_CFG_TX_OP_ALLOW_CCK    FIELD32(0x00100000)
+#define CCK_PROT_CFG_TX_OP_ALLOW_OFDM   FIELD32(0x00200000)
+#define CCK_PROT_CFG_TX_OP_ALLOW_MM20   FIELD32(0x00400000)
+#define CCK_PROT_CFG_TX_OP_ALLOW_MM40   FIELD32(0x00800000)
+#define CCK_PROT_CFG_TX_OP_ALLOW_GF20   FIELD32(0x01000000)
+#define CCK_PROT_CFG_TX_OP_ALLOW_GF40   FIELD32(0x02000000)
+#define CCK_PROT_CFG_RTS_TH_EN          FIELD32(0x04000000)
+
+/*
+ * OFDM_PROT_CFG: OFDM Protection
+ */
+#define OFDM_PROT_CFG                   0x1368
+#define OFDM_PROT_CFG_PROTECT_RATE      FIELD32(0x0000ffff)
+#define OFDM_PROT_CFG_PROTECT_CTRL      FIELD32(0x00030000)
+#define OFDM_PROT_CFG_PROTECT_NAV       FIELD32(0x000c0000)
+#define OFDM_PROT_CFG_TX_OP_ALLOW_CCK   FIELD32(0x00100000)
+#define OFDM_PROT_CFG_TX_OP_ALLOW_OFDM  FIELD32(0x00200000)
+#define OFDM_PROT_CFG_TX_OP_ALLOW_MM20  FIELD32(0x00400000)
+#define OFDM_PROT_CFG_TX_OP_ALLOW_MM40  FIELD32(0x00800000)
+#define OFDM_PROT_CFG_TX_OP_ALLOW_GF20  FIELD32(0x01000000)
+#define OFDM_PROT_CFG_TX_OP_ALLOW_GF40  FIELD32(0x02000000)
+#define OFDM_PROT_CFG_RTS_TH_EN         FIELD32(0x04000000)
+
+/*
+ * MM20_PROT_CFG: MM20 Protection
+ */
+#define MM20_PROT_CFG                   0x136c
+#define MM20_PROT_CFG_PROTECT_RATE      FIELD32(0x0000ffff)
+#define MM20_PROT_CFG_PROTECT_CTRL      FIELD32(0x00030000)
+#define MM20_PROT_CFG_PROTECT_NAV       FIELD32(0x000c0000)
+#define MM20_PROT_CFG_TX_OP_ALLOW_CCK   FIELD32(0x00100000)
+#define MM20_PROT_CFG_TX_OP_ALLOW_OFDM  FIELD32(0x00200000)
+#define MM20_PROT_CFG_TX_OP_ALLOW_MM20  FIELD32(0x00400000)
+#define MM20_PROT_CFG_TX_OP_ALLOW_MM40  FIELD32(0x00800000)
+#define MM20_PROT_CFG_TX_OP_ALLOW_GF20  FIELD32(0x01000000)
+#define MM20_PROT_CFG_TX_OP_ALLOW_GF40  FIELD32(0x02000000)
+#define MM20_PROT_CFG_RTS_TH_EN         FIELD32(0x04000000)
+
+/*
+ * MM40_PROT_CFG: MM40 Protection
+ */
+#define MM40_PROT_CFG                   0x1370
+#define MM40_PROT_CFG_PROTECT_RATE      FIELD32(0x0000ffff)
+#define MM40_PROT_CFG_PROTECT_CTRL      FIELD32(0x00030000)
+#define MM40_PROT_CFG_PROTECT_NAV       FIELD32(0x000c0000)
+#define MM40_PROT_CFG_TX_OP_ALLOW_CCK   FIELD32(0x00100000)
+#define MM40_PROT_CFG_TX_OP_ALLOW_OFDM  FIELD32(0x00200000)
+#define MM40_PROT_CFG_TX_OP_ALLOW_MM20  FIELD32(0x00400000)
+#define MM40_PROT_CFG_TX_OP_ALLOW_MM40  FIELD32(0x00800000)
+#define MM40_PROT_CFG_TX_OP_ALLOW_GF20  FIELD32(0x01000000)
+#define MM40_PROT_CFG_TX_OP_ALLOW_GF40  FIELD32(0x02000000)
+#define MM40_PROT_CFG_RTS_TH_EN         FIELD32(0x04000000)
+
+/*
+ * GF20_PROT_CFG: GF20 Protection
+ */
+#define GF20_PROT_CFG                   0x1374
+#define GF20_PROT_CFG_PROTECT_RATE      FIELD32(0x0000ffff)
+#define GF20_PROT_CFG_PROTECT_CTRL      FIELD32(0x00030000)
+#define GF20_PROT_CFG_PROTECT_NAV       FIELD32(0x000c0000)
+#define GF20_PROT_CFG_TX_OP_ALLOW_CCK   FIELD32(0x00100000)
+#define GF20_PROT_CFG_TX_OP_ALLOW_OFDM  FIELD32(0x00200000)
+#define GF20_PROT_CFG_TX_OP_ALLOW_MM20  FIELD32(0x00400000)
+#define GF20_PROT_CFG_TX_OP_ALLOW_MM40  FIELD32(0x00800000)
+#define GF20_PROT_CFG_TX_OP_ALLOW_GF20  FIELD32(0x01000000)
+#define GF20_PROT_CFG_TX_OP_ALLOW_GF40  FIELD32(0x02000000)
+#define GF20_PROT_CFG_RTS_TH_EN         FIELD32(0x04000000)
+
+/*
+ * GF40_PROT_CFG: GF40 Protection
+ */
+#define GF40_PROT_CFG                   0x1378
+#define GF40_PROT_CFG_PROTECT_RATE      FIELD32(0x0000ffff)
+#define GF40_PROT_CFG_PROTECT_CTRL      FIELD32(0x00030000)
+#define GF40_PROT_CFG_PROTECT_NAV       FIELD32(0x000c0000)
+#define GF40_PROT_CFG_TX_OP_ALLOW_CCK   FIELD32(0x00100000)
+#define GF40_PROT_CFG_TX_OP_ALLOW_OFDM  FIELD32(0x00200000)
+#define GF40_PROT_CFG_TX_OP_ALLOW_MM20  FIELD32(0x00400000)
+#define GF40_PROT_CFG_TX_OP_ALLOW_MM40  FIELD32(0x00800000)
+#define GF40_PROT_CFG_TX_OP_ALLOW_GF20  FIELD32(0x01000000)
+#define GF40_PROT_CFG_TX_OP_ALLOW_GF40  FIELD32(0x02000000)
+#define GF40_PROT_CFG_RTS_TH_EN         FIELD32(0x04000000)
+
+/*
+ * EXP_CTS_TIME:
+ */
+#define EXP_CTS_TIME                    0x137c
+
+/*
+ * EXP_ACK_TIME:
+ */
+#define EXP_ACK_TIME                    0x1380
+
+/*
+ * RX_FILTER_CFG: RX configuration register.
+ */
+#define RX_FILTER_CFG                   0x1400
+#define RX_FILTER_CFG_DROP_CRC_ERROR    FIELD32(0x00000001)
+#define RX_FILTER_CFG_DROP_PHY_ERROR    FIELD32(0x00000002)
+#define RX_FILTER_CFG_DROP_NOT_TO_ME    FIELD32(0x00000004)
+#define RX_FILTER_CFG_DROP_NOT_MY_BSSD  FIELD32(0x00000008)
+#define RX_FILTER_CFG_DROP_VER_ERROR    FIELD32(0x00000010)
+#define RX_FILTER_CFG_DROP_MULTICAST    FIELD32(0x00000020)
+#define RX_FILTER_CFG_DROP_BROADCAST    FIELD32(0x00000040)
+#define RX_FILTER_CFG_DROP_DUPLICATE    FIELD32(0x00000080)
+#define RX_FILTER_CFG_DROP_CF_END_ACK   FIELD32(0x00000100)
+#define RX_FILTER_CFG_DROP_CF_END       FIELD32(0x00000200)
+#define RX_FILTER_CFG_DROP_ACK          FIELD32(0x00000400)
+#define RX_FILTER_CFG_DROP_CTS          FIELD32(0x00000800)
+#define RX_FILTER_CFG_DROP_RTS          FIELD32(0x00001000)
+#define RX_FILTER_CFG_DROP_PSPOLL       FIELD32(0x00002000)
+#define RX_FILTER_CFG_DROP_BA           FIELD32(0x00004000)
+#define RX_FILTER_CFG_DROP_BAR          FIELD32(0x00008000)
+#define RX_FILTER_CFG_DROP_CNTL         FIELD32(0x00010000)
+
+/*
+ * AUTO_RSP_CFG:
+ * AUTORESPONDER: 0: disable, 1: enable
+ * BAC_ACK_POLICY: 0:long, 1:short preamble
+ * CTS_40_MMODE: Response CTS 40MHz duplicate mode
+ * CTS_40_MREF: Response CTS 40MHz duplicate mode
+ * AR_PREAMBLE: Auto responder preamble 0:long, 1:short preamble
+ * DUAL_CTS_EN: Power bit value in control frame
+ * ACK_CTS_PSM_BIT:Power bit value in control frame
+ */
+#define AUTO_RSP_CFG                    0x1404
+#define AUTO_RSP_CFG_AUTORESPONDER      FIELD32(0x00000001)
+#define AUTO_RSP_CFG_BAC_ACK_POLICY     FIELD32(0x00000002)
+#define AUTO_RSP_CFG_CTS_40_MMODE       FIELD32(0x00000004)
+#define AUTO_RSP_CFG_CTS_40_MREF        FIELD32(0x00000008)
+#define AUTO_RSP_CFG_AR_PREAMBLE        FIELD32(0x00000010)
+#define AUTO_RSP_CFG_DUAL_CTS_EN        FIELD32(0x00000040)
+#define AUTO_RSP_CFG_ACK_CTS_PSM_BIT    FIELD32(0x00000080)
+
+/*
+ * LEGACY_BASIC_RATE:
+ */
+#define LEGACY_BASIC_RATE               0x1408
+
+/*
+ * HT_BASIC_RATE:
+ */
+#define HT_BASIC_RATE                   0x140c
+
+/*
+ * HT_CTRL_CFG:
+ */
+#define HT_CTRL_CFG                     0x1410
+
+/*
+ * SIFS_COST_CFG:
+ */
+#define SIFS_COST_CFG                   0x1414
+
+/*
+ * RX_PARSER_CFG:
+ * Set NAV for all received frames
+ */
+#define RX_PARSER_CFG                   0x1418
+
+/*
+ * TX_SEC_CNT0:
+ */
+#define TX_SEC_CNT0                     0x1500
+
+/*
+ * RX_SEC_CNT0:
+ */
+#define RX_SEC_CNT0                     0x1504
+
+/*
+ * CCMP_FC_MUTE:
+ */
+#define CCMP_FC_MUTE                    0x1508
+
+/*
+ * TXOP_HLDR_ADDR0:
+ */
+#define TXOP_HLDR_ADDR0                 0x1600
+
+/*
+ * TXOP_HLDR_ADDR1:
+ */
+#define TXOP_HLDR_ADDR1                 0x1604
+
+/*
+ * TXOP_HLDR_ET:
+ */
+#define TXOP_HLDR_ET                    0x1608
+
+/*
+ * QOS_CFPOLL_RA_DW0:
+ */
+#define QOS_CFPOLL_RA_DW0               0x160c
+
+/*
+ * QOS_CFPOLL_RA_DW1:
+ */
+#define QOS_CFPOLL_RA_DW1               0x1610
+
+/*
+ * QOS_CFPOLL_QC:
+ */
+#define QOS_CFPOLL_QC                   0x1614
+
+/*
+ * RX_STA_CNT0: RX PLCP error count & RX CRC error count
+ */
+#define RX_STA_CNT0                     0x1700
+#define RX_STA_CNT0_CRC_ERR             FIELD32(0x0000ffff)
+#define RX_STA_CNT0_PHY_ERR             FIELD32(0xffff0000)
+
+/*
+ * RX_STA_CNT1: RX False CCA count & RX LONG frame count
+ */
+#define RX_STA_CNT1                     0x1704
+#define RX_STA_CNT1_FALSE_CCA           FIELD32(0x0000ffff)
+#define RX_STA_CNT1_PLCP_ERR            FIELD32(0xffff0000)
+
+/*
+ * RX_STA_CNT2:
+ */
+#define RX_STA_CNT2                     0x1708
+#define RX_STA_CNT2_RX_DUPLI_COUNT      FIELD32(0x0000ffff)
+#define RX_STA_CNT2_RX_FIFO_OVERFLOW    FIELD32(0xffff0000)
+
+/*
+ * TX_STA_CNT0: TX Beacon count
+ */
+#define TX_STA_CNT0                     0x170c
+#define TX_STA_CNT0_TX_FAIL_COUNT       FIELD32(0x0000ffff)
+#define TX_STA_CNT0_TX_BEACON_COUNT     FIELD32(0xffff0000)
+
+/*
+ * TX_STA_CNT1: TX tx count
+ */
+#define TX_STA_CNT1                     0x1710
+#define TX_STA_CNT1_TX_SUCCESS          FIELD32(0x0000ffff)
+#define TX_STA_CNT1_TX_RETRANSMIT       FIELD32(0xffff0000)
+
+/*
+ * TX_STA_CNT2: TX tx count
+ */
+#define TX_STA_CNT2                     0x1714
+#define TX_STA_CNT2_TX_ZERO_LEN_COUNT   FIELD32(0x0000ffff)
+#define TX_STA_CNT2_TX_UNDER_FLOW_COUNT FIELD32(0xffff0000)
+
+/*
+ * TX_STA_FIFO: TX Result for specific PID status fifo register
+ */
+#define TX_STA_FIFO                     0x1718
+#define TX_STA_FIFO_VALID               FIELD32(0x00000001)
+#define TX_STA_FIFO_PID_TYPE            FIELD32(0x0000001e)
+#define TX_STA_FIFO_TX_SUCCESS          FIELD32(0x00000020)
+#define TX_STA_FIFO_TX_AGGRE            FIELD32(0x00000040)
+#define TX_STA_FIFO_TX_ACK_REQUIRED     FIELD32(0x00000080)
+#define TX_STA_FIFO_WCID                FIELD32(0x0000ff00)
+#define TX_STA_FIFO_SUCCESS_RATE        FIELD32(0xffff0000)
+
+/*
+ * TX_AGG_CNT: Debug counter
+ */
+#define TX_AGG_CNT                      0x171c
+#define TX_AGG_CNT_NON_AGG_TX_COUNT     FIELD32(0x0000ffff)
+#define TX_AGG_CNT_AGG_TX_COUNT         FIELD32(0xffff0000)
+
+/*
+ * TX_AGG_CNT0:
+ */
+#define TX_AGG_CNT0                     0x1720
+#define TX_AGG_CNT0_AGG_SIZE_1_COUNT    FIELD32(0x0000ffff)
+#define TX_AGG_CNT0_AGG_SIZE_2_COUNT    FIELD32(0xffff0000)
+
+/*
+ * TX_AGG_CNT1:
+ */
+#define TX_AGG_CNT1                     0x1724
+#define TX_AGG_CNT1_AGG_SIZE_3_COUNT    FIELD32(0x0000ffff)
+#define TX_AGG_CNT1_AGG_SIZE_4_COUNT    FIELD32(0xffff0000)
+
+/*
+ * TX_AGG_CNT2:
+ */
+#define TX_AGG_CNT2                     0x1728
+#define TX_AGG_CNT2_AGG_SIZE_5_COUNT    FIELD32(0x0000ffff)
+#define TX_AGG_CNT2_AGG_SIZE_6_COUNT    FIELD32(0xffff0000)
+
+/*
+ * TX_AGG_CNT3:
+ */
+#define TX_AGG_CNT3                     0x172c
+#define TX_AGG_CNT3_AGG_SIZE_7_COUNT    FIELD32(0x0000ffff)
+#define TX_AGG_CNT3_AGG_SIZE_8_COUNT    FIELD32(0xffff0000)
+
+/*
+ * TX_AGG_CNT4:
+ */
+#define TX_AGG_CNT4                     0x1730
+#define TX_AGG_CNT4_AGG_SIZE_9_COUNT    FIELD32(0x0000ffff)
+#define TX_AGG_CNT4_AGG_SIZE_10_COUNT   FIELD32(0xffff0000)
+
+/*
+ * TX_AGG_CNT5:
+ */
+#define TX_AGG_CNT5                     0x1734
+#define TX_AGG_CNT5_AGG_SIZE_11_COUNT   FIELD32(0x0000ffff)
+#define TX_AGG_CNT5_AGG_SIZE_12_COUNT   FIELD32(0xffff0000)
+
+/*
+ * TX_AGG_CNT6:
+ */
+#define TX_AGG_CNT6                     0x1738
+#define TX_AGG_CNT6_AGG_SIZE_13_COUNT   FIELD32(0x0000ffff)
+#define TX_AGG_CNT6_AGG_SIZE_14_COUNT   FIELD32(0xffff0000)
+
+/*
+ * TX_AGG_CNT7:
+ */
+#define TX_AGG_CNT7                     0x173c
+#define TX_AGG_CNT7_AGG_SIZE_15_COUNT   FIELD32(0x0000ffff)
+#define TX_AGG_CNT7_AGG_SIZE_16_COUNT   FIELD32(0xffff0000)
+
+/*
+ * MPDU_DENSITY_CNT:
+ * TX_ZERO_DEL: TX zero length delimiter count
+ * RX_ZERO_DEL: RX zero length delimiter count
+ */
+#define MPDU_DENSITY_CNT                0x1740
+#define MPDU_DENSITY_CNT_TX_ZERO_DEL    FIELD32(0x0000ffff)
+#define MPDU_DENSITY_CNT_RX_ZERO_DEL    FIELD32(0xffff0000)
+
+/*
+ * Security key table memory.
+ * MAC_WCID_BASE: 8-bytes (use only 6 bytes) * 256 entry
+ * PAIRWISE_KEY_TABLE_BASE: 32-byte * 256 entry
+ * MAC_IVEIV_TABLE_BASE: 8-byte * 256-entry
+ * MAC_WCID_ATTRIBUTE_BASE: 4-byte * 256-entry
+ * SHARED_KEY_TABLE_BASE: 32-byte * 16-entry
+ * SHARED_KEY_MODE_BASE: 4-byte * 16-entry
+ */
+#define MAC_WCID_BASE                   0x1800
+#define PAIRWISE_KEY_TABLE_BASE         0x4000
+#define MAC_IVEIV_TABLE_BASE            0x6000
+#define MAC_WCID_ATTRIBUTE_BASE         0x6800
+#define SHARED_KEY_TABLE_BASE           0x6c00
+#define SHARED_KEY_MODE_BASE            0x7000
+
+#define MAC_WCID_ENTRY(__idx) \
+        ( MAC_WCID_BASE + ((__idx) * sizeof(struct mac_wcid_entry)) )
+#define PAIRWISE_KEY_ENTRY(__idx) \
+        ( PAIRWISE_KEY_TABLE_BASE + ((__idx) * sizeof(struct hw_key_entry)) )
+#define MAC_IVEIV_ENTRY(__idx) \
+        ( MAC_IVEIV_TABLE_BASE + ((__idx) & sizeof(struct mac_iveiv_entry)) )
+#define MAC_WCID_ATTR_ENTRY(__idx) \
+        ( MAC_WCID_ATTRIBUTE_BASE + ((__idx) * sizeof(u32)) )
+#define SHARED_KEY_ENTRY(__idx) \
+        ( SHARED_KEY_TABLE_BASE + ((__idx) * sizeof(struct hw_key_entry)) )
+#define SHARED_KEY_MODE_ENTRY(__idx) \
+        ( SHARED_KEY_MODE_BASE + ((__idx) * sizeof(u32)) )
+
+struct mac_wcid_entry {
+        u8 mac[6];
+        u8 reserved[2];
+} __attribute__ ((packed));
+
+struct hw_key_entry {
+        u8 key[16];
+        u8 tx_mic[8];
+        u8 rx_mic[8];
+} __attribute__ ((packed));
+
+struct mac_iveiv_entry {
+        u8 iv[8];
+} __attribute__ ((packed));
+
+/*
+ * MAC_WCID_ATTRIBUTE:
+ */
+#define MAC_WCID_ATTRIBUTE_KEYTAB       FIELD32(0x00000001)
+#define MAC_WCID_ATTRIBUTE_CIPHER       FIELD32(0x0000000e)
+#define MAC_WCID_ATTRIBUTE_BSS_IDX      FIELD32(0x00000070)
+#define MAC_WCID_ATTRIBUTE_RX_WIUDF     FIELD32(0x00000380)
+
+/*
+ * SHARED_KEY_MODE:
+ */
+#define SHARED_KEY_MODE_BSS0_KEY0       FIELD32(0x00000007)
+#define SHARED_KEY_MODE_BSS0_KEY1       FIELD32(0x00000070)
+#define SHARED_KEY_MODE_BSS0_KEY2       FIELD32(0x00000700)
+#define SHARED_KEY_MODE_BSS0_KEY3       FIELD32(0x00007000)
+#define SHARED_KEY_MODE_BSS1_KEY0       FIELD32(0x00070000)
+#define SHARED_KEY_MODE_BSS1_KEY1       FIELD32(0x00700000)
+#define SHARED_KEY_MODE_BSS1_KEY2       FIELD32(0x07000000)
+#define SHARED_KEY_MODE_BSS1_KEY3       FIELD32(0x70000000)
+
+/*
+ * HOST-MCU communication
+ */
+
+/*
+ * H2M_MAILBOX_CSR: Host-to-MCU Mailbox.
+ */
+#define H2M_MAILBOX_CSR                 0x7010
+#define H2M_MAILBOX_CSR_ARG0            FIELD32(0x000000ff)
+#define H2M_MAILBOX_CSR_ARG1            FIELD32(0x0000ff00)
+#define H2M_MAILBOX_CSR_CMD_TOKEN       FIELD32(0x00ff0000)
+#define H2M_MAILBOX_CSR_OWNER           FIELD32(0xff000000)
+
+/*
+ * H2M_MAILBOX_CID:
+ */
+#define H2M_MAILBOX_CID                 0x7014
+#define H2M_MAILBOX_CID_CMD0            FIELD32(0x000000ff)
+#define H2M_MAILBOX_CID_CMD1            FIELD32(0x0000ff00)
+#define H2M_MAILBOX_CID_CMD2            FIELD32(0x00ff0000)
+#define H2M_MAILBOX_CID_CMD3            FIELD32(0xff000000)
+
+/*
+ * H2M_MAILBOX_STATUS:
+ */
+#define H2M_MAILBOX_STATUS              0x701c
+
+/*
+ * H2M_INT_SRC:
+ */
+#define H2M_INT_SRC                     0x7024
+
+/*
+ * H2M_BBP_AGENT:
+ */
+#define H2M_BBP_AGENT                   0x7028
+
+/*
+ * MCU_LEDCS: LED control for MCU Mailbox.
+ */
+#define MCU_LEDCS_LED_MODE              FIELD8(0x1f)
+#define MCU_LEDCS_POLARITY              FIELD8(0x01)
+
+/*
+ * HW_CS_CTS_BASE:
+ * Carrier-sense CTS frame base address.
+ * It's where mac stores carrier-sense frame for carrier-sense function.
+ */
+#define HW_CS_CTS_BASE                  0x7700
+
+/*
+ * HW_DFS_CTS_BASE:
+ * FS CTS frame base address. It's where mac stores CTS frame for DFS.
+ */
+#define HW_DFS_CTS_BASE                 0x7780
+
+/*
+ * TXRX control registers - base address 0x3000
+ */
+
+/*
+ * TXRX_CSR1:
+ * rt2860b  UNKNOWN reg use R/O Reg Addr 0x77d0 first..
+ */
+#define TXRX_CSR1                       0x77d0
+
+/*
+ * HW_DEBUG_SETTING_BASE:
+ * since NULL frame won't be that long (256 byte)
+ * We steal 16 tail bytes to save debugging settings
+ */
+#define HW_DEBUG_SETTING_BASE           0x77f0
+#define HW_DEBUG_SETTING_BASE2          0x7770
+
+/*
+ * HW_BEACON_BASE
+ * In order to support maximum 8 MBSS and its maximum length
+ * is 512 bytes for each beacon
+ * Three section discontinue memory segments will be used.
+ * 1. The original region for BCN 0~3
+ * 2. Extract memory from FCE table for BCN 4~5
+ * 3. Extract memory from Pair-wise key table for BCN 6~7
+ *    It occupied those memory of wcid 238~253 for BCN 6
+ *    and wcid 222~237 for BCN 7
+ *
+ * IMPORTANT NOTE: Not sure why legacy driver does this,
+ * but HW_BEACON_BASE7 is 0x0200 bytes below HW_BEACON_BASE6.
+ */
+#define HW_BEACON_BASE0                 0x7800
+#define HW_BEACON_BASE1                 0x7a00
+#define HW_BEACON_BASE2                 0x7c00
+#define HW_BEACON_BASE3                 0x7e00
+#define HW_BEACON_BASE4                 0x7200
+#define HW_BEACON_BASE5                 0x7400
+#define HW_BEACON_BASE6                 0x5dc0
+#define HW_BEACON_BASE7                 0x5bc0
+
+#define HW_BEACON_OFFSET(__index) \
+        ( ((__index) < 4) ? ( HW_BEACON_BASE0 + (__index * 0x0200) ) : \
+          (((__index) < 6) ? ( HW_BEACON_BASE4 + ((__index - 4) * 0x0200) ) : \
+          (HW_BEACON_BASE6 - ((__index - 6) * 0x0200))) )
+
+/*
+ * 8051 firmware image.
+ */
+#define FIRMWARE_RT2870                 "rt2870.bin"
+#define FIRMWARE_IMAGE_BASE             0x3000
+
+/*
+ * BBP registers.
+ * The wordsize of the BBP is 8 bits.
+ */
+
+/*
+ * BBP 1: TX Antenna
+ */
+#define BBP1_TX_POWER                   FIELD8(0x07)
+#define BBP1_TX_ANTENNA                 FIELD8(0x18)
+
+/*
+ * BBP 3: RX Antenna
+ */
+#define BBP3_RX_ANTENNA                 FIELD8(0x18)
+#define BBP3_HT40_PLUS                  FIELD8(0x20)
+
+/*
+ * BBP 4: Bandwidth
+ */
+#define BBP4_TX_BF                      FIELD8(0x01)
+#define BBP4_BANDWIDTH                  FIELD8(0x18)
+
+/*
+ * RFCSR registers
+ * The wordsize of the RFCSR is 8 bits.
+ */
+
+/*
+ * RFCSR 6:
+ */
+#define RFCSR6_R                        FIELD8(0x03)
+
+/*
+ * RFCSR 7:
+ */
+#define RFCSR7_RF_TUNING                FIELD8(0x01)
+
+/*
+ * RFCSR 12:
+ */
+#define RFCSR12_TX_POWER                FIELD8(0x1f)
+
+/*
+ * RFCSR 22:
+ */
+#define RFCSR22_BASEBAND_LOOPBACK       FIELD8(0x01)
+
+/*
+ * RFCSR 23:
+ */
+#define RFCSR23_FREQ_OFFSET             FIELD8(0x7f)
+
+/*
+ * RFCSR 30:
+ */
+#define RFCSR30_RF_CALIBRATION          FIELD8(0x80)
+
+/*
+ * RF registers
+ */
+
+/*
+ * RF 2
+ */
+#define RF2_ANTENNA_RX2                 FIELD32(0x00000040)
+#define RF2_ANTENNA_TX1                 FIELD32(0x00004000)
+#define RF2_ANTENNA_RX1                 FIELD32(0x00020000)
+
+/*
+ * RF 3
+ */
+#define RF3_TXPOWER_G                   FIELD32(0x00003e00)
+#define RF3_TXPOWER_A_7DBM_BOOST        FIELD32(0x00000200)
+#define RF3_TXPOWER_A                   FIELD32(0x00003c00)
+
+/*
+ * RF 4
+ */
+#define RF4_TXPOWER_G                   FIELD32(0x000007c0)
+#define RF4_TXPOWER_A_7DBM_BOOST        FIELD32(0x00000040)
+#define RF4_TXPOWER_A                   FIELD32(0x00000780)
+#define RF4_FREQ_OFFSET                 FIELD32(0x001f8000)
+#define RF4_HT40                        FIELD32(0x00200000)
+
+/*
+ * EEPROM content.
+ * The wordsize of the EEPROM is 16 bits.
+ */
+
+/*
+ * EEPROM Version
+ */
+#define EEPROM_VERSION                  0x0001
+#define EEPROM_VERSION_FAE              FIELD16(0x00ff)
+#define EEPROM_VERSION_VERSION          FIELD16(0xff00)
+
+/*
+ * HW MAC address.
+ */
+#define EEPROM_MAC_ADDR_0               0x0002
+#define EEPROM_MAC_ADDR_BYTE0           FIELD16(0x00ff)
+#define EEPROM_MAC_ADDR_BYTE1           FIELD16(0xff00)
+#define EEPROM_MAC_ADDR_1               0x0003
+#define EEPROM_MAC_ADDR_BYTE2           FIELD16(0x00ff)
+#define EEPROM_MAC_ADDR_BYTE3           FIELD16(0xff00)
+#define EEPROM_MAC_ADDR_2               0x0004
+#define EEPROM_MAC_ADDR_BYTE4           FIELD16(0x00ff)
+#define EEPROM_MAC_ADDR_BYTE5           FIELD16(0xff00)
+
+/*
+ * EEPROM ANTENNA config
+ * RXPATH: 1: 1R, 2: 2R, 3: 3R
+ * TXPATH: 1: 1T, 2: 2T
+ */
+#define EEPROM_ANTENNA                  0x001a
+#define EEPROM_ANTENNA_RXPATH           FIELD16(0x000f)
+#define EEPROM_ANTENNA_TXPATH           FIELD16(0x00f0)
+#define EEPROM_ANTENNA_RF_TYPE          FIELD16(0x0f00)
+
+/*
+ * EEPROM NIC config
+ * CARDBUS_ACCEL: 0 - enable, 1 - disable
+ */
+#define EEPROM_NIC                      0x001b
+#define EEPROM_NIC_HW_RADIO             FIELD16(0x0001)
+#define EEPROM_NIC_DYNAMIC_TX_AGC       FIELD16(0x0002)
+#define EEPROM_NIC_EXTERNAL_LNA_BG      FIELD16(0x0004)
+#define EEPROM_NIC_EXTERNAL_LNA_A       FIELD16(0x0008)
+#define EEPROM_NIC_CARDBUS_ACCEL        FIELD16(0x0010)
+#define EEPROM_NIC_BW40M_SB_BG          FIELD16(0x0020)
+#define EEPROM_NIC_BW40M_SB_A           FIELD16(0x0040)
+#define EEPROM_NIC_WPS_PBC              FIELD16(0x0080)
+#define EEPROM_NIC_BW40M_BG             FIELD16(0x0100)
+#define EEPROM_NIC_BW40M_A              FIELD16(0x0200)
+
+/*
+ * EEPROM frequency
+ */
+#define EEPROM_FREQ                     0x001d
+#define EEPROM_FREQ_OFFSET              FIELD16(0x00ff)
+#define EEPROM_FREQ_LED_MODE            FIELD16(0x7f00)
+#define EEPROM_FREQ_LED_POLARITY        FIELD16(0x1000)
+
+/*
+ * EEPROM LED
+ * POLARITY_RDY_G: Polarity RDY_G setting.
+ * POLARITY_RDY_A: Polarity RDY_A setting.
+ * POLARITY_ACT: Polarity ACT setting.
+ * POLARITY_GPIO_0: Polarity GPIO0 setting.
+ * POLARITY_GPIO_1: Polarity GPIO1 setting.
+ * POLARITY_GPIO_2: Polarity GPIO2 setting.
+ * POLARITY_GPIO_3: Polarity GPIO3 setting.
+ * POLARITY_GPIO_4: Polarity GPIO4 setting.
+ * LED_MODE: Led mode.
+ */
+#define EEPROM_LED1                     0x001e
+#define EEPROM_LED2                     0x001f
+#define EEPROM_LED3                     0x0020
+#define EEPROM_LED_POLARITY_RDY_BG      FIELD16(0x0001)
+#define EEPROM_LED_POLARITY_RDY_A       FIELD16(0x0002)
+#define EEPROM_LED_POLARITY_ACT         FIELD16(0x0004)
+#define EEPROM_LED_POLARITY_GPIO_0      FIELD16(0x0008)
+#define EEPROM_LED_POLARITY_GPIO_1      FIELD16(0x0010)
+#define EEPROM_LED_POLARITY_GPIO_2      FIELD16(0x0020)
+#define EEPROM_LED_POLARITY_GPIO_3      FIELD16(0x0040)
+#define EEPROM_LED_POLARITY_GPIO_4      FIELD16(0x0080)
+#define EEPROM_LED_LED_MODE             FIELD16(0x1f00)
+
+/*
+ * EEPROM LNA
+ */
+#define EEPROM_LNA                      0x0022
+#define EEPROM_LNA_BG                   FIELD16(0x00ff)
+#define EEPROM_LNA_A0                   FIELD16(0xff00)
+
+/*
+ * EEPROM RSSI BG offset
+ */
+#define EEPROM_RSSI_BG                  0x0023
+#define EEPROM_RSSI_BG_OFFSET0          FIELD16(0x00ff)
+#define EEPROM_RSSI_BG_OFFSET1          FIELD16(0xff00)
+
+/*
+ * EEPROM RSSI BG2 offset
+ */
+#define EEPROM_RSSI_BG2                 0x0024
+#define EEPROM_RSSI_BG2_OFFSET2         FIELD16(0x00ff)
+#define EEPROM_RSSI_BG2_LNA_A1          FIELD16(0xff00)
+
+/*
+ * EEPROM RSSI A offset
+ */
+#define EEPROM_RSSI_A                   0x0025
+#define EEPROM_RSSI_A_OFFSET0           FIELD16(0x00ff)
+#define EEPROM_RSSI_A_OFFSET1           FIELD16(0xff00)
+
+/*
+ * EEPROM RSSI A2 offset
+ */
+#define EEPROM_RSSI_A2                  0x0026
+#define EEPROM_RSSI_A2_OFFSET2          FIELD16(0x00ff)
+#define EEPROM_RSSI_A2_LNA_A2           FIELD16(0xff00)
+
+/*
+ * EEPROM TXpower delta: 20MHZ AND 40 MHZ use different power.
+ *      This is delta in 40MHZ.
+ * VALUE: Tx Power dalta value (MAX=4)
+ * TYPE: 1: Plus the delta value, 0: minus the delta value
+ * TXPOWER: Enable:
+ */
+#define EEPROM_TXPOWER_DELTA            0x0028
+#define EEPROM_TXPOWER_DELTA_VALUE      FIELD16(0x003f)
+#define EEPROM_TXPOWER_DELTA_TYPE       FIELD16(0x0040)
+#define EEPROM_TXPOWER_DELTA_TXPOWER    FIELD16(0x0080)
+
+/*
+ * EEPROM TXPOWER 802.11BG
+ */
+#define EEPROM_TXPOWER_BG1              0x0029
+#define EEPROM_TXPOWER_BG2              0x0030
+#define EEPROM_TXPOWER_BG_SIZE          7
+#define EEPROM_TXPOWER_BG_1             FIELD16(0x00ff)
+#define EEPROM_TXPOWER_BG_2             FIELD16(0xff00)
+
+/*
+ * EEPROM TXPOWER 802.11A
+ */
+#define EEPROM_TXPOWER_A1               0x003c
+#define EEPROM_TXPOWER_A2               0x0053
+#define EEPROM_TXPOWER_A_SIZE           6
+#define EEPROM_TXPOWER_A_1              FIELD16(0x00ff)
+#define EEPROM_TXPOWER_A_2              FIELD16(0xff00)
+
+/*
+ * EEPROM TXpower byrate: 20MHZ power
+ */
+#define EEPROM_TXPOWER_BYRATE           0x006f
+
+/*
+ * EEPROM BBP.
+ */
+#define EEPROM_BBP_START                0x0078
+#define EEPROM_BBP_SIZE                 16
+#define EEPROM_BBP_VALUE                FIELD16(0x00ff)
+#define EEPROM_BBP_REG_ID               FIELD16(0xff00)
+
+/*
+ * MCU mailbox commands.
+ */
+#define MCU_SLEEP                       0x30
+#define MCU_WAKEUP                      0x31
+#define MCU_RADIO_OFF                   0x35
+#define MCU_CURRENT                     0x36
+#define MCU_LED                         0x50
+#define MCU_LED_STRENGTH                0x51
+#define MCU_LED_1                       0x52
+#define MCU_LED_2                       0x53
+#define MCU_LED_3                       0x54
+#define MCU_RADAR                       0x60
+#define MCU_BOOT_SIGNAL                 0x72
+#define MCU_BBP_SIGNAL                  0x80
+#define MCU_POWER_SAVE                  0x83
+
+/*
+ * MCU mailbox tokens
+ */
+#define TOKEN_WAKUP                     3
+
+/*
+ * DMA descriptor defines.
+ */
+#define TXD_DESC_SIZE                   ( 4 * sizeof(__le32) )
+#define TXINFO_DESC_SIZE                ( 1 * sizeof(__le32) )
+#define TXWI_DESC_SIZE                  ( 4 * sizeof(__le32) )
+#define RXD_DESC_SIZE                   ( 1 * sizeof(__le32) )
+#define RXWI_DESC_SIZE                  ( 4 * sizeof(__le32) )
+
+/*
+ * TX descriptor format for TX, PRIO and Beacon Ring.
+ */
+
+/*
+ * Word0
+ */
+#define TXD_W0_SD_PTR0                  FIELD32(0xffffffff)
+
+/*
+ * Word1
+ */
+#define TXD_W1_SD_LEN1                  FIELD32(0x00003fff)
+#define TXD_W1_LAST_SEC1                FIELD32(0x00004000)
+#define TXD_W1_BURST                    FIELD32(0x00008000)
+#define TXD_W1_SD_LEN0                  FIELD32(0x3fff0000)
+#define TXD_W1_LAST_SEC0                FIELD32(0x40000000)
+#define TXD_W1_DMA_DONE                 FIELD32(0x80000000)
+
+/*
+ * Word2
+ */
+#define TXD_W2_SD_PTR1                  FIELD32(0xffffffff)
+
+/*
+ * Word3
+ * WIV: Wireless Info Valid. 1: Driver filled WI,  0: DMA needs to copy WI
+ * QSEL: Select on-chip FIFO ID for 2nd-stage output scheduler.
+ *       0:MGMT, 1:HCCA 2:EDCA
+ */
+#define TXD_W3_WIV                      FIELD32(0x01000000)
+#define TXD_W3_QSEL                     FIELD32(0x06000000)
+#define TXD_W3_TCO                      FIELD32(0x20000000)
+#define TXD_W3_UCO                      FIELD32(0x40000000)
+#define TXD_W3_ICO                      FIELD32(0x80000000)
+
+/*
+ * TX Info structure
+ */
+
+/*
+ * Word0
+ * WIV: Wireless Info Valid. 1: Driver filled WI,  0: DMA needs to copy WI
+ * QSEL: Select on-chip FIFO ID for 2nd-stage output scheduler.
+ *       0:MGMT, 1:HCCA 2:EDCA
+ * USB_DMA_NEXT_VALID: Used ONLY in USB bulk Aggregation, NextValid
+ * DMA_TX_BURST: used ONLY in USB bulk Aggregation.
+ *               Force USB DMA transmit frame from current selected endpoint
+ */
+#define TXINFO_W0_USB_DMA_TX_PKT_LEN    FIELD32(0x0000ffff)
+#define TXINFO_W0_WIV                   FIELD32(0x01000000)
+#define TXINFO_W0_QSEL                  FIELD32(0x06000000)
+#define TXINFO_W0_SW_USE_LAST_ROUND     FIELD32(0x08000000)
+#define TXINFO_W0_USB_DMA_NEXT_VALID    FIELD32(0x40000000)
+#define TXINFO_W0_USB_DMA_TX_BURST      FIELD32(0x80000000)
+
+/*
+ * TX WI structure
+ */
+
+/*
+ * Word0
+ * FRAG: 1 To inform TKIP engine this is a fragment.
+ * MIMO_PS: The remote peer is in dynamic MIMO-PS mode
+ * TX_OP: 0:HT TXOP rule , 1:PIFS TX ,2:Backoff, 3:sifs
+ * BW: Channel bandwidth 20MHz or 40 MHz
+ * STBC: 1: STBC support MCS =0-7, 2,3 : RESERVED
+ */
+#define TXWI_W0_FRAG                    FIELD32(0x00000001)
+#define TXWI_W0_MIMO_PS                 FIELD32(0x00000002)
+#define TXWI_W0_CF_ACK                  FIELD32(0x00000004)
+#define TXWI_W0_TS                      FIELD32(0x00000008)
+#define TXWI_W0_AMPDU                   FIELD32(0x00000010)
+#define TXWI_W0_MPDU_DENSITY            FIELD32(0x000000e0)
+#define TXWI_W0_TX_OP                   FIELD32(0x00000300)
+#define TXWI_W0_MCS                     FIELD32(0x007f0000)
+#define TXWI_W0_BW                      FIELD32(0x00800000)
+#define TXWI_W0_SHORT_GI                FIELD32(0x01000000)
+#define TXWI_W0_STBC                    FIELD32(0x06000000)
+#define TXWI_W0_IFS                     FIELD32(0x08000000)
+#define TXWI_W0_PHYMODE                 FIELD32(0xc0000000)
+
+/*
+ * Word1
+ */
+#define TXWI_W1_ACK                     FIELD32(0x00000001)
+#define TXWI_W1_NSEQ                    FIELD32(0x00000002)
+#define TXWI_W1_BW_WIN_SIZE             FIELD32(0x000000fc)
+#define TXWI_W1_WIRELESS_CLI_ID         FIELD32(0x0000ff00)
+#define TXWI_W1_MPDU_TOTAL_BYTE_COUNT   FIELD32(0x0fff0000)
+#define TXWI_W1_PACKETID                FIELD32(0xf0000000)
+
+/*
+ * Word2
+ */
+#define TXWI_W2_IV                      FIELD32(0xffffffff)
+
+/*
+ * Word3
+ */
+#define TXWI_W3_EIV                     FIELD32(0xffffffff)
+
+/*
+ * RX descriptor format for RX Ring.
+ */
+
+/*
+ * Word0
+ * UNICAST_TO_ME: This RX frame is unicast to me.
+ * MULTICAST: This is a multicast frame.
+ * BROADCAST: This is a broadcast frame.
+ * MY_BSS: this frame belongs to the same BSSID.
+ * CRC_ERROR: CRC error.
+ * CIPHER_ERROR: 0: decryption okay, 1:ICV error, 2:MIC error, 3:KEY not valid.
+ * AMSDU: rx with 802.3 header, not 802.11 header.
+ */
+
+#define RXD_W0_BA                       FIELD32(0x00000001)
+#define RXD_W0_DATA                     FIELD32(0x00000002)
+#define RXD_W0_NULLDATA                 FIELD32(0x00000004)
+#define RXD_W0_FRAG                     FIELD32(0x00000008)
+#define RXD_W0_UNICAST_TO_ME            FIELD32(0x00000010)
+#define RXD_W0_MULTICAST                FIELD32(0x00000020)
+#define RXD_W0_BROADCAST                FIELD32(0x00000040)
+#define RXD_W0_MY_BSS                   FIELD32(0x00000080)
+#define RXD_W0_CRC_ERROR                FIELD32(0x00000100)
+#define RXD_W0_CIPHER_ERROR             FIELD32(0x00000600)
+#define RXD_W0_AMSDU                    FIELD32(0x00000800)
+#define RXD_W0_HTC                      FIELD32(0x00001000)
+#define RXD_W0_RSSI                     FIELD32(0x00002000)
+#define RXD_W0_L2PAD                    FIELD32(0x00004000)
+#define RXD_W0_AMPDU                    FIELD32(0x00008000)
+#define RXD_W0_DECRYPTED                FIELD32(0x00010000)
+#define RXD_W0_PLCP_RSSI                FIELD32(0x00020000)
+#define RXD_W0_CIPHER_ALG               FIELD32(0x00040000)
+#define RXD_W0_LAST_AMSDU               FIELD32(0x00080000)
+#define RXD_W0_PLCP_SIGNAL              FIELD32(0xfff00000)
+
+/*
+ * RX WI structure
+ */
+
+/*
+ * Word0
+ */
+#define RXWI_W0_WIRELESS_CLI_ID         FIELD32(0x000000ff)
+#define RXWI_W0_KEY_INDEX               FIELD32(0x00000300)
+#define RXWI_W0_BSSID                   FIELD32(0x00001c00)
+#define RXWI_W0_UDF                     FIELD32(0x0000e000)
+#define RXWI_W0_MPDU_TOTAL_BYTE_COUNT   FIELD32(0x0fff0000)
+#define RXWI_W0_TID                     FIELD32(0xf0000000)
+
+/*
+ * Word1
+ */
+#define RXWI_W1_FRAG                    FIELD32(0x0000000f)
+#define RXWI_W1_SEQUENCE                FIELD32(0x0000fff0)
+#define RXWI_W1_MCS                     FIELD32(0x007f0000)
+#define RXWI_W1_BW                      FIELD32(0x00800000)
+#define RXWI_W1_SHORT_GI                FIELD32(0x01000000)
+#define RXWI_W1_STBC                    FIELD32(0x06000000)
+#define RXWI_W1_PHYMODE                 FIELD32(0xc0000000)
+
+/*
+ * Word2
+ */
+#define RXWI_W2_RSSI0                   FIELD32(0x000000ff)
+#define RXWI_W2_RSSI1                   FIELD32(0x0000ff00)
+#define RXWI_W2_RSSI2                   FIELD32(0x00ff0000)
+
+/*
+ * Word3
+ */
+#define RXWI_W3_SNR0                    FIELD32(0x000000ff)
+#define RXWI_W3_SNR1                    FIELD32(0x0000ff00)
+
+/*
+ * Macro's for converting txpower from EEPROM to mac80211 value
+ * and from mac80211 value to register value.
+ */
+#define MIN_G_TXPOWER   0
+#define MIN_A_TXPOWER   -7
+#define MAX_G_TXPOWER   31
+#define MAX_A_TXPOWER   15
+#define DEFAULT_TXPOWER 5
+
+#define TXPOWER_G_FROM_DEV(__txpower) \
+        ((__txpower) > MAX_G_TXPOWER) ? DEFAULT_TXPOWER : (__txpower)
+
+#define TXPOWER_G_TO_DEV(__txpower) \
+        clamp_t(char, __txpower, MIN_G_TXPOWER, MAX_G_TXPOWER)
+
+#define TXPOWER_A_FROM_DEV(__txpower) \
+        ((__txpower) > MAX_A_TXPOWER) ? DEFAULT_TXPOWER : (__txpower)
+
+#define TXPOWER_A_TO_DEV(__txpower) \
+        clamp_t(char, __txpower, MIN_A_TXPOWER, MAX_A_TXPOWER)
+
+#endif /* RT2800USB_H */
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index e03d69975ea4..419b1b9f998e 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -103,6 +103,15 @@
 #define GET_DURATION_RES(__size, __rate)(((__size) * 8 * 10) % (__rate))
 
 /*
+ * Determine the alignment requirement,
+ * to make sure the 802.11 payload is padded to a 4-byte boundrary
+ * we must determine the address of the payload and calculate the
+ * amount of bytes needed to move the data.
+ */
+#define ALIGN_SIZE(__skb, __header) \
+        (  ((unsigned long)((__skb)->data + (__header))) & 3 )
+
+/*
  * Standard timing and size defines.
  * These values should follow the ieee80211 specifications.
  */
@@ -138,6 +147,7 @@ struct rt2x00_chip {
 #define RT2561          0x0302
 #define RT2661          0x0401
 #define RT2571          0x1300
+#define RT2870          0x1600
 
         u16 rf;
         u32 rev;
@@ -357,6 +367,7 @@ static inline struct rt2x00_intf* vif_to_intf(struct ieee80211_vif *vif)
  *      for @tx_power_a, @tx_power_bg and @channels.
  * @channels: Device/chipset specific channel values (See &struct rf_channel).
  * @channels_info: Additional information for channels (See &struct channel_info).
+ * @ht: Driver HT Capabilities (See &ieee80211_sta_ht_cap).
  */
 struct hw_mode_spec {
         unsigned int supported_bands;
@@ -370,6 +381,8 @@ struct hw_mode_spec {
         unsigned int num_channels;
         const struct rf_channel *channels;
         const struct channel_info *channels_info;
+
+        struct ieee80211_sta_ht_cap ht;
 };
 
 /*
@@ -590,6 +603,7 @@ enum rt2x00_flags {
         DRIVER_REQUIRE_SCHEDULED,
         DRIVER_REQUIRE_DMA,
         DRIVER_REQUIRE_COPY_IV,
+        DRIVER_REQUIRE_L2PAD,
 
         /*
          * Driver features
@@ -606,6 +620,7 @@ enum rt2x00_flags {
         CONFIG_EXTERNAL_LNA_BG,
         CONFIG_DOUBLE_ANTENNA,
         CONFIG_DISABLE_LINK_TUNING,
+        CONFIG_CHANNEL_HT40,
 };
 
 /*
@@ -778,6 +793,13 @@ struct rt2x00_dev {
         u8 freq_offset;
 
         /*
+         * Calibration information (for rt2800usb & rt2800pci).
+         * [0] -> BW20
+         * [1] -> BW40
+         */
+        u8 calibration[2];
+
+        /*
          * Low level statistics which will have
          * to be kept up to date while device is running.
          */
@@ -893,11 +915,10 @@ static inline u32 rt2x00_rev(const struct rt2x00_chip *chipset)
         return chipset->rev;
 }
 
-static inline u16 rt2x00_check_rev(const struct rt2x00_chip *chipset,
-                                   const u32 rev)
+static inline bool rt2x00_check_rev(const struct rt2x00_chip *chipset,
+                                    const u32 mask, const u32 rev)
 {
-        return (((chipset->rev & 0xffff0) == rev) &&
-                !!(chipset->rev & 0x0000f));
+        return ((chipset->rev & mask) == rev);
 }
 
 /**
@@ -943,9 +964,6 @@ int rt2x00mac_add_interface(struct ieee80211_hw *hw,
 void rt2x00mac_remove_interface(struct ieee80211_hw *hw,
                                 struct ieee80211_if_init_conf *conf);
 int rt2x00mac_config(struct ieee80211_hw *hw, u32 changed);
-int rt2x00mac_config_interface(struct ieee80211_hw *hw,
-                               struct ieee80211_vif *vif,
-                               struct ieee80211_if_conf *conf);
 void rt2x00mac_configure_filter(struct ieee80211_hw *hw,
                                 unsigned int changed_flags,
                                 unsigned int *total_flags,
diff --git a/drivers/net/wireless/rt2x00/rt2x00config.c b/drivers/net/wireless/rt2x00/rt2x00config.c
index 9c2f5517af2a..863e399d4fa6 100644
--- a/drivers/net/wireless/rt2x00/rt2x00config.c
+++ b/drivers/net/wireless/rt2x00/rt2x00config.c
@@ -173,6 +173,11 @@ void rt2x00lib_config(struct rt2x00_dev *rt2x00dev,
         libconf.conf = conf;
 
         if (ieee80211_flags & IEEE80211_CONF_CHANGE_CHANNEL) {
+                if (conf_is_ht40(conf))
+                        __set_bit(CONFIG_CHANNEL_HT40, &rt2x00dev->flags);
+                else
+                        __clear_bit(CONFIG_CHANNEL_HT40, &rt2x00dev->flags);
+
                 memcpy(&libconf.rf,
                        &rt2x00dev->spec.channels[conf->channel->hw_value],
                        sizeof(libconf.rf));
diff --git a/drivers/net/wireless/rt2x00/rt2x00crypto.c b/drivers/net/wireless/rt2x00/rt2x00crypto.c
index 0b41845d9543..57ab42cfed34 100644
--- a/drivers/net/wireless/rt2x00/rt2x00crypto.c
+++ b/drivers/net/wireless/rt2x00/rt2x00crypto.c
@@ -65,7 +65,8 @@ void rt2x00crypto_create_tx_descriptor(struct queue_entry *entry,
                 __set_bit(ENTRY_TXD_ENCRYPT_PAIRWISE, &txdesc->flags);
 
         txdesc->key_idx = hw_key->hw_key_idx;
-        txdesc->iv_offset = ieee80211_get_hdrlen_from_skb(entry->skb);
+        txdesc->iv_offset = txdesc->header_length;
+        txdesc->iv_len = hw_key->iv_len;
 
         if (!(hw_key->flags & IEEE80211_KEY_FLAG_GENERATE_IV))
                 __set_bit(ENTRY_TXD_ENCRYPT_IV, &txdesc->flags);
@@ -103,47 +104,44 @@ unsigned int rt2x00crypto_tx_overhead(struct rt2x00_dev *rt2x00dev,
         return overhead;
 }
 
-void rt2x00crypto_tx_copy_iv(struct sk_buff *skb, unsigned int iv_len)
+void rt2x00crypto_tx_copy_iv(struct sk_buff *skb, struct txentry_desc *txdesc)
 {
         struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
-        unsigned int header_length = ieee80211_get_hdrlen_from_skb(skb);
 
-        if (unlikely(!iv_len))
+        if (unlikely(!txdesc->iv_len))
                 return;
 
         /* Copy IV/EIV data */
-        memcpy(skbdesc->iv, skb->data + header_length, iv_len);
+        memcpy(skbdesc->iv, skb->data + txdesc->iv_offset, txdesc->iv_len);
 }
 
-void rt2x00crypto_tx_remove_iv(struct sk_buff *skb, unsigned int iv_len)
+void rt2x00crypto_tx_remove_iv(struct sk_buff *skb, struct txentry_desc *txdesc)
 {
         struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
-        unsigned int header_length = ieee80211_get_hdrlen_from_skb(skb);
 
-        if (unlikely(!iv_len))
+        if (unlikely(!txdesc->iv_len))
                 return;
 
         /* Copy IV/EIV data */
-        memcpy(skbdesc->iv, skb->data + header_length, iv_len);
+        memcpy(skbdesc->iv, skb->data + txdesc->iv_offset, txdesc->iv_len);
 
         /* Move ieee80211 header */
-        memmove(skb->data + iv_len, skb->data, header_length);
+        memmove(skb->data + txdesc->iv_len, skb->data, txdesc->iv_offset);
 
         /* Pull buffer to correct size */
-        skb_pull(skb, iv_len);
+        skb_pull(skb, txdesc->iv_len);
 
         /* IV/EIV data has officially be stripped */
-        skbdesc->flags |= FRAME_DESC_IV_STRIPPED;
+        skbdesc->flags |= SKBDESC_IV_STRIPPED;
 }
 
-void rt2x00crypto_tx_insert_iv(struct sk_buff *skb)
+void rt2x00crypto_tx_insert_iv(struct sk_buff *skb, unsigned int header_length)
 {
         struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
-        unsigned int header_length = ieee80211_get_hdrlen_from_skb(skb);
         const unsigned int iv_len =
             ((!!(skbdesc->iv[0])) * 4) + ((!!(skbdesc->iv[1])) * 4);
 
-        if (!(skbdesc->flags & FRAME_DESC_IV_STRIPPED))
+        if (!(skbdesc->flags & SKBDESC_IV_STRIPPED))
                 return;
 
         skb_push(skb, iv_len);
@@ -155,14 +153,15 @@ void rt2x00crypto_tx_insert_iv(struct sk_buff *skb)
         memcpy(skb->data + header_length, skbdesc->iv, iv_len);
 
         /* IV/EIV data has returned into the frame */
-        skbdesc->flags &= ~FRAME_DESC_IV_STRIPPED;
+        skbdesc->flags &= ~SKBDESC_IV_STRIPPED;
 }
 
-void rt2x00crypto_rx_insert_iv(struct sk_buff *skb, unsigned int align,
+void rt2x00crypto_rx_insert_iv(struct sk_buff *skb, bool l2pad,
                                unsigned int header_length,
                                struct rxdone_entry_desc *rxdesc)
 {
         unsigned int payload_len = rxdesc->size - header_length;
+        unsigned int align = ALIGN_SIZE(skb, header_length);
         unsigned int iv_len;
         unsigned int icv_len;
         unsigned int transfer = 0;
@@ -192,32 +191,48 @@ void rt2x00crypto_rx_insert_iv(struct sk_buff *skb, unsigned int align,
         }
 
         /*
-         * Make room for new data, note that we increase both
-         * headsize and tailsize when required. The tailsize is
-         * only needed when ICV data needs to be inserted and
-         * the padding is smaller than the ICV data.
-         * When alignment requirements is greater than the
-         * ICV data we must trim the skb to the correct size
-         * because we need to remove the extra bytes.
+         * Make room for new data. There are 2 possibilities
+         * either the alignment is already present between
+         * the 802.11 header and payload. In that case we
+         * we have to move the header less then the iv_len
+         * since we can use the already available l2pad bytes
+         * for the iv data.
+         * When the alignment must be added manually we must
+         * move the header more then iv_len since we must
+         * make room for the payload move as well.
          */
-        skb_push(skb, iv_len + align);
-        if (align < icv_len)
-                skb_put(skb, icv_len - align);
-        else if (align > icv_len)
-                skb_trim(skb, rxdesc->size + iv_len + icv_len);
+        if (l2pad) {
+                skb_push(skb, iv_len - align);
+                skb_put(skb, icv_len);
 
-        /* Move ieee80211 header */
-        memmove(skb->data + transfer,
-                skb->data + transfer + iv_len + align,
-                header_length);
-        transfer += header_length;
+                /* Move ieee80211 header */
+                memmove(skb->data + transfer,
+                        skb->data + transfer + (iv_len - align),
+                        header_length);
+                transfer += header_length;
+        } else {
+                skb_push(skb, iv_len + align);
+                if (align < icv_len)
+                        skb_put(skb, icv_len - align);
+                else if (align > icv_len)
+                        skb_trim(skb, rxdesc->size + iv_len + icv_len);
+
+                /* Move ieee80211 header */
+                memmove(skb->data + transfer,
+                        skb->data + transfer + iv_len + align,
+                        header_length);
+                transfer += header_length;
+        }
 
         /* Copy IV/EIV data */
         memcpy(skb->data + transfer, rxdesc->iv, iv_len);
         transfer += iv_len;
 
-        /* Move payload */
-        if (align) {
+        /*
+         * Move payload for alignment purposes. Note that
+         * this is only needed when no l2 padding is present.
+         */
+        if (!l2pad) {
                 memmove(skb->data + transfer,
                         skb->data + transfer + align,
                         payload_len);
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 5752aaae906b..f2270845072a 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -227,6 +227,7 @@ void rt2x00lib_txdone(struct queue_entry *entry,
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(entry->skb);
         struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
         enum data_queue_qid qid = skb_get_queue_mapping(entry->skb);
+        unsigned int header_length = ieee80211_get_hdrlen_from_skb(entry->skb);
         u8 rate_idx, rate_flags;
 
         /*
@@ -235,13 +236,19 @@ void rt2x00lib_txdone(struct queue_entry *entry,
         rt2x00queue_unmap_skb(rt2x00dev, entry->skb);
 
         /*
+         * Remove L2 padding which was added during
+         */
+        if (test_bit(DRIVER_REQUIRE_L2PAD, &rt2x00dev->flags))
+                rt2x00queue_payload_align(entry->skb, true, header_length);
+
+        /*
          * If the IV/EIV data was stripped from the frame before it was
          * passed to the hardware, we should now reinsert it again because
          * mac80211 will expect the the same data to be present it the
          * frame as it was passed to us.
          */
         if (test_bit(CONFIG_SUPPORT_HW_CRYPTO, &rt2x00dev->flags))
-                rt2x00crypto_tx_insert_iv(entry->skb);
+                rt2x00crypto_tx_insert_iv(entry->skb, header_length);
 
         /*
          * Send frame to debugfs immediately, after this call is completed
@@ -316,19 +323,54 @@ void rt2x00lib_txdone(struct queue_entry *entry,
 }
 EXPORT_SYMBOL_GPL(rt2x00lib_txdone);
 
+static int rt2x00lib_rxdone_read_signal(struct rt2x00_dev *rt2x00dev,
+                                        struct rxdone_entry_desc *rxdesc)
+{
+        struct ieee80211_supported_band *sband;
+        const struct rt2x00_rate *rate;
+        unsigned int i;
+        int signal;
+        int type;
+
+        /*
+         * For non-HT rates the MCS value needs to contain the
+         * actually used rate modulation (CCK or OFDM).
+         */
+        if (rxdesc->dev_flags & RXDONE_SIGNAL_MCS)
+                signal = RATE_MCS(rxdesc->rate_mode, rxdesc->signal);
+        else
+                signal = rxdesc->signal;
+
+        type = (rxdesc->dev_flags & RXDONE_SIGNAL_MASK);
+
+        sband = &rt2x00dev->bands[rt2x00dev->curr_band];
+        for (i = 0; i < sband->n_bitrates; i++) {
+                rate = rt2x00_get_rate(sband->bitrates[i].hw_value);
+
+                if (((type == RXDONE_SIGNAL_PLCP) &&
+                     (rate->plcp == signal)) ||
+                    ((type == RXDONE_SIGNAL_BITRATE) &&
+                      (rate->bitrate == signal)) ||
+                    ((type == RXDONE_SIGNAL_MCS) &&
+                      (rate->mcs == signal))) {
+                        return i;
+                }
+        }
+
+        WARNING(rt2x00dev, "Frame received with unrecognized signal, "
+                "signal=0x%.4x, type=%d.\n", signal, type);
+        return 0;
+}
+
 void rt2x00lib_rxdone(struct rt2x00_dev *rt2x00dev,
                       struct queue_entry *entry)
 {
         struct rxdone_entry_desc rxdesc;
         struct sk_buff *skb;
         struct ieee80211_rx_status *rx_status = &rt2x00dev->rx_status;
-        struct ieee80211_supported_band *sband;
-        const struct rt2x00_rate *rate;
         unsigned int header_length;
-        unsigned int align;
-        unsigned int i;
-        int idx = -1;
-
+        bool l2pad;
+        int rate_idx;
         /*
          * Allocate a new sk_buffer. If no new buffer available, drop the
          * received frame and reuse the existing buffer.
@@ -348,12 +390,15 @@ void rt2x00lib_rxdone(struct rt2x00_dev *rt2x00dev,
         memset(&rxdesc, 0, sizeof(rxdesc));
         rt2x00dev->ops->lib->fill_rxdone(entry, &rxdesc);
 
+        /* Trim buffer to correct size */
+        skb_trim(entry->skb, rxdesc.size);
+
         /*
          * The data behind the ieee80211 header must be
          * aligned on a 4 byte boundary.
          */
         header_length = ieee80211_get_hdrlen_from_skb(entry->skb);
-        align = ((unsigned long)(entry->skb->data + header_length)) & 3;
+        l2pad = !!(rxdesc.dev_flags & RXDONE_L2PAD);
 
         /*
          * Hardware might have stripped the IV/EIV/ICV data,
@@ -362,40 +407,24 @@ void rt2x00lib_rxdone(struct rt2x00_dev *rt2x00dev,
          * in which case we should reinsert the data into the frame.
          */
         if ((rxdesc.dev_flags & RXDONE_CRYPTO_IV) &&
-            (rxdesc.flags & RX_FLAG_IV_STRIPPED)) {
-                rt2x00crypto_rx_insert_iv(entry->skb, align,
-                                          header_length, &rxdesc);
-        } else if (align) {
-                skb_push(entry->skb, align);
-                /* Move entire frame in 1 command */
-                memmove(entry->skb->data, entry->skb->data + align,
-                        rxdesc.size);
-        }
-
-        /* Update data pointers, trim buffer to correct size */
-        skb_trim(entry->skb, rxdesc.size);
+            (rxdesc.flags & RX_FLAG_IV_STRIPPED))
+                rt2x00crypto_rx_insert_iv(entry->skb, l2pad, header_length,
+                                          &rxdesc);
+        else
+                rt2x00queue_payload_align(entry->skb, l2pad, header_length);
 
         /*
-         * Update RX statistics.
+         * Check if the frame was received using HT. In that case,
+         * the rate is the MCS index and should be passed to mac80211
+         * directly. Otherwise we need to translate the signal to
+         * the correct bitrate index.
          */
-        sband = &rt2x00dev->bands[rt2x00dev->curr_band];
-        for (i = 0; i < sband->n_bitrates; i++) {
-                rate = rt2x00_get_rate(sband->bitrates[i].hw_value);
-
-                if (((rxdesc.dev_flags & RXDONE_SIGNAL_PLCP) &&
-                     (rate->plcp == rxdesc.signal)) ||
-                    ((rxdesc.dev_flags & RXDONE_SIGNAL_BITRATE) &&
-                      (rate->bitrate == rxdesc.signal))) {
-                        idx = i;
-                        break;
-                }
-        }
-
-        if (idx < 0) {
-                WARNING(rt2x00dev, "Frame received with unrecognized signal,"
-                        "signal=0x%.2x, type=%d.\n", rxdesc.signal,
-                        (rxdesc.dev_flags & RXDONE_SIGNAL_MASK));
-                idx = 0;
+        if (rxdesc.rate_mode == RATE_MODE_CCK ||
+            rxdesc.rate_mode == RATE_MODE_OFDM) {
+                rate_idx = rt2x00lib_rxdone_read_signal(rt2x00dev, &rxdesc);
+        } else {
+                rxdesc.flags |= RX_FLAG_HT;
+                rate_idx = rxdesc.signal;
         }
 
         /*
@@ -405,7 +434,7 @@ void rt2x00lib_rxdone(struct rt2x00_dev *rt2x00dev,
         rt2x00debug_update_crypto(rt2x00dev, &rxdesc);
 
         rx_status->mactime = rxdesc.timestamp;
-        rx_status->rate_idx = idx;
+        rx_status->rate_idx = rate_idx;
         rx_status->qual = rt2x00link_calculate_signal(rt2x00dev, rxdesc.rssi);
         rx_status->signal = rxdesc.rssi;
         rx_status->noise = rxdesc.noise;
@@ -440,72 +469,84 @@ const struct rt2x00_rate rt2x00_supported_rates[12] = {
                 .bitrate = 10,
                 .ratemask = BIT(0),
                 .plcp = 0x00,
+                .mcs = RATE_MCS(RATE_MODE_CCK, 0),
         },
         {
                 .flags = DEV_RATE_CCK | DEV_RATE_SHORT_PREAMBLE,
                 .bitrate = 20,
                 .ratemask = BIT(1),
                 .plcp = 0x01,
+                .mcs = RATE_MCS(RATE_MODE_CCK, 1),
         },
         {
                 .flags = DEV_RATE_CCK | DEV_RATE_SHORT_PREAMBLE,
                 .bitrate = 55,
                 .ratemask = BIT(2),
                 .plcp = 0x02,
+                .mcs = RATE_MCS(RATE_MODE_CCK, 2),
         },
         {
                 .flags = DEV_RATE_CCK | DEV_RATE_SHORT_PREAMBLE,
                 .bitrate = 110,
                 .ratemask = BIT(3),
                 .plcp = 0x03,
+                .mcs = RATE_MCS(RATE_MODE_CCK, 3),
         },
         {
                 .flags = DEV_RATE_OFDM,
                 .bitrate = 60,
                 .ratemask = BIT(4),
                 .plcp = 0x0b,
+                .mcs = RATE_MCS(RATE_MODE_OFDM, 0),
         },
         {
                 .flags = DEV_RATE_OFDM,
                 .bitrate = 90,
                 .ratemask = BIT(5),
                 .plcp = 0x0f,
+                .mcs = RATE_MCS(RATE_MODE_OFDM, 1),
         },
         {
                 .flags = DEV_RATE_OFDM,
                 .bitrate = 120,
                 .ratemask = BIT(6),
                 .plcp = 0x0a,
+                .mcs = RATE_MCS(RATE_MODE_OFDM, 2),
         },
         {
                 .flags = DEV_RATE_OFDM,
                 .bitrate = 180,
                 .ratemask = BIT(7),
                 .plcp = 0x0e,
+                .mcs = RATE_MCS(RATE_MODE_OFDM, 3),
         },
         {
                 .flags = DEV_RATE_OFDM,
                 .bitrate = 240,
                 .ratemask = BIT(8),
                 .plcp = 0x09,
+                .mcs = RATE_MCS(RATE_MODE_OFDM, 4),
         },
         {
                 .flags = DEV_RATE_OFDM,
                 .bitrate = 360,
                 .ratemask = BIT(9),
                 .plcp = 0x0d,
+                .mcs = RATE_MCS(RATE_MODE_OFDM, 5),
         },
         {
                 .flags = DEV_RATE_OFDM,
                 .bitrate = 480,
                 .ratemask = BIT(10),
                 .plcp = 0x08,
+                .mcs = RATE_MCS(RATE_MODE_OFDM, 6),
         },
         {
                 .flags = DEV_RATE_OFDM,
                 .bitrate = 540,
                 .ratemask = BIT(11),
                 .plcp = 0x0c,
+                .mcs = RATE_MCS(RATE_MODE_OFDM, 7),
         },
 };
 
@@ -581,6 +622,8 @@ static int rt2x00lib_probe_hw_modes(struct rt2x00_dev *rt2x00dev,
                 rt2x00dev->bands[IEEE80211_BAND_2GHZ].bitrates = rates;
                 hw->wiphy->bands[IEEE80211_BAND_2GHZ] =
                     &rt2x00dev->bands[IEEE80211_BAND_2GHZ];
+                memcpy(&rt2x00dev->bands[IEEE80211_BAND_2GHZ].ht_cap,
+                       &spec->ht, sizeof(spec->ht));
         }
 
         /*
@@ -597,6 +640,8 @@ static int rt2x00lib_probe_hw_modes(struct rt2x00_dev *rt2x00dev,
                 rt2x00dev->bands[IEEE80211_BAND_5GHZ].bitrates = &rates[4];
                 hw->wiphy->bands[IEEE80211_BAND_5GHZ] =
                     &rt2x00dev->bands[IEEE80211_BAND_5GHZ];
+                memcpy(&rt2x00dev->bands[IEEE80211_BAND_5GHZ].ht_cap,
+                       &spec->ht, sizeof(spec->ht));
         }
 
         return 0;
diff --git a/drivers/net/wireless/rt2x00/rt2x00ht.c b/drivers/net/wireless/rt2x00/rt2x00ht.c
new file mode 100644
index 000000000000..e3cec839e540
--- /dev/null
+++ b/drivers/net/wireless/rt2x00/rt2x00ht.c
@@ -0,0 +1,69 @@
+/*
+        Copyright (C) 2004 - 2009 rt2x00 SourceForge Project
+        <http://rt2x00.serialmonkey.com>
+
+        This program is free software; you can redistribute it and/or modify
+        it under the terms of the GNU General Public License as published by
+        the Free Software Foundation; either version 2 of the License, or
+        (at your option) any later version.
+
+        This program is distributed in the hope that it will be useful,
+        but WITHOUT ANY WARRANTY; without even the implied warranty of
+        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+        GNU General Public License for more details.
+
+        You should have received a copy of the GNU General Public License
+        along with this program; if not, write to the
+        Free Software Foundation, Inc.,
+        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+/*
+        Module: rt2x00lib
+        Abstract: rt2x00 HT specific routines.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+
+#include "rt2x00.h"
+#include "rt2x00lib.h"
+
+void rt2x00ht_create_tx_descriptor(struct queue_entry *entry,
+                                   struct txentry_desc *txdesc,
+                                   const struct rt2x00_rate *hwrate)
+{
+        struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(entry->skb);
+        struct ieee80211_tx_rate *txrate = &tx_info->control.rates[0];
+
+        if (tx_info->control.sta)
+                txdesc->mpdu_density =
+                    tx_info->control.sta->ht_cap.ampdu_density;
+        else
+                txdesc->mpdu_density = 0;
+
+        txdesc->ba_size = 7;    /* FIXME: What value is needed? */
+        txdesc->stbc = 0;       /* FIXME: What value is needed? */
+
+        txdesc->mcs = rt2x00_get_rate_mcs(hwrate->mcs);
+        if (txrate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
+                txdesc->mcs |= 0x08;
+
+        /*
+         * Convert flags
+         */
+        if (tx_info->flags & IEEE80211_TX_CTL_AMPDU)
+                __set_bit(ENTRY_TXD_HT_AMPDU, &txdesc->flags);
+
+        /*
+         * Determine HT Mix/Greenfield rate mode
+         */
+        if (txrate->flags & IEEE80211_TX_RC_MCS)
+                txdesc->rate_mode = RATE_MODE_HT_MIX;
+        if (txrate->flags & IEEE80211_TX_RC_GREEN_FIELD)
+                txdesc->rate_mode = RATE_MODE_HT_GREENFIELD;
+        if (txrate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
+                __set_bit(ENTRY_TXD_HT_BW_40, &txdesc->flags);
+        if (txrate->flags & IEEE80211_TX_RC_SHORT_GI)
+                __set_bit(ENTRY_TXD_HT_SHORT_GI, &txdesc->flags);
+}
diff --git a/drivers/net/wireless/rt2x00/rt2x00lib.h b/drivers/net/wireless/rt2x00/rt2x00lib.h
index a631613177d0..39e00b3d7811 100644
--- a/drivers/net/wireless/rt2x00/rt2x00lib.h
+++ b/drivers/net/wireless/rt2x00/rt2x00lib.h
@@ -32,8 +32,8 @@
  * Interval defines
  * Both the link tuner as the rfkill will be called once per second.
  */
-#define LINK_TUNE_INTERVAL      ( round_jiffies_relative(HZ) )
-#define RFKILL_POLL_INTERVAL    ( 1000 )
+#define LINK_TUNE_INTERVAL      round_jiffies_relative(HZ)
+#define RFKILL_POLL_INTERVAL    1000
 
 /*
  * rt2x00_rate: Per rate device information
@@ -48,6 +48,7 @@ struct rt2x00_rate {
         unsigned short ratemask;
 
         unsigned short plcp;
+        unsigned short mcs;
 };
 
 extern const struct rt2x00_rate rt2x00_supported_rates[12];
@@ -57,6 +58,14 @@ static inline const struct rt2x00_rate *rt2x00_get_rate(const u16 hw_value)
         return &rt2x00_supported_rates[hw_value & 0xff];
 }
 
+#define RATE_MCS(__mode, __mcs) \
+        ( (((__mode) & 0x00ff) << 8) | ((__mcs) & 0x00ff) )
+
+static inline int rt2x00_get_rate_mcs(const u16 mcs_value)
+{
+        return (mcs_value & 0x00ff);
+}
+
 /*
  * Radio control handlers.
  */
@@ -113,6 +122,23 @@ void rt2x00queue_unmap_skb(struct rt2x00_dev *rt2x00dev, struct sk_buff *skb);
 void rt2x00queue_free_skb(struct rt2x00_dev *rt2x00dev, struct sk_buff *skb);
 
 /**
+ * rt2x00queue_payload_align - Align 802.11 payload to 4-byte boundary
+ * @skb: The skb to align
+ * @l2pad: Should L2 padding be used
+ * @header_length: Length of 802.11 header
+ *
+ * This function prepares the @skb to be send to the device or mac80211.
+ * If @l2pad is set to true padding will occur between the 802.11 header
+ * and payload. Otherwise the padding will be done in front of the 802.11
+ * header.
+ * When @l2pad is set the function will check for the &SKBDESC_L2_PADDED
+ * flag in &skb_frame_desc. If that flag is set, the padding is removed
+ * and the flag cleared. Otherwise the padding is added and the flag is set.
+ */
+void rt2x00queue_payload_align(struct sk_buff *skb,
+                               bool l2pad, unsigned int header_length);
+
+/**
  * rt2x00queue_write_tx_frame - Write TX frame to hardware
  * @queue: Queue over which the frame should be send
  * @skb: The skb to send
@@ -295,10 +321,12 @@ void rt2x00crypto_create_tx_descriptor(struct queue_entry *entry,
                                        struct txentry_desc *txdesc);
 unsigned int rt2x00crypto_tx_overhead(struct rt2x00_dev *rt2x00dev,
                                       struct sk_buff *skb);
-void rt2x00crypto_tx_copy_iv(struct sk_buff *skb, unsigned int iv_len);
-void rt2x00crypto_tx_remove_iv(struct sk_buff *skb, unsigned int iv_len);
-void rt2x00crypto_tx_insert_iv(struct sk_buff *skb);
-void rt2x00crypto_rx_insert_iv(struct sk_buff *skb, unsigned int align,
+void rt2x00crypto_tx_copy_iv(struct sk_buff *skb,
+                             struct txentry_desc *txdesc);
+void rt2x00crypto_tx_remove_iv(struct sk_buff *skb,
+                               struct txentry_desc *txdesc);
+void rt2x00crypto_tx_insert_iv(struct sk_buff *skb, unsigned int header_length);
+void rt2x00crypto_rx_insert_iv(struct sk_buff *skb, bool l2pad,
                                unsigned int header_length,
                                struct rxdone_entry_desc *rxdesc);
 #else
@@ -319,21 +347,21 @@ static inline unsigned int rt2x00crypto_tx_overhead(struct rt2x00_dev *rt2x00dev
 }
 
 static inline void rt2x00crypto_tx_copy_iv(struct sk_buff *skb,
-                                           unsigned int iv_len)
+                                           struct txentry_desc *txdesc)
 {
 }
 
 static inline void rt2x00crypto_tx_remove_iv(struct sk_buff *skb,
-                                             unsigned int iv_len)
+                                             struct txentry_desc *txdesc)
 {
 }
 
-static inline void rt2x00crypto_tx_insert_iv(struct sk_buff *skb)
+static inline void rt2x00crypto_tx_insert_iv(struct sk_buff *skb,
+                                             unsigned int header_length)
 {
 }
 
-static inline void rt2x00crypto_rx_insert_iv(struct sk_buff *skb,
-                                             unsigned int align,
+static inline void rt2x00crypto_rx_insert_iv(struct sk_buff *skb, bool l2pad,
                                              unsigned int header_length,
                                              struct rxdone_entry_desc *rxdesc)
 {
@@ -341,6 +369,21 @@ static inline void rt2x00crypto_rx_insert_iv(struct sk_buff *skb,
 #endif /* CONFIG_RT2X00_LIB_CRYPTO */
 
 /*
+ * HT handlers.
+ */
+#ifdef CONFIG_RT2X00_LIB_HT
+void rt2x00ht_create_tx_descriptor(struct queue_entry *entry,
+                                   struct txentry_desc *txdesc,
+                                   const struct rt2x00_rate *hwrate);
+#else
+static inline void rt2x00ht_create_tx_descriptor(struct queue_entry *entry,
+                                                 struct txentry_desc *txdesc,
+                                                 const struct rt2x00_rate *hwrate)
+{
+}
+#endif /* CONFIG_RT2X00_LIB_HT */
+
+/*
  * RFkill handlers.
  */
 #ifdef CONFIG_RT2X00_LIB_RFKILL
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index c41a0b9e473d..c4c06b4e1f08 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -390,56 +390,6 @@ int rt2x00mac_config(struct ieee80211_hw *hw, u32 changed)
 }
 EXPORT_SYMBOL_GPL(rt2x00mac_config);
 
-int rt2x00mac_config_interface(struct ieee80211_hw *hw,
-                               struct ieee80211_vif *vif,
-                               struct ieee80211_if_conf *conf)
-{
-        struct rt2x00_dev *rt2x00dev = hw->priv;
-        struct rt2x00_intf *intf = vif_to_intf(vif);
-        int update_bssid = 0;
-        int status = 0;
-
-        /*
-         * Mac80211 might be calling this function while we are trying
-         * to remove the device or perhaps suspending it.
-         */
-        if (!test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags))
-                return 0;
-
-        spin_lock(&intf->lock);
-
-        /*
-         * conf->bssid can be NULL if coming from the internal
-         * beacon update routine.
-         */
-        if (conf->changed & IEEE80211_IFCC_BSSID && conf->bssid) {
-                update_bssid = 1;
-                memcpy(&intf->bssid, conf->bssid, ETH_ALEN);
-        }
-
-        spin_unlock(&intf->lock);
-
-        /*
-         * Call rt2x00_config_intf() outside of the spinlock context since
-         * the call will sleep for USB drivers. By using the ieee80211_if_conf
-         * values as arguments we make keep access to rt2x00_intf thread safe
-         * even without the lock.
-         */
-        rt2x00lib_config_intf(rt2x00dev, intf, vif->type, NULL,
-                              update_bssid ? conf->bssid : NULL);
-
-        /*
-         * Update the beacon.
-         */
-        if (conf->changed & (IEEE80211_IFCC_BEACON |
-                             IEEE80211_IFCC_BEACON_ENABLED))
-                status = rt2x00queue_update_beacon(rt2x00dev, vif,
-                                                   conf->enable_beacon);
-
-        return status;
-}
-EXPORT_SYMBOL_GPL(rt2x00mac_config_interface);
-
 void rt2x00mac_configure_filter(struct ieee80211_hw *hw,
                                 unsigned int changed_flags,
                                 unsigned int *total_flags,
@@ -623,6 +573,44 @@ void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw,
         struct rt2x00_dev *rt2x00dev = hw->priv;
         struct rt2x00_intf *intf = vif_to_intf(vif);
         unsigned int delayed = 0;
+        int update_bssid = 0;
+
+        /*
+         * Mac80211 might be calling this function while we are trying
+         * to remove the device or perhaps suspending it.
+         */
+        if (!test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags))
+                return;
+
+        spin_lock(&intf->lock);
+
+        /*
+         * conf->bssid can be NULL if coming from the internal
+         * beacon update routine.
+         */
+        if (changes & BSS_CHANGED_BSSID) {
+                update_bssid = 1;
+                memcpy(&intf->bssid, bss_conf->bssid, ETH_ALEN);
+        }
+
+        spin_unlock(&intf->lock);
+
+        /*
+         * Call rt2x00_config_intf() outside of the spinlock context since
+         * the call will sleep for USB drivers. By using the ieee80211_if_conf
+         * values as arguments we make keep access to rt2x00_intf thread safe
+         * even without the lock.
+         */
+        if (changes & BSS_CHANGED_BSSID)
+                rt2x00lib_config_intf(rt2x00dev, intf, vif->type, NULL,
+                                      update_bssid ? bss_conf->bssid : NULL);
+
+        /*
+         * Update the beacon.
+         */
+        if (changes & (BSS_CHANGED_BEACON | BSS_CHANGED_BEACON_ENABLED))
+                rt2x00queue_update_beacon(rt2x00dev, vif,
+                                          bss_conf->enable_beacon);
 
         /*
          * When the association status has changed we must reset the link
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index a5664bd8493e..44e5b3279ca7 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -148,6 +148,35 @@ void rt2x00queue_free_skb(struct rt2x00_dev *rt2x00dev, struct sk_buff *skb)
         dev_kfree_skb_any(skb);
 }
 
+void rt2x00queue_payload_align(struct sk_buff *skb,
+                               bool l2pad, unsigned int header_length)
+{
+        struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
+        unsigned int frame_length = skb->len;
+        unsigned int align = ALIGN_SIZE(skb, header_length);
+
+        if (!align)
+                return;
+
+        if (l2pad) {
+                if (skbdesc->flags & SKBDESC_L2_PADDED) {
+                        /* Remove L2 padding */
+                        memmove(skb->data + align, skb->data, header_length);
+                        skb_pull(skb, align);
+                        skbdesc->flags &= ~SKBDESC_L2_PADDED;
+                } else {
+                        /* Add L2 padding */
+                        skb_push(skb, align);
+                        memmove(skb->data, skb->data + align, header_length);
+                        skbdesc->flags |= SKBDESC_L2_PADDED;
+                }
+        } else {
+                /* Generic payload alignment to 4-byte boundary */
+                skb_push(skb, align);
+                memmove(skb->data, skb->data + align, frame_length);
+        }
+}
+
 static void rt2x00queue_create_tx_descriptor_seq(struct queue_entry *entry,
                                                  struct txentry_desc *txdesc)
 {
@@ -259,6 +288,12 @@ static void rt2x00queue_create_tx_descriptor(struct queue_entry *entry,
         txdesc->aifs = entry->queue->aifs;
 
         /*
+         * Header and alignment information.
+         */
+        txdesc->header_length = ieee80211_get_hdrlen_from_skb(entry->skb);
+        txdesc->l2pad = ALIGN_SIZE(entry->skb, txdesc->header_length);
+
+        /*
          * Check whether this frame is to be acked.
          */
         if (!(tx_info->flags & IEEE80211_TX_CTL_NO_ACK))
@@ -326,6 +361,7 @@ static void rt2x00queue_create_tx_descriptor(struct queue_entry *entry,
          * Apply TX descriptor handling by components
          */
         rt2x00crypto_create_tx_descriptor(entry, txdesc);
+        rt2x00ht_create_tx_descriptor(entry, txdesc, hwrate);
         rt2x00queue_create_tx_descriptor_seq(entry, txdesc);
         rt2x00queue_create_tx_descriptor_plcp(entry, txdesc, hwrate);
 }
@@ -368,7 +404,6 @@ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb)
         struct queue_entry *entry = rt2x00queue_get_entry(queue, Q_INDEX);
         struct txentry_desc txdesc;
         struct skb_frame_desc *skbdesc;
-        unsigned int iv_len = 0;
         u8 rate_idx, rate_flags;
 
         if (unlikely(rt2x00queue_full(queue)))
@@ -390,9 +425,6 @@ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb)
         entry->skb = skb;
         rt2x00queue_create_tx_descriptor(entry, &txdesc);
 
-        if (IEEE80211_SKB_CB(skb)->control.hw_key != NULL)
-                iv_len = IEEE80211_SKB_CB(skb)->control.hw_key->iv_len;
-
         /*
          * All information is retrieved from the skb->cb array,
          * now we should claim ownership of the driver part of that
@@ -415,11 +447,15 @@ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb)
         if (test_bit(ENTRY_TXD_ENCRYPT, &txdesc.flags) &&
             !test_bit(ENTRY_TXD_ENCRYPT_IV, &txdesc.flags)) {
                 if (test_bit(DRIVER_REQUIRE_COPY_IV, &queue->rt2x00dev->flags))
-                        rt2x00crypto_tx_copy_iv(skb, iv_len);
+                        rt2x00crypto_tx_copy_iv(skb, &txdesc);
                 else
-                        rt2x00crypto_tx_remove_iv(skb, iv_len);
+                        rt2x00crypto_tx_remove_iv(skb, &txdesc);
         }
 
+        if (test_bit(DRIVER_REQUIRE_L2PAD, &queue->rt2x00dev->flags))
+                rt2x00queue_payload_align(entry->skb, true,
+                                          txdesc.header_length);
+
         /*
          * It could be possible that the queue was corrupted and this
          * call failed. Since we always return NETDEV_TX_OK to mac80211,
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.h b/drivers/net/wireless/rt2x00/rt2x00queue.h
index 97e2ab08f080..b5e06347c8a7 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.h
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.h
@@ -35,9 +35,12 @@
  * for USB devices this restriction does not apply, but the value of
  * 2432 makes sense since it is big enough to contain the maximum fragment
  * size according to the ieee802.11 specs.
+ * The aggregation size depends on support from the driver, but should
+ * be something around 3840 bytes.
  */
-#define DATA_FRAME_SIZE 2432
-#define MGMT_FRAME_SIZE 256
+#define DATA_FRAME_SIZE         2432
+#define MGMT_FRAME_SIZE         256
+#define AGGREGATION_SIZE        3840
 
 /**
  * DOC: Number of entries per queue
@@ -87,13 +90,16 @@ enum data_queue_qid {
  *
  * @SKBDESC_DMA_MAPPED_RX: &skb_dma field has been mapped for RX
  * @SKBDESC_DMA_MAPPED_TX: &skb_dma field has been mapped for TX
- * @FRAME_DESC_IV_STRIPPED: Frame contained a IV/EIV provided by
+ * @SKBDESC_IV_STRIPPED: Frame contained a IV/EIV provided by
  *      mac80211 but was stripped for processing by the driver.
+ * @SKBDESC_L2_PADDED: Payload has been padded for 4-byte alignment,
+ *      the padded bytes are located between header and payload.
  */
 enum skb_frame_desc_flags {
         SKBDESC_DMA_MAPPED_RX = 1 << 0,
         SKBDESC_DMA_MAPPED_TX = 1 << 1,
-        FRAME_DESC_IV_STRIPPED = 1 << 2,
+        SKBDESC_IV_STRIPPED = 1 << 2,
+        SKBDESC_L2_PADDED = 1 << 3
 };
 
 /**
@@ -145,16 +151,20 @@ static inline struct skb_frame_desc* get_skb_frame_desc(struct sk_buff *skb)
  *
  * @RXDONE_SIGNAL_PLCP: Signal field contains the plcp value.
  * @RXDONE_SIGNAL_BITRATE: Signal field contains the bitrate value.
+ * @RXDONE_SIGNAL_MCS: Signal field contains the mcs value.
  * @RXDONE_MY_BSS: Does this frame originate from device's BSS.
  * @RXDONE_CRYPTO_IV: Driver provided IV/EIV data.
  * @RXDONE_CRYPTO_ICV: Driver provided ICV data.
+ * @RXDONE_L2PAD: 802.11 payload has been padded to 4-byte boundary.
  */
 enum rxdone_entry_desc_flags {
-        RXDONE_SIGNAL_PLCP = 1 << 0,
-        RXDONE_SIGNAL_BITRATE = 1 << 1,
-        RXDONE_MY_BSS = 1 << 2,
-        RXDONE_CRYPTO_IV = 1 << 3,
-        RXDONE_CRYPTO_ICV = 1 << 4,
+        RXDONE_SIGNAL_PLCP = BIT(0),
+        RXDONE_SIGNAL_BITRATE = BIT(1),
+        RXDONE_SIGNAL_MCS = BIT(2),
+        RXDONE_MY_BSS = BIT(3),
+        RXDONE_CRYPTO_IV = BIT(4),
+        RXDONE_CRYPTO_ICV = BIT(5),
+        RXDONE_L2PAD = BIT(6),
 };
 
 /**
@@ -163,7 +173,7 @@ enum rxdone_entry_desc_flags {
  * from &rxdone_entry_desc to a signal value type.
  */
 #define RXDONE_SIGNAL_MASK \
-       ( RXDONE_SIGNAL_PLCP | RXDONE_SIGNAL_BITRATE )
+        ( RXDONE_SIGNAL_PLCP | RXDONE_SIGNAL_BITRATE | RXDONE_SIGNAL_MCS )
 
 /**
  * struct rxdone_entry_desc: RX Entry descriptor
@@ -177,6 +187,7 @@ enum rxdone_entry_desc_flags {
  * @size: Data size of the received frame.
  * @flags: MAC80211 receive flags (See &enum mac80211_rx_flags).
  * @dev_flags: Ralink receive flags (See &enum rxdone_entry_desc_flags).
+ * @rate_mode: Rate mode (See @enum rate_modulation).
  * @cipher: Cipher type used during decryption.
  * @cipher_status: Decryption status.
  * @iv: IV/EIV data used during decryption.
@@ -190,6 +201,7 @@ struct rxdone_entry_desc {
         int size;
         int flags;
         int dev_flags;
+        u16 rate_mode;
         u8 cipher;
         u8 cipher_status;
 
@@ -243,6 +255,9 @@ struct txdone_entry_desc {
  * @ENTRY_TXD_ENCRYPT_PAIRWISE: Use pairwise key table (instead of shared).
  * @ENTRY_TXD_ENCRYPT_IV: Generate IV/EIV in hardware.
  * @ENTRY_TXD_ENCRYPT_MMIC: Generate MIC in hardware.
+ * @ENTRY_TXD_HT_AMPDU: This frame is part of an AMPDU.
+ * @ENTRY_TXD_HT_BW_40: Use 40MHz Bandwidth.
+ * @ENTRY_TXD_HT_SHORT_GI: Use short GI.
  */
 enum txentry_desc_flags {
         ENTRY_TXD_RTS_FRAME,
@@ -258,6 +273,9 @@ enum txentry_desc_flags {
         ENTRY_TXD_ENCRYPT_PAIRWISE,
         ENTRY_TXD_ENCRYPT_IV,
         ENTRY_TXD_ENCRYPT_MMIC,
+        ENTRY_TXD_HT_AMPDU,
+        ENTRY_TXD_HT_BW_40,
+        ENTRY_TXD_HT_SHORT_GI,
 };
 
 /**
@@ -267,11 +285,17 @@ enum txentry_desc_flags {
  *
  * @flags: Descriptor flags (See &enum queue_entry_flags).
  * @queue: Queue identification (See &enum data_queue_qid).
+ * @header_length: Length of 802.11 header.
+ * @l2pad: Amount of padding to align 802.11 payload to 4-byte boundrary.
  * @length_high: PLCP length high word.
  * @length_low: PLCP length low word.
  * @signal: PLCP signal.
  * @service: PLCP service.
+ * @msc: MCS.
+ * @stbc: STBC.
+ * @ba_size: BA size.
  * @rate_mode: Rate mode (See @enum rate_modulation).
+ * @mpdu_density: MDPU density.
  * @retry_limit: Max number of retries.
  * @aifs: AIFS value.
  * @ifs: IFS value.
@@ -280,18 +304,26 @@ enum txentry_desc_flags {
  * @cipher: Cipher type used for encryption.
  * @key_idx: Key index used for encryption.
  * @iv_offset: Position where IV should be inserted by hardware.
+ * @iv_len: Length of IV data.
  */
 struct txentry_desc {
         unsigned long flags;
 
         enum data_queue_qid queue;
 
+        u16 header_length;
+        u16 l2pad;
+
         u16 length_high;
         u16 length_low;
         u16 signal;
         u16 service;
 
+        u16 mcs;
+        u16 stbc;
+        u16 ba_size;
         u16 rate_mode;
+        u16 mpdu_density;
 
         short retry_limit;
         short aifs;
@@ -302,6 +334,7 @@ struct txentry_desc {
         enum cipher cipher;
         u16 key_idx;
         u16 iv_offset;
+        u16 iv_len;
 };
 
 /**
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index 4346cd1494bc..cb521ee7a8f0 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -2735,7 +2735,6 @@ static const struct ieee80211_ops rt61pci_mac80211_ops = {
         .add_interface          = rt2x00mac_add_interface,
         .remove_interface       = rt2x00mac_remove_interface,
         .config                 = rt2x00mac_config,
-        .config_interface       = rt2x00mac_config_interface,
         .configure_filter       = rt2x00mac_configure_filter,
         .set_key                = rt2x00mac_set_key,
         .get_stats              = rt2x00mac_get_stats,
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index 853b2b279b64..d10af3687a8e 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -1846,7 +1846,8 @@ static int rt73usb_init_eeprom(struct rt2x00_dev *rt2x00dev)
         rt2x00usb_register_read(rt2x00dev, MAC_CSR0, &reg);
         rt2x00_set_chip(rt2x00dev, RT2571, value, reg);
 
-        if (!rt2x00_check_rev(&rt2x00dev->chip, 0x25730)) {
+        if (!rt2x00_check_rev(&rt2x00dev->chip, 0x000ffff0, 0x25730) ||
+            !rt2x00_check_rev(&rt2x00dev->chip, 0x0000000f, 0)) {
                 ERROR(rt2x00dev, "Invalid RT chipset detected.\n");
                 return -ENODEV;
         }
@@ -2259,7 +2260,6 @@ static const struct ieee80211_ops rt73usb_mac80211_ops = {
         .add_interface          = rt2x00mac_add_interface,
         .remove_interface       = rt2x00mac_remove_interface,
         .config                 = rt2x00mac_config,
-        .config_interface       = rt2x00mac_config_interface,
         .configure_filter       = rt2x00mac_configure_filter,
         .set_key                = rt2x00mac_set_key,
         .get_stats              = rt2x00mac_get_stats,
diff --git a/drivers/net/wireless/rtl818x/rtl8180_dev.c b/drivers/net/wireless/rtl818x/rtl8180_dev.c
index 387c133ec0f2..7e65d7c31802 100644
--- a/drivers/net/wireless/rtl818x/rtl8180_dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8180_dev.c
@@ -702,30 +702,26 @@ static int rtl8180_config(struct ieee80211_hw *dev, u32 changed)
         return 0;
 }
 
-static int rtl8180_config_interface(struct ieee80211_hw *dev,
-                                    struct ieee80211_vif *vif,
-                                    struct ieee80211_if_conf *conf)
-{
-        struct rtl8180_priv *priv = dev->priv;
-        int i;
-
-        for (i = 0; i < ETH_ALEN; i++)
-                rtl818x_iowrite8(priv, &priv->map->BSSID[i], conf->bssid[i]);
-
-        if (is_valid_ether_addr(conf->bssid))
-                rtl818x_iowrite8(priv, &priv->map->MSR, RTL818X_MSR_INFRA);
-        else
-                rtl818x_iowrite8(priv, &priv->map->MSR, RTL818X_MSR_NO_LINK);
-
-        return 0;
-}
-
 static void rtl8180_bss_info_changed(struct ieee80211_hw *dev,
                                      struct ieee80211_vif *vif,
                                      struct ieee80211_bss_conf *info,
                                      u32 changed)
 {
         struct rtl8180_priv *priv = dev->priv;
+        int i;
+
+        if (changed & BSS_CHANGED_BSSID) {
+                for (i = 0; i < ETH_ALEN; i++)
+                        rtl818x_iowrite8(priv, &priv->map->BSSID[i],
+                                         info->bssid[i]);
+
+                if (is_valid_ether_addr(info->bssid))
+                        rtl818x_iowrite8(priv, &priv->map->MSR,
+                                         RTL818X_MSR_INFRA);
+                else
+                        rtl818x_iowrite8(priv, &priv->map->MSR,
+                                         RTL818X_MSR_NO_LINK);
+        }
 
         if (changed & BSS_CHANGED_ERP_SLOT && priv->rf->conf_erp)
                 priv->rf->conf_erp(dev, info);
@@ -770,7 +766,6 @@ static const struct ieee80211_ops rtl8180_ops = {
         .add_interface          = rtl8180_add_interface,
         .remove_interface       = rtl8180_remove_interface,
         .config                 = rtl8180_config,
-        .config_interface       = rtl8180_config_interface,
         .bss_info_changed       = rtl8180_bss_info_changed,
         .configure_filter       = rtl8180_configure_filter,
 };
diff --git a/drivers/net/wireless/rtl818x/rtl8187_dev.c b/drivers/net/wireless/rtl818x/rtl8187_dev.c
index ac558da92aac..158827e50c55 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_dev.c
@@ -1090,32 +1090,6 @@ static int rtl8187_config(struct ieee80211_hw *dev, u32 changed)
         return 0;
 }
 
-static int rtl8187_config_interface(struct ieee80211_hw *dev,
-                                    struct ieee80211_vif *vif,
-                                    struct ieee80211_if_conf *conf)
-{
-        struct rtl8187_priv *priv = dev->priv;
-        int i;
-        u8 reg;
-
-        mutex_lock(&priv->conf_mutex);
-        for (i = 0; i < ETH_ALEN; i++)
-                rtl818x_iowrite8(priv, &priv->map->BSSID[i], conf->bssid[i]);
-
-        if (is_valid_ether_addr(conf->bssid)) {
-                reg = RTL818X_MSR_INFRA;
-                if (priv->is_rtl8187b)
-                        reg |= RTL818X_MSR_ENEDCA;
-                rtl818x_iowrite8(priv, &priv->map->MSR, reg);
-        } else {
-                reg = RTL818X_MSR_NO_LINK;
-                rtl818x_iowrite8(priv, &priv->map->MSR, reg);
-        }
-
-        mutex_unlock(&priv->conf_mutex);
-        return 0;
-}
-
 /*
  * With 8187B, AC_*_PARAM clashes with FEMR definition in struct rtl818x_csr for
  * example. Thus we have to use raw values for AC_*_PARAM register addresses.
@@ -1193,6 +1167,27 @@ static void rtl8187_bss_info_changed(struct ieee80211_hw *dev,
                                      u32 changed)
 {
         struct rtl8187_priv *priv = dev->priv;
+        int i;
+        u8 reg;
+
+        if (changed & BSS_CHANGED_BSSID) {
+                mutex_lock(&priv->conf_mutex);
+                for (i = 0; i < ETH_ALEN; i++)
+                        rtl818x_iowrite8(priv, &priv->map->BSSID[i],
+                                         info->bssid[i]);
+
+                if (is_valid_ether_addr(info->bssid)) {
+                        reg = RTL818X_MSR_INFRA;
+                        if (priv->is_rtl8187b)
+                                reg |= RTL818X_MSR_ENEDCA;
+                        rtl818x_iowrite8(priv, &priv->map->MSR, reg);
+                } else {
+                        reg = RTL818X_MSR_NO_LINK;
+                        rtl818x_iowrite8(priv, &priv->map->MSR, reg);
+                }
+
+                mutex_unlock(&priv->conf_mutex);
+        }
 
         if (changed & (BSS_CHANGED_ERP_SLOT | BSS_CHANGED_ERP_PREAMBLE))
                 rtl8187_conf_erp(priv, info->use_short_slot,
@@ -1274,7 +1269,6 @@ static const struct ieee80211_ops rtl8187_ops = {
         .add_interface          = rtl8187_add_interface,
         .remove_interface       = rtl8187_remove_interface,
         .config                 = rtl8187_config,
-        .config_interface       = rtl8187_config_interface,
         .bss_info_changed       = rtl8187_bss_info_changed,
         .configure_filter       = rtl8187_configure_filter,
         .conf_tx                = rtl8187_conf_tx
diff --git a/drivers/net/wireless/wl12xx/Kconfig b/drivers/net/wireless/wl12xx/Kconfig
new file mode 100644
index 000000000000..20a9633569f2
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/Kconfig
@@ -0,0 +1,11 @@
+config WL12XX
+        tristate "TI wl1251/wl1271 support"
+        depends on MAC80211 && WLAN_80211 && SPI_MASTER && EXPERIMENTAL
+        select FW_LOADER
+        select CRC7
+        ---help---
+          This module adds support for wireless adapters based on
+          TI wl1251/wl1271 chipsets.
+
+          If you choose to build a module, it'll be called wl12xx. Say N if
+          unsure.
diff --git a/drivers/net/wireless/wl12xx/Makefile b/drivers/net/wireless/wl12xx/Makefile
new file mode 100644
index 000000000000..d43de27dc54c
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/Makefile
@@ -0,0 +1,4 @@
+wl12xx-objs             = main.o spi.o event.o tx.o rx.o \
+                          ps.o cmd.o acx.o boot.o init.o wl1251.o \
+                          debugfs.o
+obj-$(CONFIG_WL12XX)    += wl12xx.o
diff --git a/drivers/net/wireless/wl12xx/acx.c b/drivers/net/wireless/wl12xx/acx.c
new file mode 100644
index 000000000000..1cfd458ad5ab
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/acx.c
@@ -0,0 +1,689 @@
+#include "acx.h"
+
+#include <linux/module.h>
+#include <linux/crc7.h>
+#include <linux/spi/spi.h>
+
+#include "wl12xx.h"
+#include "wl12xx_80211.h"
+#include "reg.h"
+#include "spi.h"
+#include "ps.h"
+
+int wl12xx_acx_frame_rates(struct wl12xx *wl, u8 ctrl_rate, u8 ctrl_mod,
+                           u8 mgt_rate, u8 mgt_mod)
+{
+        int ret;
+        struct acx_fw_gen_frame_rates rates;
+
+        wl12xx_debug(DEBUG_ACX, "acx frame rates");
+
+        rates.header.id = ACX_FW_GEN_FRAME_RATES;
+        rates.header.len = sizeof(struct acx_fw_gen_frame_rates) -
+                sizeof(struct acx_header);
+
+        rates.tx_ctrl_frame_rate = ctrl_rate;
+        rates.tx_ctrl_frame_mod = ctrl_mod;
+        rates.tx_mgt_frame_rate = mgt_rate;
+        rates.tx_mgt_frame_mod = mgt_mod;
+
+        ret = wl12xx_cmd_configure(wl, &rates, sizeof(rates));
+        if (ret < 0) {
+                wl12xx_error("Failed to set FW rates and modulation");
+                return ret;
+        }
+
+        return 0;
+}
+
+
+int wl12xx_acx_station_id(struct wl12xx *wl)
+{
+        int ret, i;
+        struct dot11_station_id mac;
+
+        wl12xx_debug(DEBUG_ACX, "acx dot11_station_id");
+
+        mac.header.id = DOT11_STATION_ID;
+        mac.header.len = sizeof(mac) - sizeof(struct acx_header);
+
+        for (i = 0; i < ETH_ALEN; i++)
+                mac.mac[i] = wl->mac_addr[ETH_ALEN - 1 - i];
+
+        ret = wl12xx_cmd_configure(wl, &mac, sizeof(mac));
+        if (ret < 0)
+                return ret;
+
+        return 0;
+}
+
+int wl12xx_acx_default_key(struct wl12xx *wl, u8 key_id)
+{
+        struct acx_dot11_default_key default_key;
+        int ret;
+
+        wl12xx_debug(DEBUG_ACX, "acx dot11_default_key (%d)", key_id);
+
+        default_key.header.id = DOT11_DEFAULT_KEY;
+        default_key.header.len = sizeof(default_key) -
+                sizeof(struct acx_header);
+
+        default_key.id = key_id;
+
+        ret = wl12xx_cmd_configure(wl, &default_key, sizeof(default_key));
+        if (ret < 0) {
+                wl12xx_error("Couldnt set default key");
+                return ret;
+        }
+
+        wl->default_key = key_id;
+
+        return 0;
+}
+
+int wl12xx_acx_wake_up_conditions(struct wl12xx *wl, u8 listen_interval)
+{
+        struct acx_wake_up_condition wake_up;
+
+        wl12xx_debug(DEBUG_ACX, "acx wake up conditions");
+
+        wake_up.header.id = ACX_WAKE_UP_CONDITIONS;
+        wake_up.header.len = sizeof(wake_up) - sizeof(struct acx_header);
+
+        wake_up.wake_up_event = WAKE_UP_EVENT_DTIM_BITMAP;
+        wake_up.listen_interval = listen_interval;
+
+        return wl12xx_cmd_configure(wl, &wake_up, sizeof(wake_up));
+}
+
+int wl12xx_acx_sleep_auth(struct wl12xx *wl, u8 sleep_auth)
+{
+        int ret;
+        struct acx_sleep_auth auth;
+
+        wl12xx_debug(DEBUG_ACX, "acx sleep auth");
+
+        auth.header.id = ACX_SLEEP_AUTH;
+        auth.header.len = sizeof(auth) - sizeof(struct acx_header);
+
+        auth.sleep_auth = sleep_auth;
+
+        ret = wl12xx_cmd_configure(wl, &auth, sizeof(auth));
+        if (ret < 0)
+                return ret;
+
+        return 0;
+}
+
+int wl12xx_acx_fw_version(struct wl12xx *wl, char *buf, size_t len)
+{
+        struct wl12xx_command cmd;
+        struct acx_revision *rev;
+        int ret;
+
+        wl12xx_debug(DEBUG_ACX, "acx fw rev");
+
+        memset(&cmd, 0, sizeof(cmd));
+
+        ret = wl12xx_cmd_interrogate(wl, ACX_FW_REV, sizeof(*rev), &cmd);
+        if (ret < 0) {
+                wl12xx_warning("ACX_FW_REV interrogate failed");
+                return ret;
+        }
+
+        rev = (struct acx_revision *) &cmd.parameters;
+
+        /* be careful with the buffer sizes */
+        strncpy(buf, rev->fw_version, min(len, sizeof(rev->fw_version)));
+
+        /*
+         * if the firmware version string is exactly
+         * sizeof(rev->fw_version) long or fw_len is less than
+         * sizeof(rev->fw_version) it won't be null terminated
+         */
+        buf[min(len, sizeof(rev->fw_version)) - 1] = '\0';
+
+        return 0;
+}
+
+int wl12xx_acx_tx_power(struct wl12xx *wl, int power)
+{
+        struct acx_current_tx_power ie;
+        int ret;
+
+        wl12xx_debug(DEBUG_ACX, "acx dot11_cur_tx_pwr");
+
+        if (power < 0 || power > 25)
+                return -EINVAL;
+
+        memset(&ie, 0, sizeof(ie));
+
+        ie.header.id = DOT11_CUR_TX_PWR;
+        ie.header.len = sizeof(ie) - sizeof(struct acx_header);
+        ie.current_tx_power = power * 10;
+
+        ret = wl12xx_cmd_configure(wl, &ie, sizeof(ie));
+        if (ret < 0) {
+                wl12xx_warning("configure of tx power failed: %d", ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+int wl12xx_acx_feature_cfg(struct wl12xx *wl)
+{
+        struct acx_feature_config feature;
+        int ret;
+
+        wl12xx_debug(DEBUG_ACX, "acx feature cfg");
+
+        memset(&feature, 0, sizeof(feature));
+
+        feature.header.id = ACX_FEATURE_CFG;
+        feature.header.len = sizeof(feature) - sizeof(struct acx_header);
+
+        /* DF_ENCRYPTION_DISABLE and DF_SNIFF_MODE_ENABLE are disabled */
+        feature.data_flow_options = 0;
+        feature.options = 0;
+
+        ret = wl12xx_cmd_configure(wl, &feature, sizeof(feature));
+        if (ret < 0)
+                wl12xx_error("Couldnt set HW encryption");
+
+        return ret;
+}
+
+int wl12xx_acx_mem_map(struct wl12xx *wl, void *mem_map, size_t len)
+{
+        struct wl12xx_command cmd;
+        int ret;
+
+        wl12xx_debug(DEBUG_ACX, "acx mem map");
+
+        ret = wl12xx_cmd_interrogate(wl, ACX_MEM_MAP, len, &cmd);
+        if (ret < 0)
+                return ret;
+        else if (cmd.status != CMD_STATUS_SUCCESS)
+                return -EIO;
+
+        memcpy(mem_map, &cmd.parameters, len);
+
+        return 0;
+}
+
+int wl12xx_acx_data_path_params(struct wl12xx *wl,
+                                struct acx_data_path_params_resp *data_path)
+{
+        struct acx_data_path_params params;
+        struct wl12xx_command cmd;
+        int ret;
+
+        wl12xx_debug(DEBUG_ACX, "acx data path params");
+
+        params.rx_packet_ring_chunk_size = DP_RX_PACKET_RING_CHUNK_SIZE;
+        params.tx_packet_ring_chunk_size = DP_TX_PACKET_RING_CHUNK_SIZE;
+
+        params.rx_packet_ring_chunk_num = DP_RX_PACKET_RING_CHUNK_NUM;
+        params.tx_packet_ring_chunk_num = DP_TX_PACKET_RING_CHUNK_NUM;
+
+        params.tx_complete_threshold = 1;
+
+        params.tx_complete_ring_depth = FW_TX_CMPLT_BLOCK_SIZE;
+
+        params.tx_complete_timeout = DP_TX_COMPLETE_TIME_OUT;
+
+        params.header.id = ACX_DATA_PATH_PARAMS;
+        params.header.len = sizeof(params) - sizeof(struct acx_header);
+
+        ret = wl12xx_cmd_configure(wl, &params, sizeof(params));
+        if (ret < 0)
+                return ret;
+
+
+        ret = wl12xx_cmd_interrogate(wl, ACX_DATA_PATH_PARAMS,
+                                     sizeof(struct acx_data_path_params_resp),
+                                     &cmd);
+
+        if (ret < 0) {
+                wl12xx_warning("failed to read data path parameters: %d", ret);
+                return ret;
+        } else if (cmd.status != CMD_STATUS_SUCCESS) {
+                wl12xx_warning("data path parameter acx status failed");
+                return -EIO;
+        }
+
+        memcpy(data_path, &cmd.parameters, sizeof(*data_path));
+
+        return 0;
+}
+
+int wl12xx_acx_rx_msdu_life_time(struct wl12xx *wl, u32 life_time)
+{
+        struct rx_msdu_lifetime msdu_lifetime;
+        int ret;
+
+        wl12xx_debug(DEBUG_ACX, "acx rx msdu life time");
+
+        msdu_lifetime.header.id = DOT11_RX_MSDU_LIFE_TIME;
+        msdu_lifetime.header.len = sizeof(msdu_lifetime) -
+                sizeof(struct acx_header);
+        msdu_lifetime.lifetime = life_time;
+
+        ret = wl12xx_cmd_configure(wl, &msdu_lifetime, sizeof(msdu_lifetime));
+        if (ret < 0) {
+                wl12xx_warning("failed to set rx msdu life time: %d", ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+int wl12xx_acx_rx_config(struct wl12xx *wl, u32 config, u32 filter)
+{
+        struct acx_rx_config rx_config;
+        int ret;
+
+        wl12xx_debug(DEBUG_ACX, "acx rx config");
+
+        rx_config.header.id = ACX_RX_CFG;
+        rx_config.header.len = sizeof(rx_config) - sizeof(struct acx_header);
+        rx_config.config_options = config;
+        rx_config.filter_options = filter;
+
+        ret = wl12xx_cmd_configure(wl, &rx_config, sizeof(rx_config));
+        if (ret < 0) {
+                wl12xx_warning("failed to set rx config: %d", ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+int wl12xx_acx_pd_threshold(struct wl12xx *wl)
+{
+        struct acx_packet_detection packet_detection;
+        int ret;
+
+        wl12xx_debug(DEBUG_ACX, "acx data pd threshold");
+
+        /* FIXME: threshold value not set */
+        packet_detection.header.id = ACX_PD_THRESHOLD;
+        packet_detection.header.len = sizeof(packet_detection) -
+                sizeof(struct acx_header);
+
+        ret = wl12xx_cmd_configure(wl, &packet_detection,
+                                   sizeof(packet_detection));
+        if (ret < 0) {
+                wl12xx_warning("failed to set pd threshold: %d", ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+int wl12xx_acx_slot(struct wl12xx *wl, enum acx_slot_type slot_time)
+{
+        struct acx_slot slot;
+        int ret;
+
+        wl12xx_debug(DEBUG_ACX, "acx slot");
+
+        slot.header.id = ACX_SLOT;
+        slot.header.len = sizeof(slot) - sizeof(struct acx_header);
+
+        slot.wone_index = STATION_WONE_INDEX;
+        slot.slot_time = slot_time;
+
+        ret = wl12xx_cmd_configure(wl, &slot, sizeof(slot));
+        if (ret < 0) {
+                wl12xx_warning("failed to set slot time: %d", ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+int wl12xx_acx_group_address_tbl(struct wl12xx *wl)
+{
+        struct multicast_grp_addr_start multicast;
+        int ret;
+
+        wl12xx_debug(DEBUG_ACX, "acx group address tbl");
+
+        /* MAC filtering */
+        multicast.header.id = DOT11_GROUP_ADDRESS_TBL;
+        multicast.header.len = sizeof(multicast) - sizeof(struct acx_header);
+
+        multicast.enabled = 0;
+        multicast.num_groups = 0;
+        memset(multicast.mac_table, 0, ADDRESS_GROUP_MAX_LEN);
+
+        ret = wl12xx_cmd_configure(wl, &multicast, sizeof(multicast));
+        if (ret < 0) {
+                wl12xx_warning("failed to set group addr table: %d", ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+int wl12xx_acx_service_period_timeout(struct wl12xx *wl)
+{
+        struct acx_rx_timeout rx_timeout;
+        int ret;
+
+        wl12xx_debug(DEBUG_ACX, "acx service period timeout");
+
+        /* RX timeout */
+        rx_timeout.header.id = ACX_SERVICE_PERIOD_TIMEOUT;
+        rx_timeout.header.len = sizeof(rx_timeout) - sizeof(struct acx_header);
+
+        rx_timeout.ps_poll_timeout = RX_TIMEOUT_PS_POLL_DEF;
+        rx_timeout.upsd_timeout = RX_TIMEOUT_UPSD_DEF;
+
+        ret = wl12xx_cmd_configure(wl, &rx_timeout, sizeof(rx_timeout));
+        if (ret < 0) {
+                wl12xx_warning("failed to set service period timeout: %d",
+                               ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+int wl12xx_acx_rts_threshold(struct wl12xx *wl, u16 rts_threshold)
+{
+        struct acx_rts_threshold rts;
+        int ret;
+
+        wl12xx_debug(DEBUG_ACX, "acx rts threshold");
+
+        rts.header.id = DOT11_RTS_THRESHOLD;
+        rts.header.len = sizeof(rts) - sizeof(struct acx_header);
+
+        rts.threshold = rts_threshold;
+
+        ret = wl12xx_cmd_configure(wl, &rts, sizeof(rts));
+        if (ret < 0) {
+                wl12xx_warning("failed to set rts threshold: %d", ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+int wl12xx_acx_beacon_filter_opt(struct wl12xx *wl)
+{
+        struct acx_beacon_filter_option beacon_filter;
+        int ret;
+
+        wl12xx_debug(DEBUG_ACX, "acx beacon filter opt");
+
+        beacon_filter.header.id = ACX_BEACON_FILTER_OPT;
+        beacon_filter.header.len = sizeof(beacon_filter) -
+                sizeof(struct acx_header);
+
+        beacon_filter.enable = 0;
+        beacon_filter.max_num_beacons = 0;
+
+        ret = wl12xx_cmd_configure(wl, &beacon_filter, sizeof(beacon_filter));
+        if (ret < 0) {
+                wl12xx_warning("failed to set beacon filter opt: %d", ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+int wl12xx_acx_beacon_filter_table(struct wl12xx *wl)
+{
+        struct acx_beacon_filter_ie_table ie_table;
+        int ret;
+
+        wl12xx_debug(DEBUG_ACX, "acx beacon filter table");
+
+        ie_table.header.id = ACX_BEACON_FILTER_TABLE;
+        ie_table.header.len = sizeof(ie_table) - sizeof(struct acx_header);
+
+        ie_table.num_ie = 0;
+        memset(ie_table.table, 0, BEACON_FILTER_TABLE_MAX_SIZE);
+
+        ret = wl12xx_cmd_configure(wl, &ie_table, sizeof(ie_table));
+        if (ret < 0) {
+                wl12xx_warning("failed to set beacon filter table: %d", ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+int wl12xx_acx_sg_enable(struct wl12xx *wl)
+{
+        struct acx_bt_wlan_coex pta;
+        int ret;
+
+        wl12xx_debug(DEBUG_ACX, "acx sg enable");
+
+        pta.header.id = ACX_SG_ENABLE;
+        pta.header.len = sizeof(pta) - sizeof(struct acx_header);
+
+        pta.enable = SG_ENABLE;
+
+        ret = wl12xx_cmd_configure(wl, &pta, sizeof(pta));
+        if (ret < 0) {
+                wl12xx_warning("failed to set softgemini enable: %d", ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+int wl12xx_acx_sg_cfg(struct wl12xx *wl)
+{
+        struct acx_bt_wlan_coex_param param;
+        int ret;
+
+        wl12xx_debug(DEBUG_ACX, "acx sg cfg");
+
+        /* BT-WLAN coext parameters */
+        param.header.id = ACX_SG_CFG;
+        param.header.len = sizeof(param) - sizeof(struct acx_header);
+
+        param.min_rate = RATE_INDEX_24MBPS;
+        param.bt_hp_max_time = PTA_BT_HP_MAXTIME_DEF;
+        param.wlan_hp_max_time = PTA_WLAN_HP_MAX_TIME_DEF;
+        param.sense_disable_timer = PTA_SENSE_DISABLE_TIMER_DEF;
+        param.rx_time_bt_hp = PTA_PROTECTIVE_RX_TIME_DEF;
+        param.tx_time_bt_hp = PTA_PROTECTIVE_TX_TIME_DEF;
+        param.rx_time_bt_hp_fast = PTA_PROTECTIVE_RX_TIME_FAST_DEF;
+        param.tx_time_bt_hp_fast = PTA_PROTECTIVE_TX_TIME_FAST_DEF;
+        param.wlan_cycle_fast = PTA_CYCLE_TIME_FAST_DEF;
+        param.bt_anti_starvation_period = PTA_ANTI_STARVE_PERIOD_DEF;
+        param.next_bt_lp_packet = PTA_TIMEOUT_NEXT_BT_LP_PACKET_DEF;
+        param.wake_up_beacon = PTA_TIME_BEFORE_BEACON_DEF;
+        param.hp_dm_max_guard_time = PTA_HPDM_MAX_TIME_DEF;
+        param.next_wlan_packet = PTA_TIME_OUT_NEXT_WLAN_DEF;
+        param.antenna_type = PTA_ANTENNA_TYPE_DEF;
+        param.signal_type = PTA_SIGNALING_TYPE_DEF;
+        param.afh_leverage_on = PTA_AFH_LEVERAGE_ON_DEF;
+        param.quiet_cycle_num = PTA_NUMBER_QUIET_CYCLE_DEF;
+        param.max_cts = PTA_MAX_NUM_CTS_DEF;
+        param.wlan_packets_num = PTA_NUMBER_OF_WLAN_PACKETS_DEF;
+        param.bt_packets_num = PTA_NUMBER_OF_BT_PACKETS_DEF;
+        param.missed_rx_avalanche = PTA_RX_FOR_AVALANCHE_DEF;
+        param.wlan_elp_hp = PTA_ELP_HP_DEF;
+        param.bt_anti_starvation_cycles = PTA_ANTI_STARVE_NUM_CYCLE_DEF;
+        param.ack_mode_dual_ant = PTA_ACK_MODE_DEF;
+        param.pa_sd_enable = PTA_ALLOW_PA_SD_DEF;
+        param.pta_auto_mode_enable = PTA_AUTO_MODE_NO_CTS_DEF;
+        param.bt_hp_respected_num = PTA_BT_HP_RESPECTED_DEF;
+
+        ret = wl12xx_cmd_configure(wl, &param, sizeof(param));
+        if (ret < 0) {
+                wl12xx_warning("failed to set sg config: %d", ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+int wl12xx_acx_cca_threshold(struct wl12xx *wl)
+{
+        struct acx_energy_detection detection;
+        int ret;
+
+        wl12xx_debug(DEBUG_ACX, "acx cca threshold");
+
+        detection.header.id = ACX_CCA_THRESHOLD;
+        detection.header.len = sizeof(detection) - sizeof(struct acx_header);
+
+        detection.rx_cca_threshold = CCA_THRSH_DISABLE_ENERGY_D;
+        detection.tx_energy_detection = 0;
+
+        ret = wl12xx_cmd_configure(wl, &detection, sizeof(detection));
+        if (ret < 0) {
+                wl12xx_warning("failed to set cca threshold: %d", ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+int wl12xx_acx_bcn_dtim_options(struct wl12xx *wl)
+{
+        struct acx_beacon_broadcast bb;
+        int ret;
+
+        wl12xx_debug(DEBUG_ACX, "acx bcn dtim options");
+
+        bb.header.id = ACX_BCN_DTIM_OPTIONS;
+        bb.header.len = sizeof(bb) - sizeof(struct acx_header);
+
+        bb.beacon_rx_timeout = BCN_RX_TIMEOUT_DEF_VALUE;
+        bb.broadcast_timeout = BROADCAST_RX_TIMEOUT_DEF_VALUE;
+        bb.rx_broadcast_in_ps = RX_BROADCAST_IN_PS_DEF_VALUE;
+        bb.ps_poll_threshold = CONSECUTIVE_PS_POLL_FAILURE_DEF;
+
+        ret = wl12xx_cmd_configure(wl, &bb, sizeof(bb));
+        if (ret < 0) {
+                wl12xx_warning("failed to set rx config: %d", ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+int wl12xx_acx_aid(struct wl12xx *wl, u16 aid)
+{
+        struct acx_aid acx_aid;
+        int ret;
+
+        wl12xx_debug(DEBUG_ACX, "acx aid");
+
+        acx_aid.header.id = ACX_AID;
+        acx_aid.header.len = sizeof(acx_aid) - sizeof(struct acx_header);
+
+        acx_aid.aid = aid;
+
+        ret = wl12xx_cmd_configure(wl, &acx_aid, sizeof(acx_aid));
+        if (ret < 0) {
+                wl12xx_warning("failed to set aid: %d", ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+int wl12xx_acx_event_mbox_mask(struct wl12xx *wl, u32 event_mask)
+{
+        struct acx_event_mask mask;
+        int ret;
+
+        wl12xx_debug(DEBUG_ACX, "acx event mbox mask");
+
+        mask.header.id = ACX_EVENT_MBOX_MASK;
+        mask.header.len = sizeof(mask) - sizeof(struct acx_header);
+
+        /* high event mask is unused */
+        mask.high_event_mask = 0xffffffff;
+
+        mask.event_mask = event_mask;
+
+        ret = wl12xx_cmd_configure(wl, &mask, sizeof(mask));
+        if (ret < 0) {
+                wl12xx_warning("failed to set aid: %d", ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+int wl12xx_acx_set_preamble(struct wl12xx *wl, enum acx_preamble_type preamble)
+{
+        struct acx_preamble ie;
+        int ret;
+
+        wl12xx_debug(DEBUG_ACX, "acx_set_preamble");
+
+        memset(&ie, 0, sizeof(ie));
+
+        ie.header.id = ACX_PREAMBLE_TYPE;
+        ie.header.len = sizeof(ie) - sizeof(struct acx_header);
+        ie.preamble = preamble;
+        ret = wl12xx_cmd_configure(wl, &ie, sizeof(ie));
+        if (ret < 0) {
+                wl12xx_warning("Setting of preamble failed: %d", ret);
+                return ret;
+        }
+        return 0;
+}
+
+int wl12xx_acx_cts_protect(struct wl12xx *wl,
+                           enum acx_ctsprotect_type ctsprotect)
+{
+        struct acx_ctsprotect ie;
+        int ret;
+
+        wl12xx_debug(DEBUG_ACX, "acx_set_ctsprotect");
+
+        memset(&ie, 0, sizeof(ie));
+
+        ie.header.id = ACX_CTS_PROTECTION;
+        ie.header.len = sizeof(ie) - sizeof(struct acx_header);
+        ie.ctsprotect = ctsprotect;
+        ret = wl12xx_cmd_configure(wl, &ie, sizeof(ie));
+        if (ret < 0) {
+                wl12xx_warning("Setting of ctsprotect failed: %d", ret);
+                return ret;
+        }
+        return 0;
+}
+
+int wl12xx_acx_statistics(struct wl12xx *wl, struct acx_statistics *stats)
+{
+        struct wl12xx_command *answer;
+        int ret;
+
+        wl12xx_debug(DEBUG_ACX, "acx statistics");
+
+        answer = kmalloc(sizeof(*answer), GFP_KERNEL);
+        if (!answer) {
+                wl12xx_warning("could not allocate memory for acx statistics");
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        ret = wl12xx_cmd_interrogate(wl, ACX_STATISTICS, sizeof(*answer),
+                                     answer);
+        if (ret < 0) {
+                wl12xx_warning("acx statistics failed: %d", ret);
+                goto out;
+        }
+
+        memcpy(stats, answer->parameters, sizeof(*stats));
+
+out:
+        kfree(answer);
+        return ret;
+}
diff --git a/drivers/net/wireless/wl12xx/acx.h b/drivers/net/wireless/wl12xx/acx.h
new file mode 100644
index 000000000000..fb2d2340993c
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/acx.h
@@ -0,0 +1,1245 @@
+/*
+ * This file is part of wl12xx
+ *
+ * Copyright (c) 1998-2007 Texas Instruments Incorporated
+ * Copyright (C) 2008 Nokia Corporation
+ *
+ * Contact: Kalle Valo <kalle.valo@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __WL12XX_ACX_H__
+#define __WL12XX_ACX_H__
+
+#include "wl12xx.h"
+
+/* Target's information element */
+struct acx_header {
+        u16 id;
+        u16 len;
+};
+
+struct acx_error_counter {
+        struct acx_header header;
+
+        /* The number of PLCP errors since the last time this */
+        /* information element was interrogated. This field is */
+        /* automatically cleared when it is interrogated.*/
+        u32 PLCP_error;
+
+        /* The number of FCS errors since the last time this */
+        /* information element was interrogated. This field is */
+        /* automatically cleared when it is interrogated.*/
+        u32 FCS_error;
+
+        /* The number of MPDUs without PLCP header errors received*/
+        /* since the last time this information element was interrogated. */
+        /* This field is automatically cleared when it is interrogated.*/
+        u32 valid_frame;
+
+        /* the number of missed sequence numbers in the squentially */
+        /* values of frames seq numbers */
+        u32 seq_num_miss;
+} __attribute__ ((packed));
+
+struct acx_revision {
+        struct acx_header header;
+
+        /*
+         * The WiLink firmware version, an ASCII string x.x.x.x,
+         * that uniquely identifies the current firmware.
+         * The left most digit is incremented each time a
+         * significant change is made to the firmware, such as
+         * code redesign or new platform support.
+         * The second digit is incremented when major enhancements
+         * are added or major fixes are made.
+         * The third digit is incremented for each GA release.
+         * The fourth digit is incremented for each build.
+         * The first two digits identify a firmware release version,
+         * in other words, a unique set of features.
+         * The first three digits identify a GA release.
+         */
+        char fw_version[20];
+
+        /*
+         * This 4 byte field specifies the WiLink hardware version.
+         * bits 0  - 15: Reserved.
+         * bits 16 - 23: Version ID - The WiLink version ID
+         *              (1 = first spin, 2 = second spin, and so on).
+         * bits 24 - 31: Chip ID - The WiLink chip ID.
+         */
+        u32 hw_version;
+} __attribute__ ((packed));
+
+enum wl12xx_psm_mode {
+        /* Active mode */
+        WL12XX_PSM_CAM = 0,
+
+        /* Power save mode */
+        WL12XX_PSM_PS = 1,
+
+        /* Extreme low power */
+        WL12XX_PSM_ELP = 2,
+};
+
+struct acx_sleep_auth {
+        struct acx_header header;
+
+        /* The sleep level authorization of the device. */
+        /* 0 - Always active*/
+        /* 1 - Power down mode: light / fast sleep*/
+        /* 2 - ELP mode: Deep / Max sleep*/
+        u8  sleep_auth;
+        u8  padding[3];
+} __attribute__ ((packed));
+
+#define TIM_ELE_ID    5
+#define PARTIAL_VBM_MAX    251
+
+struct tim {
+        u8 identity;
+        u8 length;
+        u8 dtim_count;
+        u8 dtim_period;
+        u8 bitmap_ctrl;
+        u8 pvb_field[PARTIAL_VBM_MAX]; /* Partial Virtual Bitmap */
+} __attribute__ ((packed));
+
+/* Virtual Bit Map update */
+struct vbm_update_request {
+        __le16 len;
+        u8  padding[2];
+        struct tim tim;
+} __attribute__ ((packed));
+
+enum {
+        HOSTIF_PCI_MASTER_HOST_INDIRECT,
+        HOSTIF_PCI_MASTER_HOST_DIRECT,
+        HOSTIF_SLAVE,
+        HOSTIF_PKT_RING,
+        HOSTIF_DONTCARE = 0xFF
+};
+
+#define DEFAULT_UCAST_PRIORITY          0
+#define DEFAULT_RX_Q_PRIORITY           0
+#define DEFAULT_NUM_STATIONS            1
+#define DEFAULT_RXQ_PRIORITY            0 /* low 0 .. 15 high  */
+#define DEFAULT_RXQ_TYPE                0x07    /* All frames, Data/Ctrl/Mgmt */
+#define TRACE_BUFFER_MAX_SIZE           256
+
+#define  DP_RX_PACKET_RING_CHUNK_SIZE 1600
+#define  DP_TX_PACKET_RING_CHUNK_SIZE 1600
+#define  DP_RX_PACKET_RING_CHUNK_NUM 2
+#define  DP_TX_PACKET_RING_CHUNK_NUM 2
+#define  DP_TX_COMPLETE_TIME_OUT 20
+#define  FW_TX_CMPLT_BLOCK_SIZE 16
+
+struct acx_data_path_params {
+        struct acx_header header;
+
+        u16 rx_packet_ring_chunk_size;
+        u16 tx_packet_ring_chunk_size;
+
+        u8 rx_packet_ring_chunk_num;
+        u8 tx_packet_ring_chunk_num;
+
+        /*
+         * Maximum number of packets that can be gathered
+         * in the TX complete ring before an interrupt
+         * is generated.
+         */
+        u8 tx_complete_threshold;
+
+        /* Number of pending TX complete entries in cyclic ring.*/
+        u8 tx_complete_ring_depth;
+
+        /*
+         * Max num microseconds since a packet enters the TX
+         * complete ring until an interrupt is generated.
+         */
+        u32 tx_complete_timeout;
+} __attribute__ ((packed));
+
+
+struct acx_data_path_params_resp {
+        struct acx_header header;
+
+        u16 rx_packet_ring_chunk_size;
+        u16 tx_packet_ring_chunk_size;
+
+        u8 rx_packet_ring_chunk_num;
+        u8 tx_packet_ring_chunk_num;
+
+        u8 pad[2];
+
+        u32 rx_packet_ring_addr;
+        u32 tx_packet_ring_addr;
+
+        u32 rx_control_addr;
+        u32 tx_control_addr;
+
+        u32 tx_complete_addr;
+} __attribute__ ((packed));
+
+#define TX_MSDU_LIFETIME_MIN       0
+#define TX_MSDU_LIFETIME_MAX       3000
+#define TX_MSDU_LIFETIME_DEF       512
+#define RX_MSDU_LIFETIME_MIN       0
+#define RX_MSDU_LIFETIME_MAX       0xFFFFFFFF
+#define RX_MSDU_LIFETIME_DEF       512000
+
+struct rx_msdu_lifetime {
+        struct acx_header header;
+
+        /*
+         * The maximum amount of time, in TU, before the
+         * firmware discards the MSDU.
+         */
+        u32 lifetime;
+} __attribute__ ((packed));
+
+/*
+ * RX Config Options Table
+ * Bit          Definition
+ * ===          ==========
+ * 31:14                Reserved
+ * 13           Copy RX Status - when set, write three receive status words
+ *              to top of rx'd MPDUs.
+ *              When cleared, do not write three status words (added rev 1.5)
+ * 12           Reserved
+ * 11           RX Complete upon FCS error - when set, give rx complete
+ *              interrupt for FCS errors, after the rx filtering, e.g. unicast
+ *              frames not to us with FCS error will not generate an interrupt.
+ * 10           SSID Filter Enable - When set, the WiLink discards all beacon,
+ *              probe request, and probe response frames with an SSID that does
+ *              not match the SSID specified by the host in the START/JOIN
+ *              command.
+ *              When clear, the WiLink receives frames with any SSID.
+ * 9            Broadcast Filter Enable - When set, the WiLink discards all
+ *              broadcast frames. When clear, the WiLink receives all received
+ *              broadcast frames.
+ * 8:6          Reserved
+ * 5            BSSID Filter Enable - When set, the WiLink discards any frames
+ *              with a BSSID that does not match the BSSID specified by the
+ *              host.
+ *              When clear, the WiLink receives frames from any BSSID.
+ * 4            MAC Addr Filter - When set, the WiLink discards any frames
+ *              with a destination address that does not match the MAC address
+ *              of the adaptor.
+ *              When clear, the WiLink receives frames destined to any MAC
+ *              address.
+ * 3            Promiscuous - When set, the WiLink receives all valid frames
+ *              (i.e., all frames that pass the FCS check).
+ *              When clear, only frames that pass the other filters specified
+ *              are received.
+ * 2            FCS - When set, the WiLink includes the FCS with the received
+ *              frame.
+ *              When cleared, the FCS is discarded.
+ * 1            PLCP header - When set, write all data from baseband to frame
+ *              buffer including PHY header.
+ * 0            Reserved - Always equal to 0.
+ *
+ * RX Filter Options Table
+ * Bit          Definition
+ * ===          ==========
+ * 31:12                Reserved - Always equal to 0.
+ * 11           Association - When set, the WiLink receives all association
+ *              related frames (association request/response, reassocation
+ *              request/response, and disassociation). When clear, these frames
+ *              are discarded.
+ * 10           Auth/De auth - When set, the WiLink receives all authentication
+ *              and de-authentication frames. When clear, these frames are
+ *              discarded.
+ * 9            Beacon - When set, the WiLink receives all beacon frames.
+ *              When clear, these frames are discarded.
+ * 8            Contention Free - When set, the WiLink receives all contention
+ *              free frames.
+ *              When clear, these frames are discarded.
+ * 7            Control - When set, the WiLink receives all control frames.
+ *              When clear, these frames are discarded.
+ * 6            Data - When set, the WiLink receives all data frames.
+ *              When clear, these frames are discarded.
+ * 5            FCS Error - When set, the WiLink receives frames that have FCS
+ *              errors.
+ *              When clear, these frames are discarded.
+ * 4            Management - When set, the WiLink receives all management
+ *              frames.
+ *              When clear, these frames are discarded.
+ * 3            Probe Request - When set, the WiLink receives all probe request
+ *              frames.
+ *              When clear, these frames are discarded.
+ * 2            Probe Response - When set, the WiLink receives all probe
+ *              response frames.
+ *              When clear, these frames are discarded.
+ * 1            RTS/CTS/ACK - When set, the WiLink receives all RTS, CTS and ACK
+ *              frames.
+ *              When clear, these frames are discarded.
+ * 0            Rsvd Type/Sub Type - When set, the WiLink receives all frames
+ *              that have reserved frame types and sub types as defined by the
+ *              802.11 specification.
+ *              When clear, these frames are discarded.
+ */
+struct acx_rx_config {
+        struct acx_header header;
+
+        u32 config_options;
+        u32 filter_options;
+} __attribute__ ((packed));
+
+enum {
+        QOS_AC_BE = 0,
+        QOS_AC_BK,
+        QOS_AC_VI,
+        QOS_AC_VO,
+        QOS_HIGHEST_AC_INDEX = QOS_AC_VO,
+};
+
+#define MAX_NUM_OF_AC             (QOS_HIGHEST_AC_INDEX+1)
+#define FIRST_AC_INDEX            QOS_AC_BE
+#define MAX_NUM_OF_802_1d_TAGS    8
+#define AC_PARAMS_MAX_TSID        15
+#define MAX_APSD_CONF             0xffff
+
+#define  QOS_TX_HIGH_MIN      (0)
+#define  QOS_TX_HIGH_MAX      (100)
+
+#define  QOS_TX_HIGH_BK_DEF   (25)
+#define  QOS_TX_HIGH_BE_DEF   (35)
+#define  QOS_TX_HIGH_VI_DEF   (35)
+#define  QOS_TX_HIGH_VO_DEF   (35)
+
+#define  QOS_TX_LOW_BK_DEF    (15)
+#define  QOS_TX_LOW_BE_DEF    (25)
+#define  QOS_TX_LOW_VI_DEF    (25)
+#define  QOS_TX_LOW_VO_DEF    (25)
+
+struct acx_tx_queue_qos_config {
+        struct acx_header header;
+
+        u8 qid;
+        u8 pad[3];
+
+        /* Max number of blocks allowd in the queue */
+        u16 high_threshold;
+
+        /* Lowest memory blocks guaranteed for this queue */
+        u16 low_threshold;
+} __attribute__ ((packed));
+
+struct acx_packet_detection {
+        struct acx_header header;
+
+        u32 threshold;
+} __attribute__ ((packed));
+
+
+enum acx_slot_type {
+        SLOT_TIME_LONG = 0,
+        SLOT_TIME_SHORT = 1,
+        DEFAULT_SLOT_TIME = SLOT_TIME_SHORT,
+        MAX_SLOT_TIMES = 0xFF
+};
+
+#define STATION_WONE_INDEX 0
+
+struct acx_slot {
+        struct acx_header header;
+
+        u8 wone_index; /* Reserved */
+        u8 slot_time;
+        u8 reserved[6];
+} __attribute__ ((packed));
+
+
+#define ADDRESS_GROUP_MAX       (8)
+#define ADDRESS_GROUP_MAX_LEN   (ETH_ALEN * ADDRESS_GROUP_MAX)
+
+struct multicast_grp_addr_start {
+        struct acx_header header;
+
+        u8 enabled;
+        u8 num_groups;
+        u8 pad[2];
+        u8 mac_table[ADDRESS_GROUP_MAX_LEN];
+} __attribute__ ((packed));
+
+
+#define  RX_TIMEOUT_PS_POLL_MIN    0
+#define  RX_TIMEOUT_PS_POLL_MAX    (200000)
+#define  RX_TIMEOUT_PS_POLL_DEF    (15)
+#define  RX_TIMEOUT_UPSD_MIN       0
+#define  RX_TIMEOUT_UPSD_MAX       (200000)
+#define  RX_TIMEOUT_UPSD_DEF       (15)
+
+struct acx_rx_timeout {
+        struct acx_header header;
+
+        /*
+         * The longest time the STA will wait to receive
+         * traffic from the AP after a PS-poll has been
+         * transmitted.
+         */
+        u16 ps_poll_timeout;
+
+        /*
+         * The longest time the STA will wait to receive
+         * traffic from the AP after a frame has been sent
+         * from an UPSD enabled queue.
+         */
+        u16 upsd_timeout;
+} __attribute__ ((packed));
+
+#define RTS_THRESHOLD_MIN              0
+#define RTS_THRESHOLD_MAX              4096
+#define RTS_THRESHOLD_DEF              2347
+
+struct acx_rts_threshold {
+        struct acx_header header;
+
+        u16 threshold;
+        u8 pad[2];
+} __attribute__ ((packed));
+
+struct acx_beacon_filter_option {
+        struct acx_header header;
+
+        u8 enable;
+
+        /*
+         * The number of beacons without the unicast TIM
+         * bit set that the firmware buffers before
+         * signaling the host about ready frames.
+         * When set to 0 and the filter is enabled, beacons
+         * without the unicast TIM bit set are dropped.
+         */
+        u8 max_num_beacons;
+        u8 pad[2];
+} __attribute__ ((packed));
+
+/*
+ * ACXBeaconFilterEntry (not 221)
+ * Byte Offset     Size (Bytes)    Definition
+ * ===========     ============    ==========
+ * 0                            1               IE identifier
+ * 1               1               Treatment bit mask
+ *
+ * ACXBeaconFilterEntry (221)
+ * Byte Offset     Size (Bytes)    Definition
+ * ===========     ============    ==========
+ * 0               1               IE identifier
+ * 1               1               Treatment bit mask
+ * 2               3               OUI
+ * 5               1               Type
+ * 6               2               Version
+ *
+ *
+ * Treatment bit mask - The information element handling:
+ * bit 0 - The information element is compared and transferred
+ * in case of change.
+ * bit 1 - The information element is transferred to the host
+ * with each appearance or disappearance.
+ * Note that both bits can be set at the same time.
+ */
+#define BEACON_FILTER_TABLE_MAX_IE_NUM                 (32)
+#define BEACON_FILTER_TABLE_MAX_VENDOR_SPECIFIC_IE_NUM (6)
+#define BEACON_FILTER_TABLE_IE_ENTRY_SIZE              (2)
+#define BEACON_FILTER_TABLE_EXTRA_VENDOR_SPECIFIC_IE_SIZE (6)
+#define BEACON_FILTER_TABLE_MAX_SIZE ((BEACON_FILTER_TABLE_MAX_IE_NUM * \
+                            BEACON_FILTER_TABLE_IE_ENTRY_SIZE) + \
+                           (BEACON_FILTER_TABLE_MAX_VENDOR_SPECIFIC_IE_NUM * \
+                            BEACON_FILTER_TABLE_EXTRA_VENDOR_SPECIFIC_IE_SIZE))
+
+struct acx_beacon_filter_ie_table {
+        struct acx_header header;
+
+        u8 num_ie;
+        u8 table[BEACON_FILTER_TABLE_MAX_SIZE];
+        u8 pad[3];
+} __attribute__ ((packed));
+
+enum {
+        SG_ENABLE = 0,
+        SG_DISABLE,
+        SG_SENSE_NO_ACTIVITY,
+        SG_SENSE_ACTIVE
+};
+
+struct acx_bt_wlan_coex {
+        struct acx_header header;
+
+        /*
+         * 0 -> PTA enabled
+         * 1 -> PTA disabled
+         * 2 -> sense no active mode, i.e.
+         *      an interrupt is sent upon
+         *      BT activity.
+         * 3 -> PTA is switched on in response
+         *      to the interrupt sending.
+         */
+        u8 enable;
+        u8 pad[3];
+} __attribute__ ((packed));
+
+#define PTA_ANTENNA_TYPE_DEF              (0)
+#define PTA_BT_HP_MAXTIME_DEF             (2000)
+#define PTA_WLAN_HP_MAX_TIME_DEF          (5000)
+#define PTA_SENSE_DISABLE_TIMER_DEF       (1350)
+#define PTA_PROTECTIVE_RX_TIME_DEF        (1500)
+#define PTA_PROTECTIVE_TX_TIME_DEF        (1500)
+#define PTA_TIMEOUT_NEXT_BT_LP_PACKET_DEF (3000)
+#define PTA_SIGNALING_TYPE_DEF            (1)
+#define PTA_AFH_LEVERAGE_ON_DEF           (0)
+#define PTA_NUMBER_QUIET_CYCLE_DEF        (0)
+#define PTA_MAX_NUM_CTS_DEF               (3)
+#define PTA_NUMBER_OF_WLAN_PACKETS_DEF    (2)
+#define PTA_NUMBER_OF_BT_PACKETS_DEF      (2)
+#define PTA_PROTECTIVE_RX_TIME_FAST_DEF   (1500)
+#define PTA_PROTECTIVE_TX_TIME_FAST_DEF   (3000)
+#define PTA_CYCLE_TIME_FAST_DEF           (8700)
+#define PTA_RX_FOR_AVALANCHE_DEF          (5)
+#define PTA_ELP_HP_DEF                    (0)
+#define PTA_ANTI_STARVE_PERIOD_DEF        (500)
+#define PTA_ANTI_STARVE_NUM_CYCLE_DEF     (4)
+#define PTA_ALLOW_PA_SD_DEF               (1)
+#define PTA_TIME_BEFORE_BEACON_DEF        (6300)
+#define PTA_HPDM_MAX_TIME_DEF             (1600)
+#define PTA_TIME_OUT_NEXT_WLAN_DEF        (2550)
+#define PTA_AUTO_MODE_NO_CTS_DEF          (0)
+#define PTA_BT_HP_RESPECTED_DEF           (3)
+#define PTA_WLAN_RX_MIN_RATE_DEF          (24)
+#define PTA_ACK_MODE_DEF                  (1)
+
+struct acx_bt_wlan_coex_param {
+        struct acx_header header;
+
+        /*
+         * The minimum rate of a received WLAN packet in the STA,
+         * during protective mode, of which a new BT-HP request
+         * during this Rx will always be respected and gain the antenna.
+         */
+        u32 min_rate;
+
+        /* Max time the BT HP will be respected. */
+        u16 bt_hp_max_time;
+
+        /* Max time the WLAN HP will be respected. */
+        u16 wlan_hp_max_time;
+
+        /*
+         * The time between the last BT activity
+         * and the moment when the sense mode returns
+         * to SENSE_INACTIVE.
+         */
+        u16 sense_disable_timer;
+
+        /* Time before the next BT HP instance */
+        u16 rx_time_bt_hp;
+        u16 tx_time_bt_hp;
+
+        /* range: 10-20000    default: 1500 */
+        u16 rx_time_bt_hp_fast;
+        u16 tx_time_bt_hp_fast;
+
+        /* range: 2000-65535  default: 8700 */
+        u16 wlan_cycle_fast;
+
+        /* range: 0 - 15000 (Msec) default: 1000 */
+        u16 bt_anti_starvation_period;
+
+        /* range 400-10000(Usec) default: 3000 */
+        u16 next_bt_lp_packet;
+
+        /* Deafult: worst case for BT DH5 traffic */
+        u16 wake_up_beacon;
+
+        /* range: 0-50000(Usec) default: 1050 */
+        u16 hp_dm_max_guard_time;
+
+        /*
+         * This is to prevent both BT & WLAN antenna
+         * starvation.
+         * Range: 100-50000(Usec) default:2550
+         */
+        u16 next_wlan_packet;
+
+        /* 0 -> shared antenna */
+        u8 antenna_type;
+
+        /*
+         * 0 -> TI legacy
+         * 1 -> Palau
+         */
+        u8 signal_type;
+
+        /*
+         * BT AFH status
+         * 0 -> no AFH
+         * 1 -> from dedicated GPIO
+         * 2 -> AFH on (from host)
+         */
+        u8 afh_leverage_on;
+
+        /*
+         * The number of cycles during which no
+         * TX will be sent after 1 cycle of RX
+         * transaction in protective mode
+         */
+        u8 quiet_cycle_num;
+
+        /*
+         * The maximum number of CTSs that will
+         * be sent for receiving RX packet in
+         * protective mode
+         */
+        u8 max_cts;
+
+        /*
+         * The number of WLAN packets
+         * transferred in common mode before
+         * switching to BT.
+         */
+        u8 wlan_packets_num;
+
+        /*
+         * The number of BT packets
+         * transferred in common mode before
+         * switching to WLAN.
+         */
+        u8 bt_packets_num;
+
+        /* range: 1-255  default: 5 */
+        u8 missed_rx_avalanche;
+
+        /* range: 0-1    default: 1 */
+        u8 wlan_elp_hp;
+
+        /* range: 0 - 15  default: 4 */
+        u8 bt_anti_starvation_cycles;
+
+        u8 ack_mode_dual_ant;
+
+        /*
+         * Allow PA_SD assertion/de-assertion
+         * during enabled BT activity.
+         */
+        u8 pa_sd_enable;
+
+        /*
+         * Enable/Disable PTA in auto mode:
+         * Support Both Active & P.S modes
+         */
+        u8 pta_auto_mode_enable;
+
+        /* range: 0 - 20  default: 1 */
+        u8 bt_hp_respected_num;
+} __attribute__ ((packed));
+
+#define CCA_THRSH_ENABLE_ENERGY_D       0x140A
+#define CCA_THRSH_DISABLE_ENERGY_D      0xFFEF
+
+struct acx_energy_detection {
+        struct acx_header header;
+
+        /* The RX Clear Channel Assessment threshold in the PHY */
+        u16 rx_cca_threshold;
+        u8 tx_energy_detection;
+        u8 pad;
+} __attribute__ ((packed));
+
+#define BCN_RX_TIMEOUT_DEF_VALUE        10000
+#define BROADCAST_RX_TIMEOUT_DEF_VALUE  20000
+#define RX_BROADCAST_IN_PS_DEF_VALUE    1
+#define CONSECUTIVE_PS_POLL_FAILURE_DEF 4
+
+struct acx_beacon_broadcast {
+        struct acx_header header;
+
+        u16 beacon_rx_timeout;
+        u16 broadcast_timeout;
+
+        /* Enables receiving of broadcast packets in PS mode */
+        u8 rx_broadcast_in_ps;
+
+        /* Consecutive PS Poll failures before updating the host */
+        u8 ps_poll_threshold;
+        u8 pad[2];
+} __attribute__ ((packed));
+
+struct acx_event_mask {
+        struct acx_header header;
+
+        u32 event_mask;
+        u32 high_event_mask; /* Unused */
+} __attribute__ ((packed));
+
+#define CFG_RX_FCS              BIT(2)
+#define CFG_RX_ALL_GOOD         BIT(3)
+#define CFG_UNI_FILTER_EN       BIT(4)
+#define CFG_BSSID_FILTER_EN     BIT(5)
+#define CFG_MC_FILTER_EN        BIT(6)
+#define CFG_MC_ADDR0_EN         BIT(7)
+#define CFG_MC_ADDR1_EN         BIT(8)
+#define CFG_BC_REJECT_EN        BIT(9)
+#define CFG_SSID_FILTER_EN      BIT(10)
+#define CFG_RX_INT_FCS_ERROR    BIT(11)
+#define CFG_RX_INT_ENCRYPTED    BIT(12)
+#define CFG_RX_WR_RX_STATUS     BIT(13)
+#define CFG_RX_FILTER_NULTI     BIT(14)
+#define CFG_RX_RESERVE          BIT(15)
+#define CFG_RX_TIMESTAMP_TSF    BIT(16)
+
+#define CFG_RX_RSV_EN           BIT(0)
+#define CFG_RX_RCTS_ACK         BIT(1)
+#define CFG_RX_PRSP_EN          BIT(2)
+#define CFG_RX_PREQ_EN          BIT(3)
+#define CFG_RX_MGMT_EN          BIT(4)
+#define CFG_RX_FCS_ERROR        BIT(5)
+#define CFG_RX_DATA_EN          BIT(6)
+#define CFG_RX_CTL_EN           BIT(7)
+#define CFG_RX_CF_EN            BIT(8)
+#define CFG_RX_BCN_EN           BIT(9)
+#define CFG_RX_AUTH_EN          BIT(10)
+#define CFG_RX_ASSOC_EN         BIT(11)
+
+#define SCAN_PASSIVE            BIT(0)
+#define SCAN_5GHZ_BAND          BIT(1)
+#define SCAN_TRIGGERED          BIT(2)
+#define SCAN_PRIORITY_HIGH      BIT(3)
+
+struct acx_fw_gen_frame_rates {
+        struct acx_header header;
+
+        u8 tx_ctrl_frame_rate; /* RATE_* */
+        u8 tx_ctrl_frame_mod; /* CCK_* or PBCC_* */
+        u8 tx_mgt_frame_rate;
+        u8 tx_mgt_frame_mod;
+} __attribute__ ((packed));
+
+/* STA MAC */
+struct dot11_station_id {
+        struct acx_header header;
+
+        u8 mac[ETH_ALEN];
+        u8 pad[2];
+} __attribute__ ((packed));
+
+/* HW encryption keys */
+#define NUM_ACCESS_CATEGORIES_COPY 4
+#define MAX_KEY_SIZE 32
+
+/* When set, disable HW encryption */
+#define DF_ENCRYPTION_DISABLE      0x01
+/* When set, disable HW decryption */
+#define DF_SNIFF_MODE_ENABLE       0x80
+
+struct acx_feature_config {
+        struct acx_header header;
+
+        u32 options;
+        u32 data_flow_options;
+} __attribute__ ((packed));
+
+enum acx_key_action {
+        KEY_ADD_OR_REPLACE = 1,
+        KEY_REMOVE         = 2,
+        KEY_SET_ID         = 3,
+        MAX_KEY_ACTION     = 0xffff,
+};
+
+enum acx_key_type {
+        KEY_WEP_DEFAULT       = 0,
+        KEY_WEP_ADDR          = 1,
+        KEY_AES_GROUP         = 4,
+        KEY_AES_PAIRWISE      = 5,
+        KEY_WEP_GROUP         = 6,
+        KEY_TKIP_MIC_GROUP    = 10,
+        KEY_TKIP_MIC_PAIRWISE = 11,
+};
+
+/*
+ *
+ * key_type_e   key size    key format
+ * ----------   ---------   ----------
+ * 0x00         5, 13, 29   Key data
+ * 0x01         5, 13, 29   Key data
+ * 0x04         16          16 bytes of key data
+ * 0x05         16          16 bytes of key data
+ * 0x0a         32          16 bytes of TKIP key data
+ *                          8 bytes of RX MIC key data
+ *                          8 bytes of TX MIC key data
+ * 0x0b         32          16 bytes of TKIP key data
+ *                          8 bytes of RX MIC key data
+ *                          8 bytes of TX MIC key data
+ *
+ */
+
+struct acx_set_key {
+        /* Ignored for default WEP key */
+        u8 addr[ETH_ALEN];
+
+        /* key_action_e */
+        u16 key_action;
+
+        u16 reserved_1;
+
+        /* key size in bytes */
+        u8 key_size;
+
+        /* key_type_e */
+        u8 key_type;
+        u8 ssid_profile;
+
+        /*
+         * TKIP, AES: frame's key id field.
+         * For WEP default key: key id;
+         */
+        u8 id;
+        u8 reserved_2[6];
+        u8 key[MAX_KEY_SIZE];
+        u16 ac_seq_num16[NUM_ACCESS_CATEGORIES_COPY];
+        u32 ac_seq_num32[NUM_ACCESS_CATEGORIES_COPY];
+} __attribute__ ((packed));
+
+struct acx_current_tx_power {
+        struct acx_header header;
+
+        u8  current_tx_power;
+        u8  padding[3];
+} __attribute__ ((packed));
+
+struct acx_dot11_default_key {
+        struct acx_header header;
+
+        u8 id;
+        u8 pad[3];
+} __attribute__ ((packed));
+
+struct acx_tsf_info {
+        struct acx_header header;
+
+        u32 current_tsf_msb;
+        u32 current_tsf_lsb;
+        u32 last_TBTT_msb;
+        u32 last_TBTT_lsb;
+        u8 last_dtim_count;
+        u8 pad[3];
+} __attribute__ ((packed));
+
+/* 802.11 PS */
+enum acx_ps_mode {
+        STATION_ACTIVE_MODE,
+        STATION_POWER_SAVE_MODE
+};
+
+struct acx_ps_params {
+        u8 ps_mode; /* STATION_* */
+        u8 send_null_data; /* Do we have to send NULL data packet ? */
+        u8 retries; /* Number of retires for the initial NULL data packet */
+
+         /*
+          * TUs during which the target stays awake after switching
+          * to power save mode.
+          */
+        u8 hang_over_period;
+        u16 null_data_rate;
+        u8 pad[2];
+} __attribute__ ((packed));
+
+enum acx_wake_up_event {
+        WAKE_UP_EVENT_BEACON_BITMAP     = 0x01, /* Wake on every Beacon*/
+        WAKE_UP_EVENT_DTIM_BITMAP       = 0x02, /* Wake on every DTIM*/
+        WAKE_UP_EVENT_N_DTIM_BITMAP     = 0x04, /* Wake on every Nth DTIM */
+        WAKE_UP_EVENT_N_BEACONS_BITMAP  = 0x08, /* Wake on every Nth Beacon */
+        WAKE_UP_EVENT_BITS_MASK         = 0x0F
+};
+
+struct acx_wake_up_condition {
+        struct acx_header header;
+
+        u8 wake_up_event; /* Only one bit can be set */
+        u8 listen_interval;
+        u8 pad[2];
+} __attribute__ ((packed));
+
+struct acx_aid {
+        struct acx_header header;
+
+        /*
+         * To be set when associated with an AP.
+         */
+        u16 aid;
+        u8 pad[2];
+} __attribute__ ((packed));
+
+enum acx_preamble_type {
+        ACX_PREAMBLE_LONG = 0,
+        ACX_PREAMBLE_SHORT = 1
+};
+
+struct acx_preamble {
+        struct acx_header header;
+        /*
+         * When set, the WiLink transmits the frames with a short preamble and
+         * when cleared, the WiLink transmits the frames with a long preamble.
+         */
+        u8 preamble;
+        u8 padding[3];
+} __attribute__ ((packed));
+
+enum acx_ctsprotect_type {
+        CTSPROTECT_DISABLE = 0,
+        CTSPROTECT_ENABLE = 1
+};
+
+struct acx_ctsprotect {
+        struct acx_header header;
+        u8 ctsprotect;
+        u8 padding[3];
+} __attribute__ ((packed));
+
+struct acx_tx_statistics {
+        u32 internal_desc_overflow;
+}  __attribute__ ((packed));
+
+struct acx_rx_statistics {
+        u32 out_of_mem;
+        u32 hdr_overflow;
+        u32 hw_stuck;
+        u32 dropped;
+        u32 fcs_err;
+        u32 xfr_hint_trig;
+        u32 path_reset;
+        u32 reset_counter;
+} __attribute__ ((packed));
+
+struct acx_dma_statistics {
+        u32 rx_requested;
+        u32 rx_errors;
+        u32 tx_requested;
+        u32 tx_errors;
+}  __attribute__ ((packed));
+
+struct acx_isr_statistics {
+        /* host command complete */
+        u32 cmd_cmplt;
+
+        /* fiqisr() */
+        u32 fiqs;
+
+        /* (INT_STS_ND & INT_TRIG_RX_HEADER) */
+        u32 rx_headers;
+
+        /* (INT_STS_ND & INT_TRIG_RX_CMPLT) */
+        u32 rx_completes;
+
+        /* (INT_STS_ND & INT_TRIG_NO_RX_BUF) */
+        u32 rx_mem_overflow;
+
+        /* (INT_STS_ND & INT_TRIG_S_RX_RDY) */
+        u32 rx_rdys;
+
+        /* irqisr() */
+        u32 irqs;
+
+        /* (INT_STS_ND & INT_TRIG_TX_PROC) */
+        u32 tx_procs;
+
+        /* (INT_STS_ND & INT_TRIG_DECRYPT_DONE) */
+        u32 decrypt_done;
+
+        /* (INT_STS_ND & INT_TRIG_DMA0) */
+        u32 dma0_done;
+
+        /* (INT_STS_ND & INT_TRIG_DMA1) */
+        u32 dma1_done;
+
+        /* (INT_STS_ND & INT_TRIG_TX_EXC_CMPLT) */
+        u32 tx_exch_complete;
+
+        /* (INT_STS_ND & INT_TRIG_COMMAND) */
+        u32 commands;
+
+        /* (INT_STS_ND & INT_TRIG_RX_PROC) */
+        u32 rx_procs;
+
+        /* (INT_STS_ND & INT_TRIG_PM_802) */
+        u32 hw_pm_mode_changes;
+
+        /* (INT_STS_ND & INT_TRIG_ACKNOWLEDGE) */
+        u32 host_acknowledges;
+
+        /* (INT_STS_ND & INT_TRIG_PM_PCI) */
+        u32 pci_pm;
+
+        /* (INT_STS_ND & INT_TRIG_ACM_WAKEUP) */
+        u32 wakeups;
+
+        /* (INT_STS_ND & INT_TRIG_LOW_RSSI) */
+        u32 low_rssi;
+} __attribute__ ((packed));
+
+struct acx_wep_statistics {
+        /* WEP address keys configured */
+        u32 addr_key_count;
+
+        /* default keys configured */
+        u32 default_key_count;
+
+        u32 reserved;
+
+        /* number of times that WEP key not found on lookup */
+        u32 key_not_found;
+
+        /* number of times that WEP key decryption failed */
+        u32 decrypt_fail;
+
+        /* WEP packets decrypted */
+        u32 packets;
+
+        /* WEP decrypt interrupts */
+        u32 interrupt;
+} __attribute__ ((packed));
+
+#define ACX_MISSED_BEACONS_SPREAD 10
+
+struct acx_pwr_statistics {
+        /* the amount of enters into power save mode (both PD & ELP) */
+        u32 ps_enter;
+
+        /* the amount of enters into ELP mode */
+        u32 elp_enter;
+
+        /* the amount of missing beacon interrupts to the host */
+        u32 missing_bcns;
+
+        /* the amount of wake on host-access times */
+        u32 wake_on_host;
+
+        /* the amount of wake on timer-expire */
+        u32 wake_on_timer_exp;
+
+        /* the number of packets that were transmitted with PS bit set */
+        u32 tx_with_ps;
+
+        /* the number of packets that were transmitted with PS bit clear */
+        u32 tx_without_ps;
+
+        /* the number of received beacons */
+        u32 rcvd_beacons;
+
+        /* the number of entering into PowerOn (power save off) */
+        u32 power_save_off;
+
+        /* the number of entries into power save mode */
+        u16 enable_ps;
+
+        /*
+         * the number of exits from power save, not including failed PS
+         * transitions
+         */
+        u16 disable_ps;
+
+        /*
+         * the number of times the TSF counter was adjusted because
+         * of drift
+         */
+        u32 fix_tsf_ps;
+
+        /* Gives statistics about the spread continuous missed beacons.
+         * The 16 LSB are dedicated for the PS mode.
+         * The 16 MSB are dedicated for the PS mode.
+         * cont_miss_bcns_spread[0] - single missed beacon.
+         * cont_miss_bcns_spread[1] - two continuous missed beacons.
+         * cont_miss_bcns_spread[2] - three continuous missed beacons.
+         * ...
+         * cont_miss_bcns_spread[9] - ten and more continuous missed beacons.
+        */
+        u32 cont_miss_bcns_spread[ACX_MISSED_BEACONS_SPREAD];
+
+        /* the number of beacons in awake mode */
+        u32 rcvd_awake_beacons;
+} __attribute__ ((packed));
+
+struct acx_mic_statistics {
+        u32 rx_pkts;
+        u32 calc_failure;
+} __attribute__ ((packed));
+
+struct acx_aes_statistics {
+        u32 encrypt_fail;
+        u32 decrypt_fail;
+        u32 encrypt_packets;
+        u32 decrypt_packets;
+        u32 encrypt_interrupt;
+        u32 decrypt_interrupt;
+} __attribute__ ((packed));
+
+struct acx_event_statistics {
+        u32 heart_beat;
+        u32 calibration;
+        u32 rx_mismatch;
+        u32 rx_mem_empty;
+        u32 rx_pool;
+        u32 oom_late;
+        u32 phy_transmit_error;
+        u32 tx_stuck;
+} __attribute__ ((packed));
+
+struct acx_ps_statistics {
+        u32 pspoll_timeouts;
+        u32 upsd_timeouts;
+        u32 upsd_max_sptime;
+        u32 upsd_max_apturn;
+        u32 pspoll_max_apturn;
+        u32 pspoll_utilization;
+        u32 upsd_utilization;
+} __attribute__ ((packed));
+
+struct acx_rxpipe_statistics {
+        u32 rx_prep_beacon_drop;
+        u32 descr_host_int_trig_rx_data;
+        u32 beacon_buffer_thres_host_int_trig_rx_data;
+        u32 missed_beacon_host_int_trig_rx_data;
+        u32 tx_xfr_host_int_trig_rx_data;
+} __attribute__ ((packed));
+
+struct acx_statistics {
+        struct acx_header header;
+
+        struct acx_tx_statistics tx;
+        struct acx_rx_statistics rx;
+        struct acx_dma_statistics dma;
+        struct acx_isr_statistics isr;
+        struct acx_wep_statistics wep;
+        struct acx_pwr_statistics pwr;
+        struct acx_aes_statistics aes;
+        struct acx_mic_statistics mic;
+        struct acx_event_statistics event;
+        struct acx_ps_statistics ps;
+        struct acx_rxpipe_statistics rxpipe;
+} __attribute__ ((packed));
+
+enum {
+        ACX_WAKE_UP_CONDITIONS      = 0x0002,
+        ACX_MEM_CFG                 = 0x0003,
+        ACX_SLOT                    = 0x0004,
+        ACX_QUEUE_HEAD              = 0x0005, /* for MASTER mode only */
+        ACX_AC_CFG                  = 0x0007,
+        ACX_MEM_MAP                 = 0x0008,
+        ACX_AID                     = 0x000A,
+        ACX_RADIO_PARAM             = 0x000B, /* Not used */
+        ACX_CFG                     = 0x000C, /* Not used */
+        ACX_FW_REV                  = 0x000D,
+        ACX_MEDIUM_USAGE            = 0x000F,
+        ACX_RX_CFG                  = 0x0010,
+        ACX_TX_QUEUE_CFG            = 0x0011, /* FIXME: only used by wl1251 */
+        ACX_BSS_IN_PS               = 0x0012, /* for AP only */
+        ACX_STATISTICS              = 0x0013, /* Debug API */
+        ACX_FEATURE_CFG             = 0x0015,
+        ACX_MISC_CFG                = 0x0017, /* Not used */
+        ACX_TID_CFG                 = 0x001A,
+        ACX_BEACON_FILTER_OPT       = 0x001F,
+        ACX_LOW_RSSI                = 0x0020,
+        ACX_NOISE_HIST              = 0x0021,
+        ACX_HDK_VERSION             = 0x0022, /* ??? */
+        ACX_PD_THRESHOLD            = 0x0023,
+        ACX_DATA_PATH_PARAMS        = 0x0024, /* WO */
+        ACX_DATA_PATH_RESP_PARAMS   = 0x0024, /* RO */
+        ACX_CCA_THRESHOLD           = 0x0025,
+        ACX_EVENT_MBOX_MASK         = 0x0026,
+#ifdef FW_RUNNING_AS_AP
+        ACX_DTIM_PERIOD             = 0x0027, /* for AP only */
+#else
+        ACX_WR_TBTT_AND_DTIM        = 0x0027, /* STA only */
+#endif
+        ACX_ACI_OPTION_CFG          = 0x0029, /* OBSOLETE (for 1251)*/
+        ACX_GPIO_CFG                = 0x002A, /* Not used */
+        ACX_GPIO_SET                = 0x002B, /* Not used */
+        ACX_PM_CFG                  = 0x002C, /* To Be Documented */
+        ACX_CONN_MONIT_PARAMS       = 0x002D,
+        ACX_AVERAGE_RSSI            = 0x002E, /* Not used */
+        ACX_CONS_TX_FAILURE         = 0x002F,
+        ACX_BCN_DTIM_OPTIONS        = 0x0031,
+        ACX_SG_ENABLE               = 0x0032,
+        ACX_SG_CFG                  = 0x0033,
+        ACX_ANTENNA_DIVERSITY_CFG   = 0x0035, /* To Be Documented */
+        ACX_LOW_SNR                 = 0x0037, /* To Be Documented */
+        ACX_BEACON_FILTER_TABLE     = 0x0038,
+        ACX_ARP_IP_FILTER           = 0x0039,
+        ACX_ROAMING_STATISTICS_TBL  = 0x003B,
+        ACX_RATE_POLICY             = 0x003D,
+        ACX_CTS_PROTECTION          = 0x003E,
+        ACX_SLEEP_AUTH              = 0x003F,
+        ACX_PREAMBLE_TYPE           = 0x0040,
+        ACX_ERROR_CNT               = 0x0041,
+        ACX_FW_GEN_FRAME_RATES      = 0x0042,
+        ACX_IBSS_FILTER             = 0x0044,
+        ACX_SERVICE_PERIOD_TIMEOUT  = 0x0045,
+        ACX_TSF_INFO                = 0x0046,
+        ACX_CONFIG_PS_WMM           = 0x0049,
+        ACX_ENABLE_RX_DATA_FILTER   = 0x004A,
+        ACX_SET_RX_DATA_FILTER      = 0x004B,
+        ACX_GET_DATA_FILTER_STATISTICS = 0x004C,
+        ACX_POWER_LEVEL_TABLE       = 0x004D,
+        ACX_BET_ENABLE              = 0x0050,
+        DOT11_STATION_ID            = 0x1001,
+        DOT11_RX_MSDU_LIFE_TIME     = 0x1004,
+        DOT11_CUR_TX_PWR            = 0x100D,
+        DOT11_DEFAULT_KEY           = 0x1010,
+        DOT11_RX_DOT11_MODE         = 0x1012,
+        DOT11_RTS_THRESHOLD         = 0x1013,
+        DOT11_GROUP_ADDRESS_TBL     = 0x1014,
+
+        MAX_DOT11_IE = DOT11_GROUP_ADDRESS_TBL,
+
+        MAX_IE = 0xFFFF
+};
+
+
+int wl12xx_acx_frame_rates(struct wl12xx *wl, u8 ctrl_rate, u8 ctrl_mod,
+                           u8 mgt_rate, u8 mgt_mod);
+int wl12xx_acx_station_id(struct wl12xx *wl);
+int wl12xx_acx_default_key(struct wl12xx *wl, u8 key_id);
+int wl12xx_acx_wake_up_conditions(struct wl12xx *wl, u8 listen_interval);
+int wl12xx_acx_sleep_auth(struct wl12xx *wl, u8 sleep_auth);
+int wl12xx_acx_fw_version(struct wl12xx *wl, char *buf, size_t len);
+int wl12xx_acx_tx_power(struct wl12xx *wl, int power);
+int wl12xx_acx_feature_cfg(struct wl12xx *wl);
+int wl12xx_acx_mem_map(struct wl12xx *wl, void *mem_map, size_t len);
+int wl12xx_acx_data_path_params(struct wl12xx *wl,
+                                struct acx_data_path_params_resp *data_path);
+int wl12xx_acx_rx_msdu_life_time(struct wl12xx *wl, u32 life_time);
+int wl12xx_acx_rx_config(struct wl12xx *wl, u32 config, u32 filter);
+int wl12xx_acx_pd_threshold(struct wl12xx *wl);
+int wl12xx_acx_slot(struct wl12xx *wl, enum acx_slot_type slot_time);
+int wl12xx_acx_group_address_tbl(struct wl12xx *wl);
+int wl12xx_acx_service_period_timeout(struct wl12xx *wl);
+int wl12xx_acx_rts_threshold(struct wl12xx *wl, u16 rts_threshold);
+int wl12xx_acx_beacon_filter_opt(struct wl12xx *wl);
+int wl12xx_acx_beacon_filter_table(struct wl12xx *wl);
+int wl12xx_acx_sg_enable(struct wl12xx *wl);
+int wl12xx_acx_sg_cfg(struct wl12xx *wl);
+int wl12xx_acx_cca_threshold(struct wl12xx *wl);
+int wl12xx_acx_bcn_dtim_options(struct wl12xx *wl);
+int wl12xx_acx_aid(struct wl12xx *wl, u16 aid);
+int wl12xx_acx_event_mbox_mask(struct wl12xx *wl, u32 event_mask);
+int wl12xx_acx_set_preamble(struct wl12xx *wl, enum acx_preamble_type preamble);
+int wl12xx_acx_cts_protect(struct wl12xx *wl,
+                            enum acx_ctsprotect_type ctsprotect);
+int wl12xx_acx_statistics(struct wl12xx *wl, struct acx_statistics *stats);
+
+#endif /* __WL12XX_ACX_H__ */
diff --git a/drivers/net/wireless/wl12xx/boot.c b/drivers/net/wireless/wl12xx/boot.c
new file mode 100644
index 000000000000..48ac08c429bd
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/boot.c
@@ -0,0 +1,295 @@
+/*
+ * This file is part of wl12xx
+ *
+ * Copyright (C) 2008 Nokia Corporation
+ *
+ * Contact: Kalle Valo <kalle.valo@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include <linux/gpio.h>
+
+#include "reg.h"
+#include "boot.h"
+#include "spi.h"
+#include "event.h"
+
+static void wl12xx_boot_enable_interrupts(struct wl12xx *wl)
+{
+        enable_irq(wl->irq);
+}
+
+void wl12xx_boot_target_enable_interrupts(struct wl12xx *wl)
+{
+        wl12xx_reg_write32(wl, ACX_REG_INTERRUPT_MASK, ~(wl->intr_mask));
+        wl12xx_reg_write32(wl, HI_CFG, HI_CFG_DEF_VAL);
+}
+
+int wl12xx_boot_soft_reset(struct wl12xx *wl)
+{
+        unsigned long timeout;
+        u32 boot_data;
+
+        /* perform soft reset */
+        wl12xx_reg_write32(wl, ACX_REG_SLV_SOFT_RESET, ACX_SLV_SOFT_RESET_BIT);
+
+        /* SOFT_RESET is self clearing */
+        timeout = jiffies + usecs_to_jiffies(SOFT_RESET_MAX_TIME);
+        while (1) {
+                boot_data = wl12xx_reg_read32(wl, ACX_REG_SLV_SOFT_RESET);
+                wl12xx_debug(DEBUG_BOOT, "soft reset bootdata 0x%x", boot_data);
+                if ((boot_data & ACX_SLV_SOFT_RESET_BIT) == 0)
+                        break;
+
+                if (time_after(jiffies, timeout)) {
+                        /* 1.2 check pWhalBus->uSelfClearTime if the
+                         * timeout was reached */
+                        wl12xx_error("soft reset timeout");
+                        return -1;
+                }
+
+                udelay(SOFT_RESET_STALL_TIME);
+        }
+
+        /* disable Rx/Tx */
+        wl12xx_reg_write32(wl, ENABLE, 0x0);
+
+        /* disable auto calibration on start*/
+        wl12xx_reg_write32(wl, SPARE_A2, 0xffff);
+
+        return 0;
+}
+
+int wl12xx_boot_init_seq(struct wl12xx *wl)
+{
+        u32 scr_pad6, init_data, tmp, elp_cmd, ref_freq;
+
+        /*
+         * col #1: INTEGER_DIVIDER
+         * col #2: FRACTIONAL_DIVIDER
+         * col #3: ATTN_BB
+         * col #4: ALPHA_BB
+         * col #5: STOP_TIME_BB
+         * col #6: BB_PLL_LOOP_FILTER
+         */
+        static const u32 LUT[REF_FREQ_NUM][LUT_PARAM_NUM] = {
+
+                {   83, 87381,  0xB, 5, 0xF00,  3}, /* REF_FREQ_19_2*/
+                {   61, 141154, 0xB, 5, 0x1450, 2}, /* REF_FREQ_26_0*/
+                {   41, 174763, 0xC, 6, 0x2D00, 1}, /* REF_FREQ_38_4*/
+                {   40, 0,      0xC, 6, 0x2EE0, 1}, /* REF_FREQ_40_0*/
+                {   47, 162280, 0xC, 6, 0x2760, 1}  /* REF_FREQ_33_6        */
+        };
+
+        /* read NVS params */
+        scr_pad6 = wl12xx_reg_read32(wl, SCR_PAD6);
+        wl12xx_debug(DEBUG_BOOT, "scr_pad6 0x%x", scr_pad6);
+
+        /* read ELP_CMD */
+        elp_cmd = wl12xx_reg_read32(wl, ELP_CMD);
+        wl12xx_debug(DEBUG_BOOT, "elp_cmd 0x%x", elp_cmd);
+
+        /* set the BB calibration time to be 300 usec (PLL_CAL_TIME) */
+        ref_freq = scr_pad6 & 0x000000FF;
+        wl12xx_debug(DEBUG_BOOT, "ref_freq 0x%x", ref_freq);
+
+        wl12xx_reg_write32(wl, PLL_CAL_TIME, 0x9);
+
+        /*
+         * PG 1.2: set the clock buffer time to be 210 usec (CLK_BUF_TIME)
+         */
+        wl12xx_reg_write32(wl, CLK_BUF_TIME, 0x6);
+
+        /*
+         * set the clock detect feature to work in the restart wu procedure
+         * (ELP_CFG_MODE[14]) and Select the clock source type
+         * (ELP_CFG_MODE[13:12])
+         */
+        tmp = ((scr_pad6 & 0x0000FF00) << 4) | 0x00004000;
+        wl12xx_reg_write32(wl, ELP_CFG_MODE, tmp);
+
+        /* PG 1.2: enable the BB PLL fix. Enable the PLL_LIMP_CLK_EN_CMD */
+        elp_cmd |= 0x00000040;
+        wl12xx_reg_write32(wl, ELP_CMD, elp_cmd);
+
+        /* PG 1.2: Set the BB PLL stable time to be 1000usec
+         * (PLL_STABLE_TIME) */
+        wl12xx_reg_write32(wl, CFG_PLL_SYNC_CNT, 0x20);
+
+        /* PG 1.2: read clock request time */
+        init_data = wl12xx_reg_read32(wl, CLK_REQ_TIME);
+
+        /*
+         * PG 1.2: set the clock request time to be ref_clk_settling_time -
+         * 1ms = 4ms
+         */
+        if (init_data > 0x21)
+                tmp = init_data - 0x21;
+        else
+                tmp = 0;
+        wl12xx_reg_write32(wl, CLK_REQ_TIME, tmp);
+
+        /* set BB PLL configurations in RF AFE */
+        wl12xx_reg_write32(wl, 0x003058cc, 0x4B5);
+
+        /* set RF_AFE_REG_5 */
+        wl12xx_reg_write32(wl, 0x003058d4, 0x50);
+
+        /* set RF_AFE_CTRL_REG_2 */
+        wl12xx_reg_write32(wl, 0x00305948, 0x11c001);
+
+        /*
+         * change RF PLL and BB PLL divider for VCO clock and adjust VCO
+         * bais current(RF_AFE_REG_13)
+         */
+        wl12xx_reg_write32(wl, 0x003058f4, 0x1e);
+
+        /* set BB PLL configurations */
+        tmp = LUT[ref_freq][LUT_PARAM_INTEGER_DIVIDER] | 0x00017000;
+        wl12xx_reg_write32(wl, 0x00305840, tmp);
+
+        /* set fractional divider according to Appendix C-BB PLL
+         * Calculations
+         */
+        tmp = LUT[ref_freq][LUT_PARAM_FRACTIONAL_DIVIDER];
+        wl12xx_reg_write32(wl, 0x00305844, tmp);
+
+        /* set the initial data for the sigma delta */
+        wl12xx_reg_write32(wl, 0x00305848, 0x3039);
+
+        /*
+         * set the accumulator attenuation value, calibration loop1
+         * (alpha), calibration loop2 (beta), calibration loop3 (gamma) and
+         * the VCO gain
+         */
+        tmp = (LUT[ref_freq][LUT_PARAM_ATTN_BB] << 16) |
+                (LUT[ref_freq][LUT_PARAM_ALPHA_BB] << 12) | 0x1;
+        wl12xx_reg_write32(wl, 0x00305854, tmp);
+
+        /*
+         * set the calibration stop time after holdoff time expires and set
+         * settling time HOLD_OFF_TIME_BB
+         */
+        tmp = LUT[ref_freq][LUT_PARAM_STOP_TIME_BB] | 0x000A0000;
+        wl12xx_reg_write32(wl, 0x00305858, tmp);
+
+        /*
+         * set BB PLL Loop filter capacitor3- BB_C3[2:0] and set BB PLL
+         * constant leakage current to linearize PFD to 0uA -
+         * BB_ILOOPF[7:3]
+         */
+        tmp = LUT[ref_freq][LUT_PARAM_BB_PLL_LOOP_FILTER] | 0x00000030;
+        wl12xx_reg_write32(wl, 0x003058f8, tmp);
+
+        /*
+         * set regulator output voltage for n divider to
+         * 1.35-BB_REFDIV[1:0], set charge pump current- BB_CPGAIN[4:2],
+         * set BB PLL Loop filter capacitor2- BB_C2[7:5], set gain of BB
+         * PLL auto-call to normal mode- BB_CALGAIN_3DB[8]
+         */
+        wl12xx_reg_write32(wl, 0x003058f0, 0x29);
+
+        /* enable restart wakeup sequence (ELP_CMD[0]) */
+        wl12xx_reg_write32(wl, ELP_CMD, elp_cmd | 0x1);
+
+        /* restart sequence completed */
+        udelay(2000);
+
+        return 0;
+}
+
+int wl12xx_boot_run_firmware(struct wl12xx *wl)
+{
+        int loop, ret;
+        u32 chip_id, interrupt;
+
+        wl->chip.op_set_ecpu_ctrl(wl, ECPU_CONTROL_HALT);
+
+        chip_id = wl12xx_reg_read32(wl, CHIP_ID_B);
+
+        wl12xx_debug(DEBUG_BOOT, "chip id after firmware boot: 0x%x", chip_id);
+
+        if (chip_id != wl->chip.id) {
+                wl12xx_error("chip id doesn't match after firmware boot");
+                return -EIO;
+        }
+
+        /* wait for init to complete */
+        loop = 0;
+        while (loop++ < INIT_LOOP) {
+                udelay(INIT_LOOP_DELAY);
+                interrupt = wl12xx_reg_read32(wl, ACX_REG_INTERRUPT_NO_CLEAR);
+
+                if (interrupt == 0xffffffff) {
+                        wl12xx_error("error reading hardware complete "
+                                     "init indication");
+                        return -EIO;
+                }
+                /* check that ACX_INTR_INIT_COMPLETE is enabled */
+                else if (interrupt & wl->chip.intr_init_complete) {
+                        wl12xx_reg_write32(wl, ACX_REG_INTERRUPT_ACK,
+                                           wl->chip.intr_init_complete);
+                        break;
+                }
+        }
+
+        if (loop >= INIT_LOOP) {
+                wl12xx_error("timeout waiting for the hardware to "
+                             "complete initialization");
+                return -EIO;
+        }
+
+        /* get hardware config command mail box */
+        wl->cmd_box_addr = wl12xx_reg_read32(wl, REG_COMMAND_MAILBOX_PTR);
+
+        /* get hardware config event mail box */
+        wl->event_box_addr = wl12xx_reg_read32(wl, REG_EVENT_MAILBOX_PTR);
+
+        /* set the working partition to its "running" mode offset */
+        wl12xx_set_partition(wl,
+                             wl->chip.p_table[PART_WORK].mem.start,
+                             wl->chip.p_table[PART_WORK].mem.size,
+                             wl->chip.p_table[PART_WORK].reg.start,
+                             wl->chip.p_table[PART_WORK].reg.size);
+
+        wl12xx_debug(DEBUG_MAILBOX, "cmd_box_addr 0x%x event_box_addr 0x%x",
+                     wl->cmd_box_addr, wl->event_box_addr);
+
+        /*
+         * in case of full asynchronous mode the firmware event must be
+         * ready to receive event from the command mailbox
+         */
+
+        /* enable gpio interrupts */
+        wl12xx_boot_enable_interrupts(wl);
+
+        wl->chip.op_target_enable_interrupts(wl);
+
+        /* unmask all mbox events  */
+        wl->event_mask = 0xffffffff;
+
+        ret = wl12xx_event_unmask(wl);
+        if (ret < 0) {
+                wl12xx_error("EVENT mask setting failed");
+                return ret;
+        }
+
+        wl12xx_event_mbox_config(wl);
+
+        /* firmware startup completed */
+        return 0;
+}
diff --git a/drivers/net/wireless/wl12xx/boot.h b/drivers/net/wireless/wl12xx/boot.h
new file mode 100644
index 000000000000..4fa73132baae
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/boot.h
@@ -0,0 +1,40 @@
+/*
+ * This file is part of wl12xx
+ *
+ * Copyright (C) 2008 Nokia Corporation
+ *
+ * Contact: Kalle Valo <kalle.valo@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __BOOT_H__
+#define __BOOT_H__
+
+#include "wl12xx.h"
+
+int wl12xx_boot_soft_reset(struct wl12xx *wl);
+int wl12xx_boot_init_seq(struct wl12xx *wl);
+int wl12xx_boot_run_firmware(struct wl12xx *wl);
+void wl12xx_boot_target_enable_interrupts(struct wl12xx *wl);
+
+/* number of times we try to read the INIT interrupt */
+#define INIT_LOOP 20000
+
+/* delay between retries */
+#define INIT_LOOP_DELAY 50
+
+#endif
diff --git a/drivers/net/wireless/wl12xx/cmd.c b/drivers/net/wireless/wl12xx/cmd.c
new file mode 100644
index 000000000000..f73ab602b7ae
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/cmd.c
@@ -0,0 +1,353 @@
+#include "cmd.h"
+
+#include <linux/module.h>
+#include <linux/crc7.h>
+#include <linux/spi/spi.h>
+
+#include "wl12xx.h"
+#include "wl12xx_80211.h"
+#include "reg.h"
+#include "spi.h"
+#include "ps.h"
+
+int wl12xx_cmd_send(struct wl12xx *wl, u16 type, void *buf, size_t buf_len)
+{
+        struct wl12xx_command cmd;
+        unsigned long timeout;
+        size_t cmd_len;
+        u32 intr;
+        int ret = 0;
+
+        memset(&cmd, 0, sizeof(cmd));
+        cmd.id = type;
+        cmd.status = 0;
+        memcpy(cmd.parameters, buf, buf_len);
+        cmd_len = ALIGN(buf_len, 4) + CMDMBOX_HEADER_LEN;
+
+        wl12xx_ps_elp_wakeup(wl);
+
+        wl12xx_spi_mem_write(wl, wl->cmd_box_addr, &cmd, cmd_len);
+
+        wl12xx_reg_write32(wl, ACX_REG_INTERRUPT_TRIG, INTR_TRIG_CMD);
+
+        timeout = jiffies + msecs_to_jiffies(WL12XX_COMMAND_TIMEOUT);
+
+        intr = wl12xx_reg_read32(wl, ACX_REG_INTERRUPT_NO_CLEAR);
+        while (!(intr & wl->chip.intr_cmd_complete)) {
+                if (time_after(jiffies, timeout)) {
+                        wl12xx_error("command complete timeout");
+                        ret = -ETIMEDOUT;
+                        goto out;
+                }
+
+                msleep(1);
+
+                intr = wl12xx_reg_read32(wl, ACX_REG_INTERRUPT_NO_CLEAR);
+        }
+
+        wl12xx_reg_write32(wl, ACX_REG_INTERRUPT_ACK,
+                           wl->chip.intr_cmd_complete);
+
+out:
+        wl12xx_ps_elp_sleep(wl);
+
+        return ret;
+}
+
+int wl12xx_cmd_test(struct wl12xx *wl, void *buf, size_t buf_len, u8 answer)
+{
+        int ret;
+
+        wl12xx_debug(DEBUG_CMD, "cmd test");
+
+        ret = wl12xx_cmd_send(wl, CMD_TEST, buf, buf_len);
+        if (ret < 0) {
+                wl12xx_warning("TEST command failed");
+                return ret;
+        }
+
+        if (answer) {
+                struct wl12xx_command *cmd_answer;
+
+                /*
+                 * The test command got in, we can read the answer.
+                 * The answer would be a wl12xx_command, where the
+                 * parameter array contains the actual answer.
+                 */
+
+                wl12xx_ps_elp_wakeup(wl);
+
+                wl12xx_spi_mem_read(wl, wl->cmd_box_addr, buf, buf_len);
+
+                wl12xx_ps_elp_sleep(wl);
+
+                cmd_answer = buf;
+                if (cmd_answer->status != CMD_STATUS_SUCCESS)
+                        wl12xx_error("TEST command answer error: %d",
+                                     cmd_answer->status);
+        }
+
+        return 0;
+}
+
+
+int wl12xx_cmd_interrogate(struct wl12xx *wl, u16 ie_id, u16 ie_len,
+                           void *answer)
+{
+        struct wl12xx_command *cmd;
+        struct acx_header header;
+        int ret;
+
+        wl12xx_debug(DEBUG_CMD, "cmd interrogate");
+
+        header.id = ie_id;
+        header.len = ie_len - sizeof(header);
+
+        ret = wl12xx_cmd_send(wl, CMD_INTERROGATE, &header, sizeof(header));
+        if (ret < 0) {
+                wl12xx_error("INTERROGATE command failed");
+                return ret;
+        }
+
+        wl12xx_ps_elp_wakeup(wl);
+
+        /* the interrogate command got in, we can read the answer */
+        wl12xx_spi_mem_read(wl, wl->cmd_box_addr, answer,
+                            CMDMBOX_HEADER_LEN + ie_len);
+
+        wl12xx_ps_elp_sleep(wl);
+
+        cmd = answer;
+        if (cmd->status != CMD_STATUS_SUCCESS)
+                wl12xx_error("INTERROGATE command error: %d",
+                             cmd->status);
+
+        return 0;
+
+}
+
+int wl12xx_cmd_configure(struct wl12xx *wl, void *ie, int ie_len)
+{
+        int ret;
+
+        wl12xx_debug(DEBUG_CMD, "cmd configure");
+
+        ret = wl12xx_cmd_send(wl, CMD_CONFIGURE, ie,
+                              ie_len);
+        if (ret < 0) {
+                wl12xx_warning("CONFIGURE command NOK");
+                return ret;
+        }
+
+        return 0;
+
+}
+
+int wl12xx_cmd_vbm(struct wl12xx *wl, u8 identity,
+                   void *bitmap, u16 bitmap_len, u8 bitmap_control)
+{
+        struct vbm_update_request vbm;
+        int ret;
+
+        wl12xx_debug(DEBUG_CMD, "cmd vbm");
+
+        /* Count and period will be filled by the target */
+        vbm.tim.bitmap_ctrl = bitmap_control;
+        if (bitmap_len > PARTIAL_VBM_MAX) {
+                wl12xx_warning("cmd vbm len is %d B, truncating to %d",
+                               bitmap_len, PARTIAL_VBM_MAX);
+                bitmap_len = PARTIAL_VBM_MAX;
+        }
+        memcpy(vbm.tim.pvb_field, bitmap, bitmap_len);
+        vbm.tim.identity = identity;
+        vbm.tim.length = bitmap_len + 3;
+
+        vbm.len = cpu_to_le16(bitmap_len + 5);
+
+        ret = wl12xx_cmd_send(wl, CMD_VBM, &vbm, sizeof(vbm));
+        if (ret < 0) {
+                wl12xx_error("VBM command failed");
+                return ret;
+        }
+
+        return 0;
+}
+
+int wl12xx_cmd_data_path(struct wl12xx *wl, u8 channel, u8 enable)
+{
+        int ret;
+        u16 cmd_rx, cmd_tx;
+
+        wl12xx_debug(DEBUG_CMD, "cmd data path");
+
+        if (enable) {
+                cmd_rx = CMD_ENABLE_RX;
+                cmd_tx = CMD_ENABLE_TX;
+        } else {
+                cmd_rx = CMD_DISABLE_RX;
+                cmd_tx = CMD_DISABLE_TX;
+        }
+
+        ret = wl12xx_cmd_send(wl, cmd_rx, &channel, sizeof(channel));
+        if (ret < 0) {
+                wl12xx_error("rx %s cmd for channel %d failed",
+                             enable ? "start" : "stop", channel);
+                return ret;
+        }
+
+        wl12xx_debug(DEBUG_BOOT, "rx %s cmd channel %d",
+                     enable ? "start" : "stop", channel);
+
+        ret = wl12xx_cmd_send(wl, cmd_tx, &channel, sizeof(channel));
+        if (ret < 0) {
+                wl12xx_error("tx %s cmd for channel %d failed",
+                             enable ? "start" : "stop", channel);
+                return ret;
+        }
+
+        wl12xx_debug(DEBUG_BOOT, "tx %s cmd channel %d",
+                     enable ? "start" : "stop", channel);
+
+        return 0;
+}
+
+int wl12xx_cmd_join(struct wl12xx *wl, u8 bss_type, u8 dtim_interval,
+                    u16 beacon_interval, u8 wait)
+{
+        unsigned long timeout;
+        struct cmd_join join = {};
+        int ret, i;
+        u8 *bssid;
+
+        /* FIXME: this should be in main.c */
+        ret = wl12xx_acx_frame_rates(wl, DEFAULT_HW_GEN_TX_RATE,
+                                     DEFAULT_HW_GEN_MODULATION_TYPE,
+                                     wl->tx_mgmt_frm_rate,
+                                     wl->tx_mgmt_frm_mod);
+        if (ret < 0)
+                return ret;
+
+        wl12xx_debug(DEBUG_CMD, "cmd join");
+
+        /* Reverse order BSSID */
+        bssid = (u8 *)&join.bssid_lsb;
+        for (i = 0; i < ETH_ALEN; i++)
+                bssid[i] = wl->bssid[ETH_ALEN - i - 1];
+
+        join.rx_config_options = wl->rx_config;
+        join.rx_filter_options = wl->rx_filter;
+
+        join.basic_rate_set = RATE_MASK_1MBPS | RATE_MASK_2MBPS |
+                RATE_MASK_5_5MBPS | RATE_MASK_11MBPS;
+
+        join.beacon_interval = beacon_interval;
+        join.dtim_interval = dtim_interval;
+        join.bss_type = bss_type;
+        join.channel = wl->channel;
+        join.ctrl = JOIN_CMD_CTRL_TX_FLUSH;
+
+        ret = wl12xx_cmd_send(wl, CMD_START_JOIN, &join, sizeof(join));
+        if (ret < 0) {
+                wl12xx_error("failed to initiate cmd join");
+                return ret;
+        }
+
+        timeout = msecs_to_jiffies(JOIN_TIMEOUT);
+
+        /*
+         * ugly hack: we should wait for JOIN_EVENT_COMPLETE_ID but to
+         * simplify locking we just sleep instead, for now
+         */
+        if (wait)
+                msleep(10);
+
+        return 0;
+}
+
+int wl12xx_cmd_ps_mode(struct wl12xx *wl, u8 ps_mode)
+{
+        int ret;
+        struct acx_ps_params ps_params;
+
+        /* FIXME: this should be in ps.c */
+        ret = wl12xx_acx_wake_up_conditions(wl, wl->listen_int);
+        if (ret < 0) {
+                wl12xx_error("Couldnt set wake up conditions");
+                return ret;
+        }
+
+        wl12xx_debug(DEBUG_CMD, "cmd set ps mode");
+
+        ps_params.ps_mode = ps_mode;
+        ps_params.send_null_data = 1;
+        ps_params.retries = 5;
+        ps_params.hang_over_period = 128;
+        ps_params.null_data_rate = 1; /* 1 Mbps */
+
+        ret = wl12xx_cmd_send(wl, CMD_SET_PS_MODE, &ps_params,
+                              sizeof(ps_params));
+        if (ret < 0) {
+                wl12xx_error("cmd set_ps_mode failed");
+                return ret;
+        }
+
+        return 0;
+}
+
+int wl12xx_cmd_read_memory(struct wl12xx *wl, u32 addr, u32 len, void *answer)
+{
+        struct cmd_read_write_memory mem_cmd, *mem_answer;
+        struct wl12xx_command cmd;
+        int ret;
+
+        wl12xx_debug(DEBUG_CMD, "cmd read memory");
+
+        memset(&mem_cmd, 0, sizeof(mem_cmd));
+        mem_cmd.addr = addr;
+        mem_cmd.size = len;
+
+        ret = wl12xx_cmd_send(wl, CMD_READ_MEMORY, &mem_cmd, sizeof(mem_cmd));
+        if (ret < 0) {
+                wl12xx_error("read memory command failed: %d", ret);
+                return ret;
+        }
+
+        /* the read command got in, we can now read the answer */
+        wl12xx_spi_mem_read(wl, wl->cmd_box_addr, &cmd,
+                            CMDMBOX_HEADER_LEN + sizeof(mem_cmd));
+
+        if (cmd.status != CMD_STATUS_SUCCESS)
+                wl12xx_error("error in read command result: %d", cmd.status);
+
+        mem_answer = (struct cmd_read_write_memory *) cmd.parameters;
+        memcpy(answer, mem_answer->value, len);
+
+        return 0;
+}
+
+int wl12xx_cmd_template_set(struct wl12xx *wl, u16 cmd_id,
+                            void *buf, size_t buf_len)
+{
+        struct wl12xx_cmd_packet_template template;
+        int ret;
+
+        wl12xx_debug(DEBUG_CMD, "cmd template %d", cmd_id);
+
+        memset(&template, 0, sizeof(template));
+
+        WARN_ON(buf_len > WL12XX_MAX_TEMPLATE_SIZE);
+        buf_len = min_t(size_t, buf_len, WL12XX_MAX_TEMPLATE_SIZE);
+        template.size = cpu_to_le16(buf_len);
+
+        if (buf)
+                memcpy(template.template, buf, buf_len);
+
+        ret = wl12xx_cmd_send(wl, cmd_id, &template,
+                              sizeof(template.size) + buf_len);
+        if (ret < 0) {
+                wl12xx_warning("cmd set_template failed: %d", ret);
+                return ret;
+        }
+
+        return 0;
+}
diff --git a/drivers/net/wireless/wl12xx/cmd.h b/drivers/net/wireless/wl12xx/cmd.h
new file mode 100644
index 000000000000..aa307dcd081f
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/cmd.h
@@ -0,0 +1,265 @@
+/*
+ * This file is part of wl12xx
+ *
+ * Copyright (c) 1998-2007 Texas Instruments Incorporated
+ * Copyright (C) 2008 Nokia Corporation
+ *
+ * Contact: Kalle Valo <kalle.valo@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __WL12XX_CMD_H__
+#define __WL12XX_CMD_H__
+
+#include "wl12xx.h"
+
+int wl12xx_cmd_send(struct wl12xx *wl, u16 type, void *buf, size_t buf_len);
+int wl12xx_cmd_test(struct wl12xx *wl, void *buf, size_t buf_len, u8 answer);
+int wl12xx_cmd_interrogate(struct wl12xx *wl, u16 ie_id, u16 ie_len,
+                           void *answer);
+int wl12xx_cmd_configure(struct wl12xx *wl, void *ie, int ie_len);
+int wl12xx_cmd_vbm(struct wl12xx *wl, u8 identity,
+                   void *bitmap, u16 bitmap_len, u8 bitmap_control);
+int wl12xx_cmd_data_path(struct wl12xx *wl, u8 channel, u8 enable);
+int wl12xx_cmd_join(struct wl12xx *wl, u8 bss_type, u8 dtim_interval,
+                    u16 beacon_interval, u8 wait);
+int wl12xx_cmd_ps_mode(struct wl12xx *wl, u8 ps_mode);
+int wl12xx_cmd_read_memory(struct wl12xx *wl, u32 addr, u32 len, void *answer);
+int wl12xx_cmd_template_set(struct wl12xx *wl, u16 cmd_id,
+                            void *buf, size_t buf_len);
+
+/* unit ms */
+#define WL12XX_COMMAND_TIMEOUT 2000
+
+#define WL12XX_MAX_TEMPLATE_SIZE 300
+
+struct wl12xx_cmd_packet_template {
+        __le16 size;
+        u8 template[WL12XX_MAX_TEMPLATE_SIZE];
+} __attribute__ ((packed));
+
+enum wl12xx_commands {
+        CMD_RESET           = 0,
+        CMD_INTERROGATE     = 1,    /*use this to read information elements*/
+        CMD_CONFIGURE       = 2,    /*use this to write information elements*/
+        CMD_ENABLE_RX       = 3,
+        CMD_ENABLE_TX       = 4,
+        CMD_DISABLE_RX      = 5,
+        CMD_DISABLE_TX      = 6,
+        CMD_SCAN            = 8,
+        CMD_STOP_SCAN       = 9,
+        CMD_VBM             = 10,
+        CMD_START_JOIN      = 11,
+        CMD_SET_KEYS        = 12,
+        CMD_READ_MEMORY     = 13,
+        CMD_WRITE_MEMORY    = 14,
+        CMD_BEACON          = 19,
+        CMD_PROBE_RESP      = 20,
+        CMD_NULL_DATA       = 21,
+        CMD_PROBE_REQ       = 22,
+        CMD_TEST            = 23,
+        CMD_RADIO_CALIBRATE     = 25,   /* OBSOLETE */
+        CMD_ENABLE_RX_PATH      = 27,   /* OBSOLETE */
+        CMD_NOISE_HIST      = 28,
+        CMD_RX_RESET        = 29,
+        CMD_PS_POLL         = 30,
+        CMD_QOS_NULL_DATA   = 31,
+        CMD_LNA_CONTROL     = 32,
+        CMD_SET_BCN_MODE    = 33,
+        CMD_MEASUREMENT      = 34,
+        CMD_STOP_MEASUREMENT = 35,
+        CMD_DISCONNECT       = 36,
+        CMD_SET_PS_MODE      = 37,
+        CMD_CHANNEL_SWITCH   = 38,
+        CMD_STOP_CHANNEL_SWICTH = 39,
+        CMD_AP_DISCOVERY     = 40,
+        CMD_STOP_AP_DISCOVERY = 41,
+        CMD_SPS_SCAN = 42,
+        CMD_STOP_SPS_SCAN = 43,
+        CMD_HEALTH_CHECK     = 45,
+        CMD_DEBUG            = 46,
+        CMD_TRIGGER_SCAN_TO  = 47,
+
+        NUM_COMMANDS,
+        MAX_COMMAND_ID = 0xFFFF,
+};
+
+#define MAX_CMD_PARAMS 572
+
+struct  wl12xx_command {
+        u16 id;
+        u16 status;
+        u8  parameters[MAX_CMD_PARAMS];
+};
+
+enum {
+        CMD_MAILBOX_IDLE                        =  0,
+        CMD_STATUS_SUCCESS                      =  1,
+        CMD_STATUS_UNKNOWN_CMD                  =  2,
+        CMD_STATUS_UNKNOWN_IE                   =  3,
+        CMD_STATUS_REJECT_MEAS_SG_ACTIVE        = 11,
+        CMD_STATUS_RX_BUSY                      = 13,
+        CMD_STATUS_INVALID_PARAM                = 14,
+        CMD_STATUS_TEMPLATE_TOO_LARGE           = 15,
+        CMD_STATUS_OUT_OF_MEMORY                = 16,
+        CMD_STATUS_STA_TABLE_FULL               = 17,
+        CMD_STATUS_RADIO_ERROR                  = 18,
+        CMD_STATUS_WRONG_NESTING                = 19,
+        CMD_STATUS_TIMEOUT                      = 21, /* Driver internal use.*/
+        CMD_STATUS_FW_RESET                     = 22, /* Driver internal use.*/
+        MAX_COMMAND_STATUS                      = 0xff
+};
+
+
+/*
+ * CMD_READ_MEMORY
+ *
+ * The host issues this command to read the WiLink device memory/registers.
+ *
+ * Note: The Base Band address has special handling (16 bits registers and
+ * addresses). For more information, see the hardware specification.
+ */
+/*
+ * CMD_WRITE_MEMORY
+ *
+ * The host issues this command to write the WiLink device memory/registers.
+ *
+ * The Base Band address has special handling (16 bits registers and
+ * addresses). For more information, see the hardware specification.
+ */
+#define MAX_READ_SIZE 256
+
+struct cmd_read_write_memory {
+        /* The address of the memory to read from or write to.*/
+        u32 addr;
+
+        /* The amount of data in bytes to read from or write to the WiLink
+         * device.*/
+        u32 size;
+
+        /* The actual value read from or written to the Wilink. The source
+           of this field is the Host in WRITE command or the Wilink in READ
+           command. */
+        u8 value[MAX_READ_SIZE];
+};
+
+#define CMDMBOX_HEADER_LEN 4
+#define CMDMBOX_INFO_ELEM_HEADER_LEN 4
+
+
+struct basic_scan_parameters {
+        u32 rx_config_options;
+        u32 rx_filter_options;
+
+        /*
+         * Scan options:
+         * bit 0: When this bit is set, passive scan.
+         * bit 1: Band, when this bit is set we scan
+         * in the 5Ghz band.
+         * bit 2: voice mode, 0 for normal scan.
+         * bit 3: scan priority, 1 for high priority.
+         */
+        u16 scan_options;
+
+        /* Number of channels to scan */
+        u8 num_channels;
+
+        /* Number opf probe requests to send, per channel */
+        u8 num_probe_requests;
+
+        /* Rate and modulation for probe requests */
+        u16 tx_rate;
+
+        u8 tid_trigger;
+        u8 ssid_len;
+        u32 ssid[8];
+
+} __attribute__ ((packed));
+
+struct basic_scan_channel_parameters {
+        u32 min_duration; /* in TU */
+        u32 max_duration; /* in TU */
+        u32 bssid_lsb;
+        u16 bssid_msb;
+
+        /*
+         * bits 0-3: Early termination count.
+         * bits 4-5: Early termination condition.
+         */
+        u8 early_termination;
+
+        u8 tx_power_att;
+        u8 channel;
+        u8 pad[3];
+} __attribute__ ((packed));
+
+/* SCAN parameters */
+#define SCAN_MAX_NUM_OF_CHANNELS 16
+
+struct cmd_scan {
+        struct basic_scan_parameters params;
+        struct basic_scan_channel_parameters channels[SCAN_MAX_NUM_OF_CHANNELS];
+} __attribute__ ((packed));
+
+enum {
+        BSS_TYPE_IBSS = 0,
+        BSS_TYPE_STA_BSS = 2,
+        BSS_TYPE_AP_BSS = 3,
+        MAX_BSS_TYPE = 0xFF
+};
+
+#define JOIN_CMD_CTRL_TX_FLUSH             0x80 /* Firmware flushes all Tx */
+#define JOIN_CMD_CTRL_EARLY_WAKEUP_ENABLE  0x01 /* Early wakeup time */
+
+
+struct cmd_join {
+        u32 bssid_lsb;
+        u16 bssid_msb;
+        u16 beacon_interval; /* in TBTTs */
+        u32 rx_config_options;
+        u32 rx_filter_options;
+
+        /*
+         * The target uses this field to determine the rate at
+         * which to transmit control frame responses (such as
+         * ACK or CTS frames).
+         */
+        u16 basic_rate_set;
+        u8 dtim_interval;
+        u8 tx_ctrl_frame_rate; /* OBSOLETE */
+        u8 tx_ctrl_frame_mod;  /* OBSOLETE */
+        /*
+         * bits 0-2: This bitwise field specifies the type
+         * of BSS to start or join (BSS_TYPE_*).
+         * bit 4: Band - The radio band in which to join
+         * or start.
+         *  0 - 2.4GHz band
+         *  1 - 5GHz band
+         * bits 3, 5-7: Reserved
+         */
+        u8 bss_type;
+        u8 channel;
+        u8 ssid_len;
+        u8 ssid[IW_ESSID_MAX_SIZE];
+        u8 ctrl; /* JOIN_CMD_CTRL_* */
+        u8 tx_mgt_frame_rate; /* OBSOLETE */
+        u8 tx_mgt_frame_mod;  /* OBSOLETE */
+        u8 reserved;
+} __attribute__ ((packed));
+
+
+#endif /* __WL12XX_CMD_H__ */
diff --git a/drivers/net/wireless/wl12xx/debugfs.c b/drivers/net/wireless/wl12xx/debugfs.c
new file mode 100644
index 000000000000..cdb368ce4dae
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/debugfs.c
@@ -0,0 +1,508 @@
+/*
+ * This file is part of wl12xx
+ *
+ * Copyright (C) 2009 Nokia Corporation
+ *
+ * Contact: Kalle Valo <kalle.valo@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include "debugfs.h"
+
+#include <linux/skbuff.h>
+
+#include "wl12xx.h"
+#include "acx.h"
+
+/* ms */
+#define WL12XX_DEBUGFS_STATS_LIFETIME 1000
+
+/* debugfs macros idea from mac80211 */
+
+#define DEBUGFS_READONLY_FILE(name, buflen, fmt, value...)              \
+static ssize_t name## _read(struct file *file, char __user *userbuf,    \
+                            size_t count, loff_t *ppos)                 \
+{                                                                       \
+        struct wl12xx *wl = file->private_data;                         \
+        char buf[buflen];                                               \
+        int res;                                                        \
+                                                                        \
+        res = scnprintf(buf, buflen, fmt "\n", ##value);                \
+        return simple_read_from_buffer(userbuf, count, ppos, buf, res); \
+}                                                                       \
+                                                                        \
+static const struct file_operations name## _ops = {                     \
+        .read = name## _read,                                           \
+        .open = wl12xx_open_file_generic,                               \
+};
+
+#define DEBUGFS_ADD(name, parent)                                       \
+        wl->debugfs.name = debugfs_create_file(#name, 0400, parent,     \
+                                               wl, &name## _ops);       \
+        if (IS_ERR(wl->debugfs.name)) {                                 \
+                ret = PTR_ERR(wl->debugfs.name);                        \
+                wl->debugfs.name = NULL;                                \
+                goto out;                                               \
+        }
+
+#define DEBUGFS_DEL(name)                                               \
+        do {                                                            \
+                debugfs_remove(wl->debugfs.name);                       \
+                wl->debugfs.name = NULL;                                \
+        } while (0)
+
+#define DEBUGFS_FWSTATS_FILE(sub, name, buflen, fmt)                    \
+static ssize_t sub## _ ##name## _read(struct file *file,                \
+                                      char __user *userbuf,             \
+                                      size_t count, loff_t *ppos)       \
+{                                                                       \
+        struct wl12xx *wl = file->private_data;                         \
+        char buf[buflen];                                               \
+        int res;                                                        \
+                                                                        \
+        wl12xx_debugfs_update_stats(wl);                                \
+                                                                        \
+        res = scnprintf(buf, buflen, fmt "\n",                          \
+                        wl->stats.fw_stats->sub.name);                  \
+        return simple_read_from_buffer(userbuf, count, ppos, buf, res); \
+}                                                                       \
+                                                                        \
+static const struct file_operations sub## _ ##name## _ops = {           \
+        .read = sub## _ ##name## _read,                                 \
+        .open = wl12xx_open_file_generic,                               \
+};
+
+#define DEBUGFS_FWSTATS_ADD(sub, name)                          \
+        DEBUGFS_ADD(sub## _ ##name, wl->debugfs.fw_statistics)
+
+#define DEBUGFS_FWSTATS_DEL(sub, name)                          \
+        DEBUGFS_DEL(sub## _ ##name)
+
+static void wl12xx_debugfs_update_stats(struct wl12xx *wl)
+{
+        mutex_lock(&wl->mutex);
+
+        if (wl->state == WL12XX_STATE_ON &&
+            time_after(jiffies, wl->stats.fw_stats_update +
+                       msecs_to_jiffies(WL12XX_DEBUGFS_STATS_LIFETIME))) {
+                wl12xx_acx_statistics(wl, wl->stats.fw_stats);
+                wl->stats.fw_stats_update = jiffies;
+        }
+
+        mutex_unlock(&wl->mutex);
+}
+
+static int wl12xx_open_file_generic(struct inode *inode, struct file *file)
+{
+        file->private_data = inode->i_private;
+        return 0;
+}
+
+DEBUGFS_FWSTATS_FILE(tx, internal_desc_overflow, 20, "%u");
+
+DEBUGFS_FWSTATS_FILE(rx, out_of_mem, 20, "%u");
+DEBUGFS_FWSTATS_FILE(rx, hdr_overflow, 20, "%u");
+DEBUGFS_FWSTATS_FILE(rx, hw_stuck, 20, "%u");
+DEBUGFS_FWSTATS_FILE(rx, dropped, 20, "%u");
+DEBUGFS_FWSTATS_FILE(rx, fcs_err, 20, "%u");
+DEBUGFS_FWSTATS_FILE(rx, xfr_hint_trig, 20, "%u");
+DEBUGFS_FWSTATS_FILE(rx, path_reset, 20, "%u");
+DEBUGFS_FWSTATS_FILE(rx, reset_counter, 20, "%u");
+
+DEBUGFS_FWSTATS_FILE(dma, rx_requested, 20, "%u");
+DEBUGFS_FWSTATS_FILE(dma, rx_errors, 20, "%u");
+DEBUGFS_FWSTATS_FILE(dma, tx_requested, 20, "%u");
+DEBUGFS_FWSTATS_FILE(dma, tx_errors, 20, "%u");
+
+DEBUGFS_FWSTATS_FILE(isr, cmd_cmplt, 20, "%u");
+DEBUGFS_FWSTATS_FILE(isr, fiqs, 20, "%u");
+DEBUGFS_FWSTATS_FILE(isr, rx_headers, 20, "%u");
+DEBUGFS_FWSTATS_FILE(isr, rx_mem_overflow, 20, "%u");
+DEBUGFS_FWSTATS_FILE(isr, rx_rdys, 20, "%u");
+DEBUGFS_FWSTATS_FILE(isr, irqs, 20, "%u");
+DEBUGFS_FWSTATS_FILE(isr, tx_procs, 20, "%u");
+DEBUGFS_FWSTATS_FILE(isr, decrypt_done, 20, "%u");
+DEBUGFS_FWSTATS_FILE(isr, dma0_done, 20, "%u");
+DEBUGFS_FWSTATS_FILE(isr, dma1_done, 20, "%u");
+DEBUGFS_FWSTATS_FILE(isr, tx_exch_complete, 20, "%u");
+DEBUGFS_FWSTATS_FILE(isr, commands, 20, "%u");
+DEBUGFS_FWSTATS_FILE(isr, rx_procs, 20, "%u");
+DEBUGFS_FWSTATS_FILE(isr, hw_pm_mode_changes, 20, "%u");
+DEBUGFS_FWSTATS_FILE(isr, host_acknowledges, 20, "%u");
+DEBUGFS_FWSTATS_FILE(isr, pci_pm, 20, "%u");
+DEBUGFS_FWSTATS_FILE(isr, wakeups, 20, "%u");
+DEBUGFS_FWSTATS_FILE(isr, low_rssi, 20, "%u");
+
+DEBUGFS_FWSTATS_FILE(wep, addr_key_count, 20, "%u");
+DEBUGFS_FWSTATS_FILE(wep, default_key_count, 20, "%u");
+/* skipping wep.reserved */
+DEBUGFS_FWSTATS_FILE(wep, key_not_found, 20, "%u");
+DEBUGFS_FWSTATS_FILE(wep, decrypt_fail, 20, "%u");
+DEBUGFS_FWSTATS_FILE(wep, packets, 20, "%u");
+DEBUGFS_FWSTATS_FILE(wep, interrupt, 20, "%u");
+
+DEBUGFS_FWSTATS_FILE(pwr, ps_enter, 20, "%u");
+DEBUGFS_FWSTATS_FILE(pwr, elp_enter, 20, "%u");
+DEBUGFS_FWSTATS_FILE(pwr, missing_bcns, 20, "%u");
+DEBUGFS_FWSTATS_FILE(pwr, wake_on_host, 20, "%u");
+DEBUGFS_FWSTATS_FILE(pwr, wake_on_timer_exp, 20, "%u");
+DEBUGFS_FWSTATS_FILE(pwr, tx_with_ps, 20, "%u");
+DEBUGFS_FWSTATS_FILE(pwr, tx_without_ps, 20, "%u");
+DEBUGFS_FWSTATS_FILE(pwr, rcvd_beacons, 20, "%u");
+DEBUGFS_FWSTATS_FILE(pwr, power_save_off, 20, "%u");
+DEBUGFS_FWSTATS_FILE(pwr, enable_ps, 20, "%u");
+DEBUGFS_FWSTATS_FILE(pwr, disable_ps, 20, "%u");
+DEBUGFS_FWSTATS_FILE(pwr, fix_tsf_ps, 20, "%u");
+/* skipping cont_miss_bcns_spread for now */
+DEBUGFS_FWSTATS_FILE(pwr, rcvd_awake_beacons, 20, "%u");
+
+DEBUGFS_FWSTATS_FILE(mic, rx_pkts, 20, "%u");
+DEBUGFS_FWSTATS_FILE(mic, calc_failure, 20, "%u");
+
+DEBUGFS_FWSTATS_FILE(aes, encrypt_fail, 20, "%u");
+DEBUGFS_FWSTATS_FILE(aes, decrypt_fail, 20, "%u");
+DEBUGFS_FWSTATS_FILE(aes, encrypt_packets, 20, "%u");
+DEBUGFS_FWSTATS_FILE(aes, decrypt_packets, 20, "%u");
+DEBUGFS_FWSTATS_FILE(aes, encrypt_interrupt, 20, "%u");
+DEBUGFS_FWSTATS_FILE(aes, decrypt_interrupt, 20, "%u");
+
+DEBUGFS_FWSTATS_FILE(event, heart_beat, 20, "%u");
+DEBUGFS_FWSTATS_FILE(event, calibration, 20, "%u");
+DEBUGFS_FWSTATS_FILE(event, rx_mismatch, 20, "%u");
+DEBUGFS_FWSTATS_FILE(event, rx_mem_empty, 20, "%u");
+DEBUGFS_FWSTATS_FILE(event, rx_pool, 20, "%u");
+DEBUGFS_FWSTATS_FILE(event, oom_late, 20, "%u");
+DEBUGFS_FWSTATS_FILE(event, phy_transmit_error, 20, "%u");
+DEBUGFS_FWSTATS_FILE(event, tx_stuck, 20, "%u");
+
+DEBUGFS_FWSTATS_FILE(ps, pspoll_timeouts, 20, "%u");
+DEBUGFS_FWSTATS_FILE(ps, upsd_timeouts, 20, "%u");
+DEBUGFS_FWSTATS_FILE(ps, upsd_max_sptime, 20, "%u");
+DEBUGFS_FWSTATS_FILE(ps, upsd_max_apturn, 20, "%u");
+DEBUGFS_FWSTATS_FILE(ps, pspoll_max_apturn, 20, "%u");
+DEBUGFS_FWSTATS_FILE(ps, pspoll_utilization, 20, "%u");
+DEBUGFS_FWSTATS_FILE(ps, upsd_utilization, 20, "%u");
+
+DEBUGFS_FWSTATS_FILE(rxpipe, rx_prep_beacon_drop, 20, "%u");
+DEBUGFS_FWSTATS_FILE(rxpipe, descr_host_int_trig_rx_data, 20, "%u");
+DEBUGFS_FWSTATS_FILE(rxpipe, beacon_buffer_thres_host_int_trig_rx_data,
+                     20, "%u");
+DEBUGFS_FWSTATS_FILE(rxpipe, missed_beacon_host_int_trig_rx_data, 20, "%u");
+DEBUGFS_FWSTATS_FILE(rxpipe, tx_xfr_host_int_trig_rx_data, 20, "%u");
+
+DEBUGFS_READONLY_FILE(retry_count, 20, "%u", wl->stats.retry_count);
+DEBUGFS_READONLY_FILE(excessive_retries, 20, "%u",
+                      wl->stats.excessive_retries);
+
+static ssize_t tx_queue_len_read(struct file *file, char __user *userbuf,
+                                 size_t count, loff_t *ppos)
+{
+        struct wl12xx *wl = file->private_data;
+        u32 queue_len;
+        char buf[20];
+        int res;
+
+        queue_len = skb_queue_len(&wl->tx_queue);
+
+        res = scnprintf(buf, sizeof(buf), "%u\n", queue_len);
+        return simple_read_from_buffer(userbuf, count, ppos, buf, res);
+}
+
+static const struct file_operations tx_queue_len_ops = {
+        .read = tx_queue_len_read,
+        .open = wl12xx_open_file_generic,
+};
+
+static void wl12xx_debugfs_delete_files(struct wl12xx *wl)
+{
+        DEBUGFS_FWSTATS_DEL(tx, internal_desc_overflow);
+
+        DEBUGFS_FWSTATS_DEL(rx, out_of_mem);
+        DEBUGFS_FWSTATS_DEL(rx, hdr_overflow);
+        DEBUGFS_FWSTATS_DEL(rx, hw_stuck);
+        DEBUGFS_FWSTATS_DEL(rx, dropped);
+        DEBUGFS_FWSTATS_DEL(rx, fcs_err);
+        DEBUGFS_FWSTATS_DEL(rx, xfr_hint_trig);
+        DEBUGFS_FWSTATS_DEL(rx, path_reset);
+        DEBUGFS_FWSTATS_DEL(rx, reset_counter);
+
+        DEBUGFS_FWSTATS_DEL(dma, rx_requested);
+        DEBUGFS_FWSTATS_DEL(dma, rx_errors);
+        DEBUGFS_FWSTATS_DEL(dma, tx_requested);
+        DEBUGFS_FWSTATS_DEL(dma, tx_errors);
+
+        DEBUGFS_FWSTATS_DEL(isr, cmd_cmplt);
+        DEBUGFS_FWSTATS_DEL(isr, fiqs);
+        DEBUGFS_FWSTATS_DEL(isr, rx_headers);
+        DEBUGFS_FWSTATS_DEL(isr, rx_mem_overflow);
+        DEBUGFS_FWSTATS_DEL(isr, rx_rdys);
+        DEBUGFS_FWSTATS_DEL(isr, irqs);
+        DEBUGFS_FWSTATS_DEL(isr, tx_procs);
+        DEBUGFS_FWSTATS_DEL(isr, decrypt_done);
+        DEBUGFS_FWSTATS_DEL(isr, dma0_done);
+        DEBUGFS_FWSTATS_DEL(isr, dma1_done);
+        DEBUGFS_FWSTATS_DEL(isr, tx_exch_complete);
+        DEBUGFS_FWSTATS_DEL(isr, commands);
+        DEBUGFS_FWSTATS_DEL(isr, rx_procs);
+        DEBUGFS_FWSTATS_DEL(isr, hw_pm_mode_changes);
+        DEBUGFS_FWSTATS_DEL(isr, host_acknowledges);
+        DEBUGFS_FWSTATS_DEL(isr, pci_pm);
+        DEBUGFS_FWSTATS_DEL(isr, wakeups);
+        DEBUGFS_FWSTATS_DEL(isr, low_rssi);
+
+        DEBUGFS_FWSTATS_DEL(wep, addr_key_count);
+        DEBUGFS_FWSTATS_DEL(wep, default_key_count);
+        /* skipping wep.reserved */
+        DEBUGFS_FWSTATS_DEL(wep, key_not_found);
+        DEBUGFS_FWSTATS_DEL(wep, decrypt_fail);
+        DEBUGFS_FWSTATS_DEL(wep, packets);
+        DEBUGFS_FWSTATS_DEL(wep, interrupt);
+
+        DEBUGFS_FWSTATS_DEL(pwr, ps_enter);
+        DEBUGFS_FWSTATS_DEL(pwr, elp_enter);
+        DEBUGFS_FWSTATS_DEL(pwr, missing_bcns);
+        DEBUGFS_FWSTATS_DEL(pwr, wake_on_host);
+        DEBUGFS_FWSTATS_DEL(pwr, wake_on_timer_exp);
+        DEBUGFS_FWSTATS_DEL(pwr, tx_with_ps);
+        DEBUGFS_FWSTATS_DEL(pwr, tx_without_ps);
+        DEBUGFS_FWSTATS_DEL(pwr, rcvd_beacons);
+        DEBUGFS_FWSTATS_DEL(pwr, power_save_off);
+        DEBUGFS_FWSTATS_DEL(pwr, enable_ps);
+        DEBUGFS_FWSTATS_DEL(pwr, disable_ps);
+        DEBUGFS_FWSTATS_DEL(pwr, fix_tsf_ps);
+        /* skipping cont_miss_bcns_spread for now */
+        DEBUGFS_FWSTATS_DEL(pwr, rcvd_awake_beacons);
+
+        DEBUGFS_FWSTATS_DEL(mic, rx_pkts);
+        DEBUGFS_FWSTATS_DEL(mic, calc_failure);
+
+        DEBUGFS_FWSTATS_DEL(aes, encrypt_fail);
+        DEBUGFS_FWSTATS_DEL(aes, decrypt_fail);
+        DEBUGFS_FWSTATS_DEL(aes, encrypt_packets);
+        DEBUGFS_FWSTATS_DEL(aes, decrypt_packets);
+        DEBUGFS_FWSTATS_DEL(aes, encrypt_interrupt);
+        DEBUGFS_FWSTATS_DEL(aes, decrypt_interrupt);
+
+        DEBUGFS_FWSTATS_DEL(event, heart_beat);
+        DEBUGFS_FWSTATS_DEL(event, calibration);
+        DEBUGFS_FWSTATS_DEL(event, rx_mismatch);
+        DEBUGFS_FWSTATS_DEL(event, rx_mem_empty);
+        DEBUGFS_FWSTATS_DEL(event, rx_pool);
+        DEBUGFS_FWSTATS_DEL(event, oom_late);
+        DEBUGFS_FWSTATS_DEL(event, phy_transmit_error);
+        DEBUGFS_FWSTATS_DEL(event, tx_stuck);
+
+        DEBUGFS_FWSTATS_DEL(ps, pspoll_timeouts);
+        DEBUGFS_FWSTATS_DEL(ps, upsd_timeouts);
+        DEBUGFS_FWSTATS_DEL(ps, upsd_max_sptime);
+        DEBUGFS_FWSTATS_DEL(ps, upsd_max_apturn);
+        DEBUGFS_FWSTATS_DEL(ps, pspoll_max_apturn);
+        DEBUGFS_FWSTATS_DEL(ps, pspoll_utilization);
+        DEBUGFS_FWSTATS_DEL(ps, upsd_utilization);
+
+        DEBUGFS_FWSTATS_DEL(rxpipe, rx_prep_beacon_drop);
+        DEBUGFS_FWSTATS_DEL(rxpipe, descr_host_int_trig_rx_data);
+        DEBUGFS_FWSTATS_DEL(rxpipe, beacon_buffer_thres_host_int_trig_rx_data);
+        DEBUGFS_FWSTATS_DEL(rxpipe, missed_beacon_host_int_trig_rx_data);
+        DEBUGFS_FWSTATS_DEL(rxpipe, tx_xfr_host_int_trig_rx_data);
+
+        DEBUGFS_DEL(tx_queue_len);
+        DEBUGFS_DEL(retry_count);
+        DEBUGFS_DEL(excessive_retries);
+}
+
+static int wl12xx_debugfs_add_files(struct wl12xx *wl)
+{
+        int ret = 0;
+
+        DEBUGFS_FWSTATS_ADD(tx, internal_desc_overflow);
+
+        DEBUGFS_FWSTATS_ADD(rx, out_of_mem);
+        DEBUGFS_FWSTATS_ADD(rx, hdr_overflow);
+        DEBUGFS_FWSTATS_ADD(rx, hw_stuck);
+        DEBUGFS_FWSTATS_ADD(rx, dropped);
+        DEBUGFS_FWSTATS_ADD(rx, fcs_err);
+        DEBUGFS_FWSTATS_ADD(rx, xfr_hint_trig);
+        DEBUGFS_FWSTATS_ADD(rx, path_reset);
+        DEBUGFS_FWSTATS_ADD(rx, reset_counter);
+
+        DEBUGFS_FWSTATS_ADD(dma, rx_requested);
+        DEBUGFS_FWSTATS_ADD(dma, rx_errors);
+        DEBUGFS_FWSTATS_ADD(dma, tx_requested);
+        DEBUGFS_FWSTATS_ADD(dma, tx_errors);
+
+        DEBUGFS_FWSTATS_ADD(isr, cmd_cmplt);
+        DEBUGFS_FWSTATS_ADD(isr, fiqs);
+        DEBUGFS_FWSTATS_ADD(isr, rx_headers);
+        DEBUGFS_FWSTATS_ADD(isr, rx_mem_overflow);
+        DEBUGFS_FWSTATS_ADD(isr, rx_rdys);
+        DEBUGFS_FWSTATS_ADD(isr, irqs);
+        DEBUGFS_FWSTATS_ADD(isr, tx_procs);
+        DEBUGFS_FWSTATS_ADD(isr, decrypt_done);
+        DEBUGFS_FWSTATS_ADD(isr, dma0_done);
+        DEBUGFS_FWSTATS_ADD(isr, dma1_done);
+        DEBUGFS_FWSTATS_ADD(isr, tx_exch_complete);
+        DEBUGFS_FWSTATS_ADD(isr, commands);
+        DEBUGFS_FWSTATS_ADD(isr, rx_procs);
+        DEBUGFS_FWSTATS_ADD(isr, hw_pm_mode_changes);
+        DEBUGFS_FWSTATS_ADD(isr, host_acknowledges);
+        DEBUGFS_FWSTATS_ADD(isr, pci_pm);
+        DEBUGFS_FWSTATS_ADD(isr, wakeups);
+        DEBUGFS_FWSTATS_ADD(isr, low_rssi);
+
+        DEBUGFS_FWSTATS_ADD(wep, addr_key_count);
+        DEBUGFS_FWSTATS_ADD(wep, default_key_count);
+        /* skipping wep.reserved */
+        DEBUGFS_FWSTATS_ADD(wep, key_not_found);
+        DEBUGFS_FWSTATS_ADD(wep, decrypt_fail);
+        DEBUGFS_FWSTATS_ADD(wep, packets);
+        DEBUGFS_FWSTATS_ADD(wep, interrupt);
+
+        DEBUGFS_FWSTATS_ADD(pwr, ps_enter);
+        DEBUGFS_FWSTATS_ADD(pwr, elp_enter);
+        DEBUGFS_FWSTATS_ADD(pwr, missing_bcns);
+        DEBUGFS_FWSTATS_ADD(pwr, wake_on_host);
+        DEBUGFS_FWSTATS_ADD(pwr, wake_on_timer_exp);
+        DEBUGFS_FWSTATS_ADD(pwr, tx_with_ps);
+        DEBUGFS_FWSTATS_ADD(pwr, tx_without_ps);
+        DEBUGFS_FWSTATS_ADD(pwr, rcvd_beacons);
+        DEBUGFS_FWSTATS_ADD(pwr, power_save_off);
+        DEBUGFS_FWSTATS_ADD(pwr, enable_ps);
+        DEBUGFS_FWSTATS_ADD(pwr, disable_ps);
+        DEBUGFS_FWSTATS_ADD(pwr, fix_tsf_ps);
+        /* skipping cont_miss_bcns_spread for now */
+        DEBUGFS_FWSTATS_ADD(pwr, rcvd_awake_beacons);
+
+        DEBUGFS_FWSTATS_ADD(mic, rx_pkts);
+        DEBUGFS_FWSTATS_ADD(mic, calc_failure);
+
+        DEBUGFS_FWSTATS_ADD(aes, encrypt_fail);
+        DEBUGFS_FWSTATS_ADD(aes, decrypt_fail);
+        DEBUGFS_FWSTATS_ADD(aes, encrypt_packets);
+        DEBUGFS_FWSTATS_ADD(aes, decrypt_packets);
+        DEBUGFS_FWSTATS_ADD(aes, encrypt_interrupt);
+        DEBUGFS_FWSTATS_ADD(aes, decrypt_interrupt);
+
+        DEBUGFS_FWSTATS_ADD(event, heart_beat);
+        DEBUGFS_FWSTATS_ADD(event, calibration);
+        DEBUGFS_FWSTATS_ADD(event, rx_mismatch);
+        DEBUGFS_FWSTATS_ADD(event, rx_mem_empty);
+        DEBUGFS_FWSTATS_ADD(event, rx_pool);
+        DEBUGFS_FWSTATS_ADD(event, oom_late);
+        DEBUGFS_FWSTATS_ADD(event, phy_transmit_error);
+        DEBUGFS_FWSTATS_ADD(event, tx_stuck);
+
+        DEBUGFS_FWSTATS_ADD(ps, pspoll_timeouts);
+        DEBUGFS_FWSTATS_ADD(ps, upsd_timeouts);
+        DEBUGFS_FWSTATS_ADD(ps, upsd_max_sptime);
+        DEBUGFS_FWSTATS_ADD(ps, upsd_max_apturn);
+        DEBUGFS_FWSTATS_ADD(ps, pspoll_max_apturn);
+        DEBUGFS_FWSTATS_ADD(ps, pspoll_utilization);
+        DEBUGFS_FWSTATS_ADD(ps, upsd_utilization);
+
+        DEBUGFS_FWSTATS_ADD(rxpipe, rx_prep_beacon_drop);
+        DEBUGFS_FWSTATS_ADD(rxpipe, descr_host_int_trig_rx_data);
+        DEBUGFS_FWSTATS_ADD(rxpipe, beacon_buffer_thres_host_int_trig_rx_data);
+        DEBUGFS_FWSTATS_ADD(rxpipe, missed_beacon_host_int_trig_rx_data);
+        DEBUGFS_FWSTATS_ADD(rxpipe, tx_xfr_host_int_trig_rx_data);
+
+        DEBUGFS_ADD(tx_queue_len, wl->debugfs.rootdir);
+        DEBUGFS_ADD(retry_count, wl->debugfs.rootdir);
+        DEBUGFS_ADD(excessive_retries, wl->debugfs.rootdir);
+
+out:
+        if (ret < 0)
+                wl12xx_debugfs_delete_files(wl);
+
+        return ret;
+}
+
+void wl12xx_debugfs_reset(struct wl12xx *wl)
+{
+        memset(wl->stats.fw_stats, 0, sizeof(*wl->stats.fw_stats));
+        wl->stats.retry_count = 0;
+        wl->stats.excessive_retries = 0;
+}
+
+int wl12xx_debugfs_init(struct wl12xx *wl)
+{
+        int ret;
+
+        wl->debugfs.rootdir = debugfs_create_dir(KBUILD_MODNAME, NULL);
+
+        if (IS_ERR(wl->debugfs.rootdir)) {
+                ret = PTR_ERR(wl->debugfs.rootdir);
+                wl->debugfs.rootdir = NULL;
+                goto err;
+        }
+
+        wl->debugfs.fw_statistics = debugfs_create_dir("fw-statistics",
+                                                       wl->debugfs.rootdir);
+
+        if (IS_ERR(wl->debugfs.fw_statistics)) {
+                ret = PTR_ERR(wl->debugfs.fw_statistics);
+                wl->debugfs.fw_statistics = NULL;
+                goto err_root;
+        }
+
+        wl->stats.fw_stats = kzalloc(sizeof(*wl->stats.fw_stats),
+                                      GFP_KERNEL);
+
+        if (!wl->stats.fw_stats) {
+                ret = -ENOMEM;
+                goto err_fw;
+        }
+
+        wl->stats.fw_stats_update = jiffies;
+
+        ret = wl12xx_debugfs_add_files(wl);
+
+        if (ret < 0)
+                goto err_file;
+
+        return 0;
+
+err_file:
+        kfree(wl->stats.fw_stats);
+        wl->stats.fw_stats = NULL;
+
+err_fw:
+        debugfs_remove(wl->debugfs.fw_statistics);
+        wl->debugfs.fw_statistics = NULL;
+
+err_root:
+        debugfs_remove(wl->debugfs.rootdir);
+        wl->debugfs.rootdir = NULL;
+
+err:
+        return ret;
+}
+
+void wl12xx_debugfs_exit(struct wl12xx *wl)
+{
+        wl12xx_debugfs_delete_files(wl);
+
+        kfree(wl->stats.fw_stats);
+        wl->stats.fw_stats = NULL;
+
+        debugfs_remove(wl->debugfs.fw_statistics);
+        wl->debugfs.fw_statistics = NULL;
+
+        debugfs_remove(wl->debugfs.rootdir);
+        wl->debugfs.rootdir = NULL;
+
+}
diff --git a/drivers/net/wireless/wl12xx/debugfs.h b/drivers/net/wireless/wl12xx/debugfs.h
new file mode 100644
index 000000000000..562cdcbcc874
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/debugfs.h
@@ -0,0 +1,33 @@
+/*
+ * This file is part of wl12xx
+ *
+ * Copyright (C) 2009 Nokia Corporation
+ *
+ * Contact: Kalle Valo <kalle.valo@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef WL12XX_DEBUGFS_H
+#define WL12XX_DEBUGFS_H
+
+#include "wl12xx.h"
+
+int wl12xx_debugfs_init(struct wl12xx *wl);
+void wl12xx_debugfs_exit(struct wl12xx *wl);
+void wl12xx_debugfs_reset(struct wl12xx *wl);
+
+#endif /* WL12XX_DEBUGFS_H */
diff --git a/drivers/net/wireless/wl12xx/event.c b/drivers/net/wireless/wl12xx/event.c
new file mode 100644
index 000000000000..99529ca89a7e
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/event.c
@@ -0,0 +1,127 @@
+/*
+ * This file is part of wl12xx
+ *
+ * Copyright (c) 1998-2007 Texas Instruments Incorporated
+ * Copyright (C) 2008 Nokia Corporation
+ *
+ * Contact: Kalle Valo <kalle.valo@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include "wl12xx.h"
+#include "reg.h"
+#include "spi.h"
+#include "event.h"
+#include "ps.h"
+
+static int wl12xx_event_scan_complete(struct wl12xx *wl,
+                                      struct event_mailbox *mbox)
+{
+        wl12xx_debug(DEBUG_EVENT, "status: 0x%x, channels: %d",
+                     mbox->scheduled_scan_status,
+                     mbox->scheduled_scan_channels);
+
+        if (wl->scanning) {
+                mutex_unlock(&wl->mutex);
+                ieee80211_scan_completed(wl->hw, false);
+                mutex_lock(&wl->mutex);
+                wl->scanning = false;
+        }
+
+        return 0;
+}
+
+static void wl12xx_event_mbox_dump(struct event_mailbox *mbox)
+{
+        wl12xx_debug(DEBUG_EVENT, "MBOX DUMP:");
+        wl12xx_debug(DEBUG_EVENT, "\tvector: 0x%x", mbox->events_vector);
+        wl12xx_debug(DEBUG_EVENT, "\tmask: 0x%x", mbox->events_mask);
+}
+
+static int wl12xx_event_process(struct wl12xx *wl, struct event_mailbox *mbox)
+{
+        int ret;
+        u32 vector;
+
+        wl12xx_event_mbox_dump(mbox);
+
+        vector = mbox->events_vector & ~(mbox->events_mask);
+        wl12xx_debug(DEBUG_EVENT, "vector: 0x%x", vector);
+
+        if (vector & SCAN_COMPLETE_EVENT_ID) {
+                ret = wl12xx_event_scan_complete(wl, mbox);
+                if (ret < 0)
+                        return ret;
+        }
+
+        if (vector & BSS_LOSE_EVENT_ID) {
+                wl12xx_debug(DEBUG_EVENT, "BSS_LOSE_EVENT");
+
+                if (wl->psm_requested && wl->psm) {
+                        ret = wl12xx_ps_set_mode(wl, STATION_ACTIVE_MODE);
+                        if (ret < 0)
+                                return ret;
+                }
+        }
+
+        return 0;
+}
+
+int wl12xx_event_unmask(struct wl12xx *wl)
+{
+        int ret;
+
+        ret = wl12xx_acx_event_mbox_mask(wl, ~(wl->event_mask));
+        if (ret < 0)
+                return ret;
+
+        return 0;
+}
+
+void wl12xx_event_mbox_config(struct wl12xx *wl)
+{
+        wl->mbox_ptr[0] = wl12xx_reg_read32(wl, REG_EVENT_MAILBOX_PTR);
+        wl->mbox_ptr[1] = wl->mbox_ptr[0] + sizeof(struct event_mailbox);
+
+        wl12xx_debug(DEBUG_EVENT, "MBOX ptrs: 0x%x 0x%x",
+                     wl->mbox_ptr[0], wl->mbox_ptr[1]);
+}
+
+int wl12xx_event_handle(struct wl12xx *wl, u8 mbox_num)
+{
+        struct event_mailbox mbox;
+        int ret;
+
+        wl12xx_debug(DEBUG_EVENT, "EVENT on mbox %d", mbox_num);
+
+        if (mbox_num > 1)
+                return -EINVAL;
+
+        /* first we read the mbox descriptor */
+        wl12xx_spi_mem_read(wl, wl->mbox_ptr[mbox_num], &mbox,
+                            sizeof(struct event_mailbox));
+
+        /* process the descriptor */
+        ret = wl12xx_event_process(wl, &mbox);
+        if (ret < 0)
+                return ret;
+
+        /* then we let the firmware know it can go on...*/
+        wl12xx_reg_write32(wl, ACX_REG_INTERRUPT_TRIG, INTR_TRIG_EVENT_ACK);
+
+        return 0;
+}
diff --git a/drivers/net/wireless/wl12xx/event.h b/drivers/net/wireless/wl12xx/event.h
new file mode 100644
index 000000000000..1f4c2f7438a7
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/event.h
@@ -0,0 +1,121 @@
+/*
+ * This file is part of wl12xx
+ *
+ * Copyright (c) 1998-2007 Texas Instruments Incorporated
+ * Copyright (C) 2008 Nokia Corporation
+ *
+ * Contact: Kalle Valo <kalle.valo@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __WL12XX_EVENT_H__
+#define __WL12XX_EVENT_H__
+
+/*
+ * Mbox events
+ *
+ * The event mechanism is based on a pair of event buffers (buffers A and
+ * B) at fixed locations in the target's memory. The host processes one
+ * buffer while the other buffer continues to collect events. If the host
+ * is not processing events, an interrupt is issued to signal that a buffer
+ * is ready. Once the host is done with processing events from one buffer,
+ * it signals the target (with an ACK interrupt) that the event buffer is
+ * free.
+ */
+
+enum {
+        RESERVED1_EVENT_ID                       = BIT(0),
+        RESERVED2_EVENT_ID                       = BIT(1),
+        MEASUREMENT_START_EVENT_ID               = BIT(2),
+        SCAN_COMPLETE_EVENT_ID                   = BIT(3),
+        CALIBRATION_COMPLETE_EVENT_ID            = BIT(4),
+        ROAMING_TRIGGER_LOW_RSSI_EVENT_ID        = BIT(5),
+        PS_REPORT_EVENT_ID                       = BIT(6),
+        SYNCHRONIZATION_TIMEOUT_EVENT_ID         = BIT(7),
+        HEALTH_REPORT_EVENT_ID                   = BIT(8),
+        ACI_DETECTION_EVENT_ID                   = BIT(9),
+        DEBUG_REPORT_EVENT_ID                    = BIT(10),
+        MAC_STATUS_EVENT_ID                      = BIT(11),
+        DISCONNECT_EVENT_COMPLETE_ID             = BIT(12),
+        JOIN_EVENT_COMPLETE_ID                   = BIT(13),
+        CHANNEL_SWITCH_COMPLETE_EVENT_ID         = BIT(14),
+        BSS_LOSE_EVENT_ID                        = BIT(15),
+        ROAMING_TRIGGER_MAX_TX_RETRY_EVENT_ID    = BIT(16),
+        MEASUREMENT_COMPLETE_EVENT_ID            = BIT(17),
+        AP_DISCOVERY_COMPLETE_EVENT_ID           = BIT(18),
+        SCHEDULED_SCAN_COMPLETE_EVENT_ID         = BIT(19),
+        PSPOLL_DELIVERY_FAILURE_EVENT_ID         = BIT(20),
+        RESET_BSS_EVENT_ID                       = BIT(21),
+        REGAINED_BSS_EVENT_ID                    = BIT(22),
+        ROAMING_TRIGGER_REGAINED_RSSI_EVENT_ID   = BIT(23),
+        ROAMING_TRIGGER_LOW_SNR_EVENT_ID         = BIT(24),
+        ROAMING_TRIGGER_REGAINED_SNR_EVENT_ID    = BIT(25),
+
+        DBG_EVENT_ID                             = BIT(26),
+        BT_PTA_SENSE_EVENT_ID                    = BIT(27),
+        BT_PTA_PREDICTION_EVENT_ID               = BIT(28),
+        BT_PTA_AVALANCHE_EVENT_ID                = BIT(29),
+
+        PLT_RX_CALIBRATION_COMPLETE_EVENT_ID     = BIT(30),
+
+        EVENT_MBOX_ALL_EVENT_ID                  = 0x7fffffff,
+};
+
+struct event_debug_report {
+        u8 debug_event_id;
+        u8 num_params;
+        u16 pad;
+        u32 report_1;
+        u32 report_2;
+        u32 report_3;
+} __attribute__ ((packed));
+
+struct event_mailbox {
+        u32 events_vector;
+        u32 events_mask;
+        u32 reserved_1;
+        u32 reserved_2;
+
+        char average_rssi_level;
+        u8 ps_status;
+        u8 channel_switch_status;
+        u8 scheduled_scan_status;
+
+        /* Channels scanned by the scheduled scan */
+        u16 scheduled_scan_channels;
+
+        /* If bit 0 is set -> target's fatal error */
+        u16 health_report;
+        u16 bad_fft_counter;
+        u8 bt_pta_sense_info;
+        u8 bt_pta_protective_info;
+        u32 reserved;
+        u32 debug_report[2];
+
+        /* Number of FCS errors since last event */
+        u32 fcs_err_counter;
+
+        struct event_debug_report report;
+        u8 average_snr_level;
+        u8 padding[19];
+} __attribute__ ((packed));
+
+int wl12xx_event_unmask(struct wl12xx *wl);
+void wl12xx_event_mbox_config(struct wl12xx *wl);
+int wl12xx_event_handle(struct wl12xx *wl, u8 mbox);
+
+#endif
diff --git a/drivers/net/wireless/wl12xx/init.c b/drivers/net/wireless/wl12xx/init.c
new file mode 100644
index 000000000000..2a573a6010bd
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/init.c
@@ -0,0 +1,200 @@
+/*
+ * This file is part of wl12xx
+ *
+ * Copyright (C) 2009 Nokia Corporation
+ *
+ * Contact: Kalle Valo <kalle.valo@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+
+#include "init.h"
+#include "wl12xx_80211.h"
+#include "acx.h"
+#include "cmd.h"
+
+int wl12xx_hw_init_hwenc_config(struct wl12xx *wl)
+{
+        int ret;
+
+        ret = wl12xx_acx_feature_cfg(wl);
+        if (ret < 0) {
+                wl12xx_warning("couldn't set feature config");
+                return ret;
+        }
+
+        ret = wl12xx_acx_default_key(wl, wl->default_key);
+        if (ret < 0) {
+                wl12xx_warning("couldn't set default key");
+                return ret;
+        }
+
+        return 0;
+}
+
+int wl12xx_hw_init_templates_config(struct wl12xx *wl)
+{
+        int ret;
+        u8 partial_vbm[PARTIAL_VBM_MAX];
+
+        /* send empty templates for fw memory reservation */
+        ret = wl12xx_cmd_template_set(wl, CMD_PROBE_REQ, NULL,
+                                      sizeof(struct wl12xx_probe_req_template));
+        if (ret < 0)
+                return ret;
+
+        ret = wl12xx_cmd_template_set(wl, CMD_NULL_DATA, NULL,
+                                      sizeof(struct wl12xx_null_data_template));
+        if (ret < 0)
+                return ret;
+
+        ret = wl12xx_cmd_template_set(wl, CMD_PS_POLL, NULL,
+                                      sizeof(struct wl12xx_ps_poll_template));
+        if (ret < 0)
+                return ret;
+
+        ret = wl12xx_cmd_template_set(wl, CMD_QOS_NULL_DATA, NULL,
+                                      sizeof
+                                      (struct wl12xx_qos_null_data_template));
+        if (ret < 0)
+                return ret;
+
+        ret = wl12xx_cmd_template_set(wl, CMD_PROBE_RESP, NULL,
+                                      sizeof
+                                      (struct wl12xx_probe_resp_template));
+        if (ret < 0)
+                return ret;
+
+        ret = wl12xx_cmd_template_set(wl, CMD_BEACON, NULL,
+                                      sizeof
+                                      (struct wl12xx_beacon_template));
+        if (ret < 0)
+                return ret;
+
+        /* tim templates, first reserve space then allocate an empty one */
+        memset(partial_vbm, 0, PARTIAL_VBM_MAX);
+        ret = wl12xx_cmd_vbm(wl, TIM_ELE_ID, partial_vbm, PARTIAL_VBM_MAX, 0);
+        if (ret < 0)
+                return ret;
+
+        ret = wl12xx_cmd_vbm(wl, TIM_ELE_ID, partial_vbm, 1, 0);
+        if (ret < 0)
+                return ret;
+
+        return 0;
+}
+
+int wl12xx_hw_init_rx_config(struct wl12xx *wl, u32 config, u32 filter)
+{
+        int ret;
+
+        ret = wl12xx_acx_rx_msdu_life_time(wl, RX_MSDU_LIFETIME_DEF);
+        if (ret < 0)
+                return ret;
+
+        ret = wl12xx_acx_rx_config(wl, config, filter);
+        if (ret < 0)
+                return ret;
+
+        return 0;
+}
+
+int wl12xx_hw_init_phy_config(struct wl12xx *wl)
+{
+        int ret;
+
+        ret = wl12xx_acx_pd_threshold(wl);
+        if (ret < 0)
+                return ret;
+
+        ret = wl12xx_acx_slot(wl, DEFAULT_SLOT_TIME);
+        if (ret < 0)
+                return ret;
+
+        ret = wl12xx_acx_group_address_tbl(wl);
+        if (ret < 0)
+                return ret;
+
+        ret = wl12xx_acx_service_period_timeout(wl);
+        if (ret < 0)
+                return ret;
+
+        ret = wl12xx_acx_rts_threshold(wl, RTS_THRESHOLD_DEF);
+        if (ret < 0)
+                return ret;
+
+        return 0;
+}
+
+int wl12xx_hw_init_beacon_filter(struct wl12xx *wl)
+{
+        int ret;
+
+        ret = wl12xx_acx_beacon_filter_opt(wl);
+        if (ret < 0)
+                return ret;
+
+        ret = wl12xx_acx_beacon_filter_table(wl);
+        if (ret < 0)
+                return ret;
+
+        return 0;
+}
+
+int wl12xx_hw_init_pta(struct wl12xx *wl)
+{
+        int ret;
+
+        ret = wl12xx_acx_sg_enable(wl);
+        if (ret < 0)
+                return ret;
+
+        ret = wl12xx_acx_sg_cfg(wl);
+        if (ret < 0)
+                return ret;
+
+        return 0;
+}
+
+int wl12xx_hw_init_energy_detection(struct wl12xx *wl)
+{
+        int ret;
+
+        ret = wl12xx_acx_cca_threshold(wl);
+        if (ret < 0)
+                return ret;
+
+        return 0;
+}
+
+int wl12xx_hw_init_beacon_broadcast(struct wl12xx *wl)
+{
+        int ret;
+
+        ret = wl12xx_acx_bcn_dtim_options(wl);
+        if (ret < 0)
+                return ret;
+
+        return 0;
+}
+
+int wl12xx_hw_init_power_auth(struct wl12xx *wl)
+{
+        return wl12xx_acx_sleep_auth(wl, WL12XX_PSM_CAM);
+}
diff --git a/drivers/net/wireless/wl12xx/init.h b/drivers/net/wireless/wl12xx/init.h
new file mode 100644
index 000000000000..c8b6cd0b7c3e
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/init.h
@@ -0,0 +1,40 @@
+/*
+ * This file is part of wl12xx
+ *
+ * Copyright (C) 2009 Nokia Corporation
+ *
+ * Contact: Kalle Valo <kalle.valo@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __WL12XX_INIT_H__
+#define __WL12XX_INIT_H__
+
+#include "wl12xx.h"
+
+int wl12xx_hw_init_hwenc_config(struct wl12xx *wl);
+int wl12xx_hw_init_templates_config(struct wl12xx *wl);
+int wl12xx_hw_init_mem_config(struct wl12xx *wl);
+int wl12xx_hw_init_rx_config(struct wl12xx *wl, u32 config, u32 filter);
+int wl12xx_hw_init_phy_config(struct wl12xx *wl);
+int wl12xx_hw_init_beacon_filter(struct wl12xx *wl);
+int wl12xx_hw_init_pta(struct wl12xx *wl);
+int wl12xx_hw_init_energy_detection(struct wl12xx *wl);
+int wl12xx_hw_init_beacon_broadcast(struct wl12xx *wl);
+int wl12xx_hw_init_power_auth(struct wl12xx *wl);
+
+#endif
diff --git a/drivers/net/wireless/wl12xx/main.c b/drivers/net/wireless/wl12xx/main.c
new file mode 100644
index 000000000000..603d6114882e
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/main.c
@@ -0,0 +1,1358 @@
+/*
+ * This file is part of wl12xx
+ *
+ * Copyright (C) 2008-2009 Nokia Corporation
+ *
+ * Contact: Kalle Valo <kalle.valo@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/interrupt.h>
+#include <linux/firmware.h>
+#include <linux/delay.h>
+#include <linux/irq.h>
+#include <linux/spi/spi.h>
+#include <linux/crc32.h>
+#include <linux/etherdevice.h>
+#include <linux/spi/wl12xx.h>
+
+#include "wl12xx.h"
+#include "wl12xx_80211.h"
+#include "reg.h"
+#include "wl1251.h"
+#include "spi.h"
+#include "event.h"
+#include "tx.h"
+#include "rx.h"
+#include "ps.h"
+#include "init.h"
+#include "debugfs.h"
+
+static void wl12xx_disable_interrupts(struct wl12xx *wl)
+{
+        disable_irq(wl->irq);
+}
+
+static void wl12xx_power_off(struct wl12xx *wl)
+{
+        wl->set_power(false);
+}
+
+static void wl12xx_power_on(struct wl12xx *wl)
+{
+        wl->set_power(true);
+}
+
+static irqreturn_t wl12xx_irq(int irq, void *cookie)
+{
+        struct wl12xx *wl;
+
+        wl12xx_debug(DEBUG_IRQ, "IRQ");
+
+        wl = cookie;
+
+        schedule_work(&wl->irq_work);
+
+        return IRQ_HANDLED;
+}
+
+static int wl12xx_fetch_firmware(struct wl12xx *wl)
+{
+        const struct firmware *fw;
+        int ret;
+
+        ret = request_firmware(&fw, wl->chip.fw_filename, &wl->spi->dev);
+
+        if (ret < 0) {
+                wl12xx_error("could not get firmware: %d", ret);
+                return ret;
+        }
+
+        if (fw->size % 4) {
+                wl12xx_error("firmware size is not multiple of 32 bits: %zu",
+                             fw->size);
+                ret = -EILSEQ;
+                goto out;
+        }
+
+        wl->fw_len = fw->size;
+        wl->fw = kmalloc(wl->fw_len, GFP_KERNEL);
+
+        if (!wl->fw) {
+                wl12xx_error("could not allocate memory for the firmware");
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        memcpy(wl->fw, fw->data, wl->fw_len);
+
+        ret = 0;
+
+out:
+        release_firmware(fw);
+
+        return ret;
+}
+
+static int wl12xx_fetch_nvs(struct wl12xx *wl)
+{
+        const struct firmware *fw;
+        int ret;
+
+        ret = request_firmware(&fw, wl->chip.nvs_filename, &wl->spi->dev);
+
+        if (ret < 0) {
+                wl12xx_error("could not get nvs file: %d", ret);
+                return ret;
+        }
+
+        if (fw->size % 4) {
+                wl12xx_error("nvs size is not multiple of 32 bits: %zu",
+                             fw->size);
+                ret = -EILSEQ;
+                goto out;
+        }
+
+        wl->nvs_len = fw->size;
+        wl->nvs = kmalloc(wl->nvs_len, GFP_KERNEL);
+
+        if (!wl->nvs) {
+                wl12xx_error("could not allocate memory for the nvs file");
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        memcpy(wl->nvs, fw->data, wl->nvs_len);
+
+        ret = 0;
+
+out:
+        release_firmware(fw);
+
+        return ret;
+}
+
+static void wl12xx_fw_wakeup(struct wl12xx *wl)
+{
+        u32 elp_reg;
+
+        elp_reg = ELPCTRL_WAKE_UP;
+        wl12xx_write32(wl, HW_ACCESS_ELP_CTRL_REG_ADDR, elp_reg);
+        elp_reg = wl12xx_read32(wl, HW_ACCESS_ELP_CTRL_REG_ADDR);
+
+        if (!(elp_reg & ELPCTRL_WLAN_READY)) {
+                wl12xx_warning("WLAN not ready");
+                elp_reg = ELPCTRL_WAKE_UP_WLAN_READY;
+                wl12xx_write32(wl, HW_ACCESS_ELP_CTRL_REG_ADDR, elp_reg);
+        }
+}
+
+static int wl12xx_chip_wakeup(struct wl12xx *wl)
+{
+        int ret = 0;
+
+        wl12xx_power_on(wl);
+        msleep(wl->chip.power_on_sleep);
+        wl12xx_spi_reset(wl);
+        wl12xx_spi_init(wl);
+
+        /* We don't need a real memory partition here, because we only want
+         * to use the registers at this point. */
+        wl12xx_set_partition(wl,
+                             0x00000000,
+                             0x00000000,
+                             REGISTERS_BASE,
+                             REGISTERS_DOWN_SIZE);
+
+        /* ELP module wake up */
+        wl12xx_fw_wakeup(wl);
+
+        /* whal_FwCtrl_BootSm() */
+
+        /* 0. read chip id from CHIP_ID */
+        wl->chip.id = wl12xx_reg_read32(wl, CHIP_ID_B);
+
+        /* 1. check if chip id is valid */
+
+        switch (wl->chip.id) {
+        case CHIP_ID_1251_PG12:
+                wl12xx_debug(DEBUG_BOOT, "chip id 0x%x (1251 PG12)",
+                             wl->chip.id);
+
+                wl1251_setup(wl);
+
+                break;
+        case CHIP_ID_1271_PG10:
+        case CHIP_ID_1251_PG10:
+        case CHIP_ID_1251_PG11:
+        default:
+                wl12xx_error("unsupported chip id: 0x%x", wl->chip.id);
+                ret = -ENODEV;
+                goto out;
+        }
+
+        if (wl->fw == NULL) {
+                ret = wl12xx_fetch_firmware(wl);
+                if (ret < 0)
+                        goto out;
+        }
+
+        /* No NVS from netlink, try to get it from the filesystem */
+        if (wl->nvs == NULL) {
+                ret = wl12xx_fetch_nvs(wl);
+                if (ret < 0)
+                        goto out;
+        }
+
+out:
+        return ret;
+}
+
+static void wl12xx_filter_work(struct work_struct *work)
+{
+        struct wl12xx *wl =
+                container_of(work, struct wl12xx, filter_work);
+        int ret;
+
+        mutex_lock(&wl->mutex);
+
+        if (wl->state == WL12XX_STATE_OFF)
+                goto out;
+
+        ret = wl12xx_cmd_join(wl, wl->bss_type, 1, 100, 0);
+        if (ret < 0)
+                goto out;
+
+out:
+        mutex_unlock(&wl->mutex);
+}
+
+int wl12xx_plt_start(struct wl12xx *wl)
+{
+        int ret;
+
+        wl12xx_notice("power up");
+
+        if (wl->state != WL12XX_STATE_OFF) {
+                wl12xx_error("cannot go into PLT state because not "
+                             "in off state: %d", wl->state);
+                return -EBUSY;
+        }
+
+        wl->state = WL12XX_STATE_PLT;
+
+        ret = wl12xx_chip_wakeup(wl);
+        if (ret < 0)
+                return ret;
+
+        ret = wl->chip.op_boot(wl);
+        if (ret < 0)
+                return ret;
+
+        wl12xx_notice("firmware booted in PLT mode (%s)", wl->chip.fw_ver);
+
+        ret = wl->chip.op_plt_init(wl);
+        if (ret < 0)
+                return ret;
+
+        return 0;
+}
+
+int wl12xx_plt_stop(struct wl12xx *wl)
+{
+        wl12xx_notice("power down");
+
+        if (wl->state != WL12XX_STATE_PLT) {
+                wl12xx_error("cannot power down because not in PLT "
+                             "state: %d", wl->state);
+                return -EBUSY;
+        }
+
+        wl12xx_disable_interrupts(wl);
+        wl12xx_power_off(wl);
+
+        wl->state = WL12XX_STATE_OFF;
+
+        return 0;
+}
+
+
+static int wl12xx_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
+{
+        struct wl12xx *wl = hw->priv;
+
+        skb_queue_tail(&wl->tx_queue, skb);
+
+        schedule_work(&wl->tx_work);
+
+        /*
+         * The workqueue is slow to process the tx_queue and we need stop
+         * the queue here, otherwise the queue will get too long.
+         */
+        if (skb_queue_len(&wl->tx_queue) >= WL12XX_TX_QUEUE_MAX_LENGTH) {
+                ieee80211_stop_queues(wl->hw);
+
+                /*
+                 * FIXME: this is racy, the variable is not properly
+                 * protected. Maybe fix this by removing the stupid
+                 * variable altogether and checking the real queue state?
+                 */
+                wl->tx_queue_stopped = true;
+        }
+
+        return NETDEV_TX_OK;
+}
+
+static int wl12xx_op_start(struct ieee80211_hw *hw)
+{
+        struct wl12xx *wl = hw->priv;
+        int ret = 0;
+
+        wl12xx_debug(DEBUG_MAC80211, "mac80211 start");
+
+        mutex_lock(&wl->mutex);
+
+        if (wl->state != WL12XX_STATE_OFF) {
+                wl12xx_error("cannot start because not in off state: %d",
+                             wl->state);
+                ret = -EBUSY;
+                goto out;
+        }
+
+        ret = wl12xx_chip_wakeup(wl);
+        if (ret < 0)
+                return ret;
+
+        ret = wl->chip.op_boot(wl);
+        if (ret < 0)
+                goto out;
+
+        ret = wl->chip.op_hw_init(wl);
+        if (ret < 0)
+                goto out;
+
+        ret = wl12xx_acx_station_id(wl);
+        if (ret < 0)
+                goto out;
+
+        wl->state = WL12XX_STATE_ON;
+
+        wl12xx_info("firmware booted (%s)", wl->chip.fw_ver);
+
+out:
+        if (ret < 0)
+                wl12xx_power_off(wl);
+
+        mutex_unlock(&wl->mutex);
+
+        return ret;
+}
+
+static void wl12xx_op_stop(struct ieee80211_hw *hw)
+{
+        struct wl12xx *wl = hw->priv;
+
+        wl12xx_info("down");
+
+        wl12xx_debug(DEBUG_MAC80211, "mac80211 stop");
+
+        mutex_lock(&wl->mutex);
+
+        WARN_ON(wl->state != WL12XX_STATE_ON);
+
+        if (wl->scanning) {
+                mutex_unlock(&wl->mutex);
+                ieee80211_scan_completed(wl->hw, true);
+                mutex_lock(&wl->mutex);
+                wl->scanning = false;
+        }
+
+        wl->state = WL12XX_STATE_OFF;
+
+        wl12xx_disable_interrupts(wl);
+
+        mutex_unlock(&wl->mutex);
+
+        cancel_work_sync(&wl->irq_work);
+        cancel_work_sync(&wl->tx_work);
+        cancel_work_sync(&wl->filter_work);
+
+        mutex_lock(&wl->mutex);
+
+        /* let's notify MAC80211 about the remaining pending TX frames */
+        wl12xx_tx_flush(wl);
+
+        wl12xx_power_off(wl);
+
+        memset(wl->bssid, 0, ETH_ALEN);
+        wl->listen_int = 1;
+        wl->bss_type = MAX_BSS_TYPE;
+
+        wl->data_in_count = 0;
+        wl->rx_counter = 0;
+        wl->rx_handled = 0;
+        wl->rx_current_buffer = 0;
+        wl->rx_last_id = 0;
+        wl->next_tx_complete = 0;
+        wl->elp = false;
+        wl->psm = 0;
+        wl->tx_queue_stopped = false;
+        wl->power_level = WL12XX_DEFAULT_POWER_LEVEL;
+
+        wl12xx_debugfs_reset(wl);
+
+        mutex_unlock(&wl->mutex);
+}
+
+static int wl12xx_op_add_interface(struct ieee80211_hw *hw,
+                                   struct ieee80211_if_init_conf *conf)
+{
+        struct wl12xx *wl = hw->priv;
+        DECLARE_MAC_BUF(mac);
+        int ret = 0;
+
+        wl12xx_debug(DEBUG_MAC80211, "mac80211 add interface type %d mac %s",
+                     conf->type, print_mac(mac, conf->mac_addr));
+
+        mutex_lock(&wl->mutex);
+
+        switch (conf->type) {
+        case NL80211_IFTYPE_STATION:
+                wl->bss_type = BSS_TYPE_STA_BSS;
+                break;
+        case NL80211_IFTYPE_ADHOC:
+                wl->bss_type = BSS_TYPE_IBSS;
+                break;
+        default:
+                ret = -EOPNOTSUPP;
+                goto out;
+        }
+
+        if (memcmp(wl->mac_addr, conf->mac_addr, ETH_ALEN)) {
+                memcpy(wl->mac_addr, conf->mac_addr, ETH_ALEN);
+                SET_IEEE80211_PERM_ADDR(wl->hw, wl->mac_addr);
+                ret = wl12xx_acx_station_id(wl);
+                if (ret < 0)
+                        goto out;
+        }
+
+out:
+        mutex_unlock(&wl->mutex);
+        return ret;
+}
+
+static void wl12xx_op_remove_interface(struct ieee80211_hw *hw,
+                                         struct ieee80211_if_init_conf *conf)
+{
+        wl12xx_debug(DEBUG_MAC80211, "mac80211 remove interface");
+}
+
+static int wl12xx_build_null_data(struct wl12xx *wl)
+{
+        struct wl12xx_null_data_template template;
+
+        if (!is_zero_ether_addr(wl->bssid)) {
+                memcpy(template.header.da, wl->bssid, ETH_ALEN);
+                memcpy(template.header.bssid, wl->bssid, ETH_ALEN);
+        } else {
+                memset(template.header.da, 0xff, ETH_ALEN);
+                memset(template.header.bssid, 0xff, ETH_ALEN);
+        }
+
+        memcpy(template.header.sa, wl->mac_addr, ETH_ALEN);
+        template.header.frame_ctl = cpu_to_le16(IEEE80211_FTYPE_DATA |
+                                                IEEE80211_STYPE_NULLFUNC);
+
+        return wl12xx_cmd_template_set(wl, CMD_NULL_DATA, &template,
+                                       sizeof(template));
+
+}
+
+static int wl12xx_build_ps_poll(struct wl12xx *wl, u16 aid)
+{
+        struct wl12xx_ps_poll_template template;
+
+        memcpy(template.bssid, wl->bssid, ETH_ALEN);
+        memcpy(template.ta, wl->mac_addr, ETH_ALEN);
+        template.aid = aid;
+        template.fc = cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_PSPOLL);
+
+        return wl12xx_cmd_template_set(wl, CMD_PS_POLL, &template,
+                                       sizeof(template));
+
+}
+
+static int wl12xx_op_config(struct ieee80211_hw *hw, u32 changed)
+{
+        struct wl12xx *wl = hw->priv;
+        struct ieee80211_conf *conf = &hw->conf;
+        int channel, ret = 0;
+
+        channel = ieee80211_frequency_to_channel(conf->channel->center_freq);
+
+        wl12xx_debug(DEBUG_MAC80211, "mac80211 config ch %d psm %s power %d",
+                     channel,
+                     conf->flags & IEEE80211_CONF_PS ? "on" : "off",
+                     conf->power_level);
+
+        mutex_lock(&wl->mutex);
+
+        if (channel != wl->channel) {
+                /* FIXME: use beacon interval provided by mac80211 */
+                ret = wl12xx_cmd_join(wl, wl->bss_type, 1, 100, 0);
+                if (ret < 0)
+                        goto out;
+
+                wl->channel = channel;
+        }
+
+        ret = wl12xx_build_null_data(wl);
+        if (ret < 0)
+                goto out;
+
+        if (conf->flags & IEEE80211_CONF_PS && !wl->psm_requested) {
+                wl12xx_info("psm enabled");
+
+                wl->psm_requested = true;
+
+                /*
+                 * We enter PSM only if we're already associated.
+                 * If we're not, we'll enter it when joining an SSID,
+                 * through the bss_info_changed() hook.
+                 */
+                ret = wl12xx_ps_set_mode(wl, STATION_POWER_SAVE_MODE);
+        } else if (!(conf->flags & IEEE80211_CONF_PS) &&
+                   wl->psm_requested) {
+                wl12xx_info("psm disabled");
+
+                wl->psm_requested = false;
+
+                if (wl->psm)
+                        ret = wl12xx_ps_set_mode(wl, STATION_ACTIVE_MODE);
+        }
+
+        if (conf->power_level != wl->power_level) {
+                ret = wl12xx_acx_tx_power(wl, conf->power_level);
+                if (ret < 0)
+                        goto out;
+
+                wl->power_level = conf->power_level;
+        }
+
+out:
+        mutex_unlock(&wl->mutex);
+        return ret;
+}
+
+#define WL12XX_SUPPORTED_FILTERS (FIF_PROMISC_IN_BSS | \
+                                  FIF_ALLMULTI | \
+                                  FIF_FCSFAIL | \
+                                  FIF_BCN_PRBRESP_PROMISC | \
+                                  FIF_CONTROL | \
+                                  FIF_OTHER_BSS)
+
+static void wl12xx_op_configure_filter(struct ieee80211_hw *hw,
+                                       unsigned int changed,
+                                       unsigned int *total,
+                                       int mc_count,
+                                       struct dev_addr_list *mc_list)
+{
+        struct wl12xx *wl = hw->priv;
+
+        wl12xx_debug(DEBUG_MAC80211, "mac80211 configure filter");
+
+        *total &= WL12XX_SUPPORTED_FILTERS;
+        changed &= WL12XX_SUPPORTED_FILTERS;
+
+        if (changed == 0)
+                /* no filters which we support changed */
+                return;
+
+        /* FIXME: wl->rx_config and wl->rx_filter are not protected */
+
+        wl->rx_config = WL12XX_DEFAULT_RX_CONFIG;
+        wl->rx_filter = WL12XX_DEFAULT_RX_FILTER;
+
+        if (*total & FIF_PROMISC_IN_BSS) {
+                wl->rx_config |= CFG_BSSID_FILTER_EN;
+                wl->rx_config |= CFG_RX_ALL_GOOD;
+        }
+        if (*total & FIF_ALLMULTI)
+                /*
+                 * CFG_MC_FILTER_EN in rx_config needs to be 0 to receive
+                 * all multicast frames
+                 */
+                wl->rx_config &= ~CFG_MC_FILTER_EN;
+        if (*total & FIF_FCSFAIL)
+                wl->rx_filter |= CFG_RX_FCS_ERROR;
+        if (*total & FIF_BCN_PRBRESP_PROMISC) {
+                wl->rx_config &= ~CFG_BSSID_FILTER_EN;
+                wl->rx_config &= ~CFG_SSID_FILTER_EN;
+        }
+        if (*total & FIF_CONTROL)
+                wl->rx_filter |= CFG_RX_CTL_EN;
+        if (*total & FIF_OTHER_BSS)
+                wl->rx_filter &= ~CFG_BSSID_FILTER_EN;
+
+        /*
+         * FIXME: workqueues need to be properly cancelled on stop(), for
+         * now let's just disable changing the filter settings. They will
+         * be updated any on config().
+         */
+        /* schedule_work(&wl->filter_work); */
+}
+
+/* HW encryption */
+static int wl12xx_set_key_type(struct wl12xx *wl, struct acx_set_key *key,
+                               enum set_key_cmd cmd,
+                               struct ieee80211_key_conf *mac80211_key,
+                               const u8 *addr)
+{
+        switch (mac80211_key->alg) {
+        case ALG_WEP:
+                if (is_broadcast_ether_addr(addr))
+                        key->key_type = KEY_WEP_DEFAULT;
+                else
+                        key->key_type = KEY_WEP_ADDR;
+
+                mac80211_key->hw_key_idx = mac80211_key->keyidx;
+                break;
+        case ALG_TKIP:
+                if (is_broadcast_ether_addr(addr))
+                        key->key_type = KEY_TKIP_MIC_GROUP;
+                else
+                        key->key_type = KEY_TKIP_MIC_PAIRWISE;
+
+                mac80211_key->hw_key_idx = mac80211_key->keyidx;
+                break;
+        case ALG_CCMP:
+                if (is_broadcast_ether_addr(addr))
+                        key->key_type = KEY_AES_GROUP;
+                else
+                        key->key_type = KEY_AES_PAIRWISE;
+                mac80211_key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
+                break;
+        default:
+                wl12xx_error("Unknown key algo 0x%x", mac80211_key->alg);
+                return -EOPNOTSUPP;
+        }
+
+        return 0;
+}
+
+static int wl12xx_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+                             struct ieee80211_vif *vif,
+                             struct ieee80211_sta *sta,
+                             struct ieee80211_key_conf *key)
+{
+        struct wl12xx *wl = hw->priv;
+        struct acx_set_key wl_key;
+        const u8 *addr;
+        int ret;
+
+        static const u8 bcast_addr[ETH_ALEN] =
+                { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
+
+        wl12xx_debug(DEBUG_MAC80211, "mac80211 set key");
+
+        memset(&wl_key, 0, sizeof(wl_key));
+
+        addr = sta ? sta->addr : bcast_addr;
+
+        wl12xx_debug(DEBUG_CRYPT, "CMD: 0x%x", cmd);
+        wl12xx_dump(DEBUG_CRYPT, "ADDR: ", addr, ETH_ALEN);
+        wl12xx_debug(DEBUG_CRYPT, "Key: algo:0x%x, id:%d, len:%d flags 0x%x",
+                     key->alg, key->keyidx, key->keylen, key->flags);
+        wl12xx_dump(DEBUG_CRYPT, "KEY: ", key->key, key->keylen);
+
+        mutex_lock(&wl->mutex);
+
+        switch (cmd) {
+        case SET_KEY:
+                wl_key.key_action = KEY_ADD_OR_REPLACE;
+                break;
+        case DISABLE_KEY:
+                wl_key.key_action = KEY_REMOVE;
+                break;
+        default:
+                wl12xx_error("Unsupported key cmd 0x%x", cmd);
+                break;
+        }
+
+        ret = wl12xx_set_key_type(wl, &wl_key, cmd, key, addr);
+        if (ret < 0) {
+                wl12xx_error("Set KEY type failed");
+                goto out;
+        }
+
+        if (wl_key.key_type != KEY_WEP_DEFAULT)
+                memcpy(wl_key.addr, addr, ETH_ALEN);
+
+        if ((wl_key.key_type == KEY_TKIP_MIC_GROUP) ||
+            (wl_key.key_type == KEY_TKIP_MIC_PAIRWISE)) {
+                /*
+                 * We get the key in the following form:
+                 * TKIP (16 bytes) - TX MIC (8 bytes) - RX MIC (8 bytes)
+                 * but the target is expecting:
+                 * TKIP - RX MIC - TX MIC
+                 */
+                memcpy(wl_key.key, key->key, 16);
+                memcpy(wl_key.key + 16, key->key + 24, 8);
+                memcpy(wl_key.key + 24, key->key + 16, 8);
+
+        } else {
+                memcpy(wl_key.key, key->key, key->keylen);
+        }
+        wl_key.key_size = key->keylen;
+
+        wl_key.id = key->keyidx;
+        wl_key.ssid_profile = 0;
+
+        wl12xx_dump(DEBUG_CRYPT, "TARGET KEY: ", &wl_key, sizeof(wl_key));
+
+        if (wl12xx_cmd_send(wl, CMD_SET_KEYS, &wl_key, sizeof(wl_key)) < 0) {
+                wl12xx_error("Set KEY failed");
+                ret = -EOPNOTSUPP;
+                goto out;
+        }
+
+out:
+        mutex_unlock(&wl->mutex);
+        return ret;
+}
+
+static int wl12xx_build_basic_rates(char *rates)
+{
+        u8 index = 0;
+
+        rates[index++] = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_1MB;
+        rates[index++] = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_2MB;
+        rates[index++] = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_5MB;
+        rates[index++] = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_11MB;
+
+        return index;
+}
+
+static int wl12xx_build_extended_rates(char *rates)
+{
+        u8 index = 0;
+
+        rates[index++] = IEEE80211_OFDM_RATE_6MB;
+        rates[index++] = IEEE80211_OFDM_RATE_9MB;
+        rates[index++] = IEEE80211_OFDM_RATE_12MB;
+        rates[index++] = IEEE80211_OFDM_RATE_18MB;
+        rates[index++] = IEEE80211_OFDM_RATE_24MB;
+        rates[index++] = IEEE80211_OFDM_RATE_36MB;
+        rates[index++] = IEEE80211_OFDM_RATE_48MB;
+        rates[index++] = IEEE80211_OFDM_RATE_54MB;
+
+        return index;
+}
+
+
+static int wl12xx_build_probe_req(struct wl12xx *wl, u8 *ssid, size_t ssid_len)
+{
+        struct wl12xx_probe_req_template template;
+        struct wl12xx_ie_rates *rates;
+        char *ptr;
+        u16 size;
+
+        ptr = (char *)&template;
+        size = sizeof(struct ieee80211_header);
+
+        memset(template.header.da, 0xff, ETH_ALEN);
+        memset(template.header.bssid, 0xff, ETH_ALEN);
+        memcpy(template.header.sa, wl->mac_addr, ETH_ALEN);
+        template.header.frame_ctl = cpu_to_le16(IEEE80211_STYPE_PROBE_REQ);
+
+        /* IEs */
+        /* SSID */
+        template.ssid.header.id = WLAN_EID_SSID;
+        template.ssid.header.len = ssid_len;
+        if (ssid_len && ssid)
+                memcpy(template.ssid.ssid, ssid, ssid_len);
+        size += sizeof(struct wl12xx_ie_header) + ssid_len;
+        ptr += size;
+
+        /* Basic Rates */
+        rates = (struct wl12xx_ie_rates *)ptr;
+        rates->header.id = WLAN_EID_SUPP_RATES;
+        rates->header.len = wl12xx_build_basic_rates(rates->rates);
+        size += sizeof(struct wl12xx_ie_header) + rates->header.len;
+        ptr += sizeof(struct wl12xx_ie_header) + rates->header.len;
+
+        /* Extended rates */
+        rates = (struct wl12xx_ie_rates *)ptr;
+        rates->header.id = WLAN_EID_EXT_SUPP_RATES;
+        rates->header.len = wl12xx_build_extended_rates(rates->rates);
+        size += sizeof(struct wl12xx_ie_header) + rates->header.len;
+
+        wl12xx_dump(DEBUG_SCAN, "PROBE REQ: ", &template, size);
+
+        return wl12xx_cmd_template_set(wl, CMD_PROBE_REQ, &template,
+                                      size);
+}
+
+static int wl12xx_hw_scan(struct wl12xx *wl, u8 *ssid, size_t len,
+                          u8 active_scan, u8 high_prio, u8 num_channels,
+                          u8 probe_requests)
+{
+        int i, ret;
+        u32 split_scan = 0;
+        u16 scan_options = 0;
+        struct cmd_scan *params;
+        struct wl12xx_command *cmd_answer;
+
+        if (wl->scanning)
+                return -EINVAL;
+
+        params = kzalloc(sizeof(*params), GFP_KERNEL);
+        if (!params)
+                return -ENOMEM;
+
+        params->params.rx_config_options = cpu_to_le32(CFG_RX_ALL_GOOD);
+        params->params.rx_filter_options =
+                cpu_to_le32(CFG_RX_PRSP_EN | CFG_RX_MGMT_EN | CFG_RX_BCN_EN);
+
+        /* High priority scan */
+        if (!active_scan)
+                scan_options |= SCAN_PASSIVE;
+        if (high_prio)
+                scan_options |= SCAN_PRIORITY_HIGH;
+        params->params.scan_options = scan_options;
+
+        params->params.num_channels = num_channels;
+        params->params.num_probe_requests = probe_requests;
+        params->params.tx_rate = cpu_to_le16(1 << 1); /* 2 Mbps */
+        params->params.tid_trigger = 0;
+
+        for (i = 0; i < num_channels; i++) {
+                params->channels[i].min_duration = cpu_to_le32(30000);
+                params->channels[i].max_duration = cpu_to_le32(60000);
+                memset(&params->channels[i].bssid_lsb, 0xff, 4);
+                memset(&params->channels[i].bssid_msb, 0xff, 2);
+                params->channels[i].early_termination = 0;
+                params->channels[i].tx_power_att = 0;
+                params->channels[i].channel = i + 1;
+                memset(params->channels[i].pad, 0, 3);
+        }
+
+        for (i = num_channels; i < SCAN_MAX_NUM_OF_CHANNELS; i++)
+                memset(&params->channels[i], 0,
+                       sizeof(struct basic_scan_channel_parameters));
+
+        if (len && ssid) {
+                params->params.ssid_len = len;
+                memcpy(params->params.ssid, ssid, len);
+        } else {
+                params->params.ssid_len = 0;
+                memset(params->params.ssid, 0, 32);
+        }
+
+        ret = wl12xx_build_probe_req(wl, ssid, len);
+        if (ret < 0) {
+                wl12xx_error("PROBE request template failed");
+                goto out;
+        }
+
+        ret = wl12xx_cmd_send(wl, CMD_TRIGGER_SCAN_TO, &split_scan,
+                              sizeof(u32));
+        if (ret < 0) {
+                wl12xx_error("Split SCAN failed");
+                goto out;
+        }
+
+        wl12xx_dump(DEBUG_SCAN, "SCAN: ", params, sizeof(*params));
+
+        wl->scanning = true;
+
+        ret = wl12xx_cmd_send(wl, CMD_SCAN, params, sizeof(*params));
+        if (ret < 0)
+                wl12xx_error("SCAN failed");
+
+        wl12xx_spi_mem_read(wl, wl->cmd_box_addr, params, sizeof(*params));
+
+        cmd_answer = (struct wl12xx_command *) params;
+        if (cmd_answer->status != CMD_STATUS_SUCCESS) {
+                wl12xx_error("TEST command answer error: %d",
+                             cmd_answer->status);
+                wl->scanning = false;
+                ret = -EIO;
+                goto out;
+        }
+
+out:
+        kfree(params);
+        return ret;
+
+}
+
+static int wl12xx_op_hw_scan(struct ieee80211_hw *hw,
+                             struct cfg80211_scan_request *req)
+{
+        struct wl12xx *wl = hw->priv;
+        int ret;
+        u8 *ssid = NULL;
+        size_t ssid_len = 0;
+
+        wl12xx_debug(DEBUG_MAC80211, "mac80211 hw scan");
+
+        if (req->n_ssids) {
+                ssid = req->ssids[0].ssid;
+                ssid_len = req->ssids[0].ssid_len;
+        }
+
+        mutex_lock(&wl->mutex);
+        ret = wl12xx_hw_scan(hw->priv, ssid, ssid_len, 1, 0, 13, 3);
+        mutex_unlock(&wl->mutex);
+
+        return ret;
+}
+
+static int wl12xx_op_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
+{
+        struct wl12xx *wl = hw->priv;
+        int ret;
+
+        ret = wl12xx_acx_rts_threshold(wl, (u16) value);
+
+        if (ret < 0)
+                wl12xx_warning("wl12xx_op_set_rts_threshold failed: %d", ret);
+
+        return ret;
+}
+
+static void wl12xx_op_bss_info_changed(struct ieee80211_hw *hw,
+                                       struct ieee80211_vif *vif,
+                                       struct ieee80211_bss_conf *bss_conf,
+                                       u32 changed)
+{
+        enum acx_ps_mode mode;
+        struct wl12xx *wl = hw->priv;
+        struct sk_buff *beacon;
+        int ret;
+
+        wl12xx_debug(DEBUG_MAC80211, "mac80211 bss info changed");
+
+        mutex_lock(&wl->mutex);
+
+        if (changed & BSS_CHANGED_ASSOC) {
+                if (bss_conf->assoc) {
+                        wl->aid = bss_conf->aid;
+
+                        ret = wl12xx_build_ps_poll(wl, wl->aid);
+                        if (ret < 0)
+                                goto out;
+
+                        ret = wl12xx_acx_aid(wl, wl->aid);
+                        if (ret < 0)
+                                goto out;
+
+                        /* If we want to go in PSM but we're not there yet */
+                        if (wl->psm_requested && !wl->psm) {
+                                mode = STATION_POWER_SAVE_MODE;
+                                ret = wl12xx_ps_set_mode(wl, mode);
+                                if (ret < 0)
+                                        goto out;
+                        }
+                }
+        }
+        if (changed & BSS_CHANGED_ERP_SLOT) {
+                if (bss_conf->use_short_slot)
+                        ret = wl12xx_acx_slot(wl, SLOT_TIME_SHORT);
+                else
+                        ret = wl12xx_acx_slot(wl, SLOT_TIME_LONG);
+                if (ret < 0) {
+                        wl12xx_warning("Set slot time failed %d", ret);
+                        goto out;
+                }
+        }
+
+        if (changed & BSS_CHANGED_ERP_PREAMBLE) {
+                if (bss_conf->use_short_preamble)
+                        wl12xx_acx_set_preamble(wl, ACX_PREAMBLE_SHORT);
+                else
+                        wl12xx_acx_set_preamble(wl, ACX_PREAMBLE_LONG);
+        }
+
+        if (changed & BSS_CHANGED_ERP_CTS_PROT) {
+                if (bss_conf->use_cts_prot)
+                        ret = wl12xx_acx_cts_protect(wl, CTSPROTECT_ENABLE);
+                else
+                        ret = wl12xx_acx_cts_protect(wl, CTSPROTECT_DISABLE);
+                if (ret < 0) {
+                        wl12xx_warning("Set ctsprotect failed %d", ret);
+                        goto out;
+                }
+        }
+
+        if (changed & BSS_CHANGED_BSSID) {
+                memcpy(wl->bssid, bss_conf->bssid, ETH_ALEN);
+
+                ret = wl12xx_build_null_data(wl);
+                if (ret < 0)
+                        goto out;
+
+                if (wl->bss_type != BSS_TYPE_IBSS) {
+                        ret = wl12xx_cmd_join(wl, wl->bss_type, 5, 100, 1);
+                        if (ret < 0)
+                                goto out;
+                }
+        }
+
+        if (changed & BSS_CHANGED_BEACON) {
+                beacon = ieee80211_beacon_get(hw, vif);
+                ret = wl12xx_cmd_template_set(wl, CMD_BEACON, beacon->data,
+                                              beacon->len);
+
+                if (ret < 0) {
+                        dev_kfree_skb(beacon);
+                        goto out;
+                }
+
+                ret = wl12xx_cmd_template_set(wl, CMD_PROBE_RESP, beacon->data,
+                                              beacon->len);
+
+                dev_kfree_skb(beacon);
+
+                if (ret < 0)
+                        goto out;
+
+                ret = wl12xx_cmd_join(wl, wl->bss_type, 1, 100, 0);
+
+                if (ret < 0)
+                        goto out;
+        }
+
+out:
+        mutex_unlock(&wl->mutex);
+}
+
+
+/* can't be const, mac80211 writes to this */
+static struct ieee80211_rate wl12xx_rates[] = {
+        { .bitrate = 10,
+          .hw_value = 0x1,
+          .hw_value_short = 0x1, },
+        { .bitrate = 20,
+          .hw_value = 0x2,
+          .hw_value_short = 0x2,
+          .flags = IEEE80211_RATE_SHORT_PREAMBLE },
+        { .bitrate = 55,
+          .hw_value = 0x4,
+          .hw_value_short = 0x4,
+          .flags = IEEE80211_RATE_SHORT_PREAMBLE },
+        { .bitrate = 110,
+          .hw_value = 0x20,
+          .hw_value_short = 0x20,
+          .flags = IEEE80211_RATE_SHORT_PREAMBLE },
+        { .bitrate = 60,
+          .hw_value = 0x8,
+          .hw_value_short = 0x8, },
+        { .bitrate = 90,
+          .hw_value = 0x10,
+          .hw_value_short = 0x10, },
+        { .bitrate = 120,
+          .hw_value = 0x40,
+          .hw_value_short = 0x40, },
+        { .bitrate = 180,
+          .hw_value = 0x80,
+          .hw_value_short = 0x80, },
+        { .bitrate = 240,
+          .hw_value = 0x200,
+          .hw_value_short = 0x200, },
+        { .bitrate = 360,
+         .hw_value = 0x400,
+         .hw_value_short = 0x400, },
+        { .bitrate = 480,
+          .hw_value = 0x800,
+          .hw_value_short = 0x800, },
+        { .bitrate = 540,
+          .hw_value = 0x1000,
+          .hw_value_short = 0x1000, },
+};
+
+/* can't be const, mac80211 writes to this */
+static struct ieee80211_channel wl12xx_channels[] = {
+        { .hw_value = 1, .center_freq = 2412},
+        { .hw_value = 2, .center_freq = 2417},
+        { .hw_value = 3, .center_freq = 2422},
+        { .hw_value = 4, .center_freq = 2427},
+        { .hw_value = 5, .center_freq = 2432},
+        { .hw_value = 6, .center_freq = 2437},
+        { .hw_value = 7, .center_freq = 2442},
+        { .hw_value = 8, .center_freq = 2447},
+        { .hw_value = 9, .center_freq = 2452},
+        { .hw_value = 10, .center_freq = 2457},
+        { .hw_value = 11, .center_freq = 2462},
+        { .hw_value = 12, .center_freq = 2467},
+        { .hw_value = 13, .center_freq = 2472},
+};
+
+/* can't be const, mac80211 writes to this */
+static struct ieee80211_supported_band wl12xx_band_2ghz = {
+        .channels = wl12xx_channels,
+        .n_channels = ARRAY_SIZE(wl12xx_channels),
+        .bitrates = wl12xx_rates,
+        .n_bitrates = ARRAY_SIZE(wl12xx_rates),
+};
+
+static const struct ieee80211_ops wl12xx_ops = {
+        .start = wl12xx_op_start,
+        .stop = wl12xx_op_stop,
+        .add_interface = wl12xx_op_add_interface,
+        .remove_interface = wl12xx_op_remove_interface,
+        .config = wl12xx_op_config,
+        .configure_filter = wl12xx_op_configure_filter,
+        .tx = wl12xx_op_tx,
+        .set_key = wl12xx_op_set_key,
+        .hw_scan = wl12xx_op_hw_scan,
+        .bss_info_changed = wl12xx_op_bss_info_changed,
+        .set_rts_threshold = wl12xx_op_set_rts_threshold,
+};
+
+static int wl12xx_register_hw(struct wl12xx *wl)
+{
+        int ret;
+
+        if (wl->mac80211_registered)
+                return 0;
+
+        SET_IEEE80211_PERM_ADDR(wl->hw, wl->mac_addr);
+
+        ret = ieee80211_register_hw(wl->hw);
+        if (ret < 0) {
+                wl12xx_error("unable to register mac80211 hw: %d", ret);
+                return ret;
+        }
+
+        wl->mac80211_registered = true;
+
+        wl12xx_notice("loaded");
+
+        return 0;
+}
+
+static int wl12xx_init_ieee80211(struct wl12xx *wl)
+{
+        /* The tx descriptor buffer and the TKIP space */
+        wl->hw->extra_tx_headroom = sizeof(struct tx_double_buffer_desc)
+                + WL12XX_TKIP_IV_SPACE;
+
+        /* unit us */
+        /* FIXME: find a proper value */
+        wl->hw->channel_change_time = 10000;
+
+        wl->hw->flags = IEEE80211_HW_SIGNAL_DBM |
+                IEEE80211_HW_NOISE_DBM;
+
+        wl->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);
+        wl->hw->wiphy->max_scan_ssids = 1;
+        wl->hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &wl12xx_band_2ghz;
+
+        SET_IEEE80211_DEV(wl->hw, &wl->spi->dev);
+
+        return 0;
+}
+
+#define WL12XX_DEFAULT_CHANNEL 1
+static int __devinit wl12xx_probe(struct spi_device *spi)
+{
+        struct wl12xx_platform_data *pdata;
+        struct ieee80211_hw *hw;
+        struct wl12xx *wl;
+        int ret, i;
+        static const u8 nokia_oui[3] = {0x00, 0x1f, 0xdf};
+
+        pdata = spi->dev.platform_data;
+        if (!pdata) {
+                wl12xx_error("no platform data");
+                return -ENODEV;
+        }
+
+        hw = ieee80211_alloc_hw(sizeof(*wl), &wl12xx_ops);
+        if (!hw) {
+                wl12xx_error("could not alloc ieee80211_hw");
+                return -ENOMEM;
+        }
+
+        wl = hw->priv;
+        memset(wl, 0, sizeof(*wl));
+
+        wl->hw = hw;
+        dev_set_drvdata(&spi->dev, wl);
+        wl->spi = spi;
+
+        wl->data_in_count = 0;
+
+        skb_queue_head_init(&wl->tx_queue);
+
+        INIT_WORK(&wl->tx_work, wl12xx_tx_work);
+        INIT_WORK(&wl->filter_work, wl12xx_filter_work);
+        wl->channel = WL12XX_DEFAULT_CHANNEL;
+        wl->scanning = false;
+        wl->default_key = 0;
+        wl->listen_int = 1;
+        wl->rx_counter = 0;
+        wl->rx_handled = 0;
+        wl->rx_current_buffer = 0;
+        wl->rx_last_id = 0;
+        wl->rx_config = WL12XX_DEFAULT_RX_CONFIG;
+        wl->rx_filter = WL12XX_DEFAULT_RX_FILTER;
+        wl->elp = false;
+        wl->psm = 0;
+        wl->psm_requested = false;
+        wl->tx_queue_stopped = false;
+        wl->power_level = WL12XX_DEFAULT_POWER_LEVEL;
+
+        /* We use the default power on sleep time until we know which chip
+         * we're using */
+        wl->chip.power_on_sleep = WL12XX_DEFAULT_POWER_ON_SLEEP;
+
+        for (i = 0; i < FW_TX_CMPLT_BLOCK_SIZE; i++)
+                wl->tx_frames[i] = NULL;
+
+        wl->next_tx_complete = 0;
+
+        /*
+         * In case our MAC address is not correctly set,
+         * we use a random but Nokia MAC.
+         */
+        memcpy(wl->mac_addr, nokia_oui, 3);
+        get_random_bytes(wl->mac_addr + 3, 3);
+
+        wl->state = WL12XX_STATE_OFF;
+        mutex_init(&wl->mutex);
+
+        wl->tx_mgmt_frm_rate = DEFAULT_HW_GEN_TX_RATE;
+        wl->tx_mgmt_frm_mod = DEFAULT_HW_GEN_MODULATION_TYPE;
+
+        /* This is the only SPI value that we need to set here, the rest
+         * comes from the board-peripherals file */
+        spi->bits_per_word = 32;
+
+        ret = spi_setup(spi);
+        if (ret < 0) {
+                wl12xx_error("spi_setup failed");
+                goto out_free;
+        }
+
+        wl->set_power = pdata->set_power;
+        if (!wl->set_power) {
+                wl12xx_error("set power function missing in platform data");
+                return -ENODEV;
+        }
+
+        wl->irq = spi->irq;
+        if (wl->irq < 0) {
+                wl12xx_error("irq missing in platform data");
+                return -ENODEV;
+        }
+
+        ret = request_irq(wl->irq, wl12xx_irq, 0, DRIVER_NAME, wl);
+        if (ret < 0) {
+                wl12xx_error("request_irq() failed: %d", ret);
+                goto out_free;
+        }
+
+        set_irq_type(wl->irq, IRQ_TYPE_EDGE_RISING);
+
+        disable_irq(wl->irq);
+
+        ret = wl12xx_init_ieee80211(wl);
+        if (ret)
+                goto out_irq;
+
+        ret = wl12xx_register_hw(wl);
+        if (ret)
+                goto out_irq;
+
+        wl12xx_debugfs_init(wl);
+
+        wl12xx_notice("initialized");
+
+        return 0;
+
+ out_irq:
+        free_irq(wl->irq, wl);
+
+ out_free:
+        ieee80211_free_hw(hw);
+
+        return ret;
+}
+
+static int __devexit wl12xx_remove(struct spi_device *spi)
+{
+        struct wl12xx *wl = dev_get_drvdata(&spi->dev);
+
+        ieee80211_unregister_hw(wl->hw);
+
+        wl12xx_debugfs_exit(wl);
+
+        free_irq(wl->irq, wl);
+        kfree(wl->target_mem_map);
+        kfree(wl->data_path);
+        kfree(wl->fw);
+        wl->fw = NULL;
+        kfree(wl->nvs);
+        wl->nvs = NULL;
+        ieee80211_free_hw(wl->hw);
+
+        return 0;
+}
+
+
+static struct spi_driver wl12xx_spi_driver = {
+        .driver = {
+                .name           = "wl12xx",
+                .bus            = &spi_bus_type,
+                .owner          = THIS_MODULE,
+        },
+
+        .probe          = wl12xx_probe,
+        .remove         = __devexit_p(wl12xx_remove),
+};
+
+static int __init wl12xx_init(void)
+{
+        int ret;
+
+        ret = spi_register_driver(&wl12xx_spi_driver);
+        if (ret < 0) {
+                wl12xx_error("failed to register spi driver: %d", ret);
+                goto out;
+        }
+
+out:
+        return ret;
+}
+
+static void __exit wl12xx_exit(void)
+{
+        spi_unregister_driver(&wl12xx_spi_driver);
+
+        wl12xx_notice("unloaded");
+}
+
+module_init(wl12xx_init);
+module_exit(wl12xx_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Kalle Valo <Kalle.Valo@nokia.com>, "
+                "Luciano Coelho <luciano.coelho@nokia.com>");
diff --git a/drivers/net/wireless/wl12xx/ps.c b/drivers/net/wireless/wl12xx/ps.c
new file mode 100644
index 000000000000..83a10117330b
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/ps.c
@@ -0,0 +1,151 @@
+/*
+ * This file is part of wl12xx
+ *
+ * Copyright (C) 2008 Nokia Corporation
+ *
+ * Contact: Kalle Valo <kalle.valo@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include "reg.h"
+#include "ps.h"
+#include "spi.h"
+
+#define WL12XX_WAKEUP_TIMEOUT 2000
+
+/* Routines to toggle sleep mode while in ELP */
+void wl12xx_ps_elp_sleep(struct wl12xx *wl)
+{
+        if (wl->elp || !wl->psm)
+                return;
+
+        wl12xx_debug(DEBUG_PSM, "chip to elp");
+
+        wl12xx_write32(wl, HW_ACCESS_ELP_CTRL_REG_ADDR, ELPCTRL_SLEEP);
+
+        wl->elp = true;
+}
+
+int wl12xx_ps_elp_wakeup(struct wl12xx *wl)
+{
+        unsigned long timeout;
+        u32 elp_reg;
+
+        if (!wl->elp)
+                return 0;
+
+        wl12xx_debug(DEBUG_PSM, "waking up chip from elp");
+
+        timeout = jiffies + msecs_to_jiffies(WL12XX_WAKEUP_TIMEOUT);
+
+        wl12xx_write32(wl, HW_ACCESS_ELP_CTRL_REG_ADDR, ELPCTRL_WAKE_UP);
+
+        elp_reg = wl12xx_read32(wl, HW_ACCESS_ELP_CTRL_REG_ADDR);
+
+        /*
+         * FIXME: we should wait for irq from chip but, as a temporary
+         * solution to simplify locking, let's poll instead
+         */
+        while (!(elp_reg & ELPCTRL_WLAN_READY)) {
+                if (time_after(jiffies, timeout)) {
+                        wl12xx_error("elp wakeup timeout");
+                        return -ETIMEDOUT;
+                }
+                msleep(1);
+                elp_reg = wl12xx_read32(wl, HW_ACCESS_ELP_CTRL_REG_ADDR);
+        }
+
+        wl12xx_debug(DEBUG_PSM, "wakeup time: %u ms",
+                     jiffies_to_msecs(jiffies) -
+                     (jiffies_to_msecs(timeout) - WL12XX_WAKEUP_TIMEOUT));
+
+        wl->elp = false;
+
+        return 0;
+}
+
+static int wl12xx_ps_set_elp(struct wl12xx *wl, bool enable)
+{
+        int ret;
+
+        if (enable) {
+                wl12xx_debug(DEBUG_PSM, "sleep auth psm/elp");
+
+                /*
+                 * FIXME: we should PSM_ELP, but because of firmware wakeup
+                 * problems let's use only PSM_PS
+                 */
+                ret = wl12xx_acx_sleep_auth(wl, WL12XX_PSM_PS);
+                if (ret < 0)
+                        return ret;
+
+                wl12xx_ps_elp_sleep(wl);
+        } else {
+                wl12xx_debug(DEBUG_PSM, "sleep auth cam");
+
+                /*
+                 * When the target is in ELP, we can only
+                 * access the ELP control register. Thus,
+                 * we have to wake the target up before
+                 * changing the power authorization.
+                 */
+
+                wl12xx_ps_elp_wakeup(wl);
+
+                ret = wl12xx_acx_sleep_auth(wl, WL12XX_PSM_CAM);
+                if (ret < 0)
+                        return ret;
+        }
+
+        return 0;
+}
+
+int wl12xx_ps_set_mode(struct wl12xx *wl, enum acx_ps_mode mode)
+{
+        int ret;
+
+        switch (mode) {
+        case STATION_POWER_SAVE_MODE:
+                wl12xx_debug(DEBUG_PSM, "entering psm");
+                ret = wl12xx_cmd_ps_mode(wl, STATION_POWER_SAVE_MODE);
+                if (ret < 0)
+                        return ret;
+
+                ret = wl12xx_ps_set_elp(wl, true);
+                if (ret < 0)
+                        return ret;
+
+                wl->psm = 1;
+                break;
+        case STATION_ACTIVE_MODE:
+        default:
+                wl12xx_debug(DEBUG_PSM, "leaving psm");
+                ret = wl12xx_ps_set_elp(wl, false);
+                if (ret < 0)
+                        return ret;
+
+                ret = wl12xx_cmd_ps_mode(wl, STATION_ACTIVE_MODE);
+                if (ret < 0)
+                        return ret;
+
+                wl->psm = 0;
+                break;
+        }
+
+        return ret;
+}
+
diff --git a/drivers/net/wireless/wl12xx/ps.h b/drivers/net/wireless/wl12xx/ps.h
new file mode 100644
index 000000000000..5d7c52553830
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/ps.h
@@ -0,0 +1,36 @@
+#ifndef __WL12XX_PS_H__
+#define __WL12XX_PS_H__
+
+/*
+ * This file is part of wl12xx
+ *
+ * Copyright (c) 1998-2007 Texas Instruments Incorporated
+ * Copyright (C) 2008 Nokia Corporation
+ *
+ * Contact: Kalle Valo <kalle.valo@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include "wl12xx.h"
+#include "acx.h"
+
+int wl12xx_ps_set_mode(struct wl12xx *wl, enum acx_ps_mode mode);
+void wl12xx_ps_elp_sleep(struct wl12xx *wl);
+int wl12xx_ps_elp_wakeup(struct wl12xx *wl);
+
+
+#endif /* __WL12XX_PS_H__ */
diff --git a/drivers/net/wireless/wl12xx/reg.h b/drivers/net/wireless/wl12xx/reg.h
new file mode 100644
index 000000000000..e421643215cd
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/reg.h
@@ -0,0 +1,745 @@
+/*
+ * This file is part of wl12xx
+ *
+ * Copyright (c) 1998-2007 Texas Instruments Incorporated
+ * Copyright (C) 2008 Nokia Corporation
+ *
+ * Contact: Kalle Valo <kalle.valo@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __REG_H__
+#define __REG_H__
+
+#include <linux/bitops.h>
+#include "wl12xx.h"
+
+#define REGISTERS_BASE 0x00300000
+#define DRPW_BASE      0x00310000
+
+#define REGISTERS_DOWN_SIZE 0x00008800
+#define REGISTERS_WORK_SIZE 0x0000b000
+
+#define HW_ACCESS_ELP_CTRL_REG_ADDR         0x1FFFC
+
+/* ELP register commands */
+#define ELPCTRL_WAKE_UP             0x1
+#define ELPCTRL_WAKE_UP_WLAN_READY  0x5
+#define ELPCTRL_SLEEP               0x0
+/* ELP WLAN_READY bit */
+#define ELPCTRL_WLAN_READY          0x2
+
+/*
+ * Interrupt registers.
+ * 64 bit interrupt sources registers ws ced.
+ * sme interupts were removed and new ones were added.
+ * Order was changed.
+ */
+#define FIQ_MASK                       (REGISTERS_BASE + 0x0400)
+#define FIQ_MASK_L                     (REGISTERS_BASE + 0x0400)
+#define FIQ_MASK_H                     (REGISTERS_BASE + 0x0404)
+#define FIQ_MASK_SET                   (REGISTERS_BASE + 0x0408)
+#define FIQ_MASK_SET_L                 (REGISTERS_BASE + 0x0408)
+#define FIQ_MASK_SET_H                 (REGISTERS_BASE + 0x040C)
+#define FIQ_MASK_CLR                   (REGISTERS_BASE + 0x0410)
+#define FIQ_MASK_CLR_L                 (REGISTERS_BASE + 0x0410)
+#define FIQ_MASK_CLR_H                 (REGISTERS_BASE + 0x0414)
+#define IRQ_MASK                       (REGISTERS_BASE + 0x0418)
+#define IRQ_MASK_L                     (REGISTERS_BASE + 0x0418)
+#define IRQ_MASK_H                     (REGISTERS_BASE + 0x041C)
+#define IRQ_MASK_SET                   (REGISTERS_BASE + 0x0420)
+#define IRQ_MASK_SET_L                 (REGISTERS_BASE + 0x0420)
+#define IRQ_MASK_SET_H                 (REGISTERS_BASE + 0x0424)
+#define IRQ_MASK_CLR                   (REGISTERS_BASE + 0x0428)
+#define IRQ_MASK_CLR_L                 (REGISTERS_BASE + 0x0428)
+#define IRQ_MASK_CLR_H                 (REGISTERS_BASE + 0x042C)
+#define ECPU_MASK                      (REGISTERS_BASE + 0x0448)
+#define FIQ_STS_L                      (REGISTERS_BASE + 0x044C)
+#define FIQ_STS_H                      (REGISTERS_BASE + 0x0450)
+#define IRQ_STS_L                      (REGISTERS_BASE + 0x0454)
+#define IRQ_STS_H                      (REGISTERS_BASE + 0x0458)
+#define INT_STS_ND                     (REGISTERS_BASE + 0x0464)
+#define INT_STS_RAW_L                  (REGISTERS_BASE + 0x0464)
+#define INT_STS_RAW_H                  (REGISTERS_BASE + 0x0468)
+#define INT_STS_CLR                    (REGISTERS_BASE + 0x04B4)
+#define INT_STS_CLR_L                  (REGISTERS_BASE + 0x04B4)
+#define INT_STS_CLR_H                  (REGISTERS_BASE + 0x04B8)
+#define INT_ACK                        (REGISTERS_BASE + 0x046C)
+#define INT_ACK_L                      (REGISTERS_BASE + 0x046C)
+#define INT_ACK_H                      (REGISTERS_BASE + 0x0470)
+#define INT_TRIG                       (REGISTERS_BASE + 0x0474)
+#define INT_TRIG_L                     (REGISTERS_BASE + 0x0474)
+#define INT_TRIG_H                     (REGISTERS_BASE + 0x0478)
+#define HOST_STS_L                     (REGISTERS_BASE + 0x045C)
+#define HOST_STS_H                     (REGISTERS_BASE + 0x0460)
+#define HOST_MASK                      (REGISTERS_BASE + 0x0430)
+#define HOST_MASK_L                    (REGISTERS_BASE + 0x0430)
+#define HOST_MASK_H                    (REGISTERS_BASE + 0x0434)
+#define HOST_MASK_SET                  (REGISTERS_BASE + 0x0438)
+#define HOST_MASK_SET_L                (REGISTERS_BASE + 0x0438)
+#define HOST_MASK_SET_H                (REGISTERS_BASE + 0x043C)
+#define HOST_MASK_CLR                  (REGISTERS_BASE + 0x0440)
+#define HOST_MASK_CLR_L                (REGISTERS_BASE + 0x0440)
+#define HOST_MASK_CLR_H                (REGISTERS_BASE + 0x0444)
+
+/* Host Interrupts*/
+#define HINT_MASK                      (REGISTERS_BASE + 0x0494)
+#define HINT_MASK_SET                  (REGISTERS_BASE + 0x0498)
+#define HINT_MASK_CLR                  (REGISTERS_BASE + 0x049C)
+#define HINT_STS_ND_MASKED             (REGISTERS_BASE + 0x04A0)
+/*1150 spec calls this HINT_STS_RAW*/
+#define HINT_STS_ND                    (REGISTERS_BASE + 0x04B0)
+#define HINT_STS_CLR                   (REGISTERS_BASE + 0x04A4)
+#define HINT_ACK                       (REGISTERS_BASE + 0x04A8)
+#define HINT_TRIG                      (REGISTERS_BASE + 0x04AC)
+
+/* Device Configuration registers*/
+#define SOR_CFG                        (REGISTERS_BASE + 0x0800)
+#define ECPU_CTRL                      (REGISTERS_BASE + 0x0804)
+#define HI_CFG                         (REGISTERS_BASE + 0x0808)
+#define EE_START                       (REGISTERS_BASE + 0x080C)
+
+#define CHIP_ID_B                      (REGISTERS_BASE + 0x5674)
+
+#define CHIP_ID_1251_PG10                  (0x7010101)
+#define CHIP_ID_1251_PG11                  (0x7020101)
+#define CHIP_ID_1251_PG12                  (0x7030101)
+
+#define ENABLE                         (REGISTERS_BASE + 0x5450)
+
+/* Power Management registers */
+#define ELP_CFG_MODE                   (REGISTERS_BASE + 0x5804)
+#define ELP_CMD                        (REGISTERS_BASE + 0x5808)
+#define PLL_CAL_TIME                   (REGISTERS_BASE + 0x5810)
+#define CLK_REQ_TIME                   (REGISTERS_BASE + 0x5814)
+#define CLK_BUF_TIME                   (REGISTERS_BASE + 0x5818)
+
+#define CFG_PLL_SYNC_CNT               (REGISTERS_BASE + 0x5820)
+
+/* Scratch Pad registers*/
+#define SCR_PAD0                       (REGISTERS_BASE + 0x5608)
+#define SCR_PAD1                       (REGISTERS_BASE + 0x560C)
+#define SCR_PAD2                       (REGISTERS_BASE + 0x5610)
+#define SCR_PAD3                       (REGISTERS_BASE + 0x5614)
+#define SCR_PAD4                       (REGISTERS_BASE + 0x5618)
+#define SCR_PAD4_SET                   (REGISTERS_BASE + 0x561C)
+#define SCR_PAD4_CLR                   (REGISTERS_BASE + 0x5620)
+#define SCR_PAD5                       (REGISTERS_BASE + 0x5624)
+#define SCR_PAD5_SET                   (REGISTERS_BASE + 0x5628)
+#define SCR_PAD5_CLR                   (REGISTERS_BASE + 0x562C)
+#define SCR_PAD6                       (REGISTERS_BASE + 0x5630)
+#define SCR_PAD7                       (REGISTERS_BASE + 0x5634)
+#define SCR_PAD8                       (REGISTERS_BASE + 0x5638)
+#define SCR_PAD9                       (REGISTERS_BASE + 0x563C)
+
+/* Spare registers*/
+#define SPARE_A1                       (REGISTERS_BASE + 0x0994)
+#define SPARE_A2                       (REGISTERS_BASE + 0x0998)
+#define SPARE_A3                       (REGISTERS_BASE + 0x099C)
+#define SPARE_A4                       (REGISTERS_BASE + 0x09A0)
+#define SPARE_A5                       (REGISTERS_BASE + 0x09A4)
+#define SPARE_A6                       (REGISTERS_BASE + 0x09A8)
+#define SPARE_A7                       (REGISTERS_BASE + 0x09AC)
+#define SPARE_A8                       (REGISTERS_BASE + 0x09B0)
+#define SPARE_B1                       (REGISTERS_BASE + 0x5420)
+#define SPARE_B2                       (REGISTERS_BASE + 0x5424)
+#define SPARE_B3                       (REGISTERS_BASE + 0x5428)
+#define SPARE_B4                       (REGISTERS_BASE + 0x542C)
+#define SPARE_B5                       (REGISTERS_BASE + 0x5430)
+#define SPARE_B6                       (REGISTERS_BASE + 0x5434)
+#define SPARE_B7                       (REGISTERS_BASE + 0x5438)
+#define SPARE_B8                       (REGISTERS_BASE + 0x543C)
+
+enum wl12xx_acx_int_reg {
+        ACX_REG_INTERRUPT_TRIG,
+        ACX_REG_INTERRUPT_TRIG_H,
+
+/*=============================================
+  Host Interrupt Mask Register - 32bit (RW)
+  ------------------------------------------
+  Setting a bit in this register masks the
+  corresponding interrupt to the host.
+  0 - RX0               - Rx first dubble buffer Data Interrupt
+  1 - TXD               - Tx Data Interrupt
+  2 - TXXFR             - Tx Transfer Interrupt
+  3 - RX1               - Rx second dubble buffer Data Interrupt
+  4 - RXXFR             - Rx Transfer Interrupt
+  5 - EVENT_A   - Event Mailbox interrupt
+  6 - EVENT_B   - Event Mailbox interrupt
+  7 - WNONHST   - Wake On Host Interrupt
+  8 - TRACE_A   - Debug Trace interrupt
+  9 - TRACE_B   - Debug Trace interrupt
+ 10 - CDCMP             - Command Complete Interrupt
+ 11 -
+ 12 -
+ 13 -
+ 14 - ICOMP             - Initialization Complete Interrupt
+ 16 - SG SE             - Soft Gemini - Sense enable interrupt
+ 17 - SG SD             - Soft Gemini - Sense disable interrupt
+ 18 -                   -
+ 19 -                   -
+ 20 -                   -
+ 21-                    -
+ Default: 0x0001
+*==============================================*/
+        ACX_REG_INTERRUPT_MASK,
+
+/*=============================================
+  Host Interrupt Mask Set 16bit, (Write only)
+  ------------------------------------------
+ Setting a bit in this register sets
+ the corresponding bin in ACX_HINT_MASK register
+ without effecting the mask
+ state of other bits (0 = no effect).
+==============================================*/
+        ACX_REG_HINT_MASK_SET,
+
+/*=============================================
+  Host Interrupt Mask Clear 16bit,(Write only)
+  ------------------------------------------
+ Setting a bit in this register clears
+ the corresponding bin in ACX_HINT_MASK register
+ without effecting the mask
+ state of other bits (0 = no effect).
+=============================================*/
+        ACX_REG_HINT_MASK_CLR,
+
+/*=============================================
+  Host Interrupt Status Nondestructive Read
+  16bit,(Read only)
+  ------------------------------------------
+ The host can read this register to determine
+ which interrupts are active.
+ Reading this register doesn't
+ effect its content.
+=============================================*/
+        ACX_REG_INTERRUPT_NO_CLEAR,
+
+/*=============================================
+  Host Interrupt Status Clear on Read  Register
+  16bit,(Read only)
+  ------------------------------------------
+ The host can read this register to determine
+ which interrupts are active.
+ Reading this register clears it,
+ thus making all interrupts inactive.
+==============================================*/
+        ACX_REG_INTERRUPT_CLEAR,
+
+/*=============================================
+  Host Interrupt Acknowledge Register
+  16bit,(Write only)
+  ------------------------------------------
+ The host can set individual bits in this
+ register to clear (acknowledge) the corresp.
+ interrupt status bits in the HINT_STS_CLR and
+ HINT_STS_ND registers, thus making the
+ assotiated interrupt inactive. (0-no effect)
+==============================================*/
+        ACX_REG_INTERRUPT_ACK,
+
+/*===============================================
+   Host Software Reset - 32bit RW
+ ------------------------------------------
+    [31:1] Reserved
+    0  SOFT_RESET Soft Reset  - When this bit is set,
+    it holds the Wlan hardware in a soft reset state.
+    This reset disables all MAC and baseband processor
+    clocks except the CardBus/PCI interface clock.
+    It also initializes all MAC state machines except
+    the host interface. It does not reload the
+    contents of the EEPROM. When this bit is cleared
+    (not self-clearing), the Wlan hardware
+    exits the software reset state.
+===============================================*/
+        ACX_REG_SLV_SOFT_RESET,
+
+/*===============================================
+ EEPROM Burst Read Start  - 32bit RW
+ ------------------------------------------
+ [31:1] Reserved
+ 0  ACX_EE_START -  EEPROM Burst Read Start 0
+ Setting this bit starts a burst read from
+ the external EEPROM.
+ If this bit is set (after reset) before an EEPROM read/write,
+ the burst read starts at EEPROM address 0.
+ Otherwise, it starts at the address
+ following the address of the previous access.
+ TheWlan hardware hardware clears this bit automatically.
+
+ Default: 0x00000000
+*================================================*/
+        ACX_REG_EE_START,
+
+/* Embedded ARM CPU Control */
+
+/*===============================================
+ Halt eCPU   - 32bit RW
+ ------------------------------------------
+ 0 HALT_ECPU Halt Embedded CPU - This bit is the
+ compliment of bit 1 (MDATA2) in the SOR_CFG register.
+ During a hardware reset, this bit holds
+ the inverse of MDATA2.
+ When downloading firmware from the host,
+ set this bit (pull down MDATA2).
+ The host clears this bit after downloading the firmware into
+ zero-wait-state SSRAM.
+ When loading firmware from Flash, clear this bit (pull up MDATA2)
+ so that the eCPU can run the bootloader code in Flash
+ HALT_ECPU eCPU State
+ --------------------
+ 1 halt eCPU
+ 0 enable eCPU
+ ===============================================*/
+        ACX_REG_ECPU_CONTROL,
+
+        ACX_REG_TABLE_LEN
+};
+
+#define ACX_SLV_SOFT_RESET_BIT   BIT(1)
+#define ACX_REG_EEPROM_START_BIT BIT(1)
+
+/* Command/Information Mailbox Pointers */
+
+/*===============================================
+  Command Mailbox Pointer - 32bit RW
+ ------------------------------------------
+ This register holds the start address of
+ the command mailbox located in the Wlan hardware memory.
+ The host must read this pointer after a reset to
+ find the location of the command mailbox.
+ The Wlan hardware initializes the command mailbox
+ pointer with the default address of the command mailbox.
+ The command mailbox pointer is not valid until after
+ the host receives the Init Complete interrupt from
+ the Wlan hardware.
+ ===============================================*/
+#define REG_COMMAND_MAILBOX_PTR                         (SCR_PAD0)
+
+/*===============================================
+  Information Mailbox Pointer - 32bit RW
+ ------------------------------------------
+ This register holds the start address of
+ the information mailbox located in the Wlan hardware memory.
+ The host must read this pointer after a reset to find
+ the location of the information mailbox.
+ The Wlan hardware initializes the information mailbox pointer
+ with the default address of the information mailbox.
+ The information mailbox pointer is not valid
+ until after the host receives the Init Complete interrupt from
+ the Wlan hardware.
+ ===============================================*/
+#define REG_EVENT_MAILBOX_PTR                           (SCR_PAD1)
+
+
+/* Misc */
+
+#define REG_ENABLE_TX_RX                                (ENABLE)
+/*
+ * Rx configuration (filter) information element
+ * ---------------------------------------------
+ */
+#define REG_RX_CONFIG                           (RX_CFG)
+#define REG_RX_FILTER                           (RX_FILTER_CFG)
+
+
+#define RX_CFG_ENABLE_PHY_HEADER_PLCP    0x0002
+
+/* promiscuous - receives all valid frames */
+#define RX_CFG_PROMISCUOUS               0x0008
+
+/* receives frames from any BSSID */
+#define RX_CFG_BSSID                     0x0020
+
+/* receives frames destined to any MAC address */
+#define RX_CFG_MAC                       0x0010
+
+#define RX_CFG_ENABLE_ONLY_MY_DEST_MAC   0x0010
+#define RX_CFG_ENABLE_ANY_DEST_MAC       0x0000
+#define RX_CFG_ENABLE_ONLY_MY_BSSID      0x0020
+#define RX_CFG_ENABLE_ANY_BSSID          0x0000
+
+/* discards all broadcast frames */
+#define RX_CFG_DISABLE_BCAST             0x0200
+
+#define RX_CFG_ENABLE_ONLY_MY_SSID       0x0400
+#define RX_CFG_ENABLE_RX_CMPLT_FCS_ERROR 0x0800
+#define RX_CFG_COPY_RX_STATUS            0x2000
+#define RX_CFG_TSF                       0x10000
+
+#define RX_CONFIG_OPTION_ANY_DST_MY_BSS  (RX_CFG_ENABLE_ANY_DEST_MAC | \
+                                          RX_CFG_ENABLE_ONLY_MY_BSSID)
+
+#define RX_CONFIG_OPTION_MY_DST_ANY_BSS  (RX_CFG_ENABLE_ONLY_MY_DEST_MAC\
+                                          | RX_CFG_ENABLE_ANY_BSSID)
+
+#define RX_CONFIG_OPTION_ANY_DST_ANY_BSS (RX_CFG_ENABLE_ANY_DEST_MAC | \
+                                          RX_CFG_ENABLE_ANY_BSSID)
+
+#define RX_CONFIG_OPTION_MY_DST_MY_BSS   (RX_CFG_ENABLE_ONLY_MY_DEST_MAC\
+                                          | RX_CFG_ENABLE_ONLY_MY_BSSID)
+
+#define RX_CONFIG_OPTION_FOR_SCAN  (RX_CFG_ENABLE_PHY_HEADER_PLCP \
+                                    | RX_CFG_ENABLE_RX_CMPLT_FCS_ERROR \
+                                    | RX_CFG_COPY_RX_STATUS | RX_CFG_TSF)
+
+#define RX_CONFIG_OPTION_FOR_MEASUREMENT (RX_CFG_ENABLE_ANY_DEST_MAC)
+
+#define RX_CONFIG_OPTION_FOR_JOIN        (RX_CFG_ENABLE_ONLY_MY_BSSID | \
+                                          RX_CFG_ENABLE_ONLY_MY_DEST_MAC)
+
+#define RX_CONFIG_OPTION_FOR_IBSS_JOIN   (RX_CFG_ENABLE_ONLY_MY_SSID | \
+                                          RX_CFG_ENABLE_ONLY_MY_DEST_MAC)
+
+#define RX_FILTER_OPTION_DEF          (CFG_RX_MGMT_EN | CFG_RX_DATA_EN\
+                                       | CFG_RX_CTL_EN | CFG_RX_BCN_EN\
+                                       | CFG_RX_AUTH_EN | CFG_RX_ASSOC_EN)
+
+#define RX_FILTER_OPTION_FILTER_ALL      0
+
+#define RX_FILTER_OPTION_DEF_PRSP_BCN  (CFG_RX_PRSP_EN | CFG_RX_MGMT_EN\
+                                        | CFG_RX_RCTS_ACK | CFG_RX_BCN_EN)
+
+#define RX_FILTER_OPTION_JOIN        (CFG_RX_MGMT_EN | CFG_RX_DATA_EN\
+                                      | CFG_RX_BCN_EN | CFG_RX_AUTH_EN\
+                                      | CFG_RX_ASSOC_EN | CFG_RX_RCTS_ACK\
+                                      | CFG_RX_PRSP_EN)
+
+
+/*===============================================
+  Phy regs
+ ===============================================*/
+#define ACX_PHY_ADDR_REG                SBB_ADDR
+#define ACX_PHY_DATA_REG                SBB_DATA
+#define ACX_PHY_CTRL_REG                SBB_CTL
+#define ACX_PHY_REG_WR_MASK             0x00000001ul
+#define ACX_PHY_REG_RD_MASK             0x00000002ul
+
+
+/*===============================================
+ EEPROM Read/Write Request 32bit RW
+ ------------------------------------------
+ 1 EE_READ - EEPROM Read Request 1 - Setting this bit
+ loads a single byte of data into the EE_DATA
+ register from the EEPROM location specified in
+ the EE_ADDR register.
+ The Wlan hardware hardware clears this bit automatically.
+ EE_DATA is valid when this bit is cleared.
+
+ 0 EE_WRITE  - EEPROM Write Request  - Setting this bit
+ writes a single byte of data from the EE_DATA register into the
+ EEPROM location specified in the EE_ADDR register.
+ The Wlan hardware hardware clears this bit automatically.
+*===============================================*/
+#define ACX_EE_CTL_REG                      EE_CTL
+#define EE_WRITE                            0x00000001ul
+#define EE_READ                             0x00000002ul
+
+/*===============================================
+  EEPROM Address  - 32bit RW
+  ------------------------------------------
+  This register specifies the address
+  within the EEPROM from/to which to read/write data.
+  ===============================================*/
+#define ACX_EE_ADDR_REG                     EE_ADDR
+
+/*===============================================
+  EEPROM Data  - 32bit RW
+  ------------------------------------------
+  This register either holds the read 8 bits of
+  data from the EEPROM or the write data
+  to be written to the EEPROM.
+  ===============================================*/
+#define ACX_EE_DATA_REG                     EE_DATA
+
+/*===============================================
+  EEPROM Base Address  - 32bit RW
+  ------------------------------------------
+  This register holds the upper nine bits
+  [23:15] of the 24-bit Wlan hardware memory
+  address for burst reads from EEPROM accesses.
+  The EEPROM provides the lower 15 bits of this address.
+  The MSB of the address from the EEPROM is ignored.
+  ===============================================*/
+#define ACX_EE_CFG                          EE_CFG
+
+/*===============================================
+  GPIO Output Values  -32bit, RW
+  ------------------------------------------
+  [31:16]  Reserved
+  [15: 0]  Specify the output values (at the output driver inputs) for
+  GPIO[15:0], respectively.
+  ===============================================*/
+#define ACX_GPIO_OUT_REG            GPIO_OUT
+#define ACX_MAX_GPIO_LINES          15
+
+/*===============================================
+  Contention window  -32bit, RW
+  ------------------------------------------
+  [31:26]  Reserved
+  [25:16]  Max (0x3ff)
+  [15:07]  Reserved
+  [06:00]  Current contention window value - default is 0x1F
+  ===============================================*/
+#define ACX_CONT_WIND_CFG_REG    CONT_WIND_CFG
+#define ACX_CONT_WIND_MIN_MASK   0x0000007f
+#define ACX_CONT_WIND_MAX        0x03ff0000
+
+/*
+ * Indirect slave register/memory registers
+ * ----------------------------------------
+ */
+#define HW_SLAVE_REG_ADDR_REG           0x00000004
+#define HW_SLAVE_REG_DATA_REG           0x00000008
+#define HW_SLAVE_REG_CTRL_REG           0x0000000c
+
+#define SLAVE_AUTO_INC                          0x00010000
+#define SLAVE_NO_AUTO_INC                       0x00000000
+#define SLAVE_HOST_LITTLE_ENDIAN        0x00000000
+
+#define HW_SLAVE_MEM_ADDR_REG           SLV_MEM_ADDR
+#define HW_SLAVE_MEM_DATA_REG           SLV_MEM_DATA
+#define HW_SLAVE_MEM_CTRL_REG           SLV_MEM_CTL
+#define HW_SLAVE_MEM_ENDIAN_REG         SLV_END_CTL
+
+#define HW_FUNC_EVENT_INT_EN            0x8000
+#define HW_FUNC_EVENT_MASK_REG          0x00000034
+
+#define ACX_MAC_TIMESTAMP_REG   (MAC_TIMESTAMP)
+
+/*===============================================
+  HI_CFG Interface Configuration Register Values
+  ------------------------------------------
+  ===============================================*/
+#define HI_CFG_UART_ENABLE          0x00000004
+#define HI_CFG_RST232_ENABLE        0x00000008
+#define HI_CFG_CLOCK_REQ_SELECT     0x00000010
+#define HI_CFG_HOST_INT_ENABLE      0x00000020
+#define HI_CFG_VLYNQ_OUTPUT_ENABLE  0x00000040
+#define HI_CFG_HOST_INT_ACTIVE_LOW  0x00000080
+#define HI_CFG_UART_TX_OUT_GPIO_15  0x00000100
+#define HI_CFG_UART_TX_OUT_GPIO_14  0x00000200
+#define HI_CFG_UART_TX_OUT_GPIO_7   0x00000400
+
+/*
+ * NOTE: USE_ACTIVE_HIGH compilation flag should be defined in makefile
+ *       for platforms using active high interrupt level
+ */
+#ifdef USE_ACTIVE_HIGH
+#define HI_CFG_DEF_VAL              \
+        (HI_CFG_UART_ENABLE |        \
+        HI_CFG_RST232_ENABLE |      \
+        HI_CFG_CLOCK_REQ_SELECT |   \
+        HI_CFG_HOST_INT_ENABLE)
+#else
+#define HI_CFG_DEF_VAL              \
+        (HI_CFG_UART_ENABLE |        \
+        HI_CFG_RST232_ENABLE |      \
+        HI_CFG_CLOCK_REQ_SELECT |   \
+        HI_CFG_HOST_INT_ENABLE)
+
+#endif
+
+#define REF_FREQ_19_2                       0
+#define REF_FREQ_26_0                       1
+#define REF_FREQ_38_4                       2
+#define REF_FREQ_40_0                       3
+#define REF_FREQ_33_6                       4
+#define REF_FREQ_NUM                        5
+
+#define LUT_PARAM_INTEGER_DIVIDER           0
+#define LUT_PARAM_FRACTIONAL_DIVIDER        1
+#define LUT_PARAM_ATTN_BB                   2
+#define LUT_PARAM_ALPHA_BB                  3
+#define LUT_PARAM_STOP_TIME_BB              4
+#define LUT_PARAM_BB_PLL_LOOP_FILTER        5
+#define LUT_PARAM_NUM                       6
+
+#define ACX_EEPROMLESS_IND_REG              (SCR_PAD4)
+#define USE_EEPROM                          0
+#define SOFT_RESET_MAX_TIME                 1000000
+#define SOFT_RESET_STALL_TIME               1000
+#define NVS_DATA_BUNDARY_ALIGNMENT          4
+
+
+/* Firmware image load chunk size */
+#define CHUNK_SIZE          512
+
+/* Firmware image header size */
+#define FW_HDR_SIZE 8
+
+#define ECPU_CONTROL_HALT                                       0x00000101
+
+
+/******************************************************************************
+
+    CHANNELS, BAND & REG DOMAINS definitions
+
+******************************************************************************/
+
+
+enum {
+        RADIO_BAND_2_4GHZ = 0,  /* 2.4 Ghz band */
+        RADIO_BAND_5GHZ = 1,    /* 5 Ghz band */
+        RADIO_BAND_JAPAN_4_9_GHZ = 2,
+        DEFAULT_BAND = RADIO_BAND_2_4GHZ,
+        INVALID_BAND = 0xFE,
+        MAX_RADIO_BANDS = 0xFF
+};
+
+enum {
+        NO_RATE      = 0,
+        RATE_1MBPS   = 0x0A,
+        RATE_2MBPS   = 0x14,
+        RATE_5_5MBPS = 0x37,
+        RATE_6MBPS   = 0x0B,
+        RATE_9MBPS   = 0x0F,
+        RATE_11MBPS  = 0x6E,
+        RATE_12MBPS  = 0x0A,
+        RATE_18MBPS  = 0x0E,
+        RATE_22MBPS  = 0xDC,
+        RATE_24MBPS  = 0x09,
+        RATE_36MBPS  = 0x0D,
+        RATE_48MBPS  = 0x08,
+        RATE_54MBPS  = 0x0C
+};
+
+enum {
+        RATE_INDEX_1MBPS   =  0,
+        RATE_INDEX_2MBPS   =  1,
+        RATE_INDEX_5_5MBPS =  2,
+        RATE_INDEX_6MBPS   =  3,
+        RATE_INDEX_9MBPS   =  4,
+        RATE_INDEX_11MBPS  =  5,
+        RATE_INDEX_12MBPS  =  6,
+        RATE_INDEX_18MBPS  =  7,
+        RATE_INDEX_22MBPS  =  8,
+        RATE_INDEX_24MBPS  =  9,
+        RATE_INDEX_36MBPS  =  10,
+        RATE_INDEX_48MBPS  =  11,
+        RATE_INDEX_54MBPS  =  12,
+        RATE_INDEX_MAX     =  RATE_INDEX_54MBPS,
+        MAX_RATE_INDEX,
+        INVALID_RATE_INDEX = MAX_RATE_INDEX,
+        RATE_INDEX_ENUM_MAX_SIZE = 0x7FFFFFFF
+};
+
+enum {
+        RATE_MASK_1MBPS = 0x1,
+        RATE_MASK_2MBPS = 0x2,
+        RATE_MASK_5_5MBPS = 0x4,
+        RATE_MASK_11MBPS = 0x20,
+};
+
+#define SHORT_PREAMBLE_BIT   BIT(0) /* CCK or Barker depending on the rate */
+#define OFDM_RATE_BIT        BIT(6)
+#define PBCC_RATE_BIT        BIT(7)
+
+enum {
+        CCK_LONG = 0,
+        CCK_SHORT = SHORT_PREAMBLE_BIT,
+        PBCC_LONG = PBCC_RATE_BIT,
+        PBCC_SHORT = PBCC_RATE_BIT | SHORT_PREAMBLE_BIT,
+        OFDM = OFDM_RATE_BIT
+};
+
+/******************************************************************************
+
+Transmit-Descriptor RATE-SET field definitions...
+
+Define a new "Rate-Set" for TX path that incorporates the
+Rate & Modulation info into a single 16-bit field.
+
+TxdRateSet_t:
+b15   - Indicates Preamble type (1=SHORT, 0=LONG).
+        Notes:
+        Must be LONG (0) for 1Mbps rate.
+        Does not apply (set to 0) for RevG-OFDM rates.
+b14   - Indicates PBCC encoding (1=PBCC, 0=not).
+        Notes:
+        Does not apply (set to 0) for rates 1 and 2 Mbps.
+        Does not apply (set to 0) for RevG-OFDM rates.
+b13    - Unused (set to 0).
+b12-b0 - Supported Rate indicator bits as defined below.
+
+******************************************************************************/
+
+
+#define TNETW1251_CHIP_ID_PG1_0         0x07010101
+#define TNETW1251_CHIP_ID_PG1_1         0x07020101
+#define TNETW1251_CHIP_ID_PG1_2         0x07030101
+
+/*************************************************************************
+
+    Interrupt Trigger Register (Host -> WiLink)
+
+**************************************************************************/
+
+/* Hardware to Embedded CPU Interrupts - first 32-bit register set */
+
+/*
+ * Host Command Interrupt. Setting this bit masks
+ * the interrupt that the host issues to inform
+ * the FW that it has sent a command
+ * to the Wlan hardware Command Mailbox.
+ */
+#define INTR_TRIG_CMD       BIT(0)
+
+/*
+ * Host Event Acknowlegde Interrupt. The host
+ * sets this bit to acknowledge that it received
+ * the unsolicited information from the event
+ * mailbox.
+ */
+#define INTR_TRIG_EVENT_ACK BIT(1)
+
+/*
+ * The host sets this bit to inform the Wlan
+ * FW that a TX packet is in the XFER
+ * Buffer #0.
+ */
+#define INTR_TRIG_TX_PROC0 BIT(2)
+
+/*
+ * The host sets this bit to inform the FW
+ * that it read a packet from RX XFER
+ * Buffer #0.
+ */
+#define INTR_TRIG_RX_PROC0 BIT(3)
+
+#define INTR_TRIG_DEBUG_ACK BIT(4)
+
+#define INTR_TRIG_STATE_CHANGED BIT(5)
+
+
+/* Hardware to Embedded CPU Interrupts - second 32-bit register set */
+
+/*
+ * The host sets this bit to inform the FW
+ * that it read a packet from RX XFER
+ * Buffer #1.
+ */
+#define INTR_TRIG_RX_PROC1 BIT(17)
+
+/*
+ * The host sets this bit to inform the Wlan
+ * hardware that a TX packet is in the XFER
+ * Buffer #1.
+ */
+#define INTR_TRIG_TX_PROC1 BIT(18)
+
+#endif
diff --git a/drivers/net/wireless/wl12xx/rx.c b/drivers/net/wireless/wl12xx/rx.c
new file mode 100644
index 000000000000..981ea259eb89
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/rx.c
@@ -0,0 +1,208 @@
+/*
+ * This file is part of wl12xx
+ *
+ * Copyright (c) 1998-2007 Texas Instruments Incorporated
+ * Copyright (C) 2008 Nokia Corporation
+ *
+ * Contact: Kalle Valo <kalle.valo@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include <linux/skbuff.h>
+#include <net/mac80211.h>
+
+#include "wl12xx.h"
+#include "reg.h"
+#include "spi.h"
+#include "rx.h"
+
+static void wl12xx_rx_header(struct wl12xx *wl,
+                             struct wl12xx_rx_descriptor *desc)
+{
+        u32 rx_packet_ring_addr;
+
+        rx_packet_ring_addr = wl->data_path->rx_packet_ring_addr;
+        if (wl->rx_current_buffer)
+                rx_packet_ring_addr += wl->data_path->rx_packet_ring_chunk_size;
+
+        wl12xx_spi_mem_read(wl, rx_packet_ring_addr, desc,
+                            sizeof(struct wl12xx_rx_descriptor));
+}
+
+static void wl12xx_rx_status(struct wl12xx *wl,
+                             struct wl12xx_rx_descriptor *desc,
+                             struct ieee80211_rx_status *status,
+                             u8 beacon)
+{
+        memset(status, 0, sizeof(struct ieee80211_rx_status));
+
+        status->band = IEEE80211_BAND_2GHZ;
+        status->mactime = desc->timestamp;
+
+        /*
+         * The rx status timestamp is a 32 bits value while the TSF is a
+         * 64 bits one.
+         * For IBSS merging, TSF is mandatory, so we have to get it
+         * somehow, so we ask for ACX_TSF_INFO.
+         * That could be moved to the get_tsf() hook, but unfortunately,
+         * this one must be atomic, while our SPI routines can sleep.
+         */
+        if ((wl->bss_type == BSS_TYPE_IBSS) && beacon) {
+                u64 mactime;
+                int ret;
+                struct wl12xx_command cmd;
+                struct acx_tsf_info *tsf_info;
+
+                memset(&cmd, 0, sizeof(cmd));
+
+                ret = wl12xx_cmd_interrogate(wl, ACX_TSF_INFO,
+                                             sizeof(struct acx_tsf_info),
+                                             &cmd);
+                if (ret < 0) {
+                        wl12xx_warning("ACX_FW_REV interrogate failed");
+                        return;
+                }
+
+                tsf_info = (struct acx_tsf_info *)&(cmd.parameters);
+
+                mactime = tsf_info->current_tsf_lsb |
+                        (tsf_info->current_tsf_msb << 31);
+
+                status->mactime = mactime;
+        }
+
+        status->signal = desc->rssi;
+        status->qual = (desc->rssi - WL12XX_RX_MIN_RSSI) * 100 /
+                (WL12XX_RX_MAX_RSSI - WL12XX_RX_MIN_RSSI);
+        status->qual = min(status->qual, 100);
+        status->qual = max(status->qual, 0);
+
+        /*
+         * FIXME: guessing that snr needs to be divided by two, otherwise
+         * the values don't make any sense
+         */
+        status->noise = desc->rssi - desc->snr / 2;
+
+        status->freq = ieee80211_channel_to_frequency(desc->channel);
+
+        status->flag |= RX_FLAG_TSFT;
+
+        if (desc->flags & RX_DESC_ENCRYPTION_MASK) {
+                status->flag |= RX_FLAG_IV_STRIPPED | RX_FLAG_MMIC_STRIPPED;
+
+                if (likely(!(desc->flags & RX_DESC_DECRYPT_FAIL)))
+                        status->flag |= RX_FLAG_DECRYPTED;
+
+                if (unlikely(desc->flags & RX_DESC_MIC_FAIL))
+                        status->flag |= RX_FLAG_MMIC_ERROR;
+        }
+
+        if (unlikely(!(desc->flags & RX_DESC_VALID_FCS)))
+                status->flag |= RX_FLAG_FAILED_FCS_CRC;
+
+
+        /* FIXME: set status->rate_idx */
+}
+
+static void wl12xx_rx_body(struct wl12xx *wl,
+                           struct wl12xx_rx_descriptor *desc)
+{
+        struct sk_buff *skb;
+        struct ieee80211_rx_status status;
+        u8 *rx_buffer, beacon = 0;
+        u16 length, *fc;
+        u32 curr_id, last_id_inc, rx_packet_ring_addr;
+
+        length = WL12XX_RX_ALIGN(desc->length  - PLCP_HEADER_LENGTH);
+        curr_id = (desc->flags & RX_DESC_SEQNUM_MASK) >> RX_DESC_PACKETID_SHIFT;
+        last_id_inc = (wl->rx_last_id + 1) % (RX_MAX_PACKET_ID + 1);
+
+        if (last_id_inc != curr_id) {
+                wl12xx_warning("curr ID:%d, last ID inc:%d",
+                               curr_id, last_id_inc);
+                wl->rx_last_id = curr_id;
+        } else {
+                wl->rx_last_id = last_id_inc;
+        }
+
+        rx_packet_ring_addr = wl->data_path->rx_packet_ring_addr +
+                sizeof(struct wl12xx_rx_descriptor) + 20;
+        if (wl->rx_current_buffer)
+                rx_packet_ring_addr += wl->data_path->rx_packet_ring_chunk_size;
+
+        skb = dev_alloc_skb(length);
+        if (!skb) {
+                wl12xx_error("Couldn't allocate RX frame");
+                return;
+        }
+
+        rx_buffer = skb_put(skb, length);
+        wl12xx_spi_mem_read(wl, rx_packet_ring_addr, rx_buffer, length);
+
+        /* The actual lenght doesn't include the target's alignment */
+        skb->len = desc->length  - PLCP_HEADER_LENGTH;
+
+        fc = (u16 *)skb->data;
+
+        if ((*fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_BEACON)
+                beacon = 1;
+
+        wl12xx_rx_status(wl, desc, &status, beacon);
+
+        wl12xx_debug(DEBUG_RX, "rx skb 0x%p: %d B %s", skb, skb->len,
+                     beacon ? "beacon" : "");
+
+        ieee80211_rx(wl->hw, skb, &status);
+}
+
+static void wl12xx_rx_ack(struct wl12xx *wl)
+{
+        u32 data, addr;
+
+        if (wl->rx_current_buffer) {
+                addr = ACX_REG_INTERRUPT_TRIG_H;
+                data = INTR_TRIG_RX_PROC1;
+        } else {
+                addr = ACX_REG_INTERRUPT_TRIG;
+                data = INTR_TRIG_RX_PROC0;
+        }
+
+        wl12xx_reg_write32(wl, addr, data);
+
+        /* Toggle buffer ring */
+        wl->rx_current_buffer = !wl->rx_current_buffer;
+}
+
+
+void wl12xx_rx(struct wl12xx *wl)
+{
+        struct wl12xx_rx_descriptor rx_desc;
+
+        if (wl->state != WL12XX_STATE_ON)
+                return;
+
+        /* We first read the frame's header */
+        wl12xx_rx_header(wl, &rx_desc);
+
+        /* Now we can read the body */
+        wl12xx_rx_body(wl, &rx_desc);
+
+        /* Finally, we need to ACK the RX */
+        wl12xx_rx_ack(wl);
+
+        return;
+}
diff --git a/drivers/net/wireless/wl12xx/rx.h b/drivers/net/wireless/wl12xx/rx.h
new file mode 100644
index 000000000000..8a23fdea5016
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/rx.h
@@ -0,0 +1,122 @@
+/*
+ * This file is part of wl12xx
+ *
+ * Copyright (c) 1998-2007 Texas Instruments Incorporated
+ * Copyright (C) 2008 Nokia Corporation
+ *
+ * Contact: Kalle Valo <kalle.valo@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __WL12XX_RX_H__
+#define __WL12XX_RX_H__
+
+#include <linux/bitops.h>
+
+/*
+ * RX PATH
+ *
+ * The Rx path uses a double buffer and an rx_contro structure, each located
+ * at a fixed address in the device memory. The host keeps track of which
+ * buffer is available and alternates between them on a per packet basis.
+ * The size of each of the two buffers is large enough to hold the longest
+ * 802.3 packet.
+ * The RX path goes like that:
+ * 1) The target generates an interrupt each time a new packet is received.
+ *   There are 2 RX interrupts, one for each buffer.
+ * 2) The host reads the received packet from one of the double buffers.
+ * 3) The host triggers a target interrupt.
+ * 4) The target prepares the next RX packet.
+ */
+
+#define WL12XX_RX_MAX_RSSI -30
+#define WL12XX_RX_MIN_RSSI -95
+
+#define WL12XX_RX_ALIGN_TO 4
+#define WL12XX_RX_ALIGN(len) (((len) + WL12XX_RX_ALIGN_TO - 1) & \
+                             ~(WL12XX_RX_ALIGN_TO - 1))
+
+#define SHORT_PREAMBLE_BIT   BIT(0)
+#define OFDM_RATE_BIT        BIT(6)
+#define PBCC_RATE_BIT        BIT(7)
+
+#define PLCP_HEADER_LENGTH 8
+#define RX_DESC_PACKETID_SHIFT 11
+#define RX_MAX_PACKET_ID 3
+
+#define RX_DESC_VALID_FCS         0x0001
+#define RX_DESC_MATCH_RXADDR1     0x0002
+#define RX_DESC_MCAST             0x0004
+#define RX_DESC_STAINTIM          0x0008
+#define RX_DESC_VIRTUAL_BM        0x0010
+#define RX_DESC_BCAST             0x0020
+#define RX_DESC_MATCH_SSID        0x0040
+#define RX_DESC_MATCH_BSSID       0x0080
+#define RX_DESC_ENCRYPTION_MASK   0x0300
+#define RX_DESC_MEASURMENT        0x0400
+#define RX_DESC_SEQNUM_MASK       0x1800
+#define RX_DESC_MIC_FAIL          0x2000
+#define RX_DESC_DECRYPT_FAIL      0x4000
+
+struct wl12xx_rx_descriptor {
+        u32 timestamp; /* In microseconds */
+        u16 length; /* Paylod length, including headers */
+        u16 flags;
+
+        /*
+         * 0 - 802.11
+         * 1 - 802.3
+         * 2 - IP
+         * 3 - Raw Codec
+         */
+        u8 type;
+
+        /*
+         * Recevied Rate:
+         * 0x0A - 1MBPS
+         * 0x14 - 2MBPS
+         * 0x37 - 5_5MBPS
+         * 0x0B - 6MBPS
+         * 0x0F - 9MBPS
+         * 0x6E - 11MBPS
+         * 0x0A - 12MBPS
+         * 0x0E - 18MBPS
+         * 0xDC - 22MBPS
+         * 0x09 - 24MBPS
+         * 0x0D - 36MBPS
+         * 0x08 - 48MBPS
+         * 0x0C - 54MBPS
+         */
+        u8 rate;
+
+        u8 mod_pre; /* Modulation and preamble */
+        u8 channel;
+
+        /*
+         * 0 - 2.4 Ghz
+         * 1 - 5 Ghz
+         */
+        u8 band;
+
+        s8 rssi; /* in dB */
+        u8 rcpi; /* in dB */
+        u8 snr; /* in dB */
+} __attribute__ ((packed));
+
+void wl12xx_rx(struct wl12xx *wl);
+
+#endif
diff --git a/drivers/net/wireless/wl12xx/spi.c b/drivers/net/wireless/wl12xx/spi.c
new file mode 100644
index 000000000000..abdf171a47e7
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/spi.c
@@ -0,0 +1,358 @@
+/*
+ * This file is part of wl12xx
+ *
+ * Copyright (C) 2008 Nokia Corporation
+ *
+ * Contact: Kalle Valo <kalle.valo@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/crc7.h>
+#include <linux/spi/spi.h>
+
+#include "wl12xx.h"
+#include "wl12xx_80211.h"
+#include "reg.h"
+#include "spi.h"
+#include "ps.h"
+
+static int wl12xx_translate_reg_addr(struct wl12xx *wl, int addr)
+{
+        /* If the address is lower than REGISTERS_BASE, it means that this is
+         * a chip-specific register address, so look it up in the registers
+         * table */
+        if (addr < REGISTERS_BASE) {
+                /* Make sure we don't go over the table */
+                if (addr >= ACX_REG_TABLE_LEN) {
+                        wl12xx_error("address out of range (%d)", addr);
+                        return -EINVAL;
+                }
+                addr = wl->chip.acx_reg_table[addr];
+        }
+
+        return addr - wl->physical_reg_addr + wl->virtual_reg_addr;
+}
+
+static int wl12xx_translate_mem_addr(struct wl12xx *wl, int addr)
+{
+        return addr - wl->physical_mem_addr + wl->virtual_mem_addr;
+}
+
+
+void wl12xx_spi_reset(struct wl12xx *wl)
+{
+        u8 *cmd;
+        struct spi_transfer t;
+        struct spi_message m;
+
+        cmd = kzalloc(WSPI_INIT_CMD_LEN, GFP_KERNEL);
+        if (!cmd) {
+                wl12xx_error("could not allocate cmd for spi reset");
+                return;
+        }
+
+        memset(&t, 0, sizeof(t));
+        spi_message_init(&m);
+
+        memset(cmd, 0xff, WSPI_INIT_CMD_LEN);
+
+        t.tx_buf = cmd;
+        t.len = WSPI_INIT_CMD_LEN;
+        spi_message_add_tail(&t, &m);
+
+        spi_sync(wl->spi, &m);
+
+        wl12xx_dump(DEBUG_SPI, "spi reset -> ", cmd, WSPI_INIT_CMD_LEN);
+}
+
+void wl12xx_spi_init(struct wl12xx *wl)
+{
+        u8 crc[WSPI_INIT_CMD_CRC_LEN], *cmd;
+        struct spi_transfer t;
+        struct spi_message m;
+
+        cmd = kzalloc(WSPI_INIT_CMD_LEN, GFP_KERNEL);
+        if (!cmd) {
+                wl12xx_error("could not allocate cmd for spi init");
+                return;
+        }
+
+        memset(crc, 0, sizeof(crc));
+        memset(&t, 0, sizeof(t));
+        spi_message_init(&m);
+
+        /*
+         * Set WSPI_INIT_COMMAND
+         * the data is being send from the MSB to LSB
+         */
+        cmd[2] = 0xff;
+        cmd[3] = 0xff;
+        cmd[1] = WSPI_INIT_CMD_START | WSPI_INIT_CMD_TX;
+        cmd[0] = 0;
+        cmd[7] = 0;
+        cmd[6] |= HW_ACCESS_WSPI_INIT_CMD_MASK << 3;
+        cmd[6] |= HW_ACCESS_WSPI_FIXED_BUSY_LEN & WSPI_INIT_CMD_FIXEDBUSY_LEN;
+
+        if (HW_ACCESS_WSPI_FIXED_BUSY_LEN == 0)
+                cmd[5] |=  WSPI_INIT_CMD_DIS_FIXEDBUSY;
+        else
+                cmd[5] |= WSPI_INIT_CMD_EN_FIXEDBUSY;
+
+        cmd[5] |= WSPI_INIT_CMD_IOD | WSPI_INIT_CMD_IP | WSPI_INIT_CMD_CS
+                | WSPI_INIT_CMD_WSPI | WSPI_INIT_CMD_WS;
+
+        crc[0] = cmd[1];
+        crc[1] = cmd[0];
+        crc[2] = cmd[7];
+        crc[3] = cmd[6];
+        crc[4] = cmd[5];
+
+        cmd[4] |= crc7(0, crc, WSPI_INIT_CMD_CRC_LEN) << 1;
+        cmd[4] |= WSPI_INIT_CMD_END;
+
+        t.tx_buf = cmd;
+        t.len = WSPI_INIT_CMD_LEN;
+        spi_message_add_tail(&t, &m);
+
+        spi_sync(wl->spi, &m);
+
+        wl12xx_dump(DEBUG_SPI, "spi init -> ", cmd, WSPI_INIT_CMD_LEN);
+}
+
+/* Set the SPI partitions to access the chip addresses
+ *
+ * There are two VIRTUAL (SPI) partitions (the memory partition and the
+ * registers partition), which are mapped to two different areas of the
+ * PHYSICAL (hardware) memory.  This function also makes other checks to
+ * ensure that the partitions are not overlapping.  In the diagram below, the
+ * memory partition comes before the register partition, but the opposite is
+ * also supported.
+ *
+ *                               PHYSICAL address
+ *                                     space
+ *
+ *                                    |    |
+ *                                 ...+----+--> mem_start
+ *          VIRTUAL address     ...   |    |
+ *               space       ...      |    | [PART_0]
+ *                        ...         |    |
+ * 0x00000000 <--+----+...         ...+----+--> mem_start + mem_size
+ *               |    |         ...   |    |
+ *               |MEM |      ...      |    |
+ *               |    |   ...         |    |
+ *  part_size <--+----+...            |    | {unused area)
+ *               |    |   ...         |    |
+ *               |REG |      ...      |    |
+ *  part_size    |    |         ...   |    |
+ *      +     <--+----+...         ...+----+--> reg_start
+ *  reg_size              ...         |    |
+ *                           ...      |    | [PART_1]
+ *                              ...   |    |
+ *                                 ...+----+--> reg_start + reg_size
+ *                                    |    |
+ *
+ */
+void wl12xx_set_partition(struct wl12xx *wl,
+                          u32 mem_start, u32 mem_size,
+                          u32 reg_start, u32 reg_size)
+{
+        u8 tx_buf[sizeof(u32) + 2 * sizeof(struct wl12xx_partition)];
+        struct wl12xx_partition *partition;
+        struct spi_transfer t;
+        struct spi_message m;
+        u32 *cmd;
+        size_t len;
+        int addr;
+
+        spi_message_init(&m);
+        memset(&t, 0, sizeof(t));
+        memset(tx_buf, 0, sizeof(tx_buf));
+
+        cmd = (u32 *) tx_buf;
+        partition = (struct wl12xx_partition *) (tx_buf + sizeof(u32));
+        addr = HW_ACCESS_PART0_SIZE_ADDR;
+        len = 2 * sizeof(struct wl12xx_partition);
+
+        *cmd |= WSPI_CMD_WRITE;
+        *cmd |= (len << WSPI_CMD_BYTE_LENGTH_OFFSET) & WSPI_CMD_BYTE_LENGTH;
+        *cmd |= addr & WSPI_CMD_BYTE_ADDR;
+
+        wl12xx_debug(DEBUG_SPI, "mem_start %08X mem_size %08X",
+                     mem_start, mem_size);
+        wl12xx_debug(DEBUG_SPI, "reg_start %08X reg_size %08X",
+                     reg_start, reg_size);
+
+        /* Make sure that the two partitions together don't exceed the
+         * address range */
+        if ((mem_size + reg_size) > HW_ACCESS_MEMORY_MAX_RANGE) {
+                wl12xx_debug(DEBUG_SPI, "Total size exceeds maximum virtual"
+                             " address range.  Truncating partition[0].");
+                mem_size = HW_ACCESS_MEMORY_MAX_RANGE - reg_size;
+                wl12xx_debug(DEBUG_SPI, "mem_start %08X mem_size %08X",
+                             mem_start, mem_size);
+                wl12xx_debug(DEBUG_SPI, "reg_start %08X reg_size %08X",
+                             reg_start, reg_size);
+        }
+
+        if ((mem_start < reg_start) &&
+            ((mem_start + mem_size) > reg_start)) {
+                /* Guarantee that the memory partition doesn't overlap the
+                 * registers partition */
+                wl12xx_debug(DEBUG_SPI, "End of partition[0] is "
+                             "overlapping partition[1].  Adjusted.");
+                mem_size = reg_start - mem_start;
+                wl12xx_debug(DEBUG_SPI, "mem_start %08X mem_size %08X",
+                             mem_start, mem_size);
+                wl12xx_debug(DEBUG_SPI, "reg_start %08X reg_size %08X",
+                             reg_start, reg_size);
+        } else if ((reg_start < mem_start) &&
+                   ((reg_start + reg_size) > mem_start)) {
+                /* Guarantee that the register partition doesn't overlap the
+                 * memory partition */
+                wl12xx_debug(DEBUG_SPI, "End of partition[1] is"
+                             " overlapping partition[0].  Adjusted.");
+                reg_size = mem_start - reg_start;
+                wl12xx_debug(DEBUG_SPI, "mem_start %08X mem_size %08X",
+                             mem_start, mem_size);
+                wl12xx_debug(DEBUG_SPI, "reg_start %08X reg_size %08X",
+                             reg_start, reg_size);
+        }
+
+        partition[0].start = mem_start;
+        partition[0].size  = mem_size;
+        partition[1].start = reg_start;
+        partition[1].size  = reg_size;
+
+        wl->physical_mem_addr = mem_start;
+        wl->physical_reg_addr = reg_start;
+
+        wl->virtual_mem_addr = 0;
+        wl->virtual_reg_addr = mem_size;
+
+        t.tx_buf = tx_buf;
+        t.len = sizeof(tx_buf);
+        spi_message_add_tail(&t, &m);
+
+        spi_sync(wl->spi, &m);
+}
+
+void wl12xx_spi_read(struct wl12xx *wl, int addr, void *buf,
+                     size_t len)
+{
+        struct spi_transfer t[3];
+        struct spi_message m;
+        char busy_buf[TNETWIF_READ_OFFSET_BYTES];
+        u32 cmd;
+
+        cmd = 0;
+        cmd |= WSPI_CMD_READ;
+        cmd |= (len << WSPI_CMD_BYTE_LENGTH_OFFSET) & WSPI_CMD_BYTE_LENGTH;
+        cmd |= addr & WSPI_CMD_BYTE_ADDR;
+
+        spi_message_init(&m);
+        memset(t, 0, sizeof(t));
+
+        t[0].tx_buf = &cmd;
+        t[0].len = 4;
+        spi_message_add_tail(&t[0], &m);
+
+        /* Busy and non busy words read */
+        t[1].rx_buf = busy_buf;
+        t[1].len = TNETWIF_READ_OFFSET_BYTES;
+        spi_message_add_tail(&t[1], &m);
+
+        t[2].rx_buf = buf;
+        t[2].len = len;
+        spi_message_add_tail(&t[2], &m);
+
+        spi_sync(wl->spi, &m);
+
+        /* FIXME: check busy words */
+
+        wl12xx_dump(DEBUG_SPI, "spi_read cmd -> ", &cmd, sizeof(cmd));
+        wl12xx_dump(DEBUG_SPI, "spi_read buf <- ", buf, len);
+}
+
+void wl12xx_spi_write(struct wl12xx *wl, int addr, void *buf,
+                      size_t len)
+{
+        struct spi_transfer t[2];
+        struct spi_message m;
+        u32 cmd;
+
+        cmd = 0;
+        cmd |= WSPI_CMD_WRITE;
+        cmd |= (len << WSPI_CMD_BYTE_LENGTH_OFFSET) & WSPI_CMD_BYTE_LENGTH;
+        cmd |= addr & WSPI_CMD_BYTE_ADDR;
+
+        spi_message_init(&m);
+        memset(t, 0, sizeof(t));
+
+        t[0].tx_buf = &cmd;
+        t[0].len = sizeof(cmd);
+        spi_message_add_tail(&t[0], &m);
+
+        t[1].tx_buf = buf;
+        t[1].len = len;
+        spi_message_add_tail(&t[1], &m);
+
+        spi_sync(wl->spi, &m);
+
+        wl12xx_dump(DEBUG_SPI, "spi_write cmd -> ", &cmd, sizeof(cmd));
+        wl12xx_dump(DEBUG_SPI, "spi_write buf -> ", buf, len);
+}
+
+void wl12xx_spi_mem_read(struct wl12xx *wl, int addr, void *buf,
+                         size_t len)
+{
+        int physical;
+
+        physical = wl12xx_translate_mem_addr(wl, addr);
+
+        wl12xx_spi_read(wl, physical, buf, len);
+}
+
+void wl12xx_spi_mem_write(struct wl12xx *wl, int addr, void *buf,
+                          size_t len)
+{
+        int physical;
+
+        physical = wl12xx_translate_mem_addr(wl, addr);
+
+        wl12xx_spi_write(wl, physical, buf, len);
+}
+
+u32 wl12xx_mem_read32(struct wl12xx *wl, int addr)
+{
+        return wl12xx_read32(wl, wl12xx_translate_mem_addr(wl, addr));
+}
+
+void wl12xx_mem_write32(struct wl12xx *wl, int addr, u32 val)
+{
+        wl12xx_write32(wl, wl12xx_translate_mem_addr(wl, addr), val);
+}
+
+u32 wl12xx_reg_read32(struct wl12xx *wl, int addr)
+{
+        return wl12xx_read32(wl, wl12xx_translate_reg_addr(wl, addr));
+}
+
+void wl12xx_reg_write32(struct wl12xx *wl, int addr, u32 val)
+{
+        wl12xx_write32(wl, wl12xx_translate_reg_addr(wl, addr), val);
+}
diff --git a/drivers/net/wireless/wl12xx/spi.h b/drivers/net/wireless/wl12xx/spi.h
new file mode 100644
index 000000000000..fd3227e904a8
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/spi.h
@@ -0,0 +1,109 @@
+/*
+ * This file is part of wl12xx
+ *
+ * Copyright (c) 1998-2007 Texas Instruments Incorporated
+ * Copyright (C) 2008 Nokia Corporation
+ *
+ * Contact: Kalle Valo <kalle.valo@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __WL12XX_SPI_H__
+#define __WL12XX_SPI_H__
+
+#include "cmd.h"
+#include "acx.h"
+#include "reg.h"
+
+#define HW_ACCESS_MEMORY_MAX_RANGE              0x1FFC0
+
+#define HW_ACCESS_PART0_SIZE_ADDR           0x1FFC0
+#define HW_ACCESS_PART0_START_ADDR          0x1FFC4
+#define HW_ACCESS_PART1_SIZE_ADDR           0x1FFC8
+#define HW_ACCESS_PART1_START_ADDR          0x1FFCC
+
+#define HW_ACCESS_REGISTER_SIZE             4
+
+#define HW_ACCESS_PRAM_MAX_RANGE                0x3c000
+
+#define WSPI_CMD_READ                 0x40000000
+#define WSPI_CMD_WRITE                0x00000000
+#define WSPI_CMD_FIXED                0x20000000
+#define WSPI_CMD_BYTE_LENGTH          0x1FFE0000
+#define WSPI_CMD_BYTE_LENGTH_OFFSET   17
+#define WSPI_CMD_BYTE_ADDR            0x0001FFFF
+
+#define WSPI_INIT_CMD_CRC_LEN       5
+
+#define WSPI_INIT_CMD_START         0x00
+#define WSPI_INIT_CMD_TX            0x40
+/* the extra bypass bit is sampled by the TNET as '1' */
+#define WSPI_INIT_CMD_BYPASS_BIT    0x80
+#define WSPI_INIT_CMD_FIXEDBUSY_LEN 0x07
+#define WSPI_INIT_CMD_EN_FIXEDBUSY  0x80
+#define WSPI_INIT_CMD_DIS_FIXEDBUSY 0x00
+#define WSPI_INIT_CMD_IOD           0x40
+#define WSPI_INIT_CMD_IP            0x20
+#define WSPI_INIT_CMD_CS            0x10
+#define WSPI_INIT_CMD_WS            0x08
+#define WSPI_INIT_CMD_WSPI          0x01
+#define WSPI_INIT_CMD_END           0x01
+
+#define WSPI_INIT_CMD_LEN           8
+
+#define TNETWIF_READ_OFFSET_BYTES  8
+#define HW_ACCESS_WSPI_FIXED_BUSY_LEN \
+                ((TNETWIF_READ_OFFSET_BYTES - 4) / sizeof(u32))
+#define HW_ACCESS_WSPI_INIT_CMD_MASK  0
+
+
+/* Raw target IO, address is not translated */
+void wl12xx_spi_read(struct wl12xx *wl, int addr, void *buf, size_t len);
+void wl12xx_spi_write(struct wl12xx *wl, int addr, void *buf, size_t len);
+
+/* Memory target IO, address is tranlated to partition 0 */
+void wl12xx_spi_mem_read(struct wl12xx *wl, int addr, void *buf, size_t len);
+void wl12xx_spi_mem_write(struct wl12xx *wl, int addr, void *buf, size_t len);
+u32 wl12xx_mem_read32(struct wl12xx *wl, int addr);
+void wl12xx_mem_write32(struct wl12xx *wl, int addr, u32 val);
+
+/* Registers IO */
+u32 wl12xx_reg_read32(struct wl12xx *wl, int addr);
+void wl12xx_reg_write32(struct wl12xx *wl, int addr, u32 val);
+
+/* INIT and RESET words */
+void wl12xx_spi_reset(struct wl12xx *wl);
+void wl12xx_spi_init(struct wl12xx *wl);
+void wl12xx_set_partition(struct wl12xx *wl,
+                          u32 part_start, u32 part_size,
+                          u32 reg_start,  u32 reg_size);
+
+static inline u32 wl12xx_read32(struct wl12xx *wl, int addr)
+{
+        u32 response;
+
+        wl12xx_spi_read(wl, addr, &response, sizeof(u32));
+
+        return response;
+}
+
+static inline void wl12xx_write32(struct wl12xx *wl, int addr, u32 val)
+{
+        wl12xx_spi_write(wl, addr, &val, sizeof(u32));
+}
+
+#endif /* __WL12XX_SPI_H__ */
diff --git a/drivers/net/wireless/wl12xx/tx.c b/drivers/net/wireless/wl12xx/tx.c
new file mode 100644
index 000000000000..62145e205a8c
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/tx.c
@@ -0,0 +1,557 @@
+/*
+ * This file is part of wl12xx
+ *
+ * Copyright (c) 1998-2007 Texas Instruments Incorporated
+ * Copyright (C) 2008 Nokia Corporation
+ *
+ * Contact: Kalle Valo <kalle.valo@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+
+#include "wl12xx.h"
+#include "reg.h"
+#include "spi.h"
+#include "tx.h"
+#include "ps.h"
+
+static bool wl12xx_tx_double_buffer_busy(struct wl12xx *wl, u32 data_out_count)
+{
+        int used, data_in_count;
+
+        data_in_count = wl->data_in_count;
+
+        if (data_in_count < data_out_count)
+                /* data_in_count has wrapped */
+                data_in_count += TX_STATUS_DATA_OUT_COUNT_MASK + 1;
+
+        used = data_in_count - data_out_count;
+
+        WARN_ON(used < 0);
+        WARN_ON(used > DP_TX_PACKET_RING_CHUNK_NUM);
+
+        if (used >= DP_TX_PACKET_RING_CHUNK_NUM)
+                return true;
+        else
+                return false;
+}
+
+static int wl12xx_tx_path_status(struct wl12xx *wl)
+{
+        u32 status, addr, data_out_count;
+        bool busy;
+
+        addr = wl->data_path->tx_control_addr;
+        status = wl12xx_mem_read32(wl, addr);
+        data_out_count = status & TX_STATUS_DATA_OUT_COUNT_MASK;
+        busy = wl12xx_tx_double_buffer_busy(wl, data_out_count);
+
+        if (busy)
+                return -EBUSY;
+
+        return 0;
+}
+
+static int wl12xx_tx_id(struct wl12xx *wl, struct sk_buff *skb)
+{
+        int i;
+
+        for (i = 0; i < FW_TX_CMPLT_BLOCK_SIZE; i++)
+                if (wl->tx_frames[i] == NULL) {
+                        wl->tx_frames[i] = skb;
+                        return i;
+                }
+
+        return -EBUSY;
+}
+
+static void wl12xx_tx_control(struct tx_double_buffer_desc *tx_hdr,
+                              struct ieee80211_tx_info *control, u16 fc)
+{
+        *(u16 *)&tx_hdr->control = 0;
+
+        tx_hdr->control.rate_policy = 0;
+
+        /* 802.11 packets */
+        tx_hdr->control.packet_type = 0;
+
+        if (control->flags & IEEE80211_TX_CTL_NO_ACK)
+                tx_hdr->control.ack_policy = 1;
+
+        tx_hdr->control.tx_complete = 1;
+
+        if ((fc & IEEE80211_FTYPE_DATA) &&
+            ((fc & IEEE80211_STYPE_QOS_DATA) ||
+             (fc & IEEE80211_STYPE_QOS_NULLFUNC)))
+                tx_hdr->control.qos = 1;
+}
+
+/* RSN + MIC = 8 + 8 = 16 bytes (worst case - AES). */
+#define MAX_MSDU_SECURITY_LENGTH      16
+#define MAX_MPDU_SECURITY_LENGTH      16
+#define WLAN_QOS_HDR_LEN              26
+#define MAX_MPDU_HEADER_AND_SECURITY  (MAX_MPDU_SECURITY_LENGTH + \
+                                       WLAN_QOS_HDR_LEN)
+#define HW_BLOCK_SIZE                 252
+static void wl12xx_tx_frag_block_num(struct tx_double_buffer_desc *tx_hdr)
+{
+        u16 payload_len, frag_threshold, mem_blocks;
+        u16 num_mpdus, mem_blocks_per_frag;
+
+        frag_threshold = IEEE80211_MAX_FRAG_THRESHOLD;
+        tx_hdr->frag_threshold = cpu_to_le16(frag_threshold);
+
+        payload_len = tx_hdr->length + MAX_MSDU_SECURITY_LENGTH;
+
+        if (payload_len > frag_threshold) {
+                mem_blocks_per_frag =
+                        ((frag_threshold + MAX_MPDU_HEADER_AND_SECURITY) /
+                         HW_BLOCK_SIZE) + 1;
+                num_mpdus = payload_len / frag_threshold;
+                mem_blocks = num_mpdus * mem_blocks_per_frag;
+                payload_len -= num_mpdus * frag_threshold;
+                num_mpdus++;
+
+        } else {
+                mem_blocks_per_frag = 0;
+                mem_blocks = 0;
+                num_mpdus = 1;
+        }
+
+        mem_blocks += (payload_len / HW_BLOCK_SIZE) + 1;
+
+        if (num_mpdus > 1)
+                mem_blocks += min(num_mpdus, mem_blocks_per_frag);
+
+        tx_hdr->num_mem_blocks = mem_blocks;
+}
+
+static int wl12xx_tx_fill_hdr(struct wl12xx *wl, struct sk_buff *skb,
+                              struct ieee80211_tx_info *control)
+{
+        struct tx_double_buffer_desc *tx_hdr;
+        struct ieee80211_rate *rate;
+        int id;
+        u16 fc;
+
+        if (!skb)
+                return -EINVAL;
+
+        id = wl12xx_tx_id(wl, skb);
+        if (id < 0)
+                return id;
+
+        fc = *(u16 *)skb->data;
+        tx_hdr = (struct tx_double_buffer_desc *) skb_push(skb,
+                                                           sizeof(*tx_hdr));
+
+        tx_hdr->length = cpu_to_le16(skb->len - sizeof(*tx_hdr));
+        rate = ieee80211_get_tx_rate(wl->hw, control);
+        tx_hdr->rate = cpu_to_le16(rate->hw_value);
+        tx_hdr->expiry_time = cpu_to_le32(1 << 16);
+        tx_hdr->id = id;
+
+        /* FIXME: how to get the correct queue id? */
+        tx_hdr->xmit_queue = 0;
+
+        wl12xx_tx_control(tx_hdr, control, fc);
+        wl12xx_tx_frag_block_num(tx_hdr);
+
+        return 0;
+}
+
+/* We copy the packet to the target */
+static int wl12xx_tx_send_packet(struct wl12xx *wl, struct sk_buff *skb,
+                                 struct ieee80211_tx_info *control)
+{
+        struct tx_double_buffer_desc *tx_hdr;
+        int len;
+        u32 addr;
+
+        if (!skb)
+                return -EINVAL;
+
+        tx_hdr = (struct tx_double_buffer_desc *) skb->data;
+
+        if (control->control.hw_key &&
+            control->control.hw_key->alg == ALG_TKIP) {
+                int hdrlen;
+                u16 fc;
+                u8 *pos;
+
+                fc = *(u16 *)(skb->data + sizeof(*tx_hdr));
+                tx_hdr->length += WL12XX_TKIP_IV_SPACE;
+
+                hdrlen = ieee80211_hdrlen(fc);
+
+                pos = skb_push(skb, WL12XX_TKIP_IV_SPACE);
+                memmove(pos, pos + WL12XX_TKIP_IV_SPACE,
+                        sizeof(*tx_hdr) + hdrlen);
+        }
+
+        /* Revisit. This is a workaround for getting non-aligned packets.
+           This happens at least with EAPOL packets from the user space.
+           Our DMA requires packets to be aligned on a 4-byte boundary.
+        */
+        if (unlikely((long)skb->data & 0x03)) {
+                int offset = (4 - (long)skb->data) & 0x03;
+                wl12xx_debug(DEBUG_TX, "skb offset %d", offset);
+
+                /* check whether the current skb can be used */
+                if (!skb_cloned(skb) && (skb_tailroom(skb) >= offset)) {
+                        unsigned char *src = skb->data;
+
+                        /* align the buffer on a 4-byte boundary */
+                        skb_reserve(skb, offset);
+                        memmove(skb->data, src, skb->len);
+                } else {
+                        wl12xx_info("No handler, fixme!");
+                        return -EINVAL;
+                }
+        }
+
+        /* Our skb->data at this point includes the HW header */
+        len = WL12XX_TX_ALIGN(skb->len);
+
+        if (wl->data_in_count & 0x1)
+                addr = wl->data_path->tx_packet_ring_addr +
+                        wl->data_path->tx_packet_ring_chunk_size;
+        else
+                addr = wl->data_path->tx_packet_ring_addr;
+
+        wl12xx_spi_mem_write(wl, addr, skb->data, len);
+
+        wl12xx_debug(DEBUG_TX, "tx id %u skb 0x%p payload %u rate 0x%x",
+                     tx_hdr->id, skb, tx_hdr->length, tx_hdr->rate);
+
+        return 0;
+}
+
+static void wl12xx_tx_trigger(struct wl12xx *wl)
+{
+        u32 data, addr;
+
+        if (wl->data_in_count & 0x1) {
+                addr = ACX_REG_INTERRUPT_TRIG_H;
+                data = INTR_TRIG_TX_PROC1;
+        } else {
+                addr = ACX_REG_INTERRUPT_TRIG;
+                data = INTR_TRIG_TX_PROC0;
+        }
+
+        wl12xx_reg_write32(wl, addr, data);
+
+        /* Bumping data in */
+        wl->data_in_count = (wl->data_in_count + 1) &
+                TX_STATUS_DATA_OUT_COUNT_MASK;
+}
+
+/* caller must hold wl->mutex */
+static int wl12xx_tx_frame(struct wl12xx *wl, struct sk_buff *skb)
+{
+        struct ieee80211_tx_info *info;
+        int ret = 0;
+        u8 idx;
+
+        info = IEEE80211_SKB_CB(skb);
+
+        if (info->control.hw_key) {
+                idx = info->control.hw_key->hw_key_idx;
+                if (unlikely(wl->default_key != idx)) {
+                        ret = wl12xx_acx_default_key(wl, idx);
+                        if (ret < 0)
+                                return ret;
+                }
+        }
+
+        ret = wl12xx_tx_path_status(wl);
+        if (ret < 0)
+                return ret;
+
+        ret = wl12xx_tx_fill_hdr(wl, skb, info);
+        if (ret < 0)
+                return ret;
+
+        ret = wl12xx_tx_send_packet(wl, skb, info);
+        if (ret < 0)
+                return ret;
+
+        wl12xx_tx_trigger(wl);
+
+        return ret;
+}
+
+void wl12xx_tx_work(struct work_struct *work)
+{
+        struct wl12xx *wl = container_of(work, struct wl12xx, tx_work);
+        struct sk_buff *skb;
+        bool woken_up = false;
+        int ret;
+
+        mutex_lock(&wl->mutex);
+
+        if (unlikely(wl->state == WL12XX_STATE_OFF))
+                goto out;
+
+        while ((skb = skb_dequeue(&wl->tx_queue))) {
+                if (!woken_up) {
+                        wl12xx_ps_elp_wakeup(wl);
+                        woken_up = true;
+                }
+
+                ret = wl12xx_tx_frame(wl, skb);
+                if (ret == -EBUSY) {
+                        /* firmware buffer is full, stop queues */
+                        wl12xx_debug(DEBUG_TX, "tx_work: fw buffer full, "
+                                     "stop queues");
+                        ieee80211_stop_queues(wl->hw);
+                        wl->tx_queue_stopped = true;
+                        skb_queue_head(&wl->tx_queue, skb);
+                        goto out;
+                } else if (ret < 0) {
+                        dev_kfree_skb(skb);
+                        goto out;
+                }
+        }
+
+out:
+        if (woken_up)
+                wl12xx_ps_elp_sleep(wl);
+
+        mutex_unlock(&wl->mutex);
+}
+
+static const char *wl12xx_tx_parse_status(u8 status)
+{
+        /* 8 bit status field, one character per bit plus null */
+        static char buf[9];
+        int i = 0;
+
+        memset(buf, 0, sizeof(buf));
+
+        if (status & TX_DMA_ERROR)
+                buf[i++] = 'm';
+        if (status & TX_DISABLED)
+                buf[i++] = 'd';
+        if (status & TX_RETRY_EXCEEDED)
+                buf[i++] = 'r';
+        if (status & TX_TIMEOUT)
+                buf[i++] = 't';
+        if (status & TX_KEY_NOT_FOUND)
+                buf[i++] = 'k';
+        if (status & TX_ENCRYPT_FAIL)
+                buf[i++] = 'e';
+        if (status & TX_UNAVAILABLE_PRIORITY)
+                buf[i++] = 'p';
+
+        /* bit 0 is unused apparently */
+
+        return buf;
+}
+
+static void wl12xx_tx_packet_cb(struct wl12xx *wl,
+                                struct tx_result *result)
+{
+        struct ieee80211_tx_info *info;
+        struct sk_buff *skb;
+        int hdrlen, ret;
+        u8 *frame;
+
+        skb = wl->tx_frames[result->id];
+        if (skb == NULL) {
+                wl12xx_error("SKB for packet %d is NULL", result->id);
+                return;
+        }
+
+        info = IEEE80211_SKB_CB(skb);
+
+        if (!(info->flags & IEEE80211_TX_CTL_NO_ACK) &&
+            (result->status == TX_SUCCESS))
+                info->flags |= IEEE80211_TX_STAT_ACK;
+
+        info->status.rates[0].count = result->ack_failures + 1;
+        wl->stats.retry_count += result->ack_failures;
+
+        /*
+         * We have to remove our private TX header before pushing
+         * the skb back to mac80211.
+         */
+        frame = skb_pull(skb, sizeof(struct tx_double_buffer_desc));
+        if (info->control.hw_key &&
+            info->control.hw_key->alg == ALG_TKIP) {
+                hdrlen = ieee80211_get_hdrlen_from_skb(skb);
+                memmove(frame + WL12XX_TKIP_IV_SPACE, frame, hdrlen);
+                skb_pull(skb, WL12XX_TKIP_IV_SPACE);
+        }
+
+        wl12xx_debug(DEBUG_TX, "tx status id %u skb 0x%p failures %u rate 0x%x"
+                     " status 0x%x (%s)",
+                     result->id, skb, result->ack_failures, result->rate,
+                     result->status, wl12xx_tx_parse_status(result->status));
+
+
+        ieee80211_tx_status(wl->hw, skb);
+
+        wl->tx_frames[result->id] = NULL;
+
+        if (wl->tx_queue_stopped) {
+                wl12xx_debug(DEBUG_TX, "cb: queue was stopped");
+
+                skb = skb_dequeue(&wl->tx_queue);
+
+                /* The skb can be NULL because tx_work might have been
+                   scheduled before the queue was stopped making the
+                   queue empty */
+
+                if (skb) {
+                        ret = wl12xx_tx_frame(wl, skb);
+                        if (ret == -EBUSY) {
+                                /* firmware buffer is still full */
+                                wl12xx_debug(DEBUG_TX, "cb: fw buffer "
+                                             "still full");
+                                skb_queue_head(&wl->tx_queue, skb);
+                                return;
+                        } else if (ret < 0) {
+                                dev_kfree_skb(skb);
+                                return;
+                        }
+                }
+
+                wl12xx_debug(DEBUG_TX, "cb: waking queues");
+                ieee80211_wake_queues(wl->hw);
+                wl->tx_queue_stopped = false;
+        }
+}
+
+/* Called upon reception of a TX complete interrupt */
+void wl12xx_tx_complete(struct wl12xx *wl)
+{
+        int i, result_index, num_complete = 0;
+        struct tx_result result[FW_TX_CMPLT_BLOCK_SIZE], *result_ptr;
+
+        if (unlikely(wl->state != WL12XX_STATE_ON))
+                return;
+
+        /* First we read the result */
+        wl12xx_spi_mem_read(wl, wl->data_path->tx_complete_addr,
+                            result, sizeof(result));
+
+        result_index = wl->next_tx_complete;
+
+        for (i = 0; i < ARRAY_SIZE(result); i++) {
+                result_ptr = &result[result_index];
+
+                if (result_ptr->done_1 == 1 &&
+                    result_ptr->done_2 == 1) {
+                        wl12xx_tx_packet_cb(wl, result_ptr);
+
+                        result_ptr->done_1 = 0;
+                        result_ptr->done_2 = 0;
+
+                        result_index = (result_index + 1) &
+                                (FW_TX_CMPLT_BLOCK_SIZE - 1);
+                        num_complete++;
+                } else {
+                        break;
+                }
+        }
+
+        /* Every completed frame needs to be acknowledged */
+        if (num_complete) {
+                /*
+                 * If we've wrapped, we have to clear
+                 * the results in 2 steps.
+                 */
+                if (result_index > wl->next_tx_complete) {
+                        /* Only 1 write is needed */
+                        wl12xx_spi_mem_write(wl,
+                                             wl->data_path->tx_complete_addr +
+                                             (wl->next_tx_complete *
+                                              sizeof(struct tx_result)),
+                                             &result[wl->next_tx_complete],
+                                             num_complete *
+                                             sizeof(struct tx_result));
+
+
+                } else if (result_index < wl->next_tx_complete) {
+                        /* 2 writes are needed */
+                        wl12xx_spi_mem_write(wl,
+                                             wl->data_path->tx_complete_addr +
+                                             (wl->next_tx_complete *
+                                              sizeof(struct tx_result)),
+                                             &result[wl->next_tx_complete],
+                                             (FW_TX_CMPLT_BLOCK_SIZE -
+                                              wl->next_tx_complete) *
+                                             sizeof(struct tx_result));
+
+                        wl12xx_spi_mem_write(wl,
+                                             wl->data_path->tx_complete_addr,
+                                             result,
+                                             (num_complete -
+                                              FW_TX_CMPLT_BLOCK_SIZE +
+                                              wl->next_tx_complete) *
+                                             sizeof(struct tx_result));
+
+                } else {
+                        /* We have to write the whole array */
+                        wl12xx_spi_mem_write(wl,
+                                             wl->data_path->tx_complete_addr,
+                                             result,
+                                             FW_TX_CMPLT_BLOCK_SIZE *
+                                             sizeof(struct tx_result));
+                }
+
+        }
+
+        wl->next_tx_complete = result_index;
+}
+
+/* caller must hold wl->mutex */
+void wl12xx_tx_flush(struct wl12xx *wl)
+{
+        int i;
+        struct sk_buff *skb;
+        struct ieee80211_tx_info *info;
+
+        /* TX failure */
+/*      control->flags = 0; FIXME */
+
+        while ((skb = skb_dequeue(&wl->tx_queue))) {
+                info = IEEE80211_SKB_CB(skb);
+
+                wl12xx_debug(DEBUG_TX, "flushing skb 0x%p", skb);
+
+                if (!(info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS))
+                                continue;
+
+                ieee80211_tx_status(wl->hw, skb);
+        }
+
+        for (i = 0; i < FW_TX_CMPLT_BLOCK_SIZE; i++)
+                if (wl->tx_frames[i] != NULL) {
+                        skb = wl->tx_frames[i];
+                        info = IEEE80211_SKB_CB(skb);
+
+                        if (!(info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS))
+                                continue;
+
+                        ieee80211_tx_status(wl->hw, skb);
+                        wl->tx_frames[i] = NULL;
+                }
+}
diff --git a/drivers/net/wireless/wl12xx/tx.h b/drivers/net/wireless/wl12xx/tx.h
new file mode 100644
index 000000000000..dc82691f4c14
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/tx.h
@@ -0,0 +1,215 @@
+/*
+ * This file is part of wl12xx
+ *
+ * Copyright (c) 1998-2007 Texas Instruments Incorporated
+ * Copyright (C) 2008 Nokia Corporation
+ *
+ * Contact: Kalle Valo <kalle.valo@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __WL12XX_TX_H__
+#define __WL12XX_TX_H__
+
+#include <linux/bitops.h>
+
+/*
+ *
+ * TX PATH
+ *
+ * The Tx path uses a double buffer and a tx_control structure, each located
+ * at a fixed address in the device's memory. On startup, the host retrieves
+ * the pointers to these addresses. A double buffer allows for continuous data
+ * flow towards the device. The host keeps track of which buffer is available
+ * and alternates between these two buffers on a per packet basis.
+ *
+ * The size of each of the two buffers is large enough to hold the longest
+ * 802.3 packet - maximum size Ethernet packet + header + descriptor.
+ * TX complete indication will be received a-synchronously in a TX done cyclic
+ * buffer which is composed of 16 tx_result descriptors structures and is used
+ * in a cyclic manner.
+ *
+ * The TX (HOST) procedure is as follows:
+ * 1. Read the Tx path status, that will give the data_out_count.
+ * 2. goto 1, if not possible.
+ *    i.e. if data_in_count - data_out_count >= HwBuffer size (2 for double
+ *    buffer).
+ * 3. Copy the packet (preceded by double_buffer_desc), if possible.
+ *    i.e. if data_in_count - data_out_count < HwBuffer size (2 for double
+ *    buffer).
+ * 4. increment data_in_count.
+ * 5. Inform the firmware by generating a firmware internal interrupt.
+ * 6. FW will increment data_out_count after it reads the buffer.
+ *
+ * The TX Complete procedure:
+ * 1. To get a TX complete indication the host enables the tx_complete flag in
+ *    the TX descriptor Structure.
+ * 2. For each packet with a Tx Complete field set, the firmware adds the
+ *    transmit results to the cyclic buffer (txDoneRing) and sets both done_1
+ *    and done_2 to 1 to indicate driver ownership.
+ * 3. The firmware sends a Tx Complete interrupt to the host to trigger the
+ *    host to process the new data. Note: interrupt will be send per packet if
+ *    TX complete indication was requested in tx_control or per crossing
+ *    aggregation threshold.
+ * 4. After receiving the Tx Complete interrupt, the host reads the
+ *    TxDescriptorDone information in a cyclic manner and clears both done_1
+ *    and done_2 fields.
+ *
+ */
+
+#define TX_COMPLETE_REQUIRED_BIT        0x80
+#define TX_STATUS_DATA_OUT_COUNT_MASK   0xf
+#define WL12XX_TX_ALIGN_TO 4
+#define WL12XX_TX_ALIGN(len) (((len) + WL12XX_TX_ALIGN_TO - 1) & \
+                             ~(WL12XX_TX_ALIGN_TO - 1))
+#define WL12XX_TKIP_IV_SPACE 4
+
+struct tx_control {
+        /* Rate Policy (class) index */
+        unsigned rate_policy:3;
+
+        /* When set, no ack policy is expected */
+        unsigned ack_policy:1;
+
+        /*
+         * Packet type:
+         * 0 -> 802.11
+         * 1 -> 802.3
+         * 2 -> IP
+         * 3 -> raw codec
+         */
+        unsigned packet_type:2;
+
+        /* If set, this is a QoS-Null or QoS-Data frame */
+        unsigned qos:1;
+
+        /*
+         * If set, the target triggers the tx complete INT
+         * upon frame sending completion.
+         */
+        unsigned tx_complete:1;
+
+        /* 2 bytes padding before packet header */
+        unsigned xfer_pad:1;
+
+        unsigned reserved:7;
+} __attribute__ ((packed));
+
+
+struct tx_double_buffer_desc {
+        /* Length of payload, including headers. */
+        u16 length;
+
+        /*
+         * A bit mask that specifies the initial rate to be used
+         * Possible values are:
+         * 0x0001 - 1Mbits
+         * 0x0002 - 2Mbits
+         * 0x0004 - 5.5Mbits
+         * 0x0008 - 6Mbits
+         * 0x0010 - 9Mbits
+         * 0x0020 - 11Mbits
+         * 0x0040 - 12Mbits
+         * 0x0080 - 18Mbits
+         * 0x0100 - 22Mbits
+         * 0x0200 - 24Mbits
+         * 0x0400 - 36Mbits
+         * 0x0800 - 48Mbits
+         * 0x1000 - 54Mbits
+         */
+        u16 rate;
+
+        /* Time in us that a packet can spend in the target */
+        u32 expiry_time;
+
+        /* index of the TX queue used for this packet */
+        u8 xmit_queue;
+
+        /* Used to identify a packet */
+        u8 id;
+
+        struct tx_control control;
+
+        /*
+         * The FW should cut the packet into fragments
+         * of this size.
+         */
+        u16 frag_threshold;
+
+        /* Numbers of HW queue blocks to be allocated */
+        u8 num_mem_blocks;
+
+        u8 reserved;
+} __attribute__ ((packed));
+
+enum {
+        TX_SUCCESS              = 0,
+        TX_DMA_ERROR            = BIT(7),
+        TX_DISABLED             = BIT(6),
+        TX_RETRY_EXCEEDED       = BIT(5),
+        TX_TIMEOUT              = BIT(4),
+        TX_KEY_NOT_FOUND        = BIT(3),
+        TX_ENCRYPT_FAIL         = BIT(2),
+        TX_UNAVAILABLE_PRIORITY = BIT(1),
+};
+
+struct tx_result {
+        /*
+         * Ownership synchronization between the host and
+         * the firmware. If done_1 and done_2 are cleared,
+         * owned by the FW (no info ready).
+         */
+        u8 done_1;
+
+        /* same as double_buffer_desc->id */
+        u8 id;
+
+        /*
+         * Total air access duration consumed by this
+         * packet, including all retries and overheads.
+         */
+        u16 medium_usage;
+
+        /* Total media delay (from 1st EDCA AIFS counter until TX Complete). */
+        u32 medium_delay;
+
+        /* Time between host xfer and tx complete */
+        u32 fw_hnadling_time;
+
+        /* The LS-byte of the last TKIP sequence number. */
+        u8 lsb_seq_num;
+
+        /* Retry count */
+        u8 ack_failures;
+
+        /* At which rate we got a ACK */
+        u16 rate;
+
+        u16 reserved;
+
+        /* TX_* */
+        u8 status;
+
+        /* See done_1 */
+        u8 done_2;
+} __attribute__ ((packed));
+
+void wl12xx_tx_work(struct work_struct *work);
+void wl12xx_tx_complete(struct wl12xx *wl);
+void wl12xx_tx_flush(struct wl12xx *wl);
+
+#endif
diff --git a/drivers/net/wireless/wl12xx/wl1251.c b/drivers/net/wireless/wl12xx/wl1251.c
new file mode 100644
index 000000000000..ce1561a41fa4
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/wl1251.c
@@ -0,0 +1,709 @@
+/*
+ * This file is part of wl12xx
+ *
+ * Copyright (C) 2008-2009 Nokia Corporation
+ *
+ * Contact: Kalle Valo <kalle.valo@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+
+#include "wl1251.h"
+#include "reg.h"
+#include "spi.h"
+#include "boot.h"
+#include "event.h"
+#include "acx.h"
+#include "tx.h"
+#include "rx.h"
+#include "ps.h"
+#include "init.h"
+
+static struct wl12xx_partition_set wl1251_part_table[PART_TABLE_LEN] = {
+        [PART_DOWN] = {
+                .mem = {
+                        .start = 0x00000000,
+                        .size  = 0x00016800
+                },
+                .reg = {
+                        .start = REGISTERS_BASE,
+                        .size  = REGISTERS_DOWN_SIZE
+                },
+        },
+
+        [PART_WORK] = {
+                .mem = {
+                        .start = 0x00028000,
+                        .size  = 0x00014000
+                },
+                .reg = {
+                        .start = REGISTERS_BASE,
+                        .size  = REGISTERS_WORK_SIZE
+                },
+        },
+
+        /* WL1251 doesn't use the DRPW partition, so we don't set it here */
+};
+
+static enum wl12xx_acx_int_reg wl1251_acx_reg_table[ACX_REG_TABLE_LEN] = {
+        [ACX_REG_INTERRUPT_TRIG]     = (REGISTERS_BASE + 0x0474),
+        [ACX_REG_INTERRUPT_TRIG_H]   = (REGISTERS_BASE + 0x0478),
+        [ACX_REG_INTERRUPT_MASK]     = (REGISTERS_BASE + 0x0494),
+        [ACX_REG_HINT_MASK_SET]      = (REGISTERS_BASE + 0x0498),
+        [ACX_REG_HINT_MASK_CLR]      = (REGISTERS_BASE + 0x049C),
+        [ACX_REG_INTERRUPT_NO_CLEAR] = (REGISTERS_BASE + 0x04B0),
+        [ACX_REG_INTERRUPT_CLEAR]    = (REGISTERS_BASE + 0x04A4),
+        [ACX_REG_INTERRUPT_ACK]      = (REGISTERS_BASE + 0x04A8),
+        [ACX_REG_SLV_SOFT_RESET]     = (REGISTERS_BASE + 0x0000),
+        [ACX_REG_EE_START]           = (REGISTERS_BASE + 0x080C),
+        [ACX_REG_ECPU_CONTROL]       = (REGISTERS_BASE + 0x0804)
+};
+
+static int wl1251_upload_firmware(struct wl12xx *wl)
+{
+        struct wl12xx_partition_set *p_table = wl->chip.p_table;
+        int addr, chunk_num, partition_limit;
+        size_t fw_data_len;
+        u8 *p;
+
+        /* whal_FwCtrl_LoadFwImageSm() */
+
+        wl12xx_debug(DEBUG_BOOT, "chip id before fw upload: 0x%x",
+                     wl12xx_reg_read32(wl, CHIP_ID_B));
+
+        /* 10.0 check firmware length and set partition */
+        fw_data_len =  (wl->fw[4] << 24) | (wl->fw[5] << 16) |
+                (wl->fw[6] << 8) | (wl->fw[7]);
+
+        wl12xx_debug(DEBUG_BOOT, "fw_data_len %zu chunk_size %d", fw_data_len,
+                CHUNK_SIZE);
+
+        if ((fw_data_len % 4) != 0) {
+                wl12xx_error("firmware length not multiple of four");
+                return -EIO;
+        }
+
+        wl12xx_set_partition(wl,
+                             p_table[PART_DOWN].mem.start,
+                             p_table[PART_DOWN].mem.size,
+                             p_table[PART_DOWN].reg.start,
+                             p_table[PART_DOWN].reg.size);
+
+        /* 10.1 set partition limit and chunk num */
+        chunk_num = 0;
+        partition_limit = p_table[PART_DOWN].mem.size;
+
+        while (chunk_num < fw_data_len / CHUNK_SIZE) {
+                /* 10.2 update partition, if needed */
+                addr = p_table[PART_DOWN].mem.start +
+                        (chunk_num + 2) * CHUNK_SIZE;
+                if (addr > partition_limit) {
+                        addr = p_table[PART_DOWN].mem.start +
+                                chunk_num * CHUNK_SIZE;
+                        partition_limit = chunk_num * CHUNK_SIZE +
+                                p_table[PART_DOWN].mem.size;
+                        wl12xx_set_partition(wl,
+                                             addr,
+                                             p_table[PART_DOWN].mem.size,
+                                             p_table[PART_DOWN].reg.start,
+                                             p_table[PART_DOWN].reg.size);
+                }
+
+                /* 10.3 upload the chunk */
+                addr = p_table[PART_DOWN].mem.start + chunk_num * CHUNK_SIZE;
+                p = wl->fw + FW_HDR_SIZE + chunk_num * CHUNK_SIZE;
+                wl12xx_debug(DEBUG_BOOT, "uploading fw chunk 0x%p to 0x%x",
+                             p, addr);
+                wl12xx_spi_mem_write(wl, addr, p, CHUNK_SIZE);
+
+                chunk_num++;
+        }
+
+        /* 10.4 upload the last chunk */
+        addr = p_table[PART_DOWN].mem.start + chunk_num * CHUNK_SIZE;
+        p = wl->fw + FW_HDR_SIZE + chunk_num * CHUNK_SIZE;
+        wl12xx_debug(DEBUG_BOOT, "uploading fw last chunk (%zu B) 0x%p to 0x%x",
+                     fw_data_len % CHUNK_SIZE, p, addr);
+        wl12xx_spi_mem_write(wl, addr, p, fw_data_len % CHUNK_SIZE);
+
+        return 0;
+}
+
+static int wl1251_upload_nvs(struct wl12xx *wl)
+{
+        size_t nvs_len, nvs_bytes_written, burst_len;
+        int nvs_start, i;
+        u32 dest_addr, val;
+        u8 *nvs_ptr, *nvs;
+
+        nvs = wl->nvs;
+        if (nvs == NULL)
+                return -ENODEV;
+
+        nvs_ptr = nvs;
+
+        nvs_len = wl->nvs_len;
+        nvs_start = wl->fw_len;
+
+        /*
+         * Layout before the actual NVS tables:
+         * 1 byte : burst length.
+         * 2 bytes: destination address.
+         * n bytes: data to burst copy.
+         *
+         * This is ended by a 0 length, then the NVS tables.
+         */
+
+        while (nvs_ptr[0]) {
+                burst_len = nvs_ptr[0];
+                dest_addr = (nvs_ptr[1] & 0xfe) | ((u32)(nvs_ptr[2] << 8));
+
+                /* We move our pointer to the data */
+                nvs_ptr += 3;
+
+                for (i = 0; i < burst_len; i++) {
+                        val = (nvs_ptr[0] | (nvs_ptr[1] << 8)
+                               | (nvs_ptr[2] << 16) | (nvs_ptr[3] << 24));
+
+                        wl12xx_debug(DEBUG_BOOT,
+                                     "nvs burst write 0x%x: 0x%x",
+                                     dest_addr, val);
+                        wl12xx_mem_write32(wl, dest_addr, val);
+
+                        nvs_ptr += 4;
+                        dest_addr += 4;
+                }
+        }
+
+        /*
+         * We've reached the first zero length, the first NVS table
+         * is 7 bytes further.
+         */
+        nvs_ptr += 7;
+        nvs_len -= nvs_ptr - nvs;
+        nvs_len = ALIGN(nvs_len, 4);
+
+        /* Now we must set the partition correctly */
+        wl12xx_set_partition(wl, nvs_start,
+                             wl->chip.p_table[PART_DOWN].mem.size,
+                             wl->chip.p_table[PART_DOWN].reg.start,
+                             wl->chip.p_table[PART_DOWN].reg.size);
+
+        /* And finally we upload the NVS tables */
+        nvs_bytes_written = 0;
+        while (nvs_bytes_written < nvs_len) {
+                val = (nvs_ptr[0] | (nvs_ptr[1] << 8)
+                       | (nvs_ptr[2] << 16) | (nvs_ptr[3] << 24));
+
+                val = cpu_to_le32(val);
+
+                wl12xx_debug(DEBUG_BOOT,
+                             "nvs write table 0x%x: 0x%x",
+                             nvs_start, val);
+                wl12xx_mem_write32(wl, nvs_start, val);
+
+                nvs_ptr += 4;
+                nvs_bytes_written += 4;
+                nvs_start += 4;
+        }
+
+        return 0;
+}
+
+static int wl1251_boot(struct wl12xx *wl)
+{
+        int ret = 0, minor_minor_e2_ver;
+        u32 tmp, boot_data;
+
+        ret = wl12xx_boot_soft_reset(wl);
+        if (ret < 0)
+                goto out;
+
+        /* 2. start processing NVS file */
+        ret = wl->chip.op_upload_nvs(wl);
+        if (ret < 0)
+                goto out;
+
+        /* write firmware's last address (ie. it's length) to
+         * ACX_EEPROMLESS_IND_REG */
+        wl12xx_reg_write32(wl, ACX_EEPROMLESS_IND_REG, wl->fw_len);
+
+        /* 6. read the EEPROM parameters */
+        tmp = wl12xx_reg_read32(wl, SCR_PAD2);
+
+        /* 7. read bootdata */
+        wl->boot_attr.radio_type = (tmp & 0x0000FF00) >> 8;
+        wl->boot_attr.major = (tmp & 0x00FF0000) >> 16;
+        tmp = wl12xx_reg_read32(wl, SCR_PAD3);
+
+        /* 8. check bootdata and call restart sequence */
+        wl->boot_attr.minor = (tmp & 0x00FF0000) >> 16;
+        minor_minor_e2_ver = (tmp & 0xFF000000) >> 24;
+
+        wl12xx_debug(DEBUG_BOOT, "radioType 0x%x majorE2Ver 0x%x "
+                     "minorE2Ver 0x%x minor_minor_e2_ver 0x%x",
+                     wl->boot_attr.radio_type, wl->boot_attr.major,
+                     wl->boot_attr.minor, minor_minor_e2_ver);
+
+        ret = wl12xx_boot_init_seq(wl);
+        if (ret < 0)
+                goto out;
+
+        /* 9. NVS processing done */
+        boot_data = wl12xx_reg_read32(wl, ACX_REG_ECPU_CONTROL);
+
+        wl12xx_debug(DEBUG_BOOT, "halt boot_data 0x%x", boot_data);
+
+        /* 10. check that ECPU_CONTROL_HALT bits are set in
+         * pWhalBus->uBootData and start uploading firmware
+         */
+        if ((boot_data & ECPU_CONTROL_HALT) == 0) {
+                wl12xx_error("boot failed, ECPU_CONTROL_HALT not set");
+                ret = -EIO;
+                goto out;
+        }
+
+        ret = wl->chip.op_upload_fw(wl);
+        if (ret < 0)
+                goto out;
+
+        /* 10.5 start firmware */
+        ret = wl12xx_boot_run_firmware(wl);
+        if (ret < 0)
+                goto out;
+
+        /* Get and save the firmware version */
+        wl12xx_acx_fw_version(wl, wl->chip.fw_ver, sizeof(wl->chip.fw_ver));
+
+out:
+        return ret;
+}
+
+static int wl1251_mem_cfg(struct wl12xx *wl)
+{
+        struct wl1251_acx_config_memory mem_conf;
+        int ret, i;
+
+        wl12xx_debug(DEBUG_ACX, "wl1251 mem cfg");
+
+        /* memory config */
+        mem_conf.mem_config.num_stations = cpu_to_le16(DEFAULT_NUM_STATIONS);
+        mem_conf.mem_config.rx_mem_block_num = 35;
+        mem_conf.mem_config.tx_min_mem_block_num = 64;
+        mem_conf.mem_config.num_tx_queues = MAX_TX_QUEUES;
+        mem_conf.mem_config.host_if_options = HOSTIF_PKT_RING;
+        mem_conf.mem_config.num_ssid_profiles = 1;
+        mem_conf.mem_config.debug_buffer_size =
+                cpu_to_le16(TRACE_BUFFER_MAX_SIZE);
+
+        /* RX queue config */
+        mem_conf.rx_queue_config.dma_address = 0;
+        mem_conf.rx_queue_config.num_descs = ACX_RX_DESC_DEF;
+        mem_conf.rx_queue_config.priority = DEFAULT_RXQ_PRIORITY;
+        mem_conf.rx_queue_config.type = DEFAULT_RXQ_TYPE;
+
+        /* TX queue config */
+        for (i = 0; i < MAX_TX_QUEUES; i++) {
+                mem_conf.tx_queue_config[i].num_descs = ACX_TX_DESC_DEF;
+                mem_conf.tx_queue_config[i].attributes = i;
+        }
+
+        mem_conf.header.id = ACX_MEM_CFG;
+        mem_conf.header.len = sizeof(struct wl1251_acx_config_memory) -
+                sizeof(struct acx_header);
+        mem_conf.header.len -=
+                (MAX_TX_QUEUE_CONFIGS - mem_conf.mem_config.num_tx_queues) *
+                sizeof(struct wl1251_acx_tx_queue_config);
+
+        ret = wl12xx_cmd_configure(wl, &mem_conf,
+                                   sizeof(struct wl1251_acx_config_memory));
+        if (ret < 0)
+                wl12xx_warning("wl1251 mem config failed: %d", ret);
+
+        return ret;
+}
+
+static int wl1251_hw_init_mem_config(struct wl12xx *wl)
+{
+        int ret;
+
+        ret = wl1251_mem_cfg(wl);
+        if (ret < 0)
+                return ret;
+
+        wl->target_mem_map = kzalloc(sizeof(struct wl1251_acx_mem_map),
+                                          GFP_KERNEL);
+        if (!wl->target_mem_map) {
+                wl12xx_error("couldn't allocate target memory map");
+                return -ENOMEM;
+        }
+
+        /* we now ask for the firmware built memory map */
+        ret = wl12xx_acx_mem_map(wl, wl->target_mem_map,
+                                 sizeof(struct wl1251_acx_mem_map));
+        if (ret < 0) {
+                wl12xx_error("couldn't retrieve firmware memory map");
+                kfree(wl->target_mem_map);
+                wl->target_mem_map = NULL;
+                return ret;
+        }
+
+        return 0;
+}
+
+static void wl1251_set_ecpu_ctrl(struct wl12xx *wl, u32 flag)
+{
+        u32 cpu_ctrl;
+
+        /* 10.5.0 run the firmware (I) */
+        cpu_ctrl = wl12xx_reg_read32(wl, ACX_REG_ECPU_CONTROL);
+
+        /* 10.5.1 run the firmware (II) */
+        cpu_ctrl &= ~flag;
+        wl12xx_reg_write32(wl, ACX_REG_ECPU_CONTROL, cpu_ctrl);
+}
+
+static void wl1251_target_enable_interrupts(struct wl12xx *wl)
+{
+        /* Enable target's interrupts */
+        wl->intr_mask = WL1251_ACX_INTR_RX0_DATA |
+                WL1251_ACX_INTR_RX1_DATA |
+                WL1251_ACX_INTR_TX_RESULT |
+                WL1251_ACX_INTR_EVENT_A |
+                WL1251_ACX_INTR_EVENT_B |
+                WL1251_ACX_INTR_INIT_COMPLETE;
+        wl12xx_boot_target_enable_interrupts(wl);
+}
+
+static void wl1251_irq_work(struct work_struct *work)
+{
+        u32 intr;
+        struct wl12xx *wl =
+                container_of(work, struct wl12xx, irq_work);
+
+        mutex_lock(&wl->mutex);
+
+        wl12xx_debug(DEBUG_IRQ, "IRQ work");
+
+        if (wl->state == WL12XX_STATE_OFF)
+                goto out;
+
+        wl12xx_ps_elp_wakeup(wl);
+
+        wl12xx_reg_write32(wl, ACX_REG_INTERRUPT_MASK, WL1251_ACX_INTR_ALL);
+
+        intr = wl12xx_reg_read32(wl, ACX_REG_INTERRUPT_CLEAR);
+        wl12xx_debug(DEBUG_IRQ, "intr: 0x%x", intr);
+
+        if (wl->data_path) {
+                wl12xx_spi_mem_read(wl, wl->data_path->rx_control_addr,
+                                    &wl->rx_counter, sizeof(u32));
+
+                /* We handle a frmware bug here */
+                switch ((wl->rx_counter - wl->rx_handled) & 0xf) {
+                case 0:
+                        wl12xx_debug(DEBUG_IRQ, "RX: FW and host in sync");
+                        intr &= ~WL1251_ACX_INTR_RX0_DATA;
+                        intr &= ~WL1251_ACX_INTR_RX1_DATA;
+                        break;
+                case 1:
+                        wl12xx_debug(DEBUG_IRQ, "RX: FW +1");
+                        intr |= WL1251_ACX_INTR_RX0_DATA;
+                        intr &= ~WL1251_ACX_INTR_RX1_DATA;
+                        break;
+                case 2:
+                        wl12xx_debug(DEBUG_IRQ, "RX: FW +2");
+                        intr |= WL1251_ACX_INTR_RX0_DATA;
+                        intr |= WL1251_ACX_INTR_RX1_DATA;
+                        break;
+                default:
+                        wl12xx_warning("RX: FW and host out of sync: %d",
+                                       wl->rx_counter - wl->rx_handled);
+                        break;
+                }
+
+                wl->rx_handled = wl->rx_counter;
+
+
+                wl12xx_debug(DEBUG_IRQ, "RX counter: %d", wl->rx_counter);
+        }
+
+        intr &= wl->intr_mask;
+
+        if (intr == 0) {
+                wl12xx_debug(DEBUG_IRQ, "INTR is 0");
+                wl12xx_reg_write32(wl, ACX_REG_INTERRUPT_MASK,
+                                   ~(wl->intr_mask));
+
+                goto out_sleep;
+        }
+
+        if (intr & WL1251_ACX_INTR_RX0_DATA) {
+                wl12xx_debug(DEBUG_IRQ, "WL1251_ACX_INTR_RX0_DATA");
+                wl12xx_rx(wl);
+        }
+
+        if (intr & WL1251_ACX_INTR_RX1_DATA) {
+                wl12xx_debug(DEBUG_IRQ, "WL1251_ACX_INTR_RX1_DATA");
+                wl12xx_rx(wl);
+        }
+
+        if (intr & WL1251_ACX_INTR_TX_RESULT) {
+                wl12xx_debug(DEBUG_IRQ, "WL1251_ACX_INTR_TX_RESULT");
+                wl12xx_tx_complete(wl);
+        }
+
+        if (intr & (WL1251_ACX_INTR_EVENT_A | WL1251_ACX_INTR_EVENT_B)) {
+                wl12xx_debug(DEBUG_IRQ, "WL1251_ACX_INTR_EVENT (0x%x)", intr);
+                if (intr & WL1251_ACX_INTR_EVENT_A)
+                        wl12xx_event_handle(wl, 0);
+                else
+                        wl12xx_event_handle(wl, 1);
+        }
+
+        if (intr & WL1251_ACX_INTR_INIT_COMPLETE)
+                wl12xx_debug(DEBUG_IRQ, "WL1251_ACX_INTR_INIT_COMPLETE");
+
+        wl12xx_reg_write32(wl, ACX_REG_INTERRUPT_MASK, ~(wl->intr_mask));
+
+out_sleep:
+        wl12xx_ps_elp_sleep(wl);
+out:
+        mutex_unlock(&wl->mutex);
+}
+
+static int wl1251_hw_init_txq_fill(u8 qid,
+                                   struct acx_tx_queue_qos_config *config,
+                                   u32 num_blocks)
+{
+        config->qid = qid;
+
+        switch (qid) {
+        case QOS_AC_BE:
+                config->high_threshold =
+                        (QOS_TX_HIGH_BE_DEF * num_blocks) / 100;
+                config->low_threshold =
+                        (QOS_TX_LOW_BE_DEF * num_blocks) / 100;
+                break;
+        case QOS_AC_BK:
+                config->high_threshold =
+                        (QOS_TX_HIGH_BK_DEF * num_blocks) / 100;
+                config->low_threshold =
+                        (QOS_TX_LOW_BK_DEF * num_blocks) / 100;
+                break;
+        case QOS_AC_VI:
+                config->high_threshold =
+                        (QOS_TX_HIGH_VI_DEF * num_blocks) / 100;
+                config->low_threshold =
+                        (QOS_TX_LOW_VI_DEF * num_blocks) / 100;
+                break;
+        case QOS_AC_VO:
+                config->high_threshold =
+                        (QOS_TX_HIGH_VO_DEF * num_blocks) / 100;
+                config->low_threshold =
+                        (QOS_TX_LOW_VO_DEF * num_blocks) / 100;
+                break;
+        default:
+                wl12xx_error("Invalid TX queue id: %d", qid);
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static int wl1251_hw_init_tx_queue_config(struct wl12xx *wl)
+{
+        struct acx_tx_queue_qos_config config;
+        struct wl1251_acx_mem_map *wl_mem_map = wl->target_mem_map;
+        int ret, i;
+
+        wl12xx_debug(DEBUG_ACX, "acx tx queue config");
+
+        config.header.id = ACX_TX_QUEUE_CFG;
+        config.header.len = sizeof(struct acx_tx_queue_qos_config) -
+                sizeof(struct acx_header);
+
+        for (i = 0; i < MAX_NUM_OF_AC; i++) {
+                ret = wl1251_hw_init_txq_fill(i, &config,
+                                              wl_mem_map->num_tx_mem_blocks);
+                if (ret < 0)
+                        return ret;
+
+                ret = wl12xx_cmd_configure(wl, &config, sizeof(config));
+                if (ret < 0)
+                        return ret;
+        }
+
+        return 0;
+}
+
+static int wl1251_hw_init_data_path_config(struct wl12xx *wl)
+{
+        int ret;
+
+        /* asking for the data path parameters */
+        wl->data_path = kzalloc(sizeof(struct acx_data_path_params_resp),
+                                GFP_KERNEL);
+        if (!wl->data_path) {
+                wl12xx_error("Couldnt allocate data path parameters");
+                return -ENOMEM;
+        }
+
+        ret = wl12xx_acx_data_path_params(wl, wl->data_path);
+        if (ret < 0) {
+                kfree(wl->data_path);
+                wl->data_path = NULL;
+                return ret;
+        }
+
+        return 0;
+}
+
+static int wl1251_hw_init(struct wl12xx *wl)
+{
+        struct wl1251_acx_mem_map *wl_mem_map;
+        int ret;
+
+        ret = wl12xx_hw_init_hwenc_config(wl);
+        if (ret < 0)
+                return ret;
+
+        /* Template settings */
+        ret = wl12xx_hw_init_templates_config(wl);
+        if (ret < 0)
+                return ret;
+
+        /* Default memory configuration */
+        ret = wl1251_hw_init_mem_config(wl);
+        if (ret < 0)
+                return ret;
+
+        /* Default data path configuration  */
+        ret = wl1251_hw_init_data_path_config(wl);
+        if (ret < 0)
+                goto out_free_memmap;
+
+        /* RX config */
+        ret = wl12xx_hw_init_rx_config(wl,
+                                       RX_CFG_PROMISCUOUS | RX_CFG_TSF,
+                                       RX_FILTER_OPTION_DEF);
+        /* RX_CONFIG_OPTION_ANY_DST_ANY_BSS,
+           RX_FILTER_OPTION_FILTER_ALL); */
+        if (ret < 0)
+                goto out_free_data_path;
+
+        /* TX queues config */
+        ret = wl1251_hw_init_tx_queue_config(wl);
+        if (ret < 0)
+                goto out_free_data_path;
+
+        /* PHY layer config */
+        ret = wl12xx_hw_init_phy_config(wl);
+        if (ret < 0)
+                goto out_free_data_path;
+
+        /* Beacon filtering */
+        ret = wl12xx_hw_init_beacon_filter(wl);
+        if (ret < 0)
+                goto out_free_data_path;
+
+        /* Bluetooth WLAN coexistence */
+        ret = wl12xx_hw_init_pta(wl);
+        if (ret < 0)
+                goto out_free_data_path;
+
+        /* Energy detection */
+        ret = wl12xx_hw_init_energy_detection(wl);
+        if (ret < 0)
+                goto out_free_data_path;
+
+        /* Beacons and boradcast settings */
+        ret = wl12xx_hw_init_beacon_broadcast(wl);
+        if (ret < 0)
+                goto out_free_data_path;
+
+        /* Enable data path */
+        ret = wl12xx_cmd_data_path(wl, wl->channel, 1);
+        if (ret < 0)
+                goto out_free_data_path;
+
+        /* Default power state */
+        ret = wl12xx_hw_init_power_auth(wl);
+        if (ret < 0)
+                goto out_free_data_path;
+
+        wl_mem_map = wl->target_mem_map;
+        wl12xx_info("%d tx blocks at 0x%x, %d rx blocks at 0x%x",
+                    wl_mem_map->num_tx_mem_blocks,
+                    wl->data_path->tx_control_addr,
+                    wl_mem_map->num_rx_mem_blocks,
+                    wl->data_path->rx_control_addr);
+
+        return 0;
+
+ out_free_data_path:
+        kfree(wl->data_path);
+
+ out_free_memmap:
+        kfree(wl->target_mem_map);
+
+        return ret;
+}
+
+static int wl1251_plt_init(struct wl12xx *wl)
+{
+        int ret;
+
+        ret = wl1251_hw_init_mem_config(wl);
+        if (ret < 0)
+                return ret;
+
+        ret = wl12xx_cmd_data_path(wl, wl->channel, 1);
+        if (ret < 0)
+                return ret;
+
+        return 0;
+}
+
+void wl1251_setup(struct wl12xx *wl)
+{
+        /* FIXME: Is it better to use strncpy here or is this ok? */
+        wl->chip.fw_filename = WL1251_FW_NAME;
+        wl->chip.nvs_filename = WL1251_NVS_NAME;
+
+        /* Now we know what chip we're using, so adjust the power on sleep
+         * time accordingly */
+        wl->chip.power_on_sleep = WL1251_POWER_ON_SLEEP;
+
+        wl->chip.intr_cmd_complete = WL1251_ACX_INTR_CMD_COMPLETE;
+        wl->chip.intr_init_complete = WL1251_ACX_INTR_INIT_COMPLETE;
+
+        wl->chip.op_upload_nvs = wl1251_upload_nvs;
+        wl->chip.op_upload_fw = wl1251_upload_firmware;
+        wl->chip.op_boot = wl1251_boot;
+        wl->chip.op_set_ecpu_ctrl = wl1251_set_ecpu_ctrl;
+        wl->chip.op_target_enable_interrupts = wl1251_target_enable_interrupts;
+        wl->chip.op_hw_init = wl1251_hw_init;
+        wl->chip.op_plt_init = wl1251_plt_init;
+
+        wl->chip.p_table = wl1251_part_table;
+        wl->chip.acx_reg_table = wl1251_acx_reg_table;
+
+        INIT_WORK(&wl->irq_work, wl1251_irq_work);
+}
diff --git a/drivers/net/wireless/wl12xx/wl1251.h b/drivers/net/wireless/wl12xx/wl1251.h
new file mode 100644
index 000000000000..1f4a44330394
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/wl1251.h
@@ -0,0 +1,165 @@
+/*
+ * This file is part of wl12xx
+ *
+ * Copyright (C) 2008 Nokia Corporation
+ *
+ * Contact: Kalle Valo <kalle.valo@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __WL1251_H__
+#define __WL1251_H__
+
+#include <linux/bitops.h>
+
+#include "wl12xx.h"
+#include "acx.h"
+
+#define WL1251_FW_NAME "wl1251-fw.bin"
+#define WL1251_NVS_NAME "wl1251-nvs.bin"
+
+#define WL1251_POWER_ON_SLEEP 10 /* in miliseconds */
+
+void wl1251_setup(struct wl12xx *wl);
+
+
+struct wl1251_acx_memory {
+        __le16 num_stations; /* number of STAs to be supported. */
+        u16 reserved_1;
+
+        /*
+         * Nmber of memory buffers for the RX mem pool.
+         * The actual number may be less if there are
+         * not enough blocks left for the minimum num
+         * of TX ones.
+         */
+        u8 rx_mem_block_num;
+        u8 reserved_2;
+        u8 num_tx_queues; /* From 1 to 16 */
+        u8 host_if_options; /* HOST_IF* */
+        u8 tx_min_mem_block_num;
+        u8 num_ssid_profiles;
+        __le16 debug_buffer_size;
+} __attribute__ ((packed));
+
+
+#define ACX_RX_DESC_MIN                1
+#define ACX_RX_DESC_MAX                127
+#define ACX_RX_DESC_DEF                32
+struct wl1251_acx_rx_queue_config {
+        u8 num_descs;
+        u8 pad;
+        u8 type;
+        u8 priority;
+        __le32 dma_address;
+} __attribute__ ((packed));
+
+#define ACX_TX_DESC_MIN                1
+#define ACX_TX_DESC_MAX                127
+#define ACX_TX_DESC_DEF                16
+struct wl1251_acx_tx_queue_config {
+    u8 num_descs;
+    u8 pad[2];
+    u8 attributes;
+} __attribute__ ((packed));
+
+#define MAX_TX_QUEUE_CONFIGS 5
+#define MAX_TX_QUEUES 4
+struct wl1251_acx_config_memory {
+        struct acx_header header;
+
+        struct wl1251_acx_memory mem_config;
+        struct wl1251_acx_rx_queue_config rx_queue_config;
+        struct wl1251_acx_tx_queue_config tx_queue_config[MAX_TX_QUEUE_CONFIGS];
+} __attribute__ ((packed));
+
+struct wl1251_acx_mem_map {
+        struct acx_header header;
+
+        void *code_start;
+        void *code_end;
+
+        void *wep_defkey_start;
+        void *wep_defkey_end;
+
+        void *sta_table_start;
+        void *sta_table_end;
+
+        void *packet_template_start;
+        void *packet_template_end;
+
+        void *queue_memory_start;
+        void *queue_memory_end;
+
+        void *packet_memory_pool_start;
+        void *packet_memory_pool_end;
+
+        void *debug_buffer1_start;
+        void *debug_buffer1_end;
+
+        void *debug_buffer2_start;
+        void *debug_buffer2_end;
+
+        /* Number of blocks FW allocated for TX packets */
+        u32 num_tx_mem_blocks;
+
+        /* Number of blocks FW allocated for RX packets */
+        u32 num_rx_mem_blocks;
+} __attribute__ ((packed));
+
+/*************************************************************************
+
+    Host Interrupt Register (WiLink -> Host)
+
+**************************************************************************/
+
+/* RX packet is ready in Xfer buffer #0 */
+#define WL1251_ACX_INTR_RX0_DATA      BIT(0)
+
+/* TX result(s) are in the TX complete buffer */
+#define WL1251_ACX_INTR_TX_RESULT       BIT(1)
+
+/* OBSOLETE */
+#define WL1251_ACX_INTR_TX_XFR          BIT(2)
+
+/* RX packet is ready in Xfer buffer #1 */
+#define WL1251_ACX_INTR_RX1_DATA        BIT(3)
+
+/* Event was entered to Event MBOX #A */
+#define WL1251_ACX_INTR_EVENT_A         BIT(4)
+
+/* Event was entered to Event MBOX #B */
+#define WL1251_ACX_INTR_EVENT_B         BIT(5)
+
+/* OBSOLETE */
+#define WL1251_ACX_INTR_WAKE_ON_HOST    BIT(6)
+
+/* Trace meassge on MBOX #A */
+#define WL1251_ACX_INTR_TRACE_A         BIT(7)
+
+/* Trace meassge on MBOX #B */
+#define WL1251_ACX_INTR_TRACE_B         BIT(8)
+
+/* Command processing completion */
+#define WL1251_ACX_INTR_CMD_COMPLETE    BIT(9)
+
+/* Init sequence is done */
+#define WL1251_ACX_INTR_INIT_COMPLETE   BIT(14)
+
+#define WL1251_ACX_INTR_ALL           0xFFFFFFFF
+
+#endif
diff --git a/drivers/net/wireless/wl12xx/wl12xx.h b/drivers/net/wireless/wl12xx/wl12xx.h
new file mode 100644
index 000000000000..48641437414b
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/wl12xx.h
@@ -0,0 +1,409 @@
+/*
+ * This file is part of wl12xx
+ *
+ * Copyright (c) 1998-2007 Texas Instruments Incorporated
+ * Copyright (C) 2008-2009 Nokia Corporation
+ *
+ * Contact: Kalle Valo <kalle.valo@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __WL12XX_H__
+#define __WL12XX_H__
+
+#include <linux/mutex.h>
+#include <linux/list.h>
+#include <linux/bitops.h>
+#include <net/mac80211.h>
+
+#define DRIVER_NAME "wl12xx"
+#define DRIVER_PREFIX DRIVER_NAME ": "
+
+enum {
+        DEBUG_NONE      = 0,
+        DEBUG_IRQ       = BIT(0),
+        DEBUG_SPI       = BIT(1),
+        DEBUG_BOOT      = BIT(2),
+        DEBUG_MAILBOX   = BIT(3),
+        DEBUG_NETLINK   = BIT(4),
+        DEBUG_EVENT     = BIT(5),
+        DEBUG_TX        = BIT(6),
+        DEBUG_RX        = BIT(7),
+        DEBUG_SCAN      = BIT(8),
+        DEBUG_CRYPT     = BIT(9),
+        DEBUG_PSM       = BIT(10),
+        DEBUG_MAC80211  = BIT(11),
+        DEBUG_CMD       = BIT(12),
+        DEBUG_ACX       = BIT(13),
+        DEBUG_ALL       = ~0,
+};
+
+#define DEBUG_LEVEL (DEBUG_NONE)
+
+#define DEBUG_DUMP_LIMIT 1024
+
+#define wl12xx_error(fmt, arg...) \
+        printk(KERN_ERR DRIVER_PREFIX "ERROR " fmt "\n", ##arg)
+
+#define wl12xx_warning(fmt, arg...) \
+        printk(KERN_WARNING DRIVER_PREFIX "WARNING " fmt "\n", ##arg)
+
+#define wl12xx_notice(fmt, arg...) \
+        printk(KERN_INFO DRIVER_PREFIX fmt "\n", ##arg)
+
+#define wl12xx_info(fmt, arg...) \
+        printk(KERN_DEBUG DRIVER_PREFIX fmt "\n", ##arg)
+
+#define wl12xx_debug(level, fmt, arg...) \
+        do { \
+                if (level & DEBUG_LEVEL) \
+                        printk(KERN_DEBUG DRIVER_PREFIX fmt "\n", ##arg); \
+        } while (0)
+
+#define wl12xx_dump(level, prefix, buf, len)    \
+        do { \
+                if (level & DEBUG_LEVEL) \
+                        print_hex_dump(KERN_DEBUG, DRIVER_PREFIX prefix, \
+                                       DUMP_PREFIX_OFFSET, 16, 1,       \
+                                       buf,                             \
+                                       min_t(size_t, len, DEBUG_DUMP_LIMIT), \
+                                       0);                              \
+        } while (0)
+
+#define wl12xx_dump_ascii(level, prefix, buf, len)      \
+        do { \
+                if (level & DEBUG_LEVEL) \
+                        print_hex_dump(KERN_DEBUG, DRIVER_PREFIX prefix, \
+                                       DUMP_PREFIX_OFFSET, 16, 1,       \
+                                       buf,                             \
+                                       min_t(size_t, len, DEBUG_DUMP_LIMIT), \
+                                       true);                           \
+        } while (0)
+
+#define WL12XX_DEFAULT_RX_CONFIG (CFG_UNI_FILTER_EN |   \
+                                  CFG_BSSID_FILTER_EN)
+
+#define WL12XX_DEFAULT_RX_FILTER (CFG_RX_PRSP_EN |  \
+                                  CFG_RX_MGMT_EN |  \
+                                  CFG_RX_DATA_EN |  \
+                                  CFG_RX_CTL_EN |   \
+                                  CFG_RX_BCN_EN |   \
+                                  CFG_RX_AUTH_EN |  \
+                                  CFG_RX_ASSOC_EN)
+
+
+struct boot_attr {
+        u32 radio_type;
+        u8 mac_clock;
+        u8 arm_clock;
+        int firmware_debug;
+        u32 minor;
+        u32 major;
+        u32 bugfix;
+};
+
+enum wl12xx_state {
+        WL12XX_STATE_OFF,
+        WL12XX_STATE_ON,
+        WL12XX_STATE_PLT,
+};
+
+enum wl12xx_partition_type {
+        PART_DOWN,
+        PART_WORK,
+        PART_DRPW,
+
+        PART_TABLE_LEN
+};
+
+struct wl12xx_partition {
+        u32 size;
+        u32 start;
+};
+
+struct wl12xx_partition_set {
+        struct wl12xx_partition mem;
+        struct wl12xx_partition reg;
+};
+
+struct wl12xx;
+
+/* FIXME: I'm not sure about this structure name */
+struct wl12xx_chip {
+        u32 id;
+
+        const char *fw_filename;
+        const char *nvs_filename;
+
+        char fw_ver[21];
+
+        unsigned int power_on_sleep;
+        int intr_cmd_complete;
+        int intr_init_complete;
+
+        int (*op_upload_fw)(struct wl12xx *wl);
+        int (*op_upload_nvs)(struct wl12xx *wl);
+        int (*op_boot)(struct wl12xx *wl);
+        void (*op_set_ecpu_ctrl)(struct wl12xx *wl, u32 flag);
+        void (*op_target_enable_interrupts)(struct wl12xx *wl);
+        int (*op_hw_init)(struct wl12xx *wl);
+        int (*op_plt_init)(struct wl12xx *wl);
+
+        struct wl12xx_partition_set *p_table;
+        enum wl12xx_acx_int_reg *acx_reg_table;
+};
+
+struct wl12xx_stats {
+        struct acx_statistics *fw_stats;
+        unsigned long fw_stats_update;
+
+        unsigned int retry_count;
+        unsigned int excessive_retries;
+};
+
+struct wl12xx_debugfs {
+        struct dentry *rootdir;
+        struct dentry *fw_statistics;
+
+        struct dentry *tx_internal_desc_overflow;
+
+        struct dentry *rx_out_of_mem;
+        struct dentry *rx_hdr_overflow;
+        struct dentry *rx_hw_stuck;
+        struct dentry *rx_dropped;
+        struct dentry *rx_fcs_err;
+        struct dentry *rx_xfr_hint_trig;
+        struct dentry *rx_path_reset;
+        struct dentry *rx_reset_counter;
+
+        struct dentry *dma_rx_requested;
+        struct dentry *dma_rx_errors;
+        struct dentry *dma_tx_requested;
+        struct dentry *dma_tx_errors;
+
+        struct dentry *isr_cmd_cmplt;
+        struct dentry *isr_fiqs;
+        struct dentry *isr_rx_headers;
+        struct dentry *isr_rx_mem_overflow;
+        struct dentry *isr_rx_rdys;
+        struct dentry *isr_irqs;
+        struct dentry *isr_tx_procs;
+        struct dentry *isr_decrypt_done;
+        struct dentry *isr_dma0_done;
+        struct dentry *isr_dma1_done;
+        struct dentry *isr_tx_exch_complete;
+        struct dentry *isr_commands;
+        struct dentry *isr_rx_procs;
+        struct dentry *isr_hw_pm_mode_changes;
+        struct dentry *isr_host_acknowledges;
+        struct dentry *isr_pci_pm;
+        struct dentry *isr_wakeups;
+        struct dentry *isr_low_rssi;
+
+        struct dentry *wep_addr_key_count;
+        struct dentry *wep_default_key_count;
+        /* skipping wep.reserved */
+        struct dentry *wep_key_not_found;
+        struct dentry *wep_decrypt_fail;
+        struct dentry *wep_packets;
+        struct dentry *wep_interrupt;
+
+        struct dentry *pwr_ps_enter;
+        struct dentry *pwr_elp_enter;
+        struct dentry *pwr_missing_bcns;
+        struct dentry *pwr_wake_on_host;
+        struct dentry *pwr_wake_on_timer_exp;
+        struct dentry *pwr_tx_with_ps;
+        struct dentry *pwr_tx_without_ps;
+        struct dentry *pwr_rcvd_beacons;
+        struct dentry *pwr_power_save_off;
+        struct dentry *pwr_enable_ps;
+        struct dentry *pwr_disable_ps;
+        struct dentry *pwr_fix_tsf_ps;
+        /* skipping cont_miss_bcns_spread for now */
+        struct dentry *pwr_rcvd_awake_beacons;
+
+        struct dentry *mic_rx_pkts;
+        struct dentry *mic_calc_failure;
+
+        struct dentry *aes_encrypt_fail;
+        struct dentry *aes_decrypt_fail;
+        struct dentry *aes_encrypt_packets;
+        struct dentry *aes_decrypt_packets;
+        struct dentry *aes_encrypt_interrupt;
+        struct dentry *aes_decrypt_interrupt;
+
+        struct dentry *event_heart_beat;
+        struct dentry *event_calibration;
+        struct dentry *event_rx_mismatch;
+        struct dentry *event_rx_mem_empty;
+        struct dentry *event_rx_pool;
+        struct dentry *event_oom_late;
+        struct dentry *event_phy_transmit_error;
+        struct dentry *event_tx_stuck;
+
+        struct dentry *ps_pspoll_timeouts;
+        struct dentry *ps_upsd_timeouts;
+        struct dentry *ps_upsd_max_sptime;
+        struct dentry *ps_upsd_max_apturn;
+        struct dentry *ps_pspoll_max_apturn;
+        struct dentry *ps_pspoll_utilization;
+        struct dentry *ps_upsd_utilization;
+
+        struct dentry *rxpipe_rx_prep_beacon_drop;
+        struct dentry *rxpipe_descr_host_int_trig_rx_data;
+        struct dentry *rxpipe_beacon_buffer_thres_host_int_trig_rx_data;
+        struct dentry *rxpipe_missed_beacon_host_int_trig_rx_data;
+        struct dentry *rxpipe_tx_xfr_host_int_trig_rx_data;
+
+        struct dentry *tx_queue_len;
+
+        struct dentry *retry_count;
+        struct dentry *excessive_retries;
+};
+
+struct wl12xx {
+        struct ieee80211_hw *hw;
+        bool mac80211_registered;
+
+        struct spi_device *spi;
+
+        void (*set_power)(bool enable);
+        int irq;
+
+        enum wl12xx_state state;
+        struct mutex mutex;
+
+        int physical_mem_addr;
+        int physical_reg_addr;
+        int virtual_mem_addr;
+        int virtual_reg_addr;
+
+        struct wl12xx_chip chip;
+
+        int cmd_box_addr;
+        int event_box_addr;
+        struct boot_attr boot_attr;
+
+        u8 *fw;
+        size_t fw_len;
+        u8 *nvs;
+        size_t nvs_len;
+
+        u8 bssid[ETH_ALEN];
+        u8 mac_addr[ETH_ALEN];
+        u8 bss_type;
+        u8 listen_int;
+        int channel;
+
+        void *target_mem_map;
+        struct acx_data_path_params_resp *data_path;
+
+        /* Number of TX packets transferred to the FW, modulo 16 */
+        u32 data_in_count;
+
+        /* Frames scheduled for transmission, not handled yet */
+        struct sk_buff_head tx_queue;
+        bool tx_queue_stopped;
+
+        struct work_struct tx_work;
+        struct work_struct filter_work;
+
+        /* Pending TX frames */
+        struct sk_buff *tx_frames[16];
+
+        /*
+         * Index pointing to the next TX complete entry
+         * in the cyclic XT complete array we get from
+         * the FW.
+         */
+        u32 next_tx_complete;
+
+        /* FW Rx counter */
+        u32 rx_counter;
+
+        /* Rx frames handled */
+        u32 rx_handled;
+
+        /* Current double buffer */
+        u32 rx_current_buffer;
+        u32 rx_last_id;
+
+        /* The target interrupt mask */
+        u32 intr_mask;
+        struct work_struct irq_work;
+
+        /* The mbox event mask */
+        u32 event_mask;
+
+        /* Mailbox pointers */
+        u32 mbox_ptr[2];
+
+        /* Are we currently scanning */
+        bool scanning;
+
+        /* Our association ID */
+        u16 aid;
+
+        /* Default key (for WEP) */
+        u32 default_key;
+
+        unsigned int tx_mgmt_frm_rate;
+        unsigned int tx_mgmt_frm_mod;
+
+        unsigned int rx_config;
+        unsigned int rx_filter;
+
+        /* is firmware in elp mode */
+        bool elp;
+
+        /* we can be in psm, but not in elp, we have to differentiate */
+        bool psm;
+
+        /* PSM mode requested */
+        bool psm_requested;
+
+        /* in dBm */
+        int power_level;
+
+        struct wl12xx_stats stats;
+        struct wl12xx_debugfs debugfs;
+};
+
+int wl12xx_plt_start(struct wl12xx *wl);
+int wl12xx_plt_stop(struct wl12xx *wl);
+
+#define DEFAULT_HW_GEN_MODULATION_TYPE    CCK_LONG /* Long Preamble */
+#define DEFAULT_HW_GEN_TX_RATE          RATE_2MBPS
+#define JOIN_TIMEOUT 5000 /* 5000 milliseconds to join */
+
+#define WL12XX_DEFAULT_POWER_LEVEL 20
+
+#define WL12XX_TX_QUEUE_MAX_LENGTH 20
+
+/* Different chips need different sleep times after power on.  WL1271 needs
+ * 200ms, WL1251 needs only 10ms.  By default we use 200ms, but as soon as we
+ * know the chip ID, we change the sleep value in the wl12xx chip structure,
+ * so in subsequent power ons, we don't waste more time then needed.  */
+#define WL12XX_DEFAULT_POWER_ON_SLEEP 200
+
+#define CHIP_ID_1251_PG10                  (0x7010101)
+#define CHIP_ID_1251_PG11                  (0x7020101)
+#define CHIP_ID_1251_PG12                  (0x7030101)
+#define CHIP_ID_1271_PG10                  (0x4030101)
+
+#endif
diff --git a/drivers/net/wireless/wl12xx/wl12xx_80211.h b/drivers/net/wireless/wl12xx/wl12xx_80211.h
new file mode 100644
index 000000000000..657c2dbcb7d3
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/wl12xx_80211.h
@@ -0,0 +1,156 @@
+#ifndef __WL12XX_80211_H__
+#define __WL12XX_80211_H__
+
+#include <linux/if_ether.h>     /* ETH_ALEN */
+
+/* RATES */
+#define IEEE80211_CCK_RATE_1MB                  0x02
+#define IEEE80211_CCK_RATE_2MB                  0x04
+#define IEEE80211_CCK_RATE_5MB                  0x0B
+#define IEEE80211_CCK_RATE_11MB                 0x16
+#define IEEE80211_OFDM_RATE_6MB                 0x0C
+#define IEEE80211_OFDM_RATE_9MB                 0x12
+#define IEEE80211_OFDM_RATE_12MB                0x18
+#define IEEE80211_OFDM_RATE_18MB                0x24
+#define IEEE80211_OFDM_RATE_24MB                0x30
+#define IEEE80211_OFDM_RATE_36MB                0x48
+#define IEEE80211_OFDM_RATE_48MB                0x60
+#define IEEE80211_OFDM_RATE_54MB                0x6C
+#define IEEE80211_BASIC_RATE_MASK               0x80
+
+#define IEEE80211_CCK_RATE_1MB_MASK             (1<<0)
+#define IEEE80211_CCK_RATE_2MB_MASK             (1<<1)
+#define IEEE80211_CCK_RATE_5MB_MASK             (1<<2)
+#define IEEE80211_CCK_RATE_11MB_MASK            (1<<3)
+#define IEEE80211_OFDM_RATE_6MB_MASK            (1<<4)
+#define IEEE80211_OFDM_RATE_9MB_MASK            (1<<5)
+#define IEEE80211_OFDM_RATE_12MB_MASK           (1<<6)
+#define IEEE80211_OFDM_RATE_18MB_MASK           (1<<7)
+#define IEEE80211_OFDM_RATE_24MB_MASK           (1<<8)
+#define IEEE80211_OFDM_RATE_36MB_MASK           (1<<9)
+#define IEEE80211_OFDM_RATE_48MB_MASK           (1<<10)
+#define IEEE80211_OFDM_RATE_54MB_MASK           (1<<11)
+
+#define IEEE80211_CCK_RATES_MASK          0x0000000F
+#define IEEE80211_CCK_BASIC_RATES_MASK   (IEEE80211_CCK_RATE_1MB_MASK | \
+        IEEE80211_CCK_RATE_2MB_MASK)
+#define IEEE80211_CCK_DEFAULT_RATES_MASK (IEEE80211_CCK_BASIC_RATES_MASK | \
+        IEEE80211_CCK_RATE_5MB_MASK | \
+        IEEE80211_CCK_RATE_11MB_MASK)
+
+#define IEEE80211_OFDM_RATES_MASK         0x00000FF0
+#define IEEE80211_OFDM_BASIC_RATES_MASK   (IEEE80211_OFDM_RATE_6MB_MASK | \
+        IEEE80211_OFDM_RATE_12MB_MASK | \
+        IEEE80211_OFDM_RATE_24MB_MASK)
+#define IEEE80211_OFDM_DEFAULT_RATES_MASK (IEEE80211_OFDM_BASIC_RATES_MASK | \
+        IEEE80211_OFDM_RATE_9MB_MASK  | \
+        IEEE80211_OFDM_RATE_18MB_MASK | \
+        IEEE80211_OFDM_RATE_36MB_MASK | \
+        IEEE80211_OFDM_RATE_48MB_MASK | \
+        IEEE80211_OFDM_RATE_54MB_MASK)
+#define IEEE80211_DEFAULT_RATES_MASK (IEEE80211_OFDM_DEFAULT_RATES_MASK | \
+                                      IEEE80211_CCK_DEFAULT_RATES_MASK)
+
+
+/* This really should be 8, but not for our firmware */
+#define MAX_SUPPORTED_RATES 32
+#define COUNTRY_STRING_LEN 3
+#define MAX_COUNTRY_TRIPLETS 32
+
+/* Headers */
+struct ieee80211_header {
+        __le16 frame_ctl;
+        __le16 duration_id;
+        u8 da[ETH_ALEN];
+        u8 sa[ETH_ALEN];
+        u8 bssid[ETH_ALEN];
+        __le16 seq_ctl;
+        u8 payload[0];
+} __attribute__ ((packed));
+
+struct wl12xx_ie_header {
+        u8 id;
+        u8 len;
+} __attribute__ ((packed));
+
+/* IEs */
+
+struct wl12xx_ie_ssid {
+        struct wl12xx_ie_header header;
+        char ssid[IW_ESSID_MAX_SIZE];
+} __attribute__ ((packed));
+
+struct wl12xx_ie_rates {
+        struct wl12xx_ie_header header;
+        u8 rates[MAX_SUPPORTED_RATES];
+} __attribute__ ((packed));
+
+struct wl12xx_ie_ds_params {
+        struct wl12xx_ie_header header;
+        u8 channel;
+} __attribute__ ((packed));
+
+struct country_triplet {
+        u8 channel;
+        u8 num_channels;
+        u8 max_tx_power;
+} __attribute__ ((packed));
+
+struct wl12xx_ie_country {
+        struct wl12xx_ie_header header;
+        u8 country_string[COUNTRY_STRING_LEN];
+        struct country_triplet triplets[MAX_COUNTRY_TRIPLETS];
+} __attribute__ ((packed));
+
+
+/* Templates */
+
+struct wl12xx_beacon_template {
+        struct ieee80211_header header;
+        __le32 time_stamp[2];
+        __le16 beacon_interval;
+        __le16 capability;
+        struct wl12xx_ie_ssid ssid;
+        struct wl12xx_ie_rates rates;
+        struct wl12xx_ie_rates ext_rates;
+        struct wl12xx_ie_ds_params ds_params;
+        struct wl12xx_ie_country country;
+} __attribute__ ((packed));
+
+struct wl12xx_null_data_template {
+        struct ieee80211_header header;
+} __attribute__ ((packed));
+
+struct wl12xx_ps_poll_template {
+        u16 fc;
+        u16 aid;
+        u8 bssid[ETH_ALEN];
+        u8 ta[ETH_ALEN];
+} __attribute__ ((packed));
+
+struct wl12xx_qos_null_data_template {
+        struct ieee80211_header header;
+        __le16 qos_ctl;
+} __attribute__ ((packed));
+
+struct wl12xx_probe_req_template {
+        struct ieee80211_header header;
+        struct wl12xx_ie_ssid ssid;
+        struct wl12xx_ie_rates rates;
+        struct wl12xx_ie_rates ext_rates;
+} __attribute__ ((packed));
+
+
+struct wl12xx_probe_resp_template {
+        struct ieee80211_header header;
+        __le32 time_stamp[2];
+        __le16 beacon_interval;
+        __le16 capability;
+        struct wl12xx_ie_ssid ssid;
+        struct wl12xx_ie_rates rates;
+        struct wl12xx_ie_rates ext_rates;
+        struct wl12xx_ie_ds_params ds_params;
+        struct wl12xx_ie_country country;
+} __attribute__ ((packed));
+
+#endif
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.c b/drivers/net/wireless/zd1211rw/zd_mac.c
index c3a51266de20..6bdb1704083b 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.c
+++ b/drivers/net/wireless/zd1211rw/zd_mac.c
@@ -755,52 +755,6 @@ static int zd_op_config(struct ieee80211_hw *hw, u32 changed)
         return zd_chip_set_channel(&mac->chip, conf->channel->hw_value);
 }
 
-static int zd_op_config_interface(struct ieee80211_hw *hw,
-                                  struct ieee80211_vif *vif,
-                                   struct ieee80211_if_conf *conf)
-{
-        struct zd_mac *mac = zd_hw_mac(hw);
-        int associated;
-        int r;
-
-        if (mac->type == NL80211_IFTYPE_MESH_POINT ||
-            mac->type == NL80211_IFTYPE_ADHOC) {
-                associated = true;
-                if (conf->changed & IEEE80211_IFCC_BEACON) {
-                        struct sk_buff *beacon = ieee80211_beacon_get(hw, vif);
-
-                        if (!beacon)
-                                return -ENOMEM;
-                        r = zd_mac_config_beacon(hw, beacon);
-                        kfree_skb(beacon);
-
-                        if (r < 0)
-                                return r;
-                }
-
-                if (conf->changed & IEEE80211_IFCC_BEACON_ENABLED) {
-                        u32 interval;
-
-                        if (conf->enable_beacon)
-                                interval = BCN_MODE_IBSS | hw->conf.beacon_int;
-                        else
-                                interval = 0;
-
-                        r = zd_set_beacon_interval(&mac->chip, interval);
-                        if (r < 0)
-                                return r;
-                }
-        } else
-                associated = is_valid_ether_addr(conf->bssid);
-
-        spin_lock_irq(&mac->lock);
-        mac->associated = associated;
-        spin_unlock_irq(&mac->lock);
-
-        /* TODO: do hardware bssid filtering */
-        return 0;
-}
-
 static void zd_process_intr(struct work_struct *work)
 {
         u16 int_status;
@@ -923,9 +877,42 @@ static void zd_op_bss_info_changed(struct ieee80211_hw *hw,
 {
         struct zd_mac *mac = zd_hw_mac(hw);
         unsigned long flags;
+        int associated;
 
         dev_dbg_f(zd_mac_dev(mac), "changes: %x\n", changes);
 
+        if (mac->type == NL80211_IFTYPE_MESH_POINT ||
+            mac->type == NL80211_IFTYPE_ADHOC) {
+                associated = true;
+                if (changes & BSS_CHANGED_BEACON) {
+                        struct sk_buff *beacon = ieee80211_beacon_get(hw, vif);
+
+                        if (beacon) {
+                                zd_mac_config_beacon(hw, beacon);
+                                kfree_skb(beacon);
+                        }
+                }
+
+                if (changes & BSS_CHANGED_BEACON_ENABLED) {
+                        u32 interval;
+
+                        if (bss_conf->enable_beacon)
+                                interval = BCN_MODE_IBSS |
+                                                bss_conf->beacon_int;
+                        else
+                                interval = 0;
+
+                        zd_set_beacon_interval(&mac->chip, interval);
+                }
+        } else
+                associated = is_valid_ether_addr(bss_conf->bssid);
+
+        spin_lock_irq(&mac->lock);
+        mac->associated = associated;
+        spin_unlock_irq(&mac->lock);
+
+        /* TODO: do hardware bssid filtering */
+
         if (changes & BSS_CHANGED_ERP_PREAMBLE) {
                 spin_lock_irqsave(&mac->lock, flags);
                 mac->short_preamble = bss_conf->use_short_preamble;
@@ -952,7 +939,6 @@ static const struct ieee80211_ops zd_ops = {
         .add_interface          = zd_op_add_interface,
         .remove_interface       = zd_op_remove_interface,
         .config                 = zd_op_config,
-        .config_interface       = zd_op_config_interface,
         .configure_filter       = zd_op_configure_filter,
         .bss_info_changed       = zd_op_bss_info_changed,
         .get_tsf                = zd_op_get_tsf,
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index c52e7fba4e40..dc92359f37e6 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -543,7 +543,7 @@ struct ieee80211_tim_ie {
         u8 virtual_map[1];
 } __attribute__ ((packed));
 
-#define WLAN_SA_QUERY_TR_ID_LEN 16
+#define WLAN_SA_QUERY_TR_ID_LEN 2
 
 struct ieee80211_mgmt {
         __le16 frame_control;
diff --git a/include/linux/spi/wl12xx.h b/include/linux/spi/wl12xx.h
new file mode 100644
index 000000000000..11430cab2aad
--- /dev/null
+++ b/include/linux/spi/wl12xx.h
@@ -0,0 +1,31 @@
+/*
+ * This file is part of wl12xx
+ *
+ * Copyright (C) 2009 Nokia Corporation
+ *
+ * Contact: Kalle Valo <kalle.valo@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef _LINUX_SPI_WL12XX_H
+#define _LINUX_SPI_WL12XX_H
+
+struct wl12xx_platform_data {
+        void (*set_power)(bool enable);
+};
+
+#endif
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 446dbf75a1c5..38dc1cd10270 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -149,6 +149,13 @@ struct ieee80211_low_level_stats {
  * @BSS_CHANGED_ERP_SLOT: slot timing changed
  * @BSS_CHANGED_HT: 802.11n parameters changed
  * @BSS_CHANGED_BASIC_RATES: Basic rateset changed
+ * @BSS_CHANGED_BEACON_INT: Beacon interval changed
+ * @BSS_CHANGED_BSSID: BSSID changed, for whatever
+ *      reason (IBSS and managed mode)
+ * @BSS_CHANGED_BEACON: Beacon data changed, retrieve
+ *      new beacon (beaconing modes)
+ * @BSS_CHANGED_BEACON_ENABLED: Beaconing should be
+ *      enabled/disabled (beaconing modes)
  */
 enum ieee80211_bss_change {
         BSS_CHANGED_ASSOC               = 1<<0,
@@ -157,6 +164,10 @@ enum ieee80211_bss_change {
         BSS_CHANGED_ERP_SLOT            = 1<<3,
         BSS_CHANGED_HT                  = 1<<4,
         BSS_CHANGED_BASIC_RATES         = 1<<5,
+        BSS_CHANGED_BEACON_INT          = 1<<6,
+        BSS_CHANGED_BSSID               = 1<<7,
+        BSS_CHANGED_BEACON              = 1<<8,
+        BSS_CHANGED_BEACON_ENABLED      = 1<<9,
 };
 
 /**
@@ -190,8 +201,11 @@ struct ieee80211_bss_ht_conf {
  * @basic_rates: bitmap of basic rates, each bit stands for an
  *      index into the rate table configured by the driver in
  *      the current band.
+ * @bssid: The BSSID for this BSS
+ * @enable_beacon: whether beaconing should be enabled or not
  */
 struct ieee80211_bss_conf {
+        const u8 *bssid;
         /* association related data */
         bool assoc;
         u16 aid;
@@ -199,6 +213,7 @@ struct ieee80211_bss_conf {
         bool use_cts_prot;
         bool use_short_preamble;
         bool use_short_slot;
+        bool enable_beacon;
         u8 dtim_period;
         u16 beacon_int;
         u16 assoc_capability;
@@ -518,10 +533,16 @@ struct ieee80211_rx_status {
  *
  * @IEEE80211_CONF_RADIOTAP: add radiotap header at receive time (if supported)
  * @IEEE80211_CONF_PS: Enable 802.11 power save mode (managed mode only)
+ * @IEEE80211_CONF_IDLE: The device is running, but idle; if the flag is set
+ *      the driver should be prepared to handle configuration requests but
+ *      may turn the device off as much as possible. Typically, this flag will
+ *      be set when an interface is set UP but not associated or scanning, but
+ *      it can also be unset in that case when monitor interfaces are active.
  */
 enum ieee80211_conf_flags {
         IEEE80211_CONF_RADIOTAP         = (1<<0),
         IEEE80211_CONF_PS               = (1<<1),
+        IEEE80211_CONF_IDLE             = (1<<2),
 };
 
 
@@ -529,25 +550,35 @@ enum ieee80211_conf_flags {
  * enum ieee80211_conf_changed - denotes which configuration changed
  *
  * @IEEE80211_CONF_CHANGE_RADIO_ENABLED: the value of radio_enabled changed
- * @IEEE80211_CONF_CHANGE_BEACON_INTERVAL: the beacon interval changed
+ * @_IEEE80211_CONF_CHANGE_BEACON_INTERVAL: DEPRECATED
  * @IEEE80211_CONF_CHANGE_LISTEN_INTERVAL: the listen interval changed
  * @IEEE80211_CONF_CHANGE_RADIOTAP: the radiotap flag changed
  * @IEEE80211_CONF_CHANGE_PS: the PS flag or dynamic PS timeout changed
  * @IEEE80211_CONF_CHANGE_POWER: the TX power changed
  * @IEEE80211_CONF_CHANGE_CHANNEL: the channel/channel_type changed
  * @IEEE80211_CONF_CHANGE_RETRY_LIMITS: retry limits changed
+ * @IEEE80211_CONF_CHANGE_IDLE: Idle flag changed
  */
 enum ieee80211_conf_changed {
         IEEE80211_CONF_CHANGE_RADIO_ENABLED     = BIT(0),
-        IEEE80211_CONF_CHANGE_BEACON_INTERVAL   = BIT(1),
+        _IEEE80211_CONF_CHANGE_BEACON_INTERVAL  = BIT(1),
         IEEE80211_CONF_CHANGE_LISTEN_INTERVAL   = BIT(2),
         IEEE80211_CONF_CHANGE_RADIOTAP          = BIT(3),
         IEEE80211_CONF_CHANGE_PS                = BIT(4),
         IEEE80211_CONF_CHANGE_POWER             = BIT(5),
         IEEE80211_CONF_CHANGE_CHANNEL           = BIT(6),
         IEEE80211_CONF_CHANGE_RETRY_LIMITS      = BIT(7),
+        IEEE80211_CONF_CHANGE_IDLE              = BIT(8),
 };
 
+static inline __deprecated enum ieee80211_conf_changed
+__IEEE80211_CONF_CHANGE_BEACON_INTERVAL(void)
+{
+        return _IEEE80211_CONF_CHANGE_BEACON_INTERVAL;
+}
+#define IEEE80211_CONF_CHANGE_BEACON_INTERVAL \
+        __IEEE80211_CONF_CHANGE_BEACON_INTERVAL()
+
 /**
  * struct ieee80211_conf - configuration of the device
  *
@@ -559,7 +590,7 @@ enum ieee80211_conf_changed {
  * @beacon_int: beacon interval (TODO make interface config)
  *
  * @listen_interval: listen interval in units of beacon interval
- * @max_sleep_interval: the maximum number of beacon intervals to sleep for
+ * @max_sleep_period: the maximum number of beacon intervals to sleep for
  *      before checking the beacon for a TIM bit (managed mode only); this
  *      value will be only achievable between DTIM frames, the hardware
  *      needs to check for the multicast traffic bit in DTIM beacons.
@@ -584,7 +615,7 @@ struct ieee80211_conf {
         int beacon_int;
         u32 flags;
         int power_level, dynamic_ps_timeout;
-        int max_sleep_interval;
+        int max_sleep_period;
 
         u16 listen_interval;
         bool radio_enabled;
@@ -650,37 +681,6 @@ struct ieee80211_if_init_conf {
 };
 
 /**
- * enum ieee80211_if_conf_change - interface config change flags
- *
- * @IEEE80211_IFCC_BSSID: The BSSID changed.
- * @IEEE80211_IFCC_BEACON: The beacon for this interface changed
- *      (currently AP and MESH only), use ieee80211_beacon_get().
- * @IEEE80211_IFCC_BEACON_ENABLED: The enable_beacon value changed.
- */
-enum ieee80211_if_conf_change {
-        IEEE80211_IFCC_BSSID            = BIT(0),
-        IEEE80211_IFCC_BEACON           = BIT(1),
-        IEEE80211_IFCC_BEACON_ENABLED   = BIT(2),
-};
-
-/**
- * struct ieee80211_if_conf - configuration of an interface
- *
- * @changed: parameters that have changed, see &enum ieee80211_if_conf_change.
- * @bssid: BSSID of the network we are associated to/creating.
- * @enable_beacon: Indicates whether beacons can be sent.
- *      This is valid only for AP/IBSS/MESH modes.
- *
- * This structure is passed to the config_interface() callback of
- * &struct ieee80211_hw.
- */
-struct ieee80211_if_conf {
-        u32 changed;
-        const u8 *bssid;
-        bool enable_beacon;
-};
-
-/**
  * enum ieee80211_key_alg - key algorithm
  * @ALG_WEP: WEP40 or WEP104
  * @ALG_TKIP: TKIP
@@ -1348,10 +1348,6 @@ enum ieee80211_ampdu_mlme_action {
  *      This function should never fail but returns a negative error code
  *      if it does.
  *
- * @config_interface: Handler for configuration requests related to interfaces
- *      (e.g. BSSID changes.)
- *      Returns a negative error code which will be seen in userspace.
- *
  * @bss_info_changed: Handler for configuration requests related to BSS
  *      parameters that may vary during BSS's lifespan, and may affect low
  *      level driver (e.g. assoc/disassoc status, erp parameters).
@@ -1453,9 +1449,6 @@ struct ieee80211_ops {
         void (*remove_interface)(struct ieee80211_hw *hw,
                                  struct ieee80211_if_init_conf *conf);
         int (*config)(struct ieee80211_hw *hw, u32 changed);
-        int (*config_interface)(struct ieee80211_hw *hw,
-                                struct ieee80211_vif *vif,
-                                struct ieee80211_if_conf *conf);
         void (*bss_info_changed)(struct ieee80211_hw *hw,
                                  struct ieee80211_vif *vif,
                                  struct ieee80211_bss_conf *info,
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 07656d830bc4..bc064d7933ff 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -16,12 +16,12 @@
 #include <linux/ieee80211.h>
 #include <net/mac80211.h>
 #include "ieee80211_i.h"
+#include "driver-ops.h"
 
 void __ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
                                     u16 initiator, u16 reason)
 {
         struct ieee80211_local *local = sta->local;
-        struct ieee80211_hw *hw = &local->hw;
         int i;
 
         /* check if TID is in operational state */
@@ -41,8 +41,8 @@ void __ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
                sta->sta.addr, tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
 
-        if (local->ops->ampdu_action(hw, IEEE80211_AMPDU_RX_STOP,
-                                     &sta->sta, tid, NULL))
+        if (drv_ampdu_action(local, IEEE80211_AMPDU_RX_STOP,
+                             &sta->sta, tid, NULL))
                 printk(KERN_DEBUG "HW problem - can not stop rx "
                                 "aggregation for tid %d\n", tid);
 
@@ -68,6 +68,7 @@ void __ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
         spin_lock_bh(&sta->lock);
         /* free resources */
         kfree(sta->ampdu_mlme.tid_rx[tid]->reorder_buf);
+        kfree(sta->ampdu_mlme.tid_rx[tid]->reorder_time);
 
         if (!sta->ampdu_mlme.tid_rx[tid]->shutdown) {
                 kfree(sta->ampdu_mlme.tid_rx[tid]);
@@ -268,19 +269,23 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
         /* prepare reordering buffer */
         tid_agg_rx->reorder_buf =
                 kcalloc(buf_size, sizeof(struct sk_buff *), GFP_ATOMIC);
-        if (!tid_agg_rx->reorder_buf) {
+        tid_agg_rx->reorder_time =
+                kcalloc(buf_size, sizeof(unsigned long), GFP_ATOMIC);
+        if (!tid_agg_rx->reorder_buf || !tid_agg_rx->reorder_time) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 if (net_ratelimit())
                         printk(KERN_ERR "can not allocate reordering buffer "
                                "to tid %d\n", tid);
 #endif
+                kfree(tid_agg_rx->reorder_buf);
+                kfree(tid_agg_rx->reorder_time);
                 kfree(sta->ampdu_mlme.tid_rx[tid]);
+                sta->ampdu_mlme.tid_rx[tid] = NULL;
                 goto end;
         }
 
-        if (local->ops->ampdu_action)
-                ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_RX_START,
-                                               &sta->sta, tid, &start_seq_num);
+        ret = drv_ampdu_action(local, IEEE80211_AMPDU_RX_START,
+                               &sta->sta, tid, &start_seq_num);
 #ifdef CONFIG_MAC80211_HT_DEBUG
         printk(KERN_DEBUG "Rx A-MPDU request on tid %d result %d\n", tid, ret);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 947aaaad35d2..43d00ffd3988 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -16,6 +16,7 @@
 #include <linux/ieee80211.h>
 #include <net/mac80211.h>
 #include "ieee80211_i.h"
+#include "driver-ops.h"
 #include "wme.h"
 
 /**
@@ -134,8 +135,8 @@ static int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
         *state = HT_AGG_STATE_REQ_STOP_BA_MSK |
                 (initiator << HT_AGG_STATE_INITIATOR_SHIFT);
 
-        ret = local->ops->ampdu_action(&local->hw, IEEE80211_AMPDU_TX_STOP,
-                                       &sta->sta, tid, NULL);
+        ret = drv_ampdu_action(local, IEEE80211_AMPDU_TX_STOP,
+                               &sta->sta, tid, NULL);
 
         /* HW shall not deny going back to legacy */
         if (WARN_ON(ret)) {
@@ -306,8 +307,8 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
 
         start_seq_num = sta->tid_seq[tid];
 
-        ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_TX_START,
-                                       &sta->sta, tid, &start_seq_num);
+        ret = drv_ampdu_action(local, IEEE80211_AMPDU_TX_START,
+                               &sta->sta, tid, &start_seq_num);
 
         if (ret) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
@@ -418,8 +419,8 @@ static void ieee80211_agg_tx_operational(struct ieee80211_local *local,
         ieee80211_agg_splice_finish(local, sta, tid);
         spin_unlock(&local->ampdu_lock);
 
-        local->ops->ampdu_action(&local->hw, IEEE80211_AMPDU_TX_OPERATIONAL,
-                                 &sta->sta, tid, NULL);
+        drv_ampdu_action(local, IEEE80211_AMPDU_TX_OPERATIONAL,
+                         &sta->sta, tid, NULL);
 }
 
 void ieee80211_start_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u16 tid)
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 5e1c230744b5..d0ca6da33ca9 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -13,6 +13,7 @@
 #include <linux/rcupdate.h>
 #include <net/cfg80211.h>
 #include "ieee80211_i.h"
+#include "driver-ops.h"
 #include "cfg.h"
 #include "rate.h"
 #include "mesh.h"
@@ -245,12 +246,10 @@ static int ieee80211_get_key(struct wiphy *wiphy, struct net_device *dev,
                 iv32 = key->u.tkip.tx.iv32;
                 iv16 = key->u.tkip.tx.iv16;
 
-                if (key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE &&
-                    sdata->local->ops->get_tkip_seq)
-                        sdata->local->ops->get_tkip_seq(
-                                local_to_hw(sdata->local),
-                                key->conf.hw_key_idx,
-                                &iv32, &iv16);
+                if (key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)
+                        drv_get_tkip_seq(sdata->local,
+                                         key->conf.hw_key_idx,
+                                         &iv32, &iv16);
 
                 seq[0] = iv16 & 0xff;
                 seq[1] = (iv16 >> 8) & 0xff;
@@ -451,18 +450,11 @@ static int ieee80211_config_beacon(struct ieee80211_sub_if_data *sdata,
          * This is a kludge. beacon interval should really be part
          * of the beacon information.
          */
-        if (params->interval && (sdata->local->hw.conf.beacon_int !=
-                                 params->interval)) {
-                sdata->local->hw.conf.beacon_int = params->interval;
-                err = ieee80211_hw_config(sdata->local,
-                                        IEEE80211_CONF_CHANGE_BEACON_INTERVAL);
-                if (err < 0)
-                        return err;
-                /*
-                 * We updated some parameter so if below bails out
-                 * it's not an error.
-                 */
-                err = 0;
+        if (params->interval &&
+            (sdata->vif.bss_conf.beacon_int != params->interval)) {
+                sdata->vif.bss_conf.beacon_int = params->interval;
+                ieee80211_bss_info_change_notify(sdata,
+                                                 BSS_CHANGED_BEACON_INT);
         }
 
         /* Need to have a beacon head if we don't have one yet */
@@ -528,8 +520,9 @@ static int ieee80211_config_beacon(struct ieee80211_sub_if_data *sdata,
 
         kfree(old);
 
-        return ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON |
-                                          IEEE80211_IFCC_BEACON_ENABLED);
+        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED |
+                                                BSS_CHANGED_BEACON);
+        return 0;
 }
 
 static int ieee80211_add_beacon(struct wiphy *wiphy, struct net_device *dev,
@@ -580,7 +573,8 @@ static int ieee80211_del_beacon(struct wiphy *wiphy, struct net_device *dev)
         synchronize_rcu();
         kfree(old);
 
-        return ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON_ENABLED);
+        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED);
+        return 0;
 }
 
 /* Layer 2 Update frame (802.2 Type 1 LLC XID Update response) */
@@ -1120,7 +1114,7 @@ static int ieee80211_set_txq_params(struct wiphy *wiphy,
         p.cw_max = params->cwmax;
         p.cw_min = params->cwmin;
         p.txop = params->txop;
-        if (local->ops->conf_tx(local_to_hw(local), params->queue, &p)) {
+        if (drv_conf_tx(local, params->queue, &p)) {
                 printk(KERN_DEBUG "%s: failed to set TX queue "
                        "parameters for queue %d\n", local->mdev->name,
                        params->queue);
@@ -1301,16 +1295,13 @@ static int ieee80211_leave_ibss(struct wiphy *wiphy, struct net_device *dev)
 static int ieee80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
 {
         struct ieee80211_local *local = wiphy_priv(wiphy);
+        int err;
 
         if (changed & WIPHY_PARAM_RTS_THRESHOLD) {
-                int err;
+                err = drv_set_rts_threshold(local, wiphy->rts_threshold);
 
-                if (local->ops->set_rts_threshold) {
-                        err = local->ops->set_rts_threshold(
-                                local_to_hw(local), wiphy->rts_threshold);
-                        if (err)
-                                return err;
-                }
+                if (err)
+                        return err;
         }
 
         if (changed & WIPHY_PARAM_RETRY_SHORT)
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index 5001328be46b..ac793201b701 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -10,6 +10,7 @@
 #include <linux/debugfs.h>
 #include <linux/rtnetlink.h>
 #include "ieee80211_i.h"
+#include "driver-ops.h"
 #include "rate.h"
 #include "debugfs.h"
 
@@ -70,11 +71,10 @@ static ssize_t tsf_read(struct file *file, char __user *user_buf,
                              size_t count, loff_t *ppos)
 {
         struct ieee80211_local *local = file->private_data;
-        u64 tsf = 0;
+        u64 tsf;
         char buf[100];
 
-        if (local->ops->get_tsf)
-                tsf = local->ops->get_tsf(local_to_hw(local));
+        tsf = drv_get_tsf(local);
 
         snprintf(buf, sizeof(buf), "0x%016llx\n", (unsigned long long) tsf);
 
@@ -97,13 +97,13 @@ static ssize_t tsf_write(struct file *file,
 
         if (strncmp(buf, "reset", 5) == 0) {
                 if (local->ops->reset_tsf) {
-                        local->ops->reset_tsf(local_to_hw(local));
+                        drv_reset_tsf(local);
                         printk(KERN_INFO "%s: debugfs reset TSF\n", wiphy_name(local->hw.wiphy));
                 }
         } else {
                 tsf = simple_strtoul(buf, NULL, 0);
                 if (local->ops->set_tsf) {
-                        local->ops->set_tsf(local_to_hw(local), tsf);
+                        drv_set_tsf(local, tsf);
                         printk(KERN_INFO "%s: debugfs set TSF to %#018llx\n", wiphy_name(local->hw.wiphy), tsf);
                 }
         }
@@ -150,14 +150,12 @@ static ssize_t format_devstat_counter(struct ieee80211_local *local,
         char buf[20];
         int res;
 
-        if (!local->ops->get_stats)
-                return -EOPNOTSUPP;
-
         rtnl_lock();
-        res = local->ops->get_stats(local_to_hw(local), &stats);
+        res = drv_get_stats(local, &stats);
         rtnl_unlock();
-        if (!res)
-                res = printvalue(&stats, buf, sizeof(buf));
+        if (res)
+                return res;
+        res = printvalue(&stats, buf, sizeof(buf));
         return simple_read_from_buffer(userbuf, count, ppos, buf, res);
 }
 
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
new file mode 100644
index 000000000000..3912b5334b9c
--- /dev/null
+++ b/net/mac80211/driver-ops.h
@@ -0,0 +1,184 @@
+#ifndef __MAC80211_DRIVER_OPS
+#define __MAC80211_DRIVER_OPS
+
+#include <net/mac80211.h>
+#include "ieee80211_i.h"
+
+static inline int drv_tx(struct ieee80211_local *local, struct sk_buff *skb)
+{
+        return local->ops->tx(&local->hw, skb);
+}
+
+static inline int drv_start(struct ieee80211_local *local)
+{
+        return local->ops->start(&local->hw);
+}
+
+static inline void drv_stop(struct ieee80211_local *local)
+{
+        local->ops->stop(&local->hw);
+}
+
+static inline int drv_add_interface(struct ieee80211_local *local,
+                                    struct ieee80211_if_init_conf *conf)
+{
+        return local->ops->add_interface(&local->hw, conf);
+}
+
+static inline void drv_remove_interface(struct ieee80211_local *local,
+                                        struct ieee80211_if_init_conf *conf)
+{
+        local->ops->remove_interface(&local->hw, conf);
+}
+
+static inline int drv_config(struct ieee80211_local *local, u32 changed)
+{
+        return local->ops->config(&local->hw, changed);
+}
+
+static inline void drv_bss_info_changed(struct ieee80211_local *local,
+                                        struct ieee80211_vif *vif,
+                                        struct ieee80211_bss_conf *info,
+                                        u32 changed)
+{
+        if (local->ops->bss_info_changed)
+                local->ops->bss_info_changed(&local->hw, vif, info, changed);
+}
+
+static inline void drv_configure_filter(struct ieee80211_local *local,
+                                        unsigned int changed_flags,
+                                        unsigned int *total_flags,
+                                        int mc_count,
+                                        struct dev_addr_list *mc_list)
+{
+        local->ops->configure_filter(&local->hw, changed_flags, total_flags,
+                                     mc_count, mc_list);
+}
+
+static inline int drv_set_tim(struct ieee80211_local *local,
+                              struct ieee80211_sta *sta, bool set)
+{
+        if (local->ops->set_tim)
+                return local->ops->set_tim(&local->hw, sta, set);
+        return 0;
+}
+
+static inline int drv_set_key(struct ieee80211_local *local,
+                              enum set_key_cmd cmd, struct ieee80211_vif *vif,
+                              struct ieee80211_sta *sta,
+                              struct ieee80211_key_conf *key)
+{
+        return local->ops->set_key(&local->hw, cmd, vif, sta, key);
+}
+
+static inline void drv_update_tkip_key(struct ieee80211_local *local,
+                                       struct ieee80211_key_conf *conf,
+                                       const u8 *address, u32 iv32,
+                                       u16 *phase1key)
+{
+        if (local->ops->update_tkip_key)
+                local->ops->update_tkip_key(&local->hw, conf, address,
+                                            iv32, phase1key);
+}
+
+static inline int drv_hw_scan(struct ieee80211_local *local,
+                              struct cfg80211_scan_request *req)
+{
+        return local->ops->hw_scan(&local->hw, req);
+}
+
+static inline void drv_sw_scan_start(struct ieee80211_local *local)
+{
+        if (local->ops->sw_scan_start)
+                local->ops->sw_scan_start(&local->hw);
+}
+
+static inline void drv_sw_scan_complete(struct ieee80211_local *local)
+{
+        if (local->ops->sw_scan_complete)
+                local->ops->sw_scan_complete(&local->hw);
+}
+
+static inline int drv_get_stats(struct ieee80211_local *local,
+                                struct ieee80211_low_level_stats *stats)
+{
+        if (!local->ops->get_stats)
+                return -EOPNOTSUPP;
+        return local->ops->get_stats(&local->hw, stats);
+}
+
+static inline void drv_get_tkip_seq(struct ieee80211_local *local,
+                                    u8 hw_key_idx, u32 *iv32, u16 *iv16)
+{
+        if (local->ops->get_tkip_seq)
+                local->ops->get_tkip_seq(&local->hw, hw_key_idx, iv32, iv16);
+}
+
+static inline int drv_set_rts_threshold(struct ieee80211_local *local,
+                                        u32 value)
+{
+        if (local->ops->set_rts_threshold)
+                return local->ops->set_rts_threshold(&local->hw, value);
+        return 0;
+}
+
+static inline void drv_sta_notify(struct ieee80211_local *local,
+                                  struct ieee80211_vif *vif,
+                                  enum sta_notify_cmd cmd,
+                                  struct ieee80211_sta *sta)
+{
+        if (local->ops->sta_notify)
+                local->ops->sta_notify(&local->hw, vif, cmd, sta);
+}
+
+static inline int drv_conf_tx(struct ieee80211_local *local, u16 queue,
+                              const struct ieee80211_tx_queue_params *params)
+{
+        if (local->ops->conf_tx)
+                return local->ops->conf_tx(&local->hw, queue, params);
+        return -EOPNOTSUPP;
+}
+
+static inline int drv_get_tx_stats(struct ieee80211_local *local,
+                                   struct ieee80211_tx_queue_stats *stats)
+{
+        return local->ops->get_tx_stats(&local->hw, stats);
+}
+
+static inline u64 drv_get_tsf(struct ieee80211_local *local)
+{
+        if (local->ops->get_tsf)
+                return local->ops->get_tsf(&local->hw);
+        return -1ULL;
+}
+
+static inline void drv_set_tsf(struct ieee80211_local *local, u64 tsf)
+{
+        if (local->ops->set_tsf)
+                local->ops->set_tsf(&local->hw, tsf);
+}
+
+static inline void drv_reset_tsf(struct ieee80211_local *local)
+{
+        if (local->ops->reset_tsf)
+                local->ops->reset_tsf(&local->hw);
+}
+
+static inline int drv_tx_last_beacon(struct ieee80211_local *local)
+{
+        if (local->ops->tx_last_beacon)
+                return local->ops->tx_last_beacon(&local->hw);
+        return 1;
+}
+
+static inline int drv_ampdu_action(struct ieee80211_local *local,
+                                   enum ieee80211_ampdu_mlme_action action,
+                                   struct ieee80211_sta *sta, u16 tid,
+                                   u16 *ssn)
+{
+        if (local->ops->ampdu_action)
+                return local->ops->ampdu_action(&local->hw, action,
+                                                sta, tid, ssn);
+        return -EOPNOTSUPP;
+}
+#endif /* __MAC80211_DRIVER_OPS */
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 6030e003180c..aa537681f87c 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -22,6 +22,7 @@
 #include <asm/unaligned.h>
 
 #include "ieee80211_i.h"
+#include "driver-ops.h"
 #include "rate.h"
 
 #define IEEE80211_SCAN_INTERVAL (2 * HZ)
@@ -73,11 +74,11 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_mgmt *mgmt;
         u8 *pos;
         struct ieee80211_supported_band *sband;
+        u32 bss_change;
 
-        if (local->ops->reset_tsf) {
-                /* Reset own TSF to allow time synchronization work. */
-                local->ops->reset_tsf(local_to_hw(local));
-        }
+
+        /* Reset own TSF to allow time synchronization work. */
+        drv_reset_tsf(local);
 
         skb = ifibss->skb;
         rcu_assign_pointer(ifibss->presp, NULL);
@@ -92,15 +93,12 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
 
         memcpy(ifibss->bssid, bssid, ETH_ALEN);
 
-        local->hw.conf.beacon_int = beacon_int >= 10 ? beacon_int : 10;
-
         sdata->drop_unencrypted = capability & WLAN_CAPABILITY_PRIVACY ? 1 : 0;
 
-        ieee80211_if_config(sdata, IEEE80211_IFCC_BSSID);
-
         local->oper_channel = chan;
         local->oper_channel_type = NL80211_CHAN_NO_HT;
         ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
+
         sband = local->hw.wiphy->bands[chan->band];
 
         /* Build IBSS probe response */
@@ -111,7 +109,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         memset(mgmt->da, 0xff, ETH_ALEN);
         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
         memcpy(mgmt->bssid, ifibss->bssid, ETH_ALEN);
-        mgmt->u.beacon.beacon_int = cpu_to_le16(local->hw.conf.beacon_int);
+        mgmt->u.beacon.beacon_int = cpu_to_le16(beacon_int);
         mgmt->u.beacon.timestamp = cpu_to_le64(tsf);
         mgmt->u.beacon.capab_info = cpu_to_le16(capability);
 
@@ -156,8 +154,13 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
 
         rcu_assign_pointer(ifibss->presp, skb);
 
-        ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON |
-                                   IEEE80211_IFCC_BEACON_ENABLED);
+        sdata->vif.bss_conf.beacon_int = beacon_int;
+        bss_change = BSS_CHANGED_BEACON_INT;
+        bss_change |= ieee80211_reset_erp_info(sdata);
+        bss_change |= BSS_CHANGED_BSSID;
+        bss_change |= BSS_CHANGED_BEACON;
+        bss_change |= BSS_CHANGED_BEACON_ENABLED;
+        ieee80211_bss_info_change_notify(sdata, bss_change);
 
         rates = 0;
         for (i = 0; i < supp_rates_len; i++) {
@@ -181,8 +184,13 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
 static void ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
                                     struct ieee80211_bss *bss)
 {
+        u16 beacon_int = bss->cbss.beacon_interval;
+
+        if (beacon_int < 10)
+                beacon_int = 10;
+
         __ieee80211_sta_join_ibss(sdata, bss->cbss.bssid,
-                                  bss->cbss.beacon_interval,
+                                  beacon_int,
                                   bss->cbss.channel,
                                   bss->supp_rates_len, bss->supp_rates,
                                   bss->cbss.capability,
@@ -307,12 +315,13 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                                 bitrates[rx_status->rate_idx].bitrate;
 
                 rx_timestamp = rx_status->mactime + (24 * 8 * 10 / rate);
-        } else if (local && local->ops && local->ops->get_tsf)
-                /* second best option: get current TSF */
-                rx_timestamp = local->ops->get_tsf(local_to_hw(local));
-        else
-                /* can't merge without knowing the TSF */
-                rx_timestamp = -1LLU;
+        } else {
+                /*
+                 * second best option: get current TSF
+                 * (will return -1 if not supported)
+                 */
+                rx_timestamp = drv_get_tsf(local);
+        }
 
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
         printk(KERN_DEBUG "RX beacon SA=%pM BSSID="
@@ -432,14 +441,7 @@ static void ieee80211_sta_merge_ibss(struct ieee80211_sub_if_data *sdata)
         printk(KERN_DEBUG "%s: No active IBSS STAs - trying to scan for other "
                "IBSS networks with same SSID (merge)\n", sdata->dev->name);
 
-        /* XXX maybe racy? */
-        if (sdata->local->scan_req)
-                return;
-
-        memcpy(sdata->local->int_scan_req.ssids[0].ssid,
-               ifibss->ssid, IEEE80211_MAX_SSID_LEN);
-        sdata->local->int_scan_req.ssids[0].ssid_len = ifibss->ssid_len;
-        ieee80211_request_scan(sdata, &sdata->local->int_scan_req);
+        ieee80211_request_internal_scan(sdata, ifibss->ssid, ifibss->ssid_len);
 }
 
 static void ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
@@ -471,9 +473,6 @@ static void ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
 
         sband = local->hw.wiphy->bands[ifibss->channel->band];
 
-        if (local->hw.conf.beacon_int == 0)
-                local->hw.conf.beacon_int = 100;
-
         capability = WLAN_CAPABILITY_IBSS;
 
         if (sdata->default_key)
@@ -487,7 +486,7 @@ static void ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
                 *pos++ = (u8) (rate / 5);
         }
 
-        __ieee80211_sta_join_ibss(sdata, bssid, local->hw.conf.beacon_int,
+        __ieee80211_sta_join_ibss(sdata, bssid, sdata->vif.bss_conf.beacon_int,
                                   ifibss->channel, sband->n_bitrates,
                                   supp_rates, capability, 0);
 }
@@ -552,15 +551,8 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
                 printk(KERN_DEBUG "%s: Trigger new scan to find an IBSS to "
                        "join\n", sdata->dev->name);
 
-                /* XXX maybe racy? */
-                if (local->scan_req)
-                        return;
-
-                memcpy(local->int_scan_req.ssids[0].ssid,
-                       ifibss->ssid, IEEE80211_MAX_SSID_LEN);
-                local->int_scan_req.ssids[0].ssid_len =
-                        ifibss->ssid_len;
-                ieee80211_request_scan(sdata, &local->int_scan_req);
+                ieee80211_request_internal_scan(sdata, ifibss->ssid,
+                                                ifibss->ssid_len);
         } else if (ifibss->state != IEEE80211_IBSS_MLME_JOINED) {
                 int interval = IEEE80211_SCAN_INTERVAL;
 
@@ -600,10 +592,7 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
             len < 24 + 2 || !ifibss->presp)
                 return;
 
-        if (local->ops->tx_last_beacon)
-                tx_last_beacon = local->ops->tx_last_beacon(local_to_hw(local));
-        else
-                tx_last_beacon = 1;
+        tx_last_beacon = drv_tx_last_beacon(local);
 
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
         printk(KERN_DEBUG "%s: RX ProbeReq SA=%pM DA=%pM BSSID=%pM"
@@ -786,8 +775,12 @@ void ieee80211_ibss_notify_scan_completed(struct ieee80211_local *local)
 
         mutex_lock(&local->iflist_mtx);
         list_for_each_entry(sdata, &local->interfaces, list) {
+                if (!netif_running(sdata->dev))
+                        continue;
                 if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
                         continue;
+                if (!sdata->u.ibss.ssid_len)
+                        continue;
                 sdata->u.ibss.last_scan_completed = jiffies;
                 ieee80211_sta_find_ibss(sdata);
         }
@@ -827,15 +820,14 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
 {
         struct sk_buff *skb;
 
-        memcpy(sdata->u.ibss.ssid, params->ssid, IEEE80211_MAX_SSID_LEN);
-        sdata->u.ibss.ssid_len = params->ssid_len;
-
         if (params->bssid) {
                 memcpy(sdata->u.ibss.bssid, params->bssid, ETH_ALEN);
                 sdata->u.ibss.fixed_bssid = true;
         } else
                 sdata->u.ibss.fixed_bssid = false;
 
+        sdata->vif.bss_conf.beacon_int = params->beacon_interval;
+
         sdata->u.ibss.channel = params->channel;
         sdata->u.ibss.fixed_channel = params->channel_fixed;
 
@@ -859,6 +851,19 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
         sdata->u.ibss.state = IEEE80211_IBSS_MLME_SEARCH;
         sdata->u.ibss.ibss_join_req = jiffies;
 
+        memcpy(sdata->u.ibss.ssid, params->ssid, IEEE80211_MAX_SSID_LEN);
+
+        /*
+         * The ssid_len setting below is used to see whether
+         * we are active, and we need all other settings
+         * before that may get visible.
+         */
+        mb();
+
+        sdata->u.ibss.ssid_len = params->ssid_len;
+
+        ieee80211_recalc_idle(sdata->local);
+
         set_bit(IEEE80211_IBSS_REQ_RUN, &sdata->u.ibss.request);
         queue_work(sdata->local->hw.workqueue, &sdata->u.ibss.work);
 
@@ -880,12 +885,15 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
         kfree(sdata->u.ibss.ie);
         skb = sdata->u.ibss.presp;
         rcu_assign_pointer(sdata->u.ibss.presp, NULL);
-        ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON_ENABLED);
+        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED);
         synchronize_rcu();
         kfree_skb(skb);
 
         skb_queue_purge(&sdata->u.ibss.skb_queue);
         memset(sdata->u.ibss.bssid, 0, ETH_ALEN);
+        sdata->u.ibss.ssid_len = 0;
+
+        ieee80211_recalc_idle(sdata->local);
 
         return 0;
 }
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 1579bc92c88d..03e0d22603c8 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -248,9 +248,8 @@ struct mesh_preq_queue {
 #define IEEE80211_STA_EXT_SME           BIT(17)
 /* flags for MLME request */
 #define IEEE80211_STA_REQ_SCAN 0
-#define IEEE80211_STA_REQ_DIRECT_PROBE 1
-#define IEEE80211_STA_REQ_AUTH 2
-#define IEEE80211_STA_REQ_RUN  3
+#define IEEE80211_STA_REQ_AUTH 1
+#define IEEE80211_STA_REQ_RUN  2
 
 /* bitfield of allowed auth algs */
 #define IEEE80211_AUTH_ALG_OPEN BIT(0)
@@ -659,6 +658,7 @@ struct ieee80211_local {
 
 
         /* Scanning and BSS list */
+        struct mutex scan_mtx;
         bool sw_scanning, hw_scanning;
         struct cfg80211_ssid scan_ssid;
         struct cfg80211_scan_request int_scan_req;
@@ -905,7 +905,6 @@ static inline int ieee80211_bssid_match(const u8 *raddr, const u8 *addr)
 
 
 int ieee80211_hw_config(struct ieee80211_local *local, u32 changed);
-int ieee80211_if_config(struct ieee80211_sub_if_data *sdata, u32 changed);
 void ieee80211_tx_set_protected(struct ieee80211_tx_data *tx);
 void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
                                       u32 changed);
@@ -947,6 +946,8 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata);
 
 /* scan/BSS handling */
 void ieee80211_scan_work(struct work_struct *work);
+int ieee80211_request_internal_scan(struct ieee80211_sub_if_data *sdata,
+                                    const u8 *ssid, u8 ssid_len);
 int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
                            struct cfg80211_scan_request *req);
 int ieee80211_scan_results(struct ieee80211_local *local,
@@ -960,9 +961,6 @@ int ieee80211_sta_set_extra_ie(struct ieee80211_sub_if_data *sdata,
                                const char *ie, size_t len);
 
 void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local);
-void ieee80211_scan_failed(struct ieee80211_local *local);
-int ieee80211_start_scan(struct ieee80211_sub_if_data *scan_sdata,
-                         struct cfg80211_scan_request *req);
 struct ieee80211_bss *
 ieee80211_bss_info_update(struct ieee80211_local *local,
                           struct ieee80211_rx_status *rx_status,
@@ -987,6 +985,8 @@ int ieee80211_if_change_type(struct ieee80211_sub_if_data *sdata,
                              enum nl80211_iftype type);
 void ieee80211_if_remove(struct ieee80211_sub_if_data *sdata);
 void ieee80211_remove_interfaces(struct ieee80211_local *local);
+u32 __ieee80211_recalc_idle(struct ieee80211_local *local);
+void ieee80211_recalc_idle(struct ieee80211_local *local);
 
 /* tx handling */
 void ieee80211_clear_tx_pending(struct ieee80211_local *local);
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 52425975bbbe..8b6daf0219f4 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -20,6 +20,7 @@
 #include "debugfs_netdev.h"
 #include "mesh.h"
 #include "led.h"
+#include "driver-ops.h"
 
 /**
  * DOC: Interface list locking
@@ -164,9 +165,7 @@ static int ieee80211_open(struct net_device *dev)
         }
 
         if (local->open_count == 0) {
-                res = 0;
-                if (local->ops->start)
-                        res = local->ops->start(local_to_hw(local));
+                res = drv_start(local);
                 if (res)
                         goto err_del_bss;
                 /* we're brought up, everything changes */
@@ -199,8 +198,8 @@ static int ieee80211_open(struct net_device *dev)
          * Validate the MAC address for this device.
          */
         if (!is_valid_ether_addr(dev->dev_addr)) {
-                if (!local->open_count && local->ops->stop)
-                        local->ops->stop(local_to_hw(local));
+                if (!local->open_count)
+                        drv_stop(local);
                 return -EADDRNOTAVAIL;
         }
 
@@ -241,7 +240,7 @@ static int ieee80211_open(struct net_device *dev)
                 conf.vif = &sdata->vif;
                 conf.type = sdata->vif.type;
                 conf.mac_addr = dev->dev_addr;
-                res = local->ops->add_interface(local_to_hw(local), &conf);
+                res = drv_add_interface(local, &conf);
                 if (res)
                         goto err_stop;
 
@@ -302,6 +301,8 @@ static int ieee80211_open(struct net_device *dev)
         if (sdata->flags & IEEE80211_SDATA_PROMISC)
                 atomic_inc(&local->iff_promiscs);
 
+        hw_reconf_flags |= __ieee80211_recalc_idle(local);
+
         local->open_count++;
         if (hw_reconf_flags) {
                 ieee80211_hw_config(local, hw_reconf_flags);
@@ -328,10 +329,10 @@ static int ieee80211_open(struct net_device *dev)
 
         return 0;
  err_del_interface:
-        local->ops->remove_interface(local_to_hw(local), &conf);
+        drv_remove_interface(local, &conf);
  err_stop:
-        if (!local->open_count && local->ops->stop)
-                local->ops->stop(local_to_hw(local));
+        if (!local->open_count)
+                drv_stop(local);
  err_del_bss:
         sdata->bss = NULL;
         if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
@@ -544,17 +545,20 @@ static int ieee80211_stop(struct net_device *dev)
                 conf.mac_addr = dev->dev_addr;
                 /* disable all keys for as long as this netdev is down */
                 ieee80211_disable_keys(sdata);
-                local->ops->remove_interface(local_to_hw(local), &conf);
+                drv_remove_interface(local, &conf);
         }
 
         sdata->bss = NULL;
 
+        hw_reconf_flags |= __ieee80211_recalc_idle(local);
+
+        ieee80211_recalc_ps(local, -1);
+
         if (local->open_count == 0) {
                 if (netif_running(local->mdev))
                         dev_close(local->mdev);
 
-                if (local->ops->stop)
-                        local->ops->stop(local_to_hw(local));
+                drv_stop(local);
 
                 ieee80211_led_radio(local, 0);
 
@@ -567,8 +571,6 @@ static int ieee80211_stop(struct net_device *dev)
                 hw_reconf_flags = 0;
         }
 
-        ieee80211_recalc_ps(local, -1);
-
         /* do after stop to avoid reconfiguring when we stop anyway */
         if (hw_reconf_flags)
                 ieee80211_hw_config(local, hw_reconf_flags);
@@ -894,3 +896,73 @@ void ieee80211_remove_interfaces(struct ieee80211_local *local)
                 unregister_netdevice(sdata->dev);
         }
 }
+
+static u32 ieee80211_idle_off(struct ieee80211_local *local,
+                              const char *reason)
+{
+        if (!(local->hw.conf.flags & IEEE80211_CONF_IDLE))
+                return 0;
+
+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
+        printk(KERN_DEBUG "%s: device no longer idle - %s\n",
+               wiphy_name(local->hw.wiphy), reason);
+#endif
+
+        local->hw.conf.flags &= ~IEEE80211_CONF_IDLE;
+        return IEEE80211_CONF_CHANGE_IDLE;
+}
+
+static u32 ieee80211_idle_on(struct ieee80211_local *local)
+{
+        if (local->hw.conf.flags & IEEE80211_CONF_IDLE)
+                return 0;
+
+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
+        printk(KERN_DEBUG "%s: device now idle\n",
+               wiphy_name(local->hw.wiphy));
+#endif
+
+        local->hw.conf.flags |= IEEE80211_CONF_IDLE;
+        return IEEE80211_CONF_CHANGE_IDLE;
+}
+
+u32 __ieee80211_recalc_idle(struct ieee80211_local *local)
+{
+        struct ieee80211_sub_if_data *sdata;
+        int count = 0;
+
+        if (local->hw_scanning || local->sw_scanning)
+                return ieee80211_idle_off(local, "scanning");
+
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                if (!netif_running(sdata->dev))
+                        continue;
+                /* do not count disabled managed interfaces */
+                if (sdata->vif.type == NL80211_IFTYPE_STATION &&
+                    sdata->u.mgd.state == IEEE80211_STA_MLME_DISABLED)
+                        continue;
+                /* do not count unused IBSS interfaces */
+                if (sdata->vif.type == NL80211_IFTYPE_ADHOC &&
+                    !sdata->u.ibss.ssid_len)
+                        continue;
+                /* count everything else */
+                count++;
+        }
+
+        if (!count)
+                return ieee80211_idle_on(local);
+        else
+                return ieee80211_idle_off(local, "in use");
+
+        return 0;
+}
+
+void ieee80211_recalc_idle(struct ieee80211_local *local)
+{
+        u32 chg;
+
+        mutex_lock(&local->iflist_mtx);
+        chg = __ieee80211_recalc_idle(local);
+        mutex_unlock(&local->iflist_mtx);
+        ieee80211_hw_config(local, chg);
+}
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 687acf23054d..b7e1350273bb 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -16,6 +16,7 @@
 #include <linux/rtnetlink.h>
 #include <net/mac80211.h>
 #include "ieee80211_i.h"
+#include "driver-ops.h"
 #include "debugfs_key.h"
 #include "aes_ccm.h"
 #include "aes_cmac.h"
@@ -136,8 +137,7 @@ static void ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
                                      struct ieee80211_sub_if_data,
                                      u.ap);
 
-        ret = key->local->ops->set_key(local_to_hw(key->local), SET_KEY,
-                                       &sdata->vif, sta, &key->conf);
+        ret = drv_set_key(key->local, SET_KEY, &sdata->vif, sta, &key->conf);
 
         if (!ret) {
                 spin_lock(&todo_lock);
@@ -179,8 +179,8 @@ static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
                                      struct ieee80211_sub_if_data,
                                      u.ap);
 
-        ret = key->local->ops->set_key(local_to_hw(key->local), DISABLE_KEY,
-                                       &sdata->vif, sta, &key->conf);
+        ret = drv_set_key(key->local, DISABLE_KEY, &sdata->vif,
+                          sta, &key->conf);
 
         if (ret)
                 printk(KERN_ERR "mac80211-%s: failed to remove key "
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 5ca62ea15079..b80bc80e46cf 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -26,6 +26,7 @@
 #include <net/cfg80211.h>
 
 #include "ieee80211_i.h"
+#include "driver-ops.h"
 #include "rate.h"
 #include "mesh.h"
 #include "wep.h"
@@ -81,10 +82,9 @@ void ieee80211_configure_filter(struct ieee80211_local *local)
         /* be a bit nasty */
         new_flags |= (1<<31);
 
-        local->ops->configure_filter(local_to_hw(local),
-                                     changed_flags, &new_flags,
-                                     local->mdev->mc_count,
-                                     local->mdev->mc_list);
+        drv_configure_filter(local, changed_flags, &new_flags,
+                             local->mdev->mc_count,
+                             local->mdev->mc_list);
 
         WARN_ON(new_flags & (1<<31));
 
@@ -152,82 +152,6 @@ static void ieee80211_master_set_multicast_list(struct net_device *dev)
         ieee80211_configure_filter(local);
 }
 
-/* everything else */
-
-int ieee80211_if_config(struct ieee80211_sub_if_data *sdata, u32 changed)
-{
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_if_conf conf;
-
-        if (WARN_ON(!netif_running(sdata->dev)))
-                return 0;
-
-        memset(&conf, 0, sizeof(conf));
-
-        if (sdata->vif.type == NL80211_IFTYPE_STATION)
-                conf.bssid = sdata->u.mgd.bssid;
-        else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
-                conf.bssid = sdata->u.ibss.bssid;
-        else if (sdata->vif.type == NL80211_IFTYPE_AP)
-                conf.bssid = sdata->dev->dev_addr;
-        else if (ieee80211_vif_is_mesh(&sdata->vif)) {
-                static const u8 zero[ETH_ALEN] = { 0 };
-                conf.bssid = zero;
-        } else {
-                WARN_ON(1);
-                return -EINVAL;
-        }
-
-        if (!local->ops->config_interface)
-                return 0;
-
-        switch (sdata->vif.type) {
-        case NL80211_IFTYPE_AP:
-        case NL80211_IFTYPE_ADHOC:
-        case NL80211_IFTYPE_MESH_POINT:
-                break;
-        default:
-                /* do not warn to simplify caller in scan.c */
-                changed &= ~IEEE80211_IFCC_BEACON_ENABLED;
-                if (WARN_ON(changed & IEEE80211_IFCC_BEACON))
-                        return -EINVAL;
-                changed &= ~IEEE80211_IFCC_BEACON;
-                break;
-        }
-
-        if (changed & IEEE80211_IFCC_BEACON_ENABLED) {
-                if (local->sw_scanning) {
-                        conf.enable_beacon = false;
-                } else {
-                        /*
-                         * Beacon should be enabled, but AP mode must
-                         * check whether there is a beacon configured.
-                         */
-                        switch (sdata->vif.type) {
-                        case NL80211_IFTYPE_AP:
-                                conf.enable_beacon =
-                                        !!rcu_dereference(sdata->u.ap.beacon);
-                                break;
-                        case NL80211_IFTYPE_ADHOC:
-                                conf.enable_beacon = !!sdata->u.ibss.presp;
-                                break;
-                        case NL80211_IFTYPE_MESH_POINT:
-                                conf.enable_beacon = true;
-                                break;
-                        default:
-                                /* not reached */
-                                WARN_ON(1);
-                                break;
-                        }
-                }
-        }
-
-        conf.changed = changed;
-
-        return local->ops->config_interface(local_to_hw(local),
-                                            &sdata->vif, &conf);
-}
-
 int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
 {
         struct ieee80211_channel *chan;
@@ -268,7 +192,7 @@ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
         }
 
         if (changed && local->open_count) {
-                ret = local->ops->config(local_to_hw(local), changed);
+                ret = drv_config(local, changed);
                 /*
                  * Goal:
                  * HW reconfiguration should never fail, the driver has told
@@ -294,17 +218,77 @@ void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_local *local = sdata->local;
 
-        if (WARN_ON(sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
+        if (!changed)
                 return;
 
-        if (!changed)
+        if (sdata->vif.type == NL80211_IFTYPE_STATION)
+                sdata->vif.bss_conf.bssid = sdata->u.mgd.bssid;
+        else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
+                sdata->vif.bss_conf.bssid = sdata->u.ibss.bssid;
+        else if (sdata->vif.type == NL80211_IFTYPE_AP)
+                sdata->vif.bss_conf.bssid = sdata->dev->dev_addr;
+        else if (ieee80211_vif_is_mesh(&sdata->vif)) {
+                static const u8 zero[ETH_ALEN] = { 0 };
+                sdata->vif.bss_conf.bssid = zero;
+        } else {
+                WARN_ON(1);
                 return;
+        }
+
+        switch (sdata->vif.type) {
+        case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_ADHOC:
+        case NL80211_IFTYPE_MESH_POINT:
+                break;
+        default:
+                /* do not warn to simplify caller in scan.c */
+                changed &= ~BSS_CHANGED_BEACON_ENABLED;
+                if (WARN_ON(changed & BSS_CHANGED_BEACON))
+                        return;
+                break;
+        }
+
+        if (changed & BSS_CHANGED_BEACON_ENABLED) {
+                if (local->sw_scanning) {
+                        sdata->vif.bss_conf.enable_beacon = false;
+                } else {
+                        /*
+                         * Beacon should be enabled, but AP mode must
+                         * check whether there is a beacon configured.
+                         */
+                        switch (sdata->vif.type) {
+                        case NL80211_IFTYPE_AP:
+                                sdata->vif.bss_conf.enable_beacon =
+                                        !!rcu_dereference(sdata->u.ap.beacon);
+                                break;
+                        case NL80211_IFTYPE_ADHOC:
+                                sdata->vif.bss_conf.enable_beacon =
+                                        !!rcu_dereference(sdata->u.ibss.presp);
+                                break;
+                        case NL80211_IFTYPE_MESH_POINT:
+                                sdata->vif.bss_conf.enable_beacon = true;
+                                break;
+                        default:
+                                /* not reached */
+                                WARN_ON(1);
+                                break;
+                        }
+                }
+        }
 
-        if (local->ops->bss_info_changed)
-                local->ops->bss_info_changed(local_to_hw(local),
-                                             &sdata->vif,
-                                             &sdata->vif.bss_conf,
-                                             changed);
+        drv_bss_info_changed(local, &sdata->vif,
+                             &sdata->vif.bss_conf, changed);
+
+        /*
+         * DEPRECATED
+         *
+         * ~changed is just there to not do this at resume time
+         */
+        if (changed & BSS_CHANGED_BEACON_INT && ~changed) {
+                local->hw.conf.beacon_int = sdata->vif.bss_conf.beacon_int;
+                ieee80211_hw_config(local,
+                                    _IEEE80211_CONF_CHANGE_BEACON_INTERVAL);
+        }
 }
 
 u32 ieee80211_reset_erp_info(struct ieee80211_sub_if_data *sdata)
@@ -783,6 +767,7 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
 
         INIT_LIST_HEAD(&local->interfaces);
         mutex_init(&local->iflist_mtx);
+        mutex_init(&local->scan_mtx);
 
         spin_lock_init(&local->key_lock);
 
@@ -970,9 +955,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
 
         debugfs_hw_add(local);
 
-        if (local->hw.conf.beacon_int < 10)
-                local->hw.conf.beacon_int = 100;
-
         if (local->hw.max_listen_interval == 0)
                 local->hw.max_listen_interval = 1;
 
@@ -1126,6 +1108,7 @@ void ieee80211_free_hw(struct ieee80211_hw *hw)
         struct ieee80211_local *local = hw_to_local(hw);
 
         mutex_destroy(&local->iflist_mtx);
+        mutex_destroy(&local->scan_mtx);
 
         wiphy_free(local->hw.wiphy);
 }
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 9a3e5de0410a..9000b01a1671 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -417,7 +417,7 @@ static void ieee80211_mesh_housekeeping(struct ieee80211_sub_if_data *sdata,
 
         free_plinks = mesh_plink_availables(sdata);
         if (free_plinks != sdata->u.mesh.accepting_plinks)
-                ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON);
+                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
 
         ifmsh->housekeeping = false;
         mod_timer(&ifmsh->housekeeping_timer,
@@ -432,8 +432,8 @@ void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
 
         ifmsh->housekeeping = true;
         queue_work(local->hw.workqueue, &ifmsh->work);
-        ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON |
-                                   IEEE80211_IFCC_BEACON_ENABLED);
+        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON |
+                                                BSS_CHANGED_BEACON_ENABLED);
 }
 
 void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 3610c11286bc..75c487229f2e 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -23,6 +23,7 @@
 #include <asm/unaligned.h>
 
 #include "ieee80211_i.h"
+#include "driver-ops.h"
 #include "rate.h"
 #include "led.h"
 
@@ -487,6 +488,13 @@ static void ieee80211_enable_ps(struct ieee80211_local *local,
 {
         struct ieee80211_conf *conf = &local->hw.conf;
 
+        /*
+         * If we are scanning right now then the parameters will
+         * take effect when scan finishes.
+         */
+        if (local->hw_scanning || local->sw_scanning)
+                return;
+
         if (conf->dynamic_ps_timeout > 0 &&
             !(local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)) {
                 mod_timer(&local->dynamic_ps_timer, jiffies +
@@ -555,7 +563,7 @@ void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
                                 maxslp = min_t(int, dtimper,
                                                     latency / beaconint_us);
 
-                        local->hw.conf.max_sleep_interval = maxslp;
+                        local->hw.conf.max_sleep_period = maxslp;
                         local->ps_sdata = found;
                 }
         } else {
@@ -676,11 +684,10 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
                        local->mdev->name, queue, aci, acm, params.aifs, params.cw_min,
                        params.cw_max, params.txop);
 #endif
-                if (local->ops->conf_tx &&
-                    local->ops->conf_tx(local_to_hw(local), queue, &params)) {
+                if (drv_conf_tx(local, queue, &params) && local->ops->conf_tx)
                         printk(KERN_DEBUG "%s: failed to set TX queue "
-                               "parameters for queue %d\n", local->mdev->name, queue);
-                }
+                               "parameters for queue %d\n", local->mdev->name,
+                               queue);
         }
 }
 
@@ -835,6 +842,7 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
                 sdata->vif.bss_conf.timestamp = bss->cbss.tsf;
                 sdata->vif.bss_conf.dtim_period = bss->dtim_period;
 
+                bss_info_changed |= BSS_CHANGED_BEACON_INT;
                 bss_info_changed |= ieee80211_handle_bss_capability(sdata,
                         bss->cbss.capability, bss->has_erp_value, bss->erp_value);
 
@@ -882,7 +890,8 @@ static void ieee80211_direct_probe(struct ieee80211_sub_if_data *sdata)
                 printk(KERN_DEBUG "%s: direct probe to AP %pM timed out\n",
                        sdata->dev->name, ifmgd->bssid);
                 ifmgd->state = IEEE80211_STA_MLME_DISABLED;
-                ieee80211_sta_send_apinfo(sdata);
+                ieee80211_recalc_idle(local);
+                cfg80211_send_auth_timeout(sdata->dev, ifmgd->bssid);
 
                 /*
                  * Most likely AP is not in the range so remove the
@@ -907,8 +916,6 @@ static void ieee80211_direct_probe(struct ieee80211_sub_if_data *sdata)
 
         ifmgd->state = IEEE80211_STA_MLME_DIRECT_PROBE;
 
-        set_bit(IEEE80211_STA_REQ_DIRECT_PROBE, &ifmgd->request);
-
         /* Direct probe is sent to broadcast address as some APs
          * will not answer to direct packet in unassociated state.
          */
@@ -932,6 +939,7 @@ static void ieee80211_authenticate(struct ieee80211_sub_if_data *sdata)
                        " timed out\n",
                        sdata->dev->name, ifmgd->bssid);
                 ifmgd->state = IEEE80211_STA_MLME_DISABLED;
+                ieee80211_recalc_idle(local);
                 cfg80211_send_auth_timeout(sdata->dev, ifmgd->bssid);
                 ieee80211_rx_bss_remove(sdata, ifmgd->bssid,
                                 sdata->local->hw.conf.channel->center_freq,
@@ -1035,6 +1043,8 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
 
         rcu_read_unlock();
 
+        ieee80211_recalc_idle(local);
+
         /* channel(_type) changes are handled by ieee80211_hw_config */
         local->oper_channel_type = NL80211_CHAN_NO_HT;
 
@@ -1115,6 +1125,7 @@ static void ieee80211_associate(struct ieee80211_sub_if_data *sdata)
                        " timed out\n",
                        sdata->dev->name, ifmgd->bssid);
                 ifmgd->state = IEEE80211_STA_MLME_DISABLED;
+                ieee80211_recalc_idle(local);
                 cfg80211_send_assoc_timeout(sdata->dev, ifmgd->bssid);
                 ieee80211_rx_bss_remove(sdata, ifmgd->bssid,
                                 sdata->local->hw.conf.channel->center_freq,
@@ -1135,6 +1146,7 @@ static void ieee80211_associate(struct ieee80211_sub_if_data *sdata)
                 printk(KERN_DEBUG "%s: mismatch in privacy configuration and "
                        "mixed-cell disabled - abort association\n", sdata->dev->name);
                 ifmgd->state = IEEE80211_STA_MLME_DISABLED;
+                ieee80211_recalc_idle(local);
                 return;
         }
 
@@ -1273,6 +1285,7 @@ static void ieee80211_auth_completed(struct ieee80211_sub_if_data *sdata)
         if (ifmgd->flags & IEEE80211_STA_EXT_SME) {
                 /* Wait for SME to request association */
                 ifmgd->state = IEEE80211_STA_MLME_DISABLED;
+                ieee80211_recalc_idle(sdata->local);
         } else
                 ieee80211_associate(sdata);
 }
@@ -1509,6 +1522,7 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
                 if (ifmgd->flags & IEEE80211_STA_EXT_SME) {
                         /* Wait for SME to decide what to do next */
                         ifmgd->state = IEEE80211_STA_MLME_DISABLED;
+                        ieee80211_recalc_idle(local);
                 }
                 return;
         }
@@ -1730,8 +1744,7 @@ static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
         ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems, false);
 
         /* direct probe may be part of the association flow */
-        if (test_and_clear_bit(IEEE80211_STA_REQ_DIRECT_PROBE,
-                               &ifmgd->request)) {
+        if (ifmgd->state == IEEE80211_STA_MLME_DIRECT_PROBE) {
                 printk(KERN_DEBUG "%s direct probe responded\n",
                        sdata->dev->name);
                 ieee80211_authenticate(sdata);
@@ -1974,10 +1987,8 @@ static void ieee80211_sta_reset_auth(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
 
-        if (local->ops->reset_tsf) {
-                /* Reset own TSF to allow time synchronization work. */
-                local->ops->reset_tsf(local_to_hw(local));
-        }
+        /* Reset own TSF to allow time synchronization work. */
+        drv_reset_tsf(local);
 
         ifmgd->wmm_last_param_set = -1; /* allow any WMM update */
 
@@ -2065,25 +2076,18 @@ static int ieee80211_sta_config_auth(struct ieee80211_sub_if_data *sdata)
                 return 0;
         } else {
                 if (ifmgd->assoc_scan_tries < IEEE80211_ASSOC_SCANS_MAX_TRIES) {
+
                         ifmgd->assoc_scan_tries++;
-                        /* XXX maybe racy? */
-                        if (local->scan_req)
-                                return -1;
-                        memcpy(local->int_scan_req.ssids[0].ssid,
-                               ifmgd->ssid, IEEE80211_MAX_SSID_LEN);
-                        if (ifmgd->flags & IEEE80211_STA_AUTO_SSID_SEL)
-                                local->int_scan_req.ssids[0].ssid_len = 0;
-                        else
-                                local->int_scan_req.ssids[0].ssid_len = ifmgd->ssid_len;
 
-                        if (ieee80211_start_scan(sdata, &local->int_scan_req))
-                                ieee80211_scan_failed(local);
+                        ieee80211_request_internal_scan(sdata, ifmgd->ssid,
+                                                        ssid_len);
 
                         ifmgd->state = IEEE80211_STA_MLME_AUTHENTICATE;
                         set_bit(IEEE80211_STA_REQ_AUTH, &ifmgd->request);
                 } else {
                         ifmgd->assoc_scan_tries = 0;
                         ifmgd->state = IEEE80211_STA_MLME_DISABLED;
+                        ieee80211_recalc_idle(local);
                 }
         }
         return -1;
@@ -2115,14 +2119,8 @@ static void ieee80211_sta_work(struct work_struct *work)
             ifmgd->state != IEEE80211_STA_MLME_AUTHENTICATE &&
             ifmgd->state != IEEE80211_STA_MLME_ASSOCIATE &&
             test_and_clear_bit(IEEE80211_STA_REQ_SCAN, &ifmgd->request)) {
-                /*
-                 * The call to ieee80211_start_scan can fail but ieee80211_request_scan
-                 * (which queued ieee80211_sta_work) did not return an error. Thus, call
-                 * ieee80211_scan_failed here if ieee80211_start_scan fails in order to
-                 * notify the scan requester.
-                 */
-                if (ieee80211_start_scan(sdata, local->scan_req))
-                        ieee80211_scan_failed(local);
+                queue_delayed_work(local->hw.workqueue, &local->scan_work,
+                                   round_jiffies_relative(0));
                 return;
         }
 
@@ -2133,6 +2131,8 @@ static void ieee80211_sta_work(struct work_struct *work)
         } else if (!test_and_clear_bit(IEEE80211_STA_REQ_RUN, &ifmgd->request))
                 return;
 
+        ieee80211_recalc_idle(local);
+
         switch (ifmgd->state) {
         case IEEE80211_STA_MLME_DISABLED:
                 break;
@@ -2291,12 +2291,8 @@ int ieee80211_sta_set_bssid(struct ieee80211_sub_if_data *sdata, u8 *bssid)
                 ifmgd->flags &= ~IEEE80211_STA_BSSID_SET;
         }
 
-        if (netif_running(sdata->dev)) {
-                if (ieee80211_if_config(sdata, IEEE80211_IFCC_BSSID)) {
-                        printk(KERN_DEBUG "%s: Failed to config new BSSID to "
-                               "the low-level driver\n", sdata->dev->name);
-                }
-        }
+        if (netif_running(sdata->dev))
+                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
 
         return ieee80211_sta_commit(sdata);
 }
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index b38986c9deef..9d3d89abbb57 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -2,6 +2,7 @@
 #include <net/rtnetlink.h>
 
 #include "ieee80211_i.h"
+#include "driver-ops.h"
 #include "led.h"
 
 int __ieee80211_suspend(struct ieee80211_hw *hw)
@@ -43,8 +44,8 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
                                              struct ieee80211_sub_if_data,
                                              u.ap);
 
-                        local->ops->sta_notify(hw, &sdata->vif,
-                                STA_NOTIFY_REMOVE, &sta->sta);
+                        drv_sta_notify(local, &sdata->vif, STA_NOTIFY_REMOVE,
+                                       &sta->sta);
                 }
                 spin_unlock_irqrestore(&local->sta_lock, flags);
         }
@@ -57,7 +58,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
                         conf.vif = &sdata->vif;
                         conf.type = sdata->vif.type;
                         conf.mac_addr = sdata->dev->dev_addr;
-                        local->ops->remove_interface(hw, &conf);
+                        drv_remove_interface(local, &conf);
                 }
         }
 
@@ -67,7 +68,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
         /* stop hardware */
         if (local->open_count) {
                 ieee80211_led_radio(local, false);
-                local->ops->stop(hw);
+                drv_stop(local);
         }
         return 0;
 }
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index 70df3dcc3cf6..efaf38349731 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -80,8 +80,7 @@ use_low_rate(struct sk_buff *skb)
         fc = le16_to_cpu(hdr->frame_control);
 
         return ((info->flags & IEEE80211_TX_CTL_NO_ACK) ||
-                (fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA ||
-                is_multicast_ether_addr(hdr->addr1));
+                (fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA);
 }
 
 
@@ -245,7 +244,10 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
 
         if (!sta || !mi || use_low_rate(skb)) {
                 ar[0].idx = rate_lowest_index(sband, sta);
-                ar[0].count = mp->max_retry;
+                if (info->flags & IEEE80211_TX_CTL_NO_ACK)
+                        ar[0].count = 1;
+                else
+                        ar[0].count = mp->max_retry;
                 return;
         }
 
diff --git a/net/mac80211/rc80211_pid_algo.c b/net/mac80211/rc80211_pid_algo.c
index 01d59a8e334c..6704fb55c6b2 100644
--- a/net/mac80211/rc80211_pid_algo.c
+++ b/net/mac80211/rc80211_pid_algo.c
@@ -289,13 +289,15 @@ rate_control_pid_get_rate(void *priv, struct ieee80211_sta *sta,
                 info->control.rates[0].count =
                         txrc->hw->conf.short_frame_max_tx_count;
 
-        /* Send management frames and broadcast/multicast data using lowest
-         * rate. */
+        /* Send management frames and NO_ACK data using lowest rate. */
         fc = le16_to_cpu(hdr->frame_control);
         if (!sta || !spinfo ||
             (fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA ||
-            is_multicast_ether_addr(hdr->addr1)) {
+            info->flags & IEEE80211_TX_CTL_NO_ACK) {
                 info->control.rates[0].idx = rate_lowest_index(sband, sta);
+                if (info->flags & IEEE80211_TX_CTL_NO_ACK)
+                        info->control.rates[0].count = 1;
+
                 return;
         }
 
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index a5afb79dab6e..d052f4004829 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -19,6 +19,7 @@
 #include <net/ieee80211_radiotap.h>
 
 #include "ieee80211_i.h"
+#include "driver-ops.h"
 #include "led.h"
 #include "mesh.h"
 #include "wep.h"
@@ -773,9 +774,7 @@ static void ap_sta_ps_start(struct sta_info *sta)
 
         atomic_inc(&sdata->bss->num_sta_ps);
         set_and_clear_sta_flags(sta, WLAN_STA_PS, WLAN_STA_PSPOLL);
-        if (local->ops->sta_notify)
-                local->ops->sta_notify(local_to_hw(local), &sdata->vif,
-                                        STA_NOTIFY_SLEEP, &sta->sta);
+        drv_sta_notify(local, &sdata->vif, STA_NOTIFY_SLEEP, &sta->sta);
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
         printk(KERN_DEBUG "%s: STA %pM aid %d enters power save mode\n",
                sdata->dev->name, sta->sta.addr, sta->sta.aid);
@@ -792,9 +791,7 @@ static int ap_sta_ps_end(struct sta_info *sta)
         atomic_dec(&sdata->bss->num_sta_ps);
 
         clear_sta_flags(sta, WLAN_STA_PS | WLAN_STA_PSPOLL);
-        if (local->ops->sta_notify)
-                local->ops->sta_notify(local_to_hw(local), &sdata->vif,
-                                        STA_NOTIFY_AWAKE, &sta->sta);
+        drv_sta_notify(local, &sdata->vif, STA_NOTIFY_AWAKE, &sta->sta);
 
         if (!skb_queue_empty(&sta->ps_tx_buf))
                 sta_info_clear_tim_bit(sta);
@@ -2287,6 +2284,43 @@ static inline u16 seq_sub(u16 sq1, u16 sq2)
 }
 
 
+static void ieee80211_release_reorder_frame(struct ieee80211_hw *hw,
+                                            struct tid_ampdu_rx *tid_agg_rx,
+                                            int index)
+{
+        struct ieee80211_supported_band *sband;
+        struct ieee80211_rate *rate;
+        struct ieee80211_rx_status status;
+
+        if (!tid_agg_rx->reorder_buf[index])
+                goto no_frame;
+
+        /* release the reordered frames to stack */
+        memcpy(&status, tid_agg_rx->reorder_buf[index]->cb, sizeof(status));
+        sband = hw->wiphy->bands[status.band];
+        if (status.flag & RX_FLAG_HT)
+                rate = sband->bitrates; /* TODO: HT rates */
+        else
+                rate = &sband->bitrates[status.rate_idx];
+        __ieee80211_rx_handle_packet(hw, tid_agg_rx->reorder_buf[index],
+                                     &status, rate);
+        tid_agg_rx->stored_mpdu_num--;
+        tid_agg_rx->reorder_buf[index] = NULL;
+
+no_frame:
+        tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
+}
+
+
+/*
+ * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If
+ * the skb was added to the buffer longer than this time ago, the earlier
+ * frames that have not yet been received are assumed to be lost and the skb
+ * can be released for processing. This may also release other skb's from the
+ * reorder buffer if there are no additional gaps between the frames.
+ */
+#define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)
+
 /*
  * As it function blongs to Rx path it must be called with
  * the proper rcu_read_lock protection for its flow.
@@ -2298,12 +2332,8 @@ static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
                                            u16 mpdu_seq_num,
                                            int bar_req)
 {
-        struct ieee80211_local *local = hw_to_local(hw);
-        struct ieee80211_rx_status status;
         u16 head_seq_num, buf_size;
         int index;
-        struct ieee80211_supported_band *sband;
-        struct ieee80211_rate *rate;
 
         buf_size = tid_agg_rx->buf_size;
         head_seq_num = tid_agg_rx->head_seq_num;
@@ -2328,28 +2358,8 @@ static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
                         index = seq_sub(tid_agg_rx->head_seq_num,
                                 tid_agg_rx->ssn)
                                 % tid_agg_rx->buf_size;
-
-                        if (tid_agg_rx->reorder_buf[index]) {
-                                /* release the reordered frames to stack */
-                                memcpy(&status,
-                                        tid_agg_rx->reorder_buf[index]->cb,
-                                        sizeof(status));
-                                sband = local->hw.wiphy->bands[status.band];
-                                if (status.flag & RX_FLAG_HT) {
-                                        /* TODO: HT rates */
-                                        rate = sband->bitrates;
-                                } else {
-                                        rate = &sband->bitrates
-                                                [status.rate_idx];
-                                }
-                                __ieee80211_rx_handle_packet(hw,
-                                        tid_agg_rx->reorder_buf[index],
-                                        &status, rate);
-                                tid_agg_rx->stored_mpdu_num--;
-                                tid_agg_rx->reorder_buf[index] = NULL;
-                        }
-                        tid_agg_rx->head_seq_num =
-                                seq_inc(tid_agg_rx->head_seq_num);
+                        ieee80211_release_reorder_frame(hw, tid_agg_rx,
+                                                        index);
                 }
                 if (bar_req)
                         return 1;
@@ -2376,26 +2386,50 @@ static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
 
         /* put the frame in the reordering buffer */
         tid_agg_rx->reorder_buf[index] = skb;
+        tid_agg_rx->reorder_time[index] = jiffies;
         memcpy(tid_agg_rx->reorder_buf[index]->cb, rxstatus,
                sizeof(*rxstatus));
         tid_agg_rx->stored_mpdu_num++;
         /* release the buffer until next missing frame */
         index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn)
                                                 % tid_agg_rx->buf_size;
-        while (tid_agg_rx->reorder_buf[index]) {
-                /* release the reordered frame back to stack */
-                memcpy(&status, tid_agg_rx->reorder_buf[index]->cb,
-                        sizeof(status));
-                sband = local->hw.wiphy->bands[status.band];
-                if (status.flag & RX_FLAG_HT)
-                        rate = sband->bitrates; /* TODO: HT rates */
-                else
-                        rate = &sband->bitrates[status.rate_idx];
-                __ieee80211_rx_handle_packet(hw, tid_agg_rx->reorder_buf[index],
-                                             &status, rate);
-                tid_agg_rx->stored_mpdu_num--;
-                tid_agg_rx->reorder_buf[index] = NULL;
-                tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
+        if (!tid_agg_rx->reorder_buf[index] &&
+            tid_agg_rx->stored_mpdu_num > 1) {
+                /*
+                 * No buffers ready to be released, but check whether any
+                 * frames in the reorder buffer have timed out.
+                 */
+                int j;
+                int skipped = 1;
+                for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
+                     j = (j + 1) % tid_agg_rx->buf_size) {
+                        if (tid_agg_rx->reorder_buf[j] == NULL) {
+                                skipped++;
+                                continue;
+                        }
+                        if (!time_after(jiffies, tid_agg_rx->reorder_time[j] +
+                                        HZ / 10))
+                                break;
+
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                        if (net_ratelimit())
+                                printk(KERN_DEBUG "%s: release an RX reorder "
+                                       "frame due to timeout on earlier "
+                                       "frames\n",
+                                       wiphy_name(hw->wiphy));
+#endif
+                        ieee80211_release_reorder_frame(hw, tid_agg_rx, j);
+
+                        /*
+                         * Increment the head seq# also for the skipped slots.
+                         */
+                        tid_agg_rx->head_seq_num =
+                                (tid_agg_rx->head_seq_num + skipped) &
+                                SEQ_MASK;
+                        skipped = 0;
+                }
+        } else while (tid_agg_rx->reorder_buf[index]) {
+                ieee80211_release_reorder_frame(hw, tid_agg_rx, index);
                 index = seq_sub(tid_agg_rx->head_seq_num,
                         tid_agg_rx->ssn) % tid_agg_rx->buf_size;
         }
@@ -2517,6 +2551,18 @@ void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
                 return;
         }
 
+        /*
+         * In theory, the block ack reordering should happen after duplicate
+         * removal (ieee80211_rx_h_check(), which is an RX handler). As such,
+         * the call to ieee80211_rx_reorder_ampdu() should really be moved to
+         * happen as a new RX handler between ieee80211_rx_h_check and
+         * ieee80211_rx_h_decrypt. This cleanup may eventually happen, but for
+         * the time being, the call can be here since RX reorder buf processing
+         * will implicitly skip duplicates. We could, in theory at least,
+         * process frames that ieee80211_rx_h_passive_scan would drop (e.g.,
+         * frames from other than operational channel), but that should not
+         * happen in normal networks.
+         */
         if (!ieee80211_rx_reorder_ampdu(local, skb, status))
                 __ieee80211_rx_handle_packet(hw, skb, status, rate);
 
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index f25b07feabf9..c99ef8d04d3d 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -21,6 +21,7 @@
 #include <net/iw_handler.h>
 
 #include "ieee80211_i.h"
+#include "driver-ops.h"
 #include "mesh.h"
 
 #define IEEE80211_PROBE_DELAY (HZ / 33)
@@ -202,18 +203,6 @@ ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
         return RX_QUEUED;
 }
 
-void ieee80211_scan_failed(struct ieee80211_local *local)
-{
-        if (WARN_ON(!local->scan_req))
-                return;
-
-        /* notify cfg80211 about the failed scan */
-        if (local->scan_req != &local->int_scan_req)
-                cfg80211_scan_done(local->scan_req, true);
-
-        local->scan_req = NULL;
-}
-
 /*
  * inform AP that we will go to sleep so that it will buffer the frames
  * while we scan
@@ -274,55 +263,61 @@ static void ieee80211_scan_ps_disable(struct ieee80211_sub_if_data *sdata)
         }
 }
 
+static void ieee80211_restore_scan_ies(struct ieee80211_local *local)
+{
+        kfree(local->scan_req->ie);
+        local->scan_req->ie = local->orig_ies;
+        local->scan_req->ie_len = local->orig_ies_len;
+}
+
 void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
 {
         struct ieee80211_local *local = hw_to_local(hw);
         struct ieee80211_sub_if_data *sdata;
+        bool was_hw_scan;
 
-        if (WARN_ON(!local->hw_scanning && !local->sw_scanning))
-                return;
+        mutex_lock(&local->scan_mtx);
 
-        if (WARN_ON(!local->scan_req))
+        if (WARN_ON(!local->hw_scanning && !local->sw_scanning)) {
+                mutex_unlock(&local->scan_mtx);
                 return;
+        }
 
-        if (local->hw_scanning) {
-                kfree(local->scan_req->ie);
-                local->scan_req->ie = local->orig_ies;
-                local->scan_req->ie_len = local->orig_ies_len;
+        if (WARN_ON(!local->scan_req)) {
+                mutex_unlock(&local->scan_mtx);
+                return;
         }
 
+        if (local->hw_scanning)
+                ieee80211_restore_scan_ies(local);
+
         if (local->scan_req != &local->int_scan_req)
                 cfg80211_scan_done(local->scan_req, aborted);
         local->scan_req = NULL;
 
-        if (local->hw_scanning) {
-                local->hw_scanning = false;
-                /*
-                 * Somebody might have requested channel change during scan
-                 * that we won't have acted upon, try now. ieee80211_hw_config
-                 * will set the flag based on actual changes.
-                 */
-                ieee80211_hw_config(local, 0);
-                goto done;
-        }
-
+        was_hw_scan = local->hw_scanning;
+        local->hw_scanning = false;
         local->sw_scanning = false;
+
+        /* we only have to protect scan_req and hw/sw scan */
+        mutex_unlock(&local->scan_mtx);
+
         ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
+        if (was_hw_scan)
+                goto done;
 
         netif_tx_lock_bh(local->mdev);
         netif_addr_lock(local->mdev);
         local->filter_flags &= ~FIF_BCN_PRBRESP_PROMISC;
-        local->ops->configure_filter(local_to_hw(local),
-                                     FIF_BCN_PRBRESP_PROMISC,
-                                     &local->filter_flags,
-                                     local->mdev->mc_count,
-                                     local->mdev->mc_list);
+        drv_configure_filter(local, FIF_BCN_PRBRESP_PROMISC,
+                             &local->filter_flags,
+                             local->mdev->mc_count,
+                             local->mdev->mc_list);
 
         netif_addr_unlock(local->mdev);
         netif_tx_unlock_bh(local->mdev);
 
-        if (local->ops->sw_scan_complete)
-                local->ops->sw_scan_complete(local_to_hw(local));
+        drv_sw_scan_complete(local);
 
         mutex_lock(&local->iflist_mtx);
         list_for_each_entry(sdata, &local->interfaces, list) {
@@ -342,18 +337,160 @@ void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
                 if (sdata->vif.type == NL80211_IFTYPE_AP ||
                     sdata->vif.type == NL80211_IFTYPE_ADHOC ||
                     sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
-                        ieee80211_if_config(sdata,
-                                            IEEE80211_IFCC_BEACON_ENABLED);
+                        ieee80211_bss_info_change_notify(
+                                sdata, BSS_CHANGED_BEACON_ENABLED);
         }
         mutex_unlock(&local->iflist_mtx);
 
  done:
+        ieee80211_recalc_idle(local);
         ieee80211_mlme_notify_scan_completed(local);
         ieee80211_ibss_notify_scan_completed(local);
         ieee80211_mesh_notify_scan_completed(local);
 }
 EXPORT_SYMBOL(ieee80211_scan_completed);
 
+static int ieee80211_start_sw_scan(struct ieee80211_local *local)
+{
+        struct ieee80211_sub_if_data *sdata;
+
+        /*
+         * Hardware/driver doesn't support hw_scan, so use software
+         * scanning instead. First send a nullfunc frame with power save
+         * bit on so that AP will buffer the frames for us while we are not
+         * listening, then send probe requests to each channel and wait for
+         * the responses. After all channels are scanned, tune back to the
+         * original channel and send a nullfunc frame with power save bit
+         * off to trigger the AP to send us all the buffered frames.
+         *
+         * Note that while local->sw_scanning is true everything else but
+         * nullfunc frames and probe requests will be dropped in
+         * ieee80211_tx_h_check_assoc().
+         */
+        drv_sw_scan_start(local);
+
+        mutex_lock(&local->iflist_mtx);
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                if (!netif_running(sdata->dev))
+                        continue;
+
+                /* disable beaconing */
+                if (sdata->vif.type == NL80211_IFTYPE_AP ||
+                    sdata->vif.type == NL80211_IFTYPE_ADHOC ||
+                    sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
+                        ieee80211_bss_info_change_notify(
+                                sdata, BSS_CHANGED_BEACON_ENABLED);
+
+                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
+                        if (sdata->u.mgd.flags & IEEE80211_STA_ASSOCIATED) {
+                                netif_tx_stop_all_queues(sdata->dev);
+                                ieee80211_scan_ps_enable(sdata);
+                        }
+                } else
+                        netif_tx_stop_all_queues(sdata->dev);
+        }
+        mutex_unlock(&local->iflist_mtx);
+
+        local->scan_state = SCAN_SET_CHANNEL;
+        local->scan_channel_idx = 0;
+
+        netif_addr_lock_bh(local->mdev);
+        local->filter_flags |= FIF_BCN_PRBRESP_PROMISC;
+        drv_configure_filter(local, FIF_BCN_PRBRESP_PROMISC,
+                             &local->filter_flags,
+                             local->mdev->mc_count,
+                             local->mdev->mc_list);
+        netif_addr_unlock_bh(local->mdev);
+
+        /* TODO: start scan as soon as all nullfunc frames are ACKed */
+        queue_delayed_work(local->hw.workqueue, &local->scan_work,
+                           IEEE80211_CHANNEL_TIME);
+
+        return 0;
+}
+
+
+static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
+                                  struct cfg80211_scan_request *req)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        int rc;
+
+        if (local->scan_req)
+                return -EBUSY;
+
+        if (local->ops->hw_scan) {
+                u8 *ies;
+                int ielen;
+
+                ies = kmalloc(2 + IEEE80211_MAX_SSID_LEN +
+                              local->scan_ies_len + req->ie_len, GFP_KERNEL);
+                if (!ies)
+                        return -ENOMEM;
+
+                ielen = ieee80211_build_preq_ies(local, ies,
+                                                 req->ie, req->ie_len);
+                local->orig_ies = req->ie;
+                local->orig_ies_len = req->ie_len;
+                req->ie = ies;
+                req->ie_len = ielen;
+        }
+
+        local->scan_req = req;
+        local->scan_sdata = sdata;
+
+        if (req != &local->int_scan_req &&
+            sdata->vif.type == NL80211_IFTYPE_STATION &&
+            (ifmgd->state == IEEE80211_STA_MLME_DIRECT_PROBE ||
+             ifmgd->state == IEEE80211_STA_MLME_AUTHENTICATE ||
+             ifmgd->state == IEEE80211_STA_MLME_ASSOCIATE)) {
+                /* actually wait for the assoc to finish/time out */
+                set_bit(IEEE80211_STA_REQ_SCAN, &ifmgd->request);
+                return 0;
+        }
+
+        if (local->ops->hw_scan)
+                local->hw_scanning = true;
+        else
+                local->sw_scanning = true;
+        /*
+         * Kicking off the scan need not be protected,
+         * only the scan variable stuff, since now
+         * local->scan_req is assigned and other callers
+         * will abort their scan attempts.
+         *
+         * This avoids getting a scan_mtx -> iflist_mtx
+         * dependency, so that the scan completed calls
+         * have more locking freedom.
+         */
+
+        ieee80211_recalc_idle(local);
+        mutex_unlock(&local->scan_mtx);
+
+        if (local->ops->hw_scan)
+                rc = drv_hw_scan(local, local->scan_req);
+        else
+                rc = ieee80211_start_sw_scan(local);
+
+        mutex_lock(&local->scan_mtx);
+
+        if (rc) {
+                if (local->ops->hw_scan) {
+                        local->hw_scanning = false;
+                        ieee80211_restore_scan_ies(local);
+                } else
+                        local->sw_scanning = false;
+
+                ieee80211_recalc_idle(local);
+
+                local->scan_req = NULL;
+                local->scan_sdata = NULL;
+        }
+
+        return rc;
+}
+
 void ieee80211_scan_work(struct work_struct *work)
 {
         struct ieee80211_local *local =
@@ -363,17 +500,41 @@ void ieee80211_scan_work(struct work_struct *work)
         int skip, i;
         unsigned long next_delay = 0;
 
+        mutex_lock(&local->scan_mtx);
+        if (!sdata || !local->scan_req) {
+                mutex_unlock(&local->scan_mtx);
+                return;
+        }
+
+        if (local->scan_req && !(local->sw_scanning || local->hw_scanning)) {
+                struct cfg80211_scan_request *req = local->scan_req;
+                int rc;
+
+                local->scan_req = NULL;
+
+                rc = __ieee80211_start_scan(sdata, req);
+                mutex_unlock(&local->scan_mtx);
+
+                if (rc)
+                        ieee80211_scan_completed(&local->hw, true);
+                return;
+        }
+
+        mutex_unlock(&local->scan_mtx);
+
         /*
          * Avoid re-scheduling when the sdata is going away.
          */
-        if (!netif_running(sdata->dev))
+        if (!netif_running(sdata->dev)) {
+                ieee80211_scan_completed(&local->hw, true);
                 return;
+        }
 
         switch (local->scan_state) {
         case SCAN_SET_CHANNEL:
                 /* if no more bands/channels left, complete scan */
                 if (local->scan_channel_idx >= local->scan_req->n_channels) {
-                        ieee80211_scan_completed(local_to_hw(local), false);
+                        ieee80211_scan_completed(&local->hw, false);
                         return;
                 }
                 skip = 0;
@@ -422,166 +583,35 @@ void ieee80211_scan_work(struct work_struct *work)
                            next_delay);
 }
 
-
-int ieee80211_start_scan(struct ieee80211_sub_if_data *scan_sdata,
-                         struct cfg80211_scan_request *req)
+int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
+                           struct cfg80211_scan_request *req)
 {
-        struct ieee80211_local *local = scan_sdata->local;
-        struct ieee80211_sub_if_data *sdata;
-
-        if (!req)
-                return -EINVAL;
-
-        if (local->scan_req && local->scan_req != req)
-                return -EBUSY;
-
-        local->scan_req = req;
+        int res;
 
-        /* MLME-SCAN.request (page 118)  page 144 (11.1.3.1)
-         * BSSType: INFRASTRUCTURE, INDEPENDENT, ANY_BSS
-         * BSSID: MACAddress
-         * SSID
-         * ScanType: ACTIVE, PASSIVE
-         * ProbeDelay: delay (in microseconds) to be used prior to transmitting
-         *    a Probe frame during active scanning
-         * ChannelList
-         * MinChannelTime (>= ProbeDelay), in TU
-         * MaxChannelTime: (>= MinChannelTime), in TU
-         */
+        mutex_lock(&sdata->local->scan_mtx);
+        res = __ieee80211_start_scan(sdata, req);
+        mutex_unlock(&sdata->local->scan_mtx);
 
-         /* MLME-SCAN.confirm
-          * BSSDescriptionSet
-          * ResultCode: SUCCESS, INVALID_PARAMETERS
-         */
-
-        if (local->sw_scanning || local->hw_scanning) {
-                if (local->scan_sdata == scan_sdata)
-                        return 0;
-                return -EBUSY;
-        }
-
-        if (local->ops->hw_scan) {
-                u8 *ies;
-                int rc, ielen;
-
-                ies = kmalloc(2 + IEEE80211_MAX_SSID_LEN +
-                              local->scan_ies_len + req->ie_len, GFP_KERNEL);
-                if (!ies)
-                        return -ENOMEM;
-
-                ielen = ieee80211_build_preq_ies(local, ies,
-                                                 req->ie, req->ie_len);
-                local->orig_ies = req->ie;
-                local->orig_ies_len = req->ie_len;
-                req->ie = ies;
-                req->ie_len = ielen;
-
-                local->hw_scanning = true;
-                rc = local->ops->hw_scan(local_to_hw(local), req);
-                if (rc) {
-                        local->hw_scanning = false;
-                        kfree(ies);
-                        req->ie_len = local->orig_ies_len;
-                        req->ie = local->orig_ies;
-                        return rc;
-                }
-                local->scan_sdata = scan_sdata;
-                return 0;
-        }
-
-        /*
-         * Hardware/driver doesn't support hw_scan, so use software
-         * scanning instead. First send a nullfunc frame with power save
-         * bit on so that AP will buffer the frames for us while we are not
-         * listening, then send probe requests to each channel and wait for
-         * the responses. After all channels are scanned, tune back to the
-         * original channel and send a nullfunc frame with power save bit
-         * off to trigger the AP to send us all the buffered frames.
-         *
-         * Note that while local->sw_scanning is true everything else but
-         * nullfunc frames and probe requests will be dropped in
-         * ieee80211_tx_h_check_assoc().
-         */
-        local->sw_scanning = true;
-        if (local->ops->sw_scan_start)
-                local->ops->sw_scan_start(local_to_hw(local));
-
-        mutex_lock(&local->iflist_mtx);
-        list_for_each_entry(sdata, &local->interfaces, list) {
-                if (!netif_running(sdata->dev))
-                        continue;
-
-                /* disable beaconing */
-                if (sdata->vif.type == NL80211_IFTYPE_AP ||
-                    sdata->vif.type == NL80211_IFTYPE_ADHOC ||
-                    sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
-                        ieee80211_if_config(sdata,
-                                            IEEE80211_IFCC_BEACON_ENABLED);
-
-                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                        if (sdata->u.mgd.flags & IEEE80211_STA_ASSOCIATED) {
-                                netif_tx_stop_all_queues(sdata->dev);
-                                ieee80211_scan_ps_enable(sdata);
-                        }
-                } else
-                        netif_tx_stop_all_queues(sdata->dev);
-        }
-        mutex_unlock(&local->iflist_mtx);
-
-        local->scan_state = SCAN_SET_CHANNEL;
-        local->scan_channel_idx = 0;
-        local->scan_sdata = scan_sdata;
-        local->scan_req = req;
-
-        netif_addr_lock_bh(local->mdev);
-        local->filter_flags |= FIF_BCN_PRBRESP_PROMISC;
-        local->ops->configure_filter(local_to_hw(local),
-                                     FIF_BCN_PRBRESP_PROMISC,
-                                     &local->filter_flags,
-                                     local->mdev->mc_count,
-                                     local->mdev->mc_list);
-        netif_addr_unlock_bh(local->mdev);
-
-        /* TODO: start scan as soon as all nullfunc frames are ACKed */
-        queue_delayed_work(local->hw.workqueue, &local->scan_work,
-                           IEEE80211_CHANNEL_TIME);
-
-        return 0;
+        return res;
 }
 
-
-int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
-                           struct cfg80211_scan_request *req)
+int ieee80211_request_internal_scan(struct ieee80211_sub_if_data *sdata,
+                                    const u8 *ssid, u8 ssid_len)
 {
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_if_managed *ifmgd;
-
-        if (!req)
-                return -EINVAL;
-
-        if (local->scan_req && local->scan_req != req)
-                return -EBUSY;
-
-        local->scan_req = req;
+        int ret = -EBUSY;
 
-        if (sdata->vif.type != NL80211_IFTYPE_STATION)
-                return ieee80211_start_scan(sdata, req);
+        mutex_lock(&local->scan_mtx);
 
-        /*
-         * STA has a state machine that might need to defer scanning
-         * while it's trying to associate/authenticate, therefore we
-         * queue it up to the state machine in that case.
-         */
+        /* busy scanning */
+        if (local->scan_req)
+                goto unlock;
 
-        if (local->sw_scanning || local->hw_scanning) {
-                if (local->scan_sdata == sdata)
-                        return 0;
-                return -EBUSY;
-        }
-
-        ifmgd = &sdata->u.mgd;
-        set_bit(IEEE80211_STA_REQ_SCAN, &ifmgd->request);
-        queue_work(local->hw.workqueue, &ifmgd->work);
+        memcpy(local->int_scan_req.ssids[0].ssid, ssid, IEEE80211_MAX_SSID_LEN);
+        local->int_scan_req.ssids[0].ssid_len = ssid_len;
 
-        return 0;
+        ret = __ieee80211_start_scan(sdata, &sdata->local->int_scan_req);
+ unlock:
+        mutex_unlock(&local->scan_mtx);
+        return ret;
 }
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 654a8e963ccb..a98ea273a155 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -19,6 +19,7 @@
 
 #include <net/mac80211.h>
 #include "ieee80211_i.h"
+#include "driver-ops.h"
 #include "rate.h"
 #include "sta_info.h"
 #include "debugfs_sta.h"
@@ -346,8 +347,7 @@ int sta_info_insert(struct sta_info *sta)
                                              struct ieee80211_sub_if_data,
                                              u.ap);
 
-                local->ops->sta_notify(local_to_hw(local), &sdata->vif,
-                                       STA_NOTIFY_ADD, &sta->sta);
+                drv_sta_notify(local, &sdata->vif, STA_NOTIFY_ADD, &sta->sta);
         }
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
@@ -405,8 +405,7 @@ static void __sta_info_set_tim_bit(struct ieee80211_if_ap *bss,
 
         if (sta->local->ops->set_tim) {
                 sta->local->tim_in_locked_section = true;
-                sta->local->ops->set_tim(local_to_hw(sta->local),
-                                         &sta->sta, true);
+                drv_set_tim(sta->local, &sta->sta, true);
                 sta->local->tim_in_locked_section = false;
         }
 }
@@ -431,8 +430,7 @@ static void __sta_info_clear_tim_bit(struct ieee80211_if_ap *bss,
 
         if (sta->local->ops->set_tim) {
                 sta->local->tim_in_locked_section = true;
-                sta->local->ops->set_tim(local_to_hw(sta->local),
-                                         &sta->sta, false);
+                drv_set_tim(sta->local, &sta->sta, false);
                 sta->local->tim_in_locked_section = false;
         }
 }
@@ -482,8 +480,8 @@ static void __sta_info_unlink(struct sta_info **sta)
                                              struct ieee80211_sub_if_data,
                                              u.ap);
 
-                local->ops->sta_notify(local_to_hw(local), &sdata->vif,
-                                       STA_NOTIFY_REMOVE, &(*sta)->sta);
+                drv_sta_notify(local, &sdata->vif, STA_NOTIFY_REMOVE,
+                               &(*sta)->sta);
         }
 
         if (ieee80211_vif_is_mesh(&sdata->vif)) {
@@ -543,9 +541,8 @@ void sta_info_unlink(struct sta_info **sta)
         spin_unlock_irqrestore(&local->sta_lock, flags);
 }
 
-static inline int sta_info_buffer_expired(struct ieee80211_local *local,
-                                          struct sta_info *sta,
-                                          struct sk_buff *skb)
+static int sta_info_buffer_expired(struct sta_info *sta,
+                                   struct sk_buff *skb)
 {
         struct ieee80211_tx_info *info;
         int timeout;
@@ -556,8 +553,9 @@ static inline int sta_info_buffer_expired(struct ieee80211_local *local,
         info = IEEE80211_SKB_CB(skb);
 
         /* Timeout: (2 * listen_interval * beacon_int * 1024 / 1000000) sec */
-        timeout = (sta->listen_interval * local->hw.conf.beacon_int * 32 /
-                   15625) * HZ;
+        timeout = (sta->listen_interval *
+                   sta->sdata->vif.bss_conf.beacon_int *
+                   32 / 15625) * HZ;
         if (timeout < STA_TX_BUFFER_EXPIRE)
                 timeout = STA_TX_BUFFER_EXPIRE;
         return time_after(jiffies, info->control.jiffies + timeout);
@@ -577,7 +575,7 @@ static void sta_info_cleanup_expire_buffered(struct ieee80211_local *local,
         for (;;) {
                 spin_lock_irqsave(&sta->ps_tx_buf.lock, flags);
                 skb = skb_peek(&sta->ps_tx_buf);
-                if (sta_info_buffer_expired(local, sta, skb))
+                if (sta_info_buffer_expired(sta, skb))
                         skb = __skb_dequeue(&sta->ps_tx_buf);
                 else
                         skb = NULL;
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 31a8990ce401..164b16cbe0a5 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -88,6 +88,7 @@ struct tid_ampdu_tx {
  * struct tid_ampdu_rx - TID aggregation information (Rx).
  *
  * @reorder_buf: buffer to reorder incoming aggregated MPDUs
+ * @reorder_time: jiffies when skb was added
  * @session_timer: check if peer keeps Tx-ing on the TID (by timeout value)
  * @head_seq_num: head sequence number in reordering buffer.
  * @stored_mpdu_num: number of MPDUs in reordering buffer
@@ -99,6 +100,7 @@ struct tid_ampdu_tx {
  */
 struct tid_ampdu_rx {
         struct sk_buff **reorder_buf;
+        unsigned long *reorder_time;
         struct timer_list session_timer;
         u16 head_seq_num;
         u16 stored_mpdu_num;
diff --git a/net/mac80211/tkip.c b/net/mac80211/tkip.c
index 38fa111d2dc6..964b7faa7f17 100644
--- a/net/mac80211/tkip.c
+++ b/net/mac80211/tkip.c
@@ -13,6 +13,7 @@
 #include <asm/unaligned.h>
 
 #include <net/mac80211.h>
+#include "driver-ops.h"
 #include "key.h"
 #include "tkip.h"
 #include "wep.h"
@@ -307,9 +308,8 @@ int ieee80211_tkip_decrypt_data(struct crypto_blkcipher *tfm,
                         if (is_multicast_ether_addr(ra))
                                 sta_addr = bcast;
 
-                        key->local->ops->update_tkip_key(
-                                local_to_hw(key->local), &key->conf,
-                                sta_addr, iv32, key->u.tkip.rx[queue].p1k);
+                        drv_update_tkip_key(key->local, &key->conf, sta_addr,
+                                            iv32, key->u.tkip.rx[queue].p1k);
                 }
         }
 
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index e5b148fe24bb..5f9a8d7af83d 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -25,6 +25,7 @@
 #include <asm/unaligned.h>
 
 #include "ieee80211_i.h"
+#include "driver-ops.h"
 #include "led.h"
 #include "mesh.h"
 #include "wep.h"
@@ -557,6 +558,10 @@ ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
         if (unlikely(!info->control.rates[0].count))
                 info->control.rates[0].count = 1;
 
+        if (WARN_ON_ONCE((info->control.rates[0].count > 1) &&
+                         (info->flags & IEEE80211_TX_CTL_NO_ACK)))
+                info->control.rates[0].count = 1;
+
         if (is_multicast_ether_addr(hdr->addr1)) {
                 /*
                  * XXX: verify the rate is in the basic rateset
@@ -1162,7 +1167,7 @@ static int __ieee80211_tx(struct ieee80211_local *local,
 
                 next = skb->next;
                 len = skb->len;
-                ret = local->ops->tx(local_to_hw(local), skb);
+                ret = drv_tx(local, skb);
                 if (WARN_ON(ret != NETDEV_TX_OK && skb->len != len)) {
                         dev_kfree_skb(skb);
                         ret = NETDEV_TX_OK;
@@ -2132,7 +2137,7 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
                 memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
                 /* BSSID is left zeroed, wildcard value */
                 mgmt->u.beacon.beacon_int =
-                        cpu_to_le16(local->hw.conf.beacon_int);
+                        cpu_to_le16(sdata->vif.bss_conf.beacon_int);
                 mgmt->u.beacon.capab_info = 0x0; /* 0x0 for MPs */
 
                 pos = skb_put(skb, 2);
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 61876eb50b49..97b613affe08 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -26,6 +26,7 @@
 #include <net/rtnetlink.h>
 
 #include "ieee80211_i.h"
+#include "driver-ops.h"
 #include "rate.h"
 #include "mesh.h"
 #include "wme.h"
@@ -726,7 +727,7 @@ void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata)
         qparam.txop = 0;
 
         for (i = 0; i < local_to_hw(local)->queues; i++)
-                local->ops->conf_tx(local_to_hw(local), i, &qparam);
+                drv_conf_tx(local, i, &qparam);
 }
 
 void ieee80211_sta_def_wmm_params(struct ieee80211_sub_if_data *sdata,
@@ -1000,7 +1001,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
 
         /* restart hardware */
         if (local->open_count) {
-                res = local->ops->start(hw);
+                res = drv_start(local);
 
                 ieee80211_led_radio(local, hw->conf.radio_enabled);
         }
@@ -1013,7 +1014,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                         conf.vif = &sdata->vif;
                         conf.type = sdata->vif.type;
                         conf.mac_addr = sdata->dev->dev_addr;
-                        res = local->ops->add_interface(hw, &conf);
+                        res = drv_add_interface(local, &conf);
                 }
         }
 
@@ -1026,8 +1027,8 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                                              struct ieee80211_sub_if_data,
                                              u.ap);
 
-                        local->ops->sta_notify(hw, &sdata->vif,
-                                STA_NOTIFY_ADD, &sta->sta);
+                        drv_sta_notify(local, &sdata->vif, STA_NOTIFY_ADD,
+                                       &sta->sta);
                 }
                 spin_unlock_irqrestore(&local->sta_lock, flags);
         }
@@ -1045,8 +1046,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
         rcu_read_unlock();
 
         /* setup RTS threshold */
-        if (local->ops->set_rts_threshold)
-                local->ops->set_rts_threshold(hw, hw->wiphy->rts_threshold);
+        drv_set_rts_threshold(local, hw->wiphy->rts_threshold);
 
         /* reconfigure hardware */
         ieee80211_hw_config(local, ~0);
@@ -1063,24 +1063,13 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                 switch (sdata->vif.type) {
                 case NL80211_IFTYPE_STATION:
                         /* disable beacon change bits */
-                        changed &= ~IEEE80211_IFCC_BEACON;
+                        changed &= ~(BSS_CHANGED_BEACON |
+                                     BSS_CHANGED_BEACON_ENABLED);
                         /* fall through */
                 case NL80211_IFTYPE_ADHOC:
                 case NL80211_IFTYPE_AP:
                 case NL80211_IFTYPE_MESH_POINT:
-                        /*
-                         * Driver's config_interface can fail if rfkill is
-                         * enabled. Accommodate this return code.
-                         * FIXME: When mac80211 has knowledge of rfkill
-                         * state the code below can change back to:
-                         *   WARN(ieee80211_if_config(sdata, changed));
-                         *   ieee80211_bss_info_change_notify(sdata, ~0);
-                         */
-                        if (ieee80211_if_config(sdata, changed))
-                                printk(KERN_DEBUG "%s: failed to configure interface during resume\n",
-                                       sdata->dev->name);
-                        else
-                                ieee80211_bss_info_change_notify(sdata, ~0);
+                        ieee80211_bss_info_change_notify(sdata, changed);
                         break;
                 case NL80211_IFTYPE_WDS:
                         break;
diff --git a/net/mac80211/wext.c b/net/mac80211/wext.c
index 1a649da42c41..6b4eb8d43a4e 100644
--- a/net/mac80211/wext.c
+++ b/net/mac80211/wext.c
@@ -185,7 +185,7 @@ static int ieee80211_ioctl_giwfreq(struct net_device *dev,
         if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
                 return cfg80211_ibss_wext_giwfreq(dev, info, freq, extra);
 
-        freq->m = local->hw.conf.channel->center_freq;
+        freq->m = local->oper_channel->center_freq;
         freq->e = 6;
 
         return 0;
diff --git a/net/rfkill/rfkill.c b/net/rfkill/rfkill.c
index e2d4510623f2..4f5a83183c95 100644
--- a/net/rfkill/rfkill.c
+++ b/net/rfkill/rfkill.c
@@ -75,6 +75,11 @@ static void rfkill_led_trigger_activate(struct led_classdev *led)
 
         rfkill_led_trigger(rfkill, rfkill->state);
 }
+#else
+static inline void rfkill_led_trigger(struct rfkill *rfkill,
+                                        enum rfkill_state state)
+{
+}
 #endif /* CONFIG_RFKILL_LEDS */
 
 static void rfkill_uevent(struct rfkill *rfkill)
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index b1fc98225fd1..3c53c5cbc3a9 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -3696,9 +3696,9 @@ void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
                                 NL80211_CMD_DISASSOCIATE);
 }
 
-void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
-                               struct net_device *netdev, int cmd,
-                               const u8 *addr)
+static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
+                                      struct net_device *netdev, int cmd,
+                                      const u8 *addr)
 {
         struct sk_buff *msg;
         void *hdr;
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 139d13fdc94f..537af62ec42b 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -2113,14 +2113,14 @@ void reg_device_remove(struct wiphy *wiphy)
 
         assert_cfg80211_lock();
 
+        kfree(wiphy->regd);
+
         if (last_request)
                 request_wiphy = wiphy_idx_to_wiphy(last_request->wiphy_idx);
 
-        kfree(wiphy->regd);
-        if (!last_request || !request_wiphy)
-                return;
-        if (request_wiphy != wiphy)
+        if (!request_wiphy || request_wiphy != wiphy)
                 return;
+
         last_request->wiphy_idx = WIPHY_IDX_STALE;
         last_request->country_ie_env = ENVIRON_ANY;
 }
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index dfb53d19fd77..df59440290e5 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -377,18 +377,16 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
                         size_t used = dev->wiphy.bss_priv_size + sizeof(*res);
                         size_t ielen = res->pub.len_information_elements;
 
-                        if (ksize(found) >= used + ielen) {
+                        if (!found->ies_allocated && ksize(found) >= used + ielen) {
                                 memcpy(found->pub.information_elements,
                                        res->pub.information_elements, ielen);
                                 found->pub.len_information_elements = ielen;
                         } else {
                                 u8 *ies = found->pub.information_elements;
 
-                                if (found->ies_allocated) {
-                                        if (ksize(ies) < ielen)
-                                                ies = krealloc(ies, ielen,
-                                                               GFP_ATOMIC);
-                                } else
+                                if (found->ies_allocated)
+                                        ies = krealloc(ies, ielen, GFP_ATOMIC);
+                                else
                                         ies = kmalloc(ielen, GFP_ATOMIC);
 
                                 if (ies) {