Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6

126 files changed, 8007 insertions, 4142 deletions

diff --git a/drivers/net/wireless/Kconfig b/drivers/net/wireless/Kconfig
index fe819a785714..1294175cab20 100644
--- a/drivers/net/wireless/Kconfig
+++ b/drivers/net/wireless/Kconfig
@@ -228,6 +228,14 @@ config PCMCIA_ATMEL
           Enable support for PCMCIA cards containing the
           Atmel at76c502 and at76c504 chips.
 
+config AT76C50X_USB
+        tristate "Atmel at76c503/at76c505/at76c505a USB cards"
+        depends on MAC80211 && WLAN_80211 && USB
+        select FW_LOADER
+        ---help---
+          Enable support for USB Wireless devices using Atmel at76c503,
+          at76c505 or at76c505a chips.
+
 config AIRO_CS
         tristate "Cisco/Aironet 34X/35X/4500/4800 PCMCIA cards"
         depends on PCMCIA && (BROKEN || !M32R) && WLAN_80211
diff --git a/drivers/net/wireless/Makefile b/drivers/net/wireless/Makefile
index ac590e1ca8be..e2574cafe051 100644
--- a/drivers/net/wireless/Makefile
+++ b/drivers/net/wireless/Makefile
@@ -24,6 +24,8 @@ obj-$(CONFIG_ATMEL)             += atmel.o
 obj-$(CONFIG_PCI_ATMEL)         += atmel_pci.o 
 obj-$(CONFIG_PCMCIA_ATMEL)      += atmel_cs.o
 
+obj-$(CONFIG_AT76C50X_USB)      += at76c50x-usb.o
+
 obj-$(CONFIG_PRISM54)           += prism54/
 
 obj-$(CONFIG_HOSTAP)            += hostap/
diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index c44f38895fbe..a3e324e0ca83 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -4727,7 +4727,7 @@ static int proc_stats_rid_open( struct inode *inode,
         StatsRid stats;
         int i, j;
         __le32 *vals = stats.vals;
-        int len = le16_to_cpu(stats.len);
+        int len;
 
         if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
                 return -ENOMEM;
@@ -4738,6 +4738,7 @@ static int proc_stats_rid_open( struct inode *inode,
         }
 
         readStatsRid(apriv, &stats, rid, 1);
+        len = le16_to_cpu(stats.len);
 
         j = 0;
         for(i=0; statsLabels[i]!=(char *)-1 && i*4<len; i++) {
diff --git a/drivers/net/wireless/at76c50x-usb.c b/drivers/net/wireless/at76c50x-usb.c
new file mode 100644
index 000000000000..0c02f1c2bd94
--- /dev/null
+++ b/drivers/net/wireless/at76c50x-usb.c
@@ -0,0 +1,2501 @@
+/*
+ * at76c503/at76c505 USB driver
+ *
+ * Copyright (c) 2002 - 2003 Oliver Kurth
+ * Copyright (c) 2004 Joerg Albert <joerg.albert@gmx.de>
+ * Copyright (c) 2004 Nick Jones
+ * Copyright (c) 2004 Balint Seeber <n0_5p4m_p13453@hotmail.com>
+ * Copyright (c) 2007 Guido Guenther <agx@sigxcpu.org>
+ * Copyright (c) 2007 Kalle Valo <kalle.valo@iki.fi>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of
+ * the License, or (at your option) any later version.
+ *
+ * This file is part of the Berlios driver for WLAN USB devices based on the
+ * Atmel AT76C503A/505/505A.
+ *
+ * Some iw_handler code was taken from airo.c, (C) 1999 Benjamin Reed
+ *
+ * TODO list is at the wiki:
+ *
+ * http://wireless.kernel.org/en/users/Drivers/at76c50x-usb#TODO
+ *
+ */
+
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/errno.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/spinlock.h>
+#include <linux/list.h>
+#include <linux/usb.h>
+#include <linux/netdevice.h>
+#include <linux/if_arp.h>
+#include <linux/etherdevice.h>
+#include <linux/ethtool.h>
+#include <linux/wireless.h>
+#include <net/iw_handler.h>
+#include <net/ieee80211_radiotap.h>
+#include <linux/firmware.h>
+#include <linux/leds.h>
+#include <net/mac80211.h>
+
+#include "at76c50x-usb.h"
+
+/* Version information */
+#define DRIVER_NAME "at76c50x-usb"
+#define DRIVER_VERSION  "0.17"
+#define DRIVER_DESC "Atmel at76x USB Wireless LAN Driver"
+
+/* at76_debug bits */
+#define DBG_PROGRESS            0x00000001      /* authentication/accociation */
+#define DBG_BSS_TABLE           0x00000002      /* show BSS table after scans */
+#define DBG_IOCTL               0x00000004      /* ioctl calls / settings */
+#define DBG_MAC_STATE           0x00000008      /* MAC state transitions */
+#define DBG_TX_DATA             0x00000010      /* tx header */
+#define DBG_TX_DATA_CONTENT     0x00000020      /* tx content */
+#define DBG_TX_MGMT             0x00000040      /* tx management */
+#define DBG_RX_DATA             0x00000080      /* rx data header */
+#define DBG_RX_DATA_CONTENT     0x00000100      /* rx data content */
+#define DBG_RX_MGMT             0x00000200      /* rx mgmt frame headers */
+#define DBG_RX_BEACON           0x00000400      /* rx beacon */
+#define DBG_RX_CTRL             0x00000800      /* rx control */
+#define DBG_RX_MGMT_CONTENT     0x00001000      /* rx mgmt content */
+#define DBG_RX_FRAGS            0x00002000      /* rx data fragment handling */
+#define DBG_DEVSTART            0x00004000      /* fw download, device start */
+#define DBG_URB                 0x00008000      /* rx urb status, ... */
+#define DBG_RX_ATMEL_HDR        0x00010000      /* Atmel-specific Rx headers */
+#define DBG_PROC_ENTRY          0x00020000      /* procedure entries/exits */
+#define DBG_PM                  0x00040000      /* power management settings */
+#define DBG_BSS_MATCH           0x00080000      /* BSS match failures */
+#define DBG_PARAMS              0x00100000      /* show configured parameters */
+#define DBG_WAIT_COMPLETE       0x00200000      /* command completion */
+#define DBG_RX_FRAGS_SKB        0x00400000      /* skb header of Rx fragments */
+#define DBG_BSS_TABLE_RM        0x00800000      /* purging bss table entries */
+#define DBG_MONITOR_MODE        0x01000000      /* monitor mode */
+#define DBG_MIB                 0x02000000      /* dump all MIBs on startup */
+#define DBG_MGMT_TIMER          0x04000000      /* dump mgmt_timer ops */
+#define DBG_WE_EVENTS           0x08000000      /* dump wireless events */
+#define DBG_FW                  0x10000000      /* firmware download */
+#define DBG_DFU                 0x20000000      /* device firmware upgrade */
+#define DBG_CMD                 0x40000000
+#define DBG_MAC80211            0x80000000
+
+#define DBG_DEFAULTS            0
+
+/* Use our own dbg macro */
+#define at76_dbg(bits, format, arg...) \
+        do { \
+                if (at76_debug & (bits))                                 \
+                        printk(KERN_DEBUG DRIVER_NAME ": " format "\n" , \
+                               ## arg);                                  \
+        } while (0)
+
+#define at76_dbg_dump(bits, buf, len, format, arg...)   \
+        do { \
+                if (at76_debug & (bits)) { \
+                        printk(KERN_DEBUG DRIVER_NAME ": " format "\n" , \
+                               ## arg);                                  \
+                        print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,     \
+                                             buf, len);                  \
+                }                                                        \
+        } while (0)
+
+static uint at76_debug = DBG_DEFAULTS;
+
+/* Protect against concurrent firmware loading and parsing */
+static struct mutex fw_mutex;
+
+static struct fwentry firmwares[] = {
+        [0] = { "" },
+        [BOARD_503_ISL3861] = { "atmel_at76c503-i3861.bin" },
+        [BOARD_503_ISL3863] = { "atmel_at76c503-i3863.bin" },
+        [BOARD_503] = { "atmel_at76c503-rfmd.bin" },
+        [BOARD_503_ACC] = { "atmel_at76c503-rfmd-acc.bin" },
+        [BOARD_505] = { "atmel_at76c505-rfmd.bin" },
+        [BOARD_505_2958] = { "atmel_at76c505-rfmd2958.bin" },
+        [BOARD_505A] = { "atmel_at76c505a-rfmd2958.bin" },
+        [BOARD_505AMX] = { "atmel_at76c505amx-rfmd.bin" },
+};
+
+#define USB_DEVICE_DATA(__ops)  .driver_info = (kernel_ulong_t)(__ops)
+
+static struct usb_device_id dev_table[] = {
+        /*
+         * at76c503-i3861
+         */
+        /* Generic AT76C503/3861 device */
+        { USB_DEVICE(0x03eb, 0x7603), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        /* Linksys WUSB11 v2.1/v2.6 */
+        { USB_DEVICE(0x066b, 0x2211), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        /* Netgear MA101 rev. A */
+        { USB_DEVICE(0x0864, 0x4100), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        /* Tekram U300C / Allnet ALL0193 */
+        { USB_DEVICE(0x0b3b, 0x1612), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        /* HP HN210W J7801A */
+        { USB_DEVICE(0x03f0, 0x011c), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        /* Sitecom/Z-Com/Zyxel M4Y-750 */
+        { USB_DEVICE(0x0cde, 0x0001), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        /* Dynalink/Askey WLL013 (intersil) */
+        { USB_DEVICE(0x069a, 0x0320), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        /* EZ connect 11Mpbs Wireless USB Adapter SMC2662W v1 */
+        { USB_DEVICE(0x0d5c, 0xa001), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        /* BenQ AWL300 */
+        { USB_DEVICE(0x04a5, 0x9000), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        /* Addtron AWU-120, Compex WLU11 */
+        { USB_DEVICE(0x05dd, 0xff31), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        /* Intel AP310 AnyPoint II USB */
+        { USB_DEVICE(0x8086, 0x0200), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        /* Dynalink L11U */
+        { USB_DEVICE(0x0d8e, 0x7100), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        /* Arescom WL-210, FCC id 07J-GL2411USB */
+        { USB_DEVICE(0x0d8e, 0x7110), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        /* I-O DATA WN-B11/USB */
+        { USB_DEVICE(0x04bb, 0x0919), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        /* BT Voyager 1010 */
+        { USB_DEVICE(0x069a, 0x0821), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        /*
+         * at76c503-i3863
+         */
+        /* Generic AT76C503/3863 device */
+        { USB_DEVICE(0x03eb, 0x7604), USB_DEVICE_DATA(BOARD_503_ISL3863) },
+        /* Samsung SWL-2100U */
+        { USB_DEVICE(0x055d, 0xa000), USB_DEVICE_DATA(BOARD_503_ISL3863) },
+        /*
+         * at76c503-rfmd
+         */
+        /* Generic AT76C503/RFMD device */
+        { USB_DEVICE(0x03eb, 0x7605), USB_DEVICE_DATA(BOARD_503) },
+        /* Dynalink/Askey WLL013 (rfmd) */
+        { USB_DEVICE(0x069a, 0x0321), USB_DEVICE_DATA(BOARD_503) },
+        /* Linksys WUSB11 v2.6 */
+        { USB_DEVICE(0x077b, 0x2219), USB_DEVICE_DATA(BOARD_503) },
+        /* Network Everywhere NWU11B */
+        { USB_DEVICE(0x077b, 0x2227), USB_DEVICE_DATA(BOARD_503) },
+        /* Netgear MA101 rev. B */
+        { USB_DEVICE(0x0864, 0x4102), USB_DEVICE_DATA(BOARD_503) },
+        /* D-Link DWL-120 rev. E */
+        { USB_DEVICE(0x2001, 0x3200), USB_DEVICE_DATA(BOARD_503) },
+        /* Actiontec 802UAT1, HWU01150-01UK */
+        { USB_DEVICE(0x1668, 0x7605), USB_DEVICE_DATA(BOARD_503) },
+        /* AirVast W-Buddie WN210 */
+        { USB_DEVICE(0x03eb, 0x4102), USB_DEVICE_DATA(BOARD_503) },
+        /* Dick Smith Electronics XH1153 802.11b USB adapter */
+        { USB_DEVICE(0x1371, 0x5743), USB_DEVICE_DATA(BOARD_503) },
+        /* CNet CNUSB611 */
+        { USB_DEVICE(0x1371, 0x0001), USB_DEVICE_DATA(BOARD_503) },
+        /* FiberLine FL-WL200U */
+        { USB_DEVICE(0x1371, 0x0002), USB_DEVICE_DATA(BOARD_503) },
+        /* BenQ AWL400 USB stick */
+        { USB_DEVICE(0x04a5, 0x9001), USB_DEVICE_DATA(BOARD_503) },
+        /* 3Com 3CRSHEW696 */
+        { USB_DEVICE(0x0506, 0x0a01), USB_DEVICE_DATA(BOARD_503) },
+        /* Siemens Santis ADSL WLAN USB adapter WLL 013 */
+        { USB_DEVICE(0x0681, 0x001b), USB_DEVICE_DATA(BOARD_503) },
+        /* Belkin F5D6050, version 2 */
+        { USB_DEVICE(0x050d, 0x0050), USB_DEVICE_DATA(BOARD_503) },
+        /* iBlitzz, BWU613 (not *B or *SB) */
+        { USB_DEVICE(0x07b8, 0xb000), USB_DEVICE_DATA(BOARD_503) },
+        /* Gigabyte GN-WLBM101 */
+        { USB_DEVICE(0x1044, 0x8003), USB_DEVICE_DATA(BOARD_503) },
+        /* Planex GW-US11S */
+        { USB_DEVICE(0x2019, 0x3220), USB_DEVICE_DATA(BOARD_503) },
+        /* Internal WLAN adapter in h5[4,5]xx series iPAQs */
+        { USB_DEVICE(0x049f, 0x0032), USB_DEVICE_DATA(BOARD_503) },
+        /* Corega Wireless LAN USB-11 mini */
+        { USB_DEVICE(0x07aa, 0x0011), USB_DEVICE_DATA(BOARD_503) },
+        /* Corega Wireless LAN USB-11 mini2 */
+        { USB_DEVICE(0x07aa, 0x0018), USB_DEVICE_DATA(BOARD_503) },
+        /* Uniden PCW100 */
+        { USB_DEVICE(0x05dd, 0xff35), USB_DEVICE_DATA(BOARD_503) },
+        /*
+         * at76c503-rfmd-acc
+         */
+        /* SMC2664W */
+        { USB_DEVICE(0x083a, 0x3501), USB_DEVICE_DATA(BOARD_503_ACC) },
+        /* Belkin F5D6050, SMC2662W v2, SMC2662W-AR */
+        { USB_DEVICE(0x0d5c, 0xa002), USB_DEVICE_DATA(BOARD_503_ACC) },
+        /*
+         * at76c505-rfmd
+         */
+        /* Generic AT76C505/RFMD */
+        { USB_DEVICE(0x03eb, 0x7606), USB_DEVICE_DATA(BOARD_505) },
+        /*
+         * at76c505-rfmd2958
+         */
+        /* Generic AT76C505/RFMD, OvisLink WL-1130USB */
+        { USB_DEVICE(0x03eb, 0x7613), USB_DEVICE_DATA(BOARD_505_2958) },
+        /* Fiberline FL-WL240U */
+        { USB_DEVICE(0x1371, 0x0014), USB_DEVICE_DATA(BOARD_505_2958) },
+        /* CNet CNUSB-611G */
+        { USB_DEVICE(0x1371, 0x0013), USB_DEVICE_DATA(BOARD_505_2958) },
+        /* Linksys WUSB11 v2.8 */
+        { USB_DEVICE(0x1915, 0x2233), USB_DEVICE_DATA(BOARD_505_2958) },
+        /* Xterasys XN-2122B, IBlitzz BWU613B/BWU613SB */
+        { USB_DEVICE(0x12fd, 0x1001), USB_DEVICE_DATA(BOARD_505_2958) },
+        /* Corega WLAN USB Stick 11 */
+        { USB_DEVICE(0x07aa, 0x7613), USB_DEVICE_DATA(BOARD_505_2958) },
+        /* Microstar MSI Box MS6978 */
+        { USB_DEVICE(0x0db0, 0x1020), USB_DEVICE_DATA(BOARD_505_2958) },
+        /*
+         * at76c505a-rfmd2958
+         */
+        /* Generic AT76C505A device */
+        { USB_DEVICE(0x03eb, 0x7614), USB_DEVICE_DATA(BOARD_505A) },
+        /* Generic AT76C505AS device */
+        { USB_DEVICE(0x03eb, 0x7617), USB_DEVICE_DATA(BOARD_505A) },
+        /* Siemens Gigaset USB WLAN Adapter 11 */
+        { USB_DEVICE(0x1690, 0x0701), USB_DEVICE_DATA(BOARD_505A) },
+        /*
+         * at76c505amx-rfmd
+         */
+        /* Generic AT76C505AMX device */
+        { USB_DEVICE(0x03eb, 0x7615), USB_DEVICE_DATA(BOARD_505AMX) },
+        { }
+};
+
+MODULE_DEVICE_TABLE(usb, dev_table);
+
+/* Supported rates of this hardware, bit 7 marks basic rates */
+static const u8 hw_rates[] = { 0x82, 0x84, 0x0b, 0x16 };
+
+static const char *const preambles[] = { "long", "short", "auto" };
+
+/* Firmware download */
+/* DFU states */
+#define STATE_IDLE                      0x00
+#define STATE_DETACH                    0x01
+#define STATE_DFU_IDLE                  0x02
+#define STATE_DFU_DOWNLOAD_SYNC         0x03
+#define STATE_DFU_DOWNLOAD_BUSY         0x04
+#define STATE_DFU_DOWNLOAD_IDLE         0x05
+#define STATE_DFU_MANIFEST_SYNC         0x06
+#define STATE_DFU_MANIFEST              0x07
+#define STATE_DFU_MANIFEST_WAIT_RESET   0x08
+#define STATE_DFU_UPLOAD_IDLE           0x09
+#define STATE_DFU_ERROR                 0x0a
+
+/* DFU commands */
+#define DFU_DETACH                      0
+#define DFU_DNLOAD                      1
+#define DFU_UPLOAD                      2
+#define DFU_GETSTATUS                   3
+#define DFU_CLRSTATUS                   4
+#define DFU_GETSTATE                    5
+#define DFU_ABORT                       6
+
+#define FW_BLOCK_SIZE 1024
+
+struct dfu_status {
+        unsigned char status;
+        unsigned char poll_timeout[3];
+        unsigned char state;
+        unsigned char string;
+} __attribute__((packed));
+
+static inline int at76_is_intersil(enum board_type board)
+{
+        return (board == BOARD_503_ISL3861 || board == BOARD_503_ISL3863);
+}
+
+static inline int at76_is_503rfmd(enum board_type board)
+{
+        return (board == BOARD_503 || board == BOARD_503_ACC);
+}
+
+static inline int at76_is_505a(enum board_type board)
+{
+        return (board == BOARD_505A || board == BOARD_505AMX);
+}
+
+/* Load a block of the first (internal) part of the firmware */
+static int at76_load_int_fw_block(struct usb_device *udev, int blockno,
+                                  void *block, int size)
+{
+        return usb_control_msg(udev, usb_sndctrlpipe(udev, 0), DFU_DNLOAD,
+                               USB_TYPE_CLASS | USB_DIR_OUT |
+                               USB_RECIP_INTERFACE, blockno, 0, block, size,
+                               USB_CTRL_GET_TIMEOUT);
+}
+
+static int at76_dfu_get_status(struct usb_device *udev,
+                               struct dfu_status *status)
+{
+        int ret;
+
+        ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), DFU_GETSTATUS,
+                              USB_TYPE_CLASS | USB_DIR_IN | USB_RECIP_INTERFACE,
+                              0, 0, status, sizeof(struct dfu_status),
+                              USB_CTRL_GET_TIMEOUT);
+        return ret;
+}
+
+static u8 at76_dfu_get_state(struct usb_device *udev, u8 *state)
+{
+        int ret;
+
+        ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), DFU_GETSTATE,
+                              USB_TYPE_CLASS | USB_DIR_IN | USB_RECIP_INTERFACE,
+                              0, 0, state, 1, USB_CTRL_GET_TIMEOUT);
+        return ret;
+}
+
+/* Convert timeout from the DFU status to jiffies */
+static inline unsigned long at76_get_timeout(struct dfu_status *s)
+{
+        return msecs_to_jiffies((s->poll_timeout[2] << 16)
+                                | (s->poll_timeout[1] << 8)
+                                | (s->poll_timeout[0]));
+}
+
+/* Load internal firmware from the buffer.  If manifest_sync_timeout > 0, use
+ * its value in jiffies in the MANIFEST_SYNC state.  */
+static int at76_usbdfu_download(struct usb_device *udev, u8 *buf, u32 size,
+                                int manifest_sync_timeout)
+{
+        u8 *block;
+        struct dfu_status dfu_stat_buf;
+        int ret = 0;
+        int need_dfu_state = 1;
+        int is_done = 0;
+        u8 dfu_state = 0;
+        u32 dfu_timeout = 0;
+        int bsize = 0;
+        int blockno = 0;
+
+        at76_dbg(DBG_DFU, "%s( %p, %u, %d)", __func__, buf, size,
+                 manifest_sync_timeout);
+
+        if (!size) {
+                dev_printk(KERN_ERR, &udev->dev, "FW buffer length invalid!\n");
+                return -EINVAL;
+        }
+
+        block = kmalloc(FW_BLOCK_SIZE, GFP_KERNEL);
+        if (!block)
+                return -ENOMEM;
+
+        do {
+                if (need_dfu_state) {
+                        ret = at76_dfu_get_state(udev, &dfu_state);
+                        if (ret < 0) {
+                                dev_printk(KERN_ERR, &udev->dev,
+                                           "cannot get DFU state: %d\n", ret);
+                                goto exit;
+                        }
+                        need_dfu_state = 0;
+                }
+
+                switch (dfu_state) {
+                case STATE_DFU_DOWNLOAD_SYNC:
+                        at76_dbg(DBG_DFU, "STATE_DFU_DOWNLOAD_SYNC");
+                        ret = at76_dfu_get_status(udev, &dfu_stat_buf);
+                        if (ret >= 0) {
+                                dfu_state = dfu_stat_buf.state;
+                                dfu_timeout = at76_get_timeout(&dfu_stat_buf);
+                                need_dfu_state = 0;
+                        } else
+                                dev_printk(KERN_ERR, &udev->dev,
+                                           "at76_dfu_get_status returned %d\n",
+                                           ret);
+                        break;
+
+                case STATE_DFU_DOWNLOAD_BUSY:
+                        at76_dbg(DBG_DFU, "STATE_DFU_DOWNLOAD_BUSY");
+                        need_dfu_state = 1;
+
+                        at76_dbg(DBG_DFU, "DFU: Resetting device");
+                        schedule_timeout_interruptible(dfu_timeout);
+                        break;
+
+                case STATE_DFU_DOWNLOAD_IDLE:
+                        at76_dbg(DBG_DFU, "DOWNLOAD...");
+                        /* fall through */
+                case STATE_DFU_IDLE:
+                        at76_dbg(DBG_DFU, "DFU IDLE");
+
+                        bsize = min_t(int, size, FW_BLOCK_SIZE);
+                        memcpy(block, buf, bsize);
+                        at76_dbg(DBG_DFU, "int fw, size left = %5d, "
+                                 "bsize = %4d, blockno = %2d", size, bsize,
+                                 blockno);
+                        ret =
+                            at76_load_int_fw_block(udev, blockno, block, bsize);
+                        buf += bsize;
+                        size -= bsize;
+                        blockno++;
+
+                        if (ret != bsize)
+                                dev_printk(KERN_ERR, &udev->dev,
+                                           "at76_load_int_fw_block "
+                                           "returned %d\n", ret);
+                        need_dfu_state = 1;
+                        break;
+
+                case STATE_DFU_MANIFEST_SYNC:
+                        at76_dbg(DBG_DFU, "STATE_DFU_MANIFEST_SYNC");
+
+                        ret = at76_dfu_get_status(udev, &dfu_stat_buf);
+                        if (ret < 0)
+                                break;
+
+                        dfu_state = dfu_stat_buf.state;
+                        dfu_timeout = at76_get_timeout(&dfu_stat_buf);
+                        need_dfu_state = 0;
+
+                        /* override the timeout from the status response,
+                           needed for AT76C505A */
+                        if (manifest_sync_timeout > 0)
+                                dfu_timeout = manifest_sync_timeout;
+
+                        at76_dbg(DBG_DFU, "DFU: Waiting for manifest phase");
+                        schedule_timeout_interruptible(dfu_timeout);
+                        break;
+
+                case STATE_DFU_MANIFEST:
+                        at76_dbg(DBG_DFU, "STATE_DFU_MANIFEST");
+                        is_done = 1;
+                        break;
+
+                case STATE_DFU_MANIFEST_WAIT_RESET:
+                        at76_dbg(DBG_DFU, "STATE_DFU_MANIFEST_WAIT_RESET");
+                        is_done = 1;
+                        break;
+
+                case STATE_DFU_UPLOAD_IDLE:
+                        at76_dbg(DBG_DFU, "STATE_DFU_UPLOAD_IDLE");
+                        break;
+
+                case STATE_DFU_ERROR:
+                        at76_dbg(DBG_DFU, "STATE_DFU_ERROR");
+                        ret = -EPIPE;
+                        break;
+
+                default:
+                        at76_dbg(DBG_DFU, "DFU UNKNOWN STATE (%d)", dfu_state);
+                        ret = -EINVAL;
+                        break;
+                }
+        } while (!is_done && (ret >= 0));
+
+exit:
+        kfree(block);
+        if (ret >= 0)
+                ret = 0;
+
+        return ret;
+}
+
+#define HEX2STR_BUFFERS 4
+#define HEX2STR_MAX_LEN 64
+#define BIN2HEX(x) ((x) < 10 ? '0' + (x) : (x) + 'A' - 10)
+
+/* Convert binary data into hex string */
+static char *hex2str(void *buf, int len)
+{
+        static atomic_t a = ATOMIC_INIT(0);
+        static char bufs[HEX2STR_BUFFERS][3 * HEX2STR_MAX_LEN + 1];
+        char *ret = bufs[atomic_inc_return(&a) & (HEX2STR_BUFFERS - 1)];
+        char *obuf = ret;
+        u8 *ibuf = buf;
+
+        if (len > HEX2STR_MAX_LEN)
+                len = HEX2STR_MAX_LEN;
+
+        if (len <= 0) {
+                ret[0] = '\0';
+                return ret;
+        }
+
+        while (len--) {
+                *obuf++ = BIN2HEX(*ibuf >> 4);
+                *obuf++ = BIN2HEX(*ibuf & 0xf);
+                *obuf++ = '-';
+                ibuf++;
+        }
+        *(--obuf) = '\0';
+
+        return ret;
+}
+
+#define MAC2STR_BUFFERS 4
+
+static inline char *mac2str(u8 *mac)
+{
+        static atomic_t a = ATOMIC_INIT(0);
+        static char bufs[MAC2STR_BUFFERS][6 * 3];
+        char *str;
+
+        str = bufs[atomic_inc_return(&a) & (MAC2STR_BUFFERS - 1)];
+        sprintf(str, "%02x:%02x:%02x:%02x:%02x:%02x",
+                mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]);
+        return str;
+}
+
+/* LED trigger */
+static int tx_activity;
+static void at76_ledtrig_tx_timerfunc(unsigned long data);
+static DEFINE_TIMER(ledtrig_tx_timer, at76_ledtrig_tx_timerfunc, 0, 0);
+DEFINE_LED_TRIGGER(ledtrig_tx);
+
+static void at76_ledtrig_tx_timerfunc(unsigned long data)
+{
+        static int tx_lastactivity;
+
+        if (tx_lastactivity != tx_activity) {
+                tx_lastactivity = tx_activity;
+                led_trigger_event(ledtrig_tx, LED_FULL);
+                mod_timer(&ledtrig_tx_timer, jiffies + HZ / 4);
+        } else
+                led_trigger_event(ledtrig_tx, LED_OFF);
+}
+
+static void at76_ledtrig_tx_activity(void)
+{
+        tx_activity++;
+        if (!timer_pending(&ledtrig_tx_timer))
+                mod_timer(&ledtrig_tx_timer, jiffies + HZ / 4);
+}
+
+static int at76_remap(struct usb_device *udev)
+{
+        int ret;
+        ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), 0x0a,
+                              USB_TYPE_VENDOR | USB_DIR_OUT |
+                              USB_RECIP_INTERFACE, 0, 0, NULL, 0,
+                              USB_CTRL_GET_TIMEOUT);
+        if (ret < 0)
+                return ret;
+        return 0;
+}
+
+static int at76_get_op_mode(struct usb_device *udev)
+{
+        int ret;
+        u8 saved;
+        u8 *op_mode;
+
+        op_mode = kmalloc(1, GFP_NOIO);
+        if (!op_mode)
+                return -ENOMEM;
+        ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), 0x33,
+                              USB_TYPE_VENDOR | USB_DIR_IN |
+                              USB_RECIP_INTERFACE, 0x01, 0, op_mode, 1,
+                              USB_CTRL_GET_TIMEOUT);
+        saved = *op_mode;
+        kfree(op_mode);
+
+        if (ret < 0)
+                return ret;
+        else if (ret < 1)
+                return -EIO;
+        else
+                return saved;
+}
+
+/* Load a block of the second ("external") part of the firmware */
+static inline int at76_load_ext_fw_block(struct usb_device *udev, int blockno,
+                                         void *block, int size)
+{
+        return usb_control_msg(udev, usb_sndctrlpipe(udev, 0), 0x0e,
+                               USB_TYPE_VENDOR | USB_DIR_OUT | USB_RECIP_DEVICE,
+                               0x0802, blockno, block, size,
+                               USB_CTRL_GET_TIMEOUT);
+}
+
+static inline int at76_get_hw_cfg(struct usb_device *udev,
+                                  union at76_hwcfg *buf, int buf_size)
+{
+        return usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), 0x33,
+                               USB_TYPE_VENDOR | USB_DIR_IN |
+                               USB_RECIP_INTERFACE, 0x0a02, 0,
+                               buf, buf_size, USB_CTRL_GET_TIMEOUT);
+}
+
+/* Intersil boards use a different "value" for GetHWConfig requests */
+static inline int at76_get_hw_cfg_intersil(struct usb_device *udev,
+                                           union at76_hwcfg *buf, int buf_size)
+{
+        return usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), 0x33,
+                               USB_TYPE_VENDOR | USB_DIR_IN |
+                               USB_RECIP_INTERFACE, 0x0902, 0,
+                               buf, buf_size, USB_CTRL_GET_TIMEOUT);
+}
+
+/* Get the hardware configuration for the adapter and put it to the appropriate
+ * fields of 'priv' (the GetHWConfig request and interpretation of the result
+ * depends on the board type) */
+static int at76_get_hw_config(struct at76_priv *priv)
+{
+        int ret;
+        union at76_hwcfg *hwcfg = kmalloc(sizeof(*hwcfg), GFP_KERNEL);
+
+        if (!hwcfg)
+                return -ENOMEM;
+
+        if (at76_is_intersil(priv->board_type)) {
+                ret = at76_get_hw_cfg_intersil(priv->udev, hwcfg,
+                                               sizeof(hwcfg->i));
+                if (ret < 0)
+                        goto exit;
+                memcpy(priv->mac_addr, hwcfg->i.mac_addr, ETH_ALEN);
+                priv->regulatory_domain = hwcfg->i.regulatory_domain;
+        } else if (at76_is_503rfmd(priv->board_type)) {
+                ret = at76_get_hw_cfg(priv->udev, hwcfg, sizeof(hwcfg->r3));
+                if (ret < 0)
+                        goto exit;
+                memcpy(priv->mac_addr, hwcfg->r3.mac_addr, ETH_ALEN);
+                priv->regulatory_domain = hwcfg->r3.regulatory_domain;
+        } else {
+                ret = at76_get_hw_cfg(priv->udev, hwcfg, sizeof(hwcfg->r5));
+                if (ret < 0)
+                        goto exit;
+                memcpy(priv->mac_addr, hwcfg->r5.mac_addr, ETH_ALEN);
+                priv->regulatory_domain = hwcfg->r5.regulatory_domain;
+        }
+
+exit:
+        kfree(hwcfg);
+        if (ret < 0)
+                printk(KERN_ERR "%s: cannot get HW Config (error %d)\n",
+                       wiphy_name(priv->hw->wiphy), ret);
+
+        return ret;
+}
+
+static struct reg_domain const *at76_get_reg_domain(u16 code)
+{
+        int i;
+        static struct reg_domain const fd_tab[] = {
+                { 0x10, "FCC (USA)", 0x7ff },   /* ch 1-11 */
+                { 0x20, "IC (Canada)", 0x7ff }, /* ch 1-11 */
+                { 0x30, "ETSI (most of Europe)", 0x1fff },      /* ch 1-13 */
+                { 0x31, "Spain", 0x600 },       /* ch 10-11 */
+                { 0x32, "France", 0x1e00 },     /* ch 10-13 */
+                { 0x40, "MKK (Japan)", 0x2000 },        /* ch 14 */
+                { 0x41, "MKK1 (Japan)", 0x3fff },       /* ch 1-14 */
+                { 0x50, "Israel", 0x3fc },      /* ch 3-9 */
+                { 0x00, "<unknown>", 0xffffffff }       /* ch 1-32 */
+        };
+
+        /* Last entry is fallback for unknown domain code */
+        for (i = 0; i < ARRAY_SIZE(fd_tab) - 1; i++)
+                if (code == fd_tab[i].code)
+                        break;
+
+        return &fd_tab[i];
+}
+
+static inline int at76_get_mib(struct usb_device *udev, u16 mib, void *buf,
+                               int buf_size)
+{
+        int ret;
+
+        ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), 0x33,
+                              USB_TYPE_VENDOR | USB_DIR_IN |
+                              USB_RECIP_INTERFACE, mib << 8, 0, buf, buf_size,
+                              USB_CTRL_GET_TIMEOUT);
+        if (ret >= 0 && ret != buf_size)
+                return -EIO;
+        return ret;
+}
+
+/* Return positive number for status, negative for an error */
+static inline int at76_get_cmd_status(struct usb_device *udev, u8 cmd)
+{
+        u8 *stat_buf;
+        int ret;
+
+        stat_buf = kmalloc(40, GFP_NOIO);
+        if (!stat_buf)
+                return -ENOMEM;
+
+        ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), 0x22,
+                        USB_TYPE_VENDOR | USB_DIR_IN |
+                        USB_RECIP_INTERFACE, cmd, 0, stat_buf,
+                        40, USB_CTRL_GET_TIMEOUT);
+        if (ret >= 0)
+                ret = stat_buf[5];
+        kfree(stat_buf);
+
+        return ret;
+}
+
+#define MAKE_CMD_CASE(c) case (c): return #c
+static const char *at76_get_cmd_string(u8 cmd_status)
+{
+        switch (cmd_status) {
+                MAKE_CMD_CASE(CMD_SET_MIB);
+                MAKE_CMD_CASE(CMD_GET_MIB);
+                MAKE_CMD_CASE(CMD_SCAN);
+                MAKE_CMD_CASE(CMD_JOIN);
+                MAKE_CMD_CASE(CMD_START_IBSS);
+                MAKE_CMD_CASE(CMD_RADIO_ON);
+                MAKE_CMD_CASE(CMD_RADIO_OFF);
+                MAKE_CMD_CASE(CMD_STARTUP);
+        }
+
+        return "UNKNOWN";
+}
+
+static int at76_set_card_command(struct usb_device *udev, u8 cmd, void *buf,
+                                 int buf_size)
+{
+        int ret;
+        struct at76_command *cmd_buf = kmalloc(sizeof(struct at76_command) +
+                                               buf_size, GFP_KERNEL);
+
+        if (!cmd_buf)
+                return -ENOMEM;
+
+        cmd_buf->cmd = cmd;
+        cmd_buf->reserved = 0;
+        cmd_buf->size = cpu_to_le16(buf_size);
+        memcpy(cmd_buf->data, buf, buf_size);
+
+        at76_dbg_dump(DBG_CMD, cmd_buf, sizeof(struct at76_command) + buf_size,
+                      "issuing command %s (0x%02x)",
+                      at76_get_cmd_string(cmd), cmd);
+
+        ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), 0x0e,
+                              USB_TYPE_VENDOR | USB_DIR_OUT | USB_RECIP_DEVICE,
+                              0, 0, cmd_buf,
+                              sizeof(struct at76_command) + buf_size,
+                              USB_CTRL_GET_TIMEOUT);
+        kfree(cmd_buf);
+        return ret;
+}
+
+#define MAKE_CMD_STATUS_CASE(c) case (c): return #c
+static const char *at76_get_cmd_status_string(u8 cmd_status)
+{
+        switch (cmd_status) {
+                MAKE_CMD_STATUS_CASE(CMD_STATUS_IDLE);
+                MAKE_CMD_STATUS_CASE(CMD_STATUS_COMPLETE);
+                MAKE_CMD_STATUS_CASE(CMD_STATUS_UNKNOWN);
+                MAKE_CMD_STATUS_CASE(CMD_STATUS_INVALID_PARAMETER);
+                MAKE_CMD_STATUS_CASE(CMD_STATUS_FUNCTION_NOT_SUPPORTED);
+                MAKE_CMD_STATUS_CASE(CMD_STATUS_TIME_OUT);
+                MAKE_CMD_STATUS_CASE(CMD_STATUS_IN_PROGRESS);
+                MAKE_CMD_STATUS_CASE(CMD_STATUS_HOST_FAILURE);
+                MAKE_CMD_STATUS_CASE(CMD_STATUS_SCAN_FAILED);
+        }
+
+        return "UNKNOWN";
+}
+
+/* Wait until the command is completed */
+static int at76_wait_completion(struct at76_priv *priv, int cmd)
+{
+        int status = 0;
+        unsigned long timeout = jiffies + CMD_COMPLETION_TIMEOUT;
+
+        do {
+                status = at76_get_cmd_status(priv->udev, cmd);
+                if (status < 0) {
+                        printk(KERN_ERR "%s: at76_get_cmd_status failed: %d\n",
+                               wiphy_name(priv->hw->wiphy), status);
+                        break;
+                }
+
+                at76_dbg(DBG_WAIT_COMPLETE,
+                         "%s: Waiting on cmd %d, status = %d (%s)",
+                         wiphy_name(priv->hw->wiphy), cmd, status,
+                         at76_get_cmd_status_string(status));
+
+                if (status != CMD_STATUS_IN_PROGRESS
+                    && status != CMD_STATUS_IDLE)
+                        break;
+
+                schedule_timeout_interruptible(HZ / 10);        /* 100 ms */
+                if (time_after(jiffies, timeout)) {
+                        printk(KERN_ERR
+                               "%s: completion timeout for command %d\n",
+                               wiphy_name(priv->hw->wiphy), cmd);
+                        status = -ETIMEDOUT;
+                        break;
+                }
+        } while (1);
+
+        return status;
+}
+
+static int at76_set_mib(struct at76_priv *priv, struct set_mib_buffer *buf)
+{
+        int ret;
+
+        ret = at76_set_card_command(priv->udev, CMD_SET_MIB, buf,
+                                    offsetof(struct set_mib_buffer,
+                                             data) + buf->size);
+        if (ret < 0)
+                return ret;
+
+        ret = at76_wait_completion(priv, CMD_SET_MIB);
+        if (ret != CMD_STATUS_COMPLETE) {
+                printk(KERN_INFO
+                       "%s: set_mib: at76_wait_completion failed "
+                       "with %d\n", wiphy_name(priv->hw->wiphy), ret);
+                ret = -EIO;
+        }
+
+        return ret;
+}
+
+/* Return < 0 on error, == 0 if no command sent, == 1 if cmd sent */
+static int at76_set_radio(struct at76_priv *priv, int enable)
+{
+        int ret;
+        int cmd;
+
+        if (priv->radio_on == enable)
+                return 0;
+
+        cmd = enable ? CMD_RADIO_ON : CMD_RADIO_OFF;
+
+        ret = at76_set_card_command(priv->udev, cmd, NULL, 0);
+        if (ret < 0)
+                printk(KERN_ERR "%s: at76_set_card_command(%d) failed: %d\n",
+                       wiphy_name(priv->hw->wiphy), cmd, ret);
+        else
+                ret = 1;
+
+        priv->radio_on = enable;
+        return ret;
+}
+
+/* Set current power save mode (AT76_PM_OFF/AT76_PM_ON/AT76_PM_SMART) */
+static int at76_set_pm_mode(struct at76_priv *priv)
+{
+        int ret = 0;
+
+        priv->mib_buf.type = MIB_MAC_MGMT;
+        priv->mib_buf.size = 1;
+        priv->mib_buf.index = offsetof(struct mib_mac_mgmt, power_mgmt_mode);
+        priv->mib_buf.data.byte = priv->pm_mode;
+
+        ret = at76_set_mib(priv, &priv->mib_buf);
+        if (ret < 0)
+                printk(KERN_ERR "%s: set_mib (pm_mode) failed: %d\n",
+                       wiphy_name(priv->hw->wiphy), ret);
+
+        return ret;
+}
+
+static int at76_set_preamble(struct at76_priv *priv, u8 type)
+{
+        int ret = 0;
+
+        priv->mib_buf.type = MIB_LOCAL;
+        priv->mib_buf.size = 1;
+        priv->mib_buf.index = offsetof(struct mib_local, preamble_type);
+        priv->mib_buf.data.byte = type;
+
+        ret = at76_set_mib(priv, &priv->mib_buf);
+        if (ret < 0)
+                printk(KERN_ERR "%s: set_mib (preamble) failed: %d\n",
+                       wiphy_name(priv->hw->wiphy), ret);
+
+        return ret;
+}
+
+static int at76_set_frag(struct at76_priv *priv, u16 size)
+{
+        int ret = 0;
+
+        priv->mib_buf.type = MIB_MAC;
+        priv->mib_buf.size = 2;
+        priv->mib_buf.index = offsetof(struct mib_mac, frag_threshold);
+        priv->mib_buf.data.word = cpu_to_le16(size);
+
+        ret = at76_set_mib(priv, &priv->mib_buf);
+        if (ret < 0)
+                printk(KERN_ERR "%s: set_mib (frag threshold) failed: %d\n",
+                       wiphy_name(priv->hw->wiphy), ret);
+
+        return ret;
+}
+
+static int at76_set_rts(struct at76_priv *priv, u16 size)
+{
+        int ret = 0;
+
+        priv->mib_buf.type = MIB_MAC;
+        priv->mib_buf.size = 2;
+        priv->mib_buf.index = offsetof(struct mib_mac, rts_threshold);
+        priv->mib_buf.data.word = cpu_to_le16(size);
+
+        ret = at76_set_mib(priv, &priv->mib_buf);
+        if (ret < 0)
+                printk(KERN_ERR "%s: set_mib (rts) failed: %d\n",
+                       wiphy_name(priv->hw->wiphy), ret);
+
+        return ret;
+}
+
+static int at76_set_autorate_fallback(struct at76_priv *priv, int onoff)
+{
+        int ret = 0;
+
+        priv->mib_buf.type = MIB_LOCAL;
+        priv->mib_buf.size = 1;
+        priv->mib_buf.index = offsetof(struct mib_local, txautorate_fallback);
+        priv->mib_buf.data.byte = onoff;
+
+        ret = at76_set_mib(priv, &priv->mib_buf);
+        if (ret < 0)
+                printk(KERN_ERR "%s: set_mib (autorate fallback) failed: %d\n",
+                       wiphy_name(priv->hw->wiphy), ret);
+
+        return ret;
+}
+
+static void at76_dump_mib_mac_addr(struct at76_priv *priv)
+{
+        int i;
+        int ret;
+        struct mib_mac_addr *m = kmalloc(sizeof(struct mib_mac_addr),
+                                         GFP_KERNEL);
+
+        if (!m)
+                return;
+
+        ret = at76_get_mib(priv->udev, MIB_MAC_ADDR, m,
+                           sizeof(struct mib_mac_addr));
+        if (ret < 0) {
+                printk(KERN_ERR "%s: at76_get_mib (MAC_ADDR) failed: %d\n",
+                       wiphy_name(priv->hw->wiphy), ret);
+                goto exit;
+        }
+
+        at76_dbg(DBG_MIB, "%s: MIB MAC_ADDR: mac_addr %s res 0x%x 0x%x",
+                 wiphy_name(priv->hw->wiphy),
+                 mac2str(m->mac_addr), m->res[0], m->res[1]);
+        for (i = 0; i < ARRAY_SIZE(m->group_addr); i++)
+                at76_dbg(DBG_MIB, "%s: MIB MAC_ADDR: group addr %d: %s, "
+                         "status %d", wiphy_name(priv->hw->wiphy), i,
+                         mac2str(m->group_addr[i]), m->group_addr_status[i]);
+exit:
+        kfree(m);
+}
+
+static void at76_dump_mib_mac_wep(struct at76_priv *priv)
+{
+        int i;
+        int ret;
+        int key_len;
+        struct mib_mac_wep *m = kmalloc(sizeof(struct mib_mac_wep), GFP_KERNEL);
+
+        if (!m)
+                return;
+
+        ret = at76_get_mib(priv->udev, MIB_MAC_WEP, m,
+                           sizeof(struct mib_mac_wep));
+        if (ret < 0) {
+                printk(KERN_ERR "%s: at76_get_mib (MAC_WEP) failed: %d\n",
+                       wiphy_name(priv->hw->wiphy), ret);
+                goto exit;
+        }
+
+        at76_dbg(DBG_MIB, "%s: MIB MAC_WEP: priv_invoked %u def_key_id %u "
+                 "key_len %u excl_unencr %u wep_icv_err %u wep_excluded %u "
+                 "encr_level %u key %d", wiphy_name(priv->hw->wiphy),
+                 m->privacy_invoked, m->wep_default_key_id,
+                 m->wep_key_mapping_len, m->exclude_unencrypted,
+                 le32_to_cpu(m->wep_icv_error_count),
+                 le32_to_cpu(m->wep_excluded_count), m->encryption_level,
+                 m->wep_default_key_id);
+
+        key_len = (m->encryption_level == 1) ?
+            WEP_SMALL_KEY_LEN : WEP_LARGE_KEY_LEN;
+
+        for (i = 0; i < WEP_KEYS; i++)
+                at76_dbg(DBG_MIB, "%s: MIB MAC_WEP: key %d: %s",
+                         wiphy_name(priv->hw->wiphy), i,
+                         hex2str(m->wep_default_keyvalue[i], key_len));
+exit:
+        kfree(m);
+}
+
+static void at76_dump_mib_mac_mgmt(struct at76_priv *priv)
+{
+        int ret;
+        struct mib_mac_mgmt *m = kmalloc(sizeof(struct mib_mac_mgmt),
+                                         GFP_KERNEL);
+
+        if (!m)
+                return;
+
+        ret = at76_get_mib(priv->udev, MIB_MAC_MGMT, m,
+                           sizeof(struct mib_mac_mgmt));
+        if (ret < 0) {
+                printk(KERN_ERR "%s: at76_get_mib (MAC_MGMT) failed: %d\n",
+                       wiphy_name(priv->hw->wiphy), ret);
+                goto exit;
+        }
+
+        at76_dbg(DBG_MIB, "%s: MIB MAC_MGMT: beacon_period %d CFP_max_duration "
+                 "%d medium_occupancy_limit %d station_id 0x%x ATIM_window %d "
+                 "CFP_mode %d privacy_opt_impl %d DTIM_period %d CFP_period %d "
+                 "current_bssid %s current_essid %s current_bss_type %d "
+                 "pm_mode %d ibss_change %d res %d "
+                 "multi_domain_capability_implemented %d "
+                 "international_roaming %d country_string %.3s",
+                 wiphy_name(priv->hw->wiphy), le16_to_cpu(m->beacon_period),
+                 le16_to_cpu(m->CFP_max_duration),
+                 le16_to_cpu(m->medium_occupancy_limit),
+                 le16_to_cpu(m->station_id), le16_to_cpu(m->ATIM_window),
+                 m->CFP_mode, m->privacy_option_implemented, m->DTIM_period,
+                 m->CFP_period, mac2str(m->current_bssid),
+                 hex2str(m->current_essid, IW_ESSID_MAX_SIZE),
+                 m->current_bss_type, m->power_mgmt_mode, m->ibss_change,
+                 m->res, m->multi_domain_capability_implemented,
+                 m->multi_domain_capability_enabled, m->country_string);
+exit:
+        kfree(m);
+}
+
+static void at76_dump_mib_mac(struct at76_priv *priv)
+{
+        int ret;
+        struct mib_mac *m = kmalloc(sizeof(struct mib_mac), GFP_KERNEL);
+
+        if (!m)
+                return;
+
+        ret = at76_get_mib(priv->udev, MIB_MAC, m, sizeof(struct mib_mac));
+        if (ret < 0) {
+                printk(KERN_ERR "%s: at76_get_mib (MAC) failed: %d\n",
+                       wiphy_name(priv->hw->wiphy), ret);
+                goto exit;
+        }
+
+        at76_dbg(DBG_MIB, "%s: MIB MAC: max_tx_msdu_lifetime %d "
+                 "max_rx_lifetime %d frag_threshold %d rts_threshold %d "
+                 "cwmin %d cwmax %d short_retry_time %d long_retry_time %d "
+                 "scan_type %d scan_channel %d probe_delay %u "
+                 "min_channel_time %d max_channel_time %d listen_int %d "
+                 "desired_ssid %s desired_bssid %s desired_bsstype %d",
+                 wiphy_name(priv->hw->wiphy),
+                 le32_to_cpu(m->max_tx_msdu_lifetime),
+                 le32_to_cpu(m->max_rx_lifetime),
+                 le16_to_cpu(m->frag_threshold), le16_to_cpu(m->rts_threshold),
+                 le16_to_cpu(m->cwmin), le16_to_cpu(m->cwmax),
+                 m->short_retry_time, m->long_retry_time, m->scan_type,
+                 m->scan_channel, le16_to_cpu(m->probe_delay),
+                 le16_to_cpu(m->min_channel_time),
+                 le16_to_cpu(m->max_channel_time),
+                 le16_to_cpu(m->listen_interval),
+                 hex2str(m->desired_ssid, IW_ESSID_MAX_SIZE),
+                 mac2str(m->desired_bssid), m->desired_bsstype);
+exit:
+        kfree(m);
+}
+
+static void at76_dump_mib_phy(struct at76_priv *priv)
+{
+        int ret;
+        struct mib_phy *m = kmalloc(sizeof(struct mib_phy), GFP_KERNEL);
+
+        if (!m)
+                return;
+
+        ret = at76_get_mib(priv->udev, MIB_PHY, m, sizeof(struct mib_phy));
+        if (ret < 0) {
+                printk(KERN_ERR "%s: at76_get_mib (PHY) failed: %d\n",
+                       wiphy_name(priv->hw->wiphy), ret);
+                goto exit;
+        }
+
+        at76_dbg(DBG_MIB, "%s: MIB PHY: ed_threshold %d slot_time %d "
+                 "sifs_time %d preamble_length %d plcp_header_length %d "
+                 "mpdu_max_length %d cca_mode_supported %d operation_rate_set "
+                 "0x%x 0x%x 0x%x 0x%x channel_id %d current_cca_mode %d "
+                 "phy_type %d current_reg_domain %d",
+                 wiphy_name(priv->hw->wiphy), le32_to_cpu(m->ed_threshold),
+                 le16_to_cpu(m->slot_time), le16_to_cpu(m->sifs_time),
+                 le16_to_cpu(m->preamble_length),
+                 le16_to_cpu(m->plcp_header_length),
+                 le16_to_cpu(m->mpdu_max_length),
+                 le16_to_cpu(m->cca_mode_supported), m->operation_rate_set[0],
+                 m->operation_rate_set[1], m->operation_rate_set[2],
+                 m->operation_rate_set[3], m->channel_id, m->current_cca_mode,
+                 m->phy_type, m->current_reg_domain);
+exit:
+        kfree(m);
+}
+
+static void at76_dump_mib_local(struct at76_priv *priv)
+{
+        int ret;
+        struct mib_local *m = kmalloc(sizeof(struct mib_phy), GFP_KERNEL);
+
+        if (!m)
+                return;
+
+        ret = at76_get_mib(priv->udev, MIB_LOCAL, m, sizeof(struct mib_local));
+        if (ret < 0) {
+                printk(KERN_ERR "%s: at76_get_mib (LOCAL) failed: %d\n",
+                       wiphy_name(priv->hw->wiphy), ret);
+                goto exit;
+        }
+
+        at76_dbg(DBG_MIB, "%s: MIB LOCAL: beacon_enable %d "
+                 "txautorate_fallback %d ssid_size %d promiscuous_mode %d "
+                 "preamble_type %d", wiphy_name(priv->hw->wiphy),
+                 m->beacon_enable,
+                 m->txautorate_fallback, m->ssid_size, m->promiscuous_mode,
+                 m->preamble_type);
+exit:
+        kfree(m);
+}
+
+static void at76_dump_mib_mdomain(struct at76_priv *priv)
+{
+        int ret;
+        struct mib_mdomain *m = kmalloc(sizeof(struct mib_mdomain), GFP_KERNEL);
+
+        if (!m)
+                return;
+
+        ret = at76_get_mib(priv->udev, MIB_MDOMAIN, m,
+                           sizeof(struct mib_mdomain));
+        if (ret < 0) {
+                printk(KERN_ERR "%s: at76_get_mib (MDOMAIN) failed: %d\n",
+                       wiphy_name(priv->hw->wiphy), ret);
+                goto exit;
+        }
+
+        at76_dbg(DBG_MIB, "%s: MIB MDOMAIN: channel_list %s",
+                 wiphy_name(priv->hw->wiphy),
+                 hex2str(m->channel_list, sizeof(m->channel_list)));
+
+        at76_dbg(DBG_MIB, "%s: MIB MDOMAIN: tx_powerlevel %s",
+                 wiphy_name(priv->hw->wiphy),
+                 hex2str(m->tx_powerlevel, sizeof(m->tx_powerlevel)));
+exit:
+        kfree(m);
+}
+
+/* Enable monitor mode */
+static int at76_start_monitor(struct at76_priv *priv)
+{
+        struct at76_req_scan scan;
+        int ret;
+
+        memset(&scan, 0, sizeof(struct at76_req_scan));
+        memset(scan.bssid, 0xff, ETH_ALEN);
+
+        scan.channel = priv->channel;
+        scan.scan_type = SCAN_TYPE_PASSIVE;
+        scan.international_scan = 0;
+
+        ret = at76_set_card_command(priv->udev, CMD_SCAN, &scan, sizeof(scan));
+        if (ret >= 0)
+                ret = at76_get_cmd_status(priv->udev, CMD_SCAN);
+
+        return ret;
+}
+
+/* Calculate padding from txbuf->wlength (which excludes the USB TX header),
+   likely to compensate a flaw in the AT76C503A USB part ... */
+static inline int at76_calc_padding(int wlen)
+{
+        /* add the USB TX header */
+        wlen += AT76_TX_HDRLEN;
+
+        wlen = wlen % 64;
+
+        if (wlen < 50)
+                return 50 - wlen;
+
+        if (wlen >= 61)
+                return 64 + 50 - wlen;
+
+        return 0;
+}
+
+static void at76_rx_callback(struct urb *urb)
+{
+        struct at76_priv *priv = urb->context;
+
+        priv->rx_tasklet.data = (unsigned long)urb;
+        tasklet_schedule(&priv->rx_tasklet);
+        return;
+}
+
+static int at76_submit_rx_urb(struct at76_priv *priv)
+{
+        int ret;
+        int size;
+        struct sk_buff *skb = priv->rx_skb;
+
+        if (!priv->rx_urb) {
+                printk(KERN_ERR "%s: %s: priv->rx_urb is NULL\n",
+                       wiphy_name(priv->hw->wiphy), __func__);
+                return -EFAULT;
+        }
+
+        if (!skb) {
+                skb = dev_alloc_skb(sizeof(struct at76_rx_buffer));
+                if (!skb) {
+                        printk(KERN_ERR "%s: cannot allocate rx skbuff\n",
+                               wiphy_name(priv->hw->wiphy));
+                        ret = -ENOMEM;
+                        goto exit;
+                }
+                priv->rx_skb = skb;
+        } else {
+                skb_push(skb, skb_headroom(skb));
+                skb_trim(skb, 0);
+        }
+
+        size = skb_tailroom(skb);
+        usb_fill_bulk_urb(priv->rx_urb, priv->udev, priv->rx_pipe,
+                          skb_put(skb, size), size, at76_rx_callback, priv);
+        ret = usb_submit_urb(priv->rx_urb, GFP_ATOMIC);
+        if (ret < 0) {
+                if (ret == -ENODEV)
+                        at76_dbg(DBG_DEVSTART,
+                                 "usb_submit_urb returned -ENODEV");
+                else
+                        printk(KERN_ERR "%s: rx, usb_submit_urb failed: %d\n",
+                               wiphy_name(priv->hw->wiphy), ret);
+        }
+
+exit:
+        if (ret < 0 && ret != -ENODEV)
+                printk(KERN_ERR "%s: cannot submit rx urb - please unload the "
+                       "driver and/or power cycle the device\n",
+                       wiphy_name(priv->hw->wiphy));
+
+        return ret;
+}
+
+/* Download external firmware */
+static int at76_load_external_fw(struct usb_device *udev, struct fwentry *fwe)
+{
+        int ret;
+        int op_mode;
+        int blockno = 0;
+        int bsize;
+        u8 *block;
+        u8 *buf = fwe->extfw;
+        int size = fwe->extfw_size;
+
+        if (!buf || !size)
+                return -ENOENT;
+
+        op_mode = at76_get_op_mode(udev);
+        at76_dbg(DBG_DEVSTART, "opmode %d", op_mode);
+
+        if (op_mode != OPMODE_NORMAL_NIC_WITHOUT_FLASH) {
+                dev_printk(KERN_ERR, &udev->dev, "unexpected opmode %d\n",
+                           op_mode);
+                return -EINVAL;
+        }
+
+        block = kmalloc(FW_BLOCK_SIZE, GFP_KERNEL);
+        if (!block)
+                return -ENOMEM;
+
+        at76_dbg(DBG_DEVSTART, "downloading external firmware");
+
+        /* for fw >= 0.100, the device needs an extra empty block */
+        do {
+                bsize = min_t(int, size, FW_BLOCK_SIZE);
+                memcpy(block, buf, bsize);
+                at76_dbg(DBG_DEVSTART,
+                         "ext fw, size left = %5d, bsize = %4d, blockno = %2d",
+                         size, bsize, blockno);
+                ret = at76_load_ext_fw_block(udev, blockno, block, bsize);
+                if (ret != bsize) {
+                        dev_printk(KERN_ERR, &udev->dev,
+                                   "loading %dth firmware block failed: %d\n",
+                                   blockno, ret);
+                        goto exit;
+                }
+                buf += bsize;
+                size -= bsize;
+                blockno++;
+        } while (bsize > 0);
+
+        if (at76_is_505a(fwe->board_type)) {
+                at76_dbg(DBG_DEVSTART, "200 ms delay for 505a");
+                schedule_timeout_interruptible(HZ / 5 + 1);
+        }
+
+exit:
+        kfree(block);
+        if (ret < 0)
+                dev_printk(KERN_ERR, &udev->dev,
+                           "downloading external firmware failed: %d\n", ret);
+        return ret;
+}
+
+/* Download internal firmware */
+static int at76_load_internal_fw(struct usb_device *udev, struct fwentry *fwe)
+{
+        int ret;
+        int need_remap = !at76_is_505a(fwe->board_type);
+
+        ret = at76_usbdfu_download(udev, fwe->intfw, fwe->intfw_size,
+                                   need_remap ? 0 : 2 * HZ);
+
+        if (ret < 0) {
+                dev_printk(KERN_ERR, &udev->dev,
+                           "downloading internal fw failed with %d\n", ret);
+                goto exit;
+        }
+
+        at76_dbg(DBG_DEVSTART, "sending REMAP");
+
+        /* no REMAP for 505A (see SF driver) */
+        if (need_remap) {
+                ret = at76_remap(udev);
+                if (ret < 0) {
+                        dev_printk(KERN_ERR, &udev->dev,
+                                   "sending REMAP failed with %d\n", ret);
+                        goto exit;
+                }
+        }
+
+        at76_dbg(DBG_DEVSTART, "sleeping for 2 seconds");
+        schedule_timeout_interruptible(2 * HZ + 1);
+        usb_reset_device(udev);
+
+exit:
+        return ret;
+}
+
+static int at76_startup_device(struct at76_priv *priv)
+{
+        struct at76_card_config *ccfg = &priv->card_config;
+        int ret;
+
+        at76_dbg(DBG_PARAMS,
+                 "%s param: ssid %.*s (%s) mode %s ch %d wep %s key %d "
+                 "keylen %d", wiphy_name(priv->hw->wiphy), priv->essid_size,
+                 priv->essid, hex2str(priv->essid, IW_ESSID_MAX_SIZE),
+                 priv->iw_mode == IW_MODE_ADHOC ? "adhoc" : "infra",
+                 priv->channel, priv->wep_enabled ? "enabled" : "disabled",
+                 priv->wep_key_id, priv->wep_keys_len[priv->wep_key_id]);
+        at76_dbg(DBG_PARAMS,
+                 "%s param: preamble %s rts %d retry %d frag %d "
+                 "txrate %s auth_mode %d", wiphy_name(priv->hw->wiphy),
+                 preambles[priv->preamble_type], priv->rts_threshold,
+                 priv->short_retry_limit, priv->frag_threshold,
+                 priv->txrate == TX_RATE_1MBIT ? "1MBit" : priv->txrate ==
+                 TX_RATE_2MBIT ? "2MBit" : priv->txrate ==
+                 TX_RATE_5_5MBIT ? "5.5MBit" : priv->txrate ==
+                 TX_RATE_11MBIT ? "11MBit" : priv->txrate ==
+                 TX_RATE_AUTO ? "auto" : "<invalid>", priv->auth_mode);
+        at76_dbg(DBG_PARAMS,
+                 "%s param: pm_mode %d pm_period %d auth_mode %s "
+                 "scan_times %d %d scan_mode %s",
+                 wiphy_name(priv->hw->wiphy), priv->pm_mode, priv->pm_period,
+                 priv->auth_mode == WLAN_AUTH_OPEN ? "open" : "shared_secret",
+                 priv->scan_min_time, priv->scan_max_time,
+                 priv->scan_mode == SCAN_TYPE_ACTIVE ? "active" : "passive");
+
+        memset(ccfg, 0, sizeof(struct at76_card_config));
+        ccfg->promiscuous_mode = 0;
+        ccfg->short_retry_limit = priv->short_retry_limit;
+
+        if (priv->wep_enabled) {
+                if (priv->wep_keys_len[priv->wep_key_id] > WEP_SMALL_KEY_LEN)
+                        ccfg->encryption_type = 2;
+                else
+                        ccfg->encryption_type = 1;
+
+                /* jal: always exclude unencrypted if WEP is active */
+                ccfg->exclude_unencrypted = 1;
+        } else {
+                ccfg->exclude_unencrypted = 0;
+                ccfg->encryption_type = 0;
+        }
+
+        ccfg->rts_threshold = cpu_to_le16(priv->rts_threshold);
+        ccfg->fragmentation_threshold = cpu_to_le16(priv->frag_threshold);
+
+        memcpy(ccfg->basic_rate_set, hw_rates, 4);
+        /* jal: really needed, we do a set_mib for autorate later ??? */
+        ccfg->auto_rate_fallback = (priv->txrate == TX_RATE_AUTO ? 1 : 0);
+        ccfg->channel = priv->channel;
+        ccfg->privacy_invoked = priv->wep_enabled;
+        memcpy(ccfg->current_ssid, priv->essid, IW_ESSID_MAX_SIZE);
+        ccfg->ssid_len = priv->essid_size;
+
+        ccfg->wep_default_key_id = priv->wep_key_id;
+        memcpy(ccfg->wep_default_key_value, priv->wep_keys,
+               sizeof(priv->wep_keys));
+
+        ccfg->short_preamble = priv->preamble_type;
+        ccfg->beacon_period = cpu_to_le16(priv->beacon_period);
+
+        ret = at76_set_card_command(priv->udev, CMD_STARTUP, &priv->card_config,
+                                    sizeof(struct at76_card_config));
+        if (ret < 0) {
+                printk(KERN_ERR "%s: at76_set_card_command failed: %d\n",
+                       wiphy_name(priv->hw->wiphy), ret);
+                return ret;
+        }
+
+        at76_wait_completion(priv, CMD_STARTUP);
+
+        /* remove BSSID from previous run */
+        memset(priv->bssid, 0, ETH_ALEN);
+
+        if (at76_set_radio(priv, 1) == 1)
+                at76_wait_completion(priv, CMD_RADIO_ON);
+
+        ret = at76_set_preamble(priv, priv->preamble_type);
+        if (ret < 0)
+                return ret;
+
+        ret = at76_set_frag(priv, priv->frag_threshold);
+        if (ret < 0)
+                return ret;
+
+        ret = at76_set_rts(priv, priv->rts_threshold);
+        if (ret < 0)
+                return ret;
+
+        ret = at76_set_autorate_fallback(priv,
+                                         priv->txrate == TX_RATE_AUTO ? 1 : 0);
+        if (ret < 0)
+                return ret;
+
+        ret = at76_set_pm_mode(priv);
+        if (ret < 0)
+                return ret;
+
+        if (at76_debug & DBG_MIB) {
+                at76_dump_mib_mac(priv);
+                at76_dump_mib_mac_addr(priv);
+                at76_dump_mib_mac_mgmt(priv);
+                at76_dump_mib_mac_wep(priv);
+                at76_dump_mib_mdomain(priv);
+                at76_dump_mib_phy(priv);
+                at76_dump_mib_local(priv);
+        }
+
+        return 0;
+}
+
+/* Enable or disable promiscuous mode */
+static void at76_work_set_promisc(struct work_struct *work)
+{
+        struct at76_priv *priv = container_of(work, struct at76_priv,
+                                              work_set_promisc);
+        int ret = 0;
+
+        if (priv->device_unplugged)
+                return;
+
+        mutex_lock(&priv->mtx);
+
+        priv->mib_buf.type = MIB_LOCAL;
+        priv->mib_buf.size = 1;
+        priv->mib_buf.index = offsetof(struct mib_local, promiscuous_mode);
+        priv->mib_buf.data.byte = priv->promisc ? 1 : 0;
+
+        ret = at76_set_mib(priv, &priv->mib_buf);
+        if (ret < 0)
+                printk(KERN_ERR "%s: set_mib (promiscuous_mode) failed: %d\n",
+                       wiphy_name(priv->hw->wiphy), ret);
+
+        mutex_unlock(&priv->mtx);
+}
+
+/* Submit Rx urb back to the device */
+static void at76_work_submit_rx(struct work_struct *work)
+{
+        struct at76_priv *priv = container_of(work, struct at76_priv,
+                                              work_submit_rx);
+
+        mutex_lock(&priv->mtx);
+        at76_submit_rx_urb(priv);
+        mutex_unlock(&priv->mtx);
+}
+
+static void at76_rx_tasklet(unsigned long param)
+{
+        struct urb *urb = (struct urb *)param;
+        struct at76_priv *priv = urb->context;
+        struct at76_rx_buffer *buf;
+        struct ieee80211_rx_status rx_status = { 0 };
+
+        if (priv->device_unplugged) {
+                at76_dbg(DBG_DEVSTART, "device unplugged");
+                if (urb)
+                        at76_dbg(DBG_DEVSTART, "urb status %d", urb->status);
+                return;
+        }
+
+        if (!priv->rx_skb || !priv->rx_skb->data)
+                return;
+
+        buf = (struct at76_rx_buffer *)priv->rx_skb->data;
+
+        if (urb->status != 0) {
+                if (urb->status != -ENOENT && urb->status != -ECONNRESET)
+                        at76_dbg(DBG_URB,
+                                 "%s %s: - nonzero Rx bulk status received: %d",
+                                 __func__, wiphy_name(priv->hw->wiphy),
+                                 urb->status);
+                return;
+        }
+
+        at76_dbg(DBG_RX_ATMEL_HDR,
+                 "%s: rx frame: rate %d rssi %d noise %d link %d",
+                 wiphy_name(priv->hw->wiphy), buf->rx_rate, buf->rssi,
+                 buf->noise_level, buf->link_quality);
+
+        skb_pull(priv->rx_skb, AT76_RX_HDRLEN);
+        skb_trim(priv->rx_skb, le16_to_cpu(buf->wlength));
+        at76_dbg_dump(DBG_RX_DATA, priv->rx_skb->data,
+                      priv->rx_skb->len, "RX: len=%d", priv->rx_skb->len);
+
+        rx_status.signal = buf->rssi;
+        rx_status.flag |= RX_FLAG_DECRYPTED;
+        rx_status.flag |= RX_FLAG_IV_STRIPPED;
+
+        at76_dbg(DBG_MAC80211, "calling ieee80211_rx_irqsafe(): %d/%d",
+                 priv->rx_skb->len, priv->rx_skb->data_len);
+        ieee80211_rx_irqsafe(priv->hw, priv->rx_skb, &rx_status);
+
+        /* Use a new skb for the next receive */
+        priv->rx_skb = NULL;
+
+        at76_submit_rx_urb(priv);
+}
+
+/* Load firmware into kernel memory and parse it */
+static struct fwentry *at76_load_firmware(struct usb_device *udev,
+                                          enum board_type board_type)
+{
+        int ret;
+        char *str;
+        struct at76_fw_header *fwh;
+        struct fwentry *fwe = &firmwares[board_type];
+
+        mutex_lock(&fw_mutex);
+
+        if (fwe->loaded) {
+                at76_dbg(DBG_FW, "re-using previously loaded fw");
+                goto exit;
+        }
+
+        at76_dbg(DBG_FW, "downloading firmware %s", fwe->fwname);
+        ret = request_firmware(&fwe->fw, fwe->fwname, &udev->dev);
+        if (ret < 0) {
+                dev_printk(KERN_ERR, &udev->dev, "firmware %s not found!\n",
+                           fwe->fwname);
+                dev_printk(KERN_ERR, &udev->dev,
+                           "you may need to download the firmware from "
+                           "http://developer.berlios.de/projects/at76c503a/\n");
+                goto exit;
+        }
+
+        at76_dbg(DBG_FW, "got it.");
+        fwh = (struct at76_fw_header *)(fwe->fw->data);
+
+        if (fwe->fw->size <= sizeof(*fwh)) {
+                dev_printk(KERN_ERR, &udev->dev,
+                           "firmware is too short (0x%zx)\n", fwe->fw->size);
+                goto exit;
+        }
+
+        /* CRC currently not checked */
+        fwe->board_type = le32_to_cpu(fwh->board_type);
+        if (fwe->board_type != board_type) {
+                dev_printk(KERN_ERR, &udev->dev,
+                           "board type mismatch, requested %u, got %u\n",
+                           board_type, fwe->board_type);
+                goto exit;
+        }
+
+        fwe->fw_version.major = fwh->major;
+        fwe->fw_version.minor = fwh->minor;
+        fwe->fw_version.patch = fwh->patch;
+        fwe->fw_version.build = fwh->build;
+
+        str = (char *)fwh + le32_to_cpu(fwh->str_offset);
+        fwe->intfw = (u8 *)fwh + le32_to_cpu(fwh->int_fw_offset);
+        fwe->intfw_size = le32_to_cpu(fwh->int_fw_len);
+        fwe->extfw = (u8 *)fwh + le32_to_cpu(fwh->ext_fw_offset);
+        fwe->extfw_size = le32_to_cpu(fwh->ext_fw_len);
+
+        fwe->loaded = 1;
+
+        dev_printk(KERN_DEBUG, &udev->dev,
+                   "using firmware %s (version %d.%d.%d-%d)\n",
+                   fwe->fwname, fwh->major, fwh->minor, fwh->patch, fwh->build);
+
+        at76_dbg(DBG_DEVSTART, "board %u, int %d:%d, ext %d:%d", board_type,
+                 le32_to_cpu(fwh->int_fw_offset), le32_to_cpu(fwh->int_fw_len),
+                 le32_to_cpu(fwh->ext_fw_offset), le32_to_cpu(fwh->ext_fw_len));
+        at76_dbg(DBG_DEVSTART, "firmware id %s", str);
+
+exit:
+        mutex_unlock(&fw_mutex);
+
+        if (fwe->loaded)
+                return fwe;
+        else
+                return NULL;
+}
+
+static void at76_mac80211_tx_callback(struct urb *urb)
+{
+        struct at76_priv *priv = urb->context;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(priv->tx_skb);
+
+        at76_dbg(DBG_MAC80211, "%s()", __func__);
+
+        switch (urb->status) {
+        case 0:
+                /* success */
+                info->flags |= IEEE80211_TX_STAT_ACK;
+                break;
+        case -ENOENT:
+        case -ECONNRESET:
+                /* fail, urb has been unlinked */
+                /* FIXME: add error message */
+                break;
+        default:
+                at76_dbg(DBG_URB, "%s - nonzero tx status received: %d",
+                         __func__, urb->status);
+                break;
+        }
+
+        memset(&info->status, 0, sizeof(info->status));
+
+        ieee80211_tx_status_irqsafe(priv->hw, priv->tx_skb);
+
+        priv->tx_skb = NULL;
+
+        ieee80211_wake_queues(priv->hw);
+}
+
+static int at76_mac80211_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
+{
+        struct at76_priv *priv = hw->priv;
+        struct at76_tx_buffer *tx_buffer = priv->bulk_out_buffer;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        int padding, submit_len, ret;
+
+        at76_dbg(DBG_MAC80211, "%s()", __func__);
+
+        if (priv->tx_urb->status == -EINPROGRESS) {
+                printk(KERN_ERR "%s: %s called while tx urb is pending\n",
+                       wiphy_name(priv->hw->wiphy), __func__);
+                return NETDEV_TX_BUSY;
+        }
+
+        ieee80211_stop_queues(hw);
+
+        at76_ledtrig_tx_activity();     /* tell ledtrigger we send a packet */
+
+        WARN_ON(priv->tx_skb != NULL);
+
+        priv->tx_skb = skb;
+        padding = at76_calc_padding(skb->len);
+        submit_len = AT76_TX_HDRLEN + skb->len + padding;
+
+        /* setup 'Atmel' header */
+        memset(tx_buffer, 0, sizeof(*tx_buffer));
+        tx_buffer->padding = padding;
+        tx_buffer->wlength = cpu_to_le16(skb->len);
+        tx_buffer->tx_rate = ieee80211_get_tx_rate(hw, info)->hw_value;
+        memset(tx_buffer->reserved, 0, sizeof(tx_buffer->reserved));
+        memcpy(tx_buffer->packet, skb->data, skb->len);
+
+        at76_dbg(DBG_TX_DATA, "%s tx: wlen 0x%x pad 0x%x rate %d hdr",
+                 wiphy_name(priv->hw->wiphy), le16_to_cpu(tx_buffer->wlength),
+                 tx_buffer->padding, tx_buffer->tx_rate);
+
+        /* send stuff */
+        at76_dbg_dump(DBG_TX_DATA_CONTENT, tx_buffer, submit_len,
+                      "%s(): tx_buffer %d bytes:", __func__, submit_len);
+        usb_fill_bulk_urb(priv->tx_urb, priv->udev, priv->tx_pipe, tx_buffer,
+                          submit_len, at76_mac80211_tx_callback, priv);
+        ret = usb_submit_urb(priv->tx_urb, GFP_ATOMIC);
+        if (ret) {
+                printk(KERN_ERR "%s: error in tx submit urb: %d\n",
+                       wiphy_name(priv->hw->wiphy), ret);
+                if (ret == -EINVAL)
+                        printk(KERN_ERR
+                               "%s: -EINVAL: tx urb %p hcpriv %p complete %p\n",
+                               wiphy_name(priv->hw->wiphy), priv->tx_urb,
+                               priv->tx_urb->hcpriv, priv->tx_urb->complete);
+        }
+
+        return 0;
+}
+
+static int at76_mac80211_start(struct ieee80211_hw *hw)
+{
+        struct at76_priv *priv = hw->priv;
+        int ret;
+
+        at76_dbg(DBG_MAC80211, "%s()", __func__);
+
+        mutex_lock(&priv->mtx);
+
+        ret = at76_submit_rx_urb(priv);
+        if (ret < 0) {
+                printk(KERN_ERR "%s: open: submit_rx_urb failed: %d\n",
+                       wiphy_name(priv->hw->wiphy), ret);
+                goto error;
+        }
+
+        at76_startup_device(priv);
+
+        at76_start_monitor(priv);
+
+error:
+        mutex_unlock(&priv->mtx);
+
+        return 0;
+}
+
+static void at76_mac80211_stop(struct ieee80211_hw *hw)
+{
+        struct at76_priv *priv = hw->priv;
+
+        at76_dbg(DBG_MAC80211, "%s()", __func__);
+
+        mutex_lock(&priv->mtx);
+
+        if (!priv->device_unplugged) {
+                /* We are called by "ifconfig ethX down", not because the
+                 * device is not available anymore. */
+                at76_set_radio(priv, 0);
+
+                /* We unlink rx_urb because at76_open() re-submits it.
+                 * If unplugged, at76_delete_device() takes care of it. */
+                usb_kill_urb(priv->rx_urb);
+        }
+
+        mutex_unlock(&priv->mtx);
+}
+
+static int at76_add_interface(struct ieee80211_hw *hw,
+                              struct ieee80211_if_init_conf *conf)
+{
+        struct at76_priv *priv = hw->priv;
+        int ret = 0;
+
+        at76_dbg(DBG_MAC80211, "%s()", __func__);
+
+        mutex_lock(&priv->mtx);
+
+        switch (conf->type) {
+        case NL80211_IFTYPE_STATION:
+                priv->iw_mode = IW_MODE_INFRA;
+                break;
+        default:
+                ret = -EOPNOTSUPP;
+                goto exit;
+        }
+
+exit:
+        mutex_unlock(&priv->mtx);
+
+        return ret;
+}
+
+static void at76_remove_interface(struct ieee80211_hw *hw,
+                                  struct ieee80211_if_init_conf *conf)
+{
+        at76_dbg(DBG_MAC80211, "%s()", __func__);
+}
+
+static int at76_join(struct at76_priv *priv)
+{
+        struct at76_req_join join;
+        int ret;
+
+        memset(&join, 0, sizeof(struct at76_req_join));
+        memcpy(join.essid, priv->essid, priv->essid_size);
+        join.essid_size = priv->essid_size;
+        memcpy(join.bssid, priv->bssid, ETH_ALEN);
+        join.bss_type = INFRASTRUCTURE_MODE;
+        join.channel = priv->channel;
+        join.timeout = cpu_to_le16(2000);
+
+        at76_dbg(DBG_MAC80211, "%s: sending CMD_JOIN", __func__);
+        ret = at76_set_card_command(priv->udev, CMD_JOIN, &join,
+                                    sizeof(struct at76_req_join));
+
+        if (ret < 0) {
+                printk(KERN_ERR "%s: at76_set_card_command failed: %d\n",
+                       wiphy_name(priv->hw->wiphy), ret);
+                return 0;
+        }
+
+        ret = at76_wait_completion(priv, CMD_JOIN);
+        at76_dbg(DBG_MAC80211, "%s: CMD_JOIN returned: 0x%02x", __func__, ret);
+        if (ret != CMD_STATUS_COMPLETE) {
+                printk(KERN_ERR "%s: at76_wait_completion failed: %d\n",
+                       wiphy_name(priv->hw->wiphy), ret);
+                return 0;
+        }
+
+        at76_set_pm_mode(priv);
+
+        return 0;
+}
+
+static void at76_dwork_hw_scan(struct work_struct *work)
+{
+        struct at76_priv *priv = container_of(work, struct at76_priv,
+                                              dwork_hw_scan.work);
+        int ret;
+
+        if (priv->device_unplugged)
+                return;
+
+        mutex_lock(&priv->mtx);
+
+        ret = at76_get_cmd_status(priv->udev, CMD_SCAN);
+        at76_dbg(DBG_MAC80211, "%s: CMD_SCAN status 0x%02x", __func__, ret);
+
+        /* FIXME: add maximum time for scan to complete */
+
+        if (ret != CMD_STATUS_COMPLETE) {
+                queue_delayed_work(priv->hw->workqueue, &priv->dwork_hw_scan,
+                                   SCAN_POLL_INTERVAL);
+                goto exit;
+        }
+
+        ieee80211_scan_completed(priv->hw, false);
+
+        if (is_valid_ether_addr(priv->bssid))
+                at76_join(priv);
+
+        ieee80211_wake_queues(priv->hw);
+
+exit:
+        mutex_unlock(&priv->mtx);
+}
+
+static int at76_hw_scan(struct ieee80211_hw *hw,
+                        struct cfg80211_scan_request *req)
+{
+        struct at76_priv *priv = hw->priv;
+        struct at76_req_scan scan;
+        u8 *ssid = NULL;
+        int ret, len = 0;
+
+        at76_dbg(DBG_MAC80211, "%s():", __func__);
+
+        if (priv->device_unplugged)
+                return 0;
+
+        mutex_lock(&priv->mtx);
+
+        ieee80211_stop_queues(hw);
+
+        memset(&scan, 0, sizeof(struct at76_req_scan));
+        memset(scan.bssid, 0xFF, ETH_ALEN);
+
+        if (req->n_ssids) {
+                scan.scan_type = SCAN_TYPE_ACTIVE;
+                ssid = req->ssids[0].ssid;
+                len = req->ssids[0].ssid_len;
+        } else {
+                scan.scan_type = SCAN_TYPE_PASSIVE;
+        }
+
+        if (len) {
+                memcpy(scan.essid, ssid, len);
+                scan.essid_size = len;
+        }
+
+        scan.min_channel_time = cpu_to_le16(priv->scan_min_time);
+        scan.max_channel_time = cpu_to_le16(priv->scan_max_time);
+        scan.probe_delay = cpu_to_le16(priv->scan_min_time * 1000);
+        scan.international_scan = 0;
+
+        at76_dbg(DBG_MAC80211, "%s: sending CMD_SCAN", __func__);
+        ret = at76_set_card_command(priv->udev, CMD_SCAN, &scan, sizeof(scan));
+
+        if (ret < 0) {
+                err("CMD_SCAN failed: %d", ret);
+                goto exit;
+        }
+
+        queue_delayed_work(priv->hw->workqueue, &priv->dwork_hw_scan,
+                           SCAN_POLL_INTERVAL);
+
+exit:
+        mutex_unlock(&priv->mtx);
+
+        return 0;
+}
+
+static int at76_config(struct ieee80211_hw *hw, u32 changed)
+{
+        struct at76_priv *priv = hw->priv;
+
+        at76_dbg(DBG_MAC80211, "%s(): channel %d radio %d",
+                 __func__, hw->conf.channel->hw_value,
+                 hw->conf.radio_enabled);
+        at76_dbg_dump(DBG_MAC80211, priv->bssid, ETH_ALEN, "bssid:");
+
+        mutex_lock(&priv->mtx);
+
+        priv->channel = hw->conf.channel->hw_value;
+
+        if (is_valid_ether_addr(priv->bssid))
+                at76_join(priv);
+        else
+                at76_start_monitor(priv);
+
+        mutex_unlock(&priv->mtx);
+
+        return 0;
+}
+
+static int at76_config_interface(struct ieee80211_hw *hw,
+                                 struct ieee80211_vif *vif,
+                                 struct ieee80211_if_conf *conf)
+{
+        struct at76_priv *priv = hw->priv;
+
+        at76_dbg(DBG_MAC80211, "%s():", __func__);
+        at76_dbg_dump(DBG_MAC80211, conf->bssid, ETH_ALEN, "bssid:");
+
+        mutex_lock(&priv->mtx);
+
+        memcpy(priv->bssid, conf->bssid, ETH_ALEN);
+
+        if (is_valid_ether_addr(priv->bssid))
+                /* mac80211 is joining a bss */
+                at76_join(priv);
+
+        mutex_unlock(&priv->mtx);
+
+        return 0;
+}
+
+/* must be atomic */
+static void at76_configure_filter(struct ieee80211_hw *hw,
+                                  unsigned int changed_flags,
+                                  unsigned int *total_flags, int mc_count,
+                                  struct dev_addr_list *mc_list)
+{
+        struct at76_priv *priv = hw->priv;
+        int flags;
+
+        at76_dbg(DBG_MAC80211, "%s(): changed_flags=0x%08x "
+                 "total_flags=0x%08x mc_count=%d",
+                 __func__, changed_flags, *total_flags, mc_count);
+
+        flags = changed_flags & AT76_SUPPORTED_FILTERS;
+        *total_flags = AT76_SUPPORTED_FILTERS;
+
+        /* Bail out after updating flags to prevent a WARN_ON in mac80211. */
+        if (priv->device_unplugged)
+                return;
+
+        /* FIXME: access to priv->promisc should be protected with
+         * priv->mtx, but it's impossible because this function needs to be
+         * atomic */
+
+        if (flags && !priv->promisc) {
+                /* mac80211 wants us to enable promiscuous mode */
+                priv->promisc = 1;
+        } else if (!flags && priv->promisc) {
+                /* we need to disable promiscuous mode */
+                priv->promisc = 0;
+        } else
+                return;
+
+        queue_work(hw->workqueue, &priv->work_set_promisc);
+}
+
+static int at76_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+                        struct ieee80211_vif *vif, struct ieee80211_sta *sta,
+                        struct ieee80211_key_conf *key)
+{
+        struct at76_priv *priv = hw->priv;
+
+        int i;
+
+        at76_dbg(DBG_MAC80211, "%s(): cmd %d key->alg %d key->keyidx %d "
+                 "key->keylen %d",
+                 __func__, cmd, key->alg, key->keyidx, key->keylen);
+
+        if (key->alg != ALG_WEP)
+                return -EOPNOTSUPP;
+
+        key->hw_key_idx = key->keyidx;
+
+        mutex_lock(&priv->mtx);
+
+        switch (cmd) {
+        case SET_KEY:
+                memcpy(priv->wep_keys[key->keyidx], key->key, key->keylen);
+                priv->wep_keys_len[key->keyidx] = key->keylen;
+
+                /* FIXME: find out how to do this properly */
+                priv->wep_key_id = key->keyidx;
+
+                break;
+        case DISABLE_KEY:
+        default:
+                priv->wep_keys_len[key->keyidx] = 0;
+                break;
+        }
+
+        priv->wep_enabled = 0;
+
+        for (i = 0; i < WEP_KEYS; i++) {
+                if (priv->wep_keys_len[i] != 0)
+                        priv->wep_enabled = 1;
+        }
+
+        at76_startup_device(priv);
+
+        mutex_unlock(&priv->mtx);
+
+        return 0;
+}
+
+static const struct ieee80211_ops at76_ops = {
+        .tx = at76_mac80211_tx,
+        .add_interface = at76_add_interface,
+        .remove_interface = at76_remove_interface,
+        .config = at76_config,
+        .config_interface = at76_config_interface,
+        .configure_filter = at76_configure_filter,
+        .start = at76_mac80211_start,
+        .stop = at76_mac80211_stop,
+        .hw_scan = at76_hw_scan,
+        .set_key = at76_set_key,
+};
+
+/* Allocate network device and initialize private data */
+static struct at76_priv *at76_alloc_new_device(struct usb_device *udev)
+{
+        struct ieee80211_hw *hw;
+        struct at76_priv *priv;
+
+        hw = ieee80211_alloc_hw(sizeof(struct at76_priv), &at76_ops);
+        if (!hw) {
+                printk(KERN_ERR DRIVER_NAME ": could not register"
+                       " ieee80211_hw\n");
+                return NULL;
+        }
+
+        priv = hw->priv;
+        priv->hw = hw;
+
+        priv->udev = udev;
+
+        mutex_init(&priv->mtx);
+        INIT_WORK(&priv->work_set_promisc, at76_work_set_promisc);
+        INIT_WORK(&priv->work_submit_rx, at76_work_submit_rx);
+        INIT_DELAYED_WORK(&priv->dwork_hw_scan, at76_dwork_hw_scan);
+
+        tasklet_init(&priv->rx_tasklet, at76_rx_tasklet, 0);
+
+        priv->pm_mode = AT76_PM_OFF;
+        priv->pm_period = 0;
+
+        /* unit us */
+        priv->hw->channel_change_time = 100000;
+
+        return priv;
+}
+
+static int at76_alloc_urbs(struct at76_priv *priv,
+                           struct usb_interface *interface)
+{
+        struct usb_endpoint_descriptor *endpoint, *ep_in, *ep_out;
+        int i;
+        int buffer_size;
+        struct usb_host_interface *iface_desc;
+
+        at76_dbg(DBG_PROC_ENTRY, "%s: ENTER", __func__);
+
+        at76_dbg(DBG_URB, "%s: NumEndpoints %d ", __func__,
+                 interface->altsetting[0].desc.bNumEndpoints);
+
+        ep_in = NULL;
+        ep_out = NULL;
+        iface_desc = interface->cur_altsetting;
+        for (i = 0; i < iface_desc->desc.bNumEndpoints; i++) {
+                endpoint = &iface_desc->endpoint[i].desc;
+
+                at76_dbg(DBG_URB, "%s: %d. endpoint: addr 0x%x attr 0x%x",
+                         __func__, i, endpoint->bEndpointAddress,
+                         endpoint->bmAttributes);
+
+                if (!ep_in && usb_endpoint_is_bulk_in(endpoint))
+                        ep_in = endpoint;
+
+                if (!ep_out && usb_endpoint_is_bulk_out(endpoint))
+                        ep_out = endpoint;
+        }
+
+        if (!ep_in || !ep_out) {
+                dev_printk(KERN_ERR, &interface->dev,
+                           "bulk endpoints missing\n");
+                return -ENXIO;
+        }
+
+        priv->rx_pipe = usb_rcvbulkpipe(priv->udev, ep_in->bEndpointAddress);
+        priv->tx_pipe = usb_sndbulkpipe(priv->udev, ep_out->bEndpointAddress);
+
+        priv->rx_urb = usb_alloc_urb(0, GFP_KERNEL);
+        priv->tx_urb = usb_alloc_urb(0, GFP_KERNEL);
+        if (!priv->rx_urb || !priv->tx_urb) {
+                dev_printk(KERN_ERR, &interface->dev, "cannot allocate URB\n");
+                return -ENOMEM;
+        }
+
+        buffer_size = sizeof(struct at76_tx_buffer) + MAX_PADDING_SIZE;
+        priv->bulk_out_buffer = kmalloc(buffer_size, GFP_KERNEL);
+        if (!priv->bulk_out_buffer) {
+                dev_printk(KERN_ERR, &interface->dev,
+                           "cannot allocate output buffer\n");
+                return -ENOMEM;
+        }
+
+        at76_dbg(DBG_PROC_ENTRY, "%s: EXIT", __func__);
+
+        return 0;
+}
+
+static struct ieee80211_rate at76_rates[] = {
+        { .bitrate = 10, .hw_value = TX_RATE_1MBIT, },
+        { .bitrate = 20, .hw_value = TX_RATE_2MBIT, },
+        { .bitrate = 55, .hw_value = TX_RATE_5_5MBIT, },
+        { .bitrate = 110, .hw_value = TX_RATE_11MBIT, },
+};
+
+static struct ieee80211_channel at76_channels[] = {
+        { .center_freq = 2412, .hw_value = 1 },
+        { .center_freq = 2417, .hw_value = 2 },
+        { .center_freq = 2422, .hw_value = 3 },
+        { .center_freq = 2427, .hw_value = 4 },
+        { .center_freq = 2432, .hw_value = 5 },
+        { .center_freq = 2437, .hw_value = 6 },
+        { .center_freq = 2442, .hw_value = 7 },
+        { .center_freq = 2447, .hw_value = 8 },
+        { .center_freq = 2452, .hw_value = 9 },
+        { .center_freq = 2457, .hw_value = 10 },
+        { .center_freq = 2462, .hw_value = 11 },
+        { .center_freq = 2467, .hw_value = 12 },
+        { .center_freq = 2472, .hw_value = 13 },
+        { .center_freq = 2484, .hw_value = 14 }
+};
+
+static struct ieee80211_supported_band at76_supported_band = {
+        .channels = at76_channels,
+        .n_channels = ARRAY_SIZE(at76_channels),
+        .bitrates = at76_rates,
+        .n_bitrates = ARRAY_SIZE(at76_rates),
+};
+
+/* Register network device and initialize the hardware */
+static int at76_init_new_device(struct at76_priv *priv,
+                                struct usb_interface *interface)
+{
+        int ret;
+
+        /* set up the endpoint information */
+        /* check out the endpoints */
+
+        at76_dbg(DBG_DEVSTART, "USB interface: %d endpoints",
+                 interface->cur_altsetting->desc.bNumEndpoints);
+
+        ret = at76_alloc_urbs(priv, interface);
+        if (ret < 0)
+                goto exit;
+
+        /* MAC address */
+        ret = at76_get_hw_config(priv);
+        if (ret < 0) {
+                dev_printk(KERN_ERR, &interface->dev,
+                           "cannot get MAC address\n");
+                goto exit;
+        }
+
+        priv->domain = at76_get_reg_domain(priv->regulatory_domain);
+
+        priv->channel = DEF_CHANNEL;
+        priv->iw_mode = IW_MODE_INFRA;
+        priv->rts_threshold = DEF_RTS_THRESHOLD;
+        priv->frag_threshold = DEF_FRAG_THRESHOLD;
+        priv->short_retry_limit = DEF_SHORT_RETRY_LIMIT;
+        priv->txrate = TX_RATE_AUTO;
+        priv->preamble_type = PREAMBLE_TYPE_LONG;
+        priv->beacon_period = 100;
+        priv->auth_mode = WLAN_AUTH_OPEN;
+        priv->scan_min_time = DEF_SCAN_MIN_TIME;
+        priv->scan_max_time = DEF_SCAN_MAX_TIME;
+        priv->scan_mode = SCAN_TYPE_ACTIVE;
+        priv->device_unplugged = 0;
+
+        /* mac80211 initialisation */
+        priv->hw->wiphy->max_scan_ssids = 1;
+        priv->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);
+        priv->hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &at76_supported_band;
+        priv->hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
+                          IEEE80211_HW_SIGNAL_UNSPEC;
+        priv->hw->max_signal = 100;
+
+        SET_IEEE80211_DEV(priv->hw, &interface->dev);
+        SET_IEEE80211_PERM_ADDR(priv->hw, priv->mac_addr);
+
+        ret = ieee80211_register_hw(priv->hw);
+        if (ret) {
+                printk(KERN_ERR "cannot register mac80211 hw (status %d)!\n",
+                       ret);
+                goto exit;
+        }
+
+        priv->mac80211_registered = 1;
+
+        printk(KERN_INFO "%s: USB %s, MAC %s, firmware %d.%d.%d-%d\n",
+               wiphy_name(priv->hw->wiphy),
+               dev_name(&interface->dev), mac2str(priv->mac_addr),
+               priv->fw_version.major, priv->fw_version.minor,
+               priv->fw_version.patch, priv->fw_version.build);
+        printk(KERN_INFO "%s: regulatory domain 0x%02x: %s\n",
+               wiphy_name(priv->hw->wiphy),
+               priv->regulatory_domain, priv->domain->name);
+
+exit:
+        return ret;
+}
+
+static void at76_delete_device(struct at76_priv *priv)
+{
+        at76_dbg(DBG_PROC_ENTRY, "%s: ENTER", __func__);
+
+        /* The device is gone, don't bother turning it off */
+        priv->device_unplugged = 1;
+
+        tasklet_kill(&priv->rx_tasklet);
+
+        if (priv->mac80211_registered) {
+                cancel_delayed_work(&priv->dwork_hw_scan);
+                flush_workqueue(priv->hw->workqueue);
+                ieee80211_unregister_hw(priv->hw);
+        }
+
+        if (priv->tx_urb) {
+                usb_kill_urb(priv->tx_urb);
+                usb_free_urb(priv->tx_urb);
+        }
+        if (priv->rx_urb) {
+                usb_kill_urb(priv->rx_urb);
+                usb_free_urb(priv->rx_urb);
+        }
+
+        at76_dbg(DBG_PROC_ENTRY, "%s: unlinked urbs", __func__);
+
+        kfree(priv->bulk_out_buffer);
+
+        del_timer_sync(&ledtrig_tx_timer);
+
+        if (priv->rx_skb)
+                kfree_skb(priv->rx_skb);
+
+        usb_put_dev(priv->udev);
+
+        at76_dbg(DBG_PROC_ENTRY, "%s: before freeing priv/ieee80211_hw",
+                 __func__);
+        ieee80211_free_hw(priv->hw);
+
+        at76_dbg(DBG_PROC_ENTRY, "%s: EXIT", __func__);
+}
+
+static int at76_probe(struct usb_interface *interface,
+                      const struct usb_device_id *id)
+{
+        int ret;
+        struct at76_priv *priv;
+        struct fwentry *fwe;
+        struct usb_device *udev;
+        int op_mode;
+        int need_ext_fw = 0;
+        struct mib_fw_version fwv;
+        int board_type = (int)id->driver_info;
+
+        udev = usb_get_dev(interface_to_usbdev(interface));
+
+        /* Load firmware into kernel memory */
+        fwe = at76_load_firmware(udev, board_type);
+        if (!fwe) {
+                ret = -ENOENT;
+                goto error;
+        }
+
+        op_mode = at76_get_op_mode(udev);
+
+        at76_dbg(DBG_DEVSTART, "opmode %d", op_mode);
+
+        /* we get OPMODE_NONE with 2.4.23, SMC2662W-AR ???
+           we get 204 with 2.4.23, Fiberline FL-WL240u (505A+RFMD2958) ??? */
+
+        if (op_mode == OPMODE_HW_CONFIG_MODE) {
+                dev_printk(KERN_ERR, &interface->dev,
+                           "cannot handle a device in HW_CONFIG_MODE\n");
+                ret = -EBUSY;
+                goto error;
+        }
+
+        if (op_mode != OPMODE_NORMAL_NIC_WITH_FLASH
+            && op_mode != OPMODE_NORMAL_NIC_WITHOUT_FLASH) {
+                /* download internal firmware part */
+                dev_printk(KERN_DEBUG, &interface->dev,
+                           "downloading internal firmware\n");
+                ret = at76_load_internal_fw(udev, fwe);
+                if (ret < 0) {
+                        dev_printk(KERN_ERR, &interface->dev,
+                                   "error %d downloading internal firmware\n",
+                                   ret);
+                        goto error;
+                }
+                usb_put_dev(udev);
+                return ret;
+        }
+
+        /* Internal firmware already inside the device.  Get firmware
+         * version to test if external firmware is loaded.
+         * This works only for newer firmware, e.g. the Intersil 0.90.x
+         * says "control timeout on ep0in" and subsequent
+         * at76_get_op_mode() fail too :-( */
+
+        /* if version >= 0.100.x.y or device with built-in flash we can
+         * query the device for the fw version */
+        if ((fwe->fw_version.major > 0 || fwe->fw_version.minor >= 100)
+            || (op_mode == OPMODE_NORMAL_NIC_WITH_FLASH)) {
+                ret = at76_get_mib(udev, MIB_FW_VERSION, &fwv, sizeof(fwv));
+                if (ret < 0 || (fwv.major | fwv.minor) == 0)
+                        need_ext_fw = 1;
+        } else
+                /* No way to check firmware version, reload to be sure */
+                need_ext_fw = 1;
+
+        if (need_ext_fw) {
+                dev_printk(KERN_DEBUG, &interface->dev,
+                           "downloading external firmware\n");
+
+                ret = at76_load_external_fw(udev, fwe);
+                if (ret)
+                        goto error;
+
+                /* Re-check firmware version */
+                ret = at76_get_mib(udev, MIB_FW_VERSION, &fwv, sizeof(fwv));
+                if (ret < 0) {
+                        dev_printk(KERN_ERR, &interface->dev,
+                                   "error %d getting firmware version\n", ret);
+                        goto error;
+                }
+        }
+
+        priv = at76_alloc_new_device(udev);
+        if (!priv) {
+                ret = -ENOMEM;
+                goto error;
+        }
+
+        usb_set_intfdata(interface, priv);
+
+        memcpy(&priv->fw_version, &fwv, sizeof(struct mib_fw_version));
+        priv->board_type = board_type;
+
+        ret = at76_init_new_device(priv, interface);
+        if (ret < 0)
+                at76_delete_device(priv);
+
+        return ret;
+
+error:
+        usb_put_dev(udev);
+        return ret;
+}
+
+static void at76_disconnect(struct usb_interface *interface)
+{
+        struct at76_priv *priv;
+
+        priv = usb_get_intfdata(interface);
+        usb_set_intfdata(interface, NULL);
+
+        /* Disconnect after loading internal firmware */
+        if (!priv)
+                return;
+
+        printk(KERN_INFO "%s: disconnecting\n", wiphy_name(priv->hw->wiphy));
+        at76_delete_device(priv);
+        dev_printk(KERN_INFO, &interface->dev, "disconnected\n");
+}
+
+/* Structure for registering this driver with the USB subsystem */
+static struct usb_driver at76_driver = {
+        .name = DRIVER_NAME,
+        .probe = at76_probe,
+        .disconnect = at76_disconnect,
+        .id_table = dev_table,
+};
+
+static int __init at76_mod_init(void)
+{
+        int result;
+
+        printk(KERN_INFO DRIVER_DESC " " DRIVER_VERSION " loading\n");
+
+        mutex_init(&fw_mutex);
+
+        /* register this driver with the USB subsystem */
+        result = usb_register(&at76_driver);
+        if (result < 0)
+                printk(KERN_ERR DRIVER_NAME
+                       ": usb_register failed (status %d)\n", result);
+
+        led_trigger_register_simple("at76_usb-tx", &ledtrig_tx);
+        return result;
+}
+
+static void __exit at76_mod_exit(void)
+{
+        int i;
+
+        printk(KERN_INFO DRIVER_DESC " " DRIVER_VERSION " unloading\n");
+        usb_deregister(&at76_driver);
+        for (i = 0; i < ARRAY_SIZE(firmwares); i++) {
+                if (firmwares[i].fw)
+                        release_firmware(firmwares[i].fw);
+        }
+        led_trigger_unregister_simple(ledtrig_tx);
+}
+
+module_param_named(debug, at76_debug, uint, 0600);
+MODULE_PARM_DESC(debug, "Debugging level");
+
+module_init(at76_mod_init);
+module_exit(at76_mod_exit);
+
+MODULE_AUTHOR("Oliver Kurth <oku@masqmail.cx>");
+MODULE_AUTHOR("Joerg Albert <joerg.albert@gmx.de>");
+MODULE_AUTHOR("Alex <alex@foogod.com>");
+MODULE_AUTHOR("Nick Jones");
+MODULE_AUTHOR("Balint Seeber <n0_5p4m_p13453@hotmail.com>");
+MODULE_AUTHOR("Pavel Roskin <proski@gnu.org>");
+MODULE_AUTHOR("Guido Guenther <agx@sigxcpu.org>");
+MODULE_AUTHOR("Kalle Valo <kalle.valo@iki.fi>");
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/wireless/at76c50x-usb.h b/drivers/net/wireless/at76c50x-usb.h
new file mode 100644
index 000000000000..1ec5ccffdbc0
--- /dev/null
+++ b/drivers/net/wireless/at76c50x-usb.h
@@ -0,0 +1,463 @@
+/*
+ * Copyright (c) 2002,2003 Oliver Kurth
+ *           (c) 2003,2004 Joerg Albert <joerg.albert@gmx.de>
+ *           (c) 2007 Guido Guenther <agx@sigxcpu.org>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of
+ * the License, or (at your option) any later version.
+ *
+ * This driver was based on information from the Sourceforge driver
+ * released and maintained by Atmel:
+ *
+ *  http://sourceforge.net/projects/atmelwlandriver/
+ *
+ * Although the code was completely re-written,
+ * it would have been impossible without Atmel's decision to
+ * release an Open Source driver (unfortunately the firmware was
+ * kept binary only). Thanks for that decision to Atmel!
+ */
+
+#ifndef _AT76_USB_H
+#define _AT76_USB_H
+
+/* Board types */
+enum board_type {
+        BOARD_503_ISL3861 = 1,
+        BOARD_503_ISL3863 = 2,
+        BOARD_503 = 3,
+        BOARD_503_ACC = 4,
+        BOARD_505 = 5,
+        BOARD_505_2958 = 6,
+        BOARD_505A = 7,
+        BOARD_505AMX = 8
+};
+
+#define CMD_STATUS_IDLE                         0x00
+#define CMD_STATUS_COMPLETE                     0x01
+#define CMD_STATUS_UNKNOWN                      0x02
+#define CMD_STATUS_INVALID_PARAMETER            0x03
+#define CMD_STATUS_FUNCTION_NOT_SUPPORTED       0x04
+#define CMD_STATUS_TIME_OUT                     0x07
+#define CMD_STATUS_IN_PROGRESS                  0x08
+#define CMD_STATUS_HOST_FAILURE                 0xff
+#define CMD_STATUS_SCAN_FAILED                  0xf0
+
+/* answers to get op mode */
+#define OPMODE_NONE                             0x00
+#define OPMODE_NORMAL_NIC_WITH_FLASH            0x01
+#define OPMODE_HW_CONFIG_MODE                   0x02
+#define OPMODE_DFU_MODE_WITH_FLASH              0x03
+#define OPMODE_NORMAL_NIC_WITHOUT_FLASH         0x04
+
+#define CMD_SET_MIB             0x01
+#define CMD_GET_MIB             0x02
+#define CMD_SCAN                0x03
+#define CMD_JOIN                0x04
+#define CMD_START_IBSS          0x05
+#define CMD_RADIO_ON            0x06
+#define CMD_RADIO_OFF           0x07
+#define CMD_STARTUP             0x0B
+
+#define MIB_LOCAL               0x01
+#define MIB_MAC_ADDR            0x02
+#define MIB_MAC                 0x03
+#define MIB_MAC_MGMT            0x05
+#define MIB_MAC_WEP             0x06
+#define MIB_PHY                 0x07
+#define MIB_FW_VERSION          0x08
+#define MIB_MDOMAIN             0x09
+
+#define ADHOC_MODE              1
+#define INFRASTRUCTURE_MODE     2
+
+/* values for struct mib_local, field preamble_type */
+#define PREAMBLE_TYPE_LONG      0
+#define PREAMBLE_TYPE_SHORT     1
+#define PREAMBLE_TYPE_AUTO      2
+
+/* values for tx_rate */
+#define TX_RATE_1MBIT           0
+#define TX_RATE_2MBIT           1
+#define TX_RATE_5_5MBIT         2
+#define TX_RATE_11MBIT          3
+#define TX_RATE_AUTO            4
+
+/* power management modes */
+#define AT76_PM_OFF             1
+#define AT76_PM_ON              2
+#define AT76_PM_SMART           3
+
+struct hwcfg_r505 {
+        u8 cr39_values[14];
+        u8 reserved1[14];
+        u8 bb_cr[14];
+        u8 pidvid[4];
+        u8 mac_addr[ETH_ALEN];
+        u8 regulatory_domain;
+        u8 reserved2[14];
+        u8 cr15_values[14];
+        u8 reserved3[3];
+} __attribute__((packed));
+
+struct hwcfg_rfmd {
+        u8 cr20_values[14];
+        u8 cr21_values[14];
+        u8 bb_cr[14];
+        u8 pidvid[4];
+        u8 mac_addr[ETH_ALEN];
+        u8 regulatory_domain;
+        u8 low_power_values[14];
+        u8 normal_power_values[14];
+        u8 reserved1[3];
+} __attribute__((packed));
+
+struct hwcfg_intersil {
+        u8 mac_addr[ETH_ALEN];
+        u8 cr31_values[14];
+        u8 cr58_values[14];
+        u8 pidvid[4];
+        u8 regulatory_domain;
+        u8 reserved[1];
+} __attribute__((packed));
+
+union at76_hwcfg {
+        struct hwcfg_intersil i;
+        struct hwcfg_rfmd r3;
+        struct hwcfg_r505 r5;
+};
+
+#define WEP_SMALL_KEY_LEN       (40 / 8)
+#define WEP_LARGE_KEY_LEN       (104 / 8)
+#define WEP_KEYS                (4)
+
+struct at76_card_config {
+        u8 exclude_unencrypted;
+        u8 promiscuous_mode;
+        u8 short_retry_limit;
+        u8 encryption_type;
+        __le16 rts_threshold;
+        __le16 fragmentation_threshold; /* 256..2346 */
+        u8 basic_rate_set[4];
+        u8 auto_rate_fallback;  /* 0,1 */
+        u8 channel;
+        u8 privacy_invoked;
+        u8 wep_default_key_id;  /* 0..3 */
+        u8 current_ssid[32];
+        u8 wep_default_key_value[4][WEP_LARGE_KEY_LEN];
+        u8 ssid_len;
+        u8 short_preamble;
+        __le16 beacon_period;
+} __attribute__((packed));
+
+struct at76_command {
+        u8 cmd;
+        u8 reserved;
+        __le16 size;
+        u8 data[0];
+} __attribute__((packed));
+
+/* Length of Atmel-specific Rx header before 802.11 frame */
+#define AT76_RX_HDRLEN offsetof(struct at76_rx_buffer, packet)
+
+struct at76_rx_buffer {
+        __le16 wlength;
+        u8 rx_rate;
+        u8 newbss;
+        u8 fragmentation;
+        u8 rssi;
+        u8 link_quality;
+        u8 noise_level;
+        __le32 rx_time;
+        u8 packet[IEEE80211_MAX_FRAG_THRESHOLD];
+} __attribute__((packed));
+
+/* Length of Atmel-specific Tx header before 802.11 frame */
+#define AT76_TX_HDRLEN offsetof(struct at76_tx_buffer, packet)
+
+struct at76_tx_buffer {
+        __le16 wlength;
+        u8 tx_rate;
+        u8 padding;
+        u8 reserved[4];
+        u8 packet[IEEE80211_MAX_FRAG_THRESHOLD];
+} __attribute__((packed));
+
+/* defines for scan_type below */
+#define SCAN_TYPE_ACTIVE        0
+#define SCAN_TYPE_PASSIVE       1
+
+struct at76_req_scan {
+        u8 bssid[ETH_ALEN];
+        u8 essid[32];
+        u8 scan_type;
+        u8 channel;
+        __le16 probe_delay;
+        __le16 min_channel_time;
+        __le16 max_channel_time;
+        u8 essid_size;
+        u8 international_scan;
+} __attribute__((packed));
+
+struct at76_req_ibss {
+        u8 bssid[ETH_ALEN];
+        u8 essid[32];
+        u8 bss_type;
+        u8 channel;
+        u8 essid_size;
+        u8 reserved[3];
+} __attribute__((packed));
+
+struct at76_req_join {
+        u8 bssid[ETH_ALEN];
+        u8 essid[32];
+        u8 bss_type;
+        u8 channel;
+        __le16 timeout;
+        u8 essid_size;
+        u8 reserved;
+} __attribute__((packed));
+
+struct set_mib_buffer {
+        u8 type;
+        u8 size;
+        u8 index;
+        u8 reserved;
+        union {
+                u8 byte;
+                __le16 word;
+                u8 addr[ETH_ALEN];
+        } data;
+} __attribute__((packed));
+
+struct mib_local {
+        u16 reserved0;
+        u8 beacon_enable;
+        u8 txautorate_fallback;
+        u8 reserved1;
+        u8 ssid_size;
+        u8 promiscuous_mode;
+        u16 reserved2;
+        u8 preamble_type;
+        u16 reserved3;
+} __attribute__((packed));
+
+struct mib_mac_addr {
+        u8 mac_addr[ETH_ALEN];
+        u8 res[2];              /* ??? */
+        u8 group_addr[4][ETH_ALEN];
+        u8 group_addr_status[4];
+} __attribute__((packed));
+
+struct mib_mac {
+        __le32 max_tx_msdu_lifetime;
+        __le32 max_rx_lifetime;
+        __le16 frag_threshold;
+        __le16 rts_threshold;
+        __le16 cwmin;
+        __le16 cwmax;
+        u8 short_retry_time;
+        u8 long_retry_time;
+        u8 scan_type;           /* active or passive */
+        u8 scan_channel;
+        __le16 probe_delay;     /* delay before ProbeReq in active scan, RO */
+        __le16 min_channel_time;
+        __le16 max_channel_time;
+        __le16 listen_interval;
+        u8 desired_ssid[32];
+        u8 desired_bssid[ETH_ALEN];
+        u8 desired_bsstype;     /* ad-hoc or infrastructure */
+        u8 reserved2;
+} __attribute__((packed));
+
+struct mib_mac_mgmt {
+        __le16 beacon_period;
+        __le16 CFP_max_duration;
+        __le16 medium_occupancy_limit;
+        __le16 station_id;      /* assoc id */
+        __le16 ATIM_window;
+        u8 CFP_mode;
+        u8 privacy_option_implemented;
+        u8 DTIM_period;
+        u8 CFP_period;
+        u8 current_bssid[ETH_ALEN];
+        u8 current_essid[32];
+        u8 current_bss_type;
+        u8 power_mgmt_mode;
+        /* rfmd and 505 */
+        u8 ibss_change;
+        u8 res;
+        u8 multi_domain_capability_implemented;
+        u8 multi_domain_capability_enabled;
+        u8 country_string[3];
+        u8 reserved[3];
+} __attribute__((packed));
+
+struct mib_mac_wep {
+        u8 privacy_invoked;     /* 0 disable encr., 1 enable encr */
+        u8 wep_default_key_id;
+        u8 wep_key_mapping_len;
+        u8 exclude_unencrypted;
+        __le32 wep_icv_error_count;
+        __le32 wep_excluded_count;
+        u8 wep_default_keyvalue[WEP_KEYS][WEP_LARGE_KEY_LEN];
+        u8 encryption_level;    /* 1 for 40bit, 2 for 104bit encryption */
+} __attribute__((packed));
+
+struct mib_phy {
+        __le32 ed_threshold;
+
+        __le16 slot_time;
+        __le16 sifs_time;
+        __le16 preamble_length;
+        __le16 plcp_header_length;
+        __le16 mpdu_max_length;
+        __le16 cca_mode_supported;
+
+        u8 operation_rate_set[4];
+        u8 channel_id;
+        u8 current_cca_mode;
+        u8 phy_type;
+        u8 current_reg_domain;
+} __attribute__((packed));
+
+struct mib_fw_version {
+        u8 major;
+        u8 minor;
+        u8 patch;
+        u8 build;
+} __attribute__((packed));
+
+struct mib_mdomain {
+        u8 tx_powerlevel[14];
+        u8 channel_list[14];    /* 0 for invalid channels */
+} __attribute__((packed));
+
+struct at76_fw_header {
+        __le32 crc;             /* CRC32 of the whole image */
+        __le32 board_type;      /* firmware compatibility code */
+        u8 build;               /* firmware build number */
+        u8 patch;               /* firmware patch level */
+        u8 minor;               /* firmware minor version */
+        u8 major;               /* firmware major version */
+        __le32 str_offset;      /* offset of the copyright string */
+        __le32 int_fw_offset;   /* internal firmware image offset */
+        __le32 int_fw_len;      /* internal firmware image length */
+        __le32 ext_fw_offset;   /* external firmware image offset */
+        __le32 ext_fw_len;      /* external firmware image length */
+} __attribute__((packed));
+
+/* a description of a regulatory domain and the allowed channels */
+struct reg_domain {
+        u16 code;
+        char const *name;
+        u32 channel_map;        /* if bit N is set, channel (N+1) is allowed */
+};
+
+/* Data for one loaded firmware file */
+struct fwentry {
+        const char *const fwname;
+        const struct firmware *fw;
+        int extfw_size;
+        int intfw_size;
+        /* pointer to loaded firmware, no need to free */
+        u8 *extfw;              /* external firmware, extfw_size bytes long */
+        u8 *intfw;              /* internal firmware, intfw_size bytes long */
+        enum board_type board_type;     /* board type */
+        struct mib_fw_version fw_version;
+        int loaded;             /* Loaded and parsed successfully */
+};
+
+struct at76_priv {
+        struct usb_device *udev;        /* USB device pointer */
+
+        struct sk_buff *rx_skb; /* skbuff for receiving data */
+        struct sk_buff *tx_skb; /* skbuff for transmitting data */
+        void *bulk_out_buffer;  /* buffer for sending data */
+
+        struct urb *tx_urb;     /* URB for sending data */
+        struct urb *rx_urb;     /* URB for receiving data */
+
+        unsigned int tx_pipe;   /* bulk out pipe */
+        unsigned int rx_pipe;   /* bulk in pipe */
+
+        struct mutex mtx;       /* locks this structure */
+
+        /* work queues */
+        struct work_struct work_set_promisc;
+        struct work_struct work_submit_rx;
+        struct delayed_work dwork_hw_scan;
+
+        struct tasklet_struct rx_tasklet;
+
+        /* the WEP stuff */
+        int wep_enabled;        /* 1 if WEP is enabled */
+        int wep_key_id;         /* key id to be used */
+        u8 wep_keys[WEP_KEYS][WEP_LARGE_KEY_LEN];       /* WEP keys */
+        u8 wep_keys_len[WEP_KEYS];      /* length of WEP keys */
+
+        int channel;
+        int iw_mode;
+        u8 bssid[ETH_ALEN];
+        u8 essid[IW_ESSID_MAX_SIZE];
+        int essid_size;
+        int radio_on;
+        int promisc;
+
+        int preamble_type;      /* 0 - long, 1 - short, 2 - auto */
+        int auth_mode;          /* authentication type: 0 open, 1 shared key */
+        int txrate;             /* 0,1,2,3 = 1,2,5.5,11 Mbps, 4 is auto */
+        int frag_threshold;     /* threshold for fragmentation of tx packets */
+        int rts_threshold;      /* threshold for RTS mechanism */
+        int short_retry_limit;
+
+        int scan_min_time;      /* scan min channel time */
+        int scan_max_time;      /* scan max channel time */
+        int scan_mode;          /* SCAN_TYPE_ACTIVE, SCAN_TYPE_PASSIVE */
+        int scan_need_any;      /* if set, need to scan for any ESSID */
+
+        u16 assoc_id;           /* current association ID, if associated */
+
+        u8 pm_mode;             /* power management mode */
+        u32 pm_period;          /* power management period in microseconds */
+
+        struct reg_domain const *domain;        /* reg domain description */
+
+        /* These fields contain HW config provided by the device (not all of
+         * these fields are used by all board types) */
+        u8 mac_addr[ETH_ALEN];
+        u8 regulatory_domain;
+
+        struct at76_card_config card_config;
+
+        enum board_type board_type;
+        struct mib_fw_version fw_version;
+
+        unsigned int device_unplugged:1;
+        unsigned int netdev_registered:1;
+        struct set_mib_buffer mib_buf;  /* global buffer for set_mib calls */
+
+        int beacon_period;      /* period of mgmt beacons, Kus */
+
+        struct ieee80211_hw *hw;
+        int mac80211_registered;
+};
+
+#define AT76_SUPPORTED_FILTERS FIF_PROMISC_IN_BSS
+
+#define SCAN_POLL_INTERVAL      (HZ / 4)
+
+#define CMD_COMPLETION_TIMEOUT  (5 * HZ)
+
+#define DEF_RTS_THRESHOLD       1536
+#define DEF_FRAG_THRESHOLD      1536
+#define DEF_SHORT_RETRY_LIMIT   8
+#define DEF_CHANNEL             10
+#define DEF_SCAN_MIN_TIME       10
+#define DEF_SCAN_MAX_TIME       120
+
+/* the max padding size for tx in bytes (see calc_padding) */
+#define MAX_PADDING_SIZE        53
+
+#endif                          /* _AT76_USB_H */
diff --git a/drivers/net/wireless/ath5k/base.c b/drivers/net/wireless/ath5k/base.c
index 6837ca9f3831..bce825b9ff1b 100644
--- a/drivers/net/wireless/ath5k/base.c
+++ b/drivers/net/wireless/ath5k/base.c
@@ -350,6 +350,7 @@ static int 	ath5k_beacon_setup(struct ath5k_softc *sc,
 static void     ath5k_beacon_send(struct ath5k_softc *sc);
 static void     ath5k_beacon_config(struct ath5k_softc *sc);
 static void     ath5k_beacon_update_timers(struct ath5k_softc *sc, u64 bc_tsf);
+static void     ath5k_tasklet_beacon(unsigned long data);
 
 static inline u64 ath5k_extend_tsf(struct ath5k_hw *ah, u32 rstamp)
 {
@@ -789,6 +790,7 @@ ath5k_attach(struct pci_dev *pdev, struct ieee80211_hw *hw)
         tasklet_init(&sc->rxtq, ath5k_tasklet_rx, (unsigned long)sc);
         tasklet_init(&sc->txtq, ath5k_tasklet_tx, (unsigned long)sc);
         tasklet_init(&sc->restq, ath5k_tasklet_reset, (unsigned long)sc);
+        tasklet_init(&sc->beacontq, ath5k_tasklet_beacon, (unsigned long)sc);
         setup_timer(&sc->calib_tim, ath5k_calibrate, (unsigned long)sc);
 
         ret = ath5k_eeprom_read_mac(ah, mac);
@@ -1218,6 +1220,10 @@ ath5k_txbuf_setup(struct ath5k_softc *sc, struct ath5k_buf *bf)
 
         pktlen = skb->len;
 
+        if (info->control.hw_key) {
+                keyidx = info->control.hw_key->hw_key_idx;
+                pktlen += info->control.hw_key->icv_len;
+        }
         if (rc_flags & IEEE80211_TX_RC_USE_RTS_CTS) {
                 flags |= AR5K_TXDESC_RTSENA;
                 cts_rate = ieee80211_get_rts_cts_rate(sc->hw, info)->hw_value;
@@ -1230,11 +1236,6 @@ ath5k_txbuf_setup(struct ath5k_softc *sc, struct ath5k_buf *bf)
                 duration = le16_to_cpu(ieee80211_ctstoself_duration(sc->hw,
                         sc->vif, pktlen, info));
         }
-
-        if (info->control.hw_key) {
-                keyidx = info->control.hw_key->hw_key_idx;
-                pktlen += info->control.hw_key->icv_len;
-        }
         ret = ah->ah_setup_tx_desc(ah, ds, pktlen,
                 ieee80211_get_hdrlen_from_skb(skb), AR5K_PKT_TYPE_NORMAL,
                 (sc->power_level * 2),
@@ -1700,6 +1701,34 @@ ath5k_check_ibss_tsf(struct ath5k_softc *sc, struct sk_buff *skb,
         }
 }
 
+static void ath5k_tasklet_beacon(unsigned long data)
+{
+        struct ath5k_softc *sc = (struct ath5k_softc *) data;
+
+        /*
+         * Software beacon alert--time to send a beacon.
+         *
+         * In IBSS mode we use this interrupt just to
+         * keep track of the next TBTT (target beacon
+         * transmission time) in order to detect wether
+         * automatic TSF updates happened.
+         */
+        if (sc->opmode == NL80211_IFTYPE_ADHOC) {
+                /* XXX: only if VEOL suppported */
+                u64 tsf = ath5k_hw_get_tsf64(sc->ah);
+                sc->nexttbtt += sc->bintval;
+                ATH5K_DBG(sc, ATH5K_DEBUG_BEACON,
+                                "SWBA nexttbtt: %x hw_tu: %x "
+                                "TSF: %llx\n",
+                                sc->nexttbtt,
+                                TSF_TO_TU(tsf),
+                                (unsigned long long) tsf);
+        } else {
+                spin_lock(&sc->block);
+                ath5k_beacon_send(sc);
+                spin_unlock(&sc->block);
+        }
+}
 
 static void
 ath5k_tasklet_rx(unsigned long data)
@@ -2040,9 +2069,8 @@ err_unmap:
  * frame contents are done as needed and the slot time is
  * also adjusted based on current state.
  *
- * this is usually called from interrupt context (ath5k_intr())
- * but also from ath5k_beacon_config() in IBSS mode which in turn
- * can be called from a tasklet and user context
+ * This is called from software irq context (beacontq or restq
+ * tasklets) or user context from ath5k_beacon_config.
  */
 static void
 ath5k_beacon_send(struct ath5k_softc *sc)
@@ -2216,6 +2244,7 @@ static void
 ath5k_beacon_config(struct ath5k_softc *sc)
 {
         struct ath5k_hw *ah = sc->ah;
+        unsigned long flags;
 
         ath5k_hw_set_imr(ah, 0);
         sc->bmisscount = 0;
@@ -2237,9 +2266,9 @@ ath5k_beacon_config(struct ath5k_softc *sc)
 
                 if (sc->opmode == NL80211_IFTYPE_ADHOC) {
                         if (ath5k_hw_hasveol(ah)) {
-                                spin_lock(&sc->block);
+                                spin_lock_irqsave(&sc->block, flags);
                                 ath5k_beacon_send(sc);
-                                spin_unlock(&sc->block);
+                                spin_unlock_irqrestore(&sc->block, flags);
                         }
                 } else
                         ath5k_beacon_update_timers(sc, -1);
@@ -2391,6 +2420,7 @@ ath5k_stop_hw(struct ath5k_softc *sc)
         tasklet_kill(&sc->rxtq);
         tasklet_kill(&sc->txtq);
         tasklet_kill(&sc->restq);
+        tasklet_kill(&sc->beacontq);
 
         return ret;
 }
@@ -2408,16 +2438,9 @@ ath5k_intr(int irq, void *dev_id)
                 return IRQ_NONE;
 
         do {
-                /*
-                 * Figure out the reason(s) for the interrupt.  Note
-                 * that get_isr returns a pseudo-ISR that may include
-                 * bits we haven't explicitly enabled so we mask the
-                 * value to insure we only process bits we requested.
-                 */
                 ath5k_hw_get_isr(ah, &status);          /* NB: clears IRQ too */
                 ATH5K_DBG(sc, ATH5K_DEBUG_INTR, "status 0x%x/0x%x\n",
                                 status, sc->imask);
-                status &= sc->imask; /* discard unasked for bits */
                 if (unlikely(status & AR5K_INT_FATAL)) {
                         /*
                          * Fatal errors are unrecoverable.
@@ -2428,32 +2451,7 @@ ath5k_intr(int irq, void *dev_id)
                         tasklet_schedule(&sc->restq);
                 } else {
                         if (status & AR5K_INT_SWBA) {
-                                /*
-                                * Software beacon alert--time to send a beacon.
-                                * Handle beacon transmission directly; deferring
-                                * this is too slow to meet timing constraints
-                                * under load.
-                                *
-                                * In IBSS mode we use this interrupt just to
-                                * keep track of the next TBTT (target beacon
-                                * transmission time) in order to detect wether
-                                * automatic TSF updates happened.
-                                */
-                                if (sc->opmode == NL80211_IFTYPE_ADHOC) {
-                                         /* XXX: only if VEOL suppported */
-                                        u64 tsf = ath5k_hw_get_tsf64(ah);
-                                        sc->nexttbtt += sc->bintval;
-                                        ATH5K_DBG(sc, ATH5K_DEBUG_BEACON,
-                                                  "SWBA nexttbtt: %x hw_tu: %x "
-                                                  "TSF: %llx\n",
-                                                  sc->nexttbtt,
-                                                  TSF_TO_TU(tsf),
-                                                  (unsigned long long) tsf);
-                                } else {
-                                        spin_lock(&sc->block);
-                                        ath5k_beacon_send(sc);
-                                        spin_unlock(&sc->block);
-                                }
+                                tasklet_schedule(&sc->beacontq);
                         }
                         if (status & AR5K_INT_RXEOL) {
                                 /*
diff --git a/drivers/net/wireless/ath5k/base.h b/drivers/net/wireless/ath5k/base.h
index c0fb8b5c42fe..20e0d14b41ec 100644
--- a/drivers/net/wireless/ath5k/base.h
+++ b/drivers/net/wireless/ath5k/base.h
@@ -169,6 +169,7 @@ struct ath5k_softc {
         struct ath5k_led        tx_led;         /* tx led */
 
         spinlock_t              block;          /* protects beacon */
+        struct tasklet_struct   beacontq;       /* beacon intr tasklet */
         struct ath5k_buf        *bbuf;          /* beacon buffer */
         unsigned int            bhalq,          /* SW q for outgoing beacons */
                                 bmisscount,     /* missed beacon transmits */
diff --git a/drivers/net/wireless/ath9k/ani.c b/drivers/net/wireless/ath9k/ani.c
index d4df7e611df5..a39eb760cbb7 100644
--- a/drivers/net/wireless/ath9k/ani.c
+++ b/drivers/net/wireless/ath9k/ani.c
@@ -642,14 +642,13 @@ void ath9k_enable_mib_counters(struct ath_hw *ah)
         REG_WRITE(ah, AR_PHY_ERR_MASK_2, AR_PHY_ERR_CCK_TIMING);
 }
 
+/* Freeze the MIB counters, get the stats and then clear them */
 void ath9k_hw_disable_mib_counters(struct ath_hw *ah)
 {
         DPRINTF(ah->ah_sc, ATH_DBG_ANI, "Disable MIB counters\n");
-
-        REG_WRITE(ah, AR_MIBC, AR_MIBC_FMC | AR_MIBC_CMC);
-
+        REG_WRITE(ah, AR_MIBC, AR_MIBC_FMC);
         ath9k_hw_update_mibstats(ah, &ah->ah_mibStats);
-
+        REG_WRITE(ah, AR_MIBC, AR_MIBC_CMC);
         REG_WRITE(ah, AR_FILT_OFDM, 0);
         REG_WRITE(ah, AR_FILT_CCK, 0);
 }
diff --git a/drivers/net/wireless/ath9k/ath9k.h b/drivers/net/wireless/ath9k/ath9k.h
index 0b0f82c83ffc..6481ea4bbc4e 100644
--- a/drivers/net/wireless/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath9k/ath9k.h
@@ -464,13 +464,11 @@ void ath_beacon_sync(struct ath_softc *sc, int if_id);
 /* ANI */
 /*******/
 
-/* ANI values for STA only.
-   FIXME: Add appropriate values for AP later */
-
-#define ATH_ANI_POLLINTERVAL    100     /* 100 milliseconds between ANI poll */
-#define ATH_SHORT_CALINTERVAL   1000    /* 1 second between calibrations */
-#define ATH_LONG_CALINTERVAL    30000   /* 30 seconds between calibrations */
-#define ATH_RESTART_CALINTERVAL 1200000 /* 20 minutes between calibrations */
+#define ATH_STA_SHORT_CALINTERVAL 1000    /* 1 second */
+#define ATH_AP_SHORT_CALINTERVAL  100     /* 100 ms */
+#define ATH_ANI_POLLINTERVAL      100     /* 100 ms */
+#define ATH_LONG_CALINTERVAL      30000   /* 30 seconds */
+#define ATH_RESTART_CALINTERVAL   1200000 /* 20 minutes */
 
 struct ath_ani {
         bool caldone;
diff --git a/drivers/net/wireless/ath9k/beacon.c b/drivers/net/wireless/ath9k/beacon.c
index 2e2ef3529135..18bda362d3ab 100644
--- a/drivers/net/wireless/ath9k/beacon.c
+++ b/drivers/net/wireless/ath9k/beacon.c
@@ -753,6 +753,9 @@ void ath_beacon_config(struct ath_softc *sc, int if_id)
                 if (bs.bs_sleepduration > bs.bs_dtimperiod)
                         bs.bs_sleepduration = bs.bs_dtimperiod;
 
+                /* TSF out of range threshold fixed at 1 second */
+                bs.bs_tsfoor_threshold = ATH9K_TSFOOR_THRESHOLD;
+
                 DPRINTF(sc, ATH_DBG_BEACON,
                         "tsf %llu "
                         "tsf:tu %u "
@@ -787,8 +790,6 @@ void ath_beacon_config(struct ath_softc *sc, int if_id)
                 u64 tsf;
                 u32 tsftu;
                 ath9k_hw_set_interrupts(ah, 0);
-                if (nexttbtt == intval)
-                        intval |= ATH9K_BEACON_RESET_TSF;
                 if (sc->sc_ah->opmode == NL80211_IFTYPE_ADHOC) {
                         /*
                          * Pull nexttbtt forward to reflect the current
@@ -822,6 +823,9 @@ void ath_beacon_config(struct ath_softc *sc, int if_id)
                                 sc->imask |= ATH9K_INT_SWBA;
                         ath_beaconq_config(sc);
                 } else if (sc->sc_ah->opmode == NL80211_IFTYPE_AP) {
+                        if (nexttbtt == intval)
+                                intval |= ATH9K_BEACON_RESET_TSF;
+
                         /*
                          * In AP mode we enable the beacon timers and
                          * SWBA interrupts to prepare beacon frames.
diff --git a/drivers/net/wireless/ath9k/calib.c b/drivers/net/wireless/ath9k/calib.c
index 1fc3a08e85c6..1c074c059b5c 100644
--- a/drivers/net/wireless/ath9k/calib.c
+++ b/drivers/net/wireless/ath9k/calib.c
@@ -718,6 +718,33 @@ s16 ath9k_hw_getchan_noise(struct ath_hw *ah, struct ath9k_channel *chan)
         return nf;
 }
 
+static void ath9k_olc_temp_compensation(struct ath_hw *ah)
+{
+        u32 rddata, i;
+        int delta, currPDADC, regval;
+
+        rddata = REG_READ(ah, AR_PHY_TX_PWRCTRL4);
+
+        currPDADC = MS(rddata, AR_PHY_TX_PWRCTRL_PD_AVG_OUT);
+
+        if (ah->eep_ops->get_eeprom(ah, EEP_DAC_HPWR_5G))
+                delta = (currPDADC - ah->initPDADC + 4) / 8;
+        else
+                delta = (currPDADC - ah->initPDADC + 5) / 10;
+
+        if (delta != ah->PDADCdelta) {
+                ah->PDADCdelta = delta;
+                for (i = 1; i < AR9280_TX_GAIN_TABLE_SIZE; i++) {
+                        regval = ah->originalGain[i] - delta;
+                        if (regval < 0)
+                                regval = 0;
+
+                        REG_RMW_FIELD(ah, AR_PHY_TX_GAIN_TBL1 + i * 4,
+                                        AR_PHY_TX_GAIN, regval);
+                }
+        }
+}
+
 bool ath9k_hw_calibrate(struct ath_hw *ah, struct ath9k_channel *chan,
                         u8 rxchainmask, bool longcal,
                         bool *isCalDone)
@@ -742,6 +769,8 @@ bool ath9k_hw_calibrate(struct ath_hw *ah, struct ath9k_channel *chan,
         }
 
         if (longcal) {
+                if (OLC_FOR_AR9280_20_LATER)
+                        ath9k_olc_temp_compensation(ah);
                 ath9k_hw_getnf(ah, chan);
                 ath9k_hw_loadnf(ah, ah->curchan);
                 ath9k_hw_start_nfcal(ah);
@@ -851,20 +880,53 @@ static inline void ath9k_hw_9285_pa_cal(struct ath_hw *ah)
 bool ath9k_hw_init_cal(struct ath_hw *ah,
                        struct ath9k_channel *chan)
 {
+        if (AR_SREV_9280_10_OR_LATER(ah)) {
+                REG_CLR_BIT(ah, AR_PHY_ADC_CTL, AR_PHY_ADC_CTL_OFF_PWDADC);
+                REG_SET_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_FLTR_CAL);
+                REG_CLR_BIT(ah, AR_PHY_CL_CAL_CTL, AR_PHY_CL_CAL_ENABLE);
+
+                /* Kick off the cal */
+                REG_WRITE(ah, AR_PHY_AGC_CONTROL,
+                          REG_READ(ah, AR_PHY_AGC_CONTROL) |
+                          AR_PHY_AGC_CONTROL_CAL);
+
+                if (!ath9k_hw_wait(ah, AR_PHY_AGC_CONTROL,
+                                   AR_PHY_AGC_CONTROL_CAL, 0,
+                                   AH_WAIT_TIMEOUT)) {
+                        DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
+                                "offset calibration failed to complete in 1ms; "
+                                "noisy environment?\n");
+                        return false;
+                }
+
+                REG_CLR_BIT(ah, AR_PHY_ADC_CTL, AR_PHY_ADC_CTL_OFF_PWDADC);
+                REG_SET_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_FLTR_CAL);
+                REG_SET_BIT(ah, AR_PHY_CL_CAL_CTL, AR_PHY_CL_CAL_ENABLE);
+        }
+
+        /* Calibrate the AGC */
         REG_WRITE(ah, AR_PHY_AGC_CONTROL,
                   REG_READ(ah, AR_PHY_AGC_CONTROL) |
                   AR_PHY_AGC_CONTROL_CAL);
 
-        if (!ath9k_hw_wait(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_CAL, 0)) {
+        if (!ath9k_hw_wait(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_CAL,
+                           0, AH_WAIT_TIMEOUT)) {
                 DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE,
                         "offset calibration failed to complete in 1ms; "
                         "noisy environment?\n");
                 return false;
         }
 
+        if (AR_SREV_9280_10_OR_LATER(ah)) {
+                REG_SET_BIT(ah, AR_PHY_ADC_CTL, AR_PHY_ADC_CTL_OFF_PWDADC);
+                REG_CLR_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_FLTR_CAL);
+        }
+
+        /* Do PA Calibration */
         if (AR_SREV_9285(ah) && AR_SREV_9285_11_OR_LATER(ah))
                 ath9k_hw_9285_pa_cal(ah);
 
+        /* Do NF Calibration */
         REG_WRITE(ah, AR_PHY_AGC_CONTROL,
                   REG_READ(ah, AR_PHY_AGC_CONTROL) |
                   AR_PHY_AGC_CONTROL_NF);
diff --git a/drivers/net/wireless/ath9k/calib.h b/drivers/net/wireless/ath9k/calib.h
index d2448f049c1d..32589e0c5018 100644
--- a/drivers/net/wireless/ath9k/calib.h
+++ b/drivers/net/wireless/ath9k/calib.h
@@ -27,7 +27,7 @@ extern const struct hal_percal_data adc_init_dc_cal;
 
 #define AR_PHY_CCA_MAX_GOOD_VALUE               -85
 #define AR_PHY_CCA_MAX_HIGH_VALUE               -62
-#define AR_PHY_CCA_MIN_BAD_VALUE                -121
+#define AR_PHY_CCA_MIN_BAD_VALUE                -140
 #define AR_PHY_CCA_FILTERWINDOW_LENGTH_INIT     3
 #define AR_PHY_CCA_FILTERWINDOW_LENGTH          5
 
diff --git a/drivers/net/wireless/ath9k/debug.c b/drivers/net/wireless/ath9k/debug.c
index 800ad5926b6f..0c422c50e4f0 100644
--- a/drivers/net/wireless/ath9k/debug.c
+++ b/drivers/net/wireless/ath9k/debug.c
@@ -258,13 +258,14 @@ void ath_debug_stat_rc(struct ath_softc *sc, struct sk_buff *skb)
 
 /* FIXME: legacy rates, later on .. */
 void ath_debug_stat_retries(struct ath_softc *sc, int rix,
-                            int xretries, int retries)
+                            int xretries, int retries, u8 per)
 {
         if (conf_is_ht(&sc->hw->conf)) {
                 int idx = sc->cur_rate_table->info[rix].dot11rate;
 
                 sc->debug.stats.n_rcstats[idx].xretries += xretries;
                 sc->debug.stats.n_rcstats[idx].retries += retries;
+                sc->debug.stats.n_rcstats[idx].per = per;
         }
 }
 
@@ -277,15 +278,16 @@ static ssize_t ath_read_file_stat_11n_rc(struct file *file,
         unsigned int len = 0;
         int i = 0;
 
-        len += sprintf(buf, "%7s %13s %8s %8s\n\n", "Rate", "Success",
-                       "Retries", "XRetries");
+        len += sprintf(buf, "%7s %13s %8s %8s %6s\n\n", "Rate", "Success",
+                       "Retries", "XRetries", "PER");
 
         for (i = 0; i <= 15; i++) {
                 len += snprintf(buf + len, sizeof(buf) - len,
-                                "%5s%3d: %8u %8u %8u\n", "MCS", i,
+                                "%5s%3d: %8u %8u %8u %8u\n", "MCS", i,
                                 sc->debug.stats.n_rcstats[i].success,
                                 sc->debug.stats.n_rcstats[i].retries,
-                                sc->debug.stats.n_rcstats[i].xretries);
+                                sc->debug.stats.n_rcstats[i].xretries,
+                                sc->debug.stats.n_rcstats[i].per);
         }
 
         return simple_read_from_buffer(user_buf, count, ppos, buf, len);
diff --git a/drivers/net/wireless/ath9k/debug.h b/drivers/net/wireless/ath9k/debug.h
index 61e969894c0a..01681f2d0549 100644
--- a/drivers/net/wireless/ath9k/debug.h
+++ b/drivers/net/wireless/ath9k/debug.h
@@ -91,12 +91,13 @@ struct ath_11n_rc_stats {
         u32 success;
         u32 retries;
         u32 xretries;
+        u8 per;
 };
 
 struct ath_stats {
         struct ath_interrupt_stats istats;
-        struct ath_legacy_rc_stats legacy_rcstats[12]; /* max(11a,11b,11g) */
-        struct ath_11n_rc_stats n_rcstats[16]; /* 0..15 MCS rates */
+        struct ath_legacy_rc_stats legacy_rcstats[12];  /* max(11a,11b,11g) */
+        struct ath_11n_rc_stats n_rcstats[16];          /* 0..15 MCS rates */
 };
 
 struct ath9k_debug {
@@ -115,7 +116,7 @@ void ath9k_exit_debug(struct ath_softc *sc);
 void ath_debug_stat_interrupt(struct ath_softc *sc, enum ath9k_int status);
 void ath_debug_stat_rc(struct ath_softc *sc, struct sk_buff *skb);
 void ath_debug_stat_retries(struct ath_softc *sc, int rix,
-                            int xretries, int retries);
+                            int xretries, int retries, u8 per);
 
 #else
 
@@ -144,7 +145,7 @@ static inline void ath_debug_stat_rc(struct ath_softc *sc,
 }
 
 static inline void ath_debug_stat_retries(struct ath_softc *sc, int rix,
-                                          int xretries, int retries)
+                                          int xretries, int retries, u8 per)
 {
 }
 
diff --git a/drivers/net/wireless/ath9k/eeprom.c b/drivers/net/wireless/ath9k/eeprom.c
index b55e9920a5d4..02d0b919ee3d 100644
--- a/drivers/net/wireless/ath9k/eeprom.c
+++ b/drivers/net/wireless/ath9k/eeprom.c
@@ -179,6 +179,69 @@ static void ath9k_hw_get_legacy_target_powers(struct ath_hw *ah,
         }
 }
 
+static void ath9k_get_txgain_index(struct ath_hw *ah,
+                struct ath9k_channel *chan,
+                struct calDataPerFreqOpLoop *rawDatasetOpLoop,
+                u8 *calChans,  u16 availPiers, u8 *pwr, u8 *pcdacIdx)
+{
+        u8 pcdac, i = 0;
+        u16 idxL = 0, idxR = 0, numPiers;
+        bool match;
+        struct chan_centers centers;
+
+        ath9k_hw_get_channel_centers(ah, chan, &centers);
+
+        for (numPiers = 0; numPiers < availPiers; numPiers++)
+                if (calChans[numPiers] == AR5416_BCHAN_UNUSED)
+                        break;
+
+        match = ath9k_hw_get_lower_upper_index(
+                        (u8)FREQ2FBIN(centers.synth_center, IS_CHAN_2GHZ(chan)),
+                        calChans, numPiers, &idxL, &idxR);
+        if (match) {
+                pcdac = rawDatasetOpLoop[idxL].pcdac[0][0];
+                *pwr = rawDatasetOpLoop[idxL].pwrPdg[0][0];
+        } else {
+                pcdac = rawDatasetOpLoop[idxR].pcdac[0][0];
+                *pwr = (rawDatasetOpLoop[idxL].pwrPdg[0][0] +
+                                rawDatasetOpLoop[idxR].pwrPdg[0][0])/2;
+        }
+
+        while (pcdac > ah->originalGain[i] &&
+                        i < (AR9280_TX_GAIN_TABLE_SIZE - 1))
+                i++;
+
+        *pcdacIdx = i;
+        return;
+}
+
+static void ath9k_olc_get_pdadcs(struct ath_hw *ah,
+                                u32 initTxGain,
+                                int txPower,
+                                u8 *pPDADCValues)
+{
+        u32 i;
+        u32 offset;
+
+        REG_RMW_FIELD(ah, AR_PHY_TX_PWRCTRL6_0,
+                        AR_PHY_TX_PWRCTRL_ERR_EST_MODE, 3);
+        REG_RMW_FIELD(ah, AR_PHY_TX_PWRCTRL6_1,
+                        AR_PHY_TX_PWRCTRL_ERR_EST_MODE, 3);
+
+        REG_RMW_FIELD(ah, AR_PHY_TX_PWRCTRL7,
+                        AR_PHY_TX_PWRCTRL_INIT_TX_GAIN, initTxGain);
+
+        offset = txPower;
+        for (i = 0; i < AR5416_NUM_PDADC_VALUES; i++)
+                if (i < offset)
+                        pPDADCValues[i] = 0x0;
+                else
+                        pPDADCValues[i] = 0xFF;
+}
+
+
+
+
 static void ath9k_hw_get_target_powers(struct ath_hw *ah,
                                        struct ath9k_channel *chan,
                                        struct cal_target_power_ht *powInfo,
@@ -439,7 +502,7 @@ static u32 ath9k_hw_4k_get_eeprom(struct ath_hw *ah,
 
         switch (param) {
         case EEP_NFTHRESH_2:
-                return pModal[1].noiseFloorThreshCh[0];
+                return pModal->noiseFloorThreshCh[0];
         case AR_EEPROM_MAC(0):
                 return pBase->macAddr[0] << 8 | pBase->macAddr[1];
         case AR_EEPROM_MAC(1):
@@ -466,6 +529,8 @@ static u32 ath9k_hw_4k_get_eeprom(struct ath_hw *ah,
                 return pBase->txMask;
         case EEP_RX_MASK:
                 return pBase->rxMask;
+        case EEP_FRAC_N_5G:
+                return 0;
         default:
                 return 0;
         }
@@ -1594,11 +1659,26 @@ static u32 ath9k_hw_def_get_eeprom(struct ath_hw *ah,
                 return pBase->rxGainType;
         case EEP_TXGAIN_TYPE:
                 return pBase->txGainType;
+        case EEP_OL_PWRCTRL:
+                if (AR5416_VER_MASK >= AR5416_EEP_MINOR_VER_19)
+                        return pBase->openLoopPwrCntl ? true : false;
+                else
+                        return false;
+        case EEP_RC_CHAIN_MASK:
+                if (AR5416_VER_MASK >= AR5416_EEP_MINOR_VER_19)
+                        return pBase->rcChainMask;
+                else
+                        return 0;
         case EEP_DAC_HPWR_5G:
                 if (AR5416_VER_MASK >= AR5416_EEP_MINOR_VER_20)
                         return pBase->dacHiPwrMode_5G;
                 else
                         return 0;
+        case EEP_FRAC_N_5G:
+                if (AR5416_VER_MASK >= AR5416_EEP_MINOR_VER_22)
+                        return pBase->frac_n_5g;
+                else
+                        return 0;
         default:
                 return 0;
         }
@@ -1832,8 +1912,15 @@ static bool ath9k_hw_def_set_board_values(struct ath_hw *ah,
                                       pModal->swSettleHt40);
         }
 
+        if (AR_SREV_9280_20_OR_LATER(ah) &&
+                        AR5416_VER_MASK >= AR5416_EEP_MINOR_VER_19)
+                REG_RMW_FIELD(ah, AR_PHY_CCK_TX_CTRL,
+                                AR_PHY_CCK_TX_CTRL_TX_DAC_SCALE_CCK,
+                                pModal->miscBits);
+
+
         if (AR_SREV_9280_20(ah) && AR5416_VER_MASK >= AR5416_EEP_MINOR_VER_20) {
-                if (IS_CHAN_HT20(chan))
+                if (IS_CHAN_2GHZ(chan))
                         REG_RMW_FIELD(ah, AR_AN_TOP1, AR_AN_TOP1_DACIPMODE,
                                         eep->baseEepHeader.dacLpMode);
                 else if (eep->baseEepHeader.dacHiPwrMode_5G)
@@ -1844,6 +1931,10 @@ static bool ath9k_hw_def_set_board_values(struct ath_hw *ah,
 
                 REG_RMW_FIELD(ah, AR_PHY_FRAME_CTL, AR_PHY_FRAME_CTL_TX_CLIP,
                                 pModal->miscBits >> 2);
+
+                REG_RMW_FIELD(ah, AR_PHY_TX_PWRCTRL9,
+                                AR_PHY_TX_DESIRED_SCALE_CCK,
+                                eep->baseEepHeader.desiredScaleCCK);
         }
 
         return true;
@@ -2073,6 +2164,10 @@ static bool ath9k_hw_set_def_power_cal_table(struct ath_hw *ah,
                                   struct ath9k_channel *chan,
                                   int16_t *pTxPowerIndexOffset)
 {
+#define SM_PD_GAIN(x) SM(0x38, AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_##x)
+#define SM_PDGAIN_B(x, y) \
+                SM((gainBoundaries[x]), AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_##y)
+
         struct ar5416_eeprom_def *pEepData = &ah->eeprom.def;
         struct cal_data_per_freq *pRawDataset;
         u8 *pCalBChans = NULL;
@@ -2106,6 +2201,12 @@ static bool ath9k_hw_set_def_power_cal_table(struct ath_hw *ah,
                 numPiers = AR5416_NUM_5G_CAL_PIERS;
         }
 
+        if (OLC_FOR_AR9280_20_LATER && IS_CHAN_2GHZ(chan)) {
+                pRawDataset = pEepData->calPierData2G[0];
+                ah->initPDADC = ((struct calDataPerFreqOpLoop *)
+                                 pRawDataset)->vpdPdg[0][0];
+        }
+
         numXpdGain = 0;
 
         for (i = 1; i <= AR5416_PD_GAINS_IN_MASK; i++) {
@@ -2141,25 +2242,45 @@ static bool ath9k_hw_set_def_power_cal_table(struct ath_hw *ah,
                         else
                                 pRawDataset = pEepData->calPierData5G[i];
 
-                        ath9k_hw_get_def_gain_boundaries_pdadcs(ah, chan,
-                                            pRawDataset, pCalBChans,
-                                            numPiers, pdGainOverlap_t2,
-                                            &tMinCalPower, gainBoundaries,
-                                            pdadcValues, numXpdGain);
+
+                        if (OLC_FOR_AR9280_20_LATER) {
+                                u8 pcdacIdx;
+                                u8 txPower;
+
+                                ath9k_get_txgain_index(ah, chan,
+                                (struct calDataPerFreqOpLoop *)pRawDataset,
+                                pCalBChans, numPiers, &txPower, &pcdacIdx);
+                                ath9k_olc_get_pdadcs(ah, pcdacIdx,
+                                                     txPower/2, pdadcValues);
+                        } else {
+                                ath9k_hw_get_def_gain_boundaries_pdadcs(ah,
+                                                        chan, pRawDataset,
+                                                        pCalBChans, numPiers,
+                                                        pdGainOverlap_t2,
+                                                        &tMinCalPower,
+                                                        gainBoundaries,
+                                                        pdadcValues,
+                                                        numXpdGain);
+                        }
 
                         if ((i == 0) || AR_SREV_5416_V20_OR_LATER(ah)) {
-                                REG_WRITE(ah,
-                                          AR_PHY_TPCRG5 + regChainOffset,
-                                          SM(pdGainOverlap_t2,
-                                             AR_PHY_TPCRG5_PD_GAIN_OVERLAP)
-                                          | SM(gainBoundaries[0],
-                                               AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_1)
-                                          | SM(gainBoundaries[1],
-                                               AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_2)
-                                          | SM(gainBoundaries[2],
-                                               AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_3)
-                                          | SM(gainBoundaries[3],
-                                       AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_4));
+                                if (OLC_FOR_AR9280_20_LATER) {
+                                        REG_WRITE(ah,
+                                                AR_PHY_TPCRG5 + regChainOffset,
+                                                SM(0x6,
+                                                AR_PHY_TPCRG5_PD_GAIN_OVERLAP) |
+                                                SM_PD_GAIN(1) | SM_PD_GAIN(2) |
+                                                SM_PD_GAIN(3) | SM_PD_GAIN(4));
+                                } else {
+                                        REG_WRITE(ah,
+                                                AR_PHY_TPCRG5 + regChainOffset,
+                                                SM(pdGainOverlap_t2,
+                                                AR_PHY_TPCRG5_PD_GAIN_OVERLAP)|
+                                                SM_PDGAIN_B(0, 1) |
+                                                SM_PDGAIN_B(1, 2) |
+                                                SM_PDGAIN_B(2, 3) |
+                                                SM_PDGAIN_B(3, 4));
+                                }
                         }
 
                         regOffset = AR_PHY_BASE + (672 << 2) + regChainOffset;
@@ -2193,6 +2314,8 @@ static bool ath9k_hw_set_def_power_cal_table(struct ath_hw *ah,
         *pTxPowerIndexOffset = 0;
 
         return true;
+#undef SM_PD_GAIN
+#undef SM_PDGAIN_B
 }
 
 static bool ath9k_hw_set_def_power_per_rate_table(struct ath_hw *ah,
@@ -2493,13 +2616,14 @@ static int ath9k_hw_def_set_txpower(struct ath_hw *ah,
                                     u8 twiceMaxRegulatoryPower,
                                     u8 powerLimit)
 {
+#define RT_AR_DELTA(x) (ratesArray[x] - cck_ofdm_delta)
         struct ar5416_eeprom_def *pEepData = &ah->eeprom.def;
         struct modal_eep_header *pModal =
                 &(pEepData->modalHeader[IS_CHAN_2GHZ(chan)]);
         int16_t ratesArray[Ar5416RateSize];
         int16_t txPowerIndexOffset = 0;
         u8 ht40PowerIncForPdadc = 2;
-        int i;
+        int i, cck_ofdm_delta = 0;
 
         memset(ratesArray, 0, sizeof(ratesArray));
 
@@ -2548,16 +2672,30 @@ static int ath9k_hw_def_set_txpower(struct ath_hw *ah,
                   | ATH9K_POW_SM(ratesArray[rate24mb], 0));
 
         if (IS_CHAN_2GHZ(chan)) {
-                REG_WRITE(ah, AR_PHY_POWER_TX_RATE3,
-                          ATH9K_POW_SM(ratesArray[rate2s], 24)
-                          | ATH9K_POW_SM(ratesArray[rate2l], 16)
-                          | ATH9K_POW_SM(ratesArray[rateXr], 8)
-                          | ATH9K_POW_SM(ratesArray[rate1l], 0));
-                REG_WRITE(ah, AR_PHY_POWER_TX_RATE4,
-                          ATH9K_POW_SM(ratesArray[rate11s], 24)
-                          | ATH9K_POW_SM(ratesArray[rate11l], 16)
-                          | ATH9K_POW_SM(ratesArray[rate5_5s], 8)
-                          | ATH9K_POW_SM(ratesArray[rate5_5l], 0));
+                if (OLC_FOR_AR9280_20_LATER) {
+                        cck_ofdm_delta = 2;
+                        REG_WRITE(ah, AR_PHY_POWER_TX_RATE3,
+                                ATH9K_POW_SM(RT_AR_DELTA(rate2s), 24)
+                                | ATH9K_POW_SM(RT_AR_DELTA(rate2l), 16)
+                                | ATH9K_POW_SM(ratesArray[rateXr], 8)
+                                | ATH9K_POW_SM(RT_AR_DELTA(rate1l), 0));
+                        REG_WRITE(ah, AR_PHY_POWER_TX_RATE4,
+                                ATH9K_POW_SM(RT_AR_DELTA(rate11s), 24)
+                                | ATH9K_POW_SM(RT_AR_DELTA(rate11l), 16)
+                                | ATH9K_POW_SM(RT_AR_DELTA(rate5_5s), 8)
+                                | ATH9K_POW_SM(RT_AR_DELTA(rate5_5l), 0));
+                } else {
+                        REG_WRITE(ah, AR_PHY_POWER_TX_RATE3,
+                                ATH9K_POW_SM(ratesArray[rate2s], 24)
+                                | ATH9K_POW_SM(ratesArray[rate2l], 16)
+                                | ATH9K_POW_SM(ratesArray[rateXr], 8)
+                                | ATH9K_POW_SM(ratesArray[rate1l], 0));
+                        REG_WRITE(ah, AR_PHY_POWER_TX_RATE4,
+                                ATH9K_POW_SM(ratesArray[rate11s], 24)
+                                | ATH9K_POW_SM(ratesArray[rate11l], 16)
+                                | ATH9K_POW_SM(ratesArray[rate5_5s], 8)
+                                | ATH9K_POW_SM(ratesArray[rate5_5l], 0));
+                }
         }
 
         REG_WRITE(ah, AR_PHY_POWER_TX_RATE5,
@@ -2590,12 +2728,19 @@ static int ath9k_hw_def_set_txpower(struct ath_hw *ah,
                                          ht40PowerIncForPdadc, 8)
                           | ATH9K_POW_SM(ratesArray[rateHt40_4] +
                                          ht40PowerIncForPdadc, 0));
-
-                REG_WRITE(ah, AR_PHY_POWER_TX_RATE9,
-                          ATH9K_POW_SM(ratesArray[rateExtOfdm], 24)
-                          | ATH9K_POW_SM(ratesArray[rateExtCck], 16)
-                          | ATH9K_POW_SM(ratesArray[rateDupOfdm], 8)
-                          | ATH9K_POW_SM(ratesArray[rateDupCck], 0));
+                if (OLC_FOR_AR9280_20_LATER) {
+                        REG_WRITE(ah, AR_PHY_POWER_TX_RATE9,
+                                ATH9K_POW_SM(ratesArray[rateExtOfdm], 24)
+                                | ATH9K_POW_SM(RT_AR_DELTA(rateExtCck), 16)
+                                | ATH9K_POW_SM(ratesArray[rateDupOfdm], 8)
+                                | ATH9K_POW_SM(RT_AR_DELTA(rateDupCck), 0));
+                } else {
+                        REG_WRITE(ah, AR_PHY_POWER_TX_RATE9,
+                                ATH9K_POW_SM(ratesArray[rateExtOfdm], 24)
+                                | ATH9K_POW_SM(ratesArray[rateExtCck], 16)
+                                | ATH9K_POW_SM(ratesArray[rateDupOfdm], 8)
+                                | ATH9K_POW_SM(ratesArray[rateDupCck], 0));
+                }
         }
 
         REG_WRITE(ah, AR_PHY_POWER_TX_SUB,
@@ -2615,6 +2760,21 @@ static int ath9k_hw_def_set_txpower(struct ath_hw *ah,
         else
                 ah->regulatory.max_power_level = ratesArray[i];
 
+        switch(ar5416_get_ntxchains(ah->txchainmask)) {
+        case 1:
+                break;
+        case 2:
+                ah->regulatory.max_power_level += INCREASE_MAXPOW_BY_TWO_CHAIN;
+                break;
+        case 3:
+                ah->regulatory.max_power_level += INCREASE_MAXPOW_BY_THREE_CHAIN;
+                break;
+        default:
+                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
+                        "Invalid chainmask configuration\n");
+                break;
+        }
+
         return 0;
 }
 
diff --git a/drivers/net/wireless/ath9k/eeprom.h b/drivers/net/wireless/ath9k/eeprom.h
index 99863b570441..6296e3eff10b 100644
--- a/drivers/net/wireless/ath9k/eeprom.h
+++ b/drivers/net/wireless/ath9k/eeprom.h
@@ -75,11 +75,29 @@
 #define SUB_NUM_CTL_MODES_AT_5G_40 2
 #define SUB_NUM_CTL_MODES_AT_2G_40 3
 
+#define INCREASE_MAXPOW_BY_TWO_CHAIN     6  /* 10*log10(2)*2 */
+#define INCREASE_MAXPOW_BY_THREE_CHAIN   10 /* 10*log10(3)*2 */
+
+/*
+ * For AR9285 and later chipsets, the following bits are not being programmed
+ * in EEPROM and so need to be enabled always.
+ *
+ * Bit 0: en_fcc_mid
+ * Bit 1: en_jap_mid
+ * Bit 2: en_fcc_dfs_ht40
+ * Bit 3: en_jap_ht40
+ * Bit 4: en_jap_dfs_ht40
+ */
+#define AR9285_RDEXT_DEFAULT    0x1F
+
 #define AR_EEPROM_MAC(i)        (0x1d+(i))
 #define ATH9K_POW_SM(_r, _s)    (((_r) & 0x3f) << (_s))
 #define FREQ2FBIN(x, y)         ((y) ? ((x) - 2300) : (((x) - 4800) / 5))
 #define ath9k_hw_use_flash(_ah) (!(_ah->ah_flags & AH_USE_EEPROM))
 
+#define OLC_FOR_AR9280_20_LATER (AR_SREV_9280_20_OR_LATER(ah) && \
+                                 ah->eep_ops->get_eeprom(ah, EEP_OL_PWRCTRL))
+
 #define AR_EEPROM_RFSILENT_GPIO_SEL     0x001c
 #define AR_EEPROM_RFSILENT_GPIO_SEL_S   2
 #define AR_EEPROM_RFSILENT_POLARITY     0x0002
@@ -110,6 +128,7 @@
 #define AR5416_EEP_MINOR_VER_17      0x11
 #define AR5416_EEP_MINOR_VER_19      0x13
 #define AR5416_EEP_MINOR_VER_20      0x14
+#define AR5416_EEP_MINOR_VER_22      0x16
 
 #define AR5416_NUM_5G_CAL_PIERS         8
 #define AR5416_NUM_2G_CAL_PIERS         4
@@ -152,6 +171,8 @@
 #define AR5416_EEP4K_PD_GAIN_ICEPTS           5
 #define AR5416_EEP4K_MAX_CHAINS               1
 
+#define AR9280_TX_GAIN_TABLE_SIZE 22
+
 enum eeprom_param {
         EEP_NFTHRESH_5,
         EEP_NFTHRESH_2,
@@ -172,7 +193,10 @@ enum eeprom_param {
         EEP_RX_MASK,
         EEP_RXGAIN_TYPE,
         EEP_TXGAIN_TYPE,
+        EEP_OL_PWRCTRL,
+        EEP_RC_CHAIN_MASK,
         EEP_DAC_HPWR_5G,
+        EEP_FRAC_N_5G
 };
 
 enum ar5416_rates {
@@ -212,12 +236,14 @@ struct base_eep_header {
         u8 futureBase_1[2];
         u8 rxGainType;
         u8 dacHiPwrMode_5G;
-        u8 futureBase_2;
+        u8 openLoopPwrCntl;
         u8 dacLpMode;
         u8 txGainType;
         u8 rcChainMask;
         u8 desiredScaleCCK;
-        u8 futureBase_3[23];
+        u8 power_table_offset;
+        u8 frac_n_5g;
+        u8 futureBase_3[21];
 } __packed;
 
 struct base_eep_header_4k {
@@ -291,6 +317,13 @@ struct modal_eep_header {
         struct spur_chan spurChans[AR5416_EEPROM_MODAL_SPURS];
 } __packed;
 
+struct calDataPerFreqOpLoop {
+        u8 pwrPdg[2][5];
+        u8 vpdPdg[2][5];
+        u8 pcdac[2][5];
+        u8 empty[2][5];
+} __packed;
+
 struct modal_eep_4k_header {
         u32  antCtrlChain[AR5416_EEP4K_MAX_CHAINS];
         u32  antCtrlCommon;
diff --git a/drivers/net/wireless/ath9k/hw.c b/drivers/net/wireless/ath9k/hw.c
index cad8e39c201e..2acbb84dc2ba 100644
--- a/drivers/net/wireless/ath9k/hw.c
+++ b/drivers/net/wireless/ath9k/hw.c
@@ -84,11 +84,13 @@ static u32 ath9k_hw_mac_to_clks(struct ath_hw *ah, u32 usecs)
                 return ath9k_hw_mac_clks(ah, usecs);
 }
 
-bool ath9k_hw_wait(struct ath_hw *ah, u32 reg, u32 mask, u32 val)
+bool ath9k_hw_wait(struct ath_hw *ah, u32 reg, u32 mask, u32 val, u32 timeout)
 {
         int i;
 
-        for (i = 0; i < (AH_TIMEOUT / AH_TIME_QUANTUM); i++) {
+        BUG_ON(timeout < AH_TIME_QUANTUM);
+
+        for (i = 0; i < (timeout / AH_TIME_QUANTUM); i++) {
                 if ((REG_READ(ah, reg) & mask) == val)
                         return true;
 
@@ -96,8 +98,8 @@ bool ath9k_hw_wait(struct ath_hw *ah, u32 reg, u32 mask, u32 val)
         }
 
         DPRINTF(ah->ah_sc, ATH_DBG_REG_IO,
-                "timeout on reg 0x%x: 0x%08x & 0x%08x != 0x%08x\n",
-                reg, REG_READ(ah, reg), mask, val);
+                "timeout (%d us) on reg 0x%x: 0x%08x & 0x%08x != 0x%08x\n",
+                timeout, reg, REG_READ(ah, reg), mask, val);
 
         return false;
 }
@@ -823,7 +825,16 @@ static struct ath_hw *ath9k_hw_do_attach(u16 devid, struct ath_softc *sc,
         if (AR_SREV_9280_20(ah))
                 ath9k_hw_init_txgain_ini(ah);
 
-        if (ah->hw_version.devid == AR9280_DEVID_PCI) {
+        if (!ath9k_hw_fill_cap_info(ah)) {
+                DPRINTF(sc, ATH_DBG_RESET, "failed ath9k_hw_fill_cap_info\n");
+                ecode = -EINVAL;
+                goto bad;
+        }
+
+        if ((ah->hw_version.devid == AR9280_DEVID_PCI) &&
+            test_bit(ATH9K_MODE_11A, ah->caps.wireless_modes)) {
+
+                /* EEPROM Fixup */
                 for (i = 0; i < ah->iniModes.ia_rows; i++) {
                         u32 reg = INI_RA(&ah->iniModes, i, 0);
 
@@ -838,13 +849,6 @@ static struct ath_hw *ath9k_hw_do_attach(u16 devid, struct ath_softc *sc,
                 }
         }
 
-        if (!ath9k_hw_fill_cap_info(ah)) {
-                DPRINTF(sc, ATH_DBG_RESET,
-                        "failed ath9k_hw_fill_cap_info\n");
-                ecode = -EINVAL;
-                goto bad;
-        }
-
         ecode = ath9k_hw_init_macaddr(ah);
         if (ecode != 0) {
                 DPRINTF(sc, ATH_DBG_RESET,
@@ -1200,6 +1204,17 @@ static u32 ath9k_hw_ini_fixup(struct ath_hw *ah,
                 return ath9k_hw_def_ini_fixup(ah, pEepData, reg, value);
 }
 
+static void ath9k_olc_init(struct ath_hw *ah)
+{
+        u32 i;
+
+        for (i = 0; i < AR9280_TX_GAIN_TABLE_SIZE; i++)
+                ah->originalGain[i] =
+                        MS(REG_READ(ah, AR_PHY_TX_GAIN_TBL1 + i * 4),
+                                        AR_PHY_TX_GAIN);
+        ah->PDADCdelta = 0;
+}
+
 static int ath9k_hw_process_ini(struct ath_hw *ah,
                                 struct ath9k_channel *chan,
                                 enum ath9k_ht_macmode macmode)
@@ -1306,6 +1321,9 @@ static int ath9k_hw_process_ini(struct ath_hw *ah,
         ath9k_hw_set_regs(ah, chan, macmode);
         ath9k_hw_init_chain_masks(ah);
 
+        if (OLC_FOR_AR9280_20_LATER)
+                ath9k_olc_init(ah);
+
         status = ah->eep_ops->set_txpower(ah, chan,
                                   ath9k_regd_get_ctl(ah, chan),
                                   channel->max_antenna_gain * 2,
@@ -1464,6 +1482,14 @@ static bool ath9k_hw_set_reset(struct ath_hw *ah, int type)
         u32 rst_flags;
         u32 tmpReg;
 
+        if (AR_SREV_9100(ah)) {
+                u32 val = REG_READ(ah, AR_RTC_DERIVED_CLK);
+                val &= ~AR_RTC_DERIVED_CLK_PERIOD;
+                val |= SM(1, AR_RTC_DERIVED_CLK_PERIOD);
+                REG_WRITE(ah, AR_RTC_DERIVED_CLK, val);
+                (void)REG_READ(ah, AR_RTC_DERIVED_CLK);
+        }
+
         REG_WRITE(ah, AR_RTC_FORCE_WAKE, AR_RTC_FORCE_WAKE_EN |
                   AR_RTC_FORCE_WAKE_ON_INT);
 
@@ -1490,7 +1516,7 @@ static bool ath9k_hw_set_reset(struct ath_hw *ah, int type)
         udelay(50);
 
         REG_WRITE(ah, AR_RTC_RC, 0);
-        if (!ath9k_hw_wait(ah, AR_RTC_RC, AR_RTC_RC_M, 0)) {
+        if (!ath9k_hw_wait(ah, AR_RTC_RC, AR_RTC_RC_M, 0, AH_WAIT_TIMEOUT)) {
                 DPRINTF(ah->ah_sc, ATH_DBG_RESET,
                         "RTC stuck in MAC reset\n");
                 return false;
@@ -1513,12 +1539,14 @@ static bool ath9k_hw_set_reset_power_on(struct ath_hw *ah)
                   AR_RTC_FORCE_WAKE_ON_INT);
 
         REG_WRITE(ah, AR_RTC_RESET, 0);
+        udelay(2);
         REG_WRITE(ah, AR_RTC_RESET, 1);
 
         if (!ath9k_hw_wait(ah,
                            AR_RTC_STATUS,
                            AR_RTC_STATUS_M,
-                           AR_RTC_STATUS_ON)) {
+                           AR_RTC_STATUS_ON,
+                           AH_WAIT_TIMEOUT)) {
                 DPRINTF(ah->ah_sc, ATH_DBG_RESET, "RTC not waking up\n");
                 return false;
         }
@@ -1580,7 +1608,10 @@ static void ath9k_hw_set_regs(struct ath_hw *ah, struct ath9k_channel *chan,
 static bool ath9k_hw_chip_reset(struct ath_hw *ah,
                                 struct ath9k_channel *chan)
 {
-        if (!ath9k_hw_set_reset_reg(ah, ATH9K_RESET_WARM))
+        if (OLC_FOR_AR9280_20_LATER) {
+                if (!ath9k_hw_set_reset_reg(ah, ATH9K_RESET_POWER_ON))
+                        return false;
+        } else if (!ath9k_hw_set_reset_reg(ah, ATH9K_RESET_WARM))
                 return false;
 
         if (!ath9k_hw_setpower(ah, ATH9K_PM_AWAKE))
@@ -1610,7 +1641,7 @@ static bool ath9k_hw_channel_change(struct ath_hw *ah,
 
         REG_WRITE(ah, AR_PHY_RFBUS_REQ, AR_PHY_RFBUS_REQ_EN);
         if (!ath9k_hw_wait(ah, AR_PHY_RFBUS_GRANT, AR_PHY_RFBUS_GRANT_EN,
-                           AR_PHY_RFBUS_GRANT_EN)) {
+                           AR_PHY_RFBUS_GRANT_EN, AH_WAIT_TIMEOUT)) {
                 DPRINTF(ah->ah_sc, ATH_DBG_REG_IO,
                         "Could not kill baseband RX\n");
                 return false;
@@ -2801,6 +2832,8 @@ bool ath9k_hw_getisr(struct ath_hw *ah, enum ath9k_int *masked)
                                 mask2 |= ATH9K_INT_GTT;
                         if (isr2 & AR_ISR_S2_CST)
                                 mask2 |= ATH9K_INT_CST;
+                        if (isr2 & AR_ISR_S2_TSFOOR)
+                                mask2 |= ATH9K_INT_TSFOOR;
                 }
 
                 isr = REG_READ(ah, AR_ISR_RAC);
@@ -2946,7 +2979,9 @@ enum ath9k_int ath9k_hw_set_interrupts(struct ath_hw *ah, enum ath9k_int ints)
                 if (ints & ATH9K_INT_DTIMSYNC)
                         mask2 |= AR_IMR_S2_DTIMSYNC;
                 if (ints & ATH9K_INT_CABEND)
-                        mask2 |= (AR_IMR_S2_CABEND);
+                        mask2 |= AR_IMR_S2_CABEND;
+                if (ints & ATH9K_INT_TSFOOR)
+                        mask2 |= AR_IMR_S2_TSFOOR;
         }
 
         if (ints & (ATH9K_INT_GTT | ATH9K_INT_CST)) {
@@ -3116,6 +3151,8 @@ void ath9k_hw_set_sta_beacon_timers(struct ath_hw *ah,
                     AR_TBTT_TIMER_EN | AR_TIM_TIMER_EN |
                     AR_DTIM_TIMER_EN);
 
+        /* TSF Out of Range Threshold */
+        REG_WRITE(ah, AR_TSFOOR_THRESHOLD, bs->bs_tsfoor_threshold);
 }
 
 /*******************/
@@ -3128,10 +3165,11 @@ bool ath9k_hw_fill_cap_info(struct ath_hw *ah)
         u16 capField = 0, eeval;
 
         eeval = ah->eep_ops->get_eeprom(ah, EEP_REG_0);
-
         ah->regulatory.current_rd = eeval;
 
         eeval = ah->eep_ops->get_eeprom(ah, EEP_REG_1);
+        if (AR_SREV_9285_10_OR_LATER(ah))
+                eeval |= AR9285_RDEXT_DEFAULT;
         ah->regulatory.current_rd_ext = eeval;
 
         capField = ah->eep_ops->get_eeprom(ah, EEP_OP_CAP);
@@ -3182,14 +3220,11 @@ bool ath9k_hw_fill_cap_info(struct ath_hw *ah)
         }
 
         pCap->tx_chainmask = ah->eep_ops->get_eeprom(ah, EEP_TX_MASK);
-        if ((ah->is_pciexpress)
-            || (eeval & AR5416_OPFLAGS_11A)) {
-                pCap->rx_chainmask =
-                        ah->eep_ops->get_eeprom(ah, EEP_RX_MASK);
-        } else {
-                pCap->rx_chainmask =
-                        (ath9k_hw_gpio_get(ah, 0)) ? 0x5 : 0x7;
-        }
+        if ((ah->hw_version.devid == AR5416_DEVID_PCI) &&
+            !(eeval & AR5416_OPFLAGS_11A))
+                pCap->rx_chainmask = ath9k_hw_gpio_get(ah, 0) ? 0x5 : 0x7;
+        else
+                pCap->rx_chainmask = ah->eep_ops->get_eeprom(ah, EEP_RX_MASK);
 
         if (!(AR_SREV_9280(ah) && (ah->hw_version.macRev == 0)))
                 ah->misc_mode |= AR_PCU_MIC_NEW_LOC_ENA;
@@ -3317,8 +3352,6 @@ bool ath9k_hw_fill_cap_info(struct ath_hw *ah)
 bool ath9k_hw_getcapability(struct ath_hw *ah, enum ath9k_capability_type type,
                             u32 capability, u32 *result)
 {
-        const struct ath9k_hw_capabilities *pCap = &ah->caps;
-
         switch (type) {
         case ATH9K_CAP_CIPHER:
                 switch (capability) {
@@ -3344,16 +3377,10 @@ bool ath9k_hw_getcapability(struct ath_hw *ah, enum ath9k_capability_type type,
         case ATH9K_CAP_TKIP_SPLIT:
                 return (ah->misc_mode & AR_PCU_MIC_NEW_LOC_ENA) ?
                         false : true;
-        case ATH9K_CAP_WME_TKIPMIC:
-                return 0;
-        case ATH9K_CAP_PHYCOUNTERS:
-                return ah->has_hw_phycounters ? 0 : -ENXIO;
         case ATH9K_CAP_DIVERSITY:
                 return (REG_READ(ah, AR_PHY_CCK_DETECT) &
                         AR_PHY_CCK_DETECT_BB_ENABLE_ANT_FAST_DIV) ?
                         true : false;
-        case ATH9K_CAP_PHYDIAG:
-                return true;
         case ATH9K_CAP_MCAST_KEYSRCH:
                 switch (capability) {
                 case 0:
@@ -3368,18 +3395,6 @@ bool ath9k_hw_getcapability(struct ath_hw *ah, enum ath9k_capability_type type,
                         }
                 }
                 return false;
-        case ATH9K_CAP_TSF_ADJUST:
-                return (ah->misc_mode & AR_PCU_TX_ADD_TSF) ?
-                        true : false;
-        case ATH9K_CAP_RFSILENT:
-                if (capability == 3)
-                        return false;
-        case ATH9K_CAP_ANT_CFG_2GHZ:
-                *result = pCap->num_antcfg_2ghz;
-                return true;
-        case ATH9K_CAP_ANT_CFG_5GHZ:
-                *result = pCap->num_antcfg_5ghz;
-                return true;
         case ATH9K_CAP_TXPOW:
                 switch (capability) {
                 case 0:
@@ -3395,6 +3410,10 @@ bool ath9k_hw_getcapability(struct ath_hw *ah, enum ath9k_capability_type type,
                         return 0;
                 }
                 return false;
+        case ATH9K_CAP_DS:
+                return (AR_SREV_9280_20_OR_LATER(ah) &&
+                        (ah->eep_ops->get_eeprom(ah, EEP_RC_CHAIN_MASK) == 1))
+                        ? false : true;
         default:
                 return false;
         }
@@ -3428,12 +3447,6 @@ bool ath9k_hw_setcapability(struct ath_hw *ah, enum ath9k_capability_type type,
                 else
                         ah->sta_id1_defaults &= ~AR_STA_ID1_MCAST_KSRCH;
                 return true;
-        case ATH9K_CAP_TSF_ADJUST:
-                if (setting)
-                        ah->misc_mode |= AR_PCU_TX_ADD_TSF;
-                else
-                        ah->misc_mode &= ~AR_PCU_TX_ADD_TSF;
-                return true;
         default:
                 return false;
         }
diff --git a/drivers/net/wireless/ath9k/hw.h b/drivers/net/wireless/ath9k/hw.h
index 82111636c693..5ec416b3d7ec 100644
--- a/drivers/net/wireless/ath9k/hw.h
+++ b/drivers/net/wireless/ath9k/hw.h
@@ -93,7 +93,7 @@
 #define ATH9K_NUM_QUEUES            10
 
 #define MAX_RATE_POWER              63
-#define AH_TIMEOUT                  100000
+#define AH_WAIT_TIMEOUT             100000 /* (us) */
 #define AH_TIME_QUANTUM             10
 #define AR_KEYTABLE_SIZE            128
 #define POWER_UP_TIME               200000
@@ -153,16 +153,10 @@ enum ath9k_capability_type {
         ATH9K_CAP_CIPHER = 0,
         ATH9K_CAP_TKIP_MIC,
         ATH9K_CAP_TKIP_SPLIT,
-        ATH9K_CAP_PHYCOUNTERS,
         ATH9K_CAP_DIVERSITY,
         ATH9K_CAP_TXPOW,
-        ATH9K_CAP_PHYDIAG,
         ATH9K_CAP_MCAST_KEYSRCH,
-        ATH9K_CAP_TSF_ADJUST,
-        ATH9K_CAP_WME_TKIPMIC,
-        ATH9K_CAP_RFSILENT,
-        ATH9K_CAP_ANT_CFG_2GHZ,
-        ATH9K_CAP_ANT_CFG_5GHZ
+        ATH9K_CAP_DS
 };
 
 struct ath9k_hw_capabilities {
@@ -249,6 +243,7 @@ enum ath9k_int {
         ATH9K_INT_DTIMSYNC = 0x00800000,
         ATH9K_INT_GPIO = 0x01000000,
         ATH9K_INT_CABEND = 0x02000000,
+        ATH9K_INT_TSFOOR = 0x04000000,
         ATH9K_INT_CST = 0x10000000,
         ATH9K_INT_GTT = 0x20000000,
         ATH9K_INT_FATAL = 0x40000000,
@@ -256,6 +251,7 @@ enum ath9k_int {
         ATH9K_INT_BMISC = ATH9K_INT_TIM |
                 ATH9K_INT_DTIM |
                 ATH9K_INT_DTIMSYNC |
+                ATH9K_INT_TSFOOR |
                 ATH9K_INT_CABEND,
         ATH9K_INT_COMMON = ATH9K_INT_RXNOFRM |
                 ATH9K_INT_RXDESC |
@@ -385,6 +381,7 @@ struct ath9k_beacon_state {
 #define ATH9K_BEACON_PERIOD       0x0000ffff
 #define ATH9K_BEACON_ENA          0x00800000
 #define ATH9K_BEACON_RESET_TSF    0x01000000
+#define ATH9K_TSFOOR_THRESHOLD    0x00004240 /* 16k us */
         u32 bs_dtimperiod;
         u16 bs_cfpperiod;
         u16 bs_cfpmaxduration;
@@ -392,6 +389,7 @@ struct ath9k_beacon_state {
         u16 bs_timoffset;
         u16 bs_bmissthreshold;
         u32 bs_sleepduration;
+        u32 bs_tsfoor_threshold;
 };
 
 struct chan_centers {
@@ -547,6 +545,10 @@ struct ath_hw {
         u8 txchainmask;
         u8 rxchainmask;
 
+        u32 originalGain[22];
+        int initPDADC;
+        int PDADCdelta;
+
         struct ar5416IniArray iniModes;
         struct ar5416IniArray iniCommon;
         struct ar5416IniArray iniBank0;
@@ -603,7 +605,7 @@ bool ath9k_hw_setantennaswitch(struct ath_hw *ah,
                                u8 *antenna_cfgd);
 
 /* General Operation */
-bool ath9k_hw_wait(struct ath_hw *ah, u32 reg, u32 mask, u32 val);
+bool ath9k_hw_wait(struct ath_hw *ah, u32 reg, u32 mask, u32 val, u32 timeout);
 u32 ath9k_hw_reverse_bits(u32 val, u32 n);
 bool ath9k_get_channel_edges(struct ath_hw *ah, u16 flags, u16 *low, u16 *high);
 u16 ath9k_hw_computetxtime(struct ath_hw *ah, struct ath_rate_table *rates,
diff --git a/drivers/net/wireless/ath9k/mac.c b/drivers/net/wireless/ath9k/mac.c
index f32c622db6e7..f757bc7eec68 100644
--- a/drivers/net/wireless/ath9k/mac.c
+++ b/drivers/net/wireless/ath9k/mac.c
@@ -285,7 +285,7 @@ int ath9k_hw_txprocdesc(struct ath_hw *ah, struct ath_desc *ds)
         ds->ds_txstat.ts_shortretry = MS(ads->ds_txstatus1, AR_RTSFailCnt);
         ds->ds_txstat.ts_longretry = MS(ads->ds_txstatus1, AR_DataFailCnt);
         ds->ds_txstat.ts_virtcol = MS(ads->ds_txstatus1, AR_VirtRetryCnt);
-        ds->ds_txstat.ts_antenna = 1;
+        ds->ds_txstat.ts_antenna = 0;
 
         return 0;
 }
@@ -886,7 +886,8 @@ bool ath9k_hw_setrxabort(struct ath_hw *ah, bool set)
                 REG_SET_BIT(ah, AR_DIAG_SW,
                             (AR_DIAG_RX_DIS | AR_DIAG_RX_ABORT));
 
-                if (!ath9k_hw_wait(ah, AR_OBS_BUS_1, AR_OBS_BUS_1_RX_STATE, 0)) {
+                if (!ath9k_hw_wait(ah, AR_OBS_BUS_1, AR_OBS_BUS_1_RX_STATE,
+                                   0, AH_WAIT_TIMEOUT)) {
                         REG_CLR_BIT(ah, AR_DIAG_SW,
                                     (AR_DIAG_RX_DIS |
                                      AR_DIAG_RX_ABORT));
@@ -933,15 +934,32 @@ void ath9k_hw_stoppcurecv(struct ath_hw *ah)
 
 bool ath9k_hw_stopdmarecv(struct ath_hw *ah)
 {
+#define AH_RX_STOP_DMA_TIMEOUT 10000   /* usec */
+#define AH_RX_TIME_QUANTUM     100     /* usec */
+
+        int i;
+
         REG_WRITE(ah, AR_CR, AR_CR_RXD);
 
-        if (!ath9k_hw_wait(ah, AR_CR, AR_CR_RXE, 0)) {
+        /* Wait for rx enable bit to go low */
+        for (i = AH_RX_STOP_DMA_TIMEOUT / AH_TIME_QUANTUM; i != 0; i--) {
+                if ((REG_READ(ah, AR_CR) & AR_CR_RXE) == 0)
+                        break;
+                udelay(AH_TIME_QUANTUM);
+        }
+
+        if (i == 0) {
                 DPRINTF(ah->ah_sc, ATH_DBG_QUEUE,
-                        "dma failed to stop in 10ms\n"
-                        "AR_CR=0x%08x\nAR_DIAG_SW=0x%08x\n",
-                        REG_READ(ah, AR_CR), REG_READ(ah, AR_DIAG_SW));
+                        "dma failed to stop in %d ms "
+                        "AR_CR=0x%08x AR_DIAG_SW=0x%08x\n",
+                        AH_RX_STOP_DMA_TIMEOUT / 1000,
+                        REG_READ(ah, AR_CR),
+                        REG_READ(ah, AR_DIAG_SW));
                 return false;
         } else {
                 return true;
         }
+
+#undef AH_RX_TIME_QUANTUM
+#undef AH_RX_STOP_DMA_TIMEOUT
 }
diff --git a/drivers/net/wireless/ath9k/mac.h b/drivers/net/wireless/ath9k/mac.h
index 74b660ae8add..862a63f7634b 100644
--- a/drivers/net/wireless/ath9k/mac.h
+++ b/drivers/net/wireless/ath9k/mac.h
@@ -566,8 +566,9 @@ enum ath9k_rx_filter {
         ATH9K_RX_FILTER_BEACON = 0x00000010,
         ATH9K_RX_FILTER_PROM = 0x00000020,
         ATH9K_RX_FILTER_PROBEREQ = 0x00000080,
-        ATH9K_RX_FILTER_PSPOLL = 0x00004000,
         ATH9K_RX_FILTER_PHYERR = 0x00000100,
+        ATH9K_RX_FILTER_MYBEACON = 0x00000200,
+        ATH9K_RX_FILTER_PSPOLL = 0x00004000,
         ATH9K_RX_FILTER_PHYRADAR = 0x00002000,
 };
 
diff --git a/drivers/net/wireless/ath9k/main.c b/drivers/net/wireless/ath9k/main.c
index 7d7537e2738e..f5f5739a7a4b 100644
--- a/drivers/net/wireless/ath9k/main.c
+++ b/drivers/net/wireless/ath9k/main.c
@@ -308,23 +308,23 @@ static int ath_set_channel(struct ath_softc *sc, struct ath9k_channel *hchan)
  */
 static void ath_ani_calibrate(unsigned long data)
 {
-        struct ath_softc *sc;
-        struct ath_hw *ah;
+        struct ath_softc *sc = (struct ath_softc *)data;
+        struct ath_hw *ah = sc->sc_ah;
         bool longcal = false;
         bool shortcal = false;
         bool aniflag = false;
         unsigned int timestamp = jiffies_to_msecs(jiffies);
-        u32 cal_interval;
+        u32 cal_interval, short_cal_interval;
 
-        sc = (struct ath_softc *)data;
-        ah = sc->sc_ah;
+        short_cal_interval = (ah->opmode == NL80211_IFTYPE_AP) ?
+                ATH_AP_SHORT_CALINTERVAL : ATH_STA_SHORT_CALINTERVAL;
 
         /*
         * don't calibrate when we're scanning.
         * we are most likely not on our home channel.
         */
         if (sc->rx.rxfilter & FIF_BCN_PRBRESP_PROMISC)
-                return;
+                goto set_timer;
 
         /* Long calibration runs independently of short calibration. */
         if ((timestamp - sc->ani.longcal_timer) >= ATH_LONG_CALINTERVAL) {
@@ -335,8 +335,7 @@ static void ath_ani_calibrate(unsigned long data)
 
         /* Short calibration applies only while caldone is false */
         if (!sc->ani.caldone) {
-                if ((timestamp - sc->ani.shortcal_timer) >=
-                    ATH_SHORT_CALINTERVAL) {
+                if ((timestamp - sc->ani.shortcal_timer) >= short_cal_interval) {
                         shortcal = true;
                         DPRINTF(sc, ATH_DBG_ANI, "shortcal @%lu\n", jiffies);
                         sc->ani.shortcal_timer = timestamp;
@@ -352,8 +351,7 @@ static void ath_ani_calibrate(unsigned long data)
         }
 
         /* Verify whether we must check ANI */
-        if ((timestamp - sc->ani.checkani_timer) >=
-           ATH_ANI_POLLINTERVAL) {
+        if ((timestamp - sc->ani.checkani_timer) >= ATH_ANI_POLLINTERVAL) {
                 aniflag = true;
                 sc->ani.checkani_timer = timestamp;
         }
@@ -362,8 +360,7 @@ static void ath_ani_calibrate(unsigned long data)
         if (longcal || shortcal || aniflag) {
                 /* Call ANI routine if necessary */
                 if (aniflag)
-                        ath9k_hw_ani_monitor(ah, &sc->nodestats,
-                                             ah->curchan);
+                        ath9k_hw_ani_monitor(ah, &sc->nodestats, ah->curchan);
 
                 /* Perform calibration if necessary */
                 if (longcal || shortcal) {
@@ -392,6 +389,7 @@ static void ath_ani_calibrate(unsigned long data)
                 }
         }
 
+set_timer:
         /*
         * Set timer interval based on previous results.
         * The interval must be the shortest necessary to satisfy ANI,
@@ -401,7 +399,7 @@ static void ath_ani_calibrate(unsigned long data)
         if (sc->sc_ah->config.enable_ani)
                 cal_interval = min(cal_interval, (u32)ATH_ANI_POLLINTERVAL);
         if (!sc->ani.caldone)
-                cal_interval = min(cal_interval, (u32)ATH_SHORT_CALINTERVAL);
+                cal_interval = min(cal_interval, (u32)short_cal_interval);
 
         mod_timer(&sc->ani.timer, jiffies + msecs_to_jiffies(cal_interval));
 }
@@ -574,6 +572,10 @@ irqreturn_t ath_isr(int irq, void *dev)
                                         sc->sc_flags |= SC_OP_WAIT_FOR_BEACON;
                                 }
                         }
+                        if (status & ATH9K_INT_TSFOOR) {
+                                /* FIXME: Handle this interrupt for power save */
+                                sched = true;
+                        }
                 }
         } while (0);
 
@@ -920,8 +922,7 @@ static void ath9k_bss_assoc_info(struct ath_softc *sc,
 
                 /* Start ANI */
                 mod_timer(&sc->ani.timer,
-                        jiffies + msecs_to_jiffies(ATH_ANI_POLLINTERVAL));
-
+                          jiffies + msecs_to_jiffies(ATH_ANI_POLLINTERVAL));
         } else {
                 DPRINTF(sc, ATH_DBG_CONFIG, "Bss Info DISSOC\n");
                 sc->curaid = 0;
@@ -1566,6 +1567,7 @@ bad:
 int ath_attach(u16 devid, struct ath_softc *sc)
 {
         struct ieee80211_hw *hw = sc->hw;
+        const struct ieee80211_regdomain *regd;
         int error = 0, i;
 
         DPRINTF(sc, ATH_DBG_CONFIG, "Attach ATH hw\n");
@@ -1598,6 +1600,7 @@ int ath_attach(u16 devid, struct ath_softc *sc)
 
         hw->queues = 4;
         hw->max_rates = 4;
+        hw->channel_change_time = 5000;
         hw->max_rate_tries = ATH_11N_TXMAXTRY;
         hw->sta_data_size = sizeof(struct ath_node);
         hw->vif_data_size = sizeof(struct ath_vif);
@@ -1636,30 +1639,29 @@ int ath_attach(u16 devid, struct ath_softc *sc)
 #endif
 
         if (ath9k_is_world_regd(sc->sc_ah)) {
-                /* Anything applied here (prior to wiphy registratoin) gets
+                /* Anything applied here (prior to wiphy registration) gets
                  * saved on the wiphy orig_* parameters */
-                const struct ieee80211_regdomain *regd =
-                        ath9k_world_regdomain(sc->sc_ah);
+                regd = ath9k_world_regdomain(sc->sc_ah);
                 hw->wiphy->custom_regulatory = true;
                 hw->wiphy->strict_regulatory = false;
-                wiphy_apply_custom_regulatory(sc->hw->wiphy, regd);
-                ath9k_reg_apply_radar_flags(hw->wiphy);
-                ath9k_reg_apply_world_flags(hw->wiphy, REGDOM_SET_BY_INIT);
         } else {
                 /* This gets applied in the case of the absense of CRDA,
-                 * its our own custom world regulatory domain, similar to
+                 * it's our own custom world regulatory domain, similar to
                  * cfg80211's but we enable passive scanning */
-                const struct ieee80211_regdomain *regd =
-                        ath9k_default_world_regdomain();
-                wiphy_apply_custom_regulatory(sc->hw->wiphy, regd);
-                ath9k_reg_apply_radar_flags(hw->wiphy);
-                ath9k_reg_apply_world_flags(hw->wiphy, REGDOM_SET_BY_INIT);
+                regd = ath9k_default_world_regdomain();
         }
+        wiphy_apply_custom_regulatory(hw->wiphy, regd);
+        ath9k_reg_apply_radar_flags(hw->wiphy);
+        ath9k_reg_apply_world_flags(hw->wiphy, REGDOM_SET_BY_INIT);
 
         error = ieee80211_register_hw(hw);
 
-        if (!ath9k_is_world_regd(sc->sc_ah))
-                regulatory_hint(hw->wiphy, sc->sc_ah->regulatory.alpha2);
+        if (!ath9k_is_world_regd(sc->sc_ah)) {
+                error = regulatory_hint(hw->wiphy,
+                        sc->sc_ah->regulatory.alpha2);
+                if (error)
+                        goto error_attach;
+        }
 
         /* Initialize LED control */
         ath_init_leds(sc);
@@ -2143,6 +2145,7 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
         default:
                 DPRINTF(sc, ATH_DBG_FATAL,
                         "Interface type %d not yet supported\n", conf->type);
+                mutex_unlock(&sc->mutex);
                 return -EOPNOTSUPP;
         }
 
@@ -2165,10 +2168,13 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
          * Enable MIB interrupts when there are hardware phy counters.
          * Note we only do this (at the moment) for station mode.
          */
-        if (ath9k_hw_phycounters(sc->sc_ah) &&
-            ((conf->type == NL80211_IFTYPE_STATION) ||
-             (conf->type == NL80211_IFTYPE_ADHOC)))
-                sc->imask |= ATH9K_INT_MIB;
+        if ((conf->type == NL80211_IFTYPE_STATION) ||
+            (conf->type == NL80211_IFTYPE_ADHOC)) {
+                if (ath9k_hw_phycounters(sc->sc_ah))
+                        sc->imask |= ATH9K_INT_MIB;
+                sc->imask |= ATH9K_INT_TSFOOR;
+        }
+
         /*
          * Some hardware processes the TIM IE and fires an
          * interrupt when the TIM bit is set.  For hardware
diff --git a/drivers/net/wireless/ath9k/pci.c b/drivers/net/wireless/ath9k/pci.c
index c28afe42b269..eea9d3a9d43c 100644
--- a/drivers/net/wireless/ath9k/pci.c
+++ b/drivers/net/wireless/ath9k/pci.c
@@ -52,8 +52,8 @@ static void ath_pci_cleanup(struct ath_softc *sc)
         struct pci_dev *pdev = to_pci_dev(sc->dev);
 
         pci_iounmap(pdev, sc->mem);
-        pci_release_region(pdev, 0);
         pci_disable_device(pdev);
+        pci_release_region(pdev, 0);
 }
 
 static bool ath_pci_eeprom_read(struct ath_hw *ah, u32 off, u16 *data)
@@ -63,7 +63,8 @@ static bool ath_pci_eeprom_read(struct ath_hw *ah, u32 off, u16 *data)
         if (!ath9k_hw_wait(ah,
                            AR_EEPROM_STATUS_DATA,
                            AR_EEPROM_STATUS_DATA_BUSY |
-                           AR_EEPROM_STATUS_DATA_PROT_ACCESS, 0)) {
+                           AR_EEPROM_STATUS_DATA_PROT_ACCESS, 0,
+                           AH_WAIT_TIMEOUT)) {
                 return false;
         }
 
@@ -292,7 +293,7 @@ static struct pci_driver ath_pci_driver = {
 #endif /* CONFIG_PM */
 };
 
-int __init ath_pci_init(void)
+int ath_pci_init(void)
 {
         return pci_register_driver(&ath_pci_driver);
 }
diff --git a/drivers/net/wireless/ath9k/phy.c b/drivers/net/wireless/ath9k/phy.c
index 52aa2a7abe7a..e1494bae0f9f 100644
--- a/drivers/net/wireless/ath9k/phy.c
+++ b/drivers/net/wireless/ath9k/phy.c
@@ -132,20 +132,27 @@ ath9k_hw_ar9280_set_channel(struct ath_hw *ah,
                 bMode = 0;
                 fracMode = 0;
 
-                if ((freq % 20) == 0) {
-                        aModeRefSel = 3;
-                } else if ((freq % 10) == 0) {
-                        aModeRefSel = 2;
-                } else {
+                switch(ah->eep_ops->get_eeprom(ah, EEP_FRAC_N_5G)) {
+                case 0:
+                        if ((freq % 20) == 0) {
+                                aModeRefSel = 3;
+                        } else if ((freq % 10) == 0) {
+                                aModeRefSel = 2;
+                        }
+                        if (aModeRefSel)
+                                break;
+                case 1:
+                default:
                         aModeRefSel = 0;
-
                         fracMode = 1;
                         refDivA = 1;
                         channelSel = (freq * 0x8000) / 15;
 
                         REG_RMW_FIELD(ah, AR_AN_SYNTH9,
                                       AR_AN_SYNTH9_REFDIVA, refDivA);
+
                 }
+
                 if (!fracMode) {
                         ndiv = (freq * (refDivA >> aModeRefSel)) / 60;
                         channelSel = ndiv & 0x1ff;
diff --git a/drivers/net/wireless/ath9k/phy.h b/drivers/net/wireless/ath9k/phy.h
index 837a598a7ae5..3dbdd54be4e9 100644
--- a/drivers/net/wireless/ath9k/phy.h
+++ b/drivers/net/wireless/ath9k/phy.h
@@ -387,6 +387,8 @@ bool ath9k_hw_init_rf(struct ath_hw *ah,
 
 #define AR_PHY_CCK_TX_CTRL       0xA204
 #define AR_PHY_CCK_TX_CTRL_JAPAN 0x00000010
+#define AR_PHY_CCK_TX_CTRL_TX_DAC_SCALE_CCK         0x0000000C
+#define AR_PHY_CCK_TX_CTRL_TX_DAC_SCALE_CCK_S       2
 
 #define AR_PHY_CCK_DETECT                           0xA208
 #define AR_PHY_CCK_DETECT_WEAK_SIG_THR_CCK          0x0000003F
@@ -444,6 +446,29 @@ bool ath9k_hw_init_rf(struct ath_hw *ah,
 #define AR_PHY_TPCRG1_PD_GAIN_3    0x00300000
 #define AR_PHY_TPCRG1_PD_GAIN_3_S  20
 
+#define AR_PHY_TX_PWRCTRL4       0xa264
+#define AR_PHY_TX_PWRCTRL_PD_AVG_VALID     0x00000001
+#define AR_PHY_TX_PWRCTRL_PD_AVG_VALID_S   0
+#define AR_PHY_TX_PWRCTRL_PD_AVG_OUT       0x000001FE
+#define AR_PHY_TX_PWRCTRL_PD_AVG_OUT_S     1
+
+#define AR_PHY_TX_PWRCTRL6_0     0xa270
+#define AR_PHY_TX_PWRCTRL6_1     0xb270
+#define AR_PHY_TX_PWRCTRL_ERR_EST_MODE     0x03000000
+#define AR_PHY_TX_PWRCTRL_ERR_EST_MODE_S   24
+
+#define AR_PHY_TX_PWRCTRL7       0xa274
+#define AR_PHY_TX_PWRCTRL_INIT_TX_GAIN     0x01F80000
+#define AR_PHY_TX_PWRCTRL_INIT_TX_GAIN_S   19
+
+#define AR_PHY_TX_PWRCTRL9       0xa27C
+#define AR_PHY_TX_DESIRED_SCALE_CCK        0x00007C00
+#define AR_PHY_TX_DESIRED_SCALE_CCK_S      10
+
+#define AR_PHY_TX_GAIN_TBL1      0xa300
+#define AR_PHY_TX_GAIN                     0x0007F000
+#define AR_PHY_TX_GAIN_S                   12
+
 #define AR_PHY_VIT_MASK2_M_46_61 0xa3a0
 #define AR_PHY_MASK2_M_31_45     0xa3a4
 #define AR_PHY_MASK2_M_16_30     0xa3a8
@@ -485,6 +510,10 @@ bool ath9k_hw_init_rf(struct ath_hw *ah,
 #define AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_4    0x0FC00000
 #define AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_4_S  22
 
+/* Carrier leak calibration control, do it after AGC calibration */
+#define AR_PHY_CL_CAL_CTL       0xA358
+#define AR_PHY_CL_CAL_ENABLE    0x00000002
+
 #define AR_PHY_POWER_TX_RATE5   0xA38C
 #define AR_PHY_POWER_TX_RATE6   0xA390
 
diff --git a/drivers/net/wireless/ath9k/rc.c b/drivers/net/wireless/ath9k/rc.c
index a4e863191766..cf0559f183af 100644
--- a/drivers/net/wireless/ath9k/rc.c
+++ b/drivers/net/wireless/ath9k/rc.c
@@ -1267,7 +1267,8 @@ static void ath_rc_update_ht(struct ath_softc *sc,
                 ath_rc_priv->per_down_time = now_msec;
         }
 
-        ath_debug_stat_retries(sc, tx_rate, xretries, retries);
+        ath_debug_stat_retries(sc, tx_rate, xretries, retries,
+                               ath_rc_priv->state[tx_rate].per);
 
 #undef CHK_RSSI
 }
@@ -1392,6 +1393,7 @@ static void ath_rc_init(struct ath_softc *sc,
         struct ath_rateset *rateset = &ath_rc_priv->neg_rates;
         u8 *ht_mcs = (u8 *)&ath_rc_priv->neg_ht_rates;
         u8 i, j, k, hi = 0, hthi = 0;
+        struct ath_hw *ah = sc->sc_ah;
 
         /* FIXME: Adhoc */
         if ((sc->sc_ah->opmode == NL80211_IFTYPE_STATION) ||
@@ -1412,7 +1414,8 @@ static void ath_rc_init(struct ath_softc *sc,
 
         if (sta->ht_cap.ht_supported) {
                 ath_rc_priv->ht_cap = WLAN_RC_HT_FLAG;
-                if (sc->sc_ah->caps.tx_chainmask != 1)
+                if (sc->sc_ah->caps.tx_chainmask != 1 &&
+                        ath9k_hw_getcapability(ah, ATH9K_CAP_DS, 0, NULL))
                         ath_rc_priv->ht_cap |= WLAN_RC_DS_FLAG;
                 if (sta->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40)
                         ath_rc_priv->ht_cap |= WLAN_RC_40_FLAG;
@@ -1533,7 +1536,8 @@ static void ath_tx_status(void *priv, struct ieee80211_supported_band *sband,
                          tx_info_priv->tx.ts_longretry);
 
         /* Check if aggregation has to be enabled for this tid */
-        if (conf_is_ht(&sc->hw->conf)) {
+        if (conf_is_ht(&sc->hw->conf) &&
+            !(skb->protocol == cpu_to_be16(ETH_P_PAE))) {
                 if (ieee80211_is_data_qos(fc)) {
                         u8 *qc, tid;
                         struct ath_node *an;
diff --git a/drivers/net/wireless/ath9k/recv.c b/drivers/net/wireless/ath9k/recv.c
index 08f676af894f..23b6f54cde5c 100644
--- a/drivers/net/wireless/ath9k/recv.c
+++ b/drivers/net/wireless/ath9k/recv.c
@@ -375,14 +375,15 @@ u32 ath_calcrxfilter(struct ath_softc *sc)
         if (sc->rx.rxfilter & FIF_CONTROL)
                 rfilt |= ATH9K_RX_FILTER_CONTROL;
 
-        if (sc->sc_ah->opmode == NL80211_IFTYPE_STATION ||
-            sc->sc_ah->opmode == NL80211_IFTYPE_ADHOC)
+        if ((sc->sc_ah->opmode == NL80211_IFTYPE_STATION) &&
+            !(sc->rx.rxfilter & FIF_BCN_PRBRESP_PROMISC))
+                rfilt |= ATH9K_RX_FILTER_MYBEACON;
+        else
                 rfilt |= ATH9K_RX_FILTER_BEACON;
 
-        /* If in HOSTAP mode, want to enable reception of PSPOLL frames
-           & beacon frames */
+        /* If in HOSTAP mode, want to enable reception of PSPOLL frames */
         if (sc->sc_ah->opmode == NL80211_IFTYPE_AP)
-                rfilt |= (ATH9K_RX_FILTER_BEACON | ATH9K_RX_FILTER_PSPOLL);
+                rfilt |= ATH9K_RX_FILTER_PSPOLL;
 
         return rfilt;
 
@@ -427,7 +428,6 @@ bool ath_stoprecv(struct ath_softc *sc)
         ath9k_hw_stoppcurecv(ah);
         ath9k_hw_setrxfilter(ah, 0);
         stopped = ath9k_hw_stopdmarecv(ah);
-        mdelay(3); /* 3ms is long enough for 1 frame */
         sc->rx.rxlink = NULL;
 
         return stopped;
diff --git a/drivers/net/wireless/ath9k/reg.h b/drivers/net/wireless/ath9k/reg.h
index 17ed190349a5..8d85106d6df2 100644
--- a/drivers/net/wireless/ath9k/reg.h
+++ b/drivers/net/wireless/ath9k/reg.h
@@ -977,8 +977,6 @@ enum {
 #define AR_RTC_PLL_CLKSEL       0x00000300
 #define AR_RTC_PLL_CLKSEL_S     8
 
-
-
 #define AR_RTC_RESET \
         ((AR_SREV_9100(ah)) ? (AR_RTC_BASE + 0x0040) : 0x7040)
 #define AR_RTC_RESET_EN         (0x00000001)
@@ -1015,6 +1013,12 @@ enum {
 #define AR_RTC_INTR_MASK \
         ((AR_SREV_9100(ah)) ? (AR_RTC_BASE + 0x0058) : 0x7058)
 
+/* RTC_DERIVED_* - only for AR9100 */
+
+#define AR_RTC_DERIVED_CLK           (AR_RTC_BASE + 0x0038)
+#define AR_RTC_DERIVED_CLK_PERIOD    0x0000fffe
+#define AR_RTC_DERIVED_CLK_PERIOD_S  1
+
 #define AR_SEQ_MASK     0x8060
 
 #define AR_AN_RF2G1_CH0         0x7810
@@ -1385,8 +1389,8 @@ enum {
 #define AR_PHY_COUNTMAX        (3 << 22)
 #define AR_MIBCNT_INTRMASK     (3 << 22)
 
-#define AR_TSF_THRESHOLD       0x813c
-#define AR_TSF_THRESHOLD_VAL   0x0000FFFF
+#define AR_TSFOOR_THRESHOLD       0x813c
+#define AR_TSFOOR_THRESHOLD_VAL   0x0000FFFF
 
 #define AR_PHY_ERR_EIFS_MASK   8144
 
diff --git a/drivers/net/wireless/ath9k/regd.c b/drivers/net/wireless/ath9k/regd.c
index 8c2b56ac55ff..f7d7cc24a129 100644
--- a/drivers/net/wireless/ath9k/regd.c
+++ b/drivers/net/wireless/ath9k/regd.c
@@ -106,19 +106,20 @@ static const struct ieee80211_regdomain ath9k_world_regdom_67_68_6A = {
         }
 };
 
-static u16 ath9k_regd_get_eepromRD(struct ath_hw *ah)
+static inline bool is_wwr_sku(u16 regd)
 {
-        return ah->regulatory.current_rd & ~WORLDWIDE_ROAMING_FLAG;
+        return ((regd & WORLD_SKU_MASK) == WORLD_SKU_PREFIX) ||
+                (regd == WORLD);
 }
 
-u16 ath9k_regd_get_rd(struct ath_hw *ah)
+static u16 ath9k_regd_get_eepromRD(struct ath_hw *ah)
 {
-        return ath9k_regd_get_eepromRD(ah);
+        return ah->regulatory.current_rd & ~WORLDWIDE_ROAMING_FLAG;
 }
 
 bool ath9k_is_world_regd(struct ath_hw *ah)
 {
-        return isWwrSKU(ah);
+        return is_wwr_sku(ath9k_regd_get_eepromRD(ah));
 }
 
 const struct ieee80211_regdomain *ath9k_default_world_regdomain(void)
@@ -159,13 +160,18 @@ static bool ath9k_is_radar_freq(u16 center_freq)
 }
 
 /*
- * Enable adhoc on 5 GHz if allowed by 11d.
- * Remove passive scan if channel is allowed by 11d,
- * except when on radar frequencies.
+ * N.B: These exception rules do not apply radar freqs.
+ *
+ * - We enable adhoc (or beaconing) if allowed by 11d
+ * - We enable active scan if the channel is allowed by 11d
+ * - If no country IE has been processed and a we determine we have
+ *   received a beacon on a channel we can enable active scan and
+ *   adhoc (or beaconing).
  */
-static void ath9k_reg_apply_5ghz_beaconing_flags(struct wiphy *wiphy,
+static void ath9k_reg_apply_beaconing_flags(struct wiphy *wiphy,
                                              enum reg_set_by setby)
 {
+        enum ieee80211_band band;
         struct ieee80211_supported_band *sband;
         const struct ieee80211_reg_rule *reg_rule;
         struct ieee80211_channel *ch;
@@ -173,29 +179,50 @@ static void ath9k_reg_apply_5ghz_beaconing_flags(struct wiphy *wiphy,
         u32 bandwidth = 0;
         int r;
 
-        if (setby != REGDOM_SET_BY_COUNTRY_IE)
-                return;
-        if (!wiphy->bands[IEEE80211_BAND_5GHZ])
-                return;
+        for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 
-        sband = wiphy->bands[IEEE80211_BAND_5GHZ];
-        for (i = 0; i < sband->n_channels; i++) {
-                ch = &sband->channels[i];
-                r = freq_reg_info(wiphy, ch->center_freq,
-                        &bandwidth, &reg_rule);
-                if (r)
+                if (!wiphy->bands[band])
                         continue;
-                /* If 11d had a rule for this channel ensure we enable adhoc
-                 * if it allows us to use it. Note that we would have disabled
-                 * it by applying our static world regdomain by default during
-                 * probe */
-                if (!(reg_rule->flags & NL80211_RRF_NO_IBSS))
-                        ch->flags &= ~IEEE80211_CHAN_NO_IBSS;
-                if (!ath9k_is_radar_freq(ch->center_freq))
-                        continue;
-                if (!(reg_rule->flags & NL80211_RRF_PASSIVE_SCAN))
-                        ch->flags &= ~IEEE80211_CHAN_PASSIVE_SCAN;
+
+                sband = wiphy->bands[band];
+
+                for (i = 0; i < sband->n_channels; i++) {
+
+                        ch = &sband->channels[i];
+
+                        if (ath9k_is_radar_freq(ch->center_freq) ||
+                            (ch->flags & IEEE80211_CHAN_RADAR))
+                                continue;
+
+                        if (setby == REGDOM_SET_BY_COUNTRY_IE) {
+                                r = freq_reg_info(wiphy, ch->center_freq,
+                                        &bandwidth, &reg_rule);
+                                if (r)
+                                        continue;
+                                /*
+                                 * If 11d had a rule for this channel ensure
+                                 * we enable adhoc/beaconing if it allows us to
+                                 * use it. Note that we would have disabled it
+                                 * by applying our static world regdomain by
+                                 * default during init, prior to calling our
+                                 * regulatory_hint().
+                                 */
+                                if (!(reg_rule->flags &
+                                    NL80211_RRF_NO_IBSS))
+                                        ch->flags &=
+                                          ~IEEE80211_CHAN_NO_IBSS;
+                                if (!(reg_rule->flags &
+                                    NL80211_RRF_PASSIVE_SCAN))
+                                        ch->flags &=
+                                          ~IEEE80211_CHAN_PASSIVE_SCAN;
+                        } else {
+                                if (ch->beacon_found)
+                                        ch->flags &= ~(IEEE80211_CHAN_NO_IBSS |
+                                          IEEE80211_CHAN_PASSIVE_SCAN);
+                        }
+                }
         }
+
 }
 
 /* Allows active scan scan on Ch 12 and 13 */
@@ -208,11 +235,12 @@ static void ath9k_reg_apply_active_scan_flags(struct wiphy *wiphy,
         u32 bandwidth = 0;
         int r;
 
-        /* Force passive scan on Channels 12-13 */
         sband = wiphy->bands[IEEE80211_BAND_2GHZ];
 
-        /* If no country IE has been received always enable active scan
-         * on these channels */
+        /*
+         * If no country IE has been received always enable active scan
+         * on these channels. This is only done for specific regulatory SKUs
+         */
         if (setby != REGDOM_SET_BY_COUNTRY_IE) {
                 ch = &sband->channels[11]; /* CH 12 */
                 if (ch->flags & IEEE80211_CHAN_PASSIVE_SCAN)
@@ -223,10 +251,12 @@ static void ath9k_reg_apply_active_scan_flags(struct wiphy *wiphy,
                 return;
         }
 
-        /* If a country IE has been recieved check its rule for this
+        /*
+         * If a country IE has been recieved check its rule for this
          * channel first before enabling active scan. The passive scan
-         * would have been enforced by the initial probe processing on
-         * our custom regulatory domain. */
+         * would have been enforced by the initial processing of our
+         * custom regulatory domain.
+         */
 
         ch = &sband->channels[11]; /* CH 12 */
         r = freq_reg_info(wiphy, ch->center_freq, &bandwidth, &reg_rule);
@@ -289,10 +319,10 @@ void ath9k_reg_apply_world_flags(struct wiphy *wiphy, enum reg_set_by setby)
         case 0x63:
         case 0x66:
         case 0x67:
-                ath9k_reg_apply_5ghz_beaconing_flags(wiphy, setby);
+                ath9k_reg_apply_beaconing_flags(wiphy, setby);
                 break;
         case 0x68:
-                ath9k_reg_apply_5ghz_beaconing_flags(wiphy, setby);
+                ath9k_reg_apply_beaconing_flags(wiphy, setby);
                 ath9k_reg_apply_active_scan_flags(wiphy, setby);
                 break;
         }
@@ -371,11 +401,8 @@ ath9k_regd_find_country_by_rd(int regdmn)
 }
 
 /* Returns the map of the EEPROM set RD to a country code */
-static u16 ath9k_regd_get_default_country(struct ath_hw *ah)
+static u16 ath9k_regd_get_default_country(u16 rd)
 {
-        u16 rd;
-
-        rd = ath9k_regd_get_eepromRD(ah);
         if (rd & COUNTRY_ERD_FLAG) {
                 struct country_code_to_enum_rd *country = NULL;
                 u16 cc = rd & ~COUNTRY_ERD_FLAG;
@@ -405,7 +432,7 @@ ath9k_get_regpair(int regdmn)
 int ath9k_regd_init(struct ath_hw *ah)
 {
         struct country_code_to_enum_rd *country = NULL;
-        int regdmn;
+        u16 regdmn;
 
         if (!ath9k_regd_is_eeprom_valid(ah)) {
                 DPRINTF(ah->ah_sc, ATH_DBG_REGULATORY,
@@ -413,14 +440,14 @@ int ath9k_regd_init(struct ath_hw *ah)
                 return -EINVAL;
         }
 
-        ah->regulatory.country_code = ath9k_regd_get_default_country(ah);
+        regdmn = ath9k_regd_get_eepromRD(ah);
+        ah->regulatory.country_code = ath9k_regd_get_default_country(regdmn);
 
         if (ah->regulatory.country_code == CTRY_DEFAULT &&
-            ath9k_regd_get_eepromRD(ah) == CTRY_DEFAULT)
+            regdmn == CTRY_DEFAULT)
                 ah->regulatory.country_code = CTRY_UNITED_STATES;
 
         if (ah->regulatory.country_code == CTRY_DEFAULT) {
-                regdmn = ath9k_regd_get_eepromRD(ah);
                 country = NULL;
         } else {
                 country = ath9k_regd_find_country(ah->regulatory.country_code);
@@ -433,7 +460,6 @@ int ath9k_regd_init(struct ath_hw *ah)
                         regdmn = country->regDmnEnum;
         }
 
-        ah->regulatory.current_rd_inuse = regdmn;
         ah->regulatory.regpair = ath9k_get_regpair(regdmn);
 
         if (!ah->regulatory.regpair) {
@@ -467,7 +493,8 @@ u32 ath9k_regd_get_ctl(struct ath_hw *ah, struct ath9k_channel *chan)
         u32 ctl = NO_CTL;
 
         if (!ah->regulatory.regpair ||
-            (ah->regulatory.country_code == CTRY_DEFAULT && isWwrSKU(ah))) {
+            (ah->regulatory.country_code == CTRY_DEFAULT &&
+             is_wwr_sku(ath9k_regd_get_eepromRD(ah)))) {
                 if (IS_CHAN_B(chan))
                         ctl = SD_NO_CTL | CTL_11B;
                 else if (IS_CHAN_G(chan))
@@ -480,7 +507,7 @@ u32 ath9k_regd_get_ctl(struct ath_hw *ah, struct ath9k_channel *chan)
         if (IS_CHAN_B(chan))
                 ctl = ah->regulatory.regpair->reg_2ghz_ctl | CTL_11B;
         else if (IS_CHAN_G(chan))
-                ctl = ah->regulatory.regpair->reg_5ghz_ctl | CTL_11G;
+                ctl = ah->regulatory.regpair->reg_2ghz_ctl | CTL_11G;
         else
                 ctl = ah->regulatory.regpair->reg_5ghz_ctl | CTL_11A;
 
diff --git a/drivers/net/wireless/ath9k/regd.h b/drivers/net/wireless/ath9k/regd.h
index 39420de818f8..d48160d0c0e9 100644
--- a/drivers/net/wireless/ath9k/regd.h
+++ b/drivers/net/wireless/ath9k/regd.h
@@ -20,11 +20,6 @@
 #define COUNTRY_ERD_FLAG        0x8000
 #define WORLDWIDE_ROAMING_FLAG  0x4000
 
-#define isWwrSKU(_ah) \
-        (((ath9k_regd_get_eepromRD((_ah)) & WORLD_SKU_MASK) == \
-                WORLD_SKU_PREFIX) || \
-                (ath9k_regd_get_eepromRD(_ah) == WORLD))
-
 #define MULTI_DOMAIN_MASK 0xFF00
 
 #define WORLD_SKU_MASK          0x00F0
@@ -52,7 +47,6 @@ struct ath9k_regulatory {
         u32 tp_scale;
         u16 current_rd;
         u16 current_rd_ext;
-        u16 current_rd_inuse;
         int16_t power_limit;
         struct reg_dmn_pair_mapping *regpair;
 };
@@ -239,7 +233,6 @@ enum CountryCode {
         CTRY_BELGIUM2 = 5002
 };
 
-u16 ath9k_regd_get_rd(struct ath_hw *ah);
 bool ath9k_is_world_regd(struct ath_hw *ah);
 const struct ieee80211_regdomain *ath9k_world_regdomain(struct ath_hw *ah);
 const struct ieee80211_regdomain *ath9k_default_world_regdomain(void);
@@ -249,7 +242,5 @@ int ath9k_regd_init(struct ath_hw *ah);
 bool ath9k_regd_is_eeprom_valid(struct ath_hw *ah);
 u32 ath9k_regd_get_ctl(struct ath_hw *ah, struct ath9k_channel *chan);
 int ath9k_reg_notifier(struct wiphy *wiphy, struct regulatory_request *request);
-void ath9k_regd_get_current_country(struct ath_hw *ah,
-                                    struct ath9k_country_entry *ctry);
 
 #endif
diff --git a/drivers/net/wireless/ath9k/xmit.c b/drivers/net/wireless/ath9k/xmit.c
index 3f70b1e58ae4..363bb2a94d99 100644
--- a/drivers/net/wireless/ath9k/xmit.c
+++ b/drivers/net/wireless/ath9k/xmit.c
@@ -772,24 +772,6 @@ bool ath_tx_aggr_check(struct ath_softc *sc, struct ath_node *an, u8 tidno)
 /* Queue Management */
 /********************/
 
-static u32 ath_txq_depth(struct ath_softc *sc, int qnum)
-{
-        return sc->tx.txq[qnum].axq_depth;
-}
-
-static void ath_get_beaconconfig(struct ath_softc *sc, int if_id,
-                                 struct ath_beacon_config *conf)
-{
-        struct ieee80211_hw *hw = sc->hw;
-
-        /* fill in beacon config data */
-
-        conf->beacon_interval = hw->conf.beacon_int;
-        conf->listen_interval = 100;
-        conf->dtim_count = 1;
-        conf->bmiss_timeout = ATH_DEFAULT_BMISS_LIMIT * conf->listen_interval;
-}
-
 static void ath_txq_drain_pending_buffers(struct ath_softc *sc,
                                           struct ath_txq *txq)
 {
@@ -964,7 +946,6 @@ int ath_cabq_update(struct ath_softc *sc)
 {
         struct ath9k_tx_queue_info qi;
         int qnum = sc->beacon.cabq->axq_qnum;
-        struct ath_beacon_config conf;
 
         ath9k_hw_get_txq_props(sc->sc_ah, qnum, &qi);
         /*
@@ -975,9 +956,8 @@ int ath_cabq_update(struct ath_softc *sc)
         else if (sc->config.cabqReadytime > ATH9K_READY_TIME_HI_BOUND)
                 sc->config.cabqReadytime = ATH9K_READY_TIME_HI_BOUND;
 
-        ath_get_beaconconfig(sc, ATH_IF_ID_ANY, &conf);
-        qi.tqi_readyTime =
-                (conf.beacon_interval * sc->config.cabqReadytime) / 100;
+        qi.tqi_readyTime = (sc->hw->conf.beacon_int *
+                            sc->config.cabqReadytime) / 100;
         ath_txq_update(sc, qnum, &qi);
 
         return 0;
@@ -1657,7 +1637,7 @@ int ath_tx_start(struct ath_softc *sc, struct sk_buff *skb,
                  * we will at least have to run TX completionon one buffer
                  * on the queue */
                 spin_lock_bh(&txq->axq_lock);
-                if (ath_txq_depth(sc, txq->axq_qnum) > 1) {
+                if (sc->tx.txq[txq->axq_qnum].axq_depth > 1) {
                         ieee80211_stop_queue(sc->hw,
                                 skb_get_queue_mapping(skb));
                         txq->stopped = 1;
@@ -1867,7 +1847,7 @@ static void ath_wake_mac80211_queue(struct ath_softc *sc, struct ath_txq *txq)
 
         spin_lock_bh(&txq->axq_lock);
         if (txq->stopped &&
-            ath_txq_depth(sc, txq->axq_qnum) <= (ATH_TXBUF - 20)) {
+            sc->tx.txq[txq->axq_qnum].axq_depth <= (ATH_TXBUF - 20)) {
                 qnum = ath_get_mac80211_qnum(txq->axq_qnum, sc);
                 if (qnum != -1) {
                         ieee80211_wake_queue(sc->hw, qnum);
diff --git a/drivers/net/wireless/b43/debugfs.c b/drivers/net/wireless/b43/debugfs.c
index bc2767da46e8..45e3d6af69f5 100644
--- a/drivers/net/wireless/b43/debugfs.c
+++ b/drivers/net/wireless/b43/debugfs.c
@@ -51,8 +51,8 @@ struct b43_debugfs_fops {
 };
 
 static inline
-struct b43_dfs_file * fops_to_dfs_file(struct b43_wldev *dev,
-                                       const struct b43_debugfs_fops *dfops)
+struct b43_dfs_file *fops_to_dfs_file(struct b43_wldev *dev,
+                                      const struct b43_debugfs_fops *dfops)
 {
         void *p;
 
diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
index 6d65a02b7052..92e1c0189a65 100644
--- a/drivers/net/wireless/b43/dma.c
+++ b/drivers/net/wireless/b43/dma.c
@@ -41,6 +41,12 @@
 #include <asm/div64.h>
 
 
+/* Required number of TX DMA slots per TX frame.
+ * This currently is 2, because we put the header and the ieee80211 frame
+ * into separate slots. */
+#define TX_SLOTS_PER_FRAME      2
+
+
 /* 32bit DMA ops. */
 static
 struct b43_dmadesc_generic *op32_idx2desc(struct b43_dmaring *ring,
@@ -74,8 +80,7 @@ static void op32_fill_descriptor(struct b43_dmaring *ring,
         addrext = (u32) (dmaaddr & SSB_DMA_TRANSLATION_MASK)
             >> SSB_DMA_TRANSLATION_SHIFT;
         addr |= ssb_dma_translation(ring->dev->dev);
-        ctl = (bufsize - ring->frameoffset)
-            & B43_DMA32_DCTL_BYTECNT;
+        ctl = bufsize & B43_DMA32_DCTL_BYTECNT;
         if (slot == ring->nr_slots - 1)
                 ctl |= B43_DMA32_DCTL_DTABLEEND;
         if (start)
@@ -177,8 +182,7 @@ static void op64_fill_descriptor(struct b43_dmaring *ring,
                 ctl0 |= B43_DMA64_DCTL0_FRAMEEND;
         if (irq)
                 ctl0 |= B43_DMA64_DCTL0_IRQ;
-        ctl1 |= (bufsize - ring->frameoffset)
-            & B43_DMA64_DCTL1_BYTECNT;
+        ctl1 |= bufsize & B43_DMA64_DCTL1_BYTECNT;
         ctl1 |= (addrext << B43_DMA64_DCTL1_ADDREXT_SHIFT)
             & B43_DMA64_DCTL1_ADDREXT_MASK;
 
@@ -576,12 +580,11 @@ static int setup_rx_descbuffer(struct b43_dmaring *ring,
                         return -ENOMEM;
                 dmaaddr = map_descbuffer(ring, skb->data,
                                          ring->rx_buffersize, 0);
-        }
-
-        if (b43_dma_mapping_error(ring, dmaaddr, ring->rx_buffersize, 0)) {
-                b43err(ring->dev->wl, "RX DMA buffer allocation failed\n");
-                dev_kfree_skb_any(skb);
-                return -EIO;
+                if (b43_dma_mapping_error(ring, dmaaddr, ring->rx_buffersize, 0)) {
+                        b43err(ring->dev->wl, "RX DMA buffer allocation failed\n");
+                        dev_kfree_skb_any(skb);
+                        return -EIO;
+                }
         }
 
         meta->skb = skb;
@@ -830,9 +833,6 @@ struct b43_dmaring *b43_setup_dmaring(struct b43_wldev *dev,
                 if (ring->index == 0) {
                         ring->rx_buffersize = B43_DMA0_RX_BUFFERSIZE;
                         ring->frameoffset = B43_DMA0_RX_FRAMEOFFSET;
-                } else if (ring->index == 3) {
-                        ring->rx_buffersize = B43_DMA3_RX_BUFFERSIZE;
-                        ring->frameoffset = B43_DMA3_RX_FRAMEOFFSET;
                 } else
                         B43_WARN_ON(1);
         }
@@ -842,7 +842,10 @@ struct b43_dmaring *b43_setup_dmaring(struct b43_wldev *dev,
 #endif
 
         if (for_tx) {
-                ring->txhdr_cache = kcalloc(ring->nr_slots,
+                /* Assumption: B43_TXRING_SLOTS can be divided by TX_SLOTS_PER_FRAME */
+                BUILD_BUG_ON(B43_TXRING_SLOTS % TX_SLOTS_PER_FRAME != 0);
+
+                ring->txhdr_cache = kcalloc(ring->nr_slots / TX_SLOTS_PER_FRAME,
                                             b43_txhdr_size(dev),
                                             GFP_KERNEL);
                 if (!ring->txhdr_cache)
@@ -858,7 +861,7 @@ struct b43_dmaring *b43_setup_dmaring(struct b43_wldev *dev,
                                           b43_txhdr_size(dev), 1)) {
                         /* ugh realloc */
                         kfree(ring->txhdr_cache);
-                        ring->txhdr_cache = kcalloc(ring->nr_slots,
+                        ring->txhdr_cache = kcalloc(ring->nr_slots / TX_SLOTS_PER_FRAME,
                                                     b43_txhdr_size(dev),
                                                     GFP_KERNEL | GFP_DMA);
                         if (!ring->txhdr_cache)
@@ -1149,7 +1152,10 @@ static int dma_tx_fragment(struct b43_dmaring *ring,
         u16 cookie;
         size_t hdrsize = b43_txhdr_size(ring->dev);
 
-#define SLOTS_PER_PACKET  2
+        /* Important note: If the number of used DMA slots per TX frame
+         * is changed here, the TX_SLOTS_PER_FRAME definition at the top of
+         * the file has to be updated, too!
+         */
 
         old_top_slot = ring->current_slot;
         old_used_slots = ring->used_slots;
@@ -1159,7 +1165,7 @@ static int dma_tx_fragment(struct b43_dmaring *ring,
         desc = ops->idx2desc(ring, slot, &meta_hdr);
         memset(meta_hdr, 0, sizeof(*meta_hdr));
 
-        header = &(ring->txhdr_cache[slot * hdrsize]);
+        header = &(ring->txhdr_cache[(slot / TX_SLOTS_PER_FRAME) * hdrsize]);
         cookie = generate_cookie(ring, slot);
         err = b43_generate_txhdr(ring->dev, header,
                                  skb->data, skb->len, info, cookie);
@@ -1254,8 +1260,8 @@ static inline int should_inject_overflow(struct b43_dmaring *ring)
 }
 
 /* Static mapping of mac80211's queues (priorities) to b43 DMA rings. */
-static struct b43_dmaring * select_ring_by_priority(struct b43_wldev *dev,
-                                                    u8 queue_prio)
+static struct b43_dmaring *select_ring_by_priority(struct b43_wldev *dev,
+                                                   u8 queue_prio)
 {
         struct b43_dmaring *ring;
 
@@ -1306,17 +1312,19 @@ int b43_dma_tx(struct b43_wldev *dev, struct sk_buff *skb)
         }
 
         spin_lock_irqsave(&ring->lock, flags);
+
         B43_WARN_ON(!ring->tx);
-        if (unlikely(free_slots(ring) < SLOTS_PER_PACKET)) {
-                b43warn(dev->wl, "DMA queue overflow\n");
-                err = -ENOSPC;
-                goto out_unlock;
-        }
         /* Check if the queue was stopped in mac80211,
          * but we got called nevertheless.
          * That would be a mac80211 bug. */
         B43_WARN_ON(ring->stopped);
 
+        if (unlikely(free_slots(ring) < TX_SLOTS_PER_FRAME)) {
+                b43warn(dev->wl, "DMA queue overflow\n");
+                err = -ENOSPC;
+                goto out_unlock;
+        }
+
         /* Assign the queue number to the ring (if not already done before)
          * so TX status handling can use it. The queue to ring mapping is
          * static, so we don't need to store it per frame. */
@@ -1335,7 +1343,7 @@ int b43_dma_tx(struct b43_wldev *dev, struct sk_buff *skb)
                 goto out_unlock;
         }
         ring->nr_tx_packets++;
-        if ((free_slots(ring) < SLOTS_PER_PACKET) ||
+        if ((free_slots(ring) < TX_SLOTS_PER_FRAME) ||
             should_inject_overflow(ring)) {
                 /* This TX ring is full. */
                 ieee80211_stop_queue(dev->wl->hw, skb_get_queue_mapping(skb));
@@ -1419,7 +1427,7 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
         }
         dev->stats.last_tx = jiffies;
         if (ring->stopped) {
-                B43_WARN_ON(free_slots(ring) < SLOTS_PER_PACKET);
+                B43_WARN_ON(free_slots(ring) < TX_SLOTS_PER_FRAME);
                 ieee80211_wake_queue(dev->wl->hw, ring->queue_prio);
                 ring->stopped = 0;
                 if (b43_debug(dev, B43_DBG_DMAVERBOSE)) {
@@ -1442,8 +1450,8 @@ void b43_dma_get_tx_stats(struct b43_wldev *dev,
                 ring = select_ring_by_priority(dev, i);
 
                 spin_lock_irqsave(&ring->lock, flags);
-                stats[i].len = ring->used_slots / SLOTS_PER_PACKET;
-                stats[i].limit = ring->nr_slots / SLOTS_PER_PACKET;
+                stats[i].len = ring->used_slots / TX_SLOTS_PER_FRAME;
+                stats[i].limit = ring->nr_slots / TX_SLOTS_PER_FRAME;
                 stats[i].count = ring->nr_tx_packets;
                 spin_unlock_irqrestore(&ring->lock, flags);
         }
diff --git a/drivers/net/wireless/b43/dma.h b/drivers/net/wireless/b43/dma.h
index d1eb5c0848a5..05dde646d831 100644
--- a/drivers/net/wireless/b43/dma.h
+++ b/drivers/net/wireless/b43/dma.h
@@ -1,14 +1,12 @@
 #ifndef B43_DMA_H_
 #define B43_DMA_H_
 
-#include <linux/list.h>
+#include <linux/ieee80211.h>
 #include <linux/spinlock.h>
-#include <linux/workqueue.h>
-#include <linux/linkage.h>
-#include <asm/atomic.h>
 
 #include "b43.h"
 
+
 /* DMA-Interrupt reasons. */
 #define B43_DMAIRQ_FATALMASK    ((1 << 10) | (1 << 11) | (1 << 12) \
                                          | (1 << 14) | (1 << 15))
@@ -161,14 +159,13 @@ struct b43_dmadesc_generic {
 
 /* Misc DMA constants */
 #define B43_DMA_RINGMEMSIZE             PAGE_SIZE
-#define B43_DMA0_RX_FRAMEOFFSET 30
-#define B43_DMA3_RX_FRAMEOFFSET 0
+#define B43_DMA0_RX_FRAMEOFFSET         30
 
 /* DMA engine tuning knobs */
-#define B43_TXRING_SLOTS                128
+#define B43_TXRING_SLOTS                256
 #define B43_RXRING_SLOTS                64
-#define B43_DMA0_RX_BUFFERSIZE  (2304 + 100)
-#define B43_DMA3_RX_BUFFERSIZE  16
+#define B43_DMA0_RX_BUFFERSIZE          IEEE80211_MAX_FRAME_LEN
+
 
 struct sk_buff;
 struct b43_private;
@@ -215,7 +212,7 @@ struct b43_dmaring {
         void *descbase;
         /* Meta data about all descriptors. */
         struct b43_dmadesc_meta *meta;
-        /* Cache of TX headers for each slot.
+        /* Cache of TX headers for each TX frame.
          * This is to avoid an allocation on each TX.
          * This is NULL for an RX ring.
          */
diff --git a/drivers/net/wireless/b43/lo.c b/drivers/net/wireless/b43/lo.c
index 6a18a1470465..22d0fbd83a62 100644
--- a/drivers/net/wireless/b43/lo.c
+++ b/drivers/net/wireless/b43/lo.c
@@ -36,8 +36,8 @@
 #include <linux/sched.h>
 
 
-static struct b43_lo_calib * b43_find_lo_calib(struct b43_txpower_lo_control *lo,
-                                               const struct b43_bbatt *bbatt,
+static struct b43_lo_calib *b43_find_lo_calib(struct b43_txpower_lo_control *lo,
+                                              const struct b43_bbatt *bbatt,
                                                const struct b43_rfatt *rfatt)
 {
         struct b43_lo_calib *c;
@@ -138,7 +138,7 @@ static u16 lo_measure_feedthrough(struct b43_wldev *dev,
  * "pad_mix_gain" is the PAD Mixer Gain.
  */
 static u16 lo_txctl_register_table(struct b43_wldev *dev,
-                                   u16 * value, u16 * pad_mix_gain)
+                                   u16 *value, u16 *pad_mix_gain)
 {
         struct b43_phy *phy = &dev->phy;
         u16 reg, v, padmix;
@@ -225,14 +225,12 @@ static void lo_measure_txctl_values(struct b43_wldev *dev)
                                 radio_pctl_reg = tmp;
                 }
         }
-        b43_radio_write16(dev, 0x43, (b43_radio_read16(dev, 0x43)
-                                      & 0xFFF0) | radio_pctl_reg);
+        b43_radio_maskset(dev, 0x43, 0xFFF0, radio_pctl_reg);
         b43_gphy_set_baseband_attenuation(dev, 2);
 
         reg = lo_txctl_register_table(dev, &mask, NULL);
         mask = ~mask;
-        b43_radio_write16(dev, reg, b43_radio_read16(dev, reg)
-                          & mask);
+        b43_radio_mask(dev, reg, mask);
 
         if (has_tx_magnification(phy)) {
                 int i, j;
@@ -242,14 +240,10 @@ static void lo_measure_txctl_values(struct b43_wldev *dev)
 
                 for (i = 0; i < ARRAY_SIZE(tx_magn_values); i++) {
                         tx_magn = tx_magn_values[i];
-                        b43_radio_write16(dev, 0x52,
-                                          (b43_radio_read16(dev, 0x52)
-                                           & 0xFF0F) | tx_magn);
+                        b43_radio_maskset(dev, 0x52, 0xFF0F, tx_magn);
                         for (j = 0; j < ARRAY_SIZE(tx_bias_values); j++) {
                                 tx_bias = tx_bias_values[j];
-                                b43_radio_write16(dev, 0x52,
-                                                  (b43_radio_read16(dev, 0x52)
-                                                   & 0xFFF0) | tx_bias);
+                                b43_radio_maskset(dev, 0x52, 0xFFF0, tx_bias);
                                 feedthrough =
                                     lo_measure_feedthrough(dev, 0, pga,
                                                            trsw_rx);
@@ -269,8 +263,7 @@ static void lo_measure_txctl_values(struct b43_wldev *dev)
         } else {
                 lo->tx_magn = 0;
                 lo->tx_bias = 0;
-                b43_radio_write16(dev, 0x52, b43_radio_read16(dev, 0x52)
-                                  & 0xFFF0);    /* TX bias == 0 */
+                b43_radio_mask(dev, 0x52, 0xFFF0);      /* TX bias == 0 */
         }
         lo->txctl_measured_time = jiffies;
 }
@@ -406,18 +399,10 @@ static void lo_measure_setup(struct b43_wldev *dev,
                 sav->phy_cck_14 = b43_phy_read(dev, B43_PHY_CCK(0x14));
                 sav->phy_hpwr_tssictl = b43_phy_read(dev, B43_PHY_HPWR_TSSICTL);
 
-                b43_phy_write(dev, B43_PHY_HPWR_TSSICTL,
-                              b43_phy_read(dev, B43_PHY_HPWR_TSSICTL)
-                              | 0x100);
-                b43_phy_write(dev, B43_PHY_EXTG(0x01),
-                              b43_phy_read(dev, B43_PHY_EXTG(0x01))
-                              | 0x40);
-                b43_phy_write(dev, B43_PHY_DACCTL,
-                              b43_phy_read(dev, B43_PHY_DACCTL)
-                              | 0x40);
-                b43_phy_write(dev, B43_PHY_CCK(0x14),
-                              b43_phy_read(dev, B43_PHY_CCK(0x14))
-                              | 0x200);
+                b43_phy_set(dev, B43_PHY_HPWR_TSSICTL, 0x100);
+                b43_phy_set(dev, B43_PHY_EXTG(0x01), 0x40);
+                b43_phy_set(dev, B43_PHY_DACCTL, 0x40);
+                b43_phy_set(dev, B43_PHY_CCK(0x14), 0x200);
         }
         if (phy->type == B43_PHYTYPE_B &&
             phy->radio_ver == 0x2050 && phy->radio_rev < 6) {
@@ -434,17 +419,10 @@ static void lo_measure_setup(struct b43_wldev *dev,
                 sav->phy_cck_3E = b43_phy_read(dev, B43_PHY_CCK(0x3E));
                 sav->phy_crs0 = b43_phy_read(dev, B43_PHY_CRS0);
 
-                b43_phy_write(dev, B43_PHY_CLASSCTL,
-                              b43_phy_read(dev, B43_PHY_CLASSCTL)
-                              & 0xFFFC);
-                b43_phy_write(dev, B43_PHY_CRS0, b43_phy_read(dev, B43_PHY_CRS0)
-                              & 0x7FFF);
-                b43_phy_write(dev, B43_PHY_ANALOGOVER,
-                              b43_phy_read(dev, B43_PHY_ANALOGOVER)
-                              | 0x0003);
-                b43_phy_write(dev, B43_PHY_ANALOGOVERVAL,
-                              b43_phy_read(dev, B43_PHY_ANALOGOVERVAL)
-                              & 0xFFFC);
+                b43_phy_mask(dev, B43_PHY_CLASSCTL, 0xFFFC);
+                b43_phy_mask(dev, B43_PHY_CRS0, 0x7FFF);
+                b43_phy_set(dev, B43_PHY_ANALOGOVER, 0x0003);
+                b43_phy_mask(dev, B43_PHY_ANALOGOVERVAL, 0xFFFC);
                 if (phy->type == B43_PHYTYPE_G) {
                         if ((phy->rev >= 7) &&
                             (sprom->boardflags_lo & B43_BFL_EXTLNA)) {
@@ -558,8 +536,7 @@ static void lo_measure_restore(struct b43_wldev *dev,
         b43_radio_write16(dev, 0x7A, sav->radio_7A);
         if (!has_tx_magnification(phy)) {
                 tmp = sav->radio_52;
-                b43_radio_write16(dev, 0x52, (b43_radio_read16(dev, 0x52)
-                                              & 0xFF0F) | tmp);
+                b43_radio_maskset(dev, 0x52, 0xFF0F, tmp);
         }
         b43_write16(dev, 0x3E2, sav->reg_3E2);
         if (phy->type == B43_PHYTYPE_B &&
@@ -754,9 +731,9 @@ static void lo_probe_loctls_statemachine(struct b43_wldev *dev,
 }
 
 static
-struct b43_lo_calib * b43_calibrate_lo_setting(struct b43_wldev *dev,
-                                               const struct b43_bbatt *bbatt,
-                                               const struct b43_rfatt *rfatt)
+struct b43_lo_calib *b43_calibrate_lo_setting(struct b43_wldev *dev,
+                                              const struct b43_bbatt *bbatt,
+                                              const struct b43_rfatt *rfatt)
 {
         struct b43_phy *phy = &dev->phy;
         struct b43_phy_g *gphy = phy->g;
@@ -778,12 +755,8 @@ struct b43_lo_calib * b43_calibrate_lo_setting(struct b43_wldev *dev,
 
         txctl_reg = lo_txctl_register_table(dev, &txctl_value, &pad_mix_gain);
 
-        b43_radio_write16(dev, 0x43,
-                          (b43_radio_read16(dev, 0x43) & 0xFFF0)
-                          | rfatt->att);
-        b43_radio_write16(dev, txctl_reg,
-                          (b43_radio_read16(dev, txctl_reg) & ~txctl_value)
-                          | (rfatt->with_padmix) ? txctl_value : 0);
+        b43_radio_maskset(dev, 0x43, 0xFFF0, rfatt->att);
+        b43_radio_maskset(dev, txctl_reg, ~txctl_value, (rfatt->with_padmix ? txctl_value :0));
 
         max_rx_gain = rfatt->att * 2;
         max_rx_gain += bbatt->att / 2;
@@ -824,9 +797,9 @@ struct b43_lo_calib * b43_calibrate_lo_setting(struct b43_wldev *dev,
 /* Get a calibrated LO setting for the given attenuation values.
  * Might return a NULL pointer under OOM! */
 static
-struct b43_lo_calib * b43_get_calib_lo_settings(struct b43_wldev *dev,
-                                                const struct b43_bbatt *bbatt,
-                                                const struct b43_rfatt *rfatt)
+struct b43_lo_calib *b43_get_calib_lo_settings(struct b43_wldev *dev,
+                                               const struct b43_bbatt *bbatt,
+                                               const struct b43_rfatt *rfatt)
 {
         struct b43_txpower_lo_control *lo = dev->phy.g->lo_control;
         struct b43_lo_calib *c;
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 7116ab6eccfa..8e1126d99f4c 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -512,7 +512,7 @@ void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 }
 
 /* Read HostFlags */
-u64 b43_hf_read(struct b43_wldev * dev)
+u64 b43_hf_read(struct b43_wldev *dev)
 {
         u64 ret;
 
@@ -600,7 +600,7 @@ void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
 }
 
 static
-void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 * mac)
+void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 *mac)
 {
         static const u8 zero_addr[ETH_ALEN] = { 0 };
         u16 data;
@@ -790,7 +790,7 @@ void b43_dummy_transmission(struct b43_wldev *dev)
 }
 
 static void key_write(struct b43_wldev *dev,
-                      u8 index, u8 algorithm, const u8 * key)
+                      u8 index, u8 algorithm, const u8 *key)
 {
         unsigned int i;
         u32 offset;
@@ -812,7 +812,7 @@ static void key_write(struct b43_wldev *dev,
         }
 }
 
-static void keymac_write(struct b43_wldev *dev, u8 index, const u8 * addr)
+static void keymac_write(struct b43_wldev *dev, u8 index, const u8 *addr)
 {
         u32 addrtmp[2] = { 0, 0, };
         u8 per_sta_keys_start = 8;
@@ -862,7 +862,7 @@ static void keymac_write(struct b43_wldev *dev, u8 index, const u8 * addr)
 
 static void do_key_write(struct b43_wldev *dev,
                          u8 index, u8 algorithm,
-                         const u8 * key, size_t key_len, const u8 * mac_addr)
+                         const u8 *key, size_t key_len, const u8 *mac_addr)
 {
         u8 buf[B43_SEC_KEYSIZE] = { 0, };
         u8 per_sta_keys_start = 8;
@@ -886,8 +886,8 @@ static void do_key_write(struct b43_wldev *dev,
 
 static int b43_key_write(struct b43_wldev *dev,
                          int index, u8 algorithm,
-                         const u8 * key, size_t key_len,
-                         const u8 * mac_addr,
+                         const u8 *key, size_t key_len,
+                         const u8 *mac_addr,
                          struct ieee80211_key_conf *keyconf)
 {
         int i;
@@ -1286,7 +1286,7 @@ static void handle_irq_pmq(struct b43_wldev *dev)
 }
 
 static void b43_write_template_common(struct b43_wldev *dev,
-                                      const u8 * data, u16 size,
+                                      const u8 *data, u16 size,
                                       u16 ram_offset,
                                       u16 shm_size_offset, u8 rate)
 {
@@ -1476,9 +1476,9 @@ static void b43_write_probe_resp_plcp(struct b43_wldev *dev,
  * 2) Patching duration field
  * 3) Stripping TIM
  */
-static const u8 * b43_generate_probe_resp(struct b43_wldev *dev,
-                                          u16 *dest_size,
-                                          struct ieee80211_rate *rate)
+static const u8 *b43_generate_probe_resp(struct b43_wldev *dev,
+                                         u16 *dest_size,
+                                         struct ieee80211_rate *rate)
 {
         const u8 *src_data;
         u8 *dest_data;
@@ -2980,7 +2980,7 @@ static void b43_security_init(struct b43_wldev *dev)
         b43_clear_keys(dev);
 }
 
-static int b43_rng_read(struct hwrng *rng, u32 * data)
+static int b43_rng_read(struct hwrng *rng, u32 *data)
 {
         struct b43_wl *wl = (struct b43_wl *)rng->priv;
         unsigned long flags;
@@ -3311,7 +3311,7 @@ static void b43_put_phy_into_reset(struct b43_wldev *dev)
         msleep(1);
 }
 
-static const char * band_to_string(enum ieee80211_band band)
+static const char *band_to_string(enum ieee80211_band band)
 {
         switch (band) {
         case IEEE80211_BAND_5GHZ:
@@ -4170,11 +4170,19 @@ static int b43_wireless_core_init(struct b43_wldev *dev)
                         hf |= B43_HF_GDCW;
                 if (sprom->boardflags_lo & B43_BFL_PACTRL)
                         hf |= B43_HF_OFDMPABOOST;
-        } else if (phy->type == B43_PHYTYPE_B) {
-                hf |= B43_HF_SYMW;
-                if (phy->rev >= 2 && phy->radio_ver == 0x2050)
-                        hf &= ~B43_HF_GDCW;
         }
+        if (phy->radio_ver == 0x2050) {
+                if (phy->radio_rev == 6)
+                        hf |= B43_HF_4318TSSI;
+                if (phy->radio_rev < 6)
+                        hf |= B43_HF_VCORECALC;
+        }
+        if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
+                hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
+        if ((bus->bustype == SSB_BUSTYPE_PCI) &&
+            (bus->pcicore.dev->id.revision <= 10))
+                hf |= B43_HF_PCISCW; /* PCI slow clock workaround. */
+        hf &= ~B43_HF_SKCFPUP;
         b43_hf_write(dev, hf);
 
         b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
@@ -4213,7 +4221,7 @@ static int b43_wireless_core_init(struct b43_wldev *dev)
         b43_set_synth_pu_delay(dev, 1);
         b43_bluetooth_coext_enable(dev);
 
-        ssb_bus_powerup(bus, 1);        /* Enable dynamic PCTL */
+        ssb_bus_powerup(bus, !(sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW));
         b43_upload_card_macaddress(dev);
         b43_security_init(dev);
         if (!dev->suspend_in_progress)
@@ -4397,6 +4405,34 @@ static void b43_op_sta_notify(struct ieee80211_hw *hw,
         B43_WARN_ON(!vif || wl->vif != vif);
 }
 
+static void b43_op_sw_scan_start_notifier(struct ieee80211_hw *hw)
+{
+        struct b43_wl *wl = hw_to_b43_wl(hw);
+        struct b43_wldev *dev;
+
+        mutex_lock(&wl->mutex);
+        dev = wl->current_dev;
+        if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
+                /* Disable CFP update during scan on other channels. */
+                b43_hf_write(dev, b43_hf_read(dev) | B43_HF_SKCFPUP);
+        }
+        mutex_unlock(&wl->mutex);
+}
+
+static void b43_op_sw_scan_complete_notifier(struct ieee80211_hw *hw)
+{
+        struct b43_wl *wl = hw_to_b43_wl(hw);
+        struct b43_wldev *dev;
+
+        mutex_lock(&wl->mutex);
+        dev = wl->current_dev;
+        if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
+                /* Re-enable CFP update. */
+                b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_SKCFPUP);
+        }
+        mutex_unlock(&wl->mutex);
+}
+
 static const struct ieee80211_ops b43_hw_ops = {
         .tx                     = b43_op_tx,
         .conf_tx                = b43_op_conf_tx,
@@ -4415,6 +4451,8 @@ static const struct ieee80211_ops b43_hw_ops = {
         .stop                   = b43_op_stop,
         .set_tim                = b43_op_beacon_set_tim,
         .sta_notify             = b43_op_sta_notify,
+        .sw_scan_start          = b43_op_sw_scan_start_notifier,
+        .sw_scan_complete       = b43_op_sw_scan_complete_notifier,
 };
 
 /* Hard-reset the chip. Do not call this directly.
diff --git a/drivers/net/wireless/b43/phy_a.c b/drivers/net/wireless/b43/phy_a.c
index 7fe9d1701624..c836c077d51d 100644
--- a/drivers/net/wireless/b43/phy_a.c
+++ b/drivers/net/wireless/b43/phy_a.c
@@ -121,27 +121,18 @@ static void aphy_channel_switch(struct b43_wldev *dev, unsigned int channel)
         b43_radio_write16(dev, 0x0007, (r8 << 4) | r8);
         b43_radio_write16(dev, 0x0020, (r8 << 4) | r8);
         b43_radio_write16(dev, 0x0021, (r8 << 4) | r8);
-        b43_radio_write16(dev, 0x0022, (b43_radio_read16(dev, 0x0022)
-                                        & 0x000F) | (r8 << 4));
+        b43_radio_maskset(dev, 0x0022, 0x000F, (r8 << 4));
         b43_radio_write16(dev, 0x002A, (r8 << 4));
         b43_radio_write16(dev, 0x002B, (r8 << 4));
-        b43_radio_write16(dev, 0x0008, (b43_radio_read16(dev, 0x0008)
-                                        & 0x00F0) | (r8 << 4));
-        b43_radio_write16(dev, 0x0029, (b43_radio_read16(dev, 0x0029)
-                                        & 0xFF0F) | 0x00B0);
+        b43_radio_maskset(dev, 0x0008, 0x00F0, (r8 << 4));
+        b43_radio_maskset(dev, 0x0029, 0xFF0F, 0x00B0);
         b43_radio_write16(dev, 0x0035, 0x00AA);
         b43_radio_write16(dev, 0x0036, 0x0085);
-        b43_radio_write16(dev, 0x003A, (b43_radio_read16(dev, 0x003A)
-                                        & 0xFF20) |
-                          freq_r3A_value(freq));
-        b43_radio_write16(dev, 0x003D,
-                          b43_radio_read16(dev, 0x003D) & 0x00FF);
-        b43_radio_write16(dev, 0x0081, (b43_radio_read16(dev, 0x0081)
-                                        & 0xFF7F) | 0x0080);
-        b43_radio_write16(dev, 0x0035,
-                          b43_radio_read16(dev, 0x0035) & 0xFFEF);
-        b43_radio_write16(dev, 0x0035, (b43_radio_read16(dev, 0x0035)
-                                        & 0xFFEF) | 0x0010);
+        b43_radio_maskset(dev, 0x003A, 0xFF20, freq_r3A_value(freq));
+        b43_radio_mask(dev, 0x003D, 0x00FF);
+        b43_radio_maskset(dev, 0x0081, 0xFF7F, 0x0080);
+        b43_radio_mask(dev, 0x0035, 0xFFEF);
+        b43_radio_maskset(dev, 0x0035, 0xFFEF, 0x0010);
         b43_radio_set_tx_iq(dev);
         //TODO: TSSI2dbm workaround
 //FIXME b43_phy_xmitpower(dev);
@@ -160,23 +151,20 @@ static void b43_radio_init2060(struct b43_wldev *dev)
         b43_radio_write16(dev, 0x0082, 0x0080);
         b43_radio_write16(dev, 0x0080, 0x0000);
         b43_radio_write16(dev, 0x003F, 0x00DA);
-        b43_radio_write16(dev, 0x0005, b43_radio_read16(dev, 0x0005) & ~0x0008);
-        b43_radio_write16(dev, 0x0081, b43_radio_read16(dev, 0x0081) & ~0x0010);
-        b43_radio_write16(dev, 0x0081, b43_radio_read16(dev, 0x0081) & ~0x0020);
-        b43_radio_write16(dev, 0x0081, b43_radio_read16(dev, 0x0081) & ~0x0020);
+        b43_radio_mask(dev, 0x0005, ~0x0008);
+        b43_radio_mask(dev, 0x0081, ~0x0010);
+        b43_radio_mask(dev, 0x0081, ~0x0020);
+        b43_radio_mask(dev, 0x0081, ~0x0020);
         msleep(1);              /* delay 400usec */
 
-        b43_radio_write16(dev, 0x0081,
-                          (b43_radio_read16(dev, 0x0081) & ~0x0020) | 0x0010);
+        b43_radio_maskset(dev, 0x0081, ~0x0020, 0x0010);
         msleep(1);              /* delay 400usec */
 
-        b43_radio_write16(dev, 0x0005,
-                          (b43_radio_read16(dev, 0x0005) & ~0x0008) | 0x0008);
-        b43_radio_write16(dev, 0x0085, b43_radio_read16(dev, 0x0085) & ~0x0010);
-        b43_radio_write16(dev, 0x0005, b43_radio_read16(dev, 0x0005) & ~0x0008);
-        b43_radio_write16(dev, 0x0081, b43_radio_read16(dev, 0x0081) & ~0x0040);
-        b43_radio_write16(dev, 0x0081,
-                          (b43_radio_read16(dev, 0x0081) & ~0x0040) | 0x0040);
+        b43_radio_maskset(dev, 0x0005, ~0x0008, 0x0008);
+        b43_radio_mask(dev, 0x0085, ~0x0010);
+        b43_radio_mask(dev, 0x0005, ~0x0008);
+        b43_radio_mask(dev, 0x0081, ~0x0040);
+        b43_radio_maskset(dev, 0x0081, ~0x0040, 0x0040);
         b43_radio_write16(dev, 0x0005,
                           (b43_radio_read16(dev, 0x0081) & ~0x0008) | 0x0008);
         b43_phy_write(dev, 0x0063, 0xDDC6);
@@ -224,22 +212,16 @@ static void b43_phy_ww(struct b43_wldev *dev)
         u16 b, curr_s, best_s = 0xFFFF;
         int i;
 
-        b43_phy_write(dev, B43_PHY_CRS0,
-                b43_phy_read(dev, B43_PHY_CRS0) & ~B43_PHY_CRS0_EN);
-        b43_phy_write(dev, B43_PHY_OFDM(0x1B),
-                b43_phy_read(dev, B43_PHY_OFDM(0x1B)) | 0x1000);
-        b43_phy_write(dev, B43_PHY_OFDM(0x82),
-                (b43_phy_read(dev, B43_PHY_OFDM(0x82)) & 0xF0FF) | 0x0300);
-        b43_radio_write16(dev, 0x0009,
-                b43_radio_read16(dev, 0x0009) | 0x0080);
-        b43_radio_write16(dev, 0x0012,
-                (b43_radio_read16(dev, 0x0012) & 0xFFFC) | 0x0002);
+        b43_phy_mask(dev, B43_PHY_CRS0, ~B43_PHY_CRS0_EN);
+        b43_phy_set(dev, B43_PHY_OFDM(0x1B), 0x1000);
+        b43_phy_maskset(dev, B43_PHY_OFDM(0x82), 0xF0FF, 0x0300);
+        b43_radio_set(dev, 0x0009, 0x0080);
+        b43_radio_maskset(dev, 0x0012, 0xFFFC, 0x0002);
         b43_wa_initgains(dev);
         b43_phy_write(dev, B43_PHY_OFDM(0xBA), 0x3ED5);
         b = b43_phy_read(dev, B43_PHY_PWRDOWN);
         b43_phy_write(dev, B43_PHY_PWRDOWN, (b & 0xFFF8) | 0x0005);
-        b43_radio_write16(dev, 0x0004,
-                b43_radio_read16(dev, 0x0004) | 0x0004);
+        b43_radio_set(dev, 0x0004, 0x0004);
         for (i = 0x10; i <= 0x20; i++) {
                 b43_radio_write16(dev, 0x0013, i);
                 curr_s = b43_phy_read(dev, B43_PHY_OTABLEQ) & 0x00FF;
@@ -252,8 +234,7 @@ static void b43_phy_ww(struct b43_wldev *dev)
                         best_s = curr_s;
         }
         b43_phy_write(dev, B43_PHY_PWRDOWN, b);
-        b43_radio_write16(dev, 0x0004,
-                b43_radio_read16(dev, 0x0004) & 0xFFFB);
+        b43_radio_mask(dev, 0x0004, 0xFFFB);
         b43_radio_write16(dev, 0x0013, best_s);
         b43_ofdmtab_write16(dev, B43_OFDMTAB_AGC1_R1, 0, 0xFFEC);
         b43_phy_write(dev, B43_PHY_OFDM(0xB7), 0x1E80);
@@ -261,14 +242,10 @@ static void b43_phy_ww(struct b43_wldev *dev)
         b43_phy_write(dev, B43_PHY_OFDM(0xB5), 0x0EC0);
         b43_phy_write(dev, B43_PHY_OFDM(0xB2), 0x00C0);
         b43_phy_write(dev, B43_PHY_OFDM(0xB9), 0x1FFF);
-        b43_phy_write(dev, B43_PHY_OFDM(0xBB),
-                (b43_phy_read(dev, B43_PHY_OFDM(0xBB)) & 0xF000) | 0x0053);
-        b43_phy_write(dev, B43_PHY_OFDM61,
-                (b43_phy_read(dev, B43_PHY_OFDM61) & 0xFE1F) | 0x0120);
-        b43_phy_write(dev, B43_PHY_OFDM(0x13),
-                (b43_phy_read(dev, B43_PHY_OFDM(0x13)) & 0x0FFF) | 0x3000);
-        b43_phy_write(dev, B43_PHY_OFDM(0x14),
-                (b43_phy_read(dev, B43_PHY_OFDM(0x14)) & 0x0FFF) | 0x3000);
+        b43_phy_maskset(dev, B43_PHY_OFDM(0xBB), 0xF000, 0x0053);
+        b43_phy_maskset(dev, B43_PHY_OFDM61, 0xFE1F, 0x0120);
+        b43_phy_maskset(dev, B43_PHY_OFDM(0x13), 0x0FFF, 0x3000);
+        b43_phy_maskset(dev, B43_PHY_OFDM(0x14), 0x0FFF, 0x3000);
         b43_ofdmtab_write16(dev, B43_OFDMTAB_AGC1, 6, 0x0017);
         for (i = 0; i < 6; i++)
                 b43_ofdmtab_write16(dev, B43_OFDMTAB_AGC1, i, 0x000F);
@@ -276,8 +253,7 @@ static void b43_phy_ww(struct b43_wldev *dev)
         b43_ofdmtab_write16(dev, B43_OFDMTAB_AGC1, 0x0E, 0x0011);
         b43_ofdmtab_write16(dev, B43_OFDMTAB_AGC1, 0x0F, 0x0013);
         b43_phy_write(dev, B43_PHY_OFDM(0x33), 0x5030);
-        b43_phy_write(dev, B43_PHY_CRS0,
-                b43_phy_read(dev, B43_PHY_CRS0) | B43_PHY_CRS0_EN);
+        b43_phy_set(dev, B43_PHY_CRS0, B43_PHY_CRS0_EN);
 }
 
 static void hardware_pctl_init_aphy(struct b43_wldev *dev)
@@ -300,26 +276,21 @@ void b43_phy_inita(struct b43_wldev *dev)
 
         if (phy->rev >= 6) {
                 if (phy->type == B43_PHYTYPE_A)
-                        b43_phy_write(dev, B43_PHY_OFDM(0x1B),
-                                b43_phy_read(dev, B43_PHY_OFDM(0x1B)) & ~0x1000);
+                        b43_phy_mask(dev, B43_PHY_OFDM(0x1B), ~0x1000);
                 if (b43_phy_read(dev, B43_PHY_ENCORE) & B43_PHY_ENCORE_EN)
-                        b43_phy_write(dev, B43_PHY_ENCORE,
-                                b43_phy_read(dev, B43_PHY_ENCORE) | 0x0010);
+                        b43_phy_set(dev, B43_PHY_ENCORE, 0x0010);
                 else
-                        b43_phy_write(dev, B43_PHY_ENCORE,
-                                b43_phy_read(dev, B43_PHY_ENCORE) & ~0x1010);
+                        b43_phy_mask(dev, B43_PHY_ENCORE, ~0x1010);
         }
 
         b43_wa_all(dev);
 
         if (phy->type == B43_PHYTYPE_A) {
                 if (phy->gmode && (phy->rev < 3))
-                        b43_phy_write(dev, 0x0034,
-                                b43_phy_read(dev, 0x0034) | 0x0001);
+                        b43_phy_set(dev, 0x0034, 0x0001);
                 b43_phy_rssiagc(dev, 0);
 
-                b43_phy_write(dev, B43_PHY_CRS0,
-                        b43_phy_read(dev, B43_PHY_CRS0) | B43_PHY_CRS0_EN);
+                b43_phy_set(dev, B43_PHY_CRS0, B43_PHY_CRS0_EN);
 
                 b43_radio_init2060(dev);
 
@@ -339,9 +310,7 @@ void b43_phy_inita(struct b43_wldev *dev)
 
         if ((phy->type == B43_PHYTYPE_G) &&
             (dev->dev->bus->sprom.boardflags_lo & B43_BFL_PACTRL)) {
-                b43_phy_write(dev, B43_PHY_OFDM(0x6E),
-                                  (b43_phy_read(dev, B43_PHY_OFDM(0x6E))
-                                   & 0xE000) | 0x3CF);
+                b43_phy_maskset(dev, B43_PHY_OFDM(0x6E), 0xE000, 0x3CF);
         }
 }
 
@@ -520,14 +489,14 @@ static void b43_aphy_op_software_rfkill(struct b43_wldev *dev,
                         return;
                 b43_radio_write16(dev, 0x0004, 0x00C0);
                 b43_radio_write16(dev, 0x0005, 0x0008);
-                b43_phy_write(dev, 0x0010, b43_phy_read(dev, 0x0010) & 0xFFF7);
-                b43_phy_write(dev, 0x0011, b43_phy_read(dev, 0x0011) & 0xFFF7);
+                b43_phy_mask(dev, 0x0010, 0xFFF7);
+                b43_phy_mask(dev, 0x0011, 0xFFF7);
                 b43_radio_init2060(dev);
         } else {
                 b43_radio_write16(dev, 0x0004, 0x00FF);
                 b43_radio_write16(dev, 0x0005, 0x00FB);
-                b43_phy_write(dev, 0x0010, b43_phy_read(dev, 0x0010) | 0x0008);
-                b43_phy_write(dev, 0x0011, b43_phy_read(dev, 0x0011) | 0x0008);
+                b43_phy_set(dev, 0x0010, 0x0008);
+                b43_phy_set(dev, 0x0011, 0x0008);
         }
 }
 
diff --git a/drivers/net/wireless/b43/phy_g.c b/drivers/net/wireless/b43/phy_g.c
index 88bb303ae9d5..e7b98f013b0f 100644
--- a/drivers/net/wireless/b43/phy_g.c
+++ b/drivers/net/wireless/b43/phy_g.c
@@ -204,13 +204,9 @@ void b43_gphy_set_baseband_attenuation(struct b43_wldev *dev,
                                                  & 0xFFF0) |
                             baseband_attenuation);
         } else if (phy->analog > 1) {
-                b43_phy_write(dev, B43_PHY_DACCTL,
-                              (b43_phy_read(dev, B43_PHY_DACCTL)
-                               & 0xFFC3) | (baseband_attenuation << 2));
+                b43_phy_maskset(dev, B43_PHY_DACCTL, 0xFFC3, (baseband_attenuation << 2));
         } else {
-                b43_phy_write(dev, B43_PHY_DACCTL,
-                              (b43_phy_read(dev, B43_PHY_DACCTL)
-                               & 0xFF87) | (baseband_attenuation << 3));
+                b43_phy_maskset(dev, B43_PHY_DACCTL, 0xFF87, (baseband_attenuation << 3));
         }
 }
 
@@ -252,17 +248,13 @@ static void b43_set_txpower_g(struct b43_wldev *dev,
                 b43_radio_write16(dev, 0x43,
                                   (rf & 0x000F) | (tx_control & 0x0070));
         } else {
-                b43_radio_write16(dev, 0x43, (b43_radio_read16(dev, 0x43)
-                                              & 0xFFF0) | (rf & 0x000F));
-                b43_radio_write16(dev, 0x52, (b43_radio_read16(dev, 0x52)
-                                              & ~0x0070) | (tx_control &
-                                                            0x0070));
+                b43_radio_maskset(dev, 0x43, 0xFFF0, (rf & 0x000F));
+                b43_radio_maskset(dev, 0x52, ~0x0070, (tx_control & 0x0070));
         }
         if (has_tx_magnification(phy)) {
                 b43_radio_write16(dev, 0x52, tx_magn | tx_bias);
         } else {
-                b43_radio_write16(dev, 0x52, (b43_radio_read16(dev, 0x52)
-                                              & 0xFFF0) | (tx_bias & 0x000F));
+                b43_radio_maskset(dev, 0x52, 0xFFF0, (tx_bias & 0x000F));
         }
         b43_lo_g_adjust(dev);
 }
@@ -337,12 +329,9 @@ static void b43_set_all_gains(struct b43_wldev *dev,
 
         if (third != -1) {
                 tmp = ((u16) third << 14) | ((u16) third << 6);
-                b43_phy_write(dev, 0x04A0,
-                              (b43_phy_read(dev, 0x04A0) & 0xBFBF) | tmp);
-                b43_phy_write(dev, 0x04A1,
-                              (b43_phy_read(dev, 0x04A1) & 0xBFBF) | tmp);
-                b43_phy_write(dev, 0x04A2,
-                              (b43_phy_read(dev, 0x04A2) & 0xBFBF) | tmp);
+                b43_phy_maskset(dev, 0x04A0, 0xBFBF, tmp);
+                b43_phy_maskset(dev, 0x04A1, 0xBFBF, tmp);
+                b43_phy_maskset(dev, 0x04A2, 0xBFBF, tmp);
         }
         b43_dummy_transmission(dev);
 }
@@ -373,12 +362,9 @@ static void b43_set_original_gains(struct b43_wldev *dev)
         for (i = start; i < end; i++)
                 b43_ofdmtab_write16(dev, table, i, i - start);
 
-        b43_phy_write(dev, 0x04A0,
-                      (b43_phy_read(dev, 0x04A0) & 0xBFBF) | 0x4040);
-        b43_phy_write(dev, 0x04A1,
-                      (b43_phy_read(dev, 0x04A1) & 0xBFBF) | 0x4040);
-        b43_phy_write(dev, 0x04A2,
-                      (b43_phy_read(dev, 0x04A2) & 0xBFBF) | 0x4000);
+        b43_phy_maskset(dev, 0x04A0, 0xBFBF, 0x4040);
+        b43_phy_maskset(dev, 0x04A1, 0xBFBF, 0x4040);
+        b43_phy_maskset(dev, 0x04A2, 0xBFBF, 0x4000);
         b43_dummy_transmission(dev);
 }
 
@@ -454,13 +440,11 @@ static void b43_calc_nrssi_offset(struct b43_wldev *dev)
         backup[10] = b43_radio_read16(dev, 0x007A);
         backup[11] = b43_radio_read16(dev, 0x0043);
 
-        b43_phy_write(dev, 0x0429, b43_phy_read(dev, 0x0429) & 0x7FFF);
-        b43_phy_write(dev, 0x0001,
-                      (b43_phy_read(dev, 0x0001) & 0x3FFF) | 0x4000);
-        b43_phy_write(dev, 0x0811, b43_phy_read(dev, 0x0811) | 0x000C);
-        b43_phy_write(dev, 0x0812,
-                      (b43_phy_read(dev, 0x0812) & 0xFFF3) | 0x0004);
-        b43_phy_write(dev, 0x0802, b43_phy_read(dev, 0x0802) & ~(0x1 | 0x2));
+        b43_phy_mask(dev, 0x0429, 0x7FFF);
+        b43_phy_maskset(dev, 0x0001, 0x3FFF, 0x4000);
+        b43_phy_set(dev, 0x0811, 0x000C);
+        b43_phy_maskset(dev, 0x0812, 0xFFF3, 0x0004);
+        b43_phy_mask(dev, 0x0802, ~(0x1 | 0x2));
         if (phy->rev >= 6) {
                 backup[12] = b43_phy_read(dev, 0x002E);
                 backup[13] = b43_phy_read(dev, 0x002F);
@@ -475,13 +459,13 @@ static void b43_calc_nrssi_offset(struct b43_wldev *dev)
                 b43_phy_write(dev, 0x002F, 0);
                 b43_phy_write(dev, 0x080F, 0);
                 b43_phy_write(dev, 0x0810, 0);
-                b43_phy_write(dev, 0x0478, b43_phy_read(dev, 0x0478) | 0x0100);
-                b43_phy_write(dev, 0x0801, b43_phy_read(dev, 0x0801) | 0x0040);
-                b43_phy_write(dev, 0x0060, b43_phy_read(dev, 0x0060) | 0x0040);
-                b43_phy_write(dev, 0x0014, b43_phy_read(dev, 0x0014) | 0x0200);
+                b43_phy_set(dev, 0x0478, 0x0100);
+                b43_phy_set(dev, 0x0801, 0x0040);
+                b43_phy_set(dev, 0x0060, 0x0040);
+                b43_phy_set(dev, 0x0014, 0x0200);
         }
-        b43_radio_write16(dev, 0x007A, b43_radio_read16(dev, 0x007A) | 0x0070);
-        b43_radio_write16(dev, 0x007A, b43_radio_read16(dev, 0x007A) | 0x0080);
+        b43_radio_set(dev, 0x007A, 0x0070);
+        b43_radio_set(dev, 0x007A, 0x0080);
         udelay(30);
 
         v47F = (s16) ((b43_phy_read(dev, 0x047F) >> 8) & 0x003F);
@@ -501,40 +485,31 @@ static void b43_calc_nrssi_offset(struct b43_wldev *dev)
                 if (saved == 0xFFFF)
                         saved = 4;
         } else {
-                b43_radio_write16(dev, 0x007A,
-                                  b43_radio_read16(dev, 0x007A) & 0x007F);
+                b43_radio_mask(dev, 0x007A, 0x007F);
                 if (phy->rev != 1) {    /* Not in specs, but needed to prevent PPC machine check */
-                        b43_phy_write(dev, 0x0814,
-                                      b43_phy_read(dev, 0x0814) | 0x0001);
-                        b43_phy_write(dev, 0x0815,
-                                      b43_phy_read(dev, 0x0815) & 0xFFFE);
+                        b43_phy_set(dev, 0x0814, 0x0001);
+                        b43_phy_mask(dev, 0x0815, 0xFFFE);
                 }
-                b43_phy_write(dev, 0x0811, b43_phy_read(dev, 0x0811) | 0x000C);
-                b43_phy_write(dev, 0x0812, b43_phy_read(dev, 0x0812) | 0x000C);
-                b43_phy_write(dev, 0x0811, b43_phy_read(dev, 0x0811) | 0x0030);
-                b43_phy_write(dev, 0x0812, b43_phy_read(dev, 0x0812) | 0x0030);
+                b43_phy_set(dev, 0x0811, 0x000C);
+                b43_phy_set(dev, 0x0812, 0x000C);
+                b43_phy_set(dev, 0x0811, 0x0030);
+                b43_phy_set(dev, 0x0812, 0x0030);
                 b43_phy_write(dev, 0x005A, 0x0480);
                 b43_phy_write(dev, 0x0059, 0x0810);
                 b43_phy_write(dev, 0x0058, 0x000D);
                 if (phy->rev == 0) {
                         b43_phy_write(dev, 0x0003, 0x0122);
                 } else {
-                        b43_phy_write(dev, 0x000A, b43_phy_read(dev, 0x000A)
-                                      | 0x2000);
+                        b43_phy_set(dev, 0x000A, 0x2000);
                 }
                 if (phy->rev != 1) {    /* Not in specs, but needed to prevent PPC machine check */
-                        b43_phy_write(dev, 0x0814,
-                                      b43_phy_read(dev, 0x0814) | 0x0004);
-                        b43_phy_write(dev, 0x0815,
-                                      b43_phy_read(dev, 0x0815) & 0xFFFB);
+                        b43_phy_set(dev, 0x0814, 0x0004);
+                        b43_phy_mask(dev, 0x0815, 0xFFFB);
                 }
-                b43_phy_write(dev, 0x0003, (b43_phy_read(dev, 0x0003) & 0xFF9F)
-                              | 0x0040);
-                b43_radio_write16(dev, 0x007A,
-                                  b43_radio_read16(dev, 0x007A) | 0x000F);
+                b43_phy_maskset(dev, 0x0003, 0xFF9F, 0x0040);
+                b43_radio_set(dev, 0x007A, 0x000F);
                 b43_set_all_gains(dev, 3, 0, 1);
-                b43_radio_write16(dev, 0x0043, (b43_radio_read16(dev, 0x0043)
-                                                & 0x00F0) | 0x000F);
+                b43_radio_maskset(dev, 0x0043, 0x00F0, 0x000F);
                 udelay(30);
                 v47F = (s16) ((b43_phy_read(dev, 0x047F) >> 8) & 0x003F);
                 if (v47F >= 0x20)
@@ -576,7 +551,7 @@ static void b43_calc_nrssi_offset(struct b43_wldev *dev)
         b43_radio_write16(dev, 0x0043, backup[11]);
         b43_radio_write16(dev, 0x007A, backup[10]);
         b43_phy_write(dev, 0x0802, b43_phy_read(dev, 0x0802) | 0x1 | 0x2);
-        b43_phy_write(dev, 0x0429, b43_phy_read(dev, 0x0429) | 0x8000);
+        b43_phy_set(dev, 0x0429, 0x8000);
         b43_set_original_gains(dev);
         if (phy->rev >= 6) {
                 b43_phy_write(dev, 0x0801, backup[16]);
@@ -604,9 +579,8 @@ static void b43_calc_nrssi_slope(struct b43_wldev *dev)
         if (phy->radio_rev == 8)
                 b43_calc_nrssi_offset(dev);
 
-        b43_phy_write(dev, B43_PHY_G_CRS,
-                      b43_phy_read(dev, B43_PHY_G_CRS) & 0x7FFF);
-        b43_phy_write(dev, 0x0802, b43_phy_read(dev, 0x0802) & 0xFFFC);
+        b43_phy_mask(dev, B43_PHY_G_CRS, 0x7FFF);
+        b43_phy_mask(dev, 0x0802, 0xFFFC);
         backup[7] = b43_read16(dev, 0x03E2);
         b43_write16(dev, 0x03E2, b43_read16(dev, 0x03E2) | 0x8000);
         backup[0] = b43_radio_read16(dev, 0x007A);
@@ -633,66 +607,44 @@ static void b43_calc_nrssi_slope(struct b43_wldev *dev)
                 case 4:
                 case 6:
                 case 7:
-                        b43_phy_write(dev, 0x0478,
-                                      b43_phy_read(dev, 0x0478)
-                                      | 0x0100);
-                        b43_phy_write(dev, 0x0801,
-                                      b43_phy_read(dev, 0x0801)
-                                      | 0x0040);
+                        b43_phy_set(dev, 0x0478, 0x0100);
+                        b43_phy_set(dev, 0x0801, 0x0040);
                         break;
                 case 3:
                 case 5:
-                        b43_phy_write(dev, 0x0801,
-                                      b43_phy_read(dev, 0x0801)
-                                      & 0xFFBF);
+                        b43_phy_mask(dev, 0x0801, 0xFFBF);
                         break;
                 }
-                b43_phy_write(dev, 0x0060, b43_phy_read(dev, 0x0060)
-                              | 0x0040);
-                b43_phy_write(dev, 0x0014, b43_phy_read(dev, 0x0014)
-                              | 0x0200);
+                b43_phy_set(dev, 0x0060, 0x0040);
+                b43_phy_set(dev, 0x0014, 0x0200);
         }
-        b43_radio_write16(dev, 0x007A,
-                          b43_radio_read16(dev, 0x007A) | 0x0070);
+        b43_radio_set(dev, 0x007A, 0x0070);
         b43_set_all_gains(dev, 0, 8, 0);
-        b43_radio_write16(dev, 0x007A,
-                          b43_radio_read16(dev, 0x007A) & 0x00F7);
+        b43_radio_mask(dev, 0x007A, 0x00F7);
         if (phy->rev >= 2) {
-                b43_phy_write(dev, 0x0811,
-                              (b43_phy_read(dev, 0x0811) & 0xFFCF) |
-                              0x0030);
-                b43_phy_write(dev, 0x0812,
-                              (b43_phy_read(dev, 0x0812) & 0xFFCF) |
-                              0x0010);
+                b43_phy_maskset(dev, 0x0811, 0xFFCF, 0x0030);
+                b43_phy_maskset(dev, 0x0812, 0xFFCF, 0x0010);
         }
-        b43_radio_write16(dev, 0x007A,
-                          b43_radio_read16(dev, 0x007A) | 0x0080);
+        b43_radio_set(dev, 0x007A, 0x0080);
         udelay(20);
 
         nrssi0 = (s16) ((b43_phy_read(dev, 0x047F) >> 8) & 0x003F);
         if (nrssi0 >= 0x0020)
                 nrssi0 -= 0x0040;
 
-        b43_radio_write16(dev, 0x007A,
-                          b43_radio_read16(dev, 0x007A) & 0x007F);
+        b43_radio_mask(dev, 0x007A, 0x007F);
         if (phy->rev >= 2) {
-                b43_phy_write(dev, 0x0003, (b43_phy_read(dev, 0x0003)
-                                            & 0xFF9F) | 0x0040);
+                b43_phy_maskset(dev, 0x0003, 0xFF9F, 0x0040);
         }
 
         b43_write16(dev, B43_MMIO_CHANNEL_EXT,
                     b43_read16(dev, B43_MMIO_CHANNEL_EXT)
                     | 0x2000);
-        b43_radio_write16(dev, 0x007A,
-                          b43_radio_read16(dev, 0x007A) | 0x000F);
+        b43_radio_set(dev, 0x007A, 0x000F);
         b43_phy_write(dev, 0x0015, 0xF330);
         if (phy->rev >= 2) {
-                b43_phy_write(dev, 0x0812,
-                              (b43_phy_read(dev, 0x0812) & 0xFFCF) |
-                              0x0020);
-                b43_phy_write(dev, 0x0811,
-                              (b43_phy_read(dev, 0x0811) & 0xFFCF) |
-                              0x0020);
+                b43_phy_maskset(dev, 0x0812, 0xFFCF, 0x0020);
+                b43_phy_maskset(dev, 0x0811, 0xFFCF, 0x0020);
         }
 
         b43_set_all_gains(dev, 3, 0, 1);
@@ -726,10 +678,8 @@ static void b43_calc_nrssi_slope(struct b43_wldev *dev)
                 b43_phy_write(dev, B43_PHY_G_LO_CONTROL, backup[13]);
         }
         if (phy->rev >= 2) {
-                b43_phy_write(dev, 0x0812,
-                              b43_phy_read(dev, 0x0812) & 0xFFCF);
-                b43_phy_write(dev, 0x0811,
-                              b43_phy_read(dev, 0x0811) & 0xFFCF);
+                b43_phy_mask(dev, 0x0812, 0xFFCF);
+                b43_phy_mask(dev, 0x0811, 0xFFCF);
         }
 
         b43_radio_write16(dev, 0x007A, backup[0]);
@@ -743,11 +693,9 @@ static void b43_calc_nrssi_slope(struct b43_wldev *dev)
         b43_phy_write(dev, 0x0059, backup[5]);
         b43_phy_write(dev, 0x0058, backup[6]);
         b43_synth_pu_workaround(dev, phy->channel);
-        b43_phy_write(dev, 0x0802,
-                      b43_phy_read(dev, 0x0802) | (0x0001 | 0x0002));
+        b43_phy_set(dev, 0x0802, (0x0001 | 0x0002));
         b43_set_original_gains(dev);
-        b43_phy_write(dev, B43_PHY_G_CRS,
-                      b43_phy_read(dev, B43_PHY_G_CRS) | 0x8000);
+        b43_phy_set(dev, B43_PHY_G_CRS, 0x8000);
         if (phy->rev >= 3) {
                 b43_phy_write(dev, 0x0801, backup[14]);
                 b43_phy_write(dev, 0x0060, backup[15]);
@@ -774,13 +722,9 @@ static void b43_calc_nrssi_threshold(struct b43_wldev *dev)
                 if (tmp16 >= 0x20)
                         tmp16 -= 0x40;
                 if (tmp16 < 3) {
-                        b43_phy_write(dev, 0x048A,
-                                      (b43_phy_read(dev, 0x048A)
-                                       & 0xF000) | 0x09EB);
+                        b43_phy_maskset(dev, 0x048A, 0xF000, 0x09EB);
                 } else {
-                        b43_phy_write(dev, 0x048A,
-                                      (b43_phy_read(dev, 0x048A)
-                                       & 0xF000) | 0x0AED);
+                        b43_phy_maskset(dev, 0x048A, 0xF000, 0x0AED);
                 }
         } else {
                 if (gphy->interfmode == B43_INTERFMODE_NONWLAN) {
@@ -823,7 +767,7 @@ static void b43_calc_nrssi_threshold(struct b43_wldev *dev)
  * interference mitigation code.
  * It is save to restore values in random order.
  */
-static void _stack_save(u32 * _stackptr, size_t * stackidx,
+static void _stack_save(u32 *_stackptr, size_t *stackidx,
                         u8 id, u16 offset, u16 value)
 {
         u32 *stackptr = &(_stackptr[*stackidx]);
@@ -837,7 +781,7 @@ static void _stack_save(u32 * _stackptr, size_t * stackidx,
         B43_WARN_ON(*stackidx >= B43_INTERFSTACK_SIZE);
 }
 
-static u16 _stack_restore(u32 * stackptr, u8 id, u16 offset)
+static u16 _stack_restore(u32 *stackptr, u8 id, u16 offset)
 {
         size_t i;
 
@@ -901,11 +845,8 @@ b43_radio_interference_mitigation_enable(struct b43_wldev *dev, int mode)
         switch (mode) {
         case B43_INTERFMODE_NONWLAN:
                 if (phy->rev != 1) {
-                        b43_phy_write(dev, 0x042B,
-                                      b43_phy_read(dev, 0x042B) | 0x0800);
-                        b43_phy_write(dev, B43_PHY_G_CRS,
-                                      b43_phy_read(dev,
-                                                   B43_PHY_G_CRS) & ~0x4000);
+                        b43_phy_set(dev, 0x042B, 0x0800);
+                        b43_phy_mask(dev, B43_PHY_G_CRS, ~0x4000);
                         break;
                 }
                 radio_stacksave(0x0078);
@@ -924,26 +865,19 @@ b43_radio_interference_mitigation_enable(struct b43_wldev *dev, int mode)
                 phy_stacksave(0x0406);
                 b43_phy_write(dev, 0x0406, 0x7E28);
 
-                b43_phy_write(dev, 0x042B, b43_phy_read(dev, 0x042B) | 0x0800);
-                b43_phy_write(dev, B43_PHY_RADIO_BITFIELD,
-                              b43_phy_read(dev,
-                                           B43_PHY_RADIO_BITFIELD) | 0x1000);
+                b43_phy_set(dev, 0x042B, 0x0800);
+                b43_phy_set(dev, B43_PHY_RADIO_BITFIELD, 0x1000);
 
                 phy_stacksave(0x04A0);
-                b43_phy_write(dev, 0x04A0,
-                              (b43_phy_read(dev, 0x04A0) & 0xC0C0) | 0x0008);
+                b43_phy_maskset(dev, 0x04A0, 0xC0C0, 0x0008);
                 phy_stacksave(0x04A1);
-                b43_phy_write(dev, 0x04A1,
-                              (b43_phy_read(dev, 0x04A1) & 0xC0C0) | 0x0605);
+                b43_phy_maskset(dev, 0x04A1, 0xC0C0, 0x0605);
                 phy_stacksave(0x04A2);
-                b43_phy_write(dev, 0x04A2,
-                              (b43_phy_read(dev, 0x04A2) & 0xC0C0) | 0x0204);
+                b43_phy_maskset(dev, 0x04A2, 0xC0C0, 0x0204);
                 phy_stacksave(0x04A8);
-                b43_phy_write(dev, 0x04A8,
-                              (b43_phy_read(dev, 0x04A8) & 0xC0C0) | 0x0803);
+                b43_phy_maskset(dev, 0x04A8, 0xC0C0, 0x0803);
                 phy_stacksave(0x04AB);
-                b43_phy_write(dev, 0x04AB,
-                              (b43_phy_read(dev, 0x04AB) & 0xC0C0) | 0x0605);
+                b43_phy_maskset(dev, 0x04AB, 0xC0C0, 0x0605);
 
                 phy_stacksave(0x04A7);
                 b43_phy_write(dev, 0x04A7, 0x0002);
@@ -999,12 +933,8 @@ b43_radio_interference_mitigation_enable(struct b43_wldev *dev, int mode)
                 phy_stacksave(0x042B);
                 phy_stacksave(0x048C);
 
-                b43_phy_write(dev, B43_PHY_RADIO_BITFIELD,
-                              b43_phy_read(dev, B43_PHY_RADIO_BITFIELD)
-                              & ~0x1000);
-                b43_phy_write(dev, B43_PHY_G_CRS,
-                              (b43_phy_read(dev, B43_PHY_G_CRS)
-                               & 0xFFFC) | 0x0002);
+                b43_phy_mask(dev, B43_PHY_RADIO_BITFIELD, ~0x1000);
+                b43_phy_maskset(dev, B43_PHY_G_CRS, 0xFFFC, 0x0002);
 
                 b43_phy_write(dev, 0x0033, 0x0800);
                 b43_phy_write(dev, 0x04A3, 0x2027);
@@ -1013,8 +943,7 @@ b43_radio_interference_mitigation_enable(struct b43_wldev *dev, int mode)
                 b43_phy_write(dev, 0x04AA, 0x1CA8);
                 b43_phy_write(dev, 0x04AC, 0x287A);
 
-                b43_phy_write(dev, 0x04A0, (b43_phy_read(dev, 0x04A0)
-                                            & 0xFFC0) | 0x001A);
+                b43_phy_maskset(dev, 0x04A0, 0xFFC0, 0x001A);
                 b43_phy_write(dev, 0x04A7, 0x000D);
 
                 if (phy->rev < 2) {
@@ -1027,65 +956,41 @@ b43_radio_interference_mitigation_enable(struct b43_wldev *dev, int mode)
                         b43_phy_write(dev, 0x04C1, 0x0059);
                 }
 
-                b43_phy_write(dev, 0x04A1, (b43_phy_read(dev, 0x04A1)
-                                            & 0xC0FF) | 0x1800);
-                b43_phy_write(dev, 0x04A1, (b43_phy_read(dev, 0x04A1)
-                                            & 0xFFC0) | 0x0015);
-                b43_phy_write(dev, 0x04A8, (b43_phy_read(dev, 0x04A8)
-                                            & 0xCFFF) | 0x1000);
-                b43_phy_write(dev, 0x04A8, (b43_phy_read(dev, 0x04A8)
-                                            & 0xF0FF) | 0x0A00);
-                b43_phy_write(dev, 0x04AB, (b43_phy_read(dev, 0x04AB)
-                                            & 0xCFFF) | 0x1000);
-                b43_phy_write(dev, 0x04AB, (b43_phy_read(dev, 0x04AB)
-                                            & 0xF0FF) | 0x0800);
-                b43_phy_write(dev, 0x04AB, (b43_phy_read(dev, 0x04AB)
-                                            & 0xFFCF) | 0x0010);
-                b43_phy_write(dev, 0x04AB, (b43_phy_read(dev, 0x04AB)
-                                            & 0xFFF0) | 0x0005);
-                b43_phy_write(dev, 0x04A8, (b43_phy_read(dev, 0x04A8)
-                                            & 0xFFCF) | 0x0010);
-                b43_phy_write(dev, 0x04A8, (b43_phy_read(dev, 0x04A8)
-                                            & 0xFFF0) | 0x0006);
-                b43_phy_write(dev, 0x04A2, (b43_phy_read(dev, 0x04A2)
-                                            & 0xF0FF) | 0x0800);
-                b43_phy_write(dev, 0x04A0, (b43_phy_read(dev, 0x04A0)
-                                            & 0xF0FF) | 0x0500);
-                b43_phy_write(dev, 0x04A2, (b43_phy_read(dev, 0x04A2)
-                                            & 0xFFF0) | 0x000B);
+                b43_phy_maskset(dev, 0x04A1, 0xC0FF, 0x1800);
+                b43_phy_maskset(dev, 0x04A1, 0xFFC0, 0x0015);
+                b43_phy_maskset(dev, 0x04A8, 0xCFFF, 0x1000);
+                b43_phy_maskset(dev, 0x04A8, 0xF0FF, 0x0A00);
+                b43_phy_maskset(dev, 0x04AB, 0xCFFF, 0x1000);
+                b43_phy_maskset(dev, 0x04AB, 0xF0FF, 0x0800);
+                b43_phy_maskset(dev, 0x04AB, 0xFFCF, 0x0010);
+                b43_phy_maskset(dev, 0x04AB, 0xFFF0, 0x0005);
+                b43_phy_maskset(dev, 0x04A8, 0xFFCF, 0x0010);
+                b43_phy_maskset(dev, 0x04A8, 0xFFF0, 0x0006);
+                b43_phy_maskset(dev, 0x04A2, 0xF0FF, 0x0800);
+                b43_phy_maskset(dev, 0x04A0, 0xF0FF, 0x0500);
+                b43_phy_maskset(dev, 0x04A2, 0xFFF0, 0x000B);
 
                 if (phy->rev >= 3) {
-                        b43_phy_write(dev, 0x048A, b43_phy_read(dev, 0x048A)
-                                      & ~0x8000);
-                        b43_phy_write(dev, 0x0415, (b43_phy_read(dev, 0x0415)
-                                                    & 0x8000) | 0x36D8);
-                        b43_phy_write(dev, 0x0416, (b43_phy_read(dev, 0x0416)
-                                                    & 0x8000) | 0x36D8);
-                        b43_phy_write(dev, 0x0417, (b43_phy_read(dev, 0x0417)
-                                                    & 0xFE00) | 0x016D);
+                        b43_phy_mask(dev, 0x048A, (u16)~0x8000);
+                        b43_phy_maskset(dev, 0x0415, 0x8000, 0x36D8);
+                        b43_phy_maskset(dev, 0x0416, 0x8000, 0x36D8);
+                        b43_phy_maskset(dev, 0x0417, 0xFE00, 0x016D);
                 } else {
-                        b43_phy_write(dev, 0x048A, b43_phy_read(dev, 0x048A)
-                                      | 0x1000);
-                        b43_phy_write(dev, 0x048A, (b43_phy_read(dev, 0x048A)
-                                                    & 0x9FFF) | 0x2000);
+                        b43_phy_set(dev, 0x048A, 0x1000);
+                        b43_phy_maskset(dev, 0x048A, 0x9FFF, 0x2000);
                         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_ACIW);
                 }
                 if (phy->rev >= 2) {
-                        b43_phy_write(dev, 0x042B, b43_phy_read(dev, 0x042B)
-                                      | 0x0800);
+                        b43_phy_set(dev, 0x042B, 0x0800);
                 }
-                b43_phy_write(dev, 0x048C, (b43_phy_read(dev, 0x048C)
-                                            & 0xF0FF) | 0x0200);
+                b43_phy_maskset(dev, 0x048C, 0xF0FF, 0x0200);
                 if (phy->rev == 2) {
-                        b43_phy_write(dev, 0x04AE, (b43_phy_read(dev, 0x04AE)
-                                                    & 0xFF00) | 0x007F);
-                        b43_phy_write(dev, 0x04AD, (b43_phy_read(dev, 0x04AD)
-                                                    & 0x00FF) | 0x1300);
+                        b43_phy_maskset(dev, 0x04AE, 0xFF00, 0x007F);
+                        b43_phy_maskset(dev, 0x04AD, 0x00FF, 0x1300);
                 } else if (phy->rev >= 6) {
                         b43_ofdmtab_write16(dev, 0x1A00, 0x3, 0x007F);
                         b43_ofdmtab_write16(dev, 0x1A00, 0x2, 0x007F);
-                        b43_phy_write(dev, 0x04AD, b43_phy_read(dev, 0x04AD)
-                                      & 0x00FF);
+                        b43_phy_mask(dev, 0x04AD, 0x00FF);
                 }
                 b43_calc_nrssi_slope(dev);
                 break;
@@ -1104,24 +1009,18 @@ b43_radio_interference_mitigation_disable(struct b43_wldev *dev, int mode)
         switch (mode) {
         case B43_INTERFMODE_NONWLAN:
                 if (phy->rev != 1) {
-                        b43_phy_write(dev, 0x042B,
-                                      b43_phy_read(dev, 0x042B) & ~0x0800);
-                        b43_phy_write(dev, B43_PHY_G_CRS,
-                                      b43_phy_read(dev,
-                                                   B43_PHY_G_CRS) | 0x4000);
+                        b43_phy_mask(dev, 0x042B, ~0x0800);
+                        b43_phy_set(dev, B43_PHY_G_CRS, 0x4000);
                         break;
                 }
                 radio_stackrestore(0x0078);
                 b43_calc_nrssi_threshold(dev);
                 phy_stackrestore(0x0406);
-                b43_phy_write(dev, 0x042B, b43_phy_read(dev, 0x042B) & ~0x0800);
+                b43_phy_mask(dev, 0x042B, ~0x0800);
                 if (!dev->bad_frames_preempt) {
-                        b43_phy_write(dev, B43_PHY_RADIO_BITFIELD,
-                                      b43_phy_read(dev, B43_PHY_RADIO_BITFIELD)
-                                      & ~(1 << 11));
+                        b43_phy_mask(dev, B43_PHY_RADIO_BITFIELD, ~(1 << 11));
                 }
-                b43_phy_write(dev, B43_PHY_G_CRS,
-                              b43_phy_read(dev, B43_PHY_G_CRS) | 0x4000);
+                b43_phy_set(dev, B43_PHY_G_CRS, 0x4000);
                 phy_stackrestore(0x04A0);
                 phy_stackrestore(0x04A1);
                 phy_stackrestore(0x04A2);
@@ -1389,17 +1288,10 @@ static u16 b43_radio_init2050(struct b43_wldev *dev)
                 sav.phy_crs0 = b43_phy_read(dev, B43_PHY_CRS0);
                 sav.phy_classctl = b43_phy_read(dev, B43_PHY_CLASSCTL);
 
-                b43_phy_write(dev, B43_PHY_ANALOGOVER,
-                              b43_phy_read(dev, B43_PHY_ANALOGOVER)
-                              | 0x0003);
-                b43_phy_write(dev, B43_PHY_ANALOGOVERVAL,
-                              b43_phy_read(dev, B43_PHY_ANALOGOVERVAL)
-                              & 0xFFFC);
-                b43_phy_write(dev, B43_PHY_CRS0, b43_phy_read(dev, B43_PHY_CRS0)
-                              & 0x7FFF);
-                b43_phy_write(dev, B43_PHY_CLASSCTL,
-                              b43_phy_read(dev, B43_PHY_CLASSCTL)
-                              & 0xFFFC);
+                b43_phy_set(dev, B43_PHY_ANALOGOVER, 0x0003);
+                b43_phy_mask(dev, B43_PHY_ANALOGOVERVAL, 0xFFFC);
+                b43_phy_mask(dev, B43_PHY_CRS0, 0x7FFF);
+                b43_phy_mask(dev, B43_PHY_CLASSCTL, 0xFFFC);
                 if (has_loopback_gain(phy)) {
                         sav.phy_lo_mask = b43_phy_read(dev, B43_PHY_LO_MASK);
                         sav.phy_lo_ctl = b43_phy_read(dev, B43_PHY_LO_CTL);
@@ -1420,8 +1312,7 @@ static u16 b43_radio_init2050(struct b43_wldev *dev)
         b43_write16(dev, 0x3E2, b43_read16(dev, 0x3E2) | 0x8000);
 
         sav.phy_syncctl = b43_phy_read(dev, B43_PHY_SYNCCTL);
-        b43_phy_write(dev, B43_PHY_SYNCCTL, b43_phy_read(dev, B43_PHY_SYNCCTL)
-                      & 0xFF7F);
+        b43_phy_mask(dev, B43_PHY_SYNCCTL, 0xFF7F);
         sav.reg_3E6 = b43_read16(dev, 0x3E6);
         sav.reg_3F4 = b43_read16(dev, 0x3F4);
 
@@ -1429,9 +1320,7 @@ static u16 b43_radio_init2050(struct b43_wldev *dev)
                 b43_write16(dev, 0x03E6, 0x0122);
         } else {
                 if (phy->analog >= 2) {
-                        b43_phy_write(dev, B43_PHY_CCK(0x03),
-                                      (b43_phy_read(dev, B43_PHY_CCK(0x03))
-                                       & 0xFFBF) | 0x40);
+                        b43_phy_maskset(dev, B43_PHY_CCK(0x03), 0xFFBF, 0x40);
                 }
                 b43_write16(dev, B43_MMIO_CHANNEL_EXT,
                             (b43_read16(dev, B43_MMIO_CHANNEL_EXT) | 0x2000));
@@ -1454,14 +1343,12 @@ static u16 b43_radio_init2050(struct b43_wldev *dev)
                                                    LPD(0, 0, 1)));
         }
         b43_phy_write(dev, B43_PHY_PGACTL, 0xBFA0);
-        b43_radio_write16(dev, 0x51, b43_radio_read16(dev, 0x51)
-                          | 0x0004);
+        b43_radio_set(dev, 0x51, 0x0004);
         if (phy->radio_rev == 8) {
                 b43_radio_write16(dev, 0x43, 0x1F);
         } else {
                 b43_radio_write16(dev, 0x52, 0);
-                b43_radio_write16(dev, 0x43, (b43_radio_read16(dev, 0x43)
-                                              & 0xFFF0) | 0x0009);
+                b43_radio_maskset(dev, 0x43, 0xFFF0, 0x0009);
         }
         b43_phy_write(dev, B43_PHY_CCK(0x58), 0);
 
@@ -1610,8 +1497,7 @@ static void b43_phy_initb5(struct b43_wldev *dev)
         u8 old_channel;
 
         if (phy->analog == 1) {
-                b43_radio_write16(dev, 0x007A, b43_radio_read16(dev, 0x007A)
-                                  | 0x0050);
+                b43_radio_set(dev, 0x007A, 0x0050);
         }
         if ((bus->boardinfo.vendor != SSB_BOARDVENDOR_BCM) &&
             (bus->boardinfo.type != SSB_BOARD_BU4306)) {
@@ -1621,39 +1507,29 @@ static void b43_phy_initb5(struct b43_wldev *dev)
                         value += 0x202;
                 }
         }
-        b43_phy_write(dev, 0x0035, (b43_phy_read(dev, 0x0035) & 0xF0FF)
-                      | 0x0700);
+        b43_phy_maskset(dev, 0x0035, 0xF0FF, 0x0700);
         if (phy->radio_ver == 0x2050)
                 b43_phy_write(dev, 0x0038, 0x0667);
 
         if (phy->gmode || phy->rev >= 2) {
                 if (phy->radio_ver == 0x2050) {
-                        b43_radio_write16(dev, 0x007A,
-                                          b43_radio_read16(dev, 0x007A)
-                                          | 0x0020);
-                        b43_radio_write16(dev, 0x0051,
-                                          b43_radio_read16(dev, 0x0051)
-                                          | 0x0004);
+                        b43_radio_set(dev, 0x007A, 0x0020);
+                        b43_radio_set(dev, 0x0051, 0x0004);
                 }
                 b43_write16(dev, B43_MMIO_PHY_RADIO, 0x0000);
 
-                b43_phy_write(dev, 0x0802, b43_phy_read(dev, 0x0802) | 0x0100);
-                b43_phy_write(dev, 0x042B, b43_phy_read(dev, 0x042B) | 0x2000);
+                b43_phy_set(dev, 0x0802, 0x0100);
+                b43_phy_set(dev, 0x042B, 0x2000);
 
                 b43_phy_write(dev, 0x001C, 0x186A);
 
-                b43_phy_write(dev, 0x0013,
-                              (b43_phy_read(dev, 0x0013) & 0x00FF) | 0x1900);
-                b43_phy_write(dev, 0x0035,
-                              (b43_phy_read(dev, 0x0035) & 0xFFC0) | 0x0064);
-                b43_phy_write(dev, 0x005D,
-                              (b43_phy_read(dev, 0x005D) & 0xFF80) | 0x000A);
+                b43_phy_maskset(dev, 0x0013, 0x00FF, 0x1900);
+                b43_phy_maskset(dev, 0x0035, 0xFFC0, 0x0064);
+                b43_phy_maskset(dev, 0x005D, 0xFF80, 0x000A);
         }
 
         if (dev->bad_frames_preempt) {
-                b43_phy_write(dev, B43_PHY_RADIO_BITFIELD,
-                              b43_phy_read(dev,
-                                           B43_PHY_RADIO_BITFIELD) | (1 << 11));
+                b43_phy_set(dev, B43_PHY_RADIO_BITFIELD, (1 << 11));
         }
 
         if (phy->analog == 1) {
@@ -1695,7 +1571,7 @@ static void b43_phy_initb5(struct b43_wldev *dev)
         b43_radio_write16(dev, 0x005B, 0x007B);
         b43_radio_write16(dev, 0x005C, 0x00B0);
 
-        b43_radio_write16(dev, 0x007A, b43_radio_read16(dev, 0x007A) | 0x0007);
+        b43_radio_set(dev, 0x007A, 0x0007);
 
         b43_gphy_channel_switch(dev, old_channel, 0);
 
@@ -1771,12 +1647,10 @@ static void b43_phy_initb6(struct b43_wldev *dev)
                 val += 0x0202;
         }
         if (phy->type == B43_PHYTYPE_G) {
-                b43_radio_write16(dev, 0x007A,
-                                  b43_radio_read16(dev, 0x007A) | 0x0020);
-                b43_radio_write16(dev, 0x0051,
-                                  b43_radio_read16(dev, 0x0051) | 0x0004);
-                b43_phy_write(dev, 0x0802, b43_phy_read(dev, 0x0802) | 0x0100);
-                b43_phy_write(dev, 0x042B, b43_phy_read(dev, 0x042B) | 0x2000);
+                b43_radio_set(dev, 0x007A, 0x0020);
+                b43_radio_set(dev, 0x0051, 0x0004);
+                b43_phy_set(dev, 0x0802, 0x0100);
+                b43_phy_set(dev, 0x042B, 0x2000);
                 b43_phy_write(dev, 0x5B, 0);
                 b43_phy_write(dev, 0x5C, 0);
         }
@@ -1801,8 +1675,7 @@ static void b43_phy_initb6(struct b43_wldev *dev)
                 b43_radio_write16(dev, 0x5B, 0x7B);
                 b43_radio_write16(dev, 0x5C, 0xB0);
         }
-        b43_radio_write16(dev, 0x007A,
-                          (b43_radio_read16(dev, 0x007A) & 0x00F8) | 0x0007);
+        b43_radio_maskset(dev, 0x007A, 0x00F8, 0x0007);
 
         b43_gphy_channel_switch(dev, old_channel, 0);
 
@@ -1814,19 +1687,16 @@ static void b43_phy_initb6(struct b43_wldev *dev)
         b43_phy_write(dev, 0x0038, 0x0668);
         b43_set_txpower_g(dev, &gphy->bbatt, &gphy->rfatt, gphy->tx_control);
         if (phy->radio_rev <= 5) {
-                b43_phy_write(dev, 0x5D, (b43_phy_read(dev, 0x5D)
-                                          & 0xFF80) | 0x0003);
+                b43_phy_maskset(dev, 0x5D, 0xFF80, 0x0003);
         }
         if (phy->radio_rev <= 2)
                 b43_radio_write16(dev, 0x005D, 0x000D);
 
         if (phy->analog == 4) {
                 b43_write16(dev, 0x3E4, 9);
-                b43_phy_write(dev, 0x61, b43_phy_read(dev, 0x61)
-                              & 0x0FFF);
+                b43_phy_mask(dev, 0x61, 0x0FFF);
         } else {
-                b43_phy_write(dev, 0x0002, (b43_phy_read(dev, 0x0002) & 0xFFC0)
-                              | 0x0004);
+                b43_phy_maskset(dev, 0x0002, 0xFFC0, 0x0004);
         }
         if (phy->type == B43_PHYTYPE_B)
                 B43_WARN_ON(1);
@@ -1868,63 +1738,39 @@ static void b43_calc_loopback_gain(struct b43_wldev *dev)
         backup_radio[1] = b43_radio_read16(dev, 0x43);
         backup_radio[2] = b43_radio_read16(dev, 0x7A);
 
-        b43_phy_write(dev, B43_PHY_CRS0,
-                      b43_phy_read(dev, B43_PHY_CRS0) & 0x3FFF);
-        b43_phy_write(dev, B43_PHY_CCKBBANDCFG,
-                      b43_phy_read(dev, B43_PHY_CCKBBANDCFG) | 0x8000);
-        b43_phy_write(dev, B43_PHY_RFOVER,
-                      b43_phy_read(dev, B43_PHY_RFOVER) | 0x0002);
-        b43_phy_write(dev, B43_PHY_RFOVERVAL,
-                      b43_phy_read(dev, B43_PHY_RFOVERVAL) & 0xFFFD);
-        b43_phy_write(dev, B43_PHY_RFOVER,
-                      b43_phy_read(dev, B43_PHY_RFOVER) | 0x0001);
-        b43_phy_write(dev, B43_PHY_RFOVERVAL,
-                      b43_phy_read(dev, B43_PHY_RFOVERVAL) & 0xFFFE);
+        b43_phy_mask(dev, B43_PHY_CRS0, 0x3FFF);
+        b43_phy_set(dev, B43_PHY_CCKBBANDCFG, 0x8000);
+        b43_phy_set(dev, B43_PHY_RFOVER, 0x0002);
+        b43_phy_mask(dev, B43_PHY_RFOVERVAL, 0xFFFD);
+        b43_phy_set(dev, B43_PHY_RFOVER, 0x0001);
+        b43_phy_mask(dev, B43_PHY_RFOVERVAL, 0xFFFE);
         if (phy->rev != 1) {    /* Not in specs, but needed to prevent PPC machine check */
-                b43_phy_write(dev, B43_PHY_ANALOGOVER,
-                              b43_phy_read(dev, B43_PHY_ANALOGOVER) | 0x0001);
-                b43_phy_write(dev, B43_PHY_ANALOGOVERVAL,
-                              b43_phy_read(dev,
-                                           B43_PHY_ANALOGOVERVAL) & 0xFFFE);
-                b43_phy_write(dev, B43_PHY_ANALOGOVER,
-                              b43_phy_read(dev, B43_PHY_ANALOGOVER) | 0x0002);
-                b43_phy_write(dev, B43_PHY_ANALOGOVERVAL,
-                              b43_phy_read(dev,
-                                           B43_PHY_ANALOGOVERVAL) & 0xFFFD);
-        }
-        b43_phy_write(dev, B43_PHY_RFOVER,
-                      b43_phy_read(dev, B43_PHY_RFOVER) | 0x000C);
-        b43_phy_write(dev, B43_PHY_RFOVERVAL,
-                      b43_phy_read(dev, B43_PHY_RFOVERVAL) | 0x000C);
-        b43_phy_write(dev, B43_PHY_RFOVER,
-                      b43_phy_read(dev, B43_PHY_RFOVER) | 0x0030);
-        b43_phy_write(dev, B43_PHY_RFOVERVAL,
-                      (b43_phy_read(dev, B43_PHY_RFOVERVAL)
-                       & 0xFFCF) | 0x10);
+                b43_phy_set(dev, B43_PHY_ANALOGOVER, 0x0001);
+                b43_phy_mask(dev, B43_PHY_ANALOGOVERVAL, 0xFFFE);
+                b43_phy_set(dev, B43_PHY_ANALOGOVER, 0x0002);
+                b43_phy_mask(dev, B43_PHY_ANALOGOVERVAL, 0xFFFD);
+        }
+        b43_phy_set(dev, B43_PHY_RFOVER, 0x000C);
+        b43_phy_set(dev, B43_PHY_RFOVERVAL, 0x000C);
+        b43_phy_set(dev, B43_PHY_RFOVER, 0x0030);
+        b43_phy_maskset(dev, B43_PHY_RFOVERVAL, 0xFFCF, 0x10);
 
         b43_phy_write(dev, B43_PHY_CCK(0x5A), 0x0780);
         b43_phy_write(dev, B43_PHY_CCK(0x59), 0xC810);
         b43_phy_write(dev, B43_PHY_CCK(0x58), 0x000D);
 
-        b43_phy_write(dev, B43_PHY_CCK(0x0A),
-                      b43_phy_read(dev, B43_PHY_CCK(0x0A)) | 0x2000);
+        b43_phy_set(dev, B43_PHY_CCK(0x0A), 0x2000);
         if (phy->rev != 1) {    /* Not in specs, but needed to prevent PPC machine check */
-                b43_phy_write(dev, B43_PHY_ANALOGOVER,
-                              b43_phy_read(dev, B43_PHY_ANALOGOVER) | 0x0004);
-                b43_phy_write(dev, B43_PHY_ANALOGOVERVAL,
-                              b43_phy_read(dev,
-                                           B43_PHY_ANALOGOVERVAL) & 0xFFFB);
+                b43_phy_set(dev, B43_PHY_ANALOGOVER, 0x0004);
+                b43_phy_mask(dev, B43_PHY_ANALOGOVERVAL, 0xFFFB);
         }
-        b43_phy_write(dev, B43_PHY_CCK(0x03),
-                      (b43_phy_read(dev, B43_PHY_CCK(0x03))
-                       & 0xFF9F) | 0x40);
+        b43_phy_maskset(dev, B43_PHY_CCK(0x03), 0xFF9F, 0x40);
 
         if (phy->radio_rev == 8) {
                 b43_radio_write16(dev, 0x43, 0x000F);
         } else {
                 b43_radio_write16(dev, 0x52, 0);
-                b43_radio_write16(dev, 0x43, (b43_radio_read16(dev, 0x43)
-                                              & 0xFFF0) | 0x9);
+                b43_radio_maskset(dev, 0x43, 0xFFF0, 0x9);
         }
         b43_gphy_set_baseband_attenuation(dev, 11);
 
@@ -1934,45 +1780,28 @@ static void b43_calc_loopback_gain(struct b43_wldev *dev)
                 b43_phy_write(dev, B43_PHY_LO_MASK, 0x8020);
         b43_phy_write(dev, B43_PHY_LO_CTL, 0);
 
-        b43_phy_write(dev, B43_PHY_CCK(0x2B),
-                      (b43_phy_read(dev, B43_PHY_CCK(0x2B))
-                       & 0xFFC0) | 0x01);
-        b43_phy_write(dev, B43_PHY_CCK(0x2B),
-                      (b43_phy_read(dev, B43_PHY_CCK(0x2B))
-                       & 0xC0FF) | 0x800);
+        b43_phy_maskset(dev, B43_PHY_CCK(0x2B), 0xFFC0, 0x01);
+        b43_phy_maskset(dev, B43_PHY_CCK(0x2B), 0xC0FF, 0x800);
 
-        b43_phy_write(dev, B43_PHY_RFOVER,
-                      b43_phy_read(dev, B43_PHY_RFOVER) | 0x0100);
-        b43_phy_write(dev, B43_PHY_RFOVERVAL,
-                      b43_phy_read(dev, B43_PHY_RFOVERVAL) & 0xCFFF);
+        b43_phy_set(dev, B43_PHY_RFOVER, 0x0100);
+        b43_phy_mask(dev, B43_PHY_RFOVERVAL, 0xCFFF);
 
         if (dev->dev->bus->sprom.boardflags_lo & B43_BFL_EXTLNA) {
                 if (phy->rev >= 7) {
-                        b43_phy_write(dev, B43_PHY_RFOVER,
-                                      b43_phy_read(dev, B43_PHY_RFOVER)
-                                      | 0x0800);
-                        b43_phy_write(dev, B43_PHY_RFOVERVAL,
-                                      b43_phy_read(dev, B43_PHY_RFOVERVAL)
-                                      | 0x8000);
+                        b43_phy_set(dev, B43_PHY_RFOVER, 0x0800);
+                        b43_phy_set(dev, B43_PHY_RFOVERVAL, 0x8000);
                 }
         }
-        b43_radio_write16(dev, 0x7A, b43_radio_read16(dev, 0x7A)
-                          & 0x00F7);
+        b43_radio_mask(dev, 0x7A, 0x00F7);
 
         j = 0;
         loop_i_max = (phy->radio_rev == 8) ? 15 : 9;
         for (i = 0; i < loop_i_max; i++) {
                 for (j = 0; j < 16; j++) {
                         b43_radio_write16(dev, 0x43, i);
-                        b43_phy_write(dev, B43_PHY_RFOVERVAL,
-                                      (b43_phy_read(dev, B43_PHY_RFOVERVAL)
-                                       & 0xF0FF) | (j << 8));
-                        b43_phy_write(dev, B43_PHY_PGACTL,
-                                      (b43_phy_read(dev, B43_PHY_PGACTL)
-                                       & 0x0FFF) | 0xA000);
-                        b43_phy_write(dev, B43_PHY_PGACTL,
-                                      b43_phy_read(dev, B43_PHY_PGACTL)
-                                      | 0xF000);
+                        b43_phy_maskset(dev, B43_PHY_RFOVERVAL, 0xF0FF, (j << 8));
+                        b43_phy_maskset(dev, B43_PHY_PGACTL, 0x0FFF, 0xA000);
+                        b43_phy_set(dev, B43_PHY_PGACTL, 0xF000);
                         udelay(20);
                         if (b43_phy_read(dev, B43_PHY_LO_LEAKAGE) >= 0xDFC)
                                 goto exit_loop1;
@@ -1982,20 +1811,12 @@ static void b43_calc_loopback_gain(struct b43_wldev *dev)
         loop1_outer_done = i;
         loop1_inner_done = j;
         if (j >= 8) {
-                b43_phy_write(dev, B43_PHY_RFOVERVAL,
-                              b43_phy_read(dev, B43_PHY_RFOVERVAL)
-                              | 0x30);
+                b43_phy_set(dev, B43_PHY_RFOVERVAL, 0x30);
                 trsw_rx = 0x1B;
                 for (j = j - 8; j < 16; j++) {
-                        b43_phy_write(dev, B43_PHY_RFOVERVAL,
-                                      (b43_phy_read(dev, B43_PHY_RFOVERVAL)
-                                       & 0xF0FF) | (j << 8));
-                        b43_phy_write(dev, B43_PHY_PGACTL,
-                                      (b43_phy_read(dev, B43_PHY_PGACTL)
-                                       & 0x0FFF) | 0xA000);
-                        b43_phy_write(dev, B43_PHY_PGACTL,
-                                      b43_phy_read(dev, B43_PHY_PGACTL)
-                                      | 0xF000);
+                        b43_phy_maskset(dev, B43_PHY_RFOVERVAL, 0xF0FF, (j << 8));
+                        b43_phy_maskset(dev, B43_PHY_PGACTL, 0x0FFF, 0xA000);
+                        b43_phy_set(dev, B43_PHY_PGACTL, 0xF000);
                         udelay(20);
                         trsw_rx -= 3;
                         if (b43_phy_read(dev, B43_PHY_LO_LEAKAGE) >= 0xDFC)
@@ -2046,34 +1867,24 @@ static void b43_hardware_pctl_early_init(struct b43_wldev *dev)
                 return;
         }
 
-        b43_phy_write(dev, 0x0036, b43_phy_read(dev, 0x0036) & 0xFEFF);
+        b43_phy_mask(dev, 0x0036, 0xFEFF);
         b43_phy_write(dev, 0x002F, 0x0202);
-        b43_phy_write(dev, 0x047C, b43_phy_read(dev, 0x047C) | 0x0002);
-        b43_phy_write(dev, 0x047A, b43_phy_read(dev, 0x047A) | 0xF000);
+        b43_phy_set(dev, 0x047C, 0x0002);
+        b43_phy_set(dev, 0x047A, 0xF000);
         if (phy->radio_ver == 0x2050 && phy->radio_rev == 8) {
-                b43_phy_write(dev, 0x047A, (b43_phy_read(dev, 0x047A)
-                                            & 0xFF0F) | 0x0010);
-                b43_phy_write(dev, 0x005D, b43_phy_read(dev, 0x005D)
-                              | 0x8000);
-                b43_phy_write(dev, 0x004E, (b43_phy_read(dev, 0x004E)
-                                            & 0xFFC0) | 0x0010);
+                b43_phy_maskset(dev, 0x047A, 0xFF0F, 0x0010);
+                b43_phy_set(dev, 0x005D, 0x8000);
+                b43_phy_maskset(dev, 0x004E, 0xFFC0, 0x0010);
                 b43_phy_write(dev, 0x002E, 0xC07F);
-                b43_phy_write(dev, 0x0036, b43_phy_read(dev, 0x0036)
-                              | 0x0400);
+                b43_phy_set(dev, 0x0036, 0x0400);
         } else {
-                b43_phy_write(dev, 0x0036, b43_phy_read(dev, 0x0036)
-                              | 0x0200);
-                b43_phy_write(dev, 0x0036, b43_phy_read(dev, 0x0036)
-                              | 0x0400);
-                b43_phy_write(dev, 0x005D, b43_phy_read(dev, 0x005D)
-                              & 0x7FFF);
-                b43_phy_write(dev, 0x004F, b43_phy_read(dev, 0x004F)
-                              & 0xFFFE);
-                b43_phy_write(dev, 0x004E, (b43_phy_read(dev, 0x004E)
-                                            & 0xFFC0) | 0x0010);
+                b43_phy_set(dev, 0x0036, 0x0200);
+                b43_phy_set(dev, 0x0036, 0x0400);
+                b43_phy_mask(dev, 0x005D, 0x7FFF);
+                b43_phy_mask(dev, 0x004F, 0xFFFE);
+                b43_phy_maskset(dev, 0x004E, 0xFFC0, 0x0010);
                 b43_phy_write(dev, 0x002E, 0xC07F);
-                b43_phy_write(dev, 0x047A, (b43_phy_read(dev, 0x047A)
-                                            & 0xFF0F) | 0x0010);
+                b43_phy_maskset(dev, 0x047A, 0xFF0F, 0x0010);
         }
 }
 
@@ -2089,22 +1900,17 @@ static void b43_hardware_pctl_init_gphy(struct b43_wldev *dev)
                 return;
         }
 
-        b43_phy_write(dev, 0x0036, (b43_phy_read(dev, 0x0036) & 0xFFC0)
-                      | (gphy->tgt_idle_tssi - gphy->cur_idle_tssi));
-        b43_phy_write(dev, 0x0478, (b43_phy_read(dev, 0x0478) & 0xFF00)
-                      | (gphy->tgt_idle_tssi - gphy->cur_idle_tssi));
+        b43_phy_maskset(dev, 0x0036, 0xFFC0, (gphy->tgt_idle_tssi - gphy->cur_idle_tssi));
+        b43_phy_maskset(dev, 0x0478, 0xFF00, (gphy->tgt_idle_tssi - gphy->cur_idle_tssi));
         b43_gphy_tssi_power_lt_init(dev);
         b43_gphy_gain_lt_init(dev);
-        b43_phy_write(dev, 0x0060, b43_phy_read(dev, 0x0060) & 0xFFBF);
+        b43_phy_mask(dev, 0x0060, 0xFFBF);
         b43_phy_write(dev, 0x0014, 0x0000);
 
         B43_WARN_ON(phy->rev < 6);
-        b43_phy_write(dev, 0x0478, b43_phy_read(dev, 0x0478)
-                      | 0x0800);
-        b43_phy_write(dev, 0x0478, b43_phy_read(dev, 0x0478)
-                      & 0xFEFF);
-        b43_phy_write(dev, 0x0801, b43_phy_read(dev, 0x0801)
-                      & 0xFFBF);
+        b43_phy_set(dev, 0x0478, 0x0800);
+        b43_phy_mask(dev, 0x0478, 0xFEFF);
+        b43_phy_mask(dev, 0x0801, 0xFFBF);
 
         b43_gphy_dc_lt_init(dev, 1);
 
@@ -2139,9 +1945,7 @@ static void b43_phy_init_pctl(struct b43_wldev *dev)
         b43_hardware_pctl_early_init(dev);
         if (gphy->cur_idle_tssi == 0) {
                 if (phy->radio_ver == 0x2050 && phy->analog == 0) {
-                        b43_radio_write16(dev, 0x0076,
-                                          (b43_radio_read16(dev, 0x0076)
-                                           & 0x00F7) | 0x0084);
+                        b43_radio_maskset(dev, 0x0076, 0x00F7, 0x0084);
                 } else {
                         struct b43_rfatt rfatt;
                         struct b43_bbatt bbatt;
@@ -2174,9 +1978,7 @@ static void b43_phy_init_pctl(struct b43_wldev *dev)
                         }
                 }
                 if (phy->radio_ver == 0x2050 && phy->analog == 0) {
-                        b43_radio_write16(dev, 0x0076,
-                                          b43_radio_read16(dev, 0x0076)
-                                          & 0xFF7B);
+                        b43_radio_mask(dev, 0x0076, 0xFF7B);
                 } else {
                         b43_set_txpower_g(dev, &old_bbatt,
                                           &old_rfatt, old_tx_control);
@@ -2220,20 +2022,14 @@ static void b43_phy_initg(struct b43_wldev *dev)
                         b43_phy_write(dev, B43_PHY_OFDM(0xC3), 0x8006);
                 }
                 if (tmp == 5) {
-                        b43_phy_write(dev, B43_PHY_OFDM(0xCC),
-                                      (b43_phy_read(dev, B43_PHY_OFDM(0xCC))
-                                       & 0x00FF) | 0x1F00);
+                        b43_phy_maskset(dev, B43_PHY_OFDM(0xCC), 0x00FF, 0x1F00);
                 }
         }
         if ((phy->rev <= 2 && phy->gmode) || phy->rev >= 2)
                 b43_phy_write(dev, B43_PHY_OFDM(0x7E), 0x78);
         if (phy->radio_rev == 8) {
-                b43_phy_write(dev, B43_PHY_EXTG(0x01),
-                              b43_phy_read(dev, B43_PHY_EXTG(0x01))
-                              | 0x80);
-                b43_phy_write(dev, B43_PHY_OFDM(0x3E),
-                              b43_phy_read(dev, B43_PHY_OFDM(0x3E))
-                              | 0x4);
+                b43_phy_set(dev, B43_PHY_EXTG(0x01), 0x80);
+                b43_phy_set(dev, B43_PHY_OFDM(0x3E), 0x4);
         }
         if (has_loopback_gain(phy))
                 b43_calc_loopback_gain(dev);
@@ -2251,15 +2047,10 @@ static void b43_phy_initg(struct b43_wldev *dev)
                                   | gphy->lo_control->tx_bias | gphy->
                                   lo_control->tx_magn);
         } else {
-                b43_radio_write16(dev, 0x52,
-                                  (b43_radio_read16(dev, 0x52) & 0xFFF0)
-                                  | gphy->lo_control->tx_bias);
+                b43_radio_maskset(dev, 0x52, 0xFFF0, gphy->lo_control->tx_bias);
         }
         if (phy->rev >= 6) {
-                b43_phy_write(dev, B43_PHY_CCK(0x36),
-                              (b43_phy_read(dev, B43_PHY_CCK(0x36))
-                               & 0x0FFF) | (gphy->lo_control->
-                                            tx_bias << 12));
+                b43_phy_maskset(dev, B43_PHY_CCK(0x36), 0x0FFF, (gphy->lo_control->tx_bias << 12));
         }
         if (dev->dev->bus->sprom.boardflags_lo & B43_BFL_PACTRL)
                 b43_phy_write(dev, B43_PHY_CCK(0x2E), 0x8075);
@@ -2298,11 +2089,8 @@ static void b43_phy_initg(struct b43_wldev *dev)
            but OFDM is legal everywhere */
         if ((dev->dev->bus->chip_id == 0x4306
              && dev->dev->bus->chip_package == 2) || 0) {
-                b43_phy_write(dev, B43_PHY_CRS0, b43_phy_read(dev, B43_PHY_CRS0)
-                              & 0xBFFF);
-                b43_phy_write(dev, B43_PHY_OFDM(0xC3),
-                              b43_phy_read(dev, B43_PHY_OFDM(0xC3))
-                              & 0x7FFF);
+                b43_phy_mask(dev, B43_PHY_CRS0, 0xBFFF);
+                b43_phy_mask(dev, B43_PHY_OFDM(0xC3), 0x7FFF);
         }
 }
 
@@ -2504,9 +2292,8 @@ static u8 b43_gphy_aci_scan(struct b43_wldev *dev)
 
         b43_phy_lock(dev);
         b43_radio_lock(dev);
-        b43_phy_write(dev, 0x0802, b43_phy_read(dev, 0x0802) & 0xFFFC);
-        b43_phy_write(dev, B43_PHY_G_CRS,
-                      b43_phy_read(dev, B43_PHY_G_CRS) & 0x7FFF);
+        b43_phy_mask(dev, 0x0802, 0xFFFC);
+        b43_phy_mask(dev, B43_PHY_G_CRS, 0x7FFF);
         b43_set_all_gains(dev, 3, 8, 1);
 
         start = (channel - 5 > 0) ? channel - 5 : 1;
@@ -2517,11 +2304,9 @@ static u8 b43_gphy_aci_scan(struct b43_wldev *dev)
                         ret[i - 1] = b43_gphy_aci_detect(dev, i);
         }
         b43_switch_channel(dev, channel);
-        b43_phy_write(dev, 0x0802,
-                      (b43_phy_read(dev, 0x0802) & 0xFFFC) | 0x0003);
-        b43_phy_write(dev, 0x0403, b43_phy_read(dev, 0x0403) & 0xFFF8);
-        b43_phy_write(dev, B43_PHY_G_CRS,
-                      b43_phy_read(dev, B43_PHY_G_CRS) | 0x8000);
+        b43_phy_maskset(dev, 0x0802, 0xFFFC, 0x0003);
+        b43_phy_mask(dev, 0x0403, 0xFFF8);
+        b43_phy_set(dev, B43_PHY_G_CRS, 0x8000);
         b43_set_original_gains(dev);
         for (i = 0; i < 13; i++) {
                 if (!ret[i])
@@ -2565,8 +2350,8 @@ static s8 b43_tssi2dbm_entry(s8 entry[], u8 index,
         return 0;
 }
 
-u8 * b43_generate_dyn_tssi2dbm_tab(struct b43_wldev *dev,
-                                   s16 pab0, s16 pab1, s16 pab2)
+u8 *b43_generate_dyn_tssi2dbm_tab(struct b43_wldev *dev,
+                                  s16 pab0, s16 pab1, s16 pab2)
 {
         unsigned int i;
         u8 *tab;
diff --git a/drivers/net/wireless/b43/pio.c b/drivers/net/wireless/b43/pio.c
index 1036bef8c4cc..8cd9776752e6 100644
--- a/drivers/net/wireless/b43/pio.c
+++ b/drivers/net/wireless/b43/pio.c
@@ -55,8 +55,8 @@ static u16 generate_cookie(struct b43_pio_txqueue *q,
 }
 
 static
-struct b43_pio_txqueue * parse_cookie(struct b43_wldev *dev,
-                                      u16 cookie,
+struct b43_pio_txqueue *parse_cookie(struct b43_wldev *dev,
+                                     u16 cookie,
                                       struct b43_pio_txpacket **pack)
 {
         struct b43_pio *pio = &dev->pio;
@@ -134,8 +134,8 @@ static u16 pio_rxqueue_offset(struct b43_wldev *dev)
         return 8;
 }
 
-static struct b43_pio_txqueue * b43_setup_pioqueue_tx(struct b43_wldev *dev,
-                                                      unsigned int index)
+static struct b43_pio_txqueue *b43_setup_pioqueue_tx(struct b43_wldev *dev,
+                                                     unsigned int index)
 {
         struct b43_pio_txqueue *q;
         struct b43_pio_txpacket *p;
@@ -171,8 +171,8 @@ static struct b43_pio_txqueue * b43_setup_pioqueue_tx(struct b43_wldev *dev,
         return q;
 }
 
-static struct b43_pio_rxqueue * b43_setup_pioqueue_rx(struct b43_wldev *dev,
-                                                      unsigned int index)
+static struct b43_pio_rxqueue *b43_setup_pioqueue_rx(struct b43_wldev *dev,
+                                                     unsigned int index)
 {
         struct b43_pio_rxqueue *q;
 
@@ -308,8 +308,8 @@ err_destroy_bk:
 }
 
 /* Static mapping of mac80211's queues (priorities) to b43 PIO queues. */
-static struct b43_pio_txqueue * select_queue_by_priority(struct b43_wldev *dev,
-                                                         u8 queue_prio)
+static struct b43_pio_txqueue *select_queue_by_priority(struct b43_wldev *dev,
+                                                        u8 queue_prio)
 {
         struct b43_pio_txqueue *q;
 
diff --git a/drivers/net/wireless/b43/rfkill.c b/drivers/net/wireless/b43/rfkill.c
index 713753781f40..afad42358693 100644
--- a/drivers/net/wireless/b43/rfkill.c
+++ b/drivers/net/wireless/b43/rfkill.c
@@ -113,7 +113,7 @@ out_unlock:
         return err;
 }
 
-char * b43_rfkill_led_name(struct b43_wldev *dev)
+char *b43_rfkill_led_name(struct b43_wldev *dev)
 {
         struct b43_rfkill *rfk = &(dev->wl->rfkill);
 
diff --git a/drivers/net/wireless/b43/wa.c b/drivers/net/wireless/b43/wa.c
index 0c0fb15abb9f..e1e20f69f6d7 100644
--- a/drivers/net/wireless/b43/wa.c
+++ b/drivers/net/wireless/b43/wa.c
@@ -62,8 +62,7 @@ void b43_wa_initgains(struct b43_wldev *dev)
         struct b43_phy *phy = &dev->phy;
 
         b43_phy_write(dev, B43_PHY_LNAHPFCTL, 0x1FF9);
-        b43_phy_write(dev, B43_PHY_LPFGAINCTL,
-                b43_phy_read(dev, B43_PHY_LPFGAINCTL) & 0xFF0F);
+        b43_phy_mask(dev, B43_PHY_LPFGAINCTL, 0xFF0F);
         if (phy->rev <= 2)
                 b43_ofdmtab_write16(dev, B43_OFDMTAB_LPFGAIN, 0, 0x1FBF);
         b43_radio_write16(dev, 0x0002, 0x1FBF);
@@ -73,11 +72,9 @@ void b43_wa_initgains(struct b43_wldev *dev)
         b43_phy_write(dev, 0x001D, 0x0F40);
         b43_phy_write(dev, 0x001F, 0x1C00);
         if (phy->rev <= 3)
-                b43_phy_write(dev, 0x002A,
-                        (b43_phy_read(dev, 0x002A) & 0x00FF) | 0x0400);
+                b43_phy_maskset(dev, 0x002A, 0x00FF, 0x0400);
         else if (phy->rev == 5) {
-                b43_phy_write(dev, 0x002A,
-                        (b43_phy_read(dev, 0x002A) & 0x00FF) | 0x1A00);
+                b43_phy_maskset(dev, 0x002A, 0x00FF, 0x1A00);
                 b43_phy_write(dev, 0x00CC, 0x2121);
         }
         if (phy->rev >= 3)
@@ -86,7 +83,7 @@ void b43_wa_initgains(struct b43_wldev *dev)
 
 static void b43_wa_divider(struct b43_wldev *dev)
 {
-        b43_phy_write(dev, 0x002B, b43_phy_read(dev, 0x002B) & ~0x0100);
+        b43_phy_mask(dev, 0x002B, ~0x0100);
         b43_phy_write(dev, 0x008E, 0x58C1);
 }
 
@@ -272,8 +269,7 @@ static void b43_wa_2060txlna_gain(struct b43_wldev *dev)
 
 static void b43_wa_lms(struct b43_wldev *dev)
 {
-        b43_phy_write(dev, 0x0055,
-                (b43_phy_read(dev, 0x0055) & 0xFFC0) | 0x0004);
+        b43_phy_maskset(dev, 0x0055, 0xFFC0, 0x0004);
 }
 
 static void b43_wa_mixedsignal(struct b43_wldev *dev)
@@ -318,23 +314,18 @@ static void b43_wa_crs_ed(struct b43_wldev *dev)
         } else if (phy->rev == 2) {
                 b43_phy_write(dev, B43_PHY_CRSTHRES1, 0x1861);
                 b43_phy_write(dev, B43_PHY_CRSTHRES2, 0x0271);
-                b43_phy_write(dev, B43_PHY_ANTDWELL,
-                                  b43_phy_read(dev, B43_PHY_ANTDWELL)
-                                  | 0x0800);
+                b43_phy_set(dev, B43_PHY_ANTDWELL, 0x0800);
         } else {
                 b43_phy_write(dev, B43_PHY_CRSTHRES1, 0x0098);
                 b43_phy_write(dev, B43_PHY_CRSTHRES2, 0x0070);
                 b43_phy_write(dev, B43_PHY_OFDM(0xC9), 0x0080);
-                b43_phy_write(dev, B43_PHY_ANTDWELL,
-                                  b43_phy_read(dev, B43_PHY_ANTDWELL)
-                                  | 0x0800);
+                b43_phy_set(dev, B43_PHY_ANTDWELL, 0x0800);
         }
 }
 
 static void b43_wa_crs_thr(struct b43_wldev *dev)
 {
-        b43_phy_write(dev, B43_PHY_CRS0,
-                        (b43_phy_read(dev, B43_PHY_CRS0) & ~0x03C0) | 0xD000);
+        b43_phy_maskset(dev, B43_PHY_CRS0, ~0x03C0, 0xD000);
 }
 
 static void b43_wa_crs_blank(struct b43_wldev *dev)
@@ -391,72 +382,45 @@ static void b43_wa_altagc(struct b43_wldev *dev)
                 b43_ofdmtab_write16(dev, B43_OFDMTAB_AGC1, 3, 25);
         }
 
-        b43_phy_write(dev, B43_PHY_CCKSHIFTBITS_WA,
-                (b43_phy_read(dev, B43_PHY_CCKSHIFTBITS_WA) & ~0xFF00) | 0x5700);
-        b43_phy_write(dev, B43_PHY_OFDM(0x1A),
-                (b43_phy_read(dev, B43_PHY_OFDM(0x1A)) & ~0x007F) | 0x000F);
-        b43_phy_write(dev, B43_PHY_OFDM(0x1A),
-                (b43_phy_read(dev, B43_PHY_OFDM(0x1A)) & ~0x3F80) | 0x2B80);
-        b43_phy_write(dev, B43_PHY_ANTWRSETT,
-                (b43_phy_read(dev, B43_PHY_ANTWRSETT) & 0xF0FF) | 0x0300);
-        b43_radio_write16(dev, 0x7A,
-                b43_radio_read16(dev, 0x7A) | 0x0008);
-        b43_phy_write(dev, B43_PHY_N1P1GAIN,
-                (b43_phy_read(dev, B43_PHY_N1P1GAIN) & ~0x000F) | 0x0008);
-        b43_phy_write(dev, B43_PHY_P1P2GAIN,
-                (b43_phy_read(dev, B43_PHY_P1P2GAIN) & ~0x0F00) | 0x0600);
-        b43_phy_write(dev, B43_PHY_N1N2GAIN,
-                (b43_phy_read(dev, B43_PHY_N1N2GAIN) & ~0x0F00) | 0x0700);
-        b43_phy_write(dev, B43_PHY_N1P1GAIN,
-                (b43_phy_read(dev, B43_PHY_N1P1GAIN) & ~0x0F00) | 0x0100);
+        b43_phy_maskset(dev, B43_PHY_CCKSHIFTBITS_WA, (u16)~0xFF00, 0x5700);
+        b43_phy_maskset(dev, B43_PHY_OFDM(0x1A), ~0x007F, 0x000F);
+        b43_phy_maskset(dev, B43_PHY_OFDM(0x1A), ~0x3F80, 0x2B80);
+        b43_phy_maskset(dev, B43_PHY_ANTWRSETT, 0xF0FF, 0x0300);
+        b43_radio_set(dev, 0x7A, 0x0008);
+        b43_phy_maskset(dev, B43_PHY_N1P1GAIN, ~0x000F, 0x0008);
+        b43_phy_maskset(dev, B43_PHY_P1P2GAIN, ~0x0F00, 0x0600);
+        b43_phy_maskset(dev, B43_PHY_N1N2GAIN, ~0x0F00, 0x0700);
+        b43_phy_maskset(dev, B43_PHY_N1P1GAIN, ~0x0F00, 0x0100);
         if (phy->rev == 1) {
-                b43_phy_write(dev, B43_PHY_N1N2GAIN,
-                                  (b43_phy_read(dev, B43_PHY_N1N2GAIN)
-                                   & ~0x000F) | 0x0007);
+                b43_phy_maskset(dev, B43_PHY_N1N2GAIN, ~0x000F, 0x0007);
         }
-        b43_phy_write(dev, B43_PHY_OFDM(0x88),
-                (b43_phy_read(dev, B43_PHY_OFDM(0x88)) & ~0x00FF) | 0x001C);
-        b43_phy_write(dev, B43_PHY_OFDM(0x88),
-                (b43_phy_read(dev, B43_PHY_OFDM(0x88)) & ~0x3F00) | 0x0200);
-        b43_phy_write(dev, B43_PHY_OFDM(0x96),
-                (b43_phy_read(dev, B43_PHY_OFDM(0x96)) & ~0x00FF) | 0x001C);
-        b43_phy_write(dev, B43_PHY_OFDM(0x89),
-                (b43_phy_read(dev, B43_PHY_OFDM(0x89)) & ~0x00FF) | 0x0020);
-        b43_phy_write(dev, B43_PHY_OFDM(0x89),
-                (b43_phy_read(dev, B43_PHY_OFDM(0x89)) & ~0x3F00) | 0x0200);
-        b43_phy_write(dev, B43_PHY_OFDM(0x82),
-                (b43_phy_read(dev, B43_PHY_OFDM(0x82)) & ~0x00FF) | 0x002E);
-        b43_phy_write(dev, B43_PHY_OFDM(0x96),
-                (b43_phy_read(dev, B43_PHY_OFDM(0x96)) & ~0xFF00) | 0x1A00);
-        b43_phy_write(dev, B43_PHY_OFDM(0x81),
-                (b43_phy_read(dev, B43_PHY_OFDM(0x81)) & ~0x00FF) | 0x0028);
-        b43_phy_write(dev, B43_PHY_OFDM(0x81),
-                (b43_phy_read(dev, B43_PHY_OFDM(0x81)) & ~0xFF00) | 0x2C00);
+        b43_phy_maskset(dev, B43_PHY_OFDM(0x88), ~0x00FF, 0x001C);
+        b43_phy_maskset(dev, B43_PHY_OFDM(0x88), ~0x3F00, 0x0200);
+        b43_phy_maskset(dev, B43_PHY_OFDM(0x96), ~0x00FF, 0x001C);
+        b43_phy_maskset(dev, B43_PHY_OFDM(0x89), ~0x00FF, 0x0020);
+        b43_phy_maskset(dev, B43_PHY_OFDM(0x89), ~0x3F00, 0x0200);
+        b43_phy_maskset(dev, B43_PHY_OFDM(0x82), ~0x00FF, 0x002E);
+        b43_phy_maskset(dev, B43_PHY_OFDM(0x96), (u16)~0xFF00, 0x1A00);
+        b43_phy_maskset(dev, B43_PHY_OFDM(0x81), ~0x00FF, 0x0028);
+        b43_phy_maskset(dev, B43_PHY_OFDM(0x81), (u16)~0xFF00, 0x2C00);
         if (phy->rev == 1) {
                 b43_phy_write(dev, B43_PHY_PEAK_COUNT, 0x092B);
-                b43_phy_write(dev, B43_PHY_OFDM(0x1B),
-                        (b43_phy_read(dev, B43_PHY_OFDM(0x1B)) & ~0x001E) | 0x0002);
+                b43_phy_maskset(dev, B43_PHY_OFDM(0x1B), ~0x001E, 0x0002);
         } else {
-                b43_phy_write(dev, B43_PHY_OFDM(0x1B),
-                        b43_phy_read(dev, B43_PHY_OFDM(0x1B)) & ~0x001E);
+                b43_phy_mask(dev, B43_PHY_OFDM(0x1B), ~0x001E);
                 b43_phy_write(dev, B43_PHY_OFDM(0x1F), 0x287A);
-                b43_phy_write(dev, B43_PHY_LPFGAINCTL,
-                        (b43_phy_read(dev, B43_PHY_LPFGAINCTL) & ~0x000F) | 0x0004);
+                b43_phy_maskset(dev, B43_PHY_LPFGAINCTL, ~0x000F, 0x0004);
                 if (phy->rev >= 6) {
                         b43_phy_write(dev, B43_PHY_OFDM(0x22), 0x287A);
-                        b43_phy_write(dev, B43_PHY_LPFGAINCTL,
-                                (b43_phy_read(dev, B43_PHY_LPFGAINCTL) & ~0xF000) | 0x3000);
+                        b43_phy_maskset(dev, B43_PHY_LPFGAINCTL, (u16)~0xF000, 0x3000);
                 }
         }
-        b43_phy_write(dev, B43_PHY_DIVSRCHIDX,
-                (b43_phy_read(dev, B43_PHY_DIVSRCHIDX) & 0x8080) | 0x7874);
+        b43_phy_maskset(dev, B43_PHY_DIVSRCHIDX, 0x8080, 0x7874);
         b43_phy_write(dev, B43_PHY_OFDM(0x8E), 0x1C00);
         if (phy->rev == 1) {
-                b43_phy_write(dev, B43_PHY_DIVP1P2GAIN,
-                        (b43_phy_read(dev, B43_PHY_DIVP1P2GAIN) & ~0x0F00) | 0x0600);
+                b43_phy_maskset(dev, B43_PHY_DIVP1P2GAIN, ~0x0F00, 0x0600);
                 b43_phy_write(dev, B43_PHY_OFDM(0x8B), 0x005E);
-                b43_phy_write(dev, B43_PHY_ANTWRSETT,
-                        (b43_phy_read(dev, B43_PHY_ANTWRSETT) & ~0x00FF) | 0x001E);
+                b43_phy_maskset(dev, B43_PHY_ANTWRSETT, ~0x00FF, 0x001E);
                 b43_phy_write(dev, B43_PHY_OFDM(0x8D), 0x0002);
                 b43_ofdmtab_write16(dev, B43_OFDMTAB_AGC3_R1, 0, 0);
                 b43_ofdmtab_write16(dev, B43_OFDMTAB_AGC3_R1, 1, 7);
@@ -469,10 +433,8 @@ static void b43_wa_altagc(struct b43_wldev *dev)
                 b43_ofdmtab_write16(dev, B43_OFDMTAB_AGC3, 3, 28);
         }
         if (phy->rev >= 6) {
-                b43_phy_write(dev, B43_PHY_OFDM(0x26),
-                        b43_phy_read(dev, B43_PHY_OFDM(0x26)) & ~0x0003);
-                b43_phy_write(dev, B43_PHY_OFDM(0x26),
-                        b43_phy_read(dev, B43_PHY_OFDM(0x26)) & ~0x1000);
+                b43_phy_mask(dev, B43_PHY_OFDM(0x26), ~0x0003);
+                b43_phy_mask(dev, B43_PHY_OFDM(0x26), ~0x1000);
         }
         b43_phy_read(dev, B43_PHY_VERSION_OFDM); /* Dummy read */
 }
@@ -538,8 +500,7 @@ static void b43_wa_boards_g(struct b43_wldev *dev)
                         b43_ofdmtab_write16(dev, B43_OFDMTAB_GAINX, 2, 0x0001);
                         if ((bus->sprom.boardflags_lo & B43_BFL_EXTLNA) &&
                             (phy->rev >= 7)) {
-                                b43_phy_write(dev, B43_PHY_EXTG(0x11),
-                                        b43_phy_read(dev, B43_PHY_EXTG(0x11)) & 0xF7FF);
+                                b43_phy_mask(dev, B43_PHY_EXTG(0x11), 0xF7FF);
                                 b43_ofdmtab_write16(dev, B43_OFDMTAB_GAINX, 0x0020, 0x0001);
                                 b43_ofdmtab_write16(dev, B43_OFDMTAB_GAINX, 0x0021, 0x0001);
                                 b43_ofdmtab_write16(dev, B43_OFDMTAB_GAINX, 0x0022, 0x0001);
diff --git a/drivers/net/wireless/hostap/hostap.h b/drivers/net/wireless/hostap/hostap.h
index 2453deaa3e00..ce8721fbc10e 100644
--- a/drivers/net/wireless/hostap/hostap.h
+++ b/drivers/net/wireless/hostap/hostap.h
@@ -31,7 +31,7 @@ void hostap_dump_rx_header(const char *name,
 void hostap_dump_tx_header(const char *name,
                            const struct hfa384x_tx_frame *tx);
 extern const struct header_ops hostap_80211_ops;
-int hostap_80211_get_hdrlen(u16 fc);
+int hostap_80211_get_hdrlen(__le16 fc);
 struct net_device_stats *hostap_get_stats(struct net_device *dev);
 void hostap_setup_dev(struct net_device *dev, local_info_t *local,
                       int type);
diff --git a/drivers/net/wireless/hostap/hostap_80211.h b/drivers/net/wireless/hostap/hostap_80211.h
index 3a9474d9a907..2e9fb0f383fc 100644
--- a/drivers/net/wireless/hostap/hostap_80211.h
+++ b/drivers/net/wireless/hostap/hostap_80211.h
@@ -2,7 +2,7 @@
 #define HOSTAP_80211_H
 
 #include <linux/types.h>
-#include <net/ieee80211.h>
+#include <linux/skbuff.h>
 
 struct hostap_ieee80211_mgmt {
         __le16 frame_control;
diff --git a/drivers/net/wireless/hostap/hostap_80211_rx.c b/drivers/net/wireless/hostap/hostap_80211_rx.c
index 241756318da4..7ba318e84dec 100644
--- a/drivers/net/wireless/hostap/hostap_80211_rx.c
+++ b/drivers/net/wireless/hostap/hostap_80211_rx.c
@@ -1,5 +1,6 @@
 #include <linux/etherdevice.h>
 #include <net/lib80211.h>
+#include <linux/if_arp.h>
 
 #include "hostap_80211.h"
 #include "hostap.h"
@@ -17,10 +18,10 @@ static unsigned char bridge_tunnel_header[] =
 void hostap_dump_rx_80211(const char *name, struct sk_buff *skb,
                           struct hostap_80211_rx_status *rx_stats)
 {
-        struct ieee80211_hdr_4addr *hdr;
+        struct ieee80211_hdr *hdr;
         u16 fc;
 
-        hdr = (struct ieee80211_hdr_4addr *) skb->data;
+        hdr = (struct ieee80211_hdr *) skb->data;
 
         printk(KERN_DEBUG "%s: RX signal=%d noise=%d rate=%d len=%d "
                "jiffies=%ld\n",
@@ -30,9 +31,10 @@ void hostap_dump_rx_80211(const char *name, struct sk_buff *skb,
         if (skb->len < 2)
                 return;
 
-        fc = le16_to_cpu(hdr->frame_ctl);
+        fc = le16_to_cpu(hdr->frame_control);
         printk(KERN_DEBUG "   FC=0x%04x (type=%d:%d)%s%s",
-               fc, WLAN_FC_GET_TYPE(fc) >> 2, WLAN_FC_GET_STYPE(fc) >> 4,
+               fc, (fc & IEEE80211_FCTL_FTYPE) >> 2,
+               (fc & IEEE80211_FCTL_STYPE) >> 4,
                fc & IEEE80211_FCTL_TODS ? " [ToDS]" : "",
                fc & IEEE80211_FCTL_FROMDS ? " [FromDS]" : "");
 
@@ -42,7 +44,7 @@ void hostap_dump_rx_80211(const char *name, struct sk_buff *skb,
         }
 
         printk(" dur=0x%04x seq=0x%04x\n", le16_to_cpu(hdr->duration_id),
-               le16_to_cpu(hdr->seq_ctl));
+               le16_to_cpu(hdr->seq_ctrl));
 
         printk(KERN_DEBUG "   A1=%pM", hdr->addr1);
         printk(" A2=%pM", hdr->addr2);
@@ -63,7 +65,7 @@ int prism2_rx_80211(struct net_device *dev, struct sk_buff *skb,
         int hdrlen, phdrlen, head_need, tail_need;
         u16 fc;
         int prism_header, ret;
-        struct ieee80211_hdr_4addr *fhdr;
+        struct ieee80211_hdr *fhdr;
 
         iface = netdev_priv(dev);
         local = iface->local;
@@ -84,8 +86,8 @@ int prism2_rx_80211(struct net_device *dev, struct sk_buff *skb,
                 phdrlen = 0;
         }
 
-        fhdr = (struct ieee80211_hdr_4addr *) skb->data;
-        fc = le16_to_cpu(fhdr->frame_ctl);
+        fhdr = (struct ieee80211_hdr *) skb->data;
+        fc = le16_to_cpu(fhdr->frame_control);
 
         if (type == PRISM2_RX_MGMT && (fc & IEEE80211_FCTL_VERS)) {
                 printk(KERN_DEBUG "%s: dropped management frame with header "
@@ -94,7 +96,7 @@ int prism2_rx_80211(struct net_device *dev, struct sk_buff *skb,
                 return 0;
         }
 
-        hdrlen = hostap_80211_get_hdrlen(fc);
+        hdrlen = hostap_80211_get_hdrlen(fhdr->frame_control);
 
         /* check if there is enough room for extra data; if not, expand skb
          * buffer to be large enough for the changes */
@@ -247,21 +249,21 @@ prism2_frag_cache_find(local_info_t *local, unsigned int seq,
 
 /* Called only as a tasklet (software IRQ) */
 static struct sk_buff *
-prism2_frag_cache_get(local_info_t *local, struct ieee80211_hdr_4addr *hdr)
+prism2_frag_cache_get(local_info_t *local, struct ieee80211_hdr *hdr)
 {
         struct sk_buff *skb = NULL;
         u16 sc;
         unsigned int frag, seq;
         struct prism2_frag_entry *entry;
 
-        sc = le16_to_cpu(hdr->seq_ctl);
-        frag = WLAN_GET_SEQ_FRAG(sc);
-        seq = WLAN_GET_SEQ_SEQ(sc) >> 4;
+        sc = le16_to_cpu(hdr->seq_ctrl);
+        frag = sc & IEEE80211_SCTL_FRAG;
+        seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
 
         if (frag == 0) {
                 /* Reserve enough space to fit maximum frame length */
                 skb = dev_alloc_skb(local->dev->mtu +
-                                    sizeof(struct ieee80211_hdr_4addr) +
+                                    sizeof(struct ieee80211_hdr) +
                                     8 /* LLC */ +
                                     2 /* alignment */ +
                                     8 /* WEP */ + ETH_ALEN /* WDS */);
@@ -299,14 +301,14 @@ prism2_frag_cache_get(local_info_t *local, struct ieee80211_hdr_4addr *hdr)
 
 /* Called only as a tasklet (software IRQ) */
 static int prism2_frag_cache_invalidate(local_info_t *local,
-                                        struct ieee80211_hdr_4addr *hdr)
+                                        struct ieee80211_hdr *hdr)
 {
         u16 sc;
         unsigned int seq;
         struct prism2_frag_entry *entry;
 
-        sc = le16_to_cpu(hdr->seq_ctl);
-        seq = WLAN_GET_SEQ_SEQ(sc) >> 4;
+        sc = le16_to_cpu(hdr->seq_ctrl);
+        seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
 
         entry = prism2_frag_cache_find(local, seq, -1, hdr->addr2, hdr->addr1);
 
@@ -472,10 +474,8 @@ hostap_rx_frame_mgmt(local_info_t *local, struct sk_buff *skb,
                      struct hostap_80211_rx_status *rx_stats, u16 type,
                      u16 stype)
 {
-        if (local->iw_mode == IW_MODE_MASTER) {
-                hostap_update_sta_ps(local, (struct ieee80211_hdr_4addr *)
-                                     skb->data);
-        }
+        if (local->iw_mode == IW_MODE_MASTER)
+                hostap_update_sta_ps(local, (struct ieee80211_hdr *) skb->data);
 
         if (local->hostapd && type == IEEE80211_FTYPE_MGMT) {
                 if (stype == IEEE80211_STYPE_BEACON &&
@@ -552,8 +552,8 @@ static struct net_device *prism2_rx_get_wds(local_info_t *local,
 
 
 static int
-hostap_rx_frame_wds(local_info_t *local, struct ieee80211_hdr_4addr *hdr,
-                    u16 fc, struct net_device **wds)
+hostap_rx_frame_wds(local_info_t *local, struct ieee80211_hdr *hdr, u16 fc,
+                    struct net_device **wds)
 {
         /* FIX: is this really supposed to accept WDS frames only in Master
          * mode? What about Repeater or Managed with WDS frames? */
@@ -611,14 +611,14 @@ static int hostap_is_eapol_frame(local_info_t *local, struct sk_buff *skb)
 {
         struct net_device *dev = local->dev;
         u16 fc, ethertype;
-        struct ieee80211_hdr_4addr *hdr;
+        struct ieee80211_hdr *hdr;
         u8 *pos;
 
         if (skb->len < 24)
                 return 0;
 
-        hdr = (struct ieee80211_hdr_4addr *) skb->data;
-        fc = le16_to_cpu(hdr->frame_ctl);
+        hdr = (struct ieee80211_hdr *) skb->data;
+        fc = le16_to_cpu(hdr->frame_control);
 
         /* check that the frame is unicast frame to us */
         if ((fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) ==
@@ -651,14 +651,14 @@ static int
 hostap_rx_frame_decrypt(local_info_t *local, struct sk_buff *skb,
                         struct lib80211_crypt_data *crypt)
 {
-        struct ieee80211_hdr_4addr *hdr;
+        struct ieee80211_hdr *hdr;
         int res, hdrlen;
 
         if (crypt == NULL || crypt->ops->decrypt_mpdu == NULL)
                 return 0;
 
-        hdr = (struct ieee80211_hdr_4addr *) skb->data;
-        hdrlen = hostap_80211_get_hdrlen(le16_to_cpu(hdr->frame_ctl));
+        hdr = (struct ieee80211_hdr *) skb->data;
+        hdrlen = hostap_80211_get_hdrlen(hdr->frame_control);
 
         if (local->tkip_countermeasures &&
             strcmp(crypt->ops->name, "TKIP") == 0) {
@@ -689,14 +689,14 @@ static int
 hostap_rx_frame_decrypt_msdu(local_info_t *local, struct sk_buff *skb,
                              int keyidx, struct lib80211_crypt_data *crypt)
 {
-        struct ieee80211_hdr_4addr *hdr;
+        struct ieee80211_hdr *hdr;
         int res, hdrlen;
 
         if (crypt == NULL || crypt->ops->decrypt_msdu == NULL)
                 return 0;
 
-        hdr = (struct ieee80211_hdr_4addr *) skb->data;
-        hdrlen = hostap_80211_get_hdrlen(le16_to_cpu(hdr->frame_ctl));
+        hdr = (struct ieee80211_hdr *) skb->data;
+        hdrlen = hostap_80211_get_hdrlen(hdr->frame_control);
 
         atomic_inc(&crypt->refcnt);
         res = crypt->ops->decrypt_msdu(skb, keyidx, hdrlen, crypt->priv);
@@ -720,7 +720,7 @@ void hostap_80211_rx(struct net_device *dev, struct sk_buff *skb,
 {
         struct hostap_interface *iface;
         local_info_t *local;
-        struct ieee80211_hdr_4addr *hdr;
+        struct ieee80211_hdr *hdr;
         size_t hdrlen;
         u16 fc, type, stype, sc;
         struct net_device *wds = NULL;
@@ -747,18 +747,18 @@ void hostap_80211_rx(struct net_device *dev, struct sk_buff *skb,
         dev = local->ddev;
         iface = netdev_priv(dev);
 
-        hdr = (struct ieee80211_hdr_4addr *) skb->data;
+        hdr = (struct ieee80211_hdr *) skb->data;
         stats = hostap_get_stats(dev);
 
         if (skb->len < 10)
                 goto rx_dropped;
 
-        fc = le16_to_cpu(hdr->frame_ctl);
-        type = WLAN_FC_GET_TYPE(fc);
-        stype = WLAN_FC_GET_STYPE(fc);
-        sc = le16_to_cpu(hdr->seq_ctl);
-        frag = WLAN_GET_SEQ_FRAG(sc);
-        hdrlen = hostap_80211_get_hdrlen(fc);
+        fc = le16_to_cpu(hdr->frame_control);
+        type = fc & IEEE80211_FCTL_FTYPE;
+        stype = fc & IEEE80211_FCTL_STYPE;
+        sc = le16_to_cpu(hdr->seq_ctrl);
+        frag = sc & IEEE80211_SCTL_FRAG;
+        hdrlen = hostap_80211_get_hdrlen(hdr->frame_control);
 
         /* Put this code here so that we avoid duplicating it in all
          * Rx paths. - Jean II */
@@ -918,7 +918,7 @@ void hostap_80211_rx(struct net_device *dev, struct sk_buff *skb,
         if (local->host_decrypt && (fc & IEEE80211_FCTL_PROTECTED) &&
             (keyidx = hostap_rx_frame_decrypt(local, skb, crypt)) < 0)
                 goto rx_dropped;
-        hdr = (struct ieee80211_hdr_4addr *) skb->data;
+        hdr = (struct ieee80211_hdr *) skb->data;
 
         /* skb: hdr + (possibly fragmented) plaintext payload */
 
@@ -931,7 +931,7 @@ void hostap_80211_rx(struct net_device *dev, struct sk_buff *skb,
                         printk(KERN_DEBUG "%s: Rx cannot get skb from "
                                "fragment cache (morefrag=%d seq=%u frag=%u)\n",
                                dev->name, (fc & IEEE80211_FCTL_MOREFRAGS) != 0,
-                               WLAN_GET_SEQ_SEQ(sc) >> 4, frag);
+                               (sc & IEEE80211_SCTL_SEQ) >> 4, frag);
                         goto rx_dropped;
                 }
 
@@ -972,7 +972,7 @@ void hostap_80211_rx(struct net_device *dev, struct sk_buff *skb,
                 /* this was the last fragment and the frame will be
                  * delivered, so remove skb from fragment cache */
                 skb = frag_skb;
-                hdr = (struct ieee80211_hdr_4addr *) skb->data;
+                hdr = (struct ieee80211_hdr *) skb->data;
                 prism2_frag_cache_invalidate(local, hdr);
         }
 
@@ -983,7 +983,7 @@ void hostap_80211_rx(struct net_device *dev, struct sk_buff *skb,
             hostap_rx_frame_decrypt_msdu(local, skb, keyidx, crypt))
                 goto rx_dropped;
 
-        hdr = (struct ieee80211_hdr_4addr *) skb->data;
+        hdr = (struct ieee80211_hdr *) skb->data;
         if (crypt && !(fc & IEEE80211_FCTL_PROTECTED) && !local->open_wep) {
                 if (local->ieee_802_1x &&
                     hostap_is_eapol_frame(local, skb)) {
diff --git a/drivers/net/wireless/hostap/hostap_80211_tx.c b/drivers/net/wireless/hostap/hostap_80211_tx.c
index 078a010f39a0..6693423f63fe 100644
--- a/drivers/net/wireless/hostap/hostap_80211_tx.c
+++ b/drivers/net/wireless/hostap/hostap_80211_tx.c
@@ -15,10 +15,10 @@ static unsigned char bridge_tunnel_header[] =
 
 void hostap_dump_tx_80211(const char *name, struct sk_buff *skb)
 {
-        struct ieee80211_hdr_4addr *hdr;
+        struct ieee80211_hdr *hdr;
         u16 fc;
 
-        hdr = (struct ieee80211_hdr_4addr *) skb->data;
+        hdr = (struct ieee80211_hdr *) skb->data;
 
         printk(KERN_DEBUG "%s: TX len=%d jiffies=%ld\n",
                name, skb->len, jiffies);
@@ -26,9 +26,10 @@ void hostap_dump_tx_80211(const char *name, struct sk_buff *skb)
         if (skb->len < 2)
                 return;
 
-        fc = le16_to_cpu(hdr->frame_ctl);
+        fc = le16_to_cpu(hdr->frame_control);
         printk(KERN_DEBUG "   FC=0x%04x (type=%d:%d)%s%s",
-               fc, WLAN_FC_GET_TYPE(fc) >> 2, WLAN_FC_GET_STYPE(fc) >> 4,
+               fc, (fc & IEEE80211_FCTL_FTYPE) >> 2,
+               (fc & IEEE80211_FCTL_STYPE) >> 4,
                fc & IEEE80211_FCTL_TODS ? " [ToDS]" : "",
                fc & IEEE80211_FCTL_FROMDS ? " [FromDS]" : "");
 
@@ -38,7 +39,7 @@ void hostap_dump_tx_80211(const char *name, struct sk_buff *skb)
         }
 
         printk(" dur=0x%04x seq=0x%04x\n", le16_to_cpu(hdr->duration_id),
-               le16_to_cpu(hdr->seq_ctl));
+               le16_to_cpu(hdr->seq_ctrl));
 
         printk(KERN_DEBUG "   A1=%pM", hdr->addr1);
         printk(" A2=%pM", hdr->addr2);
@@ -57,7 +58,7 @@ int hostap_data_start_xmit(struct sk_buff *skb, struct net_device *dev)
         struct hostap_interface *iface;
         local_info_t *local;
         int need_headroom, need_tailroom = 0;
-        struct ieee80211_hdr_4addr hdr;
+        struct ieee80211_hdr hdr;
         u16 fc, ethertype = 0;
         enum {
                 WDS_NO = 0, WDS_OWN_FRAME, WDS_COMPLIANT_FRAME
@@ -201,7 +202,7 @@ int hostap_data_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 memcpy(&hdr.addr3, local->bssid, ETH_ALEN);
         }
 
-        hdr.frame_ctl = cpu_to_le16(fc);
+        hdr.frame_control = cpu_to_le16(fc);
 
         skb_pull(skb, skip_header_bytes);
         need_headroom = local->func->need_tx_headroom + hdr_len + encaps_len;
@@ -265,7 +266,7 @@ int hostap_mgmt_start_xmit(struct sk_buff *skb, struct net_device *dev)
         struct hostap_interface *iface;
         local_info_t *local;
         struct hostap_skb_tx_data *meta;
-        struct ieee80211_hdr_4addr *hdr;
+        struct ieee80211_hdr *hdr;
         u16 fc;
 
         iface = netdev_priv(dev);
@@ -287,10 +288,10 @@ int hostap_mgmt_start_xmit(struct sk_buff *skb, struct net_device *dev)
         meta->iface = iface;
 
         if (skb->len >= IEEE80211_DATA_HDR3_LEN + sizeof(rfc1042_header) + 2) {
-                hdr = (struct ieee80211_hdr_4addr *) skb->data;
-                fc = le16_to_cpu(hdr->frame_ctl);
-                if (WLAN_FC_GET_TYPE(fc) == IEEE80211_FTYPE_DATA &&
-                    WLAN_FC_GET_STYPE(fc) == IEEE80211_STYPE_DATA) {
+                hdr = (struct ieee80211_hdr *) skb->data;
+                fc = le16_to_cpu(hdr->frame_control);
+                if (ieee80211_is_data(hdr->frame_control) &&
+                    (fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_DATA) {
                         u8 *pos = &skb->data[IEEE80211_DATA_HDR3_LEN +
                                              sizeof(rfc1042_header)];
                         meta->ethertype = (pos[0] << 8) | pos[1];
@@ -310,8 +311,7 @@ static struct sk_buff * hostap_tx_encrypt(struct sk_buff *skb,
 {
         struct hostap_interface *iface;
         local_info_t *local;
-        struct ieee80211_hdr_4addr *hdr;
-        u16 fc;
+        struct ieee80211_hdr *hdr;
         int prefix_len, postfix_len, hdr_len, res;
 
         iface = netdev_priv(skb->dev);
@@ -324,7 +324,7 @@ static struct sk_buff * hostap_tx_encrypt(struct sk_buff *skb,
 
         if (local->tkip_countermeasures &&
             strcmp(crypt->ops->name, "TKIP") == 0) {
-                hdr = (struct ieee80211_hdr_4addr *) skb->data;
+                hdr = (struct ieee80211_hdr *) skb->data;
                 if (net_ratelimit()) {
                         printk(KERN_DEBUG "%s: TKIP countermeasures: dropped "
                                "TX packet to %pM\n",
@@ -349,9 +349,8 @@ static struct sk_buff * hostap_tx_encrypt(struct sk_buff *skb,
                 return NULL;
         }
 
-        hdr = (struct ieee80211_hdr_4addr *) skb->data;
-        fc = le16_to_cpu(hdr->frame_ctl);
-        hdr_len = hostap_80211_get_hdrlen(fc);
+        hdr = (struct ieee80211_hdr *) skb->data;
+        hdr_len = hostap_80211_get_hdrlen(hdr->frame_control);
 
         /* Host-based IEEE 802.11 fragmentation for TX is not yet supported, so
          * call both MSDU and MPDU encryption functions from here. */
@@ -384,7 +383,7 @@ int hostap_master_start_xmit(struct sk_buff *skb, struct net_device *dev)
         ap_tx_ret tx_ret;
         struct hostap_skb_tx_data *meta;
         int no_encrypt = 0;
-        struct ieee80211_hdr_4addr *hdr;
+        struct ieee80211_hdr *hdr;
 
         iface = netdev_priv(dev);
         local = iface->local;
@@ -427,14 +426,14 @@ int hostap_master_start_xmit(struct sk_buff *skb, struct net_device *dev)
         tx_ret = hostap_handle_sta_tx(local, &tx);
         skb = tx.skb;
         meta = (struct hostap_skb_tx_data *) skb->cb;
-        hdr = (struct ieee80211_hdr_4addr *) skb->data;
-        fc = le16_to_cpu(hdr->frame_ctl);
+        hdr = (struct ieee80211_hdr *) skb->data;
+        fc = le16_to_cpu(hdr->frame_control);
         switch (tx_ret) {
         case AP_TX_CONTINUE:
                 break;
         case AP_TX_CONTINUE_NOT_AUTHORIZED:
                 if (local->ieee_802_1x &&
-                    WLAN_FC_GET_TYPE(fc) == IEEE80211_FTYPE_DATA &&
+                    ieee80211_is_data(hdr->frame_control) &&
                     meta->ethertype != ETH_P_PAE &&
                     !(meta->flags & HOSTAP_TX_FLAGS_WDS)) {
                         printk(KERN_DEBUG "%s: dropped frame to unauthorized "
@@ -469,10 +468,10 @@ int hostap_master_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
                 /* remove special version from the frame header */
                 fc &= ~IEEE80211_FCTL_VERS;
-                hdr->frame_ctl = cpu_to_le16(fc);
+                hdr->frame_control = cpu_to_le16(fc);
         }
 
-        if (WLAN_FC_GET_TYPE(fc) != IEEE80211_FTYPE_DATA) {
+        if (!ieee80211_is_data(hdr->frame_control)) {
                 no_encrypt = 1;
                 tx.crypt = NULL;
         }
@@ -493,9 +492,9 @@ int hostap_master_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 /* Add ISWEP flag both for firmware and host based encryption
                  */
                 fc |= IEEE80211_FCTL_PROTECTED;
-                hdr->frame_ctl = cpu_to_le16(fc);
+                hdr->frame_control = cpu_to_le16(fc);
         } else if (local->drop_unencrypted &&
-                   WLAN_FC_GET_TYPE(fc) == IEEE80211_FTYPE_DATA &&
+                   ieee80211_is_data(hdr->frame_control) &&
                    meta->ethertype != ETH_P_PAE) {
                 if (net_ratelimit()) {
                         printk(KERN_DEBUG "%s: dropped unencrypted TX data "
diff --git a/drivers/net/wireless/hostap/hostap_ap.c b/drivers/net/wireless/hostap/hostap_ap.c
index 0a4bf94dddfb..645862fd37d1 100644
--- a/drivers/net/wireless/hostap/hostap_ap.c
+++ b/drivers/net/wireless/hostap/hostap_ap.c
@@ -19,6 +19,7 @@
 #include <linux/proc_fs.h>
 #include <linux/delay.h>
 #include <linux/random.h>
+#include <linux/if_arp.h>
 
 #include "hostap_wlan.h"
 #include "hostap.h"
@@ -588,26 +589,22 @@ void hostap_check_sta_fw_version(struct ap_data *ap, int sta_fw_ver)
 static void hostap_ap_tx_cb(struct sk_buff *skb, int ok, void *data)
 {
         struct ap_data *ap = data;
-        u16 fc;
-        struct ieee80211_hdr_4addr *hdr;
+        struct ieee80211_hdr *hdr;
 
         if (!ap->local->hostapd || !ap->local->apdev) {
                 dev_kfree_skb(skb);
                 return;
         }
 
-        hdr = (struct ieee80211_hdr_4addr *) skb->data;
-        fc = le16_to_cpu(hdr->frame_ctl);
-
         /* Pass the TX callback frame to the hostapd; use 802.11 header version
          * 1 to indicate failure (no ACK) and 2 success (frame ACKed) */
 
-        fc &= ~IEEE80211_FCTL_VERS;
-        fc |= ok ? BIT(1) : BIT(0);
-        hdr->frame_ctl = cpu_to_le16(fc);
+        hdr = (struct ieee80211_hdr *) skb->data;
+        hdr->frame_control &= cpu_to_le16(~IEEE80211_FCTL_VERS);
+        hdr->frame_control |= cpu_to_le16(ok ? BIT(1) : BIT(0));
 
         skb->dev = ap->local->apdev;
-        skb_pull(skb, hostap_80211_get_hdrlen(fc));
+        skb_pull(skb, hostap_80211_get_hdrlen(hdr->frame_control));
         skb->pkt_type = PACKET_OTHERHOST;
         skb->protocol = cpu_to_be16(ETH_P_802_2);
         memset(skb->cb, 0, sizeof(skb->cb));
@@ -621,8 +618,8 @@ static void hostap_ap_tx_cb_auth(struct sk_buff *skb, int ok, void *data)
 {
         struct ap_data *ap = data;
         struct net_device *dev = ap->local->dev;
-        struct ieee80211_hdr_4addr *hdr;
-        u16 fc, auth_alg, auth_transaction, status;
+        struct ieee80211_hdr *hdr;
+        u16 auth_alg, auth_transaction, status;
         __le16 *pos;
         struct sta_info *sta = NULL;
         char *txt = NULL;
@@ -632,10 +629,8 @@ static void hostap_ap_tx_cb_auth(struct sk_buff *skb, int ok, void *data)
                 return;
         }
 
-        hdr = (struct ieee80211_hdr_4addr *) skb->data;
-        fc = le16_to_cpu(hdr->frame_ctl);
-        if (WLAN_FC_GET_TYPE(fc) != IEEE80211_FTYPE_MGMT ||
-            WLAN_FC_GET_STYPE(fc) != IEEE80211_STYPE_AUTH ||
+        hdr = (struct ieee80211_hdr *) skb->data;
+        if (!ieee80211_is_auth(hdr->frame_control) ||
             skb->len < IEEE80211_MGMT_HDR_LEN + 6) {
                 printk(KERN_DEBUG "%s: hostap_ap_tx_cb_auth received invalid "
                        "frame\n", dev->name);
@@ -691,7 +686,7 @@ static void hostap_ap_tx_cb_assoc(struct sk_buff *skb, int ok, void *data)
 {
         struct ap_data *ap = data;
         struct net_device *dev = ap->local->dev;
-        struct ieee80211_hdr_4addr *hdr;
+        struct ieee80211_hdr *hdr;
         u16 fc, status;
         __le16 *pos;
         struct sta_info *sta = NULL;
@@ -702,11 +697,10 @@ static void hostap_ap_tx_cb_assoc(struct sk_buff *skb, int ok, void *data)
                 return;
         }
 
-        hdr = (struct ieee80211_hdr_4addr *) skb->data;
-        fc = le16_to_cpu(hdr->frame_ctl);
-        if (WLAN_FC_GET_TYPE(fc) != IEEE80211_FTYPE_MGMT ||
-            (WLAN_FC_GET_STYPE(fc) != IEEE80211_STYPE_ASSOC_RESP &&
-             WLAN_FC_GET_STYPE(fc) != IEEE80211_STYPE_REASSOC_RESP) ||
+        hdr = (struct ieee80211_hdr *) skb->data;
+        fc = le16_to_cpu(hdr->frame_control);
+        if ((!ieee80211_is_assoc_resp(hdr->frame_control) &&
+             !ieee80211_is_reassoc_resp(hdr->frame_control)) ||
             skb->len < IEEE80211_MGMT_HDR_LEN + 4) {
                 printk(KERN_DEBUG "%s: hostap_ap_tx_cb_assoc received invalid "
                        "frame\n", dev->name);
@@ -757,12 +751,12 @@ static void hostap_ap_tx_cb_assoc(struct sk_buff *skb, int ok, void *data)
 static void hostap_ap_tx_cb_poll(struct sk_buff *skb, int ok, void *data)
 {
         struct ap_data *ap = data;
-        struct ieee80211_hdr_4addr *hdr;
+        struct ieee80211_hdr *hdr;
         struct sta_info *sta;
 
         if (skb->len < 24)
                 goto fail;
-        hdr = (struct ieee80211_hdr_4addr *) skb->data;
+        hdr = (struct ieee80211_hdr *) skb->data;
         if (ok) {
                 spin_lock(&ap->sta_table_lock);
                 sta = ap_get_sta(ap, hdr->addr1);
@@ -917,7 +911,7 @@ static void prism2_send_mgmt(struct net_device *dev,
 {
         struct hostap_interface *iface;
         local_info_t *local;
-        struct ieee80211_hdr_4addr *hdr;
+        struct ieee80211_hdr *hdr;
         u16 fc;
         struct sk_buff *skb;
         struct hostap_skb_tx_data *meta;
@@ -942,8 +936,8 @@ static void prism2_send_mgmt(struct net_device *dev,
         }
 
         fc = type_subtype;
-        hdrlen = hostap_80211_get_hdrlen(fc);
-        hdr = (struct ieee80211_hdr_4addr *) skb_put(skb, hdrlen);
+        hdrlen = hostap_80211_get_hdrlen(cpu_to_le16(type_subtype));
+        hdr = (struct ieee80211_hdr *) skb_put(skb, hdrlen);
         if (body)
                 memcpy(skb_put(skb, body_len), body, body_len);
 
@@ -954,11 +948,11 @@ static void prism2_send_mgmt(struct net_device *dev,
 
 
         memcpy(hdr->addr1, addr, ETH_ALEN); /* DA / RA */
-        if (WLAN_FC_GET_TYPE(fc) == IEEE80211_FTYPE_DATA) {
+        if (ieee80211_is_data(hdr->frame_control)) {
                 fc |= IEEE80211_FCTL_FROMDS;
                 memcpy(hdr->addr2, dev->dev_addr, ETH_ALEN); /* BSSID */
                 memcpy(hdr->addr3, dev->dev_addr, ETH_ALEN); /* SA */
-        } else if (WLAN_FC_GET_TYPE(fc) == IEEE80211_FTYPE_CTL) {
+        } else if (ieee80211_is_ctl(hdr->frame_control)) {
                 /* control:ACK does not have addr2 or addr3 */
                 memset(hdr->addr2, 0, ETH_ALEN);
                 memset(hdr->addr3, 0, ETH_ALEN);
@@ -967,7 +961,7 @@ static void prism2_send_mgmt(struct net_device *dev,
                 memcpy(hdr->addr3, dev->dev_addr, ETH_ALEN); /* BSSID */
         }
 
-        hdr->frame_ctl = cpu_to_le16(fc);
+        hdr->frame_control = cpu_to_le16(fc);
 
         meta = (struct hostap_skb_tx_data *) skb->cb;
         memset(meta, 0, sizeof(*meta));
@@ -1284,22 +1278,21 @@ static void handle_authen(local_info_t *local, struct sk_buff *skb,
                           struct hostap_80211_rx_status *rx_stats)
 {
         struct net_device *dev = local->dev;
-        struct ieee80211_hdr_4addr *hdr = (struct ieee80211_hdr_4addr *) skb->data;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
         size_t hdrlen;
         struct ap_data *ap = local->ap;
         char body[8 + WLAN_AUTH_CHALLENGE_LEN], *challenge = NULL;
         int len, olen;
         u16 auth_alg, auth_transaction, status_code;
         __le16 *pos;
-        u16 resp = WLAN_STATUS_SUCCESS, fc;
+        u16 resp = WLAN_STATUS_SUCCESS;
         struct sta_info *sta = NULL;
         struct lib80211_crypt_data *crypt;
         char *txt = "";
 
         len = skb->len - IEEE80211_MGMT_HDR_LEN;
 
-        fc = le16_to_cpu(hdr->frame_ctl);
-        hdrlen = hostap_80211_get_hdrlen(fc);
+        hdrlen = hostap_80211_get_hdrlen(hdr->frame_control);
 
         if (len < 6) {
                 PDEBUG(DEBUG_AP, "%s: handle_authen - too short payload "
@@ -1435,7 +1428,7 @@ static void handle_authen(local_info_t *local, struct sk_buff *skb,
                             challenge == NULL ||
                             memcmp(sta->u.sta.challenge, challenge,
                                    WLAN_AUTH_CHALLENGE_LEN) != 0 ||
-                            !(fc & IEEE80211_FCTL_PROTECTED)) {
+                            !ieee80211_has_protected(hdr->frame_control)) {
                                 txt = "challenge response incorrect";
                                 resp = WLAN_STATUS_CHALLENGE_FAIL;
                                 goto fail;
@@ -1488,7 +1481,7 @@ static void handle_authen(local_info_t *local, struct sk_buff *skb,
                        "trans#=%d stat=%d len=%d fc=%04x) ==> %d (%s)\n",
                        dev->name, hdr->addr2,
                        auth_alg, auth_transaction, status_code, len,
-                       fc, resp, txt);
+                       le16_to_cpu(hdr->frame_control), resp, txt);
         }
 }
 
@@ -1498,7 +1491,7 @@ static void handle_assoc(local_info_t *local, struct sk_buff *skb,
                          struct hostap_80211_rx_status *rx_stats, int reassoc)
 {
         struct net_device *dev = local->dev;
-        struct ieee80211_hdr_4addr *hdr = (struct ieee80211_hdr_4addr *) skb->data;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
         char body[12], *p, *lpos;
         int len, left;
         __le16 *pos;
@@ -1707,7 +1700,7 @@ static void handle_deauth(local_info_t *local, struct sk_buff *skb,
                           struct hostap_80211_rx_status *rx_stats)
 {
         struct net_device *dev = local->dev;
-        struct ieee80211_hdr_4addr *hdr = (struct ieee80211_hdr_4addr *) skb->data;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
         char *body = (char *) (skb->data + IEEE80211_MGMT_HDR_LEN);
         int len;
         u16 reason_code;
@@ -1749,7 +1742,7 @@ static void handle_disassoc(local_info_t *local, struct sk_buff *skb,
                             struct hostap_80211_rx_status *rx_stats)
 {
         struct net_device *dev = local->dev;
-        struct ieee80211_hdr_4addr *hdr = (struct ieee80211_hdr_4addr *) skb->data;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
         char *body = skb->data + IEEE80211_MGMT_HDR_LEN;
         int len;
         u16 reason_code;
@@ -1788,7 +1781,7 @@ static void handle_disassoc(local_info_t *local, struct sk_buff *skb,
 
 /* Called only as a scheduled task for pending AP frames. */
 static void ap_handle_data_nullfunc(local_info_t *local,
-                                    struct ieee80211_hdr_4addr *hdr)
+                                    struct ieee80211_hdr *hdr)
 {
         struct net_device *dev = local->dev;
 
@@ -1805,7 +1798,7 @@ static void ap_handle_data_nullfunc(local_info_t *local,
 
 /* Called only as a scheduled task for pending AP frames. */
 static void ap_handle_dropped_data(local_info_t *local,
-                                   struct ieee80211_hdr_4addr *hdr)
+                                   struct ieee80211_hdr *hdr)
 {
         struct net_device *dev = local->dev;
         struct sta_info *sta;
@@ -1863,7 +1856,7 @@ static void pspoll_send_buffered(local_info_t *local, struct sta_info *sta,
 
 /* Called only as a scheduled task for pending AP frames. */
 static void handle_pspoll(local_info_t *local,
-                          struct ieee80211_hdr_4addr *hdr,
+                          struct ieee80211_hdr *hdr,
                           struct hostap_80211_rx_status *rx_stats)
 {
         struct net_device *dev = local->dev;
@@ -1872,8 +1865,7 @@ static void handle_pspoll(local_info_t *local,
         struct sk_buff *skb;
 
         PDEBUG(DEBUG_PS2, "handle_pspoll: BSSID=%pM, TA=%pM PWRMGT=%d\n",
-               hdr->addr1, hdr->addr2,
-               !!(le16_to_cpu(hdr->frame_ctl) & IEEE80211_FCTL_PM));
+               hdr->addr1, hdr->addr2, !!ieee80211_has_pm(hdr->frame_control));
 
         if (memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN)) {
                 PDEBUG(DEBUG_AP,
@@ -1984,7 +1976,7 @@ static void handle_wds_oper_queue(struct work_struct *work)
 static void handle_beacon(local_info_t *local, struct sk_buff *skb,
                           struct hostap_80211_rx_status *rx_stats)
 {
-        struct ieee80211_hdr_4addr *hdr = (struct ieee80211_hdr_4addr *) skb->data;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
         char *body = skb->data + IEEE80211_MGMT_HDR_LEN;
         int len, left;
         u16 beacon_int, capability;
@@ -2143,14 +2135,14 @@ static void handle_ap_item(local_info_t *local, struct sk_buff *skb,
         struct net_device *dev = local->dev;
 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
         u16 fc, type, stype;
-        struct ieee80211_hdr_4addr *hdr;
+        struct ieee80211_hdr *hdr;
 
         /* FIX: should give skb->len to handler functions and check that the
          * buffer is long enough */
-        hdr = (struct ieee80211_hdr_4addr *) skb->data;
-        fc = le16_to_cpu(hdr->frame_ctl);
-        type = WLAN_FC_GET_TYPE(fc);
-        stype = WLAN_FC_GET_STYPE(fc);
+        hdr = (struct ieee80211_hdr *) skb->data;
+        fc = le16_to_cpu(hdr->frame_control);
+        type = fc & IEEE80211_FCTL_FTYPE;
+        stype = fc & IEEE80211_FCTL_STYPE;
 
 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
         if (!local->hostapd && type == IEEE80211_FTYPE_DATA) {
@@ -2262,8 +2254,7 @@ void hostap_rx(struct net_device *dev, struct sk_buff *skb,
 {
         struct hostap_interface *iface;
         local_info_t *local;
-        u16 fc;
-        struct ieee80211_hdr_4addr *hdr;
+        struct ieee80211_hdr *hdr;
 
         iface = netdev_priv(dev);
         local = iface->local;
@@ -2273,12 +2264,10 @@ void hostap_rx(struct net_device *dev, struct sk_buff *skb,
 
         local->stats.rx_packets++;
 
-        hdr = (struct ieee80211_hdr_4addr *) skb->data;
-        fc = le16_to_cpu(hdr->frame_ctl);
+        hdr = (struct ieee80211_hdr *) skb->data;
 
         if (local->ap->ap_policy == AP_OTHER_AP_SKIP_ALL &&
-            WLAN_FC_GET_TYPE(fc) == IEEE80211_FTYPE_MGMT &&
-            WLAN_FC_GET_STYPE(fc) == IEEE80211_STYPE_BEACON)
+            ieee80211_is_beacon(hdr->frame_control))
                 goto drop;
 
         skb->protocol = cpu_to_be16(ETH_P_HOSTAP);
@@ -2294,7 +2283,7 @@ void hostap_rx(struct net_device *dev, struct sk_buff *skb,
 static void schedule_packet_send(local_info_t *local, struct sta_info *sta)
 {
         struct sk_buff *skb;
-        struct ieee80211_hdr_4addr *hdr;
+        struct ieee80211_hdr *hdr;
         struct hostap_80211_rx_status rx_stats;
 
         if (skb_queue_empty(&sta->tx_buf))
@@ -2307,10 +2296,10 @@ static void schedule_packet_send(local_info_t *local, struct sta_info *sta)
                 return;
         }
 
-        hdr = (struct ieee80211_hdr_4addr *) skb_put(skb, 16);
+        hdr = (struct ieee80211_hdr *) skb_put(skb, 16);
 
         /* Generate a fake pspoll frame to start packet delivery */
-        hdr->frame_ctl = cpu_to_le16(
+        hdr->frame_control = cpu_to_le16(
                 IEEE80211_FTYPE_CTL | IEEE80211_STYPE_PSPOLL);
         memcpy(hdr->addr1, local->dev->dev_addr, ETH_ALEN);
         memcpy(hdr->addr2, sta->addr, ETH_ALEN);
@@ -2689,7 +2678,7 @@ ap_tx_ret hostap_handle_sta_tx(local_info_t *local, struct hostap_tx_data *tx)
         struct sta_info *sta = NULL;
         struct sk_buff *skb = tx->skb;
         int set_tim, ret;
-        struct ieee80211_hdr_4addr *hdr;
+        struct ieee80211_hdr *hdr;
         struct hostap_skb_tx_data *meta;
 
         meta = (struct hostap_skb_tx_data *) skb->cb;
@@ -2698,7 +2687,7 @@ ap_tx_ret hostap_handle_sta_tx(local_info_t *local, struct hostap_tx_data *tx)
             meta->iface->type == HOSTAP_INTERFACE_STA)
                 goto out;
 
-        hdr = (struct ieee80211_hdr_4addr *) skb->data;
+        hdr = (struct ieee80211_hdr *) skb->data;
 
         if (hdr->addr1[0] & 0x01) {
                 /* broadcast/multicast frame - no AP related processing */
@@ -2753,7 +2742,7 @@ ap_tx_ret hostap_handle_sta_tx(local_info_t *local, struct hostap_tx_data *tx)
 
         if (meta->flags & HOSTAP_TX_FLAGS_ADD_MOREDATA) {
                 /* indicate to STA that more frames follow */
-                hdr->frame_ctl |=
+                hdr->frame_control |=
                         cpu_to_le16(IEEE80211_FCTL_MOREDATA);
         }
 
@@ -2828,10 +2817,10 @@ void hostap_handle_sta_release(void *ptr)
 void hostap_handle_sta_tx_exc(local_info_t *local, struct sk_buff *skb)
 {
         struct sta_info *sta;
-        struct ieee80211_hdr_4addr *hdr;
+        struct ieee80211_hdr *hdr;
         struct hostap_skb_tx_data *meta;
 
-        hdr = (struct ieee80211_hdr_4addr *) skb->data;
+        hdr = (struct ieee80211_hdr *) skb->data;
         meta = (struct hostap_skb_tx_data *) skb->cb;
 
         spin_lock(&local->ap->sta_table_lock);
@@ -2898,8 +2887,8 @@ static void hostap_update_sta_ps2(local_info_t *local, struct sta_info *sta,
 
 
 /* Called only as a tasklet (software IRQ). Called for each RX frame to update
- * STA power saving state. pwrmgt is a flag from 802.11 frame_ctl field. */
-int hostap_update_sta_ps(local_info_t *local, struct ieee80211_hdr_4addr *hdr)
+ * STA power saving state. pwrmgt is a flag from 802.11 frame_control field. */
+int hostap_update_sta_ps(local_info_t *local, struct ieee80211_hdr *hdr)
 {
         struct sta_info *sta;
         u16 fc;
@@ -2913,9 +2902,10 @@ int hostap_update_sta_ps(local_info_t *local, struct ieee80211_hdr_4addr *hdr)
         if (!sta)
                 return -1;
 
-        fc = le16_to_cpu(hdr->frame_ctl);
+        fc = le16_to_cpu(hdr->frame_control);
         hostap_update_sta_ps2(local, sta, fc & IEEE80211_FCTL_PM,
-                              WLAN_FC_GET_TYPE(fc), WLAN_FC_GET_STYPE(fc));
+                              fc & IEEE80211_FCTL_FTYPE,
+                              fc & IEEE80211_FCTL_STYPE);
 
         atomic_dec(&sta->users);
         return 0;
@@ -2932,16 +2922,16 @@ ap_rx_ret hostap_handle_sta_rx(local_info_t *local, struct net_device *dev,
         int ret;
         struct sta_info *sta;
         u16 fc, type, stype;
-        struct ieee80211_hdr_4addr *hdr;
+        struct ieee80211_hdr *hdr;
 
         if (local->ap == NULL)
                 return AP_RX_CONTINUE;
 
-        hdr = (struct ieee80211_hdr_4addr *) skb->data;
+        hdr = (struct ieee80211_hdr *) skb->data;
 
-        fc = le16_to_cpu(hdr->frame_ctl);
-        type = WLAN_FC_GET_TYPE(fc);
-        stype = WLAN_FC_GET_STYPE(fc);
+        fc = le16_to_cpu(hdr->frame_control);
+        type = fc & IEEE80211_FCTL_FTYPE;
+        stype = fc & IEEE80211_FCTL_STYPE;
 
         spin_lock(&local->ap->sta_table_lock);
         sta = ap_get_sta(local->ap, hdr->addr2);
@@ -3064,7 +3054,7 @@ ap_rx_ret hostap_handle_sta_rx(local_info_t *local, struct net_device *dev,
 
 /* Called only as a tasklet (software IRQ) */
 int hostap_handle_sta_crypto(local_info_t *local,
-                             struct ieee80211_hdr_4addr *hdr,
+                             struct ieee80211_hdr *hdr,
                              struct lib80211_crypt_data **crypt,
                              void **sta_ptr)
 {
@@ -3166,7 +3156,7 @@ int hostap_add_sta(struct ap_data *ap, u8 *sta_addr)
 
 /* Called only as a tasklet (software IRQ) */
 int hostap_update_rx_stats(struct ap_data *ap,
-                           struct ieee80211_hdr_4addr *hdr,
+                           struct ieee80211_hdr *hdr,
                            struct hostap_80211_rx_status *rx_stats)
 {
         struct sta_info *sta;
diff --git a/drivers/net/wireless/hostap/hostap_ap.h b/drivers/net/wireless/hostap/hostap_ap.h
index d36e4b175336..655ceeba9612 100644
--- a/drivers/net/wireless/hostap/hostap_ap.h
+++ b/drivers/net/wireless/hostap/hostap_ap.h
@@ -235,7 +235,7 @@ struct hostap_tx_data {
 ap_tx_ret hostap_handle_sta_tx(local_info_t *local, struct hostap_tx_data *tx);
 void hostap_handle_sta_release(void *ptr);
 void hostap_handle_sta_tx_exc(local_info_t *local, struct sk_buff *skb);
-int hostap_update_sta_ps(local_info_t *local, struct ieee80211_hdr_4addr *hdr);
+int hostap_update_sta_ps(local_info_t *local, struct ieee80211_hdr *hdr);
 typedef enum {
         AP_RX_CONTINUE, AP_RX_DROP, AP_RX_EXIT, AP_RX_CONTINUE_NOT_AUTHORIZED
 } ap_rx_ret;
@@ -243,13 +243,13 @@ ap_rx_ret hostap_handle_sta_rx(local_info_t *local, struct net_device *dev,
                                struct sk_buff *skb,
                                struct hostap_80211_rx_status *rx_stats,
                                int wds);
-int hostap_handle_sta_crypto(local_info_t *local, struct ieee80211_hdr_4addr *hdr,
+int hostap_handle_sta_crypto(local_info_t *local, struct ieee80211_hdr *hdr,
                              struct lib80211_crypt_data **crypt,
                              void **sta_ptr);
 int hostap_is_sta_assoc(struct ap_data *ap, u8 *sta_addr);
 int hostap_is_sta_authorized(struct ap_data *ap, u8 *sta_addr);
 int hostap_add_sta(struct ap_data *ap, u8 *sta_addr);
-int hostap_update_rx_stats(struct ap_data *ap, struct ieee80211_hdr_4addr *hdr,
+int hostap_update_rx_stats(struct ap_data *ap, struct ieee80211_hdr *hdr,
                            struct hostap_80211_rx_status *rx_stats);
 void hostap_update_rates(local_info_t *local);
 void hostap_add_wds_links(local_info_t *local);
diff --git a/drivers/net/wireless/hostap/hostap_hw.c b/drivers/net/wireless/hostap/hostap_hw.c
index 0f27059bbe85..3d9e7b7a17b0 100644
--- a/drivers/net/wireless/hostap/hostap_hw.c
+++ b/drivers/net/wireless/hostap/hostap_hw.c
@@ -46,7 +46,6 @@
 #include <linux/rtnetlink.h>
 #include <linux/wireless.h>
 #include <net/iw_handler.h>
-#include <net/ieee80211.h>
 #include <net/lib80211.h>
 #include <asm/irq.h>
 
@@ -1840,8 +1839,8 @@ static int prism2_tx_80211(struct sk_buff *skb, struct net_device *dev)
         hdr_len = 24;
         skb_copy_from_linear_data(skb, &txdesc.frame_control, hdr_len);
         fc = le16_to_cpu(txdesc.frame_control);
-        if (WLAN_FC_GET_TYPE(fc) == IEEE80211_FTYPE_DATA &&
-            (fc & IEEE80211_FCTL_FROMDS) && (fc & IEEE80211_FCTL_TODS) &&
+        if (ieee80211_is_data(txdesc.frame_control) &&
+            ieee80211_has_a4(txdesc.frame_control) &&
             skb->len >= 30) {
                 /* Addr4 */
                 skb_copy_from_linear_data_offset(skb, hdr_len, txdesc.addr4,
@@ -2082,7 +2081,7 @@ static void hostap_rx_skb(local_info_t *local, struct sk_buff *skb)
         stats.rate = rxdesc->rate;
 
         /* Convert Prism2 RX structure into IEEE 802.11 header */
-        hdrlen = hostap_80211_get_hdrlen(le16_to_cpu(rxdesc->frame_control));
+        hdrlen = hostap_80211_get_hdrlen(rxdesc->frame_control);
         if (hdrlen > rx_hdrlen)
                 hdrlen = rx_hdrlen;
 
@@ -2204,7 +2203,7 @@ static void hostap_tx_callback(local_info_t *local,
                 return;
         }
 
-        hdrlen = hostap_80211_get_hdrlen(le16_to_cpu(txdesc->frame_control));
+        hdrlen = hostap_80211_get_hdrlen(txdesc->frame_control);
         len = le16_to_cpu(txdesc->data_len);
         skb = dev_alloc_skb(hdrlen + len);
         if (skb == NULL) {
@@ -2315,8 +2314,7 @@ static void hostap_sta_tx_exc_tasklet(unsigned long data)
                 if (skb->len >= sizeof(*txdesc)) {
                         /* Convert Prism2 RX structure into IEEE 802.11 header
                          */
-                        u16 fc = le16_to_cpu(txdesc->frame_control);
-                        int hdrlen = hostap_80211_get_hdrlen(fc);
+                        int hdrlen = hostap_80211_get_hdrlen(txdesc->frame_control);
                         memmove(skb_pull(skb, sizeof(*txdesc) - hdrlen),
                                 &txdesc->frame_control, hdrlen);
 
@@ -2394,12 +2392,12 @@ static void prism2_txexc(local_info_t *local)
         PDEBUG(DEBUG_EXTRA, "   retry_count=%d tx_rate=%d fc=0x%04x "
                "(%s%s%s::%d%s%s)\n",
                txdesc.retry_count, txdesc.tx_rate, fc,
-               WLAN_FC_GET_TYPE(fc) == IEEE80211_FTYPE_MGMT ? "Mgmt" : "",
-               WLAN_FC_GET_TYPE(fc) == IEEE80211_FTYPE_CTL ? "Ctrl" : "",
-               WLAN_FC_GET_TYPE(fc) == IEEE80211_FTYPE_DATA ? "Data" : "",
-               WLAN_FC_GET_STYPE(fc) >> 4,
-               fc & IEEE80211_FCTL_TODS ? " ToDS" : "",
-               fc & IEEE80211_FCTL_FROMDS ? " FromDS" : "");
+               ieee80211_is_mgmt(txdesc.frame_control) ? "Mgmt" : "",
+               ieee80211_is_ctl(txdesc.frame_control) ? "Ctrl" : "",
+               ieee80211_is_data(txdesc.frame_control) ? "Data" : "",
+               (fc & IEEE80211_FCTL_STYPE) >> 4,
+               ieee80211_has_tods(txdesc.frame_control) ? " ToDS" : "",
+               ieee80211_has_fromds(txdesc.frame_control) ? " FromDS" : "");
         PDEBUG(DEBUG_EXTRA, "   A1=%pM A2=%pM A3=%pM A4=%pM\n",
                txdesc.addr1, txdesc.addr2,
                txdesc.addr3, txdesc.addr4);
diff --git a/drivers/net/wireless/hostap/hostap_info.c b/drivers/net/wireless/hostap/hostap_info.c
index 99b4cf41edf2..6fa14a4e4b53 100644
--- a/drivers/net/wireless/hostap/hostap_info.c
+++ b/drivers/net/wireless/hostap/hostap_info.c
@@ -1,5 +1,6 @@
 /* Host AP driver Info Frame processing (part of hostap.o module) */
 
+#include <linux/if_arp.h>
 #include "hostap_wlan.h"
 #include "hostap.h"
 #include "hostap_ap.h"
diff --git a/drivers/net/wireless/hostap/hostap_ioctl.c b/drivers/net/wireless/hostap/hostap_ioctl.c
index 8618b3355eb4..3f2bda881a4f 100644
--- a/drivers/net/wireless/hostap/hostap_ioctl.c
+++ b/drivers/net/wireless/hostap/hostap_ioctl.c
@@ -2,6 +2,7 @@
 
 #include <linux/types.h>
 #include <linux/ethtool.h>
+#include <linux/if_arp.h>
 #include <net/lib80211.h>
 
 #include "hostap_wlan.h"
diff --git a/drivers/net/wireless/hostap/hostap_main.c b/drivers/net/wireless/hostap/hostap_main.c
index 02a312ca8607..5d55f92f654b 100644
--- a/drivers/net/wireless/hostap/hostap_main.c
+++ b/drivers/net/wireless/hostap/hostap_main.c
@@ -26,7 +26,6 @@
 #include <linux/etherdevice.h>
 #include <net/net_namespace.h>
 #include <net/iw_handler.h>
-#include <net/ieee80211.h>
 #include <net/lib80211.h>
 #include <asm/uaccess.h>
 
@@ -543,7 +542,8 @@ void hostap_dump_rx_header(const char *name, const struct hfa384x_rx_frame *rx)
         fc = __le16_to_cpu(rx->frame_control);
         printk(KERN_DEBUG "   FC=0x%04x (type=%d:%d) dur=0x%04x seq=0x%04x "
                "data_len=%d%s%s\n",
-               fc, WLAN_FC_GET_TYPE(fc) >> 2, WLAN_FC_GET_STYPE(fc) >> 4,
+               fc, (fc & IEEE80211_FCTL_FTYPE) >> 2,
+               (fc & IEEE80211_FCTL_STYPE) >> 4,
                __le16_to_cpu(rx->duration_id), __le16_to_cpu(rx->seq_ctrl),
                __le16_to_cpu(rx->data_len),
                fc & IEEE80211_FCTL_TODS ? " [ToDS]" : "",
@@ -570,7 +570,8 @@ void hostap_dump_tx_header(const char *name, const struct hfa384x_tx_frame *tx)
         fc = __le16_to_cpu(tx->frame_control);
         printk(KERN_DEBUG "   FC=0x%04x (type=%d:%d) dur=0x%04x seq=0x%04x "
                "data_len=%d%s%s\n",
-               fc, WLAN_FC_GET_TYPE(fc) >> 2, WLAN_FC_GET_STYPE(fc) >> 4,
+               fc, (fc & IEEE80211_FCTL_FTYPE) >> 2,
+               (fc & IEEE80211_FCTL_STYPE) >> 4,
                __le16_to_cpu(tx->duration_id), __le16_to_cpu(tx->seq_ctrl),
                __le16_to_cpu(tx->data_len),
                fc & IEEE80211_FCTL_TODS ? " [ToDS]" : "",
@@ -593,29 +594,16 @@ static int hostap_80211_header_parse(const struct sk_buff *skb,
 }
 
 
-int hostap_80211_get_hdrlen(u16 fc)
+int hostap_80211_get_hdrlen(__le16 fc)
 {
-        int hdrlen = 24;
-
-        switch (WLAN_FC_GET_TYPE(fc)) {
-        case IEEE80211_FTYPE_DATA:
-                if ((fc & IEEE80211_FCTL_FROMDS) && (fc & IEEE80211_FCTL_TODS))
-                        hdrlen = 30; /* Addr4 */
-                break;
-        case IEEE80211_FTYPE_CTL:
-                switch (WLAN_FC_GET_STYPE(fc)) {
-                case IEEE80211_STYPE_CTS:
-                case IEEE80211_STYPE_ACK:
-                        hdrlen = 10;
-                        break;
-                default:
-                        hdrlen = 16;
-                        break;
-                }
-                break;
-        }
-
-        return hdrlen;
+        if (ieee80211_is_data(fc) && ieee80211_has_a4 (fc))
+                return 30; /* Addr4 */
+        else if (ieee80211_is_cts(fc) || ieee80211_is_ack(fc))
+                return 10;
+        else if (ieee80211_is_ctl(fc))
+                return 16;
+
+        return 24;
 }
 
 
diff --git a/drivers/net/wireless/ipw2x00/Kconfig b/drivers/net/wireless/ipw2x00/Kconfig
index 1d5dc3e9c5fb..85cc79995f6f 100644
--- a/drivers/net/wireless/ipw2x00/Kconfig
+++ b/drivers/net/wireless/ipw2x00/Kconfig
@@ -186,7 +186,7 @@ config LIBIPW_DEBUG
           % echo 0x00000FFO > /proc/net/ieee80211/debug_level
 
           For a list of values you can assign to debug_level, you
-          can look at the bit mask values in <net/ieee80211.h>
+          can look at the bit mask values in ieee80211.h
 
           If you are not trying to debug or develop the libipw
           component, you most likely want to say N here.
diff --git a/include/net/ieee80211.h b/drivers/net/wireless/ipw2x00/ieee80211.h
index adb7cf31f781..7515fad00f92 100644
--- a/include/net/ieee80211.h
+++ b/drivers/net/wireless/ipw2x00/ieee80211.h
@@ -1119,6 +1119,9 @@ static inline int ieee80211_is_cck_rate(u8 rate)
 extern void free_ieee80211(struct net_device *dev);
 extern struct net_device *alloc_ieee80211(int sizeof_priv);
 
+extern void ieee80211_networks_age(struct ieee80211_device *ieee,
+                                   unsigned long age_secs);
+
 extern int ieee80211_set_encryption(struct ieee80211_device *ieee);
 
 /* ieee80211_tx.c */
diff --git a/drivers/net/wireless/ipw2x00/ipw2100.c b/drivers/net/wireless/ipw2x00/ipw2100.c
index 52b1cf5160f7..3a6d810a7608 100644
--- a/drivers/net/wireless/ipw2x00/ipw2100.c
+++ b/drivers/net/wireless/ipw2x00/ipw2100.c
@@ -1692,7 +1692,13 @@ static int ipw2100_up(struct ipw2100_priv *priv, int deferred)
         u32 lock;
         u32 ord_len = sizeof(lock);
 
-        /* Quite if manually disabled. */
+        /* Age scan list entries found before suspend */
+        if (priv->suspend_time) {
+                ieee80211_networks_age(priv->ieee, priv->suspend_time);
+                priv->suspend_time = 0;
+        }
+
+        /* Quiet if manually disabled. */
         if (priv->status & STATUS_RF_KILL_SW) {
                 IPW_DEBUG_INFO("%s: Radio is disabled by Manual Disable "
                                "switch\n", priv->net_dev->name);
@@ -6415,6 +6421,8 @@ static int ipw2100_suspend(struct pci_dev *pci_dev, pm_message_t state)
         pci_disable_device(pci_dev);
         pci_set_power_state(pci_dev, PCI_D3hot);
 
+        priv->suspend_at = get_seconds();
+
         mutex_unlock(&priv->action_mutex);
 
         return 0;
@@ -6458,6 +6466,8 @@ static int ipw2100_resume(struct pci_dev *pci_dev)
          * the queue of needed */
         netif_device_attach(dev);
 
+        priv->suspend_time = get_seconds() - priv->suspend_at;
+
         /* Bring the device back up */
         if (!(priv->status & STATUS_RF_KILL_SW))
                 ipw2100_up(priv, 0);
diff --git a/drivers/net/wireless/ipw2x00/ipw2100.h b/drivers/net/wireless/ipw2x00/ipw2100.h
index bbf1ddcafba8..f183d951cd32 100644
--- a/drivers/net/wireless/ipw2x00/ipw2100.h
+++ b/drivers/net/wireless/ipw2x00/ipw2100.h
@@ -39,8 +39,6 @@
 #include <linux/wireless.h>
 #include <net/iw_handler.h>     // new driver API
 
-#include <net/ieee80211.h>
-
 #ifdef CONFIG_IPW2100_MONITOR
 #include <net/ieee80211_radiotap.h>
 #endif
@@ -48,6 +46,8 @@
 #include <linux/workqueue.h>
 #include <linux/mutex.h>
 
+#include "ieee80211.h"
+
 struct ipw2100_priv;
 struct ipw2100_tx_packet;
 struct ipw2100_rx_packet;
@@ -591,6 +591,10 @@ struct ipw2100_priv {
 
         int user_requested_scan;
 
+        /* Track time in suspend */
+        unsigned long suspend_at;
+        unsigned long suspend_time;
+
         u32 interrupts;
         int tx_interrupts;
         int rx_interrupts;
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index 0420d3d35dd4..a7fb08aecf3f 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -301,88 +301,102 @@ static inline void ipw_write_reg32(struct ipw_priv *a, u32 b, u32 c)
 }
 
 /* 8-bit direct write (low 4K) */
-#define _ipw_write8(ipw, ofs, val) writeb((val), (ipw)->hw_base + (ofs))
+static inline void _ipw_write8(struct ipw_priv *ipw, unsigned long ofs,
+                u8 val)
+{
+        writeb(val, ipw->hw_base + ofs);
+}
 
 /* 8-bit direct write (for low 4K of SRAM/regs), with debug wrapper */
 #define ipw_write8(ipw, ofs, val) do { \
- IPW_DEBUG_IO("%s %d: write_direct8(0x%08X, 0x%08X)\n", __FILE__, __LINE__, (u32)(ofs), (u32)(val)); \
- _ipw_write8(ipw, ofs, val); \
- } while (0)
+        IPW_DEBUG_IO("%s %d: write_direct8(0x%08X, 0x%08X)\n", __FILE__, \
+                        __LINE__, (u32)(ofs), (u32)(val)); \
+        _ipw_write8(ipw, ofs, val); \
+} while (0)
 
 /* 16-bit direct write (low 4K) */
-#define _ipw_write16(ipw, ofs, val) writew((val), (ipw)->hw_base + (ofs))
+static inline void _ipw_write16(struct ipw_priv *ipw, unsigned long ofs,
+                u16 val)
+{
+        writew(val, ipw->hw_base + ofs);
+}
 
 /* 16-bit direct write (for low 4K of SRAM/regs), with debug wrapper */
-#define ipw_write16(ipw, ofs, val) \
- IPW_DEBUG_IO("%s %d: write_direct16(0x%08X, 0x%08X)\n", __FILE__, __LINE__, (u32)(ofs), (u32)(val)); \
- _ipw_write16(ipw, ofs, val)
+#define ipw_write16(ipw, ofs, val) do { \
+        IPW_DEBUG_IO("%s %d: write_direct16(0x%08X, 0x%08X)\n", __FILE__, \
+                        __LINE__, (u32)(ofs), (u32)(val)); \
+        _ipw_write16(ipw, ofs, val); \
+} while (0)
 
 /* 32-bit direct write (low 4K) */
-#define _ipw_write32(ipw, ofs, val) writel((val), (ipw)->hw_base + (ofs))
+static inline void _ipw_write32(struct ipw_priv *ipw, unsigned long ofs,
+                u32 val)
+{
+        writel(val, ipw->hw_base + ofs);
+}
 
 /* 32-bit direct write (for low 4K of SRAM/regs), with debug wrapper */
-#define ipw_write32(ipw, ofs, val) \
- IPW_DEBUG_IO("%s %d: write_direct32(0x%08X, 0x%08X)\n", __FILE__, __LINE__, (u32)(ofs), (u32)(val)); \
- _ipw_write32(ipw, ofs, val)
+#define ipw_write32(ipw, ofs, val) do { \
+        IPW_DEBUG_IO("%s %d: write_direct32(0x%08X, 0x%08X)\n", __FILE__, \
+                        __LINE__, (u32)(ofs), (u32)(val)); \
+        _ipw_write32(ipw, ofs, val); \
+} while (0)
 
 /* 8-bit direct read (low 4K) */
-#define _ipw_read8(ipw, ofs) readb((ipw)->hw_base + (ofs))
-
-/* 8-bit direct read (low 4K), with debug wrapper */
-static inline u8 __ipw_read8(char *f, u32 l, struct ipw_priv *ipw, u32 ofs)
+static inline u8 _ipw_read8(struct ipw_priv *ipw, unsigned long ofs)
 {
-        IPW_DEBUG_IO("%s %d: read_direct8(0x%08X)\n", f, l, (u32) (ofs));
-        return _ipw_read8(ipw, ofs);
+        return readb(ipw->hw_base + ofs);
 }
 
 /* alias to 8-bit direct read (low 4K of SRAM/regs), with debug wrapper */
-#define ipw_read8(ipw, ofs) __ipw_read8(__FILE__, __LINE__, ipw, ofs)
+#define ipw_read8(ipw, ofs) ({ \
+        IPW_DEBUG_IO("%s %d: read_direct8(0x%08X)\n", __FILE__, __LINE__, \
+                        (u32)(ofs)); \
+        _ipw_read8(ipw, ofs); \
+})
 
 /* 16-bit direct read (low 4K) */
-#define _ipw_read16(ipw, ofs) readw((ipw)->hw_base + (ofs))
-
-/* 16-bit direct read (low 4K), with debug wrapper */
-static inline u16 __ipw_read16(char *f, u32 l, struct ipw_priv *ipw, u32 ofs)
+static inline u16 _ipw_read16(struct ipw_priv *ipw, unsigned long ofs)
 {
-        IPW_DEBUG_IO("%s %d: read_direct16(0x%08X)\n", f, l, (u32) (ofs));
-        return _ipw_read16(ipw, ofs);
+        return readw(ipw->hw_base + ofs);
 }
 
 /* alias to 16-bit direct read (low 4K of SRAM/regs), with debug wrapper */
-#define ipw_read16(ipw, ofs) __ipw_read16(__FILE__, __LINE__, ipw, ofs)
+#define ipw_read16(ipw, ofs) ({ \
+        IPW_DEBUG_IO("%s %d: read_direct16(0x%08X)\n", __FILE__, __LINE__, \
+                        (u32)(ofs)); \
+        _ipw_read16(ipw, ofs); \
+})
 
 /* 32-bit direct read (low 4K) */
-#define _ipw_read32(ipw, ofs) readl((ipw)->hw_base + (ofs))
-
-/* 32-bit direct read (low 4K), with debug wrapper */
-static inline u32 __ipw_read32(char *f, u32 l, struct ipw_priv *ipw, u32 ofs)
+static inline u32 _ipw_read32(struct ipw_priv *ipw, unsigned long ofs)
 {
-        IPW_DEBUG_IO("%s %d: read_direct32(0x%08X)\n", f, l, (u32) (ofs));
-        return _ipw_read32(ipw, ofs);
+        return readl(ipw->hw_base + ofs);
 }
 
 /* alias to 32-bit direct read (low 4K of SRAM/regs), with debug wrapper */
-#define ipw_read32(ipw, ofs) __ipw_read32(__FILE__, __LINE__, ipw, ofs)
+#define ipw_read32(ipw, ofs) ({ \
+        IPW_DEBUG_IO("%s %d: read_direct32(0x%08X)\n", __FILE__, __LINE__, \
+                        (u32)(ofs)); \
+        _ipw_read32(ipw, ofs); \
+})
 
-/* multi-byte read (above 4K), with debug wrapper */
 static void _ipw_read_indirect(struct ipw_priv *, u32, u8 *, int);
-static inline void __ipw_read_indirect(const char *f, int l,
-                                       struct ipw_priv *a, u32 b, u8 * c, int d)
-{
-        IPW_DEBUG_IO("%s %d: read_indirect(0x%08X) %d bytes\n", f, l, (u32) (b),
-                     d);
-        _ipw_read_indirect(a, b, c, d);
-}
-
 /* alias to multi-byte read (SRAM/regs above 4K), with debug wrapper */
-#define ipw_read_indirect(a, b, c, d) __ipw_read_indirect(__FILE__, __LINE__, a, b, c, d)
+#define ipw_read_indirect(a, b, c, d) ({ \
+        IPW_DEBUG_IO("%s %d: read_indirect(0x%08X) %u bytes\n", __FILE__, \
+                        __LINE__, (u32)(b), (u32)(d)); \
+        _ipw_read_indirect(a, b, c, d); \
+})
 
 /* alias to multi-byte read (SRAM/regs above 4K), with debug wrapper */
 static void _ipw_write_indirect(struct ipw_priv *priv, u32 addr, u8 * data,
                                 int num);
-#define ipw_write_indirect(a, b, c, d) \
-        IPW_DEBUG_IO("%s %d: write_indirect(0x%08X) %d bytes\n", __FILE__, __LINE__, (u32)(b), d); \
-        _ipw_write_indirect(a, b, c, d)
+#define ipw_write_indirect(a, b, c, d) do { \
+        IPW_DEBUG_IO("%s %d: write_indirect(0x%08X) %u bytes\n", __FILE__, \
+                        __LINE__, (u32)(b), (u32)(d)); \
+        _ipw_write_indirect(a, b, c, d); \
+} while (0)
 
 /* 32-bit indirect write (above 4K) */
 static void _ipw_write_reg32(struct ipw_priv *priv, u32 reg, u32 value)
@@ -11224,6 +11238,12 @@ static int ipw_up(struct ipw_priv *priv)
 {
         int rc, i, j;
 
+        /* Age scan list entries found before suspend */
+        if (priv->suspend_time) {
+                ieee80211_networks_age(priv->ieee, priv->suspend_time);
+                priv->suspend_time = 0;
+        }
+
         if (priv->status & STATUS_EXIT_PENDING)
                 return -EIO;
 
@@ -11824,6 +11844,8 @@ static int ipw_pci_suspend(struct pci_dev *pdev, pm_message_t state)
         pci_disable_device(pdev);
         pci_set_power_state(pdev, pci_choose_state(pdev, state));
 
+        priv->suspend_at = get_seconds();
+
         return 0;
 }
 
@@ -11859,6 +11881,8 @@ static int ipw_pci_resume(struct pci_dev *pdev)
          * the queue of needed */
         netif_device_attach(dev);
 
+        priv->suspend_time = get_seconds() - priv->suspend_at;
+
         /* Bring the device back up */
         queue_work(priv->workqueue, &priv->up);
 
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.h b/drivers/net/wireless/ipw2x00/ipw2200.h
index 277b274d4be5..05e8ccf01c5f 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.h
+++ b/drivers/net/wireless/ipw2x00/ipw2200.h
@@ -49,13 +49,14 @@
 #include <asm/io.h>
 
 #include <net/lib80211.h>
-#include <net/ieee80211.h>
 #include <net/ieee80211_radiotap.h>
 
 #define DRV_NAME        "ipw2200"
 
 #include <linux/workqueue.h>
 
+#include "ieee80211.h"
+
 /* Authentication  and Association States */
 enum connection_manager_assoc_states {
         CMAS_INIT = 0,
@@ -1346,6 +1347,10 @@ struct ipw_priv {
 
         s8 tx_power;
 
+        /* Track time in suspend */
+        unsigned long suspend_at;
+        unsigned long suspend_time;
+
 #ifdef CONFIG_PM
         u32 pm_state[16];
 #endif
diff --git a/drivers/net/wireless/ipw2x00/libipw_geo.c b/drivers/net/wireless/ipw2x00/libipw_geo.c
index 960ad13f5e9f..9dfbb8760f67 100644
--- a/drivers/net/wireless/ipw2x00/libipw_geo.c
+++ b/drivers/net/wireless/ipw2x00/libipw_geo.c
@@ -41,7 +41,7 @@
 #include <linux/etherdevice.h>
 #include <asm/uaccess.h>
 
-#include <net/ieee80211.h>
+#include "ieee80211.h"
 
 int ieee80211_is_valid_channel(struct ieee80211_device *ieee, u8 channel)
 {
diff --git a/drivers/net/wireless/ipw2x00/libipw_module.c b/drivers/net/wireless/ipw2x00/libipw_module.c
index a2f5616d5b09..ec7753446bd3 100644
--- a/drivers/net/wireless/ipw2x00/libipw_module.c
+++ b/drivers/net/wireless/ipw2x00/libipw_module.c
@@ -50,7 +50,7 @@
 #include <net/net_namespace.h>
 #include <net/arp.h>
 
-#include <net/ieee80211.h>
+#include "ieee80211.h"
 
 #define DRV_DESCRIPTION "802.11 data/management/control stack"
 #define DRV_NAME        "ieee80211"
@@ -105,6 +105,21 @@ static inline void ieee80211_networks_free(struct ieee80211_device *ieee)
         ieee->networks = NULL;
 }
 
+void ieee80211_networks_age(struct ieee80211_device *ieee,
+                            unsigned long age_secs)
+{
+        struct ieee80211_network *network = NULL;
+        unsigned long flags;
+        unsigned long age_jiffies = msecs_to_jiffies(age_secs * MSEC_PER_SEC);
+
+        spin_lock_irqsave(&ieee->lock, flags);
+        list_for_each_entry(network, &ieee->network_list, list) {
+                network->last_scanned -= age_jiffies;
+        }
+        spin_unlock_irqrestore(&ieee->lock, flags);
+}
+EXPORT_SYMBOL(ieee80211_networks_age);
+
 static void ieee80211_networks_initialize(struct ieee80211_device *ieee)
 {
         int i;
diff --git a/drivers/net/wireless/ipw2x00/libipw_rx.c b/drivers/net/wireless/ipw2x00/libipw_rx.c
index 9c67dfae4320..8d9e96f9eb28 100644
--- a/drivers/net/wireless/ipw2x00/libipw_rx.c
+++ b/drivers/net/wireless/ipw2x00/libipw_rx.c
@@ -33,7 +33,8 @@
 #include <linux/ctype.h>
 
 #include <net/lib80211.h>
-#include <net/ieee80211.h>
+
+#include "ieee80211.h"
 
 static void ieee80211_monitor_rx(struct ieee80211_device *ieee,
                                         struct sk_buff *skb,
@@ -1615,7 +1616,7 @@ static void ieee80211_process_probe_response(struct ieee80211_device
                         break;
 
                 if ((oldest == NULL) ||
-                    (target->last_scanned < oldest->last_scanned))
+                    time_before(target->last_scanned, oldest->last_scanned))
                         oldest = target;
         }
 
diff --git a/drivers/net/wireless/ipw2x00/libipw_tx.c b/drivers/net/wireless/ipw2x00/libipw_tx.c
index f78f57e8844a..a874e9091919 100644
--- a/drivers/net/wireless/ipw2x00/libipw_tx.c
+++ b/drivers/net/wireless/ipw2x00/libipw_tx.c
@@ -41,7 +41,7 @@
 #include <linux/etherdevice.h>
 #include <asm/uaccess.h>
 
-#include <net/ieee80211.h>
+#include "ieee80211.h"
 
 /*
 
diff --git a/drivers/net/wireless/ipw2x00/libipw_wx.c b/drivers/net/wireless/ipw2x00/libipw_wx.c
index 31ea3abfc327..3c0812db030a 100644
--- a/drivers/net/wireless/ipw2x00/libipw_wx.c
+++ b/drivers/net/wireless/ipw2x00/libipw_wx.c
@@ -35,13 +35,24 @@
 #include <linux/jiffies.h>
 
 #include <net/lib80211.h>
-#include <net/ieee80211.h>
 #include <linux/wireless.h>
 
+#include "ieee80211.h"
+
 static const char *ieee80211_modes[] = {
         "?", "a", "b", "ab", "g", "ag", "bg", "abg"
 };
 
+static inline unsigned int elapsed_jiffies_msecs(unsigned long start)
+{
+        unsigned long end = jiffies;
+
+        if (end >= start)
+                return jiffies_to_msecs(end - start);
+
+        return jiffies_to_msecs(end + (MAX_JIFFY_OFFSET - start) + 1);
+}
+
 #define MAX_CUSTOM_LEN 64
 static char *ieee80211_translate_scan(struct ieee80211_device *ieee,
                                       char *start, char *stop,
@@ -215,8 +226,8 @@ static char *ieee80211_translate_scan(struct ieee80211_device *ieee,
         iwe.cmd = IWEVCUSTOM;
         p = custom;
         p += snprintf(p, MAX_CUSTOM_LEN - (p - custom),
-                      " Last beacon: %dms ago",
-                      jiffies_to_msecs(jiffies - network->last_scanned));
+                      " Last beacon: %ums ago",
+                      elapsed_jiffies_msecs(network->last_scanned));
         iwe.u.data.length = p - custom;
         if (iwe.u.data.length)
                 start = iwe_stream_add_point(info, start, stop, &iwe, custom);
@@ -276,15 +287,15 @@ int ieee80211_wx_get_scan(struct ieee80211_device *ieee,
                     time_after(network->last_scanned + ieee->scan_age, jiffies))
                         ev = ieee80211_translate_scan(ieee, ev, stop, network,
                                                       info);
-                else
+                else {
                         IEEE80211_DEBUG_SCAN("Not showing network '%s ("
-                                             "%pM)' due to age (%dms).\n",
+                                             "%pM)' due to age (%ums).\n",
                                              print_ssid(ssid, network->ssid,
                                                          network->ssid_len),
                                              network->bssid,
-                                             jiffies_to_msecs(jiffies -
-                                                              network->
-                                                              last_scanned));
+                                             elapsed_jiffies_msecs(
+                                                       network->last_scanned));
+                }
         }
 
         spin_unlock_irqrestore(&ieee->lock, flags);
diff --git a/drivers/net/wireless/iwlwifi/Kconfig b/drivers/net/wireless/iwlwifi/Kconfig
index 7b3bad1796c7..6cc5a54d35c5 100644
--- a/drivers/net/wireless/iwlwifi/Kconfig
+++ b/drivers/net/wireless/iwlwifi/Kconfig
@@ -1,27 +1,31 @@
 config IWLWIFI
-        bool "Intel Wireless Wifi"
+        tristate "Intel Wireless Wifi"
         depends on PCI && MAC80211 && WLAN_80211 && EXPERIMENTAL
-        default y
-
-config IWLCORE
-        tristate "Intel Wireless Wifi Core"
-        depends on IWLWIFI
         select LIB80211
+        select FW_LOADER
         select MAC80211_LEDS if IWLWIFI_LEDS
         select LEDS_CLASS if IWLWIFI_LEDS
         select RFKILL if IWLWIFI_RFKILL
+        select MAC80211_LEDS if IWL3945_LEDS
+        select LEDS_CLASS if IWL3945_LEDS
 
 config IWLWIFI_LEDS
         bool "Enable LED support in iwlagn driver"
-        depends on IWLCORE
+        depends on IWLWIFI
 
 config IWLWIFI_RFKILL
-        bool "Enable RF kill support in iwlagn driver"
-        depends on IWLCORE
+        bool "Enable RF kill support in iwlagn and iwl3945 drivers"
+        depends on IWLWIFI
+
+config IWLWIFI_SPECTRUM_MEASUREMENT
+        bool "Enable Spectrum Measurement in iwlagn driver"
+        depends on IWLWIFI
+        ---help---
+          This option will enable spectrum measurement for the iwlagn driver.
 
 config IWLWIFI_DEBUG
         bool "Enable full debugging output in iwlagn and iwl3945 drivers"
-        depends on IWLCORE
+        depends on IWLWIFI
         ---help---
           This option will enable debug tracing output for the iwlwifi drivers
 
@@ -45,16 +49,14 @@ config IWLWIFI_DEBUG
           any problems you may encounter.
 
 config IWLWIFI_DEBUGFS
-        bool "Iwlwifi debugfs support"
-        depends on IWLCORE && IWLWIFI_DEBUG && MAC80211_DEBUGFS
+        bool "iwlagn debugfs support"
+        depends on IWLWIFI && IWLWIFI_DEBUG && MAC80211_DEBUGFS
         ---help---
           Enable creation of debugfs files for the iwlwifi drivers.
 
 config IWLAGN
-        tristate "Intel Wireless WiFi Next Gen AGN"
+        tristate "Intel Wireless WiFi Next Gen AGN (iwlagn)"
         depends on IWLWIFI
-        select FW_LOADER
-        select IWLCORE
         ---help---
           Select to build the driver supporting the:
 
@@ -77,19 +79,6 @@ config IWLAGN
           say M here and read <file:Documentation/kbuild/modules.txt>.  The
           module will be called iwlagn.ko.
 
-config IWLAGN_SPECTRUM_MEASUREMENT
-        bool "Enable Spectrum Measurement in iwlagn driver"
-        depends on IWLAGN
-        ---help---
-          This option will enable spectrum measurement for the iwlagn driver.
-
-config IWLAGN_LEDS
-        bool "Enable LEDS features in iwlagn driver"
-        depends on IWLAGN
-        select IWLWIFI_LEDS
-        ---help---
-          This option enables LEDS for the iwlagn drivers
-
 
 config IWL4965
         bool "Intel Wireless WiFi 4965AGN"
@@ -98,19 +87,14 @@ config IWL4965
           This option enables support for Intel Wireless WiFi Link 4965AGN
 
 config IWL5000
-        bool "Intel Wireless WiFi 5000AGN"
+        bool "Intel Wireless WiFi 5000AGN; Intel WiFi Link 100, 6000, and 6050 Series"
         depends on IWLAGN
         ---help---
           This option enables support for Intel Wireless WiFi Link 5000AGN Family
 
 config IWL3945
-        tristate "Intel PRO/Wireless 3945ABG/BG Network Connection"
+        tristate "Intel PRO/Wireless 3945ABG/BG Network Connection (iwl3945)"
         depends on IWLWIFI
-        select FW_LOADER
-        select LIB80211
-        select MAC80211_LEDS if IWL3945_LEDS
-        select LEDS_CLASS if IWL3945_LEDS
-        select RFKILL if IWLWIFI_RFKILL
         ---help---
           Select to build the driver supporting the:
 
@@ -134,7 +118,7 @@ config IWL3945
           module will be called iwl3945.ko.
 
 config IWL3945_SPECTRUM_MEASUREMENT
-        bool "Enable Spectrum Measurement in iwl3945 drivers"
+        bool "Enable Spectrum Measurement in iwl3945 driver"
         depends on IWL3945
         ---help---
           This option will enable spectrum measurement for the iwl3945 driver.
diff --git a/drivers/net/wireless/iwlwifi/Makefile b/drivers/net/wireless/iwlwifi/Makefile
index ddc8b31b2608..48af523ceab7 100644
--- a/drivers/net/wireless/iwlwifi/Makefile
+++ b/drivers/net/wireless/iwlwifi/Makefile
@@ -1,11 +1,11 @@
-obj-$(CONFIG_IWLCORE)   += iwlcore.o
+obj-$(CONFIG_IWLWIFI)   += iwlcore.o
 iwlcore-objs            := iwl-core.o iwl-eeprom.o iwl-hcmd.o iwl-power.o
 iwlcore-objs            += iwl-rx.o iwl-tx.o iwl-sta.o iwl-calib.o
 iwlcore-objs            += iwl-scan.o
 iwlcore-$(CONFIG_IWLWIFI_DEBUGFS) += iwl-debugfs.o
 iwlcore-$(CONFIG_IWLWIFI_LEDS) += iwl-led.o
 iwlcore-$(CONFIG_IWLWIFI_RFKILL) += iwl-rfkill.o
-iwlcore-$(CONFIG_IWLAGN_SPECTRUM_MEASUREMENT) += iwl-spectrum.o
+iwlcore-$(CONFIG_IWLWIFI_SPECTRUM_MEASUREMENT) += iwl-spectrum.o
 
 obj-$(CONFIG_IWLAGN)    += iwlagn.o
 iwlagn-objs             := iwl-agn.o iwl-agn-rs.o
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
index d49e48b9b037..0a750534ddf2 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
@@ -1073,7 +1073,7 @@ static int iwl3945_apm_init(struct iwl_priv *priv)
         * D0U* --> D0A* state */
         iwl_set_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
 
-        iwl_poll_direct_bit(priv, CSR_GP_CNTRL,
+        ret = iwl_poll_direct_bit(priv, CSR_GP_CNTRL,
                             CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY, 25000);
         if (ret < 0) {
                 IWL_DEBUG_INFO(priv, "Failed to init the card\n");
@@ -2747,6 +2747,7 @@ static struct iwl_lib_ops iwl3945_lib = {
                 .query_addr = iwlcore_eeprom_query_addr,
         },
         .send_tx_power  = iwl3945_send_tx_power,
+        .is_valid_rtc_data_addr = iwl3945_hw_valid_rtc_data_addr,
 };
 
 static struct iwl_hcmd_utils_ops iwl3945_hcmd_utils = {
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 397577c06c92..b49f9f7a8a67 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -72,7 +72,7 @@
 #define VD
 #endif
 
-#ifdef CONFIG_IWLAGN_SPECTRUM_MEASUREMENT
+#ifdef CONFIG_IWLWIFI_SPECTRUM_MEASUREMENT
 #define VS "s"
 #else
 #define VS
@@ -444,7 +444,7 @@ void iwl_hw_txq_free_tfd(struct iwl_priv *priv, struct iwl_tx_queue *txq)
                 pci_unmap_single(dev,
                                 pci_unmap_addr(&txq->cmd[index]->meta, mapping),
                                 pci_unmap_len(&txq->cmd[index]->meta, len),
-                                PCI_DMA_TODEVICE);
+                                PCI_DMA_BIDIRECTIONAL);
 
         /* Unmap chunks, if any. */
         for (i = 1; i < num_tbs; i++) {
@@ -644,6 +644,9 @@ static u16 iwl_adjust_beacon_interval(u16 beacon_val)
                                         / MAX_UCODE_BEACON_INTERVAL;
         new_val = beacon_val / beacon_factor;
 
+        if (!new_val)
+                new_val = MAX_UCODE_BEACON_INTERVAL;
+
         return new_val;
 }
 
@@ -751,41 +754,6 @@ static void iwl_rx_reply_alive(struct iwl_priv *priv,
                 IWL_WARN(priv, "uCode did not respond OK.\n");
 }
 
-static void iwl_rx_reply_error(struct iwl_priv *priv,
-                                   struct iwl_rx_mem_buffer *rxb)
-{
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
-
-        IWL_ERR(priv, "Error Reply type 0x%08X cmd %s (0x%02X) "
-                "seq 0x%04X ser 0x%08X\n",
-                le32_to_cpu(pkt->u.err_resp.error_type),
-                get_cmd_string(pkt->u.err_resp.cmd_id),
-                pkt->u.err_resp.cmd_id,
-                le16_to_cpu(pkt->u.err_resp.bad_cmd_seq_num),
-                le32_to_cpu(pkt->u.err_resp.error_info));
-}
-
-static void iwl_rx_pm_sleep_notif(struct iwl_priv *priv,
-                                      struct iwl_rx_mem_buffer *rxb)
-{
-#ifdef CONFIG_IWLWIFI_DEBUG
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
-        struct iwl_sleep_notification *sleep = &(pkt->u.sleep_notif);
-        IWL_DEBUG_RX(priv, "sleep mode: %d, src: %d\n",
-                     sleep->pm_sleep_mode, sleep->pm_wakeup_src);
-#endif
-}
-
-static void iwl_rx_pm_debug_statistics_notif(struct iwl_priv *priv,
-                                             struct iwl_rx_mem_buffer *rxb)
-{
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
-        IWL_DEBUG_RADIO(priv, "Dumping %d bytes of unhandled "
-                        "notification for %s:\n",
-                        le32_to_cpu(pkt->len), get_cmd_string(pkt->hdr.cmd));
-        iwl_print_hex_dump(priv, IWL_DL_RADIO, pkt->u.raw, le32_to_cpu(pkt->len));
-}
-
 static void iwl_bg_beacon_update(struct work_struct *work)
 {
         struct iwl_priv *priv =
@@ -1312,64 +1280,6 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
         spin_unlock_irqrestore(&priv->lock, flags);
 }
 
-static irqreturn_t iwl_isr(int irq, void *data)
-{
-        struct iwl_priv *priv = data;
-        u32 inta, inta_mask;
-        u32 inta_fh;
-        if (!priv)
-                return IRQ_NONE;
-
-        spin_lock(&priv->lock);
-
-        /* Disable (but don't clear!) interrupts here to avoid
-         *    back-to-back ISRs and sporadic interrupts from our NIC.
-         * If we have something to service, the tasklet will re-enable ints.
-         * If we *don't* have something, we'll re-enable before leaving here. */
-        inta_mask = iwl_read32(priv, CSR_INT_MASK);  /* just for debug */
-        iwl_write32(priv, CSR_INT_MASK, 0x00000000);
-
-        /* Discover which interrupts are active/pending */
-        inta = iwl_read32(priv, CSR_INT);
-        inta_fh = iwl_read32(priv, CSR_FH_INT_STATUS);
-
-        /* Ignore interrupt if there's nothing in NIC to service.
-         * This may be due to IRQ shared with another device,
-         * or due to sporadic interrupts thrown from our NIC. */
-        if (!inta && !inta_fh) {
-                IWL_DEBUG_ISR(priv, "Ignore interrupt, inta == 0, inta_fh == 0\n");
-                goto none;
-        }
-
-        if ((inta == 0xFFFFFFFF) || ((inta & 0xFFFFFFF0) == 0xa5a5a5a0)) {
-                /* Hardware disappeared. It might have already raised
-                 * an interrupt */
-                IWL_WARN(priv, "HARDWARE GONE?? INTA == 0x%08x\n", inta);
-                goto unplugged;
-        }
-
-        IWL_DEBUG_ISR(priv, "ISR inta 0x%08x, enabled 0x%08x, fh 0x%08x\n",
-                      inta, inta_mask, inta_fh);
-
-        inta &= ~CSR_INT_BIT_SCD;
-
-        /* iwl_irq_tasklet() will service interrupts and re-enable them */
-        if (likely(inta || inta_fh))
-                tasklet_schedule(&priv->irq_tasklet);
-
- unplugged:
-        spin_unlock(&priv->lock);
-        return IRQ_HANDLED;
-
- none:
-        /* re-enable interrupts here since we don't have anything to service. */
-        /* only Re-enable if diabled by irq */
-        if (test_bit(STATUS_INT_ENABLED, &priv->status))
-                iwl_enable_interrupts(priv);
-        spin_unlock(&priv->lock);
-        return IRQ_NONE;
-}
-
 /******************************************************************************
  *
  * uCode download functions
@@ -2674,71 +2584,6 @@ static void iwl_bss_info_changed(struct ieee80211_hw *hw,
 
 }
 
-static int iwl_mac_hw_scan(struct ieee80211_hw *hw,
-                           struct cfg80211_scan_request *req)
-{
-        unsigned long flags;
-        struct iwl_priv *priv = hw->priv;
-        int ret;
-        u8 *ssid = NULL;
-        size_t ssid_len = 0;
-
-        if (req->n_ssids) {
-                ssid = req->ssids[0].ssid;
-                ssid_len = req->ssids[0].ssid_len;
-        }
-
-        IWL_DEBUG_MAC80211(priv, "enter\n");
-
-        mutex_lock(&priv->mutex);
-        spin_lock_irqsave(&priv->lock, flags);
-
-        if (!iwl_is_ready_rf(priv)) {
-                ret = -EIO;
-                IWL_DEBUG_MAC80211(priv, "leave - not ready or exit pending\n");
-                goto out_unlock;
-        }
-
-        /* We don't schedule scan within next_scan_jiffies period.
-         * Avoid scanning during possible EAPOL exchange, return
-         * success immediately.
-         */
-        if (priv->next_scan_jiffies &&
-            time_after(priv->next_scan_jiffies, jiffies)) {
-                IWL_DEBUG_SCAN(priv, "scan rejected: within next scan period\n");
-                queue_work(priv->workqueue, &priv->scan_completed);
-                ret = 0;
-                goto out_unlock;
-        }
-
-        /* if we just finished scan ask for delay */
-        if (iwl_is_associated(priv) && priv->last_scan_jiffies &&
-            time_after(priv->last_scan_jiffies + IWL_DELAY_NEXT_SCAN, jiffies)) {
-                IWL_DEBUG_SCAN(priv, "scan rejected: within previous scan period\n");
-                queue_work(priv->workqueue, &priv->scan_completed);
-                ret = 0;
-                goto out_unlock;
-        }
-
-        if (ssid_len) {
-                priv->one_direct_scan = 1;
-                priv->direct_ssid_len = ssid_len;
-                memcpy(priv->direct_ssid, ssid, priv->direct_ssid_len);
-        } else {
-                priv->one_direct_scan = 0;
-        }
-
-        ret = iwl_scan_initiate(priv);
-
-        IWL_DEBUG_MAC80211(priv, "leave\n");
-
-out_unlock:
-        spin_unlock_irqrestore(&priv->lock, flags);
-        mutex_unlock(&priv->mutex);
-
-        return ret;
-}
-
 static void iwl_mac_update_tkip_key(struct ieee80211_hw *hw,
                         struct ieee80211_key_conf *keyconf, const u8 *addr,
                         u32 iv32, u16 *phase1key)
@@ -3370,7 +3215,7 @@ static DEVICE_ATTR(statistics, S_IRUGO, show_statistics, NULL);
 
 static void iwl_setup_deferred_work(struct iwl_priv *priv)
 {
-        priv->workqueue = create_workqueue(DRV_NAME);
+        priv->workqueue = create_singlethread_workqueue(DRV_NAME);
 
         init_waitqueue_head(&priv->wait_command_queue);
 
@@ -3612,7 +3457,7 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         err = sysfs_create_group(&pdev->dev.kobj, &iwl_attribute_group);
         if (err) {
                 IWL_ERR(priv, "failed to create sysfs device attributes\n");
-                goto out_uninit_drv;
+                goto out_free_irq;
         }
 
         iwl_setup_deferred_work(priv);
@@ -3657,10 +3502,10 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 
  out_remove_sysfs:
         sysfs_remove_group(&pdev->dev.kobj, &iwl_attribute_group);
+ out_free_irq:
+        free_irq(priv->pci_dev->irq, priv);
  out_disable_msi:
         pci_disable_msi(priv->pci_dev);
-        pci_disable_device(priv->pci_dev);
- out_uninit_drv:
         iwl_uninit_drv(priv);
  out_free_eeprom:
         iwl_eeprom_free(priv);
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 260bf903cb71..37069d4c6c9b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -1386,14 +1386,16 @@ int iwl_set_tx_power(struct iwl_priv *priv, s8 tx_power, bool force)
 {
         int ret = 0;
         if (tx_power < IWL_TX_POWER_TARGET_POWER_MIN) {
-                IWL_WARN(priv, "Requested user TXPOWER %d below limit.\n",
-                            priv->tx_power_user_lmt);
+                IWL_WARN(priv, "Requested user TXPOWER %d below lower limit %d.\n",
+                         tx_power,
+                         IWL_TX_POWER_TARGET_POWER_MIN);
                 return -EINVAL;
         }
 
         if (tx_power > IWL_TX_POWER_TARGET_POWER_MAX) {
-                IWL_WARN(priv, "Requested user TXPOWER %d above limit.\n",
-                            priv->tx_power_user_lmt);
+                IWL_WARN(priv, "Requested user TXPOWER %d above upper limit %d.\n",
+                         tx_power,
+                         IWL_TX_POWER_TARGET_POWER_MAX);
                 return -EINVAL;
         }
 
@@ -1442,6 +1444,65 @@ void iwl_enable_interrupts(struct iwl_priv *priv)
 }
 EXPORT_SYMBOL(iwl_enable_interrupts);
 
+irqreturn_t iwl_isr(int irq, void *data)
+{
+        struct iwl_priv *priv = data;
+        u32 inta, inta_mask;
+        u32 inta_fh;
+        if (!priv)
+                return IRQ_NONE;
+
+        spin_lock(&priv->lock);
+
+        /* Disable (but don't clear!) interrupts here to avoid
+         *    back-to-back ISRs and sporadic interrupts from our NIC.
+         * If we have something to service, the tasklet will re-enable ints.
+         * If we *don't* have something, we'll re-enable before leaving here. */
+        inta_mask = iwl_read32(priv, CSR_INT_MASK);  /* just for debug */
+        iwl_write32(priv, CSR_INT_MASK, 0x00000000);
+
+        /* Discover which interrupts are active/pending */
+        inta = iwl_read32(priv, CSR_INT);
+        inta_fh = iwl_read32(priv, CSR_FH_INT_STATUS);
+
+        /* Ignore interrupt if there's nothing in NIC to service.
+         * This may be due to IRQ shared with another device,
+         * or due to sporadic interrupts thrown from our NIC. */
+        if (!inta && !inta_fh) {
+                IWL_DEBUG_ISR(priv, "Ignore interrupt, inta == 0, inta_fh == 0\n");
+                goto none;
+        }
+
+        if ((inta == 0xFFFFFFFF) || ((inta & 0xFFFFFFF0) == 0xa5a5a5a0)) {
+                /* Hardware disappeared. It might have already raised
+                 * an interrupt */
+                IWL_WARN(priv, "HARDWARE GONE?? INTA == 0x%08x\n", inta);
+                goto unplugged;
+        }
+
+        IWL_DEBUG_ISR(priv, "ISR inta 0x%08x, enabled 0x%08x, fh 0x%08x\n",
+                      inta, inta_mask, inta_fh);
+
+        inta &= ~CSR_INT_BIT_SCD;
+
+        /* iwl_irq_tasklet() will service interrupts and re-enable them */
+        if (likely(inta || inta_fh))
+                tasklet_schedule(&priv->irq_tasklet);
+
+ unplugged:
+        spin_unlock(&priv->lock);
+        return IRQ_HANDLED;
+
+ none:
+        /* re-enable interrupts here since we don't have anything to service. */
+        /* only Re-enable if diabled by irq */
+        if (test_bit(STATUS_INT_ENABLED, &priv->status))
+                iwl_enable_interrupts(priv);
+        spin_unlock(&priv->lock);
+        return IRQ_NONE;
+}
+EXPORT_SYMBOL(iwl_isr);
+
 int iwl_send_bt_config(struct iwl_priv *priv)
 {
         struct iwl_bt_cmd bt_cmd = {
@@ -1977,3 +2038,42 @@ void iwl_bg_rf_kill(struct work_struct *work)
         iwl_rfkill_set_hw_state(priv);
 }
 EXPORT_SYMBOL(iwl_bg_rf_kill);
+
+void iwl_rx_pm_sleep_notif(struct iwl_priv *priv,
+                           struct iwl_rx_mem_buffer *rxb)
+{
+#ifdef CONFIG_IWLWIFI_DEBUG
+        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_sleep_notification *sleep = &(pkt->u.sleep_notif);
+        IWL_DEBUG_RX(priv, "sleep mode: %d, src: %d\n",
+                     sleep->pm_sleep_mode, sleep->pm_wakeup_src);
+#endif
+}
+EXPORT_SYMBOL(iwl_rx_pm_sleep_notif);
+
+void iwl_rx_pm_debug_statistics_notif(struct iwl_priv *priv,
+                                      struct iwl_rx_mem_buffer *rxb)
+{
+        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        IWL_DEBUG_RADIO(priv, "Dumping %d bytes of unhandled "
+                        "notification for %s:\n",
+                        le32_to_cpu(pkt->len), get_cmd_string(pkt->hdr.cmd));
+        iwl_print_hex_dump(priv, IWL_DL_RADIO, pkt->u.raw, le32_to_cpu(pkt->len));
+}
+EXPORT_SYMBOL(iwl_rx_pm_debug_statistics_notif);
+
+void iwl_rx_reply_error(struct iwl_priv *priv,
+                        struct iwl_rx_mem_buffer *rxb)
+{
+        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+
+        IWL_ERR(priv, "Error Reply type 0x%08X cmd %s (0x%02X) "
+                "seq 0x%04X ser 0x%08X\n",
+                le32_to_cpu(pkt->u.err_resp.error_type),
+                get_cmd_string(pkt->u.err_resp.cmd_id),
+                pkt->u.err_resp.cmd_id,
+                le16_to_cpu(pkt->u.err_resp.bad_cmd_seq_num),
+                le32_to_cpu(pkt->u.err_resp.error_info));
+}
+EXPORT_SYMBOL(iwl_rx_reply_error);
+
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
index 9d464ec99dd5..7427d75b8c8c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.h
+++ b/drivers/net/wireless/iwlwifi/iwl-core.h
@@ -250,6 +250,16 @@ int iwl_init_drv(struct iwl_priv *priv);
 void iwl_uninit_drv(struct iwl_priv *priv);
 
 /*****************************************************
+ * RX handlers.
+ * **************************************************/
+void iwl_rx_pm_sleep_notif(struct iwl_priv *priv,
+                           struct iwl_rx_mem_buffer *rxb);
+void iwl_rx_pm_debug_statistics_notif(struct iwl_priv *priv,
+                                      struct iwl_rx_mem_buffer *rxb);
+void iwl_rx_reply_error(struct iwl_priv *priv,
+                        struct iwl_rx_mem_buffer *rxb);
+
+/*****************************************************
 * RX
 ******************************************************/
 void iwl_rx_queue_free(struct iwl_priv *priv, struct iwl_rx_queue *rxq);
@@ -345,6 +355,7 @@ void iwl_init_scan_params(struct iwl_priv *priv);
 int iwl_scan_cancel(struct iwl_priv *priv);
 int iwl_scan_cancel_timeout(struct iwl_priv *priv, unsigned long ms);
 int iwl_scan_initiate(struct iwl_priv *priv);
+int iwl_mac_hw_scan(struct ieee80211_hw *hw, struct cfg80211_scan_request *req);
 u16 iwl_fill_probe_req(struct iwl_priv *priv, enum ieee80211_band band,
                        struct ieee80211_mgmt *frame, int left);
 void iwl_setup_rx_scan_handlers(struct iwl_priv *priv);
@@ -379,7 +390,7 @@ void iwl_calib_free_results(struct iwl_priv *priv);
 /*******************************************************************************
  * Spectrum Measureemtns in  iwl-spectrum.c
  ******************************************************************************/
-#ifdef CONFIG_IWLAGN_SPECTRUM_MEASUREMENT
+#ifdef CONFIG_IWLWIFI_SPECTRUM_MEASUREMENT
 void iwl_setup_spectrum_handlers(struct iwl_priv *priv);
 #else
 static inline void iwl_setup_spectrum_handlers(struct iwl_priv *priv) {}
@@ -410,6 +421,7 @@ int iwl_send_card_state(struct iwl_priv *priv, u32 flags,
  *****************************************************/
 void iwl_disable_interrupts(struct iwl_priv *priv);
 void iwl_enable_interrupts(struct iwl_priv *priv);
+irqreturn_t iwl_isr(int irq, void *data);
 static inline u16 iwl_pcie_link_ctl(struct iwl_priv *priv)
 {
         int pos;
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index afde713c806f..b3e23abb9117 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -841,7 +841,7 @@ struct iwl_priv {
 
         struct ieee80211_supported_band bands[IEEE80211_NUM_BANDS];
 
-#if defined(CONFIG_IWLAGN_SPECTRUM_MEASUREMENT) || defined(CONFIG_IWL3945_SPECTRUM_MEASUREMENT)
+#if defined(CONFIG_IWLWIFI_SPECTRUM_MEASUREMENT) || defined(CONFIG_IWL3945_SPECTRUM_MEASUREMENT)
         /* spectrum measurement report caching */
         struct iwl_spectrum_notification measure_report;
         u8 measurement_status;
@@ -922,7 +922,7 @@ struct iwl_priv {
          * 4965's initialize alive response contains some calibration data. */
         struct iwl_init_alive_resp card_alive_init;
         struct iwl_alive_resp card_alive;
-#if defined(CONFIG_IWLWIFI_RFKILL) || defined(CONFIG_IWL3945_RFKILL)
+#if defined(CONFIG_IWLWIFI_RFKILL)
         struct rfkill *rfkill;
 #endif
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index 1ec2b20eb37c..23644cf884f1 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -440,6 +440,74 @@ int iwl_scan_initiate(struct iwl_priv *priv)
 }
 EXPORT_SYMBOL(iwl_scan_initiate);
 
+#define IWL_DELAY_NEXT_SCAN (HZ*2)
+
+int iwl_mac_hw_scan(struct ieee80211_hw *hw,
+                     struct cfg80211_scan_request *req)
+{
+        unsigned long flags;
+        struct iwl_priv *priv = hw->priv;
+        int ret;
+        u8 *ssid = NULL;
+        size_t ssid_len = 0;
+
+        if (req->n_ssids) {
+                ssid = req->ssids[0].ssid;
+                ssid_len = req->ssids[0].ssid_len;
+        }
+
+        IWL_DEBUG_MAC80211(priv, "enter\n");
+
+        mutex_lock(&priv->mutex);
+        spin_lock_irqsave(&priv->lock, flags);
+
+        if (!iwl_is_ready_rf(priv)) {
+                ret = -EIO;
+                IWL_DEBUG_MAC80211(priv, "leave - not ready or exit pending\n");
+                goto out_unlock;
+        }
+
+        /* We don't schedule scan within next_scan_jiffies period.
+         * Avoid scanning during possible EAPOL exchange, return
+         * success immediately.
+         */
+        if (priv->next_scan_jiffies &&
+            time_after(priv->next_scan_jiffies, jiffies)) {
+                IWL_DEBUG_SCAN(priv, "scan rejected: within next scan period\n");
+                queue_work(priv->workqueue, &priv->scan_completed);
+                ret = 0;
+                goto out_unlock;
+        }
+
+        /* if we just finished scan ask for delay */
+        if (iwl_is_associated(priv) && priv->last_scan_jiffies &&
+            time_after(priv->last_scan_jiffies + IWL_DELAY_NEXT_SCAN, jiffies)) {
+                IWL_DEBUG_SCAN(priv, "scan rejected: within previous scan period\n");
+                queue_work(priv->workqueue, &priv->scan_completed);
+                ret = 0;
+                goto out_unlock;
+        }
+
+        if (ssid_len) {
+                priv->one_direct_scan = 1;
+                priv->direct_ssid_len =  ssid_len;
+                memcpy(priv->direct_ssid, ssid, priv->direct_ssid_len);
+        } else {
+                priv->one_direct_scan = 0;
+        }
+
+        ret = iwl_scan_initiate(priv);
+
+        IWL_DEBUG_MAC80211(priv, "leave\n");
+
+out_unlock:
+        spin_unlock_irqrestore(&priv->lock, flags);
+        mutex_unlock(&priv->mutex);
+
+        return ret;
+}
+EXPORT_SYMBOL(iwl_mac_hw_scan);
+
 #define IWL_SCAN_CHECK_WATCHDOG (7 * HZ)
 
 void iwl_bg_scan_check(struct work_struct *data)
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index ae04c2086f70..dff60fb70214 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -819,7 +819,7 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
          * within command buffer array. */
         txcmd_phys = pci_map_single(priv->pci_dev,
                                     out_cmd, sizeof(struct iwl_cmd),
-                                    PCI_DMA_TODEVICE);
+                                    PCI_DMA_BIDIRECTIONAL);
         pci_unmap_addr_set(&out_cmd->meta, mapping, txcmd_phys);
         pci_unmap_len_set(&out_cmd->meta, len, sizeof(struct iwl_cmd));
         /* Add buffer containing Tx command and MAC(!) header to TFD's
@@ -968,7 +968,7 @@ int iwl_enqueue_hcmd(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
                         IWL_MAX_SCAN_SIZE : sizeof(struct iwl_cmd);
 
         phys_addr = pci_map_single(priv->pci_dev, out_cmd,
-                                   len, PCI_DMA_TODEVICE);
+                                   len, PCI_DMA_BIDIRECTIONAL);
         pci_unmap_addr_set(&out_cmd->meta, mapping, phys_addr);
         pci_unmap_len_set(&out_cmd->meta, len, len);
         phys_addr += offsetof(struct iwl_cmd, hdr);
@@ -1068,7 +1068,7 @@ static void iwl_hcmd_queue_reclaim(struct iwl_priv *priv, int txq_id,
         pci_unmap_single(priv->pci_dev,
                 pci_unmap_addr(&txq->cmd[cmd_idx]->meta, mapping),
                 pci_unmap_len(&txq->cmd[cmd_idx]->meta, len),
-                PCI_DMA_TODEVICE);
+                PCI_DMA_BIDIRECTIONAL);
 
         for (idx = iwl_queue_inc_wrap(idx, q->n_bd); q->read_ptr != idx;
              q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) {
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 0cd8cb96a5ef..d0596e7f64e6 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -726,38 +726,6 @@ static void iwl3945_setup_rxon_timing(struct iwl_priv *priv)
                 le16_to_cpu(priv->rxon_timing.atim_window));
 }
 
-static int iwl3945_scan_initiate(struct iwl_priv *priv)
-{
-        if (!iwl_is_ready_rf(priv)) {
-                IWL_DEBUG_SCAN(priv, "Aborting scan due to not ready.\n");
-                return -EIO;
-        }
-
-        if (test_bit(STATUS_SCANNING, &priv->status)) {
-                IWL_DEBUG_SCAN(priv, "Scan already in progress.\n");
-                return -EAGAIN;
-        }
-
-        if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
-                IWL_DEBUG_SCAN(priv, "Scan request while abort pending.  "
-                               "Queuing.\n");
-                return -EAGAIN;
-        }
-
-        IWL_DEBUG_INFO(priv, "Starting scan...\n");
-        if (priv->cfg->sku & IWL_SKU_G)
-                priv->scan_bands |= BIT(IEEE80211_BAND_2GHZ);
-        if (priv->cfg->sku & IWL_SKU_A)
-                priv->scan_bands |= BIT(IEEE80211_BAND_5GHZ);
-        set_bit(STATUS_SCANNING, &priv->status);
-        priv->scan_start = jiffies;
-        priv->scan_pass_start = priv->scan_start;
-
-        queue_work(priv->workqueue, &priv->request_scan);
-
-        return 0;
-}
-
 static int iwl3945_set_mode(struct iwl_priv *priv, int mode)
 {
         if (mode == NL80211_IFTYPE_ADHOC) {
@@ -1188,56 +1156,6 @@ drop:
         return -1;
 }
 
-static void iwl3945_radio_kill_sw(struct iwl_priv *priv, int disable_radio)
-{
-        unsigned long flags;
-
-        if (!!disable_radio == test_bit(STATUS_RF_KILL_SW, &priv->status))
-                return;
-
-        IWL_DEBUG_RF_KILL(priv, "Manual SW RF KILL set to: RADIO %s\n",
-                          disable_radio ? "OFF" : "ON");
-
-        if (disable_radio) {
-                iwl_scan_cancel(priv);
-                /* FIXME: This is a workaround for AP */
-                if (priv->iw_mode != NL80211_IFTYPE_AP) {
-                        spin_lock_irqsave(&priv->lock, flags);
-                        iwl_write32(priv, CSR_UCODE_DRV_GP1_SET,
-                                    CSR_UCODE_SW_BIT_RFKILL);
-                        spin_unlock_irqrestore(&priv->lock, flags);
-                        iwl_send_card_state(priv, CARD_STATE_CMD_DISABLE, 0);
-                        set_bit(STATUS_RF_KILL_SW, &priv->status);
-                }
-                return;
-        }
-
-        spin_lock_irqsave(&priv->lock, flags);
-        iwl_write32(priv, CSR_UCODE_DRV_GP1_CLR, CSR_UCODE_SW_BIT_RFKILL);
-
-        clear_bit(STATUS_RF_KILL_SW, &priv->status);
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        /* wake up ucode */
-        msleep(10);
-
-        spin_lock_irqsave(&priv->lock, flags);
-        iwl_read32(priv, CSR_UCODE_DRV_GP1);
-        if (!iwl_grab_nic_access(priv))
-                iwl_release_nic_access(priv);
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        if (test_bit(STATUS_RF_KILL_HW, &priv->status)) {
-                IWL_DEBUG_RF_KILL(priv, "Can not turn radio back on - "
-                                  "disabled by HW switch\n");
-                return;
-        }
-
-        if (priv->is_open)
-                queue_work(priv->workqueue, &priv->restart);
-        return;
-}
-
 #ifdef CONFIG_IWL3945_SPECTRUM_MEASUREMENT
 
 #include "iwl-spectrum.h"
@@ -1417,60 +1335,6 @@ static void iwl3945_rx_reply_add_sta(struct iwl_priv *priv,
         return;
 }
 
-static void iwl3945_rx_reply_error(struct iwl_priv *priv,
-                               struct iwl_rx_mem_buffer *rxb)
-{
-        struct iwl_rx_packet *pkt = (void *)rxb->skb->data;
-
-        IWL_ERR(priv, "Error Reply type 0x%08X cmd %s (0x%02X) "
-                "seq 0x%04X ser 0x%08X\n",
-                le32_to_cpu(pkt->u.err_resp.error_type),
-                get_cmd_string(pkt->u.err_resp.cmd_id),
-                pkt->u.err_resp.cmd_id,
-                le16_to_cpu(pkt->u.err_resp.bad_cmd_seq_num),
-                le32_to_cpu(pkt->u.err_resp.error_info));
-}
-
-static void iwl3945_rx_spectrum_measure_notif(struct iwl_priv *priv,
-                                          struct iwl_rx_mem_buffer *rxb)
-{
-#ifdef CONFIG_IWL3945_SPECTRUM_MEASUREMENT
-        struct iwl_rx_packet *pkt = (void *)rxb->skb->data;
-        struct iwl_spectrum_notification *report = &(pkt->u.spectrum_notif);
-
-        if (!report->state) {
-                IWL_DEBUG(priv, IWL_DL_11H | IWL_DL_INFO,
-                          "Spectrum Measure Notification: Start\n");
-                return;
-        }
-
-        memcpy(&priv->measure_report, report, sizeof(*report));
-        priv->measurement_status |= MEASUREMENT_READY;
-#endif
-}
-
-static void iwl3945_rx_pm_sleep_notif(struct iwl_priv *priv,
-                                  struct iwl_rx_mem_buffer *rxb)
-{
-#ifdef CONFIG_IWLWIFI_DEBUG
-        struct iwl_rx_packet *pkt = (void *)rxb->skb->data;
-        struct iwl_sleep_notification *sleep = &(pkt->u.sleep_notif);
-        IWL_DEBUG_RX(priv, "sleep mode: %d, src: %d\n",
-                     sleep->pm_sleep_mode, sleep->pm_wakeup_src);
-#endif
-}
-
-static void iwl3945_rx_pm_debug_statistics_notif(struct iwl_priv *priv,
-                                             struct iwl_rx_mem_buffer *rxb)
-{
-        struct iwl_rx_packet *pkt = (void *)rxb->skb->data;
-        IWL_DEBUG_RADIO(priv, "Dumping %d bytes of unhandled "
-                        "notification for %s:\n",
-                        le32_to_cpu(pkt->len), get_cmd_string(pkt->hdr.cmd));
-        iwl_print_hex_dump(priv, IWL_DL_RADIO, pkt->u.raw,
-                           le32_to_cpu(pkt->len));
-}
-
 static void iwl3945_bg_beacon_update(struct work_struct *work)
 {
         struct iwl_priv *priv =
@@ -1518,127 +1382,6 @@ static void iwl3945_rx_beacon_notif(struct iwl_priv *priv,
                 queue_work(priv->workqueue, &priv->beacon_update);
 }
 
-/* Service response to REPLY_SCAN_CMD (0x80) */
-static void iwl3945_rx_reply_scan(struct iwl_priv *priv,
-                              struct iwl_rx_mem_buffer *rxb)
-{
-#ifdef CONFIG_IWLWIFI_DEBUG
-        struct iwl_rx_packet *pkt = (void *)rxb->skb->data;
-        struct iwl_scanreq_notification *notif =
-            (struct iwl_scanreq_notification *)pkt->u.raw;
-
-        IWL_DEBUG_RX(priv, "Scan request status = 0x%x\n", notif->status);
-#endif
-}
-
-/* Service SCAN_START_NOTIFICATION (0x82) */
-static void iwl3945_rx_scan_start_notif(struct iwl_priv *priv,
-                                    struct iwl_rx_mem_buffer *rxb)
-{
-        struct iwl_rx_packet *pkt = (void *)rxb->skb->data;
-        struct iwl_scanstart_notification *notif =
-            (struct iwl_scanstart_notification *)pkt->u.raw;
-        priv->scan_start_tsf = le32_to_cpu(notif->tsf_low);
-        IWL_DEBUG_SCAN(priv, "Scan start: "
-                       "%d [802.11%s] "
-                       "(TSF: 0x%08X:%08X) - %d (beacon timer %u)\n",
-                       notif->channel,
-                       notif->band ? "bg" : "a",
-                       notif->tsf_high,
-                       notif->tsf_low, notif->status, notif->beacon_timer);
-}
-
-/* Service SCAN_RESULTS_NOTIFICATION (0x83) */
-static void iwl3945_rx_scan_results_notif(struct iwl_priv *priv,
-                                      struct iwl_rx_mem_buffer *rxb)
-{
-#ifdef CONFIG_IWLWIFI_DEBUG
-        struct iwl_rx_packet *pkt = (void *)rxb->skb->data;
-        struct iwl_scanresults_notification *notif =
-            (struct iwl_scanresults_notification *)pkt->u.raw;
-#endif
-
-        IWL_DEBUG_SCAN(priv, "Scan ch.res: "
-                       "%d [802.11%s] "
-                       "(TSF: 0x%08X:%08X) - %d "
-                       "elapsed=%lu usec (%dms since last)\n",
-                       notif->channel,
-                       notif->band ? "bg" : "a",
-                       le32_to_cpu(notif->tsf_high),
-                       le32_to_cpu(notif->tsf_low),
-                       le32_to_cpu(notif->statistics[0]),
-                       le32_to_cpu(notif->tsf_low) - priv->scan_start_tsf,
-                       jiffies_to_msecs(elapsed_jiffies
-                                        (priv->last_scan_jiffies, jiffies)));
-
-        priv->last_scan_jiffies = jiffies;
-        priv->next_scan_jiffies = 0;
-}
-
-/* Service SCAN_COMPLETE_NOTIFICATION (0x84) */
-static void iwl3945_rx_scan_complete_notif(struct iwl_priv *priv,
-                                       struct iwl_rx_mem_buffer *rxb)
-{
-#ifdef CONFIG_IWLWIFI_DEBUG
-        struct iwl_rx_packet *pkt = (void *)rxb->skb->data;
-        struct iwl_scancomplete_notification *scan_notif = (void *)pkt->u.raw;
-#endif
-
-        IWL_DEBUG_SCAN(priv, "Scan complete: %d channels (TSF 0x%08X:%08X) - %d\n",
-                       scan_notif->scanned_channels,
-                       scan_notif->tsf_low,
-                       scan_notif->tsf_high, scan_notif->status);
-
-        /* The HW is no longer scanning */
-        clear_bit(STATUS_SCAN_HW, &priv->status);
-
-        /* The scan completion notification came in, so kill that timer... */
-        cancel_delayed_work(&priv->scan_check);
-
-        IWL_DEBUG_INFO(priv, "Scan pass on %sGHz took %dms\n",
-                       (priv->scan_bands & BIT(IEEE80211_BAND_2GHZ)) ?
-                                                        "2.4" : "5.2",
-                       jiffies_to_msecs(elapsed_jiffies
-                                        (priv->scan_pass_start, jiffies)));
-
-        /* Remove this scanned band from the list of pending
-         * bands to scan, band G precedes A in order of scanning
-         * as seen in iwl3945_bg_request_scan */
-        if (priv->scan_bands & BIT(IEEE80211_BAND_2GHZ))
-                priv->scan_bands &= ~BIT(IEEE80211_BAND_2GHZ);
-        else if (priv->scan_bands &  BIT(IEEE80211_BAND_5GHZ))
-                priv->scan_bands &= ~BIT(IEEE80211_BAND_5GHZ);
-
-        /* If a request to abort was given, or the scan did not succeed
-         * then we reset the scan state machine and terminate,
-         * re-queuing another scan if one has been requested */
-        if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
-                IWL_DEBUG_INFO(priv, "Aborted scan completed.\n");
-                clear_bit(STATUS_SCAN_ABORTING, &priv->status);
-        } else {
-                /* If there are more bands on this scan pass reschedule */
-                if (priv->scan_bands > 0)
-                        goto reschedule;
-        }
-
-        priv->last_scan_jiffies = jiffies;
-        priv->next_scan_jiffies = 0;
-        IWL_DEBUG_INFO(priv, "Setting scan to off\n");
-
-        clear_bit(STATUS_SCANNING, &priv->status);
-
-        IWL_DEBUG_INFO(priv, "Scan took %dms\n",
-                jiffies_to_msecs(elapsed_jiffies(priv->scan_start, jiffies)));
-
-        queue_work(priv->workqueue, &priv->scan_completed);
-
-        return;
-
-reschedule:
-        priv->scan_pass_start = jiffies;
-        queue_work(priv->workqueue, &priv->request_scan);
-}
-
 /* Handle notification from uCode that card's power state is changing
  * due to software, hardware, or critical temperature RFKILL */
 static void iwl3945_rx_card_state_notif(struct iwl_priv *priv,
@@ -1690,13 +1433,11 @@ static void iwl3945_setup_rx_handlers(struct iwl_priv *priv)
 {
         priv->rx_handlers[REPLY_ALIVE] = iwl3945_rx_reply_alive;
         priv->rx_handlers[REPLY_ADD_STA] = iwl3945_rx_reply_add_sta;
-        priv->rx_handlers[REPLY_ERROR] = iwl3945_rx_reply_error;
+        priv->rx_handlers[REPLY_ERROR] = iwl_rx_reply_error;
         priv->rx_handlers[CHANNEL_SWITCH_NOTIFICATION] = iwl_rx_csa;
-        priv->rx_handlers[SPECTRUM_MEASURE_NOTIFICATION] =
-            iwl3945_rx_spectrum_measure_notif;
-        priv->rx_handlers[PM_SLEEP_NOTIFICATION] = iwl3945_rx_pm_sleep_notif;
+        priv->rx_handlers[PM_SLEEP_NOTIFICATION] = iwl_rx_pm_sleep_notif;
         priv->rx_handlers[PM_DEBUG_STATISTIC_NOTIFIC] =
-            iwl3945_rx_pm_debug_statistics_notif;
+            iwl_rx_pm_debug_statistics_notif;
         priv->rx_handlers[BEACON_NOTIFICATION] = iwl3945_rx_beacon_notif;
 
         /*
@@ -1707,12 +1448,8 @@ static void iwl3945_setup_rx_handlers(struct iwl_priv *priv)
         priv->rx_handlers[REPLY_STATISTICS_CMD] = iwl3945_hw_rx_statistics;
         priv->rx_handlers[STATISTICS_NOTIFICATION] = iwl3945_hw_rx_statistics;
 
-        priv->rx_handlers[REPLY_SCAN_CMD] = iwl3945_rx_reply_scan;
-        priv->rx_handlers[SCAN_START_NOTIFICATION] = iwl3945_rx_scan_start_notif;
-        priv->rx_handlers[SCAN_RESULTS_NOTIFICATION] =
-            iwl3945_rx_scan_results_notif;
-        priv->rx_handlers[SCAN_COMPLETE_NOTIFICATION] =
-            iwl3945_rx_scan_complete_notif;
+        iwl_setup_spectrum_handlers(priv);
+        iwl_setup_rx_scan_handlers(priv);
         priv->rx_handlers[CARD_STATE_NOTIFICATION] = iwl3945_rx_card_state_notif;
 
         /* Set up hardware specific Rx handlers */
@@ -2195,14 +1932,6 @@ static void iwl3945_rx_handle(struct iwl_priv *priv)
         iwl3945_rx_queue_restock(priv);
 }
 
-static void iwl3945_enable_interrupts(struct iwl_priv *priv)
-{
-        IWL_DEBUG_ISR(priv, "Enabling interrupts\n");
-        set_bit(STATUS_INT_ENABLED, &priv->status);
-        iwl_write32(priv, CSR_INT_MASK, CSR_INI_SET_MASK);
-}
-
-
 /* call this function to flush any scheduled tasklet */
 static inline void iwl_synchronize_irq(struct iwl_priv *priv)
 {
@@ -2211,21 +1940,6 @@ static inline void iwl_synchronize_irq(struct iwl_priv *priv)
         tasklet_kill(&priv->irq_tasklet);
 }
 
-
-static inline void iwl3945_disable_interrupts(struct iwl_priv *priv)
-{
-        clear_bit(STATUS_INT_ENABLED, &priv->status);
-
-        /* disable interrupts from uCode/NIC to host */
-        iwl_write32(priv, CSR_INT_MASK, 0x00000000);
-
-        /* acknowledge/clear/reset any interrupts still pending
-         * from uCode or flow handler (Rx/Tx DMA) */
-        iwl_write32(priv, CSR_INT, 0xffffffff);
-        iwl_write32(priv, CSR_FH_INT_STATUS, 0xffffffff);
-        IWL_DEBUG_ISR(priv, "Disabled interrupts\n");
-}
-
 static const char *desc_lookup(int i)
 {
         switch (i) {
@@ -2467,7 +2181,7 @@ static void iwl3945_irq_tasklet(struct iwl_priv *priv)
                 IWL_ERR(priv, "Microcode HW error detected.  Restarting.\n");
 
                 /* Tell the device to stop sending interrupts */
-                iwl3945_disable_interrupts(priv);
+                iwl_disable_interrupts(priv);
 
                 iwl_irq_handle_error(priv);
 
@@ -2547,7 +2261,7 @@ static void iwl3945_irq_tasklet(struct iwl_priv *priv)
         /* Re-enable all interrupts */
         /* only Re-enable if disabled by irq */
         if (test_bit(STATUS_INT_ENABLED, &priv->status))
-                iwl3945_enable_interrupts(priv);
+                iwl_enable_interrupts(priv);
 
 #ifdef CONFIG_IWLWIFI_DEBUG
         if (priv->debug_level & (IWL_DL_ISR)) {
@@ -2561,63 +2275,6 @@ static void iwl3945_irq_tasklet(struct iwl_priv *priv)
         spin_unlock_irqrestore(&priv->lock, flags);
 }
 
-static irqreturn_t iwl3945_isr(int irq, void *data)
-{
-        struct iwl_priv *priv = data;
-        u32 inta, inta_mask;
-        u32 inta_fh;
-        if (!priv)
-                return IRQ_NONE;
-
-        spin_lock(&priv->lock);
-
-        /* Disable (but don't clear!) interrupts here to avoid
-         *    back-to-back ISRs and sporadic interrupts from our NIC.
-         * If we have something to service, the tasklet will re-enable ints.
-         * If we *don't* have something, we'll re-enable before leaving here. */
-        inta_mask = iwl_read32(priv, CSR_INT_MASK);  /* just for debug */
-        iwl_write32(priv, CSR_INT_MASK, 0x00000000);
-
-        /* Discover which interrupts are active/pending */
-        inta = iwl_read32(priv, CSR_INT);
-        inta_fh = iwl_read32(priv, CSR_FH_INT_STATUS);
-
-        /* Ignore interrupt if there's nothing in NIC to service.
-         * This may be due to IRQ shared with another device,
-         * or due to sporadic interrupts thrown from our NIC. */
-        if (!inta && !inta_fh) {
-                IWL_DEBUG_ISR(priv, "Ignore interrupt, inta == 0, inta_fh == 0\n");
-                goto none;
-        }
-
-        if ((inta == 0xFFFFFFFF) || ((inta & 0xFFFFFFF0) == 0xa5a5a5a0)) {
-                /* Hardware disappeared */
-                IWL_WARN(priv, "HARDWARE GONE?? INTA == 0x%08x\n", inta);
-                goto unplugged;
-        }
-
-        IWL_DEBUG_ISR(priv, "ISR inta 0x%08x, enabled 0x%08x, fh 0x%08x\n",
-                      inta, inta_mask, inta_fh);
-
-        inta &= ~CSR_INT_BIT_SCD;
-
-        /* iwl3945_irq_tasklet() will service interrupts and re-enable them */
-        if (likely(inta || inta_fh))
-                tasklet_schedule(&priv->irq_tasklet);
-unplugged:
-        spin_unlock(&priv->lock);
-
-        return IRQ_HANDLED;
-
- none:
-        /* re-enable interrupts here since we don't have anything to service. */
-        /* only Re-enable if disabled by irq */
-        if (test_bit(STATUS_INT_ENABLED, &priv->status))
-                iwl3945_enable_interrupts(priv);
-        spin_unlock(&priv->lock);
-        return IRQ_NONE;
-}
-
 static int iwl3945_get_channels_for_scan(struct iwl_priv *priv,
                                          enum ieee80211_band band,
                                      u8 is_active, u8 n_probes,
@@ -3387,7 +3044,7 @@ static void __iwl3945_down(struct iwl_priv *priv)
 
         /* tell the device to stop sending interrupts */
         spin_lock_irqsave(&priv->lock, flags);
-        iwl3945_disable_interrupts(priv);
+        iwl_disable_interrupts(priv);
         spin_unlock_irqrestore(&priv->lock, flags);
         iwl_synchronize_irq(priv);
 
@@ -3517,7 +3174,7 @@ static int __iwl3945_up(struct iwl_priv *priv)
 
         /* clear (again), then enable host interrupts */
         iwl_write32(priv, CSR_INT, 0xFFFFFFFF);
-        iwl3945_enable_interrupts(priv);
+        iwl_enable_interrupts(priv);
 
         /* really make sure rfkill handshake bits are cleared */
         iwl_write32(priv, CSR_UCODE_DRV_GP1_CLR, CSR_UCODE_SW_BIT_RFKILL);
@@ -4172,9 +3829,13 @@ static int iwl3945_mac_config(struct ieee80211_hw *hw, u32 changed)
         }
 #endif
 
-        iwl3945_radio_kill_sw(priv, !conf->radio_enabled);
+        if (conf->radio_enabled && iwl_radio_kill_sw_enable_radio(priv)) {
+                IWL_DEBUG_MAC80211(priv, "leave - RF-KILL - waiting for uCode\n");
+                goto out;
+        }
 
         if (!conf->radio_enabled) {
+                iwl_radio_kill_sw_disable_radio(priv);
                 IWL_DEBUG_MAC80211(priv, "leave - radio disabled\n");
                 goto out;
         }
@@ -4442,66 +4103,6 @@ static void iwl3945_bss_info_changed(struct ieee80211_hw *hw,
 
 }
 
-static int iwl3945_mac_hw_scan(struct ieee80211_hw *hw,
-                               struct cfg80211_scan_request *req)
-{
-        int rc = 0;
-        unsigned long flags;
-        struct iwl_priv *priv = hw->priv;
-        size_t len = 0;
-        u8 *ssid = NULL;
-        DECLARE_SSID_BUF(ssid_buf);
-
-        IWL_DEBUG_MAC80211(priv, "enter\n");
-
-        if (req->n_ssids) {
-                ssid = req->ssids[0].ssid;
-                len = req->ssids[0].ssid_len;
-        }
-
-        mutex_lock(&priv->mutex);
-        spin_lock_irqsave(&priv->lock, flags);
-
-        if (!iwl_is_ready_rf(priv)) {
-                rc = -EIO;
-                IWL_DEBUG_MAC80211(priv, "leave - not ready or exit pending\n");
-                goto out_unlock;
-        }
-
-        /* we don't schedule scan within next_scan_jiffies period */
-        if (priv->next_scan_jiffies &&
-                        time_after(priv->next_scan_jiffies, jiffies)) {
-                rc = -EAGAIN;
-                goto out_unlock;
-        }
-        /* if we just finished scan ask for delay for a broadcast scan */
-        if ((len == 0) && priv->last_scan_jiffies &&
-            time_after(priv->last_scan_jiffies + IWL_DELAY_NEXT_SCAN,
-                       jiffies)) {
-                rc = -EAGAIN;
-                goto out_unlock;
-        }
-        if (len) {
-                IWL_DEBUG_SCAN(priv, "direct scan for %s [%zd]\n ",
-                               print_ssid(ssid_buf, ssid, len), len);
-
-                priv->one_direct_scan = 1;
-                priv->direct_ssid_len = len;
-                memcpy(priv->direct_ssid, ssid, len);
-        } else
-                priv->one_direct_scan = 0;
-
-        rc = iwl3945_scan_initiate(priv);
-
-        IWL_DEBUG_MAC80211(priv, "leave\n");
-
-out_unlock:
-        spin_unlock_irqrestore(&priv->lock, flags);
-        mutex_unlock(&priv->mutex);
-
-        return rc;
-}
-
 static int iwl3945_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                                struct ieee80211_vif *vif,
                                struct ieee80211_sta *sta,
@@ -5201,7 +4802,7 @@ static DEVICE_ATTR(dump_events, S_IWUSR, NULL, dump_event_log);
 
 static void iwl3945_setup_deferred_work(struct iwl_priv *priv)
 {
-        priv->workqueue = create_workqueue(DRV_NAME);
+        priv->workqueue = create_singlethread_workqueue(DRV_NAME);
 
         init_waitqueue_head(&priv->wait_command_queue);
 
@@ -5275,7 +4876,7 @@ static struct ieee80211_ops iwl3945_hw_ops = {
         .conf_tx = iwl3945_mac_conf_tx,
         .reset_tsf = iwl3945_mac_reset_tsf,
         .bss_info_changed = iwl3945_bss_info_changed,
-        .hw_scan = iwl3945_mac_hw_scan
+        .hw_scan = iwl_mac_hw_scan
 };
 
 static int iwl3945_init_drv(struct iwl_priv *priv)
@@ -5526,12 +5127,12 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
          * ********************/
 
         spin_lock_irqsave(&priv->lock, flags);
-        iwl3945_disable_interrupts(priv);
+        iwl_disable_interrupts(priv);
         spin_unlock_irqrestore(&priv->lock, flags);
 
         pci_enable_msi(priv->pci_dev);
 
-        err = request_irq(priv->pci_dev->irq, iwl3945_isr, IRQF_SHARED,
+        err = request_irq(priv->pci_dev->irq, iwl_isr, IRQF_SHARED,
                           DRV_NAME, priv);
         if (err) {
                 IWL_ERR(priv, "Error allocating IRQ %d\n", priv->pci_dev->irq);
@@ -5621,7 +5222,7 @@ static void __devexit iwl3945_pci_remove(struct pci_dev *pdev)
          * tasklet for the driver
          */
         spin_lock_irqsave(&priv->lock, flags);
-        iwl3945_disable_interrupts(priv);
+        iwl_disable_interrupts(priv);
         spin_unlock_irqrestore(&priv->lock, flags);
 
         iwl_synchronize_irq(priv);
diff --git a/drivers/net/wireless/libertas/defs.h b/drivers/net/wireless/libertas/defs.h
index 6388b05df4fc..e8dfde39abfc 100644
--- a/drivers/net/wireless/libertas/defs.h
+++ b/drivers/net/wireless/libertas/defs.h
@@ -265,6 +265,7 @@ static inline void lbs_deb_hex(unsigned int grp, const char *prompt, u8 *buf, in
 
 #define CMD_F_HOSTCMD           (1 << 0)
 #define FW_CAPINFO_WPA          (1 << 0)
+#define FW_CAPINFO_PS           (1 << 1)
 #define FW_CAPINFO_FIRMWARE_UPGRADE     (1 << 13)
 #define FW_CAPINFO_BOOT2_UPGRADE        (1<<14)
 #define FW_CAPINFO_PERSISTENT_CONFIG    (1<<15)
diff --git a/drivers/net/wireless/libertas/if_sdio.c b/drivers/net/wireless/libertas/if_sdio.c
index 4519d7314f47..76f4c653d641 100644
--- a/drivers/net/wireless/libertas/if_sdio.c
+++ b/drivers/net/wireless/libertas/if_sdio.c
@@ -95,6 +95,8 @@ struct if_sdio_card {
 
         spinlock_t              lock;
         struct if_sdio_packet   *packets;
+
+        struct workqueue_struct *workqueue;
         struct work_struct      packet_worker;
 };
 
@@ -209,6 +211,9 @@ static int if_sdio_handle_event(struct if_sdio_card *card,
                 event = sdio_readb(card->func, IF_SDIO_EVENT, &ret);
                 if (ret)
                         goto out;
+
+                /* right shift 3 bits to get the event id */
+                event >>= 3;
         } else {
                 if (size < 4) {
                         lbs_deb_sdio("event packet too small (%d bytes)\n",
@@ -743,7 +748,7 @@ static int if_sdio_host_to_card(struct lbs_private *priv,
 
         spin_unlock_irqrestore(&card->lock, flags);
 
-        schedule_work(&card->packet_worker);
+        queue_work(card->workqueue, &card->packet_worker);
 
         ret = 0;
 
@@ -833,6 +838,7 @@ static int if_sdio_probe(struct sdio_func *func,
         card->func = func;
         card->model = model;
         spin_lock_init(&card->lock);
+        card->workqueue = create_workqueue("libertas_sdio");
         INIT_WORK(&card->packet_worker, if_sdio_host_to_card_worker);
 
         for (i = 0;i < ARRAY_SIZE(if_sdio_models);i++) {
@@ -921,15 +927,17 @@ static int if_sdio_probe(struct sdio_func *func,
         if (ret)
                 goto err_activate_card;
 
+        if (priv->fwcapinfo & FW_CAPINFO_PS)
+                priv->ps_supported = 1;
+
 out:
         lbs_deb_leave_args(LBS_DEB_SDIO, "ret %d", ret);
 
         return ret;
 
 err_activate_card:
-        flush_scheduled_work();
-        free_netdev(priv->dev);
-        kfree(priv);
+        flush_workqueue(card->workqueue);
+        lbs_remove_card(priv);
 reclaim:
         sdio_claim_host(func);
 release_int:
@@ -939,6 +947,7 @@ disable:
 release:
         sdio_release_host(func);
 free:
+        destroy_workqueue(card->workqueue);
         while (card->packets) {
                 packet = card->packets;
                 card->packets = card->packets->next;
@@ -965,7 +974,8 @@ static void if_sdio_remove(struct sdio_func *func)
         lbs_stop_card(card->priv);
         lbs_remove_card(card->priv);
 
-        flush_scheduled_work();
+        flush_workqueue(card->workqueue);
+        destroy_workqueue(card->workqueue);
 
         sdio_claim_host(func);
         sdio_release_irq(func);
diff --git a/drivers/net/wireless/orinoco/fw.c b/drivers/net/wireless/orinoco/fw.c
index 7d2292d6ce09..e7abb45d6753 100644
--- a/drivers/net/wireless/orinoco/fw.c
+++ b/drivers/net/wireless/orinoco/fw.c
@@ -43,6 +43,33 @@ struct orinoco_fw_header {
         char signature[0];      /* FW signature length headersize-20 */
 } __attribute__ ((packed));
 
+/* Check the range of various header entries. Return a pointer to a
+ * description of the problem, or NULL if everything checks out. */
+static const char *validate_fw(const struct orinoco_fw_header *hdr, size_t len)
+{
+        u16 hdrsize;
+
+        if (len < sizeof(*hdr))
+                return "image too small";
+        if (memcmp(hdr->hdr_vers, "HFW", 3) != 0)
+                return "format not recognised";
+
+        hdrsize = le16_to_cpu(hdr->headersize);
+        if (hdrsize > len)
+                return "bad headersize";
+        if ((hdrsize + le32_to_cpu(hdr->block_offset)) > len)
+                return "bad block offset";
+        if ((hdrsize + le32_to_cpu(hdr->pdr_offset)) > len)
+                return "bad PDR offset";
+        if ((hdrsize + le32_to_cpu(hdr->pri_offset)) > len)
+                return "bad PRI offset";
+        if ((hdrsize + le32_to_cpu(hdr->compat_offset)) > len)
+                return "bad compat offset";
+
+        /* TODO: consider adding a checksum or CRC to the firmware format */
+        return NULL;
+}
+
 /* Download either STA or AP firmware into the card. */
 static int
 orinoco_dl_firmware(struct orinoco_private *priv,
@@ -56,8 +83,9 @@ orinoco_dl_firmware(struct orinoco_private *priv,
         const struct firmware *fw_entry;
         const struct orinoco_fw_header *hdr;
         const unsigned char *first_block;
-        const unsigned char *end;
+        const void *end;
         const char *firmware;
+        const char *fw_err;
         struct net_device *dev = priv->ndev;
         int err = 0;
 
@@ -93,6 +121,15 @@ orinoco_dl_firmware(struct orinoco_private *priv,
 
         hdr = (const struct orinoco_fw_header *) fw_entry->data;
 
+        fw_err = validate_fw(hdr, fw_entry->size);
+        if (fw_err) {
+                printk(KERN_WARNING "%s: Invalid firmware image detected (%s). "
+                       "Aborting download\n",
+                       dev->name, fw_err);
+                err = -EINVAL;
+                goto abort;
+        }
+
         /* Enable aux port to allow programming */
         err = hermesi_program_init(hw, le32_to_cpu(hdr->entry_point));
         printk(KERN_DEBUG "%s: Program init returned %d\n", dev->name, err);
@@ -115,7 +152,8 @@ orinoco_dl_firmware(struct orinoco_private *priv,
                        le16_to_cpu(hdr->headersize) +
                        le32_to_cpu(hdr->pdr_offset));
 
-        err = hermes_apply_pda_with_defaults(hw, first_block, pda);
+        err = hermes_apply_pda_with_defaults(hw, first_block, end, pda,
+                                             &pda[fw->pda_size / sizeof(*pda)]);
         printk(KERN_DEBUG "%s: Apply PDA returned %d\n", dev->name, err);
         if (err)
                 goto abort;
@@ -147,7 +185,7 @@ free:
  */
 static int
 symbol_dl_image(struct orinoco_private *priv, const struct fw_info *fw,
-                const unsigned char *image, const unsigned char *end,
+                const unsigned char *image, const void *end,
                 int secondary)
 {
         hermes_t *hw = &priv->hw;
@@ -188,9 +226,10 @@ symbol_dl_image(struct orinoco_private *priv, const struct fw_info *fw,
 
         /* Write the PDA to the adapter */
         if (secondary) {
-                size_t len = hermes_blocks_length(first_block);
+                size_t len = hermes_blocks_length(first_block, end);
                 ptr = first_block + len;
-                ret = hermes_apply_pda(hw, ptr, pda);
+                ret = hermes_apply_pda(hw, ptr, end, pda,
+                                       &pda[fw->pda_size / sizeof(*pda)]);
                 kfree(pda);
                 if (ret)
                         return ret;
diff --git a/drivers/net/wireless/orinoco/hermes_dld.c b/drivers/net/wireless/orinoco/hermes_dld.c
index 5260ceb5cfec..a9ba195cdada 100644
--- a/drivers/net/wireless/orinoco/hermes_dld.c
+++ b/drivers/net/wireless/orinoco/hermes_dld.c
@@ -71,18 +71,6 @@
 #define BLOCK_END       0xFFFFFFFF      /* Last image block */
 #define TEXT_END        0x1A            /* End of text header */
 
-/*
- * PDA == Production Data Area
- *
- * In principle, the max. size of the PDA is is 4096 words. Currently,
- * however, only about 500 bytes of this area are used.
- *
- * Some USB implementations can't handle sizes in excess of 1016. Note
- * that PDA is not actually used in those USB environments, but may be
- * retrieved by common code.
- */
-#define MAX_PDA_SIZE    1000
-
 /* Limit the amout we try to download in a single shot.
  * Size is in bytes.
  */
@@ -218,13 +206,14 @@ hermes_aux_control(hermes_t *hw, int enabled)
  * Scan PDR for the record with the specified RECORD_ID.
  * If it's not found, return NULL.
  */
-static struct pdr *
-hermes_find_pdr(struct pdr *first_pdr, u32 record_id)
+static const struct pdr *
+hermes_find_pdr(const struct pdr *first_pdr, u32 record_id, const void *end)
 {
-        struct pdr *pdr = first_pdr;
-        void *end = (void *)first_pdr + MAX_PDA_SIZE;
+        const struct pdr *pdr = first_pdr;
 
-        while (((void *)pdr < end) &&
+        end -= sizeof(struct pdr);
+
+        while (((void *) pdr <= end) &&
                (pdr_id(pdr) != PDI_END)) {
                 /*
                  * PDR area is currently not terminated by PDI_END.
@@ -244,12 +233,15 @@ hermes_find_pdr(struct pdr *first_pdr, u32 record_id)
 }
 
 /* Scan production data items for a particular entry */
-static struct pdi *
-hermes_find_pdi(struct pdi *first_pdi, u32 record_id)
+static const struct pdi *
+hermes_find_pdi(const struct pdi *first_pdi, u32 record_id, const void *end)
 {
-        struct pdi *pdi = first_pdi;
+        const struct pdi *pdi = first_pdi;
+
+        end -= sizeof(struct pdi);
 
-        while (pdi_id(pdi) != PDI_END) {
+        while (((void *) pdi <= end) &&
+               (pdi_id(pdi) != PDI_END)) {
 
                 /* If the record ID matches, we are done */
                 if (pdi_id(pdi) == record_id)
@@ -262,12 +254,13 @@ hermes_find_pdi(struct pdi *first_pdi, u32 record_id)
 
 /* Process one Plug Data Item - find corresponding PDR and plug it */
 static int
-hermes_plug_pdi(hermes_t *hw, struct pdr *first_pdr, const struct pdi *pdi)
+hermes_plug_pdi(hermes_t *hw, const struct pdr *first_pdr,
+                const struct pdi *pdi, const void *pdr_end)
 {
-        struct pdr *pdr;
+        const struct pdr *pdr;
 
         /* Find the PDR corresponding to this PDI */
-        pdr = hermes_find_pdr(first_pdr, pdi_id(pdi));
+        pdr = hermes_find_pdr(first_pdr, pdi_id(pdi), pdr_end);
 
         /* No match is found, safe to ignore */
         if (!pdr)
@@ -345,18 +338,22 @@ int hermes_read_pda(hermes_t *hw,
  */
 int hermes_apply_pda(hermes_t *hw,
                      const char *first_pdr,
-                     const __le16 *pda)
+                     const void *pdr_end,
+                     const __le16 *pda,
+                     const void *pda_end)
 {
         int ret;
         const struct pdi *pdi;
-        struct pdr *pdr;
+        const struct pdr *pdr;
 
-        pdr = (struct pdr *) first_pdr;
+        pdr = (const struct pdr *) first_pdr;
+        pda_end -= sizeof(struct pdi);
 
         /* Go through every PDI and plug them into the adapter */
         pdi = (const struct pdi *) (pda + 2);
-        while (pdi_id(pdi) != PDI_END) {
-                ret = hermes_plug_pdi(hw, pdr, pdi);
+        while (((void *) pdi <= pda_end) &&
+               (pdi_id(pdi) != PDI_END)) {
+                ret = hermes_plug_pdi(hw, pdr, pdi, pdr_end);
                 if (ret)
                         return ret;
 
@@ -370,15 +367,18 @@ int hermes_apply_pda(hermes_t *hw,
  * including the header data.
  */
 size_t
-hermes_blocks_length(const char *first_block)
+hermes_blocks_length(const char *first_block, const void *end)
 {
         const struct dblock *blk = (const struct dblock *) first_block;
         int total_len = 0;
         int len;
 
+        end -= sizeof(*blk);
+
         /* Skip all blocks to locate Plug Data References
          * (Spectrum CS) */
-        while (dblock_addr(blk) != BLOCK_END) {
+        while (((void *) blk <= end) &&
+               (dblock_addr(blk) != BLOCK_END)) {
                 len = dblock_len(blk);
                 total_len += sizeof(*blk) + len;
                 blk = (struct dblock *) &blk->data[len];
@@ -476,7 +476,7 @@ int hermesi_program_end(hermes_t *hw)
 }
 
 /* Program the data blocks */
-int hermes_program(hermes_t *hw, const char *first_block, const char *end)
+int hermes_program(hermes_t *hw, const char *first_block, const void *end)
 {
         const struct dblock *blk;
         u32 blkaddr;
@@ -488,14 +488,14 @@ int hermes_program(hermes_t *hw, const char *first_block, const char *end)
 
         blk = (const struct dblock *) first_block;
 
-        if ((const char *) blk > (end - sizeof(*blk)))
+        if ((void *) blk > (end - sizeof(*blk)))
                 return -EIO;
 
         blkaddr = dblock_addr(blk);
         blklen = dblock_len(blk);
 
         while ((blkaddr != BLOCK_END) &&
-               (((const char *) blk + blklen) <= end)) {
+               (((void *) blk + blklen) <= end)) {
                 printk(KERN_DEBUG PFX
                        "Programming block of length %d to address 0x%08x\n",
                        blklen, blkaddr);
@@ -527,7 +527,7 @@ int hermes_program(hermes_t *hw, const char *first_block, const char *end)
 #endif
                 blk = (const struct dblock *) &blk->data[blklen];
 
-                if ((const char *) blk > (end - sizeof(*blk)))
+                if ((void *) blk > (end - sizeof(*blk)))
                         return -EIO;
 
                 blkaddr = dblock_addr(blk);
@@ -545,9 +545,9 @@ static const struct {							\
         __le16 id;                                                      \
         u8 val[length];                                                 \
 } __attribute__ ((packed)) default_pdr_data_##pid = {                   \
-        cpu_to_le16((sizeof(default_pdr_data_##pid)/            \
+        cpu_to_le16((sizeof(default_pdr_data_##pid)/                    \
                                 sizeof(__le16)) - 1),                   \
-        cpu_to_le16(pid),                                       \
+        cpu_to_le16(pid),                                               \
         data                                                            \
 }
 
@@ -616,17 +616,20 @@ DEFINE_DEFAULT_PDR(0x0161, 256,
  */
 int hermes_apply_pda_with_defaults(hermes_t *hw,
                                    const char *first_pdr,
-                                   const __le16 *pda)
+                                   const void *pdr_end,
+                                   const __le16 *pda,
+                                   const void *pda_end)
 {
         const struct pdr *pdr = (const struct pdr *) first_pdr;
-        struct pdi *first_pdi = (struct pdi *) &pda[2];
-        struct pdi *pdi;
-        struct pdi *default_pdi = NULL;
-        struct pdi *outdoor_pdi;
-        void *end = (void *)first_pdr + MAX_PDA_SIZE;
+        const struct pdi *first_pdi = (const struct pdi *) &pda[2];
+        const struct pdi *pdi;
+        const struct pdi *default_pdi = NULL;
+        const struct pdi *outdoor_pdi;
         int record_id;
 
-        while (((void *)pdr < end) &&
+        pdr_end -= sizeof(struct pdr);
+
+        while (((void *) pdr <= pdr_end) &&
                (pdr_id(pdr) != PDI_END)) {
                 /*
                  * For spectrum_cs firmwares,
@@ -638,7 +641,7 @@ int hermes_apply_pda_with_defaults(hermes_t *hw,
                         break;
                 record_id = pdr_id(pdr);
 
-                pdi = hermes_find_pdi(first_pdi, record_id);
+                pdi = hermes_find_pdi(first_pdi, record_id, pda_end);
                 if (pdi)
                         printk(KERN_DEBUG PFX "Found record 0x%04x at %p\n",
                                record_id, pdi);
@@ -646,7 +649,8 @@ int hermes_apply_pda_with_defaults(hermes_t *hw,
                 switch (record_id) {
                 case 0x110: /* Modem REFDAC values */
                 case 0x120: /* Modem VGDAC values */
-                        outdoor_pdi = hermes_find_pdi(first_pdi, record_id + 1);
+                        outdoor_pdi = hermes_find_pdi(first_pdi, record_id + 1,
+                                                      pda_end);
                         default_pdi = NULL;
                         if (outdoor_pdi) {
                                 pdi = outdoor_pdi;
@@ -687,7 +691,8 @@ int hermes_apply_pda_with_defaults(hermes_t *hw,
 
                 if (pdi) {
                         /* Lengths of the data in PDI and PDR must match */
-                        if (pdi_len(pdi) == pdr_len(pdr)) {
+                        if ((pdi_len(pdi) == pdr_len(pdr)) &&
+                            ((void *) pdi->data + pdi_len(pdi) < pda_end)) {
                                 /* do the actual plugging */
                                 hermes_aux_setaddr(hw, pdr_addr(pdr));
                                 hermes_write_bytes(hw, HERMES_AUXDATA,
diff --git a/drivers/net/wireless/orinoco/hermes_dld.h b/drivers/net/wireless/orinoco/hermes_dld.h
index 6fcb26277999..583a5bcf9175 100644
--- a/drivers/net/wireless/orinoco/hermes_dld.h
+++ b/drivers/net/wireless/orinoco/hermes_dld.h
@@ -29,7 +29,7 @@
 
 int hermesi_program_init(hermes_t *hw, u32 offset);
 int hermesi_program_end(hermes_t *hw);
-int hermes_program(hermes_t *hw, const char *first_block, const char *end);
+int hermes_program(hermes_t *hw, const char *first_block, const void *end);
 
 int hermes_read_pda(hermes_t *hw,
                     __le16 *pda,
@@ -38,11 +38,15 @@ int hermes_read_pda(hermes_t *hw,
                     int use_eeprom);
 int hermes_apply_pda(hermes_t *hw,
                      const char *first_pdr,
-                     const __le16 *pda);
+                     const void *pdr_end,
+                     const __le16 *pda,
+                     const void *pda_end);
 int hermes_apply_pda_with_defaults(hermes_t *hw,
                                    const char *first_pdr,
-                                   const __le16 *pda);
+                                   const void *pdr_end,
+                                   const __le16 *pda,
+                                   const void *pda_end);
 
-size_t hermes_blocks_length(const char *first_block);
+size_t hermes_blocks_length(const char *first_block, const void *end);
 
 #endif /* _HERMES_DLD_H */
diff --git a/drivers/net/wireless/p54/p54common.c b/drivers/net/wireless/p54/p54common.c
index 45c2e7ad3acd..fcf43bcae979 100644
--- a/drivers/net/wireless/p54/p54common.c
+++ b/drivers/net/wireless/p54/p54common.c
@@ -2212,8 +2212,8 @@ static void p54_configure_filter(struct ieee80211_hw *dev,
 
         *total_flags &= FIF_PROMISC_IN_BSS |
                         FIF_OTHER_BSS |
-                        (*total_flags & FIF_PROMISC_IN_BSS) ?
-                                FIF_FCSFAIL : 0;
+                        (*total_flags & FIF_PROMISC_IN_BSS ?
+                                FIF_FCSFAIL : 0);
 
         priv->filter_flags = *total_flags;
 
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.c b/drivers/net/wireless/rt2x00/rt2400pci.c
index b0848259b455..0f08773328c6 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.c
+++ b/drivers/net/wireless/rt2x00/rt2400pci.c
@@ -114,9 +114,6 @@ static void rt2400pci_rf_write(struct rt2x00_dev *rt2x00dev,
 {
         u32 reg;
 
-        if (!word)
-                return;
-
         mutex_lock(&rt2x00dev->csr_mutex);
 
         /*
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.h b/drivers/net/wireless/rt2x00/rt2400pci.h
index 72ac31c3cb75..ec3b004ddc3c 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.h
+++ b/drivers/net/wireless/rt2x00/rt2400pci.h
@@ -48,8 +48,8 @@
 #define EEPROM_SIZE                     0x0100
 #define BBP_BASE                        0x0000
 #define BBP_SIZE                        0x0020
-#define RF_BASE                         0x0000
-#define RF_SIZE                         0x0010
+#define RF_BASE                         0x0004
+#define RF_SIZE                         0x000c
 
 /*
  * Number of TX queues.
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index eb82860c54f9..276a8232aaa0 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -114,9 +114,6 @@ static void rt2500pci_rf_write(struct rt2x00_dev *rt2x00dev,
 {
         u32 reg;
 
-        if (!word)
-                return;
-
         mutex_lock(&rt2x00dev->csr_mutex);
 
         /*
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.h b/drivers/net/wireless/rt2x00/rt2500pci.h
index 17a0c9c8c184..ce2f065c7486 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.h
+++ b/drivers/net/wireless/rt2x00/rt2500pci.h
@@ -59,8 +59,8 @@
 #define EEPROM_SIZE                     0x0200
 #define BBP_BASE                        0x0000
 #define BBP_SIZE                        0x0040
-#define RF_BASE                         0x0000
-#define RF_SIZE                         0x0014
+#define RF_BASE                         0x0004
+#define RF_SIZE                         0x0010
 
 /*
  * Number of TX queues.
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index 270691ac2361..ca280674180e 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -204,9 +204,6 @@ static void rt2500usb_rf_write(struct rt2x00_dev *rt2x00dev,
 {
         u16 reg;
 
-        if (!word)
-                return;
-
         mutex_lock(&rt2x00dev->csr_mutex);
 
         /*
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.h b/drivers/net/wireless/rt2x00/rt2500usb.h
index afce0e0322c3..5bc46fe72179 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.h
+++ b/drivers/net/wireless/rt2x00/rt2500usb.h
@@ -59,8 +59,8 @@
 #define EEPROM_SIZE                     0x006a
 #define BBP_BASE                        0x0000
 #define BBP_SIZE                        0x0060
-#define RF_BASE                         0x0000
-#define RF_SIZE                         0x0014
+#define RF_BASE                         0x0004
+#define RF_SIZE                         0x0010
 
 /*
  * Number of TX queues.
diff --git a/drivers/net/wireless/rt2x00/rt2x00debug.c b/drivers/net/wireless/rt2x00/rt2x00debug.c
index dcdce7f746b5..8d47389d8874 100644
--- a/drivers/net/wireless/rt2x00/rt2x00debug.c
+++ b/drivers/net/wireless/rt2x00/rt2x00debug.c
@@ -435,11 +435,12 @@ static ssize_t rt2x00debug_read_##__name(struct file *file,	\
         if (index >= debug->__name.word_count)                  \
                 return -EINVAL;                                 \
                                                                 \
+        index += (debug->__name.word_base /                     \
+                  debug->__name.word_size);                     \
+                                                                \
         if (debug->__name.flags & RT2X00DEBUGFS_OFFSET)         \
                 index *= debug->__name.word_size;               \
                                                                 \
-        index += debug->__name.word_base;                       \
-                                                                \
         debug->__name.read(intf->rt2x00dev, index, &value);     \
                                                                 \
         size = sprintf(line, __format, value);                  \
@@ -476,11 +477,12 @@ static ssize_t rt2x00debug_write_##__name(struct file *file,	\
         size = strlen(line);                                    \
         value = simple_strtoul(line, NULL, 0);                  \
                                                                 \
+        index += (debug->__name.word_base /                     \
+                  debug->__name.word_size);                     \
+                                                                \
         if (debug->__name.flags & RT2X00DEBUGFS_OFFSET)         \
                 index *= debug->__name.word_size;               \
                                                                 \
-        index += debug->__name.word_base;                       \
-                                                                \
         debug->__name.write(intf->rt2x00dev, index, value);     \
                                                                 \
         *offset += size;                                        \
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index 0be147f364e7..2ca8b7a9722c 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -123,9 +123,6 @@ static void rt61pci_rf_write(struct rt2x00_dev *rt2x00dev,
 {
         u32 reg;
 
-        if (!word)
-                return;
-
         mutex_lock(&rt2x00dev->csr_mutex);
 
         /*
diff --git a/drivers/net/wireless/rt2x00/rt61pci.h b/drivers/net/wireless/rt2x00/rt61pci.h
index 2f97fee7a8de..41e8959919f6 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.h
+++ b/drivers/net/wireless/rt2x00/rt61pci.h
@@ -50,8 +50,8 @@
 #define EEPROM_SIZE                     0x0100
 #define BBP_BASE                        0x0000
 #define BBP_SIZE                        0x0080
-#define RF_BASE                         0x0000
-#define RF_SIZE                         0x0014
+#define RF_BASE                         0x0004
+#define RF_SIZE                         0x0010
 
 /*
  * Number of TX queues.
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index 6521dac7ec4a..90ace51ab496 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -122,9 +122,6 @@ static void rt73usb_rf_write(struct rt2x00_dev *rt2x00dev,
 {
         u32 reg;
 
-        if (!word)
-                return;
-
         mutex_lock(&rt2x00dev->csr_mutex);
 
         /*
@@ -2241,13 +2238,6 @@ static int rt73usb_conf_tx(struct ieee80211_hw *hw, u16 queue_idx,
         return 0;
 }
 
-#if 0
-/*
- * Mac80211 demands get_tsf must be atomic.
- * This is not possible for rt73usb since all register access
- * functions require sleeping. Untill mac80211 no longer needs
- * get_tsf to be atomic, this function should be disabled.
- */
 static u64 rt73usb_get_tsf(struct ieee80211_hw *hw)
 {
         struct rt2x00_dev *rt2x00dev = hw->priv;
@@ -2261,9 +2251,6 @@ static u64 rt73usb_get_tsf(struct ieee80211_hw *hw)
 
         return tsf;
 }
-#else
-#define rt73usb_get_tsf NULL
-#endif
 
 static const struct ieee80211_ops rt73usb_mac80211_ops = {
         .tx                     = rt2x00mac_tx,
@@ -2355,6 +2342,9 @@ static const struct rt2x00_ops rt73usb_ops = {
 static struct usb_device_id rt73usb_device_table[] = {
         /* AboCom */
         { USB_DEVICE(0x07b8, 0xb21d), USB_DEVICE_DATA(&rt73usb_ops) },
+        /* Amigo */
+        { USB_DEVICE(0x148f, 0x9021), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x0eb0, 0x9021), USB_DEVICE_DATA(&rt73usb_ops) },
         /* Askey */
         { USB_DEVICE(0x1690, 0x0722), USB_DEVICE_DATA(&rt73usb_ops) },
         /* ASUS */
@@ -2402,6 +2392,7 @@ static struct usb_device_id rt73usb_device_table[] = {
         { USB_DEVICE(0x0db0, 0xa861), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x0db0, 0xa874), USB_DEVICE_DATA(&rt73usb_ops) },
         /* Ralink */
+        { USB_DEVICE(0x04bb, 0x093d), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x148f, 0x2573), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x148f, 0x2671), USB_DEVICE_DATA(&rt73usb_ops) },
         /* Qcom */
@@ -2418,6 +2409,8 @@ static struct usb_device_id rt73usb_device_table[] = {
         /* Planex */
         { USB_DEVICE(0x2019, 0xab01), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x2019, 0xab50), USB_DEVICE_DATA(&rt73usb_ops) },
+        /* ZyXEL */
+        { USB_DEVICE(0x0586, 0x3415), USB_DEVICE_DATA(&rt73usb_ops) },
         { 0, }
 };
 
diff --git a/drivers/net/wireless/rt2x00/rt73usb.h b/drivers/net/wireless/rt2x00/rt73usb.h
index 834b28ce6cde..c8016f65b4bd 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.h
+++ b/drivers/net/wireless/rt2x00/rt73usb.h
@@ -50,8 +50,8 @@
 #define EEPROM_SIZE                     0x0100
 #define BBP_BASE                        0x0000
 #define BBP_SIZE                        0x0080
-#define RF_BASE                         0x0000
-#define RF_SIZE                         0x0014
+#define RF_BASE                         0x0004
+#define RF_SIZE                         0x0010
 
 /*
  * Number of TX queues.
diff --git a/drivers/net/wireless/wavelan.c b/drivers/net/wireless/wavelan.c
index 688bdea8f13a..b728541f2fb5 100644
--- a/drivers/net/wireless/wavelan.c
+++ b/drivers/net/wireless/wavelan.c
@@ -4281,8 +4281,7 @@ int __init init_module(void)
 
 
         /* Loop on all possible base addresses. */
-        i = -1;
-        while ((io[++i] != 0) && (i < ARRAY_SIZE(io))) {
+        for (i = 0; i < ARRAY_SIZE(io) && io[i] != 0; i++) {
                 struct net_device *dev = alloc_etherdev(sizeof(net_local));
                 if (!dev)
                         break;
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.c b/drivers/net/wireless/zd1211rw/zd_mac.c
index 7579af27edbd..da9214e33a5f 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.c
+++ b/drivers/net/wireless/zd1211rw/zd_mac.c
@@ -170,10 +170,10 @@ int zd_mac_init_hw(struct ieee80211_hw *hw)
                 goto disable_int;
 
         r = zd_reg2alpha2(mac->regdomain, alpha2);
-        if (!r)
-                regulatory_hint(hw->wiphy, alpha2);
+        if (r)
+                goto disable_int;
 
-        r = 0;
+        r = regulatory_hint(hw->wiphy, alpha2);
 disable_int:
         zd_chip_disable_int(chip);
 out:
diff --git a/include/linux/nl80211.h b/include/linux/nl80211.h
index 8802d1bda382..f6e56370ea65 100644
--- a/include/linux/nl80211.h
+++ b/include/linux/nl80211.h
@@ -526,6 +526,9 @@ enum nl80211_rate_info {
  * @NL80211_STA_INFO_SIGNAL: signal strength of last received PPDU (u8, dBm)
  * @NL80211_STA_INFO_TX_BITRATE: current unicast tx rate, nested attribute
  *      containing info as possible, see &enum nl80211_sta_info_txrate.
+ * @NL80211_STA_INFO_RX_PACKETS: total received packet (u32, from this station)
+ * @NL80211_STA_INFO_TX_PACKETS: total transmitted packets (u32, to this
+ *      station)
  */
 enum nl80211_sta_info {
         __NL80211_STA_INFO_INVALID,
@@ -537,6 +540,8 @@ enum nl80211_sta_info {
         NL80211_STA_INFO_PLINK_STATE,
         NL80211_STA_INFO_SIGNAL,
         NL80211_STA_INFO_TX_BITRATE,
+        NL80211_STA_INFO_RX_PACKETS,
+        NL80211_STA_INFO_TX_PACKETS,
 
         /* keep last */
         __NL80211_STA_INFO_AFTER_LAST,
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index c0d1f5b708c5..75fa556728ce 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -178,6 +178,8 @@ struct station_parameters {
  * @STATION_INFO_SIGNAL: @signal filled
  * @STATION_INFO_TX_BITRATE: @tx_bitrate fields are filled
  *  (tx_bitrate, tx_bitrate_flags and tx_bitrate_mcs)
+ * @STATION_INFO_RX_PACKETS: @rx_packets filled
+ * @STATION_INFO_TX_PACKETS: @tx_packets filled
  */
 enum station_info_flags {
         STATION_INFO_INACTIVE_TIME      = 1<<0,
@@ -188,6 +190,8 @@ enum station_info_flags {
         STATION_INFO_PLINK_STATE        = 1<<5,
         STATION_INFO_SIGNAL             = 1<<6,
         STATION_INFO_TX_BITRATE         = 1<<7,
+        STATION_INFO_RX_PACKETS         = 1<<8,
+        STATION_INFO_TX_PACKETS         = 1<<9,
 };
 
 /**
@@ -235,6 +239,8 @@ struct rate_info {
  * @plink_state: mesh peer link state
  * @signal: signal strength of last received packet in dBm
  * @txrate: current unicast bitrate to this station
+ * @rx_packets: packets received from this station
+ * @tx_packets: packets transmitted to this station
  */
 struct station_info {
         u32 filled;
@@ -246,6 +252,8 @@ struct station_info {
         u8 plink_state;
         s8 signal;
         struct rate_info txrate;
+        u32 rx_packets;
+        u32 tx_packets;
 };
 
 /**
@@ -375,9 +383,9 @@ enum environment_cap {
 };
 
 /**
- * struct regulatory_request - receipt of last regulatory request
+ * struct regulatory_request - used to keep track of regulatory requests
  *
- * @wiphy: this is set if this request's initiator is
+ * @wiphy_idx: this is set if this request's initiator is
  *      %REGDOM_SET_BY_COUNTRY_IE or %REGDOM_SET_BY_DRIVER. This
  *      can be used by the wireless core to deal with conflicts
  *      and potentially inform users of which devices specifically
@@ -396,14 +404,16 @@ enum environment_cap {
  *      country IE
  * @country_ie_env: lets us know if the AP is telling us we are outdoor,
  *      indoor, or if it doesn't matter
+ * @list: used to insert into the reg_requests_list linked list
  */
 struct regulatory_request {
-        struct wiphy *wiphy;
+        int wiphy_idx;
         enum reg_set_by initiator;
         char alpha2[2];
         bool intersect;
         u32 country_ie_checksum;
         enum environment_cap country_ie_env;
+        struct list_head list;
 };
 
 struct ieee80211_freq_range {
@@ -525,6 +535,8 @@ struct cfg80211_ssid {
  * @n_ssids: number of SSIDs
  * @channels: channels to scan on.
  * @n_channels: number of channels for each band
+ * @ie: optional information element(s) to add into Probe Request or %NULL
+ * @ie_len: length of ie in octets
  * @wiphy: the wiphy this was for
  * @ifidx: the interface index
  */
@@ -533,6 +545,8 @@ struct cfg80211_scan_request {
         int n_ssids;
         struct ieee80211_channel **channels;
         u32 n_channels;
+        u8 *ie;
+        size_t ie_len;
 
         /* internal */
         struct wiphy *wiphy;
@@ -565,8 +579,7 @@ enum cfg80211_signal_type {
  * @information_elements: the information elements (Note that there
  *      is no guarantee that these are well-formed!)
  * @len_information_elements: total length of the information elements
- * @signal: signal strength value
- * @signal_type: signal type
+ * @signal: signal strength value (type depends on the wiphy's signal_type)
  * @free_priv: function pointer to free private data
  * @priv: private area for driver use, has at least wiphy->bss_priv_size bytes
  */
@@ -581,7 +594,6 @@ struct cfg80211_bss {
         size_t len_information_elements;
 
         s32 signal;
-        enum cfg80211_signal_type signal_type;
 
         void (*free_priv)(struct cfg80211_bss *bss);
         u8 priv[0] __attribute__((__aligned__(sizeof(void *))));
@@ -755,6 +767,9 @@ int cfg80211_wext_siwscan(struct net_device *dev,
 int cfg80211_wext_giwscan(struct net_device *dev,
                           struct iw_request_info *info,
                           struct iw_point *data, char *extra);
+int cfg80211_wext_giwrange(struct net_device *dev,
+                           struct iw_request_info *info,
+                           struct iw_point *data, char *extra);
 
 /**
  * cfg80211_scan_done - notify that scan finished
@@ -770,6 +785,7 @@ void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted);
  *
  * @wiphy: the wiphy reporting the BSS
  * @bss: the found BSS
+ * @signal: the signal strength, type depends on the wiphy's signal_type
  * @gfp: context flags
  *
  * This informs cfg80211 that BSS information was found and
@@ -779,8 +795,7 @@ struct cfg80211_bss*
 cfg80211_inform_bss_frame(struct wiphy *wiphy,
                           struct ieee80211_channel *channel,
                           struct ieee80211_mgmt *mgmt, size_t len,
-                          s32 signal, enum cfg80211_signal_type sigtype,
-                          gfp_t gfp);
+                          s32 signal, gfp_t gfp);
 
 struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy,
                                       struct ieee80211_channel *channel,
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 88fa3e03e3e9..12a52efcd0d1 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -1022,11 +1022,6 @@ static inline int ieee80211_num_regular_queues(struct ieee80211_hw *hw)
         return hw->queues;
 }
 
-static inline int ieee80211_num_queues(struct ieee80211_hw *hw)
-{
-        return hw->queues + hw->ampdu_queues;
-}
-
 static inline struct ieee80211_rate *
 ieee80211_get_tx_rate(const struct ieee80211_hw *hw,
                       const struct ieee80211_tx_info *c)
@@ -1329,6 +1324,12 @@ enum ieee80211_ampdu_mlme_action {
  *      because the hardware is turned off! Anything else is a bug!
  *      Returns a negative error code which will be seen in userspace.
  *
+ * @sw_scan_start: Notifier function that is called just before a software scan
+ *      is started. Can be NULL, if the driver doesn't need this notification.
+ *
+ * @sw_scan_complete: Notifier function that is called just after a software scan
+ *      finished. Can be NULL, if the driver doesn't need this notification.
+ *
  * @get_stats: Return low-level statistics.
  *      Returns zero if statistics are available.
  *
@@ -1408,6 +1409,8 @@ struct ieee80211_ops {
                         u32 iv32, u16 *phase1key);
         int (*hw_scan)(struct ieee80211_hw *hw,
                        struct cfg80211_scan_request *req);
+        void (*sw_scan_start)(struct ieee80211_hw *hw);
+        void (*sw_scan_complete)(struct ieee80211_hw *hw);
         int (*get_stats)(struct ieee80211_hw *hw,
                          struct ieee80211_low_level_stats *stats);
         void (*get_tkip_seq)(struct ieee80211_hw *hw, u8 hw_key_idx,
@@ -1980,6 +1983,16 @@ struct ieee80211_sta *ieee80211_find_sta(struct ieee80211_hw *hw,
 /* Rate control API */
 
 /**
+ * enum rate_control_changed - flags to indicate which parameter changed
+ *
+ * @IEEE80211_RC_HT_CHANGED: The HT parameters of the operating channel have
+ *      changed, rate control algorithm can update its internal state if needed.
+ */
+enum rate_control_changed {
+        IEEE80211_RC_HT_CHANGED = BIT(0)
+};
+
+/**
  * struct ieee80211_tx_rate_control - rate control information for/from RC algo
  *
  * @hw: The hardware the algorithm is invoked for.
@@ -2015,6 +2028,9 @@ struct rate_control_ops {
         void *(*alloc_sta)(void *priv, struct ieee80211_sta *sta, gfp_t gfp);
         void (*rate_init)(void *priv, struct ieee80211_supported_band *sband,
                           struct ieee80211_sta *sta, void *priv_sta);
+        void (*rate_update)(void *priv, struct ieee80211_supported_band *sband,
+                            struct ieee80211_sta *sta,
+                            void *priv_sta, u32 changed);
         void (*free_sta)(void *priv, struct ieee80211_sta *sta,
                          void *priv_sta);
 
diff --git a/include/net/wireless.h b/include/net/wireless.h
index 1c6285eb1666..64a76208580c 100644
--- a/include/net/wireless.h
+++ b/include/net/wireless.h
@@ -69,6 +69,9 @@ enum ieee80211_channel_flags {
  * @band: band this channel belongs to.
  * @max_antenna_gain: maximum antenna gain in dBi
  * @max_power: maximum transmission power (in dBm)
+ * @beacon_found: helper to regulatory code to indicate when a beacon
+ *      has been found on this channel. Use regulatory_hint_found_beacon()
+ *      to enable this, this is is useful only on 5 GHz band.
  * @orig_mag: internal use
  * @orig_mpwr: internal use
  */
@@ -80,6 +83,7 @@ struct ieee80211_channel {
         u32 flags;
         int max_antenna_gain;
         int max_power;
+        bool beacon_found;
         u32 orig_flags;
         int orig_mag, orig_mpwr;
 };
@@ -200,6 +204,7 @@ struct ieee80211_supported_band {
  *      the regulatory_hint() API. This can be used by the driver
  *      on the reg_notifier() if it chooses to ignore future
  *      regulatory domain changes caused by other drivers.
+ * @signal_type: signal type reported in &struct cfg80211_bss.
  */
 struct wiphy {
         /* assign these fields before you register the wiphy */
@@ -213,6 +218,8 @@ struct wiphy {
         bool custom_regulatory;
         bool strict_regulatory;
 
+        enum cfg80211_signal_type signal_type;
+
         int bss_priv_size;
         u8 max_scan_ssids;
 
@@ -398,8 +405,15 @@ ieee80211_get_response_rate(struct ieee80211_supported_band *sband,
  * domain should be in or by providing a completely build regulatory domain.
  * If the driver provides an ISO/IEC 3166 alpha2 userspace will be queried
  * for a regulatory domain structure for the respective country.
+ *
+ * The wiphy must have been registered to cfg80211 prior to this call.
+ * For cfg80211 drivers this means you must first use wiphy_register(),
+ * for mac80211 drivers you must first use ieee80211_register_hw().
+ *
+ * Drivers should check the return value, its possible you can get
+ * an -ENOMEM.
  */
-extern void regulatory_hint(struct wiphy *wiphy, const char *alpha2);
+extern int regulatory_hint(struct wiphy *wiphy, const char *alpha2);
 
 /**
  * regulatory_hint_11d - hints a country IE as a regulatory domain
@@ -415,7 +429,6 @@ extern void regulatory_hint(struct wiphy *wiphy, const char *alpha2);
 extern void regulatory_hint_11d(struct wiphy *wiphy,
                                 u8 *country_ie,
                                 u8 country_ie_len);
-
 /**
  * wiphy_apply_custom_regulatory - apply a custom driver regulatory domain
  * @wiphy: the wireless device we want to process the regulatory domain on
diff --git a/net/mac80211/Makefile b/net/mac80211/Makefile
index 3503a3d21318..0e3ab88bb706 100644
--- a/net/mac80211/Makefile
+++ b/net/mac80211/Makefile
@@ -9,6 +9,7 @@ mac80211-y := \
         wpa.o \
         scan.o \
         ht.o agg-tx.o agg-rx.o \
+        ibss.o \
         mlme.o \
         iface.o \
         rate.o \
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 3112bfd441b6..a95affc94629 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -129,7 +129,6 @@ static void ieee80211_send_addba_resp(struct ieee80211_sub_if_data *sdata, u8 *d
                                       u8 dialog_token, u16 status, u16 policy,
                                       u16 buf_size, u16 timeout)
 {
-        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
@@ -151,8 +150,9 @@ static void ieee80211_send_addba_resp(struct ieee80211_sub_if_data *sdata, u8 *d
         if (sdata->vif.type == NL80211_IFTYPE_AP ||
             sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
                 memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
-        else
-                memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
+        else if (sdata->vif.type == NL80211_IFTYPE_STATION)
+                memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
+
         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                           IEEE80211_STYPE_ACTION);
 
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 1232d9f01ca9..1df116d4d6e7 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -49,7 +49,6 @@ static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata,
                                          u16 agg_size, u16 timeout)
 {
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
         struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
         u16 capab;
@@ -69,8 +68,8 @@ static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata,
         if (sdata->vif.type == NL80211_IFTYPE_AP ||
             sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
                 memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
-        else
-                memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
+        else if (sdata->vif.type == NL80211_IFTYPE_STATION)
+                memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
 
         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                           IEEE80211_STYPE_ACTION);
@@ -132,9 +131,24 @@ static int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
 
         state = &sta->ampdu_mlme.tid_state_tx[tid];
 
-        if (local->hw.ampdu_queues)
-                ieee80211_stop_queue(&local->hw, sta->tid_to_tx_q[tid]);
+        if (local->hw.ampdu_queues) {
+                if (initiator) {
+                        /*
+                         * Stop the AC queue to avoid issues where we send
+                         * unaggregated frames already before the delba.
+                         */
+                        ieee80211_stop_queue_by_reason(&local->hw,
+                                local->hw.queues + sta->tid_to_tx_q[tid],
+                                IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
+                }
 
+                /*
+                 * Pretend the driver woke the queue, just in case
+                 * it disabled it before the session was stopped.
+                 */
+                ieee80211_wake_queue(
+                        &local->hw, local->hw.queues + sta->tid_to_tx_q[tid]);
+        }
         *state = HT_AGG_STATE_REQ_STOP_BA_MSK |
                 (initiator << HT_AGG_STATE_INITIATOR_SHIFT);
 
@@ -144,8 +158,6 @@ static int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
         /* HW shall not deny going back to legacy */
         if (WARN_ON(ret)) {
                 *state = HT_AGG_STATE_OPERATIONAL;
-                if (local->hw.ampdu_queues)
-                        ieee80211_wake_queue(&local->hw, sta->tid_to_tx_q[tid]);
         }
 
         return ret;
@@ -189,14 +201,19 @@ static void sta_addba_resp_timer_expired(unsigned long data)
         spin_unlock_bh(&sta->lock);
 }
 
+static inline int ieee80211_ac_from_tid(int tid)
+{
+        return ieee802_1d_to_ac[tid & 7];
+}
+
 int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
 {
         struct ieee80211_local *local = hw_to_local(hw);
         struct sta_info *sta;
         struct ieee80211_sub_if_data *sdata;
-        u16 start_seq_num;
         u8 *state;
-        int ret = 0;
+        int i, qn = -1, ret = 0;
+        u16 start_seq_num;
 
         if (WARN_ON(!local->ops->ampdu_action))
                 return -EINVAL;
@@ -209,6 +226,13 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
                ra, tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
 
+        if (hw->ampdu_queues && ieee80211_ac_from_tid(tid) == 0) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "rejecting on voice AC\n");
+#endif
+                return -EINVAL;
+        }
+
         rcu_read_lock();
 
         sta = sta_info_get(local, ra);
@@ -217,7 +241,7 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
                 printk(KERN_DEBUG "Could not find the station\n");
 #endif
                 ret = -ENOENT;
-                goto exit;
+                goto unlock;
         }
 
         /*
@@ -230,11 +254,13 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
             sta->sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
             sta->sdata->vif.type != NL80211_IFTYPE_AP) {
                 ret = -EINVAL;
-                goto exit;
+                goto unlock;
         }
 
         spin_lock_bh(&sta->lock);
 
+        sdata = sta->sdata;
+
         /* we have tried too many times, receiver does not want A-MPDU */
         if (sta->ampdu_mlme.addba_req_num[tid] > HT_AGG_MAX_RETRIES) {
                 ret = -EBUSY;
@@ -252,6 +278,42 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
                 goto err_unlock_sta;
         }
 
+        if (hw->ampdu_queues) {
+                spin_lock(&local->queue_stop_reason_lock);
+                /* reserve a new queue for this session */
+                for (i = 0; i < local->hw.ampdu_queues; i++) {
+                        if (local->ampdu_ac_queue[i] < 0) {
+                                qn = i;
+                                local->ampdu_ac_queue[qn] =
+                                        ieee80211_ac_from_tid(tid);
+                                break;
+                        }
+                }
+                spin_unlock(&local->queue_stop_reason_lock);
+
+                if (qn < 0) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                        printk(KERN_DEBUG "BA request denied - "
+                               "queue unavailable for tid %d\n", tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+                        ret = -ENOSPC;
+                        goto err_unlock_sta;
+                }
+
+                /*
+                 * If we successfully allocate the session, we can't have
+                 * anything going on on the queue this TID maps into, so
+                 * stop it for now. This is a "virtual" stop using the same
+                 * mechanism that drivers will use.
+                 *
+                 * XXX: queue up frames for this session in the sta_info
+                 *      struct instead to avoid hitting all other STAs.
+                 */
+                ieee80211_stop_queue_by_reason(
+                        &local->hw, hw->queues + qn,
+                        IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
+        }
+
         /* prepare A-MPDU MLME for Tx aggregation */
         sta->ampdu_mlme.tid_tx[tid] =
                         kmalloc(sizeof(struct tid_ampdu_tx), GFP_ATOMIC);
@@ -262,8 +324,9 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
                                         tid);
 #endif
                 ret = -ENOMEM;
-                goto err_unlock_sta;
+                goto err_return_queue;
         }
+
         /* Tx timer */
         sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer.function =
                         sta_addba_resp_timer_expired;
@@ -271,49 +334,25 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
                         (unsigned long)&sta->timer_to_tid[tid];
         init_timer(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
 
-        if (hw->ampdu_queues) {
-                /* create a new queue for this aggregation */
-                ret = ieee80211_ht_agg_queue_add(local, sta, tid);
-
-                /* case no queue is available to aggregation
-                 * don't switch to aggregation */
-                if (ret) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                        printk(KERN_DEBUG "BA request denied - "
-                               "queue unavailable for tid %d\n", tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-                        goto err_unlock_queue;
-                }
-        }
-        sdata = sta->sdata;
-
         /* Ok, the Addba frame hasn't been sent yet, but if the driver calls the
          * call back right away, it must see that the flow has begun */
         *state |= HT_ADDBA_REQUESTED_MSK;
 
-        /* This is slightly racy because the queue isn't stopped */
         start_seq_num = sta->tid_seq[tid];
 
         ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_TX_START,
                                        &sta->sta, tid, &start_seq_num);
 
         if (ret) {
-                /* No need to requeue the packets in the agg queue, since we
-                 * held the tx lock: no packet could be enqueued to the newly
-                 * allocated queue */
-                if (hw->ampdu_queues)
-                        ieee80211_ht_agg_queue_remove(local, sta, tid, 0);
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "BA request denied - HW unavailable for"
                                         " tid %d\n", tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
                 *state = HT_AGG_STATE_IDLE;
-                goto err_unlock_queue;
+                goto err_free;
         }
+        sta->tid_to_tx_q[tid] = qn;
 
-        /* Will put all the packets in the new SW queue */
-        if (hw->ampdu_queues)
-                ieee80211_requeue(local, ieee802_1d_to_ac[tid]);
         spin_unlock_bh(&sta->lock);
 
         /* send an addBA request */
@@ -322,7 +361,6 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
                         sta->ampdu_mlme.dialog_token_allocator;
         sta->ampdu_mlme.tid_tx[tid]->ssn = start_seq_num;
 
-
         ieee80211_send_addba_request(sta->sdata, ra, tid,
                          sta->ampdu_mlme.tid_tx[tid]->dialog_token,
                          sta->ampdu_mlme.tid_tx[tid]->ssn,
@@ -334,15 +372,24 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
 #ifdef CONFIG_MAC80211_HT_DEBUG
         printk(KERN_DEBUG "activated addBA response timer on tid %d\n", tid);
 #endif
-        goto exit;
+        goto unlock;
 
-err_unlock_queue:
+ err_free:
         kfree(sta->ampdu_mlme.tid_tx[tid]);
         sta->ampdu_mlme.tid_tx[tid] = NULL;
-        ret = -EBUSY;
-err_unlock_sta:
+ err_return_queue:
+        if (qn >= 0) {
+                /* We failed, so start queue again right away. */
+                ieee80211_wake_queue_by_reason(hw, hw->queues + qn,
+                        IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
+                /* give queue back to pool */
+                spin_lock(&local->queue_stop_reason_lock);
+                local->ampdu_ac_queue[qn] = -1;
+                spin_unlock(&local->queue_stop_reason_lock);
+        }
+ err_unlock_sta:
         spin_unlock_bh(&sta->lock);
-exit:
+ unlock:
         rcu_read_unlock();
         return ret;
 }
@@ -375,7 +422,7 @@ void ieee80211_start_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u16 tid)
         state = &sta->ampdu_mlme.tid_state_tx[tid];
         spin_lock_bh(&sta->lock);
 
-        if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
+        if (WARN_ON(!(*state & HT_ADDBA_REQUESTED_MSK))) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "addBA was not requested yet, state is %d\n",
                                 *state);
@@ -385,7 +432,8 @@ void ieee80211_start_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u16 tid)
                 return;
         }
 
-        WARN_ON_ONCE(*state & HT_ADDBA_DRV_READY_MSK);
+        if (WARN_ON(*state & HT_ADDBA_DRV_READY_MSK))
+                goto out;
 
         *state |= HT_ADDBA_DRV_READY_MSK;
 
@@ -393,9 +441,18 @@ void ieee80211_start_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u16 tid)
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "Aggregation is on for tid %d \n", tid);
 #endif
-                if (hw->ampdu_queues)
-                        ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
+                if (hw->ampdu_queues) {
+                        /*
+                         * Wake up this queue, we stopped it earlier,
+                         * this will in turn wake the entire AC.
+                         */
+                        ieee80211_wake_queue_by_reason(hw,
+                                hw->queues + sta->tid_to_tx_q[tid],
+                                IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
+                }
         }
+
+ out:
         spin_unlock_bh(&sta->lock);
         rcu_read_unlock();
 }
@@ -485,7 +542,6 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u8 tid)
         struct ieee80211_local *local = hw_to_local(hw);
         struct sta_info *sta;
         u8 *state;
-        int agg_queue;
 
         if (tid >= STA_TID_NUM) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
@@ -527,19 +583,19 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u8 tid)
                 ieee80211_send_delba(sta->sdata, ra, tid,
                         WLAN_BACK_INITIATOR, WLAN_REASON_QSTA_NOT_USE);
 
-        if (hw->ampdu_queues) {
-                agg_queue = sta->tid_to_tx_q[tid];
-                ieee80211_ht_agg_queue_remove(local, sta, tid, 1);
+        spin_lock_bh(&sta->lock);
 
-                /* We just requeued the all the frames that were in the
-                 * removed queue, and since we might miss a softirq we do
-                 * netif_schedule_queue.  ieee80211_wake_queue is not used
-                 * here as this queue is not necessarily stopped
+        if (*state & HT_AGG_STATE_INITIATOR_MSK &&
+            hw->ampdu_queues) {
+                /*
+                 * Wake up this queue, we stopped it earlier,
+                 * this will in turn wake the entire AC.
                  */
-                netif_schedule_queue(netdev_get_tx_queue(local->mdev,
-                                                         agg_queue));
+                ieee80211_wake_queue_by_reason(hw,
+                        hw->queues + sta->tid_to_tx_q[tid],
+                        IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
         }
-        spin_lock_bh(&sta->lock);
+
         *state = HT_AGG_STATE_IDLE;
         sta->ampdu_mlme.addba_req_num[tid] = 0;
         kfree(sta->ampdu_mlme.tid_tx[tid]);
@@ -613,12 +669,21 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
 #endif /* CONFIG_MAC80211_HT_DEBUG */
         if (le16_to_cpu(mgmt->u.action.u.addba_resp.status)
                         == WLAN_STATUS_SUCCESS) {
+                u8 curstate = *state;
+
                 *state |= HT_ADDBA_RECEIVED_MSK;
-                sta->ampdu_mlme.addba_req_num[tid] = 0;
 
-                if (*state == HT_AGG_STATE_OPERATIONAL &&
-                    local->hw.ampdu_queues)
-                        ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
+                if (hw->ampdu_queues && *state != curstate &&
+                    *state == HT_AGG_STATE_OPERATIONAL) {
+                        /*
+                         * Wake up this queue, we stopped it earlier,
+                         * this will in turn wake the entire AC.
+                         */
+                        ieee80211_wake_queue_by_reason(hw,
+                                hw->queues + sta->tid_to_tx_q[tid],
+                                IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
+                }
+                sta->ampdu_mlme.addba_req_num[tid] = 0;
 
                 if (local->ops->ampdu_action) {
                         (void)local->ops->ampdu_action(hw,
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index c8d969be440b..c43129efc3bf 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -341,11 +341,15 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
         sinfo->filled = STATION_INFO_INACTIVE_TIME |
                         STATION_INFO_RX_BYTES |
                         STATION_INFO_TX_BYTES |
+                        STATION_INFO_RX_PACKETS |
+                        STATION_INFO_TX_PACKETS |
                         STATION_INFO_TX_BITRATE;
 
         sinfo->inactive_time = jiffies_to_msecs(jiffies - sta->last_rx);
         sinfo->rx_bytes = sta->rx_bytes;
         sinfo->tx_bytes = sta->tx_bytes;
+        sinfo->rx_packets = sta->rx_packets;
+        sinfo->tx_packets = sta->tx_packets;
 
         if (sta->local->hw.flags & IEEE80211_HW_SIGNAL_DBM) {
                 sinfo->filled |= STATION_INFO_SIGNAL;
@@ -1180,45 +1184,45 @@ static int set_mgmt_extra_ie_sta(struct ieee80211_sub_if_data *sdata,
                                  u8 subtype, u8 *ies, size_t ies_len)
 {
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
         switch (subtype) {
         case IEEE80211_STYPE_PROBE_REQ >> 4:
                 if (local->ops->hw_scan)
                         break;
-                kfree(ifsta->ie_probereq);
-                ifsta->ie_probereq = ies;
-                ifsta->ie_probereq_len = ies_len;
+                kfree(ifmgd->ie_probereq);
+                ifmgd->ie_probereq = ies;
+                ifmgd->ie_probereq_len = ies_len;
                 return 0;
         case IEEE80211_STYPE_PROBE_RESP >> 4:
-                kfree(ifsta->ie_proberesp);
-                ifsta->ie_proberesp = ies;
-                ifsta->ie_proberesp_len = ies_len;
+                kfree(ifmgd->ie_proberesp);
+                ifmgd->ie_proberesp = ies;
+                ifmgd->ie_proberesp_len = ies_len;
                 return 0;
         case IEEE80211_STYPE_AUTH >> 4:
-                kfree(ifsta->ie_auth);
-                ifsta->ie_auth = ies;
-                ifsta->ie_auth_len = ies_len;
+                kfree(ifmgd->ie_auth);
+                ifmgd->ie_auth = ies;
+                ifmgd->ie_auth_len = ies_len;
                 return 0;
         case IEEE80211_STYPE_ASSOC_REQ >> 4:
-                kfree(ifsta->ie_assocreq);
-                ifsta->ie_assocreq = ies;
-                ifsta->ie_assocreq_len = ies_len;
+                kfree(ifmgd->ie_assocreq);
+                ifmgd->ie_assocreq = ies;
+                ifmgd->ie_assocreq_len = ies_len;
                 return 0;
         case IEEE80211_STYPE_REASSOC_REQ >> 4:
-                kfree(ifsta->ie_reassocreq);
-                ifsta->ie_reassocreq = ies;
-                ifsta->ie_reassocreq_len = ies_len;
+                kfree(ifmgd->ie_reassocreq);
+                ifmgd->ie_reassocreq = ies;
+                ifmgd->ie_reassocreq_len = ies_len;
                 return 0;
         case IEEE80211_STYPE_DEAUTH >> 4:
-                kfree(ifsta->ie_deauth);
-                ifsta->ie_deauth = ies;
-                ifsta->ie_deauth_len = ies_len;
+                kfree(ifmgd->ie_deauth);
+                ifmgd->ie_deauth = ies;
+                ifmgd->ie_deauth_len = ies_len;
                 return 0;
         case IEEE80211_STYPE_DISASSOC >> 4:
-                kfree(ifsta->ie_disassoc);
-                ifsta->ie_disassoc = ies;
-                ifsta->ie_disassoc_len = ies_len;
+                kfree(ifmgd->ie_disassoc);
+                ifmgd->ie_disassoc = ies;
+                ifmgd->ie_disassoc_len = ies_len;
                 return 0;
         }
 
@@ -1248,7 +1252,6 @@ static int ieee80211_set_mgmt_extra_ie(struct wiphy *wiphy,
 
         switch (sdata->vif.type) {
         case NL80211_IFTYPE_STATION:
-        case NL80211_IFTYPE_ADHOC:
                 ret = set_mgmt_extra_ie_sta(sdata, params->subtype,
                                             ies, ies_len);
                 break;
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index c54219301724..e3420329f4e6 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -94,31 +94,31 @@ IEEE80211_IF_FILE(drop_unencrypted, drop_unencrypted, DEC);
 IEEE80211_IF_FILE(force_unicast_rateidx, force_unicast_rateidx, DEC);
 IEEE80211_IF_FILE(max_ratectrl_rateidx, max_ratectrl_rateidx, DEC);
 
-/* STA/IBSS attributes */
-IEEE80211_IF_FILE(state, u.sta.state, DEC);
-IEEE80211_IF_FILE(bssid, u.sta.bssid, MAC);
-IEEE80211_IF_FILE(prev_bssid, u.sta.prev_bssid, MAC);
-IEEE80211_IF_FILE(ssid_len, u.sta.ssid_len, SIZE);
-IEEE80211_IF_FILE(aid, u.sta.aid, DEC);
-IEEE80211_IF_FILE(ap_capab, u.sta.ap_capab, HEX);
-IEEE80211_IF_FILE(capab, u.sta.capab, HEX);
-IEEE80211_IF_FILE(extra_ie_len, u.sta.extra_ie_len, SIZE);
-IEEE80211_IF_FILE(auth_tries, u.sta.auth_tries, DEC);
-IEEE80211_IF_FILE(assoc_tries, u.sta.assoc_tries, DEC);
-IEEE80211_IF_FILE(auth_algs, u.sta.auth_algs, HEX);
-IEEE80211_IF_FILE(auth_alg, u.sta.auth_alg, DEC);
-IEEE80211_IF_FILE(auth_transaction, u.sta.auth_transaction, DEC);
+/* STA attributes */
+IEEE80211_IF_FILE(state, u.mgd.state, DEC);
+IEEE80211_IF_FILE(bssid, u.mgd.bssid, MAC);
+IEEE80211_IF_FILE(prev_bssid, u.mgd.prev_bssid, MAC);
+IEEE80211_IF_FILE(ssid_len, u.mgd.ssid_len, SIZE);
+IEEE80211_IF_FILE(aid, u.mgd.aid, DEC);
+IEEE80211_IF_FILE(ap_capab, u.mgd.ap_capab, HEX);
+IEEE80211_IF_FILE(capab, u.mgd.capab, HEX);
+IEEE80211_IF_FILE(extra_ie_len, u.mgd.extra_ie_len, SIZE);
+IEEE80211_IF_FILE(auth_tries, u.mgd.auth_tries, DEC);
+IEEE80211_IF_FILE(assoc_tries, u.mgd.assoc_tries, DEC);
+IEEE80211_IF_FILE(auth_algs, u.mgd.auth_algs, HEX);
+IEEE80211_IF_FILE(auth_alg, u.mgd.auth_alg, DEC);
+IEEE80211_IF_FILE(auth_transaction, u.mgd.auth_transaction, DEC);
 
 static ssize_t ieee80211_if_fmt_flags(
         const struct ieee80211_sub_if_data *sdata, char *buf, int buflen)
 {
         return scnprintf(buf, buflen, "%s%s%s%s%s%s%s\n",
-                 sdata->u.sta.flags & IEEE80211_STA_SSID_SET ? "SSID\n" : "",
-                 sdata->u.sta.flags & IEEE80211_STA_BSSID_SET ? "BSSID\n" : "",
-                 sdata->u.sta.flags & IEEE80211_STA_PREV_BSSID_SET ? "prev BSSID\n" : "",
-                 sdata->u.sta.flags & IEEE80211_STA_AUTHENTICATED ? "AUTH\n" : "",
-                 sdata->u.sta.flags & IEEE80211_STA_ASSOCIATED ? "ASSOC\n" : "",
-                 sdata->u.sta.flags & IEEE80211_STA_PROBEREQ_POLL ? "PROBEREQ POLL\n" : "",
+                 sdata->u.mgd.flags & IEEE80211_STA_SSID_SET ? "SSID\n" : "",
+                 sdata->u.mgd.flags & IEEE80211_STA_BSSID_SET ? "BSSID\n" : "",
+                 sdata->u.mgd.flags & IEEE80211_STA_PREV_BSSID_SET ? "prev BSSID\n" : "",
+                 sdata->u.mgd.flags & IEEE80211_STA_AUTHENTICATED ? "AUTH\n" : "",
+                 sdata->u.mgd.flags & IEEE80211_STA_ASSOCIATED ? "ASSOC\n" : "",
+                 sdata->u.mgd.flags & IEEE80211_STA_PROBEREQ_POLL ? "PROBEREQ POLL\n" : "",
                  sdata->vif.bss_conf.use_cts_prot ? "CTS prot\n" : "");
 }
 __IEEE80211_IF_FILE(flags);
@@ -283,9 +283,11 @@ static void add_files(struct ieee80211_sub_if_data *sdata)
 #endif
                 break;
         case NL80211_IFTYPE_STATION:
-        case NL80211_IFTYPE_ADHOC:
                 add_sta_files(sdata);
                 break;
+        case NL80211_IFTYPE_ADHOC:
+                /* XXX */
+                break;
         case NL80211_IFTYPE_AP:
                 add_ap_files(sdata);
                 break;
@@ -418,9 +420,11 @@ static void del_files(struct ieee80211_sub_if_data *sdata)
 #endif
                 break;
         case NL80211_IFTYPE_STATION:
-        case NL80211_IFTYPE_ADHOC:
                 del_sta_files(sdata);
                 break;
+        case NL80211_IFTYPE_ADHOC:
+                /* XXX */
+                break;
         case NL80211_IFTYPE_AP:
                 del_ap_files(sdata);
                 break;
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index 82ea0b63a386..4e3c72f20de7 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -17,6 +17,7 @@
 #include <net/wireless.h>
 #include <net/mac80211.h>
 #include "ieee80211_i.h"
+#include "rate.h"
 
 void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_supported_band *sband,
                                        struct ieee80211_ht_cap *ht_cap_ie,
@@ -93,7 +94,9 @@ u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_supported_band *sband;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_bss_ht_conf ht;
+        struct sta_info *sta;
         u32 changed = 0;
         bool enable_ht = true, ht_changed;
         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
@@ -136,6 +139,16 @@ u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
         if (ht_changed) {
                 /* channel_type change automatically detected */
                 ieee80211_hw_config(local, 0);
+
+                rcu_read_lock();
+
+                sta = sta_info_get(local, ifmgd->bssid);
+                if (sta)
+                        rate_control_rate_update(local, sband, sta,
+                                                 IEEE80211_RC_HT_CHANGED);
+
+                rcu_read_unlock();
+
         }
 
         /* disable HT */
@@ -169,7 +182,6 @@ void ieee80211_send_delba(struct ieee80211_sub_if_data *sdata,
                           u16 initiator, u16 reason_code)
 {
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
         struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
         u16 params;
@@ -190,8 +202,9 @@ void ieee80211_send_delba(struct ieee80211_sub_if_data *sdata,
         if (sdata->vif.type == NL80211_IFTYPE_AP ||
             sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
                 memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
-        else
-                memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
+        else if (sdata->vif.type == NL80211_IFTYPE_STATION)
+                memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
+
         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                           IEEE80211_STYPE_ACTION);
 
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
new file mode 100644
index 000000000000..a96ce9dfc6b5
--- /dev/null
+++ b/net/mac80211/ibss.c
@@ -0,0 +1,905 @@
+/*
+ * IBSS mode implementation
+ * Copyright 2003-2008, Jouni Malinen <j@w1.fi>
+ * Copyright 2004, Instant802 Networks, Inc.
+ * Copyright 2005, Devicescape Software, Inc.
+ * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
+ * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
+ * Copyright 2009, Johannes Berg <johannes@sipsolutions.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/delay.h>
+#include <linux/if_ether.h>
+#include <linux/skbuff.h>
+#include <linux/if_arp.h>
+#include <linux/etherdevice.h>
+#include <linux/rtnetlink.h>
+#include <net/mac80211.h>
+#include <asm/unaligned.h>
+
+#include "ieee80211_i.h"
+#include "rate.h"
+
+#define IEEE80211_SCAN_INTERVAL (2 * HZ)
+#define IEEE80211_SCAN_INTERVAL_SLOW (15 * HZ)
+#define IEEE80211_IBSS_JOIN_TIMEOUT (7 * HZ)
+
+#define IEEE80211_IBSS_MERGE_INTERVAL (30 * HZ)
+#define IEEE80211_IBSS_MERGE_DELAY 0x400000
+#define IEEE80211_IBSS_INACTIVITY_LIMIT (60 * HZ)
+
+#define IEEE80211_IBSS_MAX_STA_ENTRIES 128
+
+
+static void ieee80211_rx_mgmt_auth_ibss(struct ieee80211_sub_if_data *sdata,
+                                        struct ieee80211_mgmt *mgmt,
+                                        size_t len)
+{
+        u16 auth_alg, auth_transaction, status_code;
+
+        if (len < 24 + 6)
+                return;
+
+        auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
+        auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
+        status_code = le16_to_cpu(mgmt->u.auth.status_code);
+
+        /*
+         * IEEE 802.11 standard does not require authentication in IBSS
+         * networks and most implementations do not seem to use it.
+         * However, try to reply to authentication attempts if someone
+         * has actually implemented this.
+         */
+        if (auth_alg == WLAN_AUTH_OPEN && auth_transaction == 1)
+                ieee80211_send_auth(sdata, 2, WLAN_AUTH_OPEN, NULL, 0,
+                                    sdata->u.ibss.bssid, 0);
+}
+
+static int __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
+                                     const u8 *bssid, const int beacon_int,
+                                     const int freq,
+                                     const size_t supp_rates_len,
+                                     const u8 *supp_rates,
+                                     const u16 capability)
+{
+        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+        struct ieee80211_local *local = sdata->local;
+        int res = 0, rates, i, j;
+        struct sk_buff *skb;
+        struct ieee80211_mgmt *mgmt;
+        u8 *pos;
+        struct ieee80211_supported_band *sband;
+        union iwreq_data wrqu;
+
+        if (local->ops->reset_tsf) {
+                /* Reset own TSF to allow time synchronization work. */
+                local->ops->reset_tsf(local_to_hw(local));
+        }
+
+        if ((ifibss->flags & IEEE80211_IBSS_PREV_BSSID_SET) &&
+           memcmp(ifibss->bssid, bssid, ETH_ALEN) == 0)
+                return res;
+
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400);
+        if (!skb) {
+                printk(KERN_DEBUG "%s: failed to allocate buffer for probe "
+                       "response\n", sdata->dev->name);
+                return -ENOMEM;
+        }
+
+        if (!(ifibss->flags & IEEE80211_IBSS_PREV_BSSID_SET)) {
+                /* Remove possible STA entries from other IBSS networks. */
+                sta_info_flush_delayed(sdata);
+        }
+
+        memcpy(ifibss->bssid, bssid, ETH_ALEN);
+        res = ieee80211_if_config(sdata, IEEE80211_IFCC_BSSID);
+        if (res)
+                return res;
+
+        local->hw.conf.beacon_int = beacon_int >= 10 ? beacon_int : 10;
+
+        sdata->drop_unencrypted = capability &
+                WLAN_CAPABILITY_PRIVACY ? 1 : 0;
+
+        res = ieee80211_set_freq(sdata, freq);
+
+        if (res)
+                return res;
+
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+
+        /* Build IBSS probe response */
+
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+
+        mgmt = (struct ieee80211_mgmt *)
+                skb_put(skb, 24 + sizeof(mgmt->u.beacon));
+        memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
+        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                          IEEE80211_STYPE_PROBE_RESP);
+        memset(mgmt->da, 0xff, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(mgmt->bssid, ifibss->bssid, ETH_ALEN);
+        mgmt->u.beacon.beacon_int =
+                cpu_to_le16(local->hw.conf.beacon_int);
+        mgmt->u.beacon.capab_info = cpu_to_le16(capability);
+
+        pos = skb_put(skb, 2 + ifibss->ssid_len);
+        *pos++ = WLAN_EID_SSID;
+        *pos++ = ifibss->ssid_len;
+        memcpy(pos, ifibss->ssid, ifibss->ssid_len);
+
+        rates = supp_rates_len;
+        if (rates > 8)
+                rates = 8;
+        pos = skb_put(skb, 2 + rates);
+        *pos++ = WLAN_EID_SUPP_RATES;
+        *pos++ = rates;
+        memcpy(pos, supp_rates, rates);
+
+        if (sband->band == IEEE80211_BAND_2GHZ) {
+                pos = skb_put(skb, 2 + 1);
+                *pos++ = WLAN_EID_DS_PARAMS;
+                *pos++ = 1;
+                *pos++ = ieee80211_frequency_to_channel(freq);
+        }
+
+        pos = skb_put(skb, 2 + 2);
+        *pos++ = WLAN_EID_IBSS_PARAMS;
+        *pos++ = 2;
+        /* FIX: set ATIM window based on scan results */
+        *pos++ = 0;
+        *pos++ = 0;
+
+        if (supp_rates_len > 8) {
+                rates = supp_rates_len - 8;
+                pos = skb_put(skb, 2 + rates);
+                *pos++ = WLAN_EID_EXT_SUPP_RATES;
+                *pos++ = rates;
+                memcpy(pos, &supp_rates[8], rates);
+        }
+
+        ifibss->probe_resp = skb;
+
+        ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON |
+                                   IEEE80211_IFCC_BEACON_ENABLED);
+
+
+        rates = 0;
+        for (i = 0; i < supp_rates_len; i++) {
+                int bitrate = (supp_rates[i] & 0x7f) * 5;
+                for (j = 0; j < sband->n_bitrates; j++)
+                        if (sband->bitrates[j].bitrate == bitrate)
+                                rates |= BIT(j);
+        }
+
+        ieee80211_sta_def_wmm_params(sdata, supp_rates_len, supp_rates);
+
+        ifibss->flags |= IEEE80211_IBSS_PREV_BSSID_SET;
+        ifibss->state = IEEE80211_IBSS_MLME_JOINED;
+        mod_timer(&ifibss->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
+
+        memset(&wrqu, 0, sizeof(wrqu));
+        memcpy(wrqu.ap_addr.sa_data, bssid, ETH_ALEN);
+        wireless_send_event(sdata->dev, SIOCGIWAP, &wrqu, NULL);
+
+        return res;
+}
+
+static int ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
+                                   struct ieee80211_bss *bss)
+{
+        return __ieee80211_sta_join_ibss(sdata,
+                                         bss->cbss.bssid,
+                                         bss->cbss.beacon_interval,
+                                         bss->cbss.channel->center_freq,
+                                         bss->supp_rates_len, bss->supp_rates,
+                                         bss->cbss.capability);
+}
+
+static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
+                                  struct ieee80211_mgmt *mgmt,
+                                  size_t len,
+                                  struct ieee80211_rx_status *rx_status,
+                                  struct ieee802_11_elems *elems,
+                                  bool beacon)
+{
+        struct ieee80211_local *local = sdata->local;
+        int freq;
+        struct ieee80211_bss *bss;
+        struct sta_info *sta;
+        struct ieee80211_channel *channel;
+        u64 beacon_timestamp, rx_timestamp;
+        u32 supp_rates = 0;
+        enum ieee80211_band band = rx_status->band;
+
+        if (elems->ds_params && elems->ds_params_len == 1)
+                freq = ieee80211_channel_to_frequency(elems->ds_params[0]);
+        else
+                freq = rx_status->freq;
+
+        channel = ieee80211_get_channel(local->hw.wiphy, freq);
+
+        if (!channel || channel->flags & IEEE80211_CHAN_DISABLED)
+                return;
+
+        if (sdata->vif.type == NL80211_IFTYPE_ADHOC && elems->supp_rates &&
+            memcmp(mgmt->bssid, sdata->u.ibss.bssid, ETH_ALEN) == 0) {
+                supp_rates = ieee80211_sta_get_rates(local, elems, band);
+
+                rcu_read_lock();
+
+                sta = sta_info_get(local, mgmt->sa);
+                if (sta) {
+                        u32 prev_rates;
+
+                        prev_rates = sta->sta.supp_rates[band];
+                        /* make sure mandatory rates are always added */
+                        sta->sta.supp_rates[band] = supp_rates |
+                                ieee80211_mandatory_rates(local, band);
+
+#ifdef CONFIG_MAC80211_IBSS_DEBUG
+                        if (sta->sta.supp_rates[band] != prev_rates)
+                                printk(KERN_DEBUG "%s: updated supp_rates set "
+                                    "for %pM based on beacon info (0x%llx | "
+                                    "0x%llx -> 0x%llx)\n",
+                                    sdata->dev->name,
+                                    sta->sta.addr,
+                                    (unsigned long long) prev_rates,
+                                    (unsigned long long) supp_rates,
+                                    (unsigned long long) sta->sta.supp_rates[band]);
+#endif
+                } else
+                        ieee80211_ibss_add_sta(sdata, mgmt->bssid, mgmt->sa, supp_rates);
+
+                rcu_read_unlock();
+        }
+
+        bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, elems,
+                                        channel, beacon);
+        if (!bss)
+                return;
+
+        /* was just updated in ieee80211_bss_info_update */
+        beacon_timestamp = bss->cbss.tsf;
+
+        /* check if we need to merge IBSS */
+
+        /* merge only on beacons (???) */
+        if (!beacon)
+                goto put_bss;
+
+        /* we use a fixed BSSID */
+        if (sdata->u.ibss.flags & IEEE80211_IBSS_BSSID_SET)
+                goto put_bss;
+
+        /* not an IBSS */
+        if (!(bss->cbss.capability & WLAN_CAPABILITY_IBSS))
+                goto put_bss;
+
+        /* different channel */
+        if (bss->cbss.channel != local->oper_channel)
+                goto put_bss;
+
+        /* different SSID */
+        if (elems->ssid_len != sdata->u.ibss.ssid_len ||
+            memcmp(elems->ssid, sdata->u.ibss.ssid,
+                                sdata->u.ibss.ssid_len))
+                goto put_bss;
+
+        /* same BSSID */
+        if (memcmp(bss->cbss.bssid, sdata->u.ibss.bssid, ETH_ALEN) == 0)
+                goto put_bss;
+
+        if (rx_status->flag & RX_FLAG_TSFT) {
+                /*
+                 * For correct IBSS merging we need mactime; since mactime is
+                 * defined as the time the first data symbol of the frame hits
+                 * the PHY, and the timestamp of the beacon is defined as "the
+                 * time that the data symbol containing the first bit of the
+                 * timestamp is transmitted to the PHY plus the transmitting
+                 * STA's delays through its local PHY from the MAC-PHY
+                 * interface to its interface with the WM" (802.11 11.1.2)
+                 * - equals the time this bit arrives at the receiver - we have
+                 * to take into account the offset between the two.
+                 *
+                 * E.g. at 1 MBit that means mactime is 192 usec earlier
+                 * (=24 bytes * 8 usecs/byte) than the beacon timestamp.
+                 */
+                int rate;
+
+                if (rx_status->flag & RX_FLAG_HT)
+                        rate = 65; /* TODO: HT rates */
+                else
+                        rate = local->hw.wiphy->bands[band]->
+                                bitrates[rx_status->rate_idx].bitrate;
+
+                rx_timestamp = rx_status->mactime + (24 * 8 * 10 / rate);
+        } else if (local && local->ops && local->ops->get_tsf)
+                /* second best option: get current TSF */
+                rx_timestamp = local->ops->get_tsf(local_to_hw(local));
+        else
+                /* can't merge without knowing the TSF */
+                rx_timestamp = -1LLU;
+
+#ifdef CONFIG_MAC80211_IBSS_DEBUG
+        printk(KERN_DEBUG "RX beacon SA=%pM BSSID="
+               "%pM TSF=0x%llx BCN=0x%llx diff=%lld @%lu\n",
+               mgmt->sa, mgmt->bssid,
+               (unsigned long long)rx_timestamp,
+               (unsigned long long)beacon_timestamp,
+               (unsigned long long)(rx_timestamp - beacon_timestamp),
+               jiffies);
+#endif
+
+        /* give slow hardware some time to do the TSF sync */
+        if (rx_timestamp < IEEE80211_IBSS_MERGE_DELAY)
+                goto put_bss;
+
+        if (beacon_timestamp > rx_timestamp) {
+#ifdef CONFIG_MAC80211_IBSS_DEBUG
+                printk(KERN_DEBUG "%s: beacon TSF higher than "
+                       "local TSF - IBSS merge with BSSID %pM\n",
+                       sdata->dev->name, mgmt->bssid);
+#endif
+                ieee80211_sta_join_ibss(sdata, bss);
+                ieee80211_ibss_add_sta(sdata, mgmt->bssid, mgmt->sa, supp_rates);
+        }
+
+ put_bss:
+        ieee80211_rx_bss_put(local, bss);
+}
+
+/*
+ * Add a new IBSS station, will also be called by the RX code when,
+ * in IBSS mode, receiving a frame from a yet-unknown station, hence
+ * must be callable in atomic context.
+ */
+struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
+                                        u8 *bssid,u8 *addr, u32 supp_rates)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct sta_info *sta;
+        int band = local->hw.conf.channel->band;
+
+        /* TODO: Could consider removing the least recently used entry and
+         * allow new one to be added. */
+        if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
+                if (net_ratelimit()) {
+                        printk(KERN_DEBUG "%s: No room for a new IBSS STA "
+                               "entry %pM\n", sdata->dev->name, addr);
+                }
+                return NULL;
+        }
+
+        if (compare_ether_addr(bssid, sdata->u.ibss.bssid))
+                return NULL;
+
+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
+        printk(KERN_DEBUG "%s: Adding new IBSS station %pM (dev=%s)\n",
+               wiphy_name(local->hw.wiphy), addr, sdata->dev->name);
+#endif
+
+        sta = sta_info_alloc(sdata, addr, GFP_ATOMIC);
+        if (!sta)
+                return NULL;
+
+        set_sta_flags(sta, WLAN_STA_AUTHORIZED);
+
+        /* make sure mandatory rates are always added */
+        sta->sta.supp_rates[band] = supp_rates |
+                        ieee80211_mandatory_rates(local, band);
+
+        rate_control_rate_init(sta);
+
+        if (sta_info_insert(sta))
+                return NULL;
+
+        return sta;
+}
+
+static int ieee80211_sta_active_ibss(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+        int active = 0;
+        struct sta_info *sta;
+
+        rcu_read_lock();
+
+        list_for_each_entry_rcu(sta, &local->sta_list, list) {
+                if (sta->sdata == sdata &&
+                    time_after(sta->last_rx + IEEE80211_IBSS_MERGE_INTERVAL,
+                               jiffies)) {
+                        active++;
+                        break;
+                }
+        }
+
+        rcu_read_unlock();
+
+        return active;
+}
+
+
+static void ieee80211_sta_merge_ibss(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+
+        mod_timer(&ifibss->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
+
+        ieee80211_sta_expire(sdata, IEEE80211_IBSS_INACTIVITY_LIMIT);
+        if (ieee80211_sta_active_ibss(sdata))
+                return;
+
+        if ((ifibss->flags & IEEE80211_IBSS_BSSID_SET) &&
+            (!(ifibss->flags & IEEE80211_IBSS_AUTO_CHANNEL_SEL)))
+                return;
+
+        printk(KERN_DEBUG "%s: No active IBSS STAs - trying to scan for other "
+               "IBSS networks with same SSID (merge)\n", sdata->dev->name);
+
+        /* XXX maybe racy? */
+        if (sdata->local->scan_req)
+                return;
+
+        memcpy(sdata->local->int_scan_req.ssids[0].ssid,
+               ifibss->ssid, IEEE80211_MAX_SSID_LEN);
+        sdata->local->int_scan_req.ssids[0].ssid_len = ifibss->ssid_len;
+        ieee80211_request_scan(sdata, &sdata->local->int_scan_req);
+}
+
+static int ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_supported_band *sband;
+        u8 *pos;
+        u8 bssid[ETH_ALEN];
+        u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
+        u16 capability;
+        int i;
+
+        if (ifibss->flags & IEEE80211_IBSS_BSSID_SET) {
+                memcpy(bssid, ifibss->bssid, ETH_ALEN);
+        } else {
+                /* Generate random, not broadcast, locally administered BSSID. Mix in
+                 * own MAC address to make sure that devices that do not have proper
+                 * random number generator get different BSSID. */
+                get_random_bytes(bssid, ETH_ALEN);
+                for (i = 0; i < ETH_ALEN; i++)
+                        bssid[i] ^= sdata->dev->dev_addr[i];
+                bssid[0] &= ~0x01;
+                bssid[0] |= 0x02;
+        }
+
+        printk(KERN_DEBUG "%s: Creating new IBSS network, BSSID %pM\n",
+               sdata->dev->name, bssid);
+
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+
+        if (local->hw.conf.beacon_int == 0)
+                local->hw.conf.beacon_int = 100;
+
+        capability = WLAN_CAPABILITY_IBSS;
+
+        if (sdata->default_key)
+                capability |= WLAN_CAPABILITY_PRIVACY;
+        else
+                sdata->drop_unencrypted = 0;
+
+        pos = supp_rates;
+        for (i = 0; i < sband->n_bitrates; i++) {
+                int rate = sband->bitrates[i].bitrate;
+                *pos++ = (u8) (rate / 5);
+        }
+
+        return __ieee80211_sta_join_ibss(sdata,
+                                         bssid, local->hw.conf.beacon_int,
+                                         local->hw.conf.channel->center_freq,
+                                         sband->n_bitrates, supp_rates,
+                                         capability);
+}
+
+static int ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_bss *bss;
+        const u8 *bssid = NULL;
+        int active_ibss;
+
+        if (ifibss->ssid_len == 0)
+                return -EINVAL;
+
+        active_ibss = ieee80211_sta_active_ibss(sdata);
+#ifdef CONFIG_MAC80211_IBSS_DEBUG
+        printk(KERN_DEBUG "%s: sta_find_ibss (active_ibss=%d)\n",
+               sdata->dev->name, active_ibss);
+#endif /* CONFIG_MAC80211_IBSS_DEBUG */
+
+        if (active_ibss)
+                return 0;
+
+        if (ifibss->flags & IEEE80211_IBSS_BSSID_SET)
+                bssid = ifibss->bssid;
+        bss = (void *)cfg80211_get_bss(local->hw.wiphy, NULL, bssid,
+                                       ifibss->ssid, ifibss->ssid_len,
+                                       WLAN_CAPABILITY_IBSS,
+                                       WLAN_CAPABILITY_IBSS);
+
+#ifdef CONFIG_MAC80211_IBSS_DEBUG
+        if (bss)
+                printk(KERN_DEBUG "   sta_find_ibss: selected %pM current "
+                       "%pM\n", bss->cbss.bssid, ifibss->bssid);
+#endif /* CONFIG_MAC80211_IBSS_DEBUG */
+
+        if (bss &&
+            (!(ifibss->flags & IEEE80211_IBSS_PREV_BSSID_SET) ||
+             memcmp(ifibss->bssid, bss->cbss.bssid, ETH_ALEN))) {
+                int ret;
+
+                printk(KERN_DEBUG "%s: Selected IBSS BSSID %pM"
+                       " based on configured SSID\n",
+                       sdata->dev->name, bss->cbss.bssid);
+
+                ret = ieee80211_sta_join_ibss(sdata, bss);
+                ieee80211_rx_bss_put(local, bss);
+                return ret;
+        } else if (bss)
+                ieee80211_rx_bss_put(local, bss);
+
+#ifdef CONFIG_MAC80211_IBSS_DEBUG
+        printk(KERN_DEBUG "   did not try to join ibss\n");
+#endif /* CONFIG_MAC80211_IBSS_DEBUG */
+
+        /* Selected IBSS not found in current scan results - try to scan */
+        if (ifibss->state == IEEE80211_IBSS_MLME_JOINED &&
+            !ieee80211_sta_active_ibss(sdata)) {
+                mod_timer(&ifibss->timer, jiffies +
+                                          IEEE80211_IBSS_MERGE_INTERVAL);
+        } else if (time_after(jiffies, local->last_scan_completed +
+                                        IEEE80211_SCAN_INTERVAL)) {
+                printk(KERN_DEBUG "%s: Trigger new scan to find an IBSS to "
+                       "join\n", sdata->dev->name);
+
+                /* XXX maybe racy? */
+                if (local->scan_req)
+                        return -EBUSY;
+
+                memcpy(local->int_scan_req.ssids[0].ssid,
+                       ifibss->ssid, IEEE80211_MAX_SSID_LEN);
+                local->int_scan_req.ssids[0].ssid_len = ifibss->ssid_len;
+                return ieee80211_request_scan(sdata, &local->int_scan_req);
+        } else if (ifibss->state != IEEE80211_IBSS_MLME_JOINED) {
+                int interval = IEEE80211_SCAN_INTERVAL;
+
+                if (time_after(jiffies, ifibss->ibss_join_req +
+                               IEEE80211_IBSS_JOIN_TIMEOUT)) {
+                        if (!(local->oper_channel->flags &
+                                                IEEE80211_CHAN_NO_IBSS))
+                                return ieee80211_sta_create_ibss(sdata);
+                        printk(KERN_DEBUG "%s: IBSS not allowed on"
+                               " %d MHz\n", sdata->dev->name,
+                               local->hw.conf.channel->center_freq);
+
+                        /* No IBSS found - decrease scan interval and continue
+                         * scanning. */
+                        interval = IEEE80211_SCAN_INTERVAL_SLOW;
+                }
+
+                ifibss->state = IEEE80211_IBSS_MLME_SEARCH;
+                mod_timer(&ifibss->timer, jiffies + interval);
+                return 0;
+        }
+
+        return 0;
+}
+
+static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
+                                        struct ieee80211_mgmt *mgmt,
+                                        size_t len)
+{
+        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+        struct ieee80211_local *local = sdata->local;
+        int tx_last_beacon;
+        struct sk_buff *skb;
+        struct ieee80211_mgmt *resp;
+        u8 *pos, *end;
+
+        if (ifibss->state != IEEE80211_IBSS_MLME_JOINED ||
+            len < 24 + 2 || !ifibss->probe_resp)
+                return;
+
+        if (local->ops->tx_last_beacon)
+                tx_last_beacon = local->ops->tx_last_beacon(local_to_hw(local));
+        else
+                tx_last_beacon = 1;
+
+#ifdef CONFIG_MAC80211_IBSS_DEBUG
+        printk(KERN_DEBUG "%s: RX ProbeReq SA=%pM DA=%pM BSSID=%pM"
+               " (tx_last_beacon=%d)\n",
+               sdata->dev->name, mgmt->sa, mgmt->da,
+               mgmt->bssid, tx_last_beacon);
+#endif /* CONFIG_MAC80211_IBSS_DEBUG */
+
+        if (!tx_last_beacon)
+                return;
+
+        if (memcmp(mgmt->bssid, ifibss->bssid, ETH_ALEN) != 0 &&
+            memcmp(mgmt->bssid, "\xff\xff\xff\xff\xff\xff", ETH_ALEN) != 0)
+                return;
+
+        end = ((u8 *) mgmt) + len;
+        pos = mgmt->u.probe_req.variable;
+        if (pos[0] != WLAN_EID_SSID ||
+            pos + 2 + pos[1] > end) {
+#ifdef CONFIG_MAC80211_IBSS_DEBUG
+                printk(KERN_DEBUG "%s: Invalid SSID IE in ProbeReq "
+                       "from %pM\n",
+                       sdata->dev->name, mgmt->sa);
+#endif
+                return;
+        }
+        if (pos[1] != 0 &&
+            (pos[1] != ifibss->ssid_len ||
+             memcmp(pos + 2, ifibss->ssid, ifibss->ssid_len) != 0)) {
+                /* Ignore ProbeReq for foreign SSID */
+                return;
+        }
+
+        /* Reply with ProbeResp */
+        skb = skb_copy(ifibss->probe_resp, GFP_KERNEL);
+        if (!skb)
+                return;
+
+        resp = (struct ieee80211_mgmt *) skb->data;
+        memcpy(resp->da, mgmt->sa, ETH_ALEN);
+#ifdef CONFIG_MAC80211_IBSS_DEBUG
+        printk(KERN_DEBUG "%s: Sending ProbeResp to %pM\n",
+               sdata->dev->name, resp->da);
+#endif /* CONFIG_MAC80211_IBSS_DEBUG */
+        ieee80211_tx_skb(sdata, skb, 0);
+}
+
+static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
+                                         struct ieee80211_mgmt *mgmt,
+                                         size_t len,
+                                         struct ieee80211_rx_status *rx_status)
+{
+        size_t baselen;
+        struct ieee802_11_elems elems;
+
+        if (memcmp(mgmt->da, sdata->dev->dev_addr, ETH_ALEN))
+                return; /* ignore ProbeResp to foreign address */
+
+        baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
+        if (baselen > len)
+                return;
+
+        ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
+                                &elems);
+
+        ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems, false);
+}
+
+static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
+                                     struct ieee80211_mgmt *mgmt,
+                                     size_t len,
+                                     struct ieee80211_rx_status *rx_status)
+{
+        size_t baselen;
+        struct ieee802_11_elems elems;
+
+        /* Process beacon from the current BSS */
+        baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
+        if (baselen > len)
+                return;
+
+        ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen, &elems);
+
+        ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems, true);
+}
+
+static void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
+                                          struct sk_buff *skb)
+{
+        struct ieee80211_rx_status *rx_status;
+        struct ieee80211_mgmt *mgmt;
+        u16 fc;
+
+        rx_status = (struct ieee80211_rx_status *) skb->cb;
+        mgmt = (struct ieee80211_mgmt *) skb->data;
+        fc = le16_to_cpu(mgmt->frame_control);
+
+        switch (fc & IEEE80211_FCTL_STYPE) {
+        case IEEE80211_STYPE_PROBE_REQ:
+                ieee80211_rx_mgmt_probe_req(sdata, mgmt, skb->len);
+                break;
+        case IEEE80211_STYPE_PROBE_RESP:
+                ieee80211_rx_mgmt_probe_resp(sdata, mgmt, skb->len,
+                                             rx_status);
+                break;
+        case IEEE80211_STYPE_BEACON:
+                ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len,
+                                         rx_status);
+                break;
+        case IEEE80211_STYPE_AUTH:
+                ieee80211_rx_mgmt_auth_ibss(sdata, mgmt, skb->len);
+                break;
+        }
+
+        kfree_skb(skb);
+}
+
+static void ieee80211_ibss_work(struct work_struct *work)
+{
+        struct ieee80211_sub_if_data *sdata =
+                container_of(work, struct ieee80211_sub_if_data, u.ibss.work);
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_ibss *ifibss;
+        struct sk_buff *skb;
+
+        if (!netif_running(sdata->dev))
+                return;
+
+        if (local->sw_scanning || local->hw_scanning)
+                return;
+
+        if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_ADHOC))
+                return;
+        ifibss = &sdata->u.ibss;
+
+        while ((skb = skb_dequeue(&ifibss->skb_queue)))
+                ieee80211_ibss_rx_queued_mgmt(sdata, skb);
+
+        if (!test_and_clear_bit(IEEE80211_IBSS_REQ_RUN, &ifibss->request))
+                return;
+
+        switch (ifibss->state) {
+        case IEEE80211_IBSS_MLME_SEARCH:
+                ieee80211_sta_find_ibss(sdata);
+                break;
+        case IEEE80211_IBSS_MLME_JOINED:
+                ieee80211_sta_merge_ibss(sdata);
+                break;
+        default:
+                WARN_ON(1);
+                break;
+        }
+}
+
+static void ieee80211_ibss_timer(unsigned long data)
+{
+        struct ieee80211_sub_if_data *sdata =
+                (struct ieee80211_sub_if_data *) data;
+        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+        struct ieee80211_local *local = sdata->local;
+
+        set_bit(IEEE80211_IBSS_REQ_RUN, &ifibss->request);
+        queue_work(local->hw.workqueue, &ifibss->work);
+}
+
+void ieee80211_ibss_setup_sdata(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+
+        INIT_WORK(&ifibss->work, ieee80211_ibss_work);
+        setup_timer(&ifibss->timer, ieee80211_ibss_timer,
+                    (unsigned long) sdata);
+        skb_queue_head_init(&ifibss->skb_queue);
+
+        ifibss->flags |= IEEE80211_IBSS_AUTO_BSSID_SEL |
+                        IEEE80211_IBSS_AUTO_CHANNEL_SEL;
+}
+
+int ieee80211_ibss_commit(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+
+        ifibss->flags &= ~IEEE80211_IBSS_PREV_BSSID_SET;
+
+        if (ifibss->ssid_len)
+                ifibss->flags |= IEEE80211_IBSS_SSID_SET;
+        else
+                ifibss->flags &= ~IEEE80211_IBSS_SSID_SET;
+
+        ifibss->ibss_join_req = jiffies;
+        ifibss->state = IEEE80211_IBSS_MLME_SEARCH;
+
+        return ieee80211_sta_find_ibss(sdata);
+}
+
+int ieee80211_ibss_set_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t len)
+{
+        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+
+        if (len > IEEE80211_MAX_SSID_LEN)
+                return -EINVAL;
+
+        if (ifibss->ssid_len != len || memcmp(ifibss->ssid, ssid, len) != 0) {
+                memset(ifibss->ssid, 0, sizeof(ifibss->ssid));
+                memcpy(ifibss->ssid, ssid, len);
+                ifibss->ssid_len = len;
+        }
+
+        return ieee80211_ibss_commit(sdata);
+}
+
+int ieee80211_ibss_get_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t *len)
+{
+        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+
+        memcpy(ssid, ifibss->ssid, ifibss->ssid_len);
+        *len = ifibss->ssid_len;
+
+        return 0;
+}
+
+int ieee80211_ibss_set_bssid(struct ieee80211_sub_if_data *sdata, u8 *bssid)
+{
+        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+
+        if (is_valid_ether_addr(bssid)) {
+                memcpy(ifibss->bssid, bssid, ETH_ALEN);
+                ifibss->flags |= IEEE80211_IBSS_BSSID_SET;
+        } else {
+                memset(ifibss->bssid, 0, ETH_ALEN);
+                ifibss->flags &= ~IEEE80211_IBSS_BSSID_SET;
+        }
+
+        if (netif_running(sdata->dev)) {
+                if (ieee80211_if_config(sdata, IEEE80211_IFCC_BSSID)) {
+                        printk(KERN_DEBUG "%s: Failed to config new BSSID to "
+                               "the low-level driver\n", sdata->dev->name);
+                }
+        }
+
+        return ieee80211_ibss_commit(sdata);
+}
+
+/* scan finished notification */
+void ieee80211_ibss_notify_scan_completed(struct ieee80211_local *local)
+{
+        struct ieee80211_sub_if_data *sdata = local->scan_sdata;
+        struct ieee80211_if_ibss *ifibss;
+
+        if (sdata && sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+                ifibss = &sdata->u.ibss;
+                if ((!(ifibss->flags & IEEE80211_IBSS_PREV_BSSID_SET)) ||
+                    !ieee80211_sta_active_ibss(sdata))
+                        ieee80211_sta_find_ibss(sdata);
+        }
+}
+
+ieee80211_rx_result
+ieee80211_ibss_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
+                       struct ieee80211_rx_status *rx_status)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_mgmt *mgmt;
+        u16 fc;
+
+        if (skb->len < 24)
+                return RX_DROP_MONITOR;
+
+        mgmt = (struct ieee80211_mgmt *) skb->data;
+        fc = le16_to_cpu(mgmt->frame_control);
+
+        switch (fc & IEEE80211_FCTL_STYPE) {
+        case IEEE80211_STYPE_PROBE_RESP:
+        case IEEE80211_STYPE_BEACON:
+                memcpy(skb->cb, rx_status, sizeof(*rx_status));
+        case IEEE80211_STYPE_PROBE_REQ:
+        case IEEE80211_STYPE_AUTH:
+                skb_queue_tail(&sdata->u.ibss.skb_queue, skb);
+                queue_work(local->hw.workqueue, &sdata->u.ibss.work);
+                return RX_QUEUED;
+        }
+
+        return RX_DROP_MONITOR;
+}
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 2cb743ed9f9c..ecbc8e0cb3e7 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -239,7 +239,7 @@ struct mesh_preq_queue {
         u8 flags;
 };
 
-/* flags used in struct ieee80211_if_sta.flags */
+/* flags used in struct ieee80211_if_managed.flags */
 #define IEEE80211_STA_SSID_SET          BIT(0)
 #define IEEE80211_STA_BSSID_SET         BIT(1)
 #define IEEE80211_STA_PREV_BSSID_SET    BIT(2)
@@ -262,31 +262,30 @@ struct mesh_preq_queue {
 #define IEEE80211_STA_REQ_AUTH 2
 #define IEEE80211_STA_REQ_RUN  3
 
-/* STA/IBSS MLME states */
-enum ieee80211_sta_mlme_state {
-        IEEE80211_STA_MLME_DISABLED,
-        IEEE80211_STA_MLME_DIRECT_PROBE,
-        IEEE80211_STA_MLME_AUTHENTICATE,
-        IEEE80211_STA_MLME_ASSOCIATE,
-        IEEE80211_STA_MLME_ASSOCIATED,
-        IEEE80211_STA_MLME_IBSS_SEARCH,
-        IEEE80211_STA_MLME_IBSS_JOINED,
-};
-
 /* bitfield of allowed auth algs */
 #define IEEE80211_AUTH_ALG_OPEN BIT(0)
 #define IEEE80211_AUTH_ALG_SHARED_KEY BIT(1)
 #define IEEE80211_AUTH_ALG_LEAP BIT(2)
 
-struct ieee80211_if_sta {
+struct ieee80211_if_managed {
         struct timer_list timer;
         struct timer_list chswitch_timer;
         struct work_struct work;
         struct work_struct chswitch_work;
+
         u8 bssid[ETH_ALEN], prev_bssid[ETH_ALEN];
+
         u8 ssid[IEEE80211_MAX_SSID_LEN];
-        enum ieee80211_sta_mlme_state state;
         size_t ssid_len;
+
+        enum {
+                IEEE80211_STA_MLME_DISABLED,
+                IEEE80211_STA_MLME_DIRECT_PROBE,
+                IEEE80211_STA_MLME_AUTHENTICATE,
+                IEEE80211_STA_MLME_ASSOCIATE,
+                IEEE80211_STA_MLME_ASSOCIATED,
+        } state;
+
         u16 aid;
         u16 ap_capab, capab;
         u8 *extra_ie; /* to be added to the end of AssocReq */
@@ -319,10 +318,6 @@ struct ieee80211_if_sta {
                 IEEE80211_MFP_REQUIRED
         } mfp; /* management frame protection */
 
-        unsigned long ibss_join_req;
-        struct sk_buff *probe_resp; /* ProbeResp template for IBSS */
-        u32 supp_rates_bits[IEEE80211_NUM_BANDS];
-
         int wmm_last_param_set;
 
         /* Extra IE data for management frames */
@@ -342,6 +337,42 @@ struct ieee80211_if_sta {
         size_t ie_disassoc_len;
 };
 
+enum ieee80211_ibss_flags {
+        IEEE80211_IBSS_AUTO_CHANNEL_SEL         = BIT(0),
+        IEEE80211_IBSS_AUTO_BSSID_SEL           = BIT(1),
+        IEEE80211_IBSS_BSSID_SET                = BIT(2),
+        IEEE80211_IBSS_PREV_BSSID_SET           = BIT(3),
+        IEEE80211_IBSS_SSID_SET                 = BIT(4),
+};
+
+enum ieee80211_ibss_request {
+        IEEE80211_IBSS_REQ_RUN  = 0,
+};
+
+struct ieee80211_if_ibss {
+        struct timer_list timer;
+        struct work_struct work;
+
+        struct sk_buff_head skb_queue;
+
+        u8 ssid[IEEE80211_MAX_SSID_LEN];
+        u8 ssid_len;
+
+        u32 flags;
+
+        u8 bssid[ETH_ALEN];
+
+        unsigned long request;
+
+        unsigned long ibss_join_req;
+        struct sk_buff *probe_resp; /* ProbeResp template for IBSS */
+
+        enum {
+                IEEE80211_IBSS_MLME_SEARCH,
+                IEEE80211_IBSS_MLME_JOINED,
+        } state;
+};
+
 struct ieee80211_if_mesh {
         struct work_struct work;
         struct timer_list housekeeping_timer;
@@ -445,7 +476,8 @@ struct ieee80211_sub_if_data {
                 struct ieee80211_if_ap ap;
                 struct ieee80211_if_wds wds;
                 struct ieee80211_if_vlan vlan;
-                struct ieee80211_if_sta sta;
+                struct ieee80211_if_managed mgd;
+                struct ieee80211_if_ibss ibss;
 #ifdef CONFIG_MAC80211_MESH
                 struct ieee80211_if_mesh mesh;
 #endif
@@ -564,12 +596,10 @@ enum {
 enum queue_stop_reason {
         IEEE80211_QUEUE_STOP_REASON_DRIVER,
         IEEE80211_QUEUE_STOP_REASON_PS,
-        IEEE80211_QUEUE_STOP_REASON_CSA
+        IEEE80211_QUEUE_STOP_REASON_CSA,
+        IEEE80211_QUEUE_STOP_REASON_AGGREGATION,
 };
 
-/* maximum number of hardware queues we support. */
-#define QD_MAX_QUEUES (IEEE80211_MAX_AMPDU_QUEUES + IEEE80211_MAX_QUEUES)
-
 struct ieee80211_master_priv {
         struct ieee80211_local *local;
 };
@@ -582,9 +612,15 @@ struct ieee80211_local {
 
         const struct ieee80211_ops *ops;
 
-        unsigned long queue_pool[BITS_TO_LONGS(QD_MAX_QUEUES)];
-        unsigned long queue_stop_reasons[IEEE80211_MAX_QUEUES];
+        /* AC queue corresponding to each AMPDU queue */
+        s8 ampdu_ac_queue[IEEE80211_MAX_AMPDU_QUEUES];
+        unsigned int amdpu_ac_stop_refcnt[IEEE80211_MAX_AMPDU_QUEUES];
+
+        unsigned long queue_stop_reasons[IEEE80211_MAX_QUEUES +
+                                         IEEE80211_MAX_AMPDU_QUEUES];
+        /* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
         spinlock_t queue_stop_reason_lock;
+
         struct net_device *mdev; /* wmaster# - "master" 802.11 device */
         int open_count;
         int monitors, cooked_mntrs;
@@ -888,34 +924,41 @@ void ieee80211_tx_set_protected(struct ieee80211_tx_data *tx);
 void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
                                       u32 changed);
 void ieee80211_configure_filter(struct ieee80211_local *local);
+u32 ieee80211_reset_erp_info(struct ieee80211_sub_if_data *sdata);
 
 /* wireless extensions */
 extern const struct iw_handler_def ieee80211_iw_handler_def;
 
-/* STA/IBSS code */
+/* STA code */
 void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata);
-void ieee80211_scan_work(struct work_struct *work);
-void ieee80211_sta_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
-                           struct ieee80211_rx_status *rx_status);
+ieee80211_rx_result ieee80211_sta_rx_mgmt(struct ieee80211_sub_if_data *sdata,
+                                          struct sk_buff *skb,
+                                          struct ieee80211_rx_status *rx_status);
+int ieee80211_sta_commit(struct ieee80211_sub_if_data *sdata);
 int ieee80211_sta_set_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t len);
 int ieee80211_sta_get_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t *len);
 int ieee80211_sta_set_bssid(struct ieee80211_sub_if_data *sdata, u8 *bssid);
-void ieee80211_sta_req_auth(struct ieee80211_sub_if_data *sdata,
-                            struct ieee80211_if_sta *ifsta);
-struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
-                                        u8 *bssid, u8 *addr, u32 supp_rates);
+void ieee80211_sta_req_auth(struct ieee80211_sub_if_data *sdata);
 int ieee80211_sta_deauthenticate(struct ieee80211_sub_if_data *sdata, u16 reason);
 int ieee80211_sta_disassociate(struct ieee80211_sub_if_data *sdata, u16 reason);
-u32 ieee80211_reset_erp_info(struct ieee80211_sub_if_data *sdata);
-u32 ieee80211_sta_get_rates(struct ieee80211_local *local,
-                            struct ieee802_11_elems *elems,
-                            enum ieee80211_band band);
-void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
-                              u8 *ssid, size_t ssid_len);
 void ieee80211_send_pspoll(struct ieee80211_local *local,
                            struct ieee80211_sub_if_data *sdata);
 
+/* IBSS code */
+int ieee80211_ibss_commit(struct ieee80211_sub_if_data *sdata);
+int ieee80211_ibss_set_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t len);
+int ieee80211_ibss_get_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t *len);
+int ieee80211_ibss_set_bssid(struct ieee80211_sub_if_data *sdata, u8 *bssid);
+void ieee80211_ibss_notify_scan_completed(struct ieee80211_local *local);
+void ieee80211_ibss_setup_sdata(struct ieee80211_sub_if_data *sdata);
+ieee80211_rx_result
+ieee80211_ibss_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
+                       struct ieee80211_rx_status *rx_status);
+struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
+                                        u8 *bssid, u8 *addr, u32 supp_rates);
+
 /* scan/BSS handling */
+void ieee80211_scan_work(struct work_struct *work);
 int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
                            struct cfg80211_scan_request *req);
 int ieee80211_scan_results(struct ieee80211_local *local,
@@ -1042,6 +1085,25 @@ void ieee80211_wake_queues_by_reason(struct ieee80211_hw *hw,
                                      enum queue_stop_reason reason);
 void ieee80211_stop_queues_by_reason(struct ieee80211_hw *hw,
                                      enum queue_stop_reason reason);
+void ieee80211_wake_queue_by_reason(struct ieee80211_hw *hw, int queue,
+                                    enum queue_stop_reason reason);
+void ieee80211_stop_queue_by_reason(struct ieee80211_hw *hw, int queue,
+                                    enum queue_stop_reason reason);
+
+void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
+                         u16 transaction, u16 auth_alg,
+                         u8 *extra, size_t extra_len,
+                         const u8 *bssid, int encrypt);
+void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
+                              u8 *ssid, size_t ssid_len,
+                              u8 *ie, size_t ie_len);
+
+void ieee80211_sta_def_wmm_params(struct ieee80211_sub_if_data *sdata,
+                                  const size_t supp_rates_len,
+                                  const u8 *supp_rates);
+u32 ieee80211_sta_get_rates(struct ieee80211_local *local,
+                            struct ieee802_11_elems *elems,
+                            enum ieee80211_band band);
 
 #ifdef CONFIG_MAC80211_NOINLINE
 #define debug_noinline noinline
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index df94b9365264..2acc416e77e1 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -236,7 +236,10 @@ static int ieee80211_open(struct net_device *dev)
                 break;
         case NL80211_IFTYPE_STATION:
         case NL80211_IFTYPE_ADHOC:
-                sdata->u.sta.flags &= ~IEEE80211_STA_PREV_BSSID_SET;
+                if (sdata->vif.type == NL80211_IFTYPE_STATION)
+                        sdata->u.mgd.flags &= ~IEEE80211_STA_PREV_BSSID_SET;
+                else
+                        sdata->u.ibss.flags &= ~IEEE80211_IBSS_PREV_BSSID_SET;
                 /* fall through */
         default:
                 conf.vif = &sdata->vif;
@@ -321,11 +324,10 @@ static int ieee80211_open(struct net_device *dev)
          * yet be effective. Trigger execution of ieee80211_sta_work
          * to fix this.
          */
-        if (sdata->vif.type == NL80211_IFTYPE_STATION ||
-            sdata->vif.type == NL80211_IFTYPE_ADHOC) {
-                struct ieee80211_if_sta *ifsta = &sdata->u.sta;
-                queue_work(local->hw.workqueue, &ifsta->work);
-        }
+        if (sdata->vif.type == NL80211_IFTYPE_STATION)
+                queue_work(local->hw.workqueue, &sdata->u.mgd.work);
+        else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
+                queue_work(local->hw.workqueue, &sdata->u.ibss.work);
 
         netif_tx_start_all_queues(dev);
 
@@ -452,15 +454,13 @@ static int ieee80211_stop(struct net_device *dev)
                 netif_addr_unlock_bh(local->mdev);
                 break;
         case NL80211_IFTYPE_STATION:
-        case NL80211_IFTYPE_ADHOC:
                 /* Announce that we are leaving the network. */
-                if (sdata->u.sta.state != IEEE80211_STA_MLME_DISABLED)
+                if (sdata->u.mgd.state != IEEE80211_STA_MLME_DISABLED)
                         ieee80211_sta_deauthenticate(sdata,
                                                 WLAN_REASON_DEAUTH_LEAVING);
-
-                memset(sdata->u.sta.bssid, 0, ETH_ALEN);
-                del_timer_sync(&sdata->u.sta.chswitch_timer);
-                del_timer_sync(&sdata->u.sta.timer);
+                memset(sdata->u.mgd.bssid, 0, ETH_ALEN);
+                del_timer_sync(&sdata->u.mgd.chswitch_timer);
+                del_timer_sync(&sdata->u.mgd.timer);
                 /*
                  * If the timer fired while we waited for it, it will have
                  * requeued the work. Now the work will be running again
@@ -468,8 +468,8 @@ static int ieee80211_stop(struct net_device *dev)
                  * whether the interface is running, which, at this point,
                  * it no longer is.
                  */
-                cancel_work_sync(&sdata->u.sta.work);
-                cancel_work_sync(&sdata->u.sta.chswitch_work);
+                cancel_work_sync(&sdata->u.mgd.work);
+                cancel_work_sync(&sdata->u.mgd.chswitch_work);
                 /*
                  * When we get here, the interface is marked down.
                  * Call synchronize_rcu() to wait for the RX path
@@ -477,13 +477,22 @@ static int ieee80211_stop(struct net_device *dev)
                  * frames at this very time on another CPU.
                  */
                 synchronize_rcu();
-                skb_queue_purge(&sdata->u.sta.skb_queue);
+                skb_queue_purge(&sdata->u.mgd.skb_queue);
 
-                sdata->u.sta.flags &= ~(IEEE80211_STA_PRIVACY_INVOKED |
+                sdata->u.mgd.flags &= ~(IEEE80211_STA_PRIVACY_INVOKED |
                                         IEEE80211_STA_TKIP_WEP_USED);
-                kfree(sdata->u.sta.extra_ie);
-                sdata->u.sta.extra_ie = NULL;
-                sdata->u.sta.extra_ie_len = 0;
+                kfree(sdata->u.mgd.extra_ie);
+                sdata->u.mgd.extra_ie = NULL;
+                sdata->u.mgd.extra_ie_len = 0;
+                /* fall through */
+        case NL80211_IFTYPE_ADHOC:
+                if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+                        memset(sdata->u.ibss.bssid, 0, ETH_ALEN);
+                        del_timer_sync(&sdata->u.ibss.timer);
+                        cancel_work_sync(&sdata->u.ibss.work);
+                        synchronize_rcu();
+                        skb_queue_purge(&sdata->u.ibss.skb_queue);
+                }
                 /* fall through */
         case NL80211_IFTYPE_MESH_POINT:
                 if (ieee80211_vif_is_mesh(&sdata->vif)) {
@@ -629,19 +638,20 @@ static void ieee80211_teardown_sdata(struct net_device *dev)
                 if (ieee80211_vif_is_mesh(&sdata->vif))
                         mesh_rmc_free(sdata);
                 break;
-        case NL80211_IFTYPE_STATION:
         case NL80211_IFTYPE_ADHOC:
-                kfree(sdata->u.sta.extra_ie);
-                kfree(sdata->u.sta.assocreq_ies);
-                kfree(sdata->u.sta.assocresp_ies);
-                kfree_skb(sdata->u.sta.probe_resp);
-                kfree(sdata->u.sta.ie_probereq);
-                kfree(sdata->u.sta.ie_proberesp);
-                kfree(sdata->u.sta.ie_auth);
-                kfree(sdata->u.sta.ie_assocreq);
-                kfree(sdata->u.sta.ie_reassocreq);
-                kfree(sdata->u.sta.ie_deauth);
-                kfree(sdata->u.sta.ie_disassoc);
+                kfree_skb(sdata->u.ibss.probe_resp);
+                break;
+        case NL80211_IFTYPE_STATION:
+                kfree(sdata->u.mgd.extra_ie);
+                kfree(sdata->u.mgd.assocreq_ies);
+                kfree(sdata->u.mgd.assocresp_ies);
+                kfree(sdata->u.mgd.ie_probereq);
+                kfree(sdata->u.mgd.ie_proberesp);
+                kfree(sdata->u.mgd.ie_auth);
+                kfree(sdata->u.mgd.ie_assocreq);
+                kfree(sdata->u.mgd.ie_reassocreq);
+                kfree(sdata->u.mgd.ie_deauth);
+                kfree(sdata->u.mgd.ie_disassoc);
                 break;
         case NL80211_IFTYPE_WDS:
         case NL80211_IFTYPE_AP_VLAN:
@@ -708,9 +718,11 @@ static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
                 INIT_LIST_HEAD(&sdata->u.ap.vlans);
                 break;
         case NL80211_IFTYPE_STATION:
-        case NL80211_IFTYPE_ADHOC:
                 ieee80211_sta_setup_sdata(sdata);
                 break;
+        case NL80211_IFTYPE_ADHOC:
+                ieee80211_ibss_setup_sdata(sdata);
+                break;
         case NL80211_IFTYPE_MESH_POINT:
                 if (ieee80211_vif_is_mesh(&sdata->vif))
                         ieee80211_mesh_init_sdata(sdata);
@@ -798,6 +810,7 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
 
         memcpy(ndev->dev_addr, local->hw.wiphy->perm_addr, ETH_ALEN);
         SET_NETDEV_DEV(ndev, wiphy_dev(local->hw.wiphy));
+        ndev->features |= NETIF_F_NETNS_LOCAL;
 
         /* don't use IEEE80211_DEV_TO_SUB_IF because it checks too much */
         sdata = netdev_priv(ndev);
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 19b480de4bbc..687acf23054d 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -400,7 +400,7 @@ void ieee80211_key_link(struct ieee80211_key *key,
                          */
 
                         /* same here, the AP could be using QoS */
-                        ap = sta_info_get(key->local, key->sdata->u.sta.bssid);
+                        ap = sta_info_get(key->local, key->sdata->u.mgd.bssid);
                         if (ap) {
                                 if (test_sta_flags(ap, WLAN_STA_WME))
                                         key->conf.flags |=
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 5667f4e8067f..f38db4d37e5d 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -169,9 +169,10 @@ int ieee80211_if_config(struct ieee80211_sub_if_data *sdata, u32 changed)
 
         memset(&conf, 0, sizeof(conf));
 
-        if (sdata->vif.type == NL80211_IFTYPE_STATION ||
-            sdata->vif.type == NL80211_IFTYPE_ADHOC)
-                conf.bssid = sdata->u.sta.bssid;
+        if (sdata->vif.type == NL80211_IFTYPE_STATION)
+                conf.bssid = sdata->u.mgd.bssid;
+        else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
+                conf.bssid = sdata->u.ibss.bssid;
         else if (sdata->vif.type == NL80211_IFTYPE_AP)
                 conf.bssid = sdata->dev->dev_addr;
         else if (ieee80211_vif_is_mesh(&sdata->vif)) {
@@ -210,7 +211,7 @@ int ieee80211_if_config(struct ieee80211_sub_if_data *sdata, u32 changed)
                                         !!rcu_dereference(sdata->u.ap.beacon);
                                 break;
                         case NL80211_IFTYPE_ADHOC:
-                                conf.enable_beacon = !!sdata->u.sta.probe_resp;
+                                conf.enable_beacon = !!sdata->u.ibss.probe_resp;
                                 break;
                         case NL80211_IFTYPE_MESH_POINT:
                                 conf.enable_beacon = true;
@@ -705,7 +706,7 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
                                         const struct ieee80211_ops *ops)
 {
         struct ieee80211_local *local;
-        int priv_size;
+        int priv_size, i;
         struct wiphy *wiphy;
 
         /* Ensure 32-byte alignment of our private data and hw private data.
@@ -779,6 +780,11 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         setup_timer(&local->dynamic_ps_timer,
                     ieee80211_dynamic_ps_timer, (unsigned long) local);
 
+        for (i = 0; i < IEEE80211_MAX_AMPDU_QUEUES; i++)
+                local->ampdu_ac_queue[i] = -1;
+        /* using an s8 won't work with more than that */
+        BUILD_BUG_ON(IEEE80211_MAX_AMPDU_QUEUES > 127);
+
         sta_info_init(local);
 
         tasklet_init(&local->tx_pending_tasklet, ieee80211_tx_pending,
@@ -855,6 +861,11 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         /* mac80211 always supports monitor */
         local->hw.wiphy->interface_modes |= BIT(NL80211_IFTYPE_MONITOR);
 
+        if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
+                local->hw.wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
+        else if (local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC)
+                local->hw.wiphy->signal_type = CFG80211_SIGNAL_TYPE_UNSPEC;
+
         result = wiphy_register(local->hw.wiphy);
         if (result < 0)
                 goto fail_wiphy_register;
@@ -872,7 +883,7 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
 
         mdev = alloc_netdev_mq(sizeof(struct ieee80211_master_priv),
                                "wmaster%d", ieee80211_master_setup,
-                               ieee80211_num_queues(hw));
+                               hw->queues);
         if (!mdev)
                 goto fail_mdev_alloc;
 
@@ -916,6 +927,7 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
 
         memcpy(local->mdev->dev_addr, local->hw.wiphy->perm_addr, ETH_ALEN);
         SET_NETDEV_DEV(local->mdev, wiphy_dev(local->hw.wiphy));
+        local->mdev->features |= NETIF_F_NETNS_LOCAL;
 
         result = register_netdevice(local->mdev);
         if (result < 0)
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index fbb766afe599..7f238589b6ff 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -15,11 +15,8 @@
 #include <linux/if_ether.h>
 #include <linux/skbuff.h>
 #include <linux/if_arp.h>
-#include <linux/wireless.h>
-#include <linux/random.h>
 #include <linux/etherdevice.h>
 #include <linux/rtnetlink.h>
-#include <net/iw_handler.h>
 #include <net/mac80211.h>
 #include <asm/unaligned.h>
 
@@ -35,15 +32,6 @@
 #define IEEE80211_MONITORING_INTERVAL (2 * HZ)
 #define IEEE80211_PROBE_INTERVAL (60 * HZ)
 #define IEEE80211_RETRY_AUTH_INTERVAL (1 * HZ)
-#define IEEE80211_SCAN_INTERVAL (2 * HZ)
-#define IEEE80211_SCAN_INTERVAL_SLOW (15 * HZ)
-#define IEEE80211_IBSS_JOIN_TIMEOUT (7 * HZ)
-
-#define IEEE80211_IBSS_MERGE_INTERVAL (30 * HZ)
-#define IEEE80211_IBSS_INACTIVITY_LIMIT (60 * HZ)
-
-#define IEEE80211_IBSS_MAX_STA_ENTRIES 128
-
 
 /* utils */
 static int ecw2cw(int ecw)
@@ -92,43 +80,6 @@ static int ieee80211_compatible_rates(struct ieee80211_bss *bss,
         return count;
 }
 
-/* also used by mesh code */
-u32 ieee80211_sta_get_rates(struct ieee80211_local *local,
-                            struct ieee802_11_elems *elems,
-                            enum ieee80211_band band)
-{
-        struct ieee80211_supported_band *sband;
-        struct ieee80211_rate *bitrates;
-        size_t num_rates;
-        u32 supp_rates;
-        int i, j;
-        sband = local->hw.wiphy->bands[band];
-
-        if (!sband) {
-                WARN_ON(1);
-                sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
-        }
-
-        bitrates = sband->bitrates;
-        num_rates = sband->n_bitrates;
-        supp_rates = 0;
-        for (i = 0; i < elems->supp_rates_len +
-                     elems->ext_supp_rates_len; i++) {
-                u8 rate = 0;
-                int own_rate;
-                if (i < elems->supp_rates_len)
-                        rate = elems->supp_rates[i];
-                else if (elems->ext_supp_rates)
-                        rate = elems->ext_supp_rates
-                                [i - elems->supp_rates_len];
-                own_rate = 5 * (rate & 0x7f);
-                for (j = 0; j < num_rates; j++)
-                        if (bitrates[j].bitrate == own_rate)
-                                supp_rates |= BIT(j);
-        }
-        return supp_rates;
-}
-
 /* frame sending functions */
 
 static void add_extra_ies(struct sk_buff *skb, u8 *ies, size_t ies_len)
@@ -137,113 +88,9 @@ static void add_extra_ies(struct sk_buff *skb, u8 *ies, size_t ies_len)
                 memcpy(skb_put(skb, ies_len), ies, ies_len);
 }
 
-/* also used by scanning code */
-void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
-                              u8 *ssid, size_t ssid_len)
-{
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_supported_band *sband;
-        struct sk_buff *skb;
-        struct ieee80211_mgmt *mgmt;
-        u8 *pos, *supp_rates, *esupp_rates = NULL;
-        int i;
-
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt) + 200 +
-                            sdata->u.sta.ie_probereq_len);
-        if (!skb) {
-                printk(KERN_DEBUG "%s: failed to allocate buffer for probe "
-                       "request\n", sdata->dev->name);
-                return;
-        }
-        skb_reserve(skb, local->hw.extra_tx_headroom);
-
-        mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
-        memset(mgmt, 0, 24);
-        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
-                                          IEEE80211_STYPE_PROBE_REQ);
-        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
-        if (dst) {
-                memcpy(mgmt->da, dst, ETH_ALEN);
-                memcpy(mgmt->bssid, dst, ETH_ALEN);
-        } else {
-                memset(mgmt->da, 0xff, ETH_ALEN);
-                memset(mgmt->bssid, 0xff, ETH_ALEN);
-        }
-        pos = skb_put(skb, 2 + ssid_len);
-        *pos++ = WLAN_EID_SSID;
-        *pos++ = ssid_len;
-        memcpy(pos, ssid, ssid_len);
-
-        supp_rates = skb_put(skb, 2);
-        supp_rates[0] = WLAN_EID_SUPP_RATES;
-        supp_rates[1] = 0;
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
-
-        for (i = 0; i < sband->n_bitrates; i++) {
-                struct ieee80211_rate *rate = &sband->bitrates[i];
-                if (esupp_rates) {
-                        pos = skb_put(skb, 1);
-                        esupp_rates[1]++;
-                } else if (supp_rates[1] == 8) {
-                        esupp_rates = skb_put(skb, 3);
-                        esupp_rates[0] = WLAN_EID_EXT_SUPP_RATES;
-                        esupp_rates[1] = 1;
-                        pos = &esupp_rates[2];
-                } else {
-                        pos = skb_put(skb, 1);
-                        supp_rates[1]++;
-                }
-                *pos = rate->bitrate / 5;
-        }
-
-        add_extra_ies(skb, sdata->u.sta.ie_probereq,
-                      sdata->u.sta.ie_probereq_len);
-
-        ieee80211_tx_skb(sdata, skb, 0);
-}
-
-static void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
-                                struct ieee80211_if_sta *ifsta,
-                                int transaction, u8 *extra, size_t extra_len,
-                                int encrypt)
-{
-        struct ieee80211_local *local = sdata->local;
-        struct sk_buff *skb;
-        struct ieee80211_mgmt *mgmt;
-
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom +
-                            sizeof(*mgmt) + 6 + extra_len +
-                            sdata->u.sta.ie_auth_len);
-        if (!skb) {
-                printk(KERN_DEBUG "%s: failed to allocate buffer for auth "
-                       "frame\n", sdata->dev->name);
-                return;
-        }
-        skb_reserve(skb, local->hw.extra_tx_headroom);
-
-        mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24 + 6);
-        memset(mgmt, 0, 24 + 6);
-        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
-                                          IEEE80211_STYPE_AUTH);
-        if (encrypt)
-                mgmt->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
-        memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
-        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
-        memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
-        mgmt->u.auth.auth_alg = cpu_to_le16(ifsta->auth_alg);
-        mgmt->u.auth.auth_transaction = cpu_to_le16(transaction);
-        ifsta->auth_transaction = transaction + 1;
-        mgmt->u.auth.status_code = cpu_to_le16(0);
-        if (extra)
-                memcpy(skb_put(skb, extra_len), extra, extra_len);
-        add_extra_ies(skb, sdata->u.sta.ie_auth, sdata->u.sta.ie_auth_len);
-
-        ieee80211_tx_skb(sdata, skb, encrypt);
-}
-
-static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
-                                 struct ieee80211_if_sta *ifsta)
+static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
 {
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
@@ -256,17 +103,17 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
         u32 rates = 0;
         size_t e_ies_len;
 
-        if (ifsta->flags & IEEE80211_STA_PREV_BSSID_SET) {
-                e_ies = sdata->u.sta.ie_reassocreq;
-                e_ies_len = sdata->u.sta.ie_reassocreq_len;
+        if (ifmgd->flags & IEEE80211_IBSS_PREV_BSSID_SET) {
+                e_ies = sdata->u.mgd.ie_reassocreq;
+                e_ies_len = sdata->u.mgd.ie_reassocreq_len;
         } else {
-                e_ies = sdata->u.sta.ie_assocreq;
-                e_ies_len = sdata->u.sta.ie_assocreq_len;
+                e_ies = sdata->u.mgd.ie_assocreq;
+                e_ies_len = sdata->u.mgd.ie_assocreq_len;
         }
 
         skb = dev_alloc_skb(local->hw.extra_tx_headroom +
-                            sizeof(*mgmt) + 200 + ifsta->extra_ie_len +
-                            ifsta->ssid_len + e_ies_len);
+                            sizeof(*mgmt) + 200 + ifmgd->extra_ie_len +
+                            ifmgd->ssid_len + e_ies_len);
         if (!skb) {
                 printk(KERN_DEBUG "%s: failed to allocate buffer for assoc "
                        "frame\n", sdata->dev->name);
@@ -276,7 +123,7 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
 
         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 
-        capab = ifsta->capab;
+        capab = ifmgd->capab;
 
         if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ) {
                 if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE))
@@ -285,9 +132,9 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
                         capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
         }
 
-        bss = ieee80211_rx_bss_get(local, ifsta->bssid,
+        bss = ieee80211_rx_bss_get(local, ifmgd->bssid,
                                    local->hw.conf.channel->center_freq,
-                                   ifsta->ssid, ifsta->ssid_len);
+                                   ifmgd->ssid, ifmgd->ssid_len);
         if (bss) {
                 if (bss->cbss.capability & WLAN_CAPABILITY_PRIVACY)
                         capab |= WLAN_CAPABILITY_PRIVACY;
@@ -312,18 +159,18 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
 
         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
         memset(mgmt, 0, 24);
-        memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
+        memcpy(mgmt->da, ifmgd->bssid, ETH_ALEN);
         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
-        memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
+        memcpy(mgmt->bssid, ifmgd->bssid, ETH_ALEN);
 
-        if (ifsta->flags & IEEE80211_STA_PREV_BSSID_SET) {
+        if (ifmgd->flags & IEEE80211_STA_PREV_BSSID_SET) {
                 skb_put(skb, 10);
                 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                                   IEEE80211_STYPE_REASSOC_REQ);
                 mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
                 mgmt->u.reassoc_req.listen_interval =
                                 cpu_to_le16(local->hw.conf.listen_interval);
-                memcpy(mgmt->u.reassoc_req.current_ap, ifsta->prev_bssid,
+                memcpy(mgmt->u.reassoc_req.current_ap, ifmgd->prev_bssid,
                        ETH_ALEN);
         } else {
                 skb_put(skb, 4);
@@ -335,10 +182,10 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
         }
 
         /* SSID */
-        ies = pos = skb_put(skb, 2 + ifsta->ssid_len);
+        ies = pos = skb_put(skb, 2 + ifmgd->ssid_len);
         *pos++ = WLAN_EID_SSID;
-        *pos++ = ifsta->ssid_len;
-        memcpy(pos, ifsta->ssid, ifsta->ssid_len);
+        *pos++ = ifmgd->ssid_len;
+        memcpy(pos, ifmgd->ssid, ifmgd->ssid_len);
 
         /* add all rates which were marked to be used above */
         supp_rates_len = rates_len;
@@ -393,12 +240,12 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
                 }
         }
 
-        if (ifsta->extra_ie) {
-                pos = skb_put(skb, ifsta->extra_ie_len);
-                memcpy(pos, ifsta->extra_ie, ifsta->extra_ie_len);
+        if (ifmgd->extra_ie) {
+                pos = skb_put(skb, ifmgd->extra_ie_len);
+                memcpy(pos, ifmgd->extra_ie, ifmgd->extra_ie_len);
         }
 
-        if (wmm && (ifsta->flags & IEEE80211_STA_WMM_ENABLED)) {
+        if (wmm && (ifmgd->flags & IEEE80211_STA_WMM_ENABLED)) {
                 pos = skb_put(skb, 9);
                 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
                 *pos++ = 7; /* len */
@@ -418,11 +265,11 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
          * mode (11a/b/g) if any one of these ciphers is
          * configured as pairwise.
          */
-        if (wmm && (ifsta->flags & IEEE80211_STA_WMM_ENABLED) &&
+        if (wmm && (ifmgd->flags & IEEE80211_STA_WMM_ENABLED) &&
             sband->ht_cap.ht_supported &&
             (ht_ie = ieee80211_bss_get_ie(bss, WLAN_EID_HT_INFORMATION)) &&
             ht_ie[1] >= sizeof(struct ieee80211_ht_info) &&
-            (!(ifsta->flags & IEEE80211_STA_TKIP_WEP_USED))) {
+            (!(ifmgd->flags & IEEE80211_STA_TKIP_WEP_USED))) {
                 struct ieee80211_ht_info *ht_info =
                         (struct ieee80211_ht_info *)(ht_ie + 2);
                 u16 cap = sband->ht_cap.cap;
@@ -459,11 +306,11 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
 
         add_extra_ies(skb, e_ies, e_ies_len);
 
-        kfree(ifsta->assocreq_ies);
-        ifsta->assocreq_ies_len = (skb->data + skb->len) - ies;
-        ifsta->assocreq_ies = kmalloc(ifsta->assocreq_ies_len, GFP_KERNEL);
-        if (ifsta->assocreq_ies)
-                memcpy(ifsta->assocreq_ies, ies, ifsta->assocreq_ies_len);
+        kfree(ifmgd->assocreq_ies);
+        ifmgd->assocreq_ies_len = (skb->data + skb->len) - ies;
+        ifmgd->assocreq_ies = kmalloc(ifmgd->assocreq_ies_len, GFP_KERNEL);
+        if (ifmgd->assocreq_ies)
+                memcpy(ifmgd->assocreq_ies, ies, ifmgd->assocreq_ies_len);
 
         ieee80211_tx_skb(sdata, skb, 0);
 }
@@ -473,18 +320,18 @@ static void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
                                            u16 stype, u16 reason)
 {
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
         u8 *ies;
         size_t ies_len;
 
         if (stype == IEEE80211_STYPE_DEAUTH) {
-                ies = sdata->u.sta.ie_deauth;
-                ies_len = sdata->u.sta.ie_deauth_len;
+                ies = sdata->u.mgd.ie_deauth;
+                ies_len = sdata->u.mgd.ie_deauth_len;
         } else {
-                ies = sdata->u.sta.ie_disassoc;
-                ies_len = sdata->u.sta.ie_disassoc_len;
+                ies = sdata->u.mgd.ie_disassoc;
+                ies_len = sdata->u.mgd.ie_disassoc_len;
         }
 
         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt) +
@@ -498,9 +345,9 @@ static void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
 
         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
         memset(mgmt, 0, 24);
-        memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
+        memcpy(mgmt->da, ifmgd->bssid, ETH_ALEN);
         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
-        memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
+        memcpy(mgmt->bssid, ifmgd->bssid, ETH_ALEN);
         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | stype);
         skb_put(skb, 2);
         /* u.deauth.reason_code == u.disassoc.reason_code */
@@ -508,13 +355,13 @@ static void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
 
         add_extra_ies(skb, ies, ies_len);
 
-        ieee80211_tx_skb(sdata, skb, ifsta->flags & IEEE80211_STA_MFP_ENABLED);
+        ieee80211_tx_skb(sdata, skb, ifmgd->flags & IEEE80211_STA_MFP_ENABLED);
 }
 
 void ieee80211_send_pspoll(struct ieee80211_local *local,
                            struct ieee80211_sub_if_data *sdata)
 {
-        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_pspoll *pspoll;
         struct sk_buff *skb;
         u16 fc;
@@ -531,43 +378,20 @@ void ieee80211_send_pspoll(struct ieee80211_local *local,
         memset(pspoll, 0, sizeof(*pspoll));
         fc = IEEE80211_FTYPE_CTL | IEEE80211_STYPE_PSPOLL | IEEE80211_FCTL_PM;
         pspoll->frame_control = cpu_to_le16(fc);
-        pspoll->aid = cpu_to_le16(ifsta->aid);
+        pspoll->aid = cpu_to_le16(ifmgd->aid);
 
         /* aid in PS-Poll has its two MSBs each set to 1 */
         pspoll->aid |= cpu_to_le16(1 << 15 | 1 << 14);
 
-        memcpy(pspoll->bssid, ifsta->bssid, ETH_ALEN);
+        memcpy(pspoll->bssid, ifmgd->bssid, ETH_ALEN);
         memcpy(pspoll->ta, sdata->dev->dev_addr, ETH_ALEN);
 
         ieee80211_tx_skb(sdata, skb, 0);
-
-        return;
 }
 
 /* MLME */
-static void ieee80211_sta_def_wmm_params(struct ieee80211_sub_if_data *sdata,
-                                         const size_t supp_rates_len,
-                                         const u8 *supp_rates)
-{
-        struct ieee80211_local *local = sdata->local;
-        int i, have_higher_than_11mbit = 0;
-
-        /* cf. IEEE 802.11 9.2.12 */
-        for (i = 0; i < supp_rates_len; i++)
-                if ((supp_rates[i] & 0x7f) * 5 > 110)
-                        have_higher_than_11mbit = 1;
-
-        if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ &&
-            have_higher_than_11mbit)
-                sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
-        else
-                sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
-
-        ieee80211_set_wmm_default(sdata);
-}
-
 static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
-                                     struct ieee80211_if_sta *ifsta,
+                                     struct ieee80211_if_managed *ifmgd,
                                      u8 *wmm_param, size_t wmm_param_len)
 {
         struct ieee80211_tx_queue_params params;
@@ -575,7 +399,7 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
         int count;
         u8 *pos;
 
-        if (!(ifsta->flags & IEEE80211_STA_WMM_ENABLED))
+        if (!(ifmgd->flags & IEEE80211_STA_WMM_ENABLED))
                 return;
 
         if (!wmm_param)
@@ -584,9 +408,9 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
         if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
                 return;
         count = wmm_param[6] & 0x0f;
-        if (count == ifsta->wmm_last_param_set)
+        if (count == ifmgd->wmm_last_param_set)
                 return;
-        ifsta->wmm_last_param_set = count;
+        ifmgd->wmm_last_param_set = count;
 
         pos = wmm_param + 8;
         left = wmm_param_len - 8;
@@ -671,7 +495,7 @@ static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 #endif
         u32 changed = 0;
         bool use_protection;
@@ -694,7 +518,7 @@ static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
                         printk(KERN_DEBUG "%s: CTS protection %s (BSSID=%pM)\n",
                                sdata->dev->name,
                                use_protection ? "enabled" : "disabled",
-                               ifsta->bssid);
+                               ifmgd->bssid);
                 }
 #endif
                 bss_conf->use_cts_prot = use_protection;
@@ -708,7 +532,7 @@ static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
                                " (BSSID=%pM)\n",
                                sdata->dev->name,
                                use_short_preamble ? "short" : "long",
-                               ifsta->bssid);
+                               ifmgd->bssid);
                 }
 #endif
                 bss_conf->use_short_preamble = use_short_preamble;
@@ -722,7 +546,7 @@ static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
                                " (BSSID=%pM)\n",
                                sdata->dev->name,
                                use_short_slot ? "short" : "long",
-                               ifsta->bssid);
+                               ifmgd->bssid);
                 }
 #endif
                 bss_conf->use_short_slot = use_short_slot;
@@ -732,57 +556,57 @@ static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
         return changed;
 }
 
-static void ieee80211_sta_send_apinfo(struct ieee80211_sub_if_data *sdata,
-                                        struct ieee80211_if_sta *ifsta)
+static void ieee80211_sta_send_apinfo(struct ieee80211_sub_if_data *sdata)
 {
         union iwreq_data wrqu;
+
         memset(&wrqu, 0, sizeof(wrqu));
-        if (ifsta->flags & IEEE80211_STA_ASSOCIATED)
-                memcpy(wrqu.ap_addr.sa_data, sdata->u.sta.bssid, ETH_ALEN);
+        if (sdata->u.mgd.flags & IEEE80211_STA_ASSOCIATED)
+                memcpy(wrqu.ap_addr.sa_data, sdata->u.mgd.bssid, ETH_ALEN);
         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
         wireless_send_event(sdata->dev, SIOCGIWAP, &wrqu, NULL);
 }
 
-static void ieee80211_sta_send_associnfo(struct ieee80211_sub_if_data *sdata,
-                                         struct ieee80211_if_sta *ifsta)
+static void ieee80211_sta_send_associnfo(struct ieee80211_sub_if_data *sdata)
 {
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         char *buf;
         size_t len;
         int i;
         union iwreq_data wrqu;
 
-        if (!ifsta->assocreq_ies && !ifsta->assocresp_ies)
+        if (!ifmgd->assocreq_ies && !ifmgd->assocresp_ies)
                 return;
 
-        buf = kmalloc(50 + 2 * (ifsta->assocreq_ies_len +
-                                ifsta->assocresp_ies_len), GFP_KERNEL);
+        buf = kmalloc(50 + 2 * (ifmgd->assocreq_ies_len +
+                                ifmgd->assocresp_ies_len), GFP_KERNEL);
         if (!buf)
                 return;
 
         len = sprintf(buf, "ASSOCINFO(");
-        if (ifsta->assocreq_ies) {
+        if (ifmgd->assocreq_ies) {
                 len += sprintf(buf + len, "ReqIEs=");
-                for (i = 0; i < ifsta->assocreq_ies_len; i++) {
+                for (i = 0; i < ifmgd->assocreq_ies_len; i++) {
                         len += sprintf(buf + len, "%02x",
-                                       ifsta->assocreq_ies[i]);
+                                       ifmgd->assocreq_ies[i]);
                 }
         }
-        if (ifsta->assocresp_ies) {
-                if (ifsta->assocreq_ies)
+        if (ifmgd->assocresp_ies) {
+                if (ifmgd->assocreq_ies)
                         len += sprintf(buf + len, " ");
                 len += sprintf(buf + len, "RespIEs=");
-                for (i = 0; i < ifsta->assocresp_ies_len; i++) {
+                for (i = 0; i < ifmgd->assocresp_ies_len; i++) {
                         len += sprintf(buf + len, "%02x",
-                                       ifsta->assocresp_ies[i]);
+                                       ifmgd->assocresp_ies[i]);
                 }
         }
         len += sprintf(buf + len, ")");
 
         if (len > IW_CUSTOM_MAX) {
                 len = sprintf(buf, "ASSOCRESPIE=");
-                for (i = 0; i < ifsta->assocresp_ies_len; i++) {
+                for (i = 0; i < ifmgd->assocresp_ies_len; i++) {
                         len += sprintf(buf + len, "%02x",
-                                       ifsta->assocresp_ies[i]);
+                                       ifmgd->assocresp_ies[i]);
                 }
         }
 
@@ -797,20 +621,20 @@ static void ieee80211_sta_send_associnfo(struct ieee80211_sub_if_data *sdata,
 
 
 static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
-                                     struct ieee80211_if_sta *ifsta,
                                      u32 bss_info_changed)
 {
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_conf *conf = &local_to_hw(local)->conf;
 
         struct ieee80211_bss *bss;
 
         bss_info_changed |= BSS_CHANGED_ASSOC;
-        ifsta->flags |= IEEE80211_STA_ASSOCIATED;
+        ifmgd->flags |= IEEE80211_STA_ASSOCIATED;
 
-        bss = ieee80211_rx_bss_get(local, ifsta->bssid,
+        bss = ieee80211_rx_bss_get(local, ifmgd->bssid,
                                    conf->channel->center_freq,
-                                   ifsta->ssid, ifsta->ssid_len);
+                                   ifmgd->ssid, ifmgd->ssid_len);
         if (bss) {
                 /* set timing information */
                 sdata->vif.bss_conf.beacon_int = bss->cbss.beacon_interval;
@@ -823,11 +647,11 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
                 ieee80211_rx_bss_put(local, bss);
         }
 
-        ifsta->flags |= IEEE80211_STA_PREV_BSSID_SET;
-        memcpy(ifsta->prev_bssid, sdata->u.sta.bssid, ETH_ALEN);
-        ieee80211_sta_send_associnfo(sdata, ifsta);
+        ifmgd->flags |= IEEE80211_STA_PREV_BSSID_SET;
+        memcpy(ifmgd->prev_bssid, sdata->u.mgd.bssid, ETH_ALEN);
+        ieee80211_sta_send_associnfo(sdata);
 
-        ifsta->last_probe = jiffies;
+        ifmgd->last_probe = jiffies;
         ieee80211_led_assoc(local, 1);
 
         sdata->vif.bss_conf.assoc = 1;
@@ -856,70 +680,74 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
         netif_tx_start_all_queues(sdata->dev);
         netif_carrier_on(sdata->dev);
 
-        ieee80211_sta_send_apinfo(sdata, ifsta);
+        ieee80211_sta_send_apinfo(sdata);
 }
 
-static void ieee80211_direct_probe(struct ieee80211_sub_if_data *sdata,
-                                   struct ieee80211_if_sta *ifsta)
+static void ieee80211_direct_probe(struct ieee80211_sub_if_data *sdata)
 {
-        ifsta->direct_probe_tries++;
-        if (ifsta->direct_probe_tries > IEEE80211_AUTH_MAX_TRIES) {
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+
+        ifmgd->direct_probe_tries++;
+        if (ifmgd->direct_probe_tries > IEEE80211_AUTH_MAX_TRIES) {
                 printk(KERN_DEBUG "%s: direct probe to AP %pM timed out\n",
-                       sdata->dev->name, ifsta->bssid);
-                ifsta->state = IEEE80211_STA_MLME_DISABLED;
-                ieee80211_sta_send_apinfo(sdata, ifsta);
+                       sdata->dev->name, ifmgd->bssid);
+                ifmgd->state = IEEE80211_STA_MLME_DISABLED;
+                ieee80211_sta_send_apinfo(sdata);
 
                 /*
                  * Most likely AP is not in the range so remove the
                  * bss information associated to the AP
                  */
-                ieee80211_rx_bss_remove(sdata, ifsta->bssid,
+                ieee80211_rx_bss_remove(sdata, ifmgd->bssid,
                                 sdata->local->hw.conf.channel->center_freq,
-                                ifsta->ssid, ifsta->ssid_len);
+                                ifmgd->ssid, ifmgd->ssid_len);
                 return;
         }
 
         printk(KERN_DEBUG "%s: direct probe to AP %pM try %d\n",
-                        sdata->dev->name, ifsta->bssid,
-                        ifsta->direct_probe_tries);
+                        sdata->dev->name, ifmgd->bssid,
+                        ifmgd->direct_probe_tries);
 
-        ifsta->state = IEEE80211_STA_MLME_DIRECT_PROBE;
+        ifmgd->state = IEEE80211_STA_MLME_DIRECT_PROBE;
 
-        set_bit(IEEE80211_STA_REQ_DIRECT_PROBE, &ifsta->request);
+        set_bit(IEEE80211_STA_REQ_DIRECT_PROBE, &ifmgd->request);
 
         /* Direct probe is sent to broadcast address as some APs
          * will not answer to direct packet in unassociated state.
          */
         ieee80211_send_probe_req(sdata, NULL,
-                                 ifsta->ssid, ifsta->ssid_len);
+                                 ifmgd->ssid, ifmgd->ssid_len, NULL, 0);
 
-        mod_timer(&ifsta->timer, jiffies + IEEE80211_AUTH_TIMEOUT);
+        mod_timer(&ifmgd->timer, jiffies + IEEE80211_AUTH_TIMEOUT);
 }
 
 
-static void ieee80211_authenticate(struct ieee80211_sub_if_data *sdata,
-                                   struct ieee80211_if_sta *ifsta)
+static void ieee80211_authenticate(struct ieee80211_sub_if_data *sdata)
 {
-        ifsta->auth_tries++;
-        if (ifsta->auth_tries > IEEE80211_AUTH_MAX_TRIES) {
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+
+        ifmgd->auth_tries++;
+        if (ifmgd->auth_tries > IEEE80211_AUTH_MAX_TRIES) {
                 printk(KERN_DEBUG "%s: authentication with AP %pM"
                        " timed out\n",
-                       sdata->dev->name, ifsta->bssid);
-                ifsta->state = IEEE80211_STA_MLME_DISABLED;
-                ieee80211_sta_send_apinfo(sdata, ifsta);
-                ieee80211_rx_bss_remove(sdata, ifsta->bssid,
+                       sdata->dev->name, ifmgd->bssid);
+                ifmgd->state = IEEE80211_STA_MLME_DISABLED;
+                ieee80211_sta_send_apinfo(sdata);
+                ieee80211_rx_bss_remove(sdata, ifmgd->bssid,
                                 sdata->local->hw.conf.channel->center_freq,
-                                ifsta->ssid, ifsta->ssid_len);
+                                ifmgd->ssid, ifmgd->ssid_len);
                 return;
         }
 
-        ifsta->state = IEEE80211_STA_MLME_AUTHENTICATE;
+        ifmgd->state = IEEE80211_STA_MLME_AUTHENTICATE;
         printk(KERN_DEBUG "%s: authenticate with AP %pM\n",
-               sdata->dev->name, ifsta->bssid);
+               sdata->dev->name, ifmgd->bssid);
 
-        ieee80211_send_auth(sdata, ifsta, 1, NULL, 0, 0);
+        ieee80211_send_auth(sdata, 1, ifmgd->auth_alg, NULL, 0,
+                            ifmgd->bssid, 0);
+        ifmgd->auth_transaction = 2;
 
-        mod_timer(&ifsta->timer, jiffies + IEEE80211_AUTH_TIMEOUT);
+        mod_timer(&ifmgd->timer, jiffies + IEEE80211_AUTH_TIMEOUT);
 }
 
 /*
@@ -927,27 +755,28 @@ static void ieee80211_authenticate(struct ieee80211_sub_if_data *sdata,
  * if self disconnected or a reason code from the AP.
  */
 static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
-                                   struct ieee80211_if_sta *ifsta, bool deauth,
-                                   bool self_disconnected, u16 reason)
+                                   bool deauth, bool self_disconnected,
+                                   u16 reason)
 {
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
         u32 changed = 0, config_changed = 0;
 
         rcu_read_lock();
 
-        sta = sta_info_get(local, ifsta->bssid);
+        sta = sta_info_get(local, ifmgd->bssid);
         if (!sta) {
                 rcu_read_unlock();
                 return;
         }
 
         if (deauth) {
-                ifsta->direct_probe_tries = 0;
-                ifsta->auth_tries = 0;
+                ifmgd->direct_probe_tries = 0;
+                ifmgd->auth_tries = 0;
         }
-        ifsta->assoc_scan_tries = 0;
-        ifsta->assoc_tries = 0;
+        ifmgd->assoc_scan_tries = 0;
+        ifmgd->assoc_tries = 0;
 
         netif_tx_stop_all_queues(sdata->dev);
         netif_carrier_off(sdata->dev);
@@ -963,20 +792,20 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
                                 IEEE80211_STYPE_DISASSOC, reason);
         }
 
-        ifsta->flags &= ~IEEE80211_STA_ASSOCIATED;
+        ifmgd->flags &= ~IEEE80211_STA_ASSOCIATED;
         changed |= ieee80211_reset_erp_info(sdata);
 
         ieee80211_led_assoc(local, 0);
         changed |= BSS_CHANGED_ASSOC;
         sdata->vif.bss_conf.assoc = false;
 
-        ieee80211_sta_send_apinfo(sdata, ifsta);
+        ieee80211_sta_send_apinfo(sdata);
 
         if (self_disconnected || reason == WLAN_REASON_DISASSOC_STA_HAS_LEFT) {
-                ifsta->state = IEEE80211_STA_MLME_DISABLED;
-                ieee80211_rx_bss_remove(sdata, ifsta->bssid,
+                ifmgd->state = IEEE80211_STA_MLME_DISABLED;
+                ieee80211_rx_bss_remove(sdata, ifmgd->bssid,
                                 sdata->local->hw.conf.channel->center_freq,
-                                ifsta->ssid, ifsta->ssid_len);
+                                ifmgd->ssid, ifmgd->ssid_len);
         }
 
         rcu_read_unlock();
@@ -999,7 +828,7 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
 
         rcu_read_lock();
 
-        sta = sta_info_get(local, ifsta->bssid);
+        sta = sta_info_get(local, ifmgd->bssid);
         if (!sta) {
                 rcu_read_unlock();
                 return;
@@ -1020,27 +849,27 @@ static int ieee80211_sta_wep_configured(struct ieee80211_sub_if_data *sdata)
         return 1;
 }
 
-static int ieee80211_privacy_mismatch(struct ieee80211_sub_if_data *sdata,
-                                      struct ieee80211_if_sta *ifsta)
+static int ieee80211_privacy_mismatch(struct ieee80211_sub_if_data *sdata)
 {
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_bss *bss;
         int bss_privacy;
         int wep_privacy;
         int privacy_invoked;
 
-        if (!ifsta || (ifsta->flags & IEEE80211_STA_MIXED_CELL))
+        if (!ifmgd || (ifmgd->flags & IEEE80211_STA_MIXED_CELL))
                 return 0;
 
-        bss = ieee80211_rx_bss_get(local, ifsta->bssid,
+        bss = ieee80211_rx_bss_get(local, ifmgd->bssid,
                                    local->hw.conf.channel->center_freq,
-                                   ifsta->ssid, ifsta->ssid_len);
+                                   ifmgd->ssid, ifmgd->ssid_len);
         if (!bss)
                 return 0;
 
         bss_privacy = !!(bss->cbss.capability & WLAN_CAPABILITY_PRIVACY);
         wep_privacy = !!ieee80211_sta_wep_configured(sdata);
-        privacy_invoked = !!(ifsta->flags & IEEE80211_STA_PRIVACY_INVOKED);
+        privacy_invoked = !!(ifmgd->flags & IEEE80211_STA_PRIVACY_INVOKED);
 
         ieee80211_rx_bss_put(local, bss);
 
@@ -1050,41 +879,42 @@ static int ieee80211_privacy_mismatch(struct ieee80211_sub_if_data *sdata,
         return 1;
 }
 
-static void ieee80211_associate(struct ieee80211_sub_if_data *sdata,
-                                struct ieee80211_if_sta *ifsta)
+static void ieee80211_associate(struct ieee80211_sub_if_data *sdata)
 {
-        ifsta->assoc_tries++;
-        if (ifsta->assoc_tries > IEEE80211_ASSOC_MAX_TRIES) {
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+
+        ifmgd->assoc_tries++;
+        if (ifmgd->assoc_tries > IEEE80211_ASSOC_MAX_TRIES) {
                 printk(KERN_DEBUG "%s: association with AP %pM"
                        " timed out\n",
-                       sdata->dev->name, ifsta->bssid);
-                ifsta->state = IEEE80211_STA_MLME_DISABLED;
-                ieee80211_sta_send_apinfo(sdata, ifsta);
-                ieee80211_rx_bss_remove(sdata, ifsta->bssid,
+                       sdata->dev->name, ifmgd->bssid);
+                ifmgd->state = IEEE80211_STA_MLME_DISABLED;
+                ieee80211_sta_send_apinfo(sdata);
+                ieee80211_rx_bss_remove(sdata, ifmgd->bssid,
                                 sdata->local->hw.conf.channel->center_freq,
-                                ifsta->ssid, ifsta->ssid_len);
+                                ifmgd->ssid, ifmgd->ssid_len);
                 return;
         }
 
-        ifsta->state = IEEE80211_STA_MLME_ASSOCIATE;
+        ifmgd->state = IEEE80211_STA_MLME_ASSOCIATE;
         printk(KERN_DEBUG "%s: associate with AP %pM\n",
-               sdata->dev->name, ifsta->bssid);
-        if (ieee80211_privacy_mismatch(sdata, ifsta)) {
+               sdata->dev->name, ifmgd->bssid);
+        if (ieee80211_privacy_mismatch(sdata)) {
                 printk(KERN_DEBUG "%s: mismatch in privacy configuration and "
                        "mixed-cell disabled - abort association\n", sdata->dev->name);
-                ifsta->state = IEEE80211_STA_MLME_DISABLED;
+                ifmgd->state = IEEE80211_STA_MLME_DISABLED;
                 return;
         }
 
-        ieee80211_send_assoc(sdata, ifsta);
+        ieee80211_send_assoc(sdata);
 
-        mod_timer(&ifsta->timer, jiffies + IEEE80211_ASSOC_TIMEOUT);
+        mod_timer(&ifmgd->timer, jiffies + IEEE80211_ASSOC_TIMEOUT);
 }
 
 
-static void ieee80211_associated(struct ieee80211_sub_if_data *sdata,
-                                 struct ieee80211_if_sta *ifsta)
+static void ieee80211_associated(struct ieee80211_sub_if_data *sdata)
 {
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
         int disassoc;
@@ -1094,38 +924,40 @@ static void ieee80211_associated(struct ieee80211_sub_if_data *sdata,
          * for better APs. */
         /* TODO: remove expired BSSes */
 
-        ifsta->state = IEEE80211_STA_MLME_ASSOCIATED;
+        ifmgd->state = IEEE80211_STA_MLME_ASSOCIATED;
 
         rcu_read_lock();
 
-        sta = sta_info_get(local, ifsta->bssid);
+        sta = sta_info_get(local, ifmgd->bssid);
         if (!sta) {
                 printk(KERN_DEBUG "%s: No STA entry for own AP %pM\n",
-                       sdata->dev->name, ifsta->bssid);
+                       sdata->dev->name, ifmgd->bssid);
                 disassoc = 1;
         } else {
                 disassoc = 0;
                 if (time_after(jiffies,
                                sta->last_rx + IEEE80211_MONITORING_INTERVAL)) {
-                        if (ifsta->flags & IEEE80211_STA_PROBEREQ_POLL) {
+                        if (ifmgd->flags & IEEE80211_STA_PROBEREQ_POLL) {
                                 printk(KERN_DEBUG "%s: No ProbeResp from "
                                        "current AP %pM - assume out of "
                                        "range\n",
-                                       sdata->dev->name, ifsta->bssid);
+                                       sdata->dev->name, ifmgd->bssid);
                                 disassoc = 1;
                         } else
-                                ieee80211_send_probe_req(sdata, ifsta->bssid,
-                                                         ifsta->ssid,
-                                                         ifsta->ssid_len);
-                        ifsta->flags ^= IEEE80211_STA_PROBEREQ_POLL;
+                                ieee80211_send_probe_req(sdata, ifmgd->bssid,
+                                                         ifmgd->ssid,
+                                                         ifmgd->ssid_len,
+                                                         NULL, 0);
+                        ifmgd->flags ^= IEEE80211_STA_PROBEREQ_POLL;
                 } else {
-                        ifsta->flags &= ~IEEE80211_STA_PROBEREQ_POLL;
-                        if (time_after(jiffies, ifsta->last_probe +
+                        ifmgd->flags &= ~IEEE80211_STA_PROBEREQ_POLL;
+                        if (time_after(jiffies, ifmgd->last_probe +
                                        IEEE80211_PROBE_INTERVAL)) {
-                                ifsta->last_probe = jiffies;
-                                ieee80211_send_probe_req(sdata, ifsta->bssid,
-                                                         ifsta->ssid,
-                                                         ifsta->ssid_len);
+                                ifmgd->last_probe = jiffies;
+                                ieee80211_send_probe_req(sdata, ifmgd->bssid,
+                                                         ifmgd->ssid,
+                                                         ifmgd->ssid_len,
+                                                         NULL, 0);
                         }
                 }
         }
@@ -1133,25 +965,25 @@ static void ieee80211_associated(struct ieee80211_sub_if_data *sdata,
         rcu_read_unlock();
 
         if (disassoc)
-                ieee80211_set_disassoc(sdata, ifsta, true, true,
+                ieee80211_set_disassoc(sdata, true, true,
                                         WLAN_REASON_PREV_AUTH_NOT_VALID);
         else
-                mod_timer(&ifsta->timer, jiffies +
+                mod_timer(&ifmgd->timer, jiffies +
                                       IEEE80211_MONITORING_INTERVAL);
 }
 
 
-static void ieee80211_auth_completed(struct ieee80211_sub_if_data *sdata,
-                                     struct ieee80211_if_sta *ifsta)
+static void ieee80211_auth_completed(struct ieee80211_sub_if_data *sdata)
 {
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+
         printk(KERN_DEBUG "%s: authenticated\n", sdata->dev->name);
-        ifsta->flags |= IEEE80211_STA_AUTHENTICATED;
-        ieee80211_associate(sdata, ifsta);
+        ifmgd->flags |= IEEE80211_STA_AUTHENTICATED;
+        ieee80211_associate(sdata);
 }
 
 
 static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
-                                     struct ieee80211_if_sta *ifsta,
                                      struct ieee80211_mgmt *mgmt,
                                      size_t len)
 {
@@ -1162,59 +994,37 @@ static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
         ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
         if (!elems.challenge)
                 return;
-        ieee80211_send_auth(sdata, ifsta, 3, elems.challenge - 2,
-                            elems.challenge_len + 2, 1);
-}
-
-static void ieee80211_rx_mgmt_auth_ibss(struct ieee80211_sub_if_data *sdata,
-                                        struct ieee80211_if_sta *ifsta,
-                                        struct ieee80211_mgmt *mgmt,
-                                        size_t len)
-{
-        u16 auth_alg, auth_transaction, status_code;
-
-        if (len < 24 + 6)
-                return;
-
-        auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
-        auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
-        status_code = le16_to_cpu(mgmt->u.auth.status_code);
-
-        /*
-         * IEEE 802.11 standard does not require authentication in IBSS
-         * networks and most implementations do not seem to use it.
-         * However, try to reply to authentication attempts if someone
-         * has actually implemented this.
-         */
-        if (auth_alg == WLAN_AUTH_OPEN && auth_transaction == 1)
-                ieee80211_send_auth(sdata, ifsta, 2, NULL, 0, 0);
+        ieee80211_send_auth(sdata, 3, sdata->u.mgd.auth_alg,
+                            elems.challenge - 2, elems.challenge_len + 2,
+                            sdata->u.mgd.bssid, 1);
+        sdata->u.mgd.auth_transaction = 4;
 }
 
 static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
-                                   struct ieee80211_if_sta *ifsta,
                                    struct ieee80211_mgmt *mgmt,
                                    size_t len)
 {
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         u16 auth_alg, auth_transaction, status_code;
 
-        if (ifsta->state != IEEE80211_STA_MLME_AUTHENTICATE)
+        if (ifmgd->state != IEEE80211_STA_MLME_AUTHENTICATE)
                 return;
 
         if (len < 24 + 6)
                 return;
 
-        if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0)
+        if (memcmp(ifmgd->bssid, mgmt->sa, ETH_ALEN) != 0)
                 return;
 
-        if (memcmp(ifsta->bssid, mgmt->bssid, ETH_ALEN) != 0)
+        if (memcmp(ifmgd->bssid, mgmt->bssid, ETH_ALEN) != 0)
                 return;
 
         auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
         auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
         status_code = le16_to_cpu(mgmt->u.auth.status_code);
 
-        if (auth_alg != ifsta->auth_alg ||
-            auth_transaction != ifsta->auth_transaction)
+        if (auth_alg != ifmgd->auth_alg ||
+            auth_transaction != ifmgd->auth_transaction)
                 return;
 
         if (status_code != WLAN_STATUS_SUCCESS) {
@@ -1223,15 +1033,15 @@ static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
                         const int num_algs = ARRAY_SIZE(algs);
                         int i, pos;
                         algs[0] = algs[1] = algs[2] = 0xff;
-                        if (ifsta->auth_algs & IEEE80211_AUTH_ALG_OPEN)
+                        if (ifmgd->auth_algs & IEEE80211_AUTH_ALG_OPEN)
                                 algs[0] = WLAN_AUTH_OPEN;
-                        if (ifsta->auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
+                        if (ifmgd->auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
                                 algs[1] = WLAN_AUTH_SHARED_KEY;
-                        if (ifsta->auth_algs & IEEE80211_AUTH_ALG_LEAP)
+                        if (ifmgd->auth_algs & IEEE80211_AUTH_ALG_LEAP)
                                 algs[2] = WLAN_AUTH_LEAP;
-                        if (ifsta->auth_alg == WLAN_AUTH_OPEN)
+                        if (ifmgd->auth_alg == WLAN_AUTH_OPEN)
                                 pos = 0;
-                        else if (ifsta->auth_alg == WLAN_AUTH_SHARED_KEY)
+                        else if (ifmgd->auth_alg == WLAN_AUTH_SHARED_KEY)
                                 pos = 1;
                         else
                                 pos = 2;
@@ -1239,101 +1049,101 @@ static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
                                 pos++;
                                 if (pos >= num_algs)
                                         pos = 0;
-                                if (algs[pos] == ifsta->auth_alg ||
+                                if (algs[pos] == ifmgd->auth_alg ||
                                     algs[pos] == 0xff)
                                         continue;
                                 if (algs[pos] == WLAN_AUTH_SHARED_KEY &&
                                     !ieee80211_sta_wep_configured(sdata))
                                         continue;
-                                ifsta->auth_alg = algs[pos];
+                                ifmgd->auth_alg = algs[pos];
                                 break;
                         }
                 }
                 return;
         }
 
-        switch (ifsta->auth_alg) {
+        switch (ifmgd->auth_alg) {
         case WLAN_AUTH_OPEN:
         case WLAN_AUTH_LEAP:
-                ieee80211_auth_completed(sdata, ifsta);
+                ieee80211_auth_completed(sdata);
                 break;
         case WLAN_AUTH_SHARED_KEY:
-                if (ifsta->auth_transaction == 4)
-                        ieee80211_auth_completed(sdata, ifsta);
+                if (ifmgd->auth_transaction == 4)
+                        ieee80211_auth_completed(sdata);
                 else
-                        ieee80211_auth_challenge(sdata, ifsta, mgmt, len);
+                        ieee80211_auth_challenge(sdata, mgmt, len);
                 break;
         }
 }
 
 
 static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
-                                     struct ieee80211_if_sta *ifsta,
                                      struct ieee80211_mgmt *mgmt,
                                      size_t len)
 {
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         u16 reason_code;
 
         if (len < 24 + 2)
                 return;
 
-        if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN))
+        if (memcmp(ifmgd->bssid, mgmt->sa, ETH_ALEN))
                 return;
 
         reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
 
-        if (ifsta->flags & IEEE80211_STA_AUTHENTICATED)
+        if (ifmgd->flags & IEEE80211_STA_AUTHENTICATED)
                 printk(KERN_DEBUG "%s: deauthenticated (Reason: %u)\n",
                                 sdata->dev->name, reason_code);
 
-        if (ifsta->state == IEEE80211_STA_MLME_AUTHENTICATE ||
-            ifsta->state == IEEE80211_STA_MLME_ASSOCIATE ||
-            ifsta->state == IEEE80211_STA_MLME_ASSOCIATED) {
-                ifsta->state = IEEE80211_STA_MLME_DIRECT_PROBE;
-                mod_timer(&ifsta->timer, jiffies +
+        if (ifmgd->state == IEEE80211_STA_MLME_AUTHENTICATE ||
+            ifmgd->state == IEEE80211_STA_MLME_ASSOCIATE ||
+            ifmgd->state == IEEE80211_STA_MLME_ASSOCIATED) {
+                ifmgd->state = IEEE80211_STA_MLME_DIRECT_PROBE;
+                mod_timer(&ifmgd->timer, jiffies +
                                       IEEE80211_RETRY_AUTH_INTERVAL);
         }
 
-        ieee80211_set_disassoc(sdata, ifsta, true, false, 0);
-        ifsta->flags &= ~IEEE80211_STA_AUTHENTICATED;
+        ieee80211_set_disassoc(sdata, true, false, 0);
+        ifmgd->flags &= ~IEEE80211_STA_AUTHENTICATED;
 }
 
 
 static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
-                                       struct ieee80211_if_sta *ifsta,
                                        struct ieee80211_mgmt *mgmt,
                                        size_t len)
 {
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         u16 reason_code;
 
         if (len < 24 + 2)
                 return;
 
-        if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN))
+        if (memcmp(ifmgd->bssid, mgmt->sa, ETH_ALEN))
                 return;
 
         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
 
-        if (ifsta->flags & IEEE80211_STA_ASSOCIATED)
+        if (ifmgd->flags & IEEE80211_STA_ASSOCIATED)
                 printk(KERN_DEBUG "%s: disassociated (Reason: %u)\n",
                                 sdata->dev->name, reason_code);
 
-        if (ifsta->state == IEEE80211_STA_MLME_ASSOCIATED) {
-                ifsta->state = IEEE80211_STA_MLME_ASSOCIATE;
-                mod_timer(&ifsta->timer, jiffies +
+        if (ifmgd->state == IEEE80211_STA_MLME_ASSOCIATED) {
+                ifmgd->state = IEEE80211_STA_MLME_ASSOCIATE;
+                mod_timer(&ifmgd->timer, jiffies +
                                       IEEE80211_RETRY_AUTH_INTERVAL);
         }
 
-        ieee80211_set_disassoc(sdata, ifsta, false, false, reason_code);
+        ieee80211_set_disassoc(sdata, false, false, reason_code);
 }
 
 
 static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
-                                         struct ieee80211_if_sta *ifsta,
                                          struct ieee80211_mgmt *mgmt,
                                          size_t len,
                                          int reassoc)
 {
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_supported_band *sband;
         struct sta_info *sta;
@@ -1350,13 +1160,13 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         /* AssocResp and ReassocResp have identical structure, so process both
          * of them in this function. */
 
-        if (ifsta->state != IEEE80211_STA_MLME_ASSOCIATE)
+        if (ifmgd->state != IEEE80211_STA_MLME_ASSOCIATE)
                 return;
 
         if (len < 24 + 6)
                 return;
 
-        if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0)
+        if (memcmp(ifmgd->bssid, mgmt->sa, ETH_ALEN) != 0)
                 return;
 
         capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
@@ -1381,7 +1191,7 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
                        "comeback duration %u TU (%u ms)\n",
                        sdata->dev->name, tu, ms);
                 if (ms > IEEE80211_ASSOC_TIMEOUT)
-                        mod_timer(&ifsta->timer,
+                        mod_timer(&ifmgd->timer,
                                   jiffies + msecs_to_jiffies(ms));
                 return;
         }
@@ -1392,7 +1202,7 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
                 /* if this was a reassociation, ensure we try a "full"
                  * association next time. This works around some broken APs
                  * which do not correctly reject reassociation requests. */
-                ifsta->flags &= ~IEEE80211_STA_PREV_BSSID_SET;
+                ifmgd->flags &= ~IEEE80211_STA_PREV_BSSID_SET;
                 return;
         }
 
@@ -1408,23 +1218,23 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         }
 
         printk(KERN_DEBUG "%s: associated\n", sdata->dev->name);
-        ifsta->aid = aid;
-        ifsta->ap_capab = capab_info;
+        ifmgd->aid = aid;
+        ifmgd->ap_capab = capab_info;
 
-        kfree(ifsta->assocresp_ies);
-        ifsta->assocresp_ies_len = len - (pos - (u8 *) mgmt);
-        ifsta->assocresp_ies = kmalloc(ifsta->assocresp_ies_len, GFP_KERNEL);
-        if (ifsta->assocresp_ies)
-                memcpy(ifsta->assocresp_ies, pos, ifsta->assocresp_ies_len);
+        kfree(ifmgd->assocresp_ies);
+        ifmgd->assocresp_ies_len = len - (pos - (u8 *) mgmt);
+        ifmgd->assocresp_ies = kmalloc(ifmgd->assocresp_ies_len, GFP_KERNEL);
+        if (ifmgd->assocresp_ies)
+                memcpy(ifmgd->assocresp_ies, pos, ifmgd->assocresp_ies_len);
 
         rcu_read_lock();
 
         /* Add STA entry for the AP */
-        sta = sta_info_get(local, ifsta->bssid);
+        sta = sta_info_get(local, ifmgd->bssid);
         if (!sta) {
                 newsta = true;
 
-                sta = sta_info_alloc(sdata, ifsta->bssid, GFP_ATOMIC);
+                sta = sta_info_alloc(sdata, ifmgd->bssid, GFP_ATOMIC);
                 if (!sta) {
                         printk(KERN_DEBUG "%s: failed to alloc STA entry for"
                                " the AP\n", sdata->dev->name);
@@ -1505,7 +1315,7 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
 
         rate_control_rate_init(sta);
 
-        if (ifsta->flags & IEEE80211_STA_MFP_ENABLED)
+        if (ifmgd->flags & IEEE80211_STA_MFP_ENABLED)
                 set_sta_flags(sta, WLAN_STA_MFP);
 
         if (elems.wmm_param)
@@ -1524,11 +1334,12 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         rcu_read_unlock();
 
         if (elems.wmm_param)
-                ieee80211_sta_wmm_params(local, ifsta, elems.wmm_param,
+                ieee80211_sta_wmm_params(local, ifmgd, elems.wmm_param,
                                          elems.wmm_param_len);
 
         if (elems.ht_info_elem && elems.wmm_param &&
-            (ifsta->flags & IEEE80211_STA_WMM_ENABLED))
+            (ifmgd->flags & IEEE80211_STA_WMM_ENABLED) &&
+            !(ifmgd->flags & IEEE80211_STA_TKIP_WEP_USED))
                 changed |= ieee80211_enable_ht(sdata, elems.ht_info_elem,
                                                ap_ht_cap_flags);
 
@@ -1536,162 +1347,11 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
          * ieee80211_set_associated() will tell the driver */
         bss_conf->aid = aid;
         bss_conf->assoc_capability = capab_info;
-        ieee80211_set_associated(sdata, ifsta, changed);
-
-        ieee80211_associated(sdata, ifsta);
-}
-
+        ieee80211_set_associated(sdata, changed);
 
-static int __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
-                                     struct ieee80211_if_sta *ifsta,
-                                     const u8 *bssid, const int beacon_int,
-                                     const int freq,
-                                     const size_t supp_rates_len,
-                                     const u8 *supp_rates,
-                                     const u16 capability)
-{
-        struct ieee80211_local *local = sdata->local;
-        int res = 0, rates, i, j;
-        struct sk_buff *skb;
-        struct ieee80211_mgmt *mgmt;
-        u8 *pos;
-        struct ieee80211_supported_band *sband;
-        union iwreq_data wrqu;
-
-        if (local->ops->reset_tsf) {
-                /* Reset own TSF to allow time synchronization work. */
-                local->ops->reset_tsf(local_to_hw(local));
-        }
-
-        if ((ifsta->flags & IEEE80211_STA_PREV_BSSID_SET) &&
-           memcmp(ifsta->bssid, bssid, ETH_ALEN) == 0)
-                return res;
-
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400 +
-                            sdata->u.sta.ie_proberesp_len);
-        if (!skb) {
-                printk(KERN_DEBUG "%s: failed to allocate buffer for probe "
-                       "response\n", sdata->dev->name);
-                return -ENOMEM;
-        }
-
-        if (!(ifsta->flags & IEEE80211_STA_PREV_BSSID_SET)) {
-                /* Remove possible STA entries from other IBSS networks. */
-                sta_info_flush_delayed(sdata);
-        }
-
-        memcpy(ifsta->bssid, bssid, ETH_ALEN);
-        res = ieee80211_if_config(sdata, IEEE80211_IFCC_BSSID);
-        if (res)
-                return res;
-
-        local->hw.conf.beacon_int = beacon_int >= 10 ? beacon_int : 10;
-
-        sdata->drop_unencrypted = capability &
-                WLAN_CAPABILITY_PRIVACY ? 1 : 0;
-
-        res = ieee80211_set_freq(sdata, freq);
-
-        if (res)
-                return res;
-
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
-
-        /* Build IBSS probe response */
-
-        skb_reserve(skb, local->hw.extra_tx_headroom);
-
-        mgmt = (struct ieee80211_mgmt *)
-                skb_put(skb, 24 + sizeof(mgmt->u.beacon));
-        memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
-        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
-                                          IEEE80211_STYPE_PROBE_RESP);
-        memset(mgmt->da, 0xff, ETH_ALEN);
-        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
-        memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
-        mgmt->u.beacon.beacon_int =
-                cpu_to_le16(local->hw.conf.beacon_int);
-        mgmt->u.beacon.capab_info = cpu_to_le16(capability);
-
-        pos = skb_put(skb, 2 + ifsta->ssid_len);
-        *pos++ = WLAN_EID_SSID;
-        *pos++ = ifsta->ssid_len;
-        memcpy(pos, ifsta->ssid, ifsta->ssid_len);
-
-        rates = supp_rates_len;
-        if (rates > 8)
-                rates = 8;
-        pos = skb_put(skb, 2 + rates);
-        *pos++ = WLAN_EID_SUPP_RATES;
-        *pos++ = rates;
-        memcpy(pos, supp_rates, rates);
-
-        if (sband->band == IEEE80211_BAND_2GHZ) {
-                pos = skb_put(skb, 2 + 1);
-                *pos++ = WLAN_EID_DS_PARAMS;
-                *pos++ = 1;
-                *pos++ = ieee80211_frequency_to_channel(freq);
-        }
-
-        pos = skb_put(skb, 2 + 2);
-        *pos++ = WLAN_EID_IBSS_PARAMS;
-        *pos++ = 2;
-        /* FIX: set ATIM window based on scan results */
-        *pos++ = 0;
-        *pos++ = 0;
-
-        if (supp_rates_len > 8) {
-                rates = supp_rates_len - 8;
-                pos = skb_put(skb, 2 + rates);
-                *pos++ = WLAN_EID_EXT_SUPP_RATES;
-                *pos++ = rates;
-                memcpy(pos, &supp_rates[8], rates);
-        }
-
-        add_extra_ies(skb, sdata->u.sta.ie_proberesp,
-                      sdata->u.sta.ie_proberesp_len);
-
-        ifsta->probe_resp = skb;
-
-        ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON |
-                                   IEEE80211_IFCC_BEACON_ENABLED);
-
-
-        rates = 0;
-        for (i = 0; i < supp_rates_len; i++) {
-                int bitrate = (supp_rates[i] & 0x7f) * 5;
-                for (j = 0; j < sband->n_bitrates; j++)
-                        if (sband->bitrates[j].bitrate == bitrate)
-                                rates |= BIT(j);
-        }
-        ifsta->supp_rates_bits[local->hw.conf.channel->band] = rates;
-
-        ieee80211_sta_def_wmm_params(sdata, supp_rates_len, supp_rates);
-
-        ifsta->flags |= IEEE80211_STA_PREV_BSSID_SET;
-        ifsta->state = IEEE80211_STA_MLME_IBSS_JOINED;
-        mod_timer(&ifsta->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
-
-        ieee80211_led_assoc(local, true);
-
-        memset(&wrqu, 0, sizeof(wrqu));
-        memcpy(wrqu.ap_addr.sa_data, bssid, ETH_ALEN);
-        wireless_send_event(sdata->dev, SIOCGIWAP, &wrqu, NULL);
-
-        return res;
+        ieee80211_associated(sdata);
 }
 
-static int ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
-                                   struct ieee80211_if_sta *ifsta,
-                                   struct ieee80211_bss *bss)
-{
-        return __ieee80211_sta_join_ibss(sdata, ifsta,
-                                         bss->cbss.bssid,
-                                         bss->cbss.beacon_interval,
-                                         bss->cbss.channel->center_freq,
-                                         bss->supp_rates_len, bss->supp_rates,
-                                         bss->cbss.capability);
-}
 
 static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                                   struct ieee80211_mgmt *mgmt,
@@ -1703,11 +1363,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_local *local = sdata->local;
         int freq;
         struct ieee80211_bss *bss;
-        struct sta_info *sta;
         struct ieee80211_channel *channel;
-        u64 beacon_timestamp, rx_timestamp;
-        u32 supp_rates = 0;
-        enum ieee80211_band band = rx_status->band;
 
         if (elems->ds_params && elems->ds_params_len == 1)
                 freq = ieee80211_channel_to_frequency(elems->ds_params[0]);
@@ -1719,133 +1375,18 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
         if (!channel || channel->flags & IEEE80211_CHAN_DISABLED)
                 return;
 
-        if (sdata->vif.type == NL80211_IFTYPE_ADHOC && elems->supp_rates &&
-            memcmp(mgmt->bssid, sdata->u.sta.bssid, ETH_ALEN) == 0) {
-                supp_rates = ieee80211_sta_get_rates(local, elems, band);
-
-                rcu_read_lock();
-
-                sta = sta_info_get(local, mgmt->sa);
-                if (sta) {
-                        u32 prev_rates;
-
-                        prev_rates = sta->sta.supp_rates[band];
-                        /* make sure mandatory rates are always added */
-                        sta->sta.supp_rates[band] = supp_rates |
-                                ieee80211_mandatory_rates(local, band);
-
-#ifdef CONFIG_MAC80211_IBSS_DEBUG
-                        if (sta->sta.supp_rates[band] != prev_rates)
-                                printk(KERN_DEBUG "%s: updated supp_rates set "
-                                    "for %pM based on beacon info (0x%llx | "
-                                    "0x%llx -> 0x%llx)\n",
-                                    sdata->dev->name,
-                                    sta->sta.addr,
-                                    (unsigned long long) prev_rates,
-                                    (unsigned long long) supp_rates,
-                                    (unsigned long long) sta->sta.supp_rates[band]);
-#endif
-                } else {
-                        ieee80211_ibss_add_sta(sdata, mgmt->bssid, mgmt->sa, supp_rates);
-                }
-
-                rcu_read_unlock();
-        }
-
         bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, elems,
                                         channel, beacon);
         if (!bss)
                 return;
 
         if (elems->ch_switch_elem && (elems->ch_switch_elem_len == 3) &&
-            (memcmp(mgmt->bssid, sdata->u.sta.bssid, ETH_ALEN) == 0)) {
+            (memcmp(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN) == 0)) {
                 struct ieee80211_channel_sw_ie *sw_elem =
                         (struct ieee80211_channel_sw_ie *)elems->ch_switch_elem;
                 ieee80211_process_chanswitch(sdata, sw_elem, bss);
         }
 
-        /* was just updated in ieee80211_bss_info_update */
-        beacon_timestamp = bss->cbss.tsf;
-
-        if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
-                goto put_bss;
-
-        /* check if we need to merge IBSS */
-
-        /* merge only on beacons (???) */
-        if (!beacon)
-                goto put_bss;
-
-        /* we use a fixed BSSID */
-        if (sdata->u.sta.flags & IEEE80211_STA_BSSID_SET)
-                goto put_bss;
-
-        /* not an IBSS */
-        if (!(bss->cbss.capability & WLAN_CAPABILITY_IBSS))
-                goto put_bss;
-
-        /* different channel */
-        if (bss->cbss.channel != local->oper_channel)
-                goto put_bss;
-
-        /* different SSID */
-        if (elems->ssid_len != sdata->u.sta.ssid_len ||
-            memcmp(elems->ssid, sdata->u.sta.ssid,
-                                sdata->u.sta.ssid_len))
-                goto put_bss;
-
-        if (rx_status->flag & RX_FLAG_TSFT) {
-                /*
-                 * For correct IBSS merging we need mactime; since mactime is
-                 * defined as the time the first data symbol of the frame hits
-                 * the PHY, and the timestamp of the beacon is defined as "the
-                 * time that the data symbol containing the first bit of the
-                 * timestamp is transmitted to the PHY plus the transmitting
-                 * STA's delays through its local PHY from the MAC-PHY
-                 * interface to its interface with the WM" (802.11 11.1.2)
-                 * - equals the time this bit arrives at the receiver - we have
-                 * to take into account the offset between the two.
-                 *
-                 * E.g. at 1 MBit that means mactime is 192 usec earlier
-                 * (=24 bytes * 8 usecs/byte) than the beacon timestamp.
-                 */
-                int rate;
-
-                if (rx_status->flag & RX_FLAG_HT)
-                        rate = 65; /* TODO: HT rates */
-                else
-                        rate = local->hw.wiphy->bands[band]->
-                                bitrates[rx_status->rate_idx].bitrate;
-
-                rx_timestamp = rx_status->mactime + (24 * 8 * 10 / rate);
-        } else if (local && local->ops && local->ops->get_tsf)
-                /* second best option: get current TSF */
-                rx_timestamp = local->ops->get_tsf(local_to_hw(local));
-        else
-                /* can't merge without knowing the TSF */
-                rx_timestamp = -1LLU;
-
-#ifdef CONFIG_MAC80211_IBSS_DEBUG
-        printk(KERN_DEBUG "RX beacon SA=%pM BSSID="
-               "%pM TSF=0x%llx BCN=0x%llx diff=%lld @%lu\n",
-               mgmt->sa, mgmt->bssid,
-               (unsigned long long)rx_timestamp,
-               (unsigned long long)beacon_timestamp,
-               (unsigned long long)(rx_timestamp - beacon_timestamp),
-               jiffies);
-#endif
-
-        if (beacon_timestamp > rx_timestamp) {
-#ifdef CONFIG_MAC80211_IBSS_DEBUG
-                printk(KERN_DEBUG "%s: beacon TSF higher than "
-                       "local TSF - IBSS merge with BSSID %pM\n",
-                       sdata->dev->name, mgmt->bssid);
-#endif
-                ieee80211_sta_join_ibss(sdata, &sdata->u.sta, bss);
-                ieee80211_ibss_add_sta(sdata, mgmt->bssid, mgmt->sa, supp_rates);
-        }
-
- put_bss:
         ieee80211_rx_bss_put(local, bss);
 }
 
@@ -1857,7 +1398,6 @@ static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
 {
         size_t baselen;
         struct ieee802_11_elems elems;
-        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
 
         if (memcmp(mgmt->da, sdata->dev->dev_addr, ETH_ALEN))
                 return; /* ignore ProbeResp to foreign address */
@@ -1873,20 +1413,19 @@ static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
 
         /* direct probe may be part of the association flow */
         if (test_and_clear_bit(IEEE80211_STA_REQ_DIRECT_PROBE,
-                                                        &ifsta->request)) {
+            &sdata->u.mgd.request)) {
                 printk(KERN_DEBUG "%s direct probe responded\n",
                        sdata->dev->name);
-                ieee80211_authenticate(sdata, ifsta);
+                ieee80211_authenticate(sdata);
         }
 }
 
-
 static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                                      struct ieee80211_mgmt *mgmt,
                                      size_t len,
                                      struct ieee80211_rx_status *rx_status)
 {
-        struct ieee80211_if_sta *ifsta;
+        struct ieee80211_if_managed *ifmgd;
         size_t baselen;
         struct ieee802_11_elems elems;
         struct ieee80211_local *local = sdata->local;
@@ -1905,21 +1444,22 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
 
         if (sdata->vif.type != NL80211_IFTYPE_STATION)
                 return;
-        ifsta = &sdata->u.sta;
 
-        if (!(ifsta->flags & IEEE80211_STA_ASSOCIATED) ||
-            memcmp(ifsta->bssid, mgmt->bssid, ETH_ALEN) != 0)
+        ifmgd = &sdata->u.mgd;
+
+        if (!(ifmgd->flags & IEEE80211_STA_ASSOCIATED) ||
+            memcmp(ifmgd->bssid, mgmt->bssid, ETH_ALEN) != 0)
                 return;
 
         if (rx_status->freq != local->hw.conf.channel->center_freq)
                 return;
 
-        ieee80211_sta_wmm_params(local, ifsta, elems.wmm_param,
+        ieee80211_sta_wmm_params(local, ifmgd, elems.wmm_param,
                                  elems.wmm_param_len);
 
         if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK &&
             local->hw.conf.flags & IEEE80211_CONF_PS) {
-                directed_tim = ieee80211_check_tim(&elems, ifsta->aid);
+                directed_tim = ieee80211_check_tim(&elems, ifmgd->aid);
 
                 if (directed_tim) {
                         if (local->hw.conf.dynamic_ps_timeout > 0) {
@@ -1954,14 +1494,15 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                         erp_valid, erp_value);
 
 
-        if (elems.ht_cap_elem && elems.ht_info_elem && elems.wmm_param) {
+        if (elems.ht_cap_elem && elems.ht_info_elem && elems.wmm_param &&
+            !(ifmgd->flags & IEEE80211_STA_TKIP_WEP_USED)) {
                 struct sta_info *sta;
                 struct ieee80211_supported_band *sband;
                 u16 ap_ht_cap_flags;
 
                 rcu_read_lock();
 
-                sta = sta_info_get(local, ifsta->bssid);
+                sta = sta_info_get(local, ifmgd->bssid);
                 if (!sta) {
                         rcu_read_unlock();
                         return;
@@ -1997,85 +1538,16 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
         ieee80211_bss_info_change_notify(sdata, changed);
 }
 
-
-static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
-                                        struct ieee80211_if_sta *ifsta,
-                                        struct ieee80211_mgmt *mgmt,
-                                        size_t len)
+ieee80211_rx_result ieee80211_sta_rx_mgmt(struct ieee80211_sub_if_data *sdata,
+                                          struct sk_buff *skb,
+                                          struct ieee80211_rx_status *rx_status)
 {
         struct ieee80211_local *local = sdata->local;
-        int tx_last_beacon;
-        struct sk_buff *skb;
-        struct ieee80211_mgmt *resp;
-        u8 *pos, *end;
-
-        if (ifsta->state != IEEE80211_STA_MLME_IBSS_JOINED ||
-            len < 24 + 2 || !ifsta->probe_resp)
-                return;
-
-        if (local->ops->tx_last_beacon)
-                tx_last_beacon = local->ops->tx_last_beacon(local_to_hw(local));
-        else
-                tx_last_beacon = 1;
-
-#ifdef CONFIG_MAC80211_IBSS_DEBUG
-        printk(KERN_DEBUG "%s: RX ProbeReq SA=%pM DA=%pM BSSID=%pM"
-               " (tx_last_beacon=%d)\n",
-               sdata->dev->name, mgmt->sa, mgmt->da,
-               mgmt->bssid, tx_last_beacon);
-#endif /* CONFIG_MAC80211_IBSS_DEBUG */
-
-        if (!tx_last_beacon)
-                return;
-
-        if (memcmp(mgmt->bssid, ifsta->bssid, ETH_ALEN) != 0 &&
-            memcmp(mgmt->bssid, "\xff\xff\xff\xff\xff\xff", ETH_ALEN) != 0)
-                return;
-
-        end = ((u8 *) mgmt) + len;
-        pos = mgmt->u.probe_req.variable;
-        if (pos[0] != WLAN_EID_SSID ||
-            pos + 2 + pos[1] > end) {
-#ifdef CONFIG_MAC80211_IBSS_DEBUG
-                printk(KERN_DEBUG "%s: Invalid SSID IE in ProbeReq "
-                       "from %pM\n",
-                       sdata->dev->name, mgmt->sa);
-#endif
-                return;
-        }
-        if (pos[1] != 0 &&
-            (pos[1] != ifsta->ssid_len ||
-             memcmp(pos + 2, ifsta->ssid, ifsta->ssid_len) != 0)) {
-                /* Ignore ProbeReq for foreign SSID */
-                return;
-        }
-
-        /* Reply with ProbeResp */
-        skb = skb_copy(ifsta->probe_resp, GFP_KERNEL);
-        if (!skb)
-                return;
-
-        resp = (struct ieee80211_mgmt *) skb->data;
-        memcpy(resp->da, mgmt->sa, ETH_ALEN);
-#ifdef CONFIG_MAC80211_IBSS_DEBUG
-        printk(KERN_DEBUG "%s: Sending ProbeResp to %pM\n",
-               sdata->dev->name, resp->da);
-#endif /* CONFIG_MAC80211_IBSS_DEBUG */
-        ieee80211_tx_skb(sdata, skb, 0);
-}
-
-void ieee80211_sta_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
-                           struct ieee80211_rx_status *rx_status)
-{
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_if_sta *ifsta;
         struct ieee80211_mgmt *mgmt;
         u16 fc;
 
         if (skb->len < 24)
-                goto fail;
-
-        ifsta = &sdata->u.sta;
+                return RX_DROP_MONITOR;
 
         mgmt = (struct ieee80211_mgmt *) skb->data;
         fc = le16_to_cpu(mgmt->frame_control);
@@ -2090,147 +1562,68 @@ void ieee80211_sta_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *
         case IEEE80211_STYPE_REASSOC_RESP:
         case IEEE80211_STYPE_DEAUTH:
         case IEEE80211_STYPE_DISASSOC:
-                skb_queue_tail(&ifsta->skb_queue, skb);
-                queue_work(local->hw.workqueue, &ifsta->work);
-                return;
+                skb_queue_tail(&sdata->u.mgd.skb_queue, skb);
+                queue_work(local->hw.workqueue, &sdata->u.mgd.work);
+                return RX_QUEUED;
         }
 
- fail:
-        kfree_skb(skb);
+        return RX_DROP_MONITOR;
 }
 
 static void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                                          struct sk_buff *skb)
 {
         struct ieee80211_rx_status *rx_status;
-        struct ieee80211_if_sta *ifsta;
         struct ieee80211_mgmt *mgmt;
         u16 fc;
 
-        ifsta = &sdata->u.sta;
-
         rx_status = (struct ieee80211_rx_status *) skb->cb;
         mgmt = (struct ieee80211_mgmt *) skb->data;
         fc = le16_to_cpu(mgmt->frame_control);
 
-        if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
-                switch (fc & IEEE80211_FCTL_STYPE) {
-                case IEEE80211_STYPE_PROBE_REQ:
-                        ieee80211_rx_mgmt_probe_req(sdata, ifsta, mgmt,
-                                                    skb->len);
-                        break;
-                case IEEE80211_STYPE_PROBE_RESP:
-                        ieee80211_rx_mgmt_probe_resp(sdata, mgmt, skb->len,
-                                                     rx_status);
-                        break;
-                case IEEE80211_STYPE_BEACON:
-                        ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len,
-                                                 rx_status);
-                        break;
-                case IEEE80211_STYPE_AUTH:
-                        ieee80211_rx_mgmt_auth_ibss(sdata, ifsta, mgmt,
-                                                    skb->len);
-                        break;
-                }
-        } else { /* NL80211_IFTYPE_STATION */
-                switch (fc & IEEE80211_FCTL_STYPE) {
-                case IEEE80211_STYPE_PROBE_RESP:
-                        ieee80211_rx_mgmt_probe_resp(sdata, mgmt, skb->len,
-                                                     rx_status);
-                        break;
-                case IEEE80211_STYPE_BEACON:
-                        ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len,
-                                                 rx_status);
-                        break;
-                case IEEE80211_STYPE_AUTH:
-                        ieee80211_rx_mgmt_auth(sdata, ifsta, mgmt, skb->len);
-                        break;
-                case IEEE80211_STYPE_ASSOC_RESP:
-                        ieee80211_rx_mgmt_assoc_resp(sdata, ifsta, mgmt,
-                                                     skb->len, 0);
-                        break;
-                case IEEE80211_STYPE_REASSOC_RESP:
-                        ieee80211_rx_mgmt_assoc_resp(sdata, ifsta, mgmt,
-                                                     skb->len, 1);
-                        break;
-                case IEEE80211_STYPE_DEAUTH:
-                        ieee80211_rx_mgmt_deauth(sdata, ifsta, mgmt, skb->len);
-                        break;
-                case IEEE80211_STYPE_DISASSOC:
-                        ieee80211_rx_mgmt_disassoc(sdata, ifsta, mgmt,
-                                                   skb->len);
-                        break;
-                }
+        switch (fc & IEEE80211_FCTL_STYPE) {
+        case IEEE80211_STYPE_PROBE_RESP:
+                ieee80211_rx_mgmt_probe_resp(sdata, mgmt, skb->len,
+                                             rx_status);
+                break;
+        case IEEE80211_STYPE_BEACON:
+                ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len,
+                                         rx_status);
+                break;
+        case IEEE80211_STYPE_AUTH:
+                ieee80211_rx_mgmt_auth(sdata, mgmt, skb->len);
+                break;
+        case IEEE80211_STYPE_ASSOC_RESP:
+                ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len, 0);
+                break;
+        case IEEE80211_STYPE_REASSOC_RESP:
+                ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len, 1);
+                break;
+        case IEEE80211_STYPE_DEAUTH:
+                ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len);
+                break;
+        case IEEE80211_STYPE_DISASSOC:
+                ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
+                break;
         }
 
         kfree_skb(skb);
 }
 
-
-static int ieee80211_sta_active_ibss(struct ieee80211_sub_if_data *sdata)
-{
-        struct ieee80211_local *local = sdata->local;
-        int active = 0;
-        struct sta_info *sta;
-
-        rcu_read_lock();
-
-        list_for_each_entry_rcu(sta, &local->sta_list, list) {
-                if (sta->sdata == sdata &&
-                    time_after(sta->last_rx + IEEE80211_IBSS_MERGE_INTERVAL,
-                               jiffies)) {
-                        active++;
-                        break;
-                }
-        }
-
-        rcu_read_unlock();
-
-        return active;
-}
-
-
-static void ieee80211_sta_merge_ibss(struct ieee80211_sub_if_data *sdata,
-                                     struct ieee80211_if_sta *ifsta)
-{
-        mod_timer(&ifsta->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
-
-        ieee80211_sta_expire(sdata, IEEE80211_IBSS_INACTIVITY_LIMIT);
-        if (ieee80211_sta_active_ibss(sdata))
-                return;
-
-        if ((sdata->u.sta.flags & IEEE80211_STA_BSSID_SET) &&
-            (!(sdata->u.sta.flags & IEEE80211_STA_AUTO_CHANNEL_SEL)))
-                return;
-
-        printk(KERN_DEBUG "%s: No active IBSS STAs - trying to scan for other "
-               "IBSS networks with same SSID (merge)\n", sdata->dev->name);
-
-        /* XXX maybe racy? */
-        if (sdata->local->scan_req)
-                return;
-
-        memcpy(sdata->local->int_scan_req.ssids[0].ssid,
-               ifsta->ssid, IEEE80211_MAX_SSID_LEN);
-        sdata->local->int_scan_req.ssids[0].ssid_len = ifsta->ssid_len;
-        ieee80211_request_scan(sdata, &sdata->local->int_scan_req);
-}
-
-
 static void ieee80211_sta_timer(unsigned long data)
 {
         struct ieee80211_sub_if_data *sdata =
                 (struct ieee80211_sub_if_data *) data;
-        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
 
-        set_bit(IEEE80211_STA_REQ_RUN, &ifsta->request);
-        queue_work(local->hw.workqueue, &ifsta->work);
+        set_bit(IEEE80211_STA_REQ_RUN, &ifmgd->request);
+        queue_work(local->hw.workqueue, &ifmgd->work);
 }
 
-static void ieee80211_sta_reset_auth(struct ieee80211_sub_if_data *sdata,
-                                     struct ieee80211_if_sta *ifsta)
+static void ieee80211_sta_reset_auth(struct ieee80211_sub_if_data *sdata)
 {
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
 
         if (local->ops->reset_tsf) {
@@ -2238,191 +1631,39 @@ static void ieee80211_sta_reset_auth(struct ieee80211_sub_if_data *sdata,
                 local->ops->reset_tsf(local_to_hw(local));
         }
 
-        ifsta->wmm_last_param_set = -1; /* allow any WMM update */
+        ifmgd->wmm_last_param_set = -1; /* allow any WMM update */
 
 
-        if (ifsta->auth_algs & IEEE80211_AUTH_ALG_OPEN)
-                ifsta->auth_alg = WLAN_AUTH_OPEN;
-        else if (ifsta->auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
-                ifsta->auth_alg = WLAN_AUTH_SHARED_KEY;
-        else if (ifsta->auth_algs & IEEE80211_AUTH_ALG_LEAP)
-                ifsta->auth_alg = WLAN_AUTH_LEAP;
+        if (ifmgd->auth_algs & IEEE80211_AUTH_ALG_OPEN)
+                ifmgd->auth_alg = WLAN_AUTH_OPEN;
+        else if (ifmgd->auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
+                ifmgd->auth_alg = WLAN_AUTH_SHARED_KEY;
+        else if (ifmgd->auth_algs & IEEE80211_AUTH_ALG_LEAP)
+                ifmgd->auth_alg = WLAN_AUTH_LEAP;
         else
-                ifsta->auth_alg = WLAN_AUTH_OPEN;
-        ifsta->auth_transaction = -1;
-        ifsta->flags &= ~IEEE80211_STA_ASSOCIATED;
-        ifsta->assoc_scan_tries = 0;
-        ifsta->direct_probe_tries = 0;
-        ifsta->auth_tries = 0;
-        ifsta->assoc_tries = 0;
+                ifmgd->auth_alg = WLAN_AUTH_OPEN;
+        ifmgd->auth_transaction = -1;
+        ifmgd->flags &= ~IEEE80211_STA_ASSOCIATED;
+        ifmgd->assoc_scan_tries = 0;
+        ifmgd->direct_probe_tries = 0;
+        ifmgd->auth_tries = 0;
+        ifmgd->assoc_tries = 0;
         netif_tx_stop_all_queues(sdata->dev);
         netif_carrier_off(sdata->dev);
 }
 
-static int ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata,
-                                     struct ieee80211_if_sta *ifsta)
-{
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_supported_band *sband;
-        u8 *pos;
-        u8 bssid[ETH_ALEN];
-        u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
-        u16 capability;
-        int i;
-
-        if (sdata->u.sta.flags & IEEE80211_STA_BSSID_SET) {
-                memcpy(bssid, ifsta->bssid, ETH_ALEN);
-        } else {
-                /* Generate random, not broadcast, locally administered BSSID. Mix in
-                 * own MAC address to make sure that devices that do not have proper
-                 * random number generator get different BSSID. */
-                get_random_bytes(bssid, ETH_ALEN);
-                for (i = 0; i < ETH_ALEN; i++)
-                        bssid[i] ^= sdata->dev->dev_addr[i];
-                bssid[0] &= ~0x01;
-                bssid[0] |= 0x02;
-        }
-
-        printk(KERN_DEBUG "%s: Creating new IBSS network, BSSID %pM\n",
-               sdata->dev->name, bssid);
-
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
-
-        if (local->hw.conf.beacon_int == 0)
-                local->hw.conf.beacon_int = 100;
-
-        capability = WLAN_CAPABILITY_IBSS;
-
-        if (sdata->default_key)
-                capability |= WLAN_CAPABILITY_PRIVACY;
-        else
-                sdata->drop_unencrypted = 0;
-
-        pos = supp_rates;
-        for (i = 0; i < sband->n_bitrates; i++) {
-                int rate = sband->bitrates[i].bitrate;
-                *pos++ = (u8) (rate / 5);
-        }
-
-        return __ieee80211_sta_join_ibss(sdata, ifsta,
-                                         bssid, local->hw.conf.beacon_int,
-                                         local->hw.conf.channel->center_freq,
-                                         sband->n_bitrates, supp_rates,
-                                         capability);
-}
-
-
-static int ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata,
-                                   struct ieee80211_if_sta *ifsta)
+static int ieee80211_sta_config_auth(struct ieee80211_sub_if_data *sdata)
 {
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_bss *bss;
-        int active_ibss;
-
-        if (ifsta->ssid_len == 0)
-                return -EINVAL;
-
-        active_ibss = ieee80211_sta_active_ibss(sdata);
-#ifdef CONFIG_MAC80211_IBSS_DEBUG
-        printk(KERN_DEBUG "%s: sta_find_ibss (active_ibss=%d)\n",
-               sdata->dev->name, active_ibss);
-#endif /* CONFIG_MAC80211_IBSS_DEBUG */
-
-        if (active_ibss)
-                return 0;
-
-        if (ifsta->flags & IEEE80211_STA_BSSID_SET)
-                bss = ieee80211_rx_bss_get(local, ifsta->bssid, 0,
-                                           ifsta->ssid, ifsta->ssid_len);
-        else
-                bss = (void *)cfg80211_get_ibss(local->hw.wiphy,
-                                                NULL,
-                                                ifsta->ssid, ifsta->ssid_len);
-
-#ifdef CONFIG_MAC80211_IBSS_DEBUG
-        if (bss)
-                printk(KERN_DEBUG "   sta_find_ibss: selected %pM current "
-                       "%pM\n", bss->cbss.bssid, ifsta->bssid);
-#endif /* CONFIG_MAC80211_IBSS_DEBUG */
-
-        if (bss &&
-            (!(ifsta->flags & IEEE80211_STA_PREV_BSSID_SET) ||
-             memcmp(ifsta->bssid, bss->cbss.bssid, ETH_ALEN))) {
-                int ret;
-
-                printk(KERN_DEBUG "%s: Selected IBSS BSSID %pM"
-                       " based on configured SSID\n",
-                       sdata->dev->name, bss->cbss.bssid);
-
-                ret = ieee80211_sta_join_ibss(sdata, ifsta, bss);
-                ieee80211_rx_bss_put(local, bss);
-                return ret;
-        } else if (bss)
-                ieee80211_rx_bss_put(local, bss);
-
-#ifdef CONFIG_MAC80211_IBSS_DEBUG
-        printk(KERN_DEBUG "   did not try to join ibss\n");
-#endif /* CONFIG_MAC80211_IBSS_DEBUG */
-
-        /* Selected IBSS not found in current scan results - try to scan */
-        if (ifsta->state == IEEE80211_STA_MLME_IBSS_JOINED &&
-            !ieee80211_sta_active_ibss(sdata)) {
-                mod_timer(&ifsta->timer, jiffies +
-                                      IEEE80211_IBSS_MERGE_INTERVAL);
-        } else if (time_after(jiffies, local->last_scan_completed +
-                              IEEE80211_SCAN_INTERVAL)) {
-                printk(KERN_DEBUG "%s: Trigger new scan to find an IBSS to "
-                       "join\n", sdata->dev->name);
-
-                /* XXX maybe racy? */
-                if (local->scan_req)
-                        return -EBUSY;
-
-                memcpy(local->int_scan_req.ssids[0].ssid,
-                       ifsta->ssid, IEEE80211_MAX_SSID_LEN);
-                local->int_scan_req.ssids[0].ssid_len = ifsta->ssid_len;
-                return ieee80211_request_scan(sdata, &local->int_scan_req);
-        } else if (ifsta->state != IEEE80211_STA_MLME_IBSS_JOINED) {
-                int interval = IEEE80211_SCAN_INTERVAL;
-
-                if (time_after(jiffies, ifsta->ibss_join_req +
-                               IEEE80211_IBSS_JOIN_TIMEOUT)) {
-                        if ((ifsta->flags & IEEE80211_STA_CREATE_IBSS) &&
-                            (!(local->oper_channel->flags &
-                                        IEEE80211_CHAN_NO_IBSS)))
-                                return ieee80211_sta_create_ibss(sdata, ifsta);
-                        if (ifsta->flags & IEEE80211_STA_CREATE_IBSS) {
-                                printk(KERN_DEBUG "%s: IBSS not allowed on"
-                                       " %d MHz\n", sdata->dev->name,
-                                       local->hw.conf.channel->center_freq);
-                        }
-
-                        /* No IBSS found - decrease scan interval and continue
-                         * scanning. */
-                        interval = IEEE80211_SCAN_INTERVAL_SLOW;
-                }
-
-                ifsta->state = IEEE80211_STA_MLME_IBSS_SEARCH;
-                mod_timer(&ifsta->timer, jiffies + interval);
-                return 0;
-        }
-
-        return 0;
-}
-
-
-static int ieee80211_sta_config_auth(struct ieee80211_sub_if_data *sdata,
-                                     struct ieee80211_if_sta *ifsta)
-{
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_bss *bss;
-        u8 *bssid = ifsta->bssid, *ssid = ifsta->ssid;
-        u8 ssid_len = ifsta->ssid_len;
+        u8 *bssid = ifmgd->bssid, *ssid = ifmgd->ssid;
+        u8 ssid_len = ifmgd->ssid_len;
         u16 capa_mask = WLAN_CAPABILITY_ESS;
         u16 capa_val = WLAN_CAPABILITY_ESS;
         struct ieee80211_channel *chan = local->oper_channel;
 
-        if (ifsta->flags & (IEEE80211_STA_AUTO_SSID_SEL |
+        if (ifmgd->flags & (IEEE80211_STA_AUTO_SSID_SEL |
                             IEEE80211_STA_AUTO_BSSID_SEL |
                             IEEE80211_STA_AUTO_CHANNEL_SEL)) {
                 capa_mask |= WLAN_CAPABILITY_PRIVACY;
@@ -2430,13 +1671,13 @@ static int ieee80211_sta_config_auth(struct ieee80211_sub_if_data *sdata,
                         capa_val |= WLAN_CAPABILITY_PRIVACY;
         }
 
-        if (ifsta->flags & IEEE80211_STA_AUTO_CHANNEL_SEL)
+        if (ifmgd->flags & IEEE80211_STA_AUTO_CHANNEL_SEL)
                 chan = NULL;
 
-        if (ifsta->flags & IEEE80211_STA_AUTO_BSSID_SEL)
+        if (ifmgd->flags & IEEE80211_STA_AUTO_BSSID_SEL)
                 bssid = NULL;
 
-        if (ifsta->flags & IEEE80211_STA_AUTO_SSID_SEL) {
+        if (ifmgd->flags & IEEE80211_STA_AUTO_SSID_SEL) {
                 ssid = NULL;
                 ssid_len = 0;
         }
@@ -2447,16 +1688,16 @@ static int ieee80211_sta_config_auth(struct ieee80211_sub_if_data *sdata,
 
         if (bss) {
                 ieee80211_set_freq(sdata, bss->cbss.channel->center_freq);
-                if (!(ifsta->flags & IEEE80211_STA_SSID_SET))
+                if (!(ifmgd->flags & IEEE80211_STA_SSID_SET))
                         ieee80211_sta_set_ssid(sdata, bss->ssid,
                                                bss->ssid_len);
                 ieee80211_sta_set_bssid(sdata, bss->cbss.bssid);
                 ieee80211_sta_def_wmm_params(sdata, bss->supp_rates_len,
                                                     bss->supp_rates);
-                if (sdata->u.sta.mfp == IEEE80211_MFP_REQUIRED)
-                        sdata->u.sta.flags |= IEEE80211_STA_MFP_ENABLED;
+                if (sdata->u.mgd.mfp == IEEE80211_MFP_REQUIRED)
+                        sdata->u.mgd.flags |= IEEE80211_STA_MFP_ENABLED;
                 else
-                        sdata->u.sta.flags &= ~IEEE80211_STA_MFP_ENABLED;
+                        sdata->u.mgd.flags &= ~IEEE80211_STA_MFP_ENABLED;
 
                 /* Send out direct probe if no probe resp was received or
                  * the one we have is outdated
@@ -2464,31 +1705,31 @@ static int ieee80211_sta_config_auth(struct ieee80211_sub_if_data *sdata,
                 if (!bss->last_probe_resp ||
                     time_after(jiffies, bss->last_probe_resp
                                         + IEEE80211_SCAN_RESULT_EXPIRE))
-                        ifsta->state = IEEE80211_STA_MLME_DIRECT_PROBE;
+                        ifmgd->state = IEEE80211_STA_MLME_DIRECT_PROBE;
                 else
-                        ifsta->state = IEEE80211_STA_MLME_AUTHENTICATE;
+                        ifmgd->state = IEEE80211_STA_MLME_AUTHENTICATE;
 
                 ieee80211_rx_bss_put(local, bss);
-                ieee80211_sta_reset_auth(sdata, ifsta);
+                ieee80211_sta_reset_auth(sdata);
                 return 0;
         } else {
-                if (ifsta->assoc_scan_tries < IEEE80211_ASSOC_SCANS_MAX_TRIES) {
-                        ifsta->assoc_scan_tries++;
+                if (ifmgd->assoc_scan_tries < IEEE80211_ASSOC_SCANS_MAX_TRIES) {
+                        ifmgd->assoc_scan_tries++;
                         /* XXX maybe racy? */
                         if (local->scan_req)
                                 return -1;
                         memcpy(local->int_scan_req.ssids[0].ssid,
-                               ifsta->ssid, IEEE80211_MAX_SSID_LEN);
-                        if (ifsta->flags & IEEE80211_STA_AUTO_SSID_SEL)
+                               ifmgd->ssid, IEEE80211_MAX_SSID_LEN);
+                        if (ifmgd->flags & IEEE80211_STA_AUTO_SSID_SEL)
                                 local->int_scan_req.ssids[0].ssid_len = 0;
                         else
-                                local->int_scan_req.ssids[0].ssid_len = ifsta->ssid_len;
+                                local->int_scan_req.ssids[0].ssid_len = ifmgd->ssid_len;
                         ieee80211_start_scan(sdata, &local->int_scan_req);
-                        ifsta->state = IEEE80211_STA_MLME_AUTHENTICATE;
-                        set_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request);
+                        ifmgd->state = IEEE80211_STA_MLME_AUTHENTICATE;
+                        set_bit(IEEE80211_STA_REQ_AUTH, &ifmgd->request);
                 } else {
-                        ifsta->assoc_scan_tries = 0;
-                        ifsta->state = IEEE80211_STA_MLME_DISABLED;
+                        ifmgd->assoc_scan_tries = 0;
+                        ifmgd->state = IEEE80211_STA_MLME_DISABLED;
                 }
         }
         return -1;
@@ -2498,9 +1739,9 @@ static int ieee80211_sta_config_auth(struct ieee80211_sub_if_data *sdata,
 static void ieee80211_sta_work(struct work_struct *work)
 {
         struct ieee80211_sub_if_data *sdata =
-                container_of(work, struct ieee80211_sub_if_data, u.sta.work);
+                container_of(work, struct ieee80211_sub_if_data, u.mgd.work);
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_if_sta *ifsta;
+        struct ieee80211_if_managed *ifmgd;
         struct sk_buff *skb;
 
         if (!netif_running(sdata->dev))
@@ -2509,60 +1750,53 @@ static void ieee80211_sta_work(struct work_struct *work)
         if (local->sw_scanning || local->hw_scanning)
                 return;
 
-        if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION &&
-                    sdata->vif.type != NL80211_IFTYPE_ADHOC))
+        if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
                 return;
-        ifsta = &sdata->u.sta;
+        ifmgd = &sdata->u.mgd;
 
-        while ((skb = skb_dequeue(&ifsta->skb_queue)))
+        while ((skb = skb_dequeue(&ifmgd->skb_queue)))
                 ieee80211_sta_rx_queued_mgmt(sdata, skb);
 
-        if (ifsta->state != IEEE80211_STA_MLME_DIRECT_PROBE &&
-            ifsta->state != IEEE80211_STA_MLME_AUTHENTICATE &&
-            ifsta->state != IEEE80211_STA_MLME_ASSOCIATE &&
-            test_and_clear_bit(IEEE80211_STA_REQ_SCAN, &ifsta->request)) {
+        if (ifmgd->state != IEEE80211_STA_MLME_DIRECT_PROBE &&
+            ifmgd->state != IEEE80211_STA_MLME_AUTHENTICATE &&
+            ifmgd->state != IEEE80211_STA_MLME_ASSOCIATE &&
+            test_and_clear_bit(IEEE80211_STA_REQ_SCAN, &ifmgd->request)) {
                 ieee80211_start_scan(sdata, local->scan_req);
                 return;
         }
 
-        if (test_and_clear_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request)) {
-                if (ieee80211_sta_config_auth(sdata, ifsta))
+        if (test_and_clear_bit(IEEE80211_STA_REQ_AUTH, &ifmgd->request)) {
+                if (ieee80211_sta_config_auth(sdata))
                         return;
-                clear_bit(IEEE80211_STA_REQ_RUN, &ifsta->request);
-        } else if (!test_and_clear_bit(IEEE80211_STA_REQ_RUN, &ifsta->request))
+                clear_bit(IEEE80211_STA_REQ_RUN, &ifmgd->request);
+        } else if (!test_and_clear_bit(IEEE80211_STA_REQ_RUN, &ifmgd->request))
                 return;
 
-        switch (ifsta->state) {
+        switch (ifmgd->state) {
         case IEEE80211_STA_MLME_DISABLED:
                 break;
         case IEEE80211_STA_MLME_DIRECT_PROBE:
-                ieee80211_direct_probe(sdata, ifsta);
+                ieee80211_direct_probe(sdata);
                 break;
         case IEEE80211_STA_MLME_AUTHENTICATE:
-                ieee80211_authenticate(sdata, ifsta);
+                ieee80211_authenticate(sdata);
                 break;
         case IEEE80211_STA_MLME_ASSOCIATE:
-                ieee80211_associate(sdata, ifsta);
+                ieee80211_associate(sdata);
                 break;
         case IEEE80211_STA_MLME_ASSOCIATED:
-                ieee80211_associated(sdata, ifsta);
-                break;
-        case IEEE80211_STA_MLME_IBSS_SEARCH:
-                ieee80211_sta_find_ibss(sdata, ifsta);
-                break;
-        case IEEE80211_STA_MLME_IBSS_JOINED:
-                ieee80211_sta_merge_ibss(sdata, ifsta);
+                ieee80211_associated(sdata);
                 break;
         default:
                 WARN_ON(1);
                 break;
         }
 
-        if (ieee80211_privacy_mismatch(sdata, ifsta)) {
+        if (ieee80211_privacy_mismatch(sdata)) {
                 printk(KERN_DEBUG "%s: privacy configuration mismatch and "
                        "mixed-cell disabled - disassociate\n", sdata->dev->name);
 
-                ieee80211_set_disassoc(sdata, ifsta, false, true,
+                ieee80211_set_disassoc(sdata, false, true,
                                         WLAN_REASON_UNSPECIFIED);
         }
 }
@@ -2571,155 +1805,106 @@ static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
 {
         if (sdata->vif.type == NL80211_IFTYPE_STATION)
                 queue_work(sdata->local->hw.workqueue,
-                           &sdata->u.sta.work);
+                           &sdata->u.mgd.work);
 }
 
 /* interface setup */
 void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
 {
-        struct ieee80211_if_sta *ifsta;
+        struct ieee80211_if_managed *ifmgd;
 
-        ifsta = &sdata->u.sta;
-        INIT_WORK(&ifsta->work, ieee80211_sta_work);
-        INIT_WORK(&ifsta->chswitch_work, ieee80211_chswitch_work);
-        setup_timer(&ifsta->timer, ieee80211_sta_timer,
+        ifmgd = &sdata->u.mgd;
+        INIT_WORK(&ifmgd->work, ieee80211_sta_work);
+        INIT_WORK(&ifmgd->chswitch_work, ieee80211_chswitch_work);
+        setup_timer(&ifmgd->timer, ieee80211_sta_timer,
                     (unsigned long) sdata);
-        setup_timer(&ifsta->chswitch_timer, ieee80211_chswitch_timer,
+        setup_timer(&ifmgd->chswitch_timer, ieee80211_chswitch_timer,
                     (unsigned long) sdata);
-        skb_queue_head_init(&ifsta->skb_queue);
+        skb_queue_head_init(&ifmgd->skb_queue);
 
-        ifsta->capab = WLAN_CAPABILITY_ESS;
-        ifsta->auth_algs = IEEE80211_AUTH_ALG_OPEN |
+        ifmgd->capab = WLAN_CAPABILITY_ESS;
+        ifmgd->auth_algs = IEEE80211_AUTH_ALG_OPEN |
                 IEEE80211_AUTH_ALG_SHARED_KEY;
-        ifsta->flags |= IEEE80211_STA_CREATE_IBSS |
+        ifmgd->flags |= IEEE80211_STA_CREATE_IBSS |
                 IEEE80211_STA_AUTO_BSSID_SEL |
                 IEEE80211_STA_AUTO_CHANNEL_SEL;
         if (ieee80211_num_regular_queues(&sdata->local->hw) >= 4)
-                ifsta->flags |= IEEE80211_STA_WMM_ENABLED;
-}
-
-/*
- * Add a new IBSS station, will also be called by the RX code when,
- * in IBSS mode, receiving a frame from a yet-unknown station, hence
- * must be callable in atomic context.
- */
-struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
-                                        u8 *bssid,u8 *addr, u32 supp_rates)
-{
-        struct ieee80211_local *local = sdata->local;
-        struct sta_info *sta;
-        int band = local->hw.conf.channel->band;
-
-        /* TODO: Could consider removing the least recently used entry and
-         * allow new one to be added. */
-        if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
-                if (net_ratelimit()) {
-                        printk(KERN_DEBUG "%s: No room for a new IBSS STA "
-                               "entry %pM\n", sdata->dev->name, addr);
-                }
-                return NULL;
-        }
-
-        if (compare_ether_addr(bssid, sdata->u.sta.bssid))
-                return NULL;
-
-#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        printk(KERN_DEBUG "%s: Adding new IBSS station %pM (dev=%s)\n",
-               wiphy_name(local->hw.wiphy), addr, sdata->dev->name);
-#endif
-
-        sta = sta_info_alloc(sdata, addr, GFP_ATOMIC);
-        if (!sta)
-                return NULL;
-
-        set_sta_flags(sta, WLAN_STA_AUTHORIZED);
-
-        /* make sure mandatory rates are always added */
-        sta->sta.supp_rates[band] = supp_rates |
-                        ieee80211_mandatory_rates(local, band);
-
-        rate_control_rate_init(sta);
-
-        if (sta_info_insert(sta))
-                return NULL;
-
-        return sta;
+                ifmgd->flags |= IEEE80211_STA_WMM_ENABLED;
 }
 
 /* configuration hooks */
-void ieee80211_sta_req_auth(struct ieee80211_sub_if_data *sdata,
-                            struct ieee80211_if_sta *ifsta)
+void ieee80211_sta_req_auth(struct ieee80211_sub_if_data *sdata)
 {
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
 
-        if (sdata->vif.type != NL80211_IFTYPE_STATION)
+        if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
                 return;
 
-        if ((ifsta->flags & (IEEE80211_STA_BSSID_SET |
+        if ((ifmgd->flags & (IEEE80211_STA_BSSID_SET |
                              IEEE80211_STA_AUTO_BSSID_SEL)) &&
-            (ifsta->flags & (IEEE80211_STA_SSID_SET |
+            (ifmgd->flags & (IEEE80211_STA_SSID_SET |
                              IEEE80211_STA_AUTO_SSID_SEL))) {
 
-                if (ifsta->state == IEEE80211_STA_MLME_ASSOCIATED)
-                        ieee80211_set_disassoc(sdata, ifsta, true, true,
+                if (ifmgd->state == IEEE80211_STA_MLME_ASSOCIATED)
+                        ieee80211_set_disassoc(sdata, true, true,
                                                WLAN_REASON_DEAUTH_LEAVING);
 
-                set_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request);
-                queue_work(local->hw.workqueue, &ifsta->work);
+                set_bit(IEEE80211_STA_REQ_AUTH, &ifmgd->request);
+                queue_work(local->hw.workqueue, &ifmgd->work);
         }
 }
 
-int ieee80211_sta_set_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t len)
+int ieee80211_sta_commit(struct ieee80211_sub_if_data *sdata)
 {
-        struct ieee80211_if_sta *ifsta;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
-        if (len > IEEE80211_MAX_SSID_LEN)
-                return -EINVAL;
+        ifmgd->flags &= ~IEEE80211_STA_PREV_BSSID_SET;
 
-        ifsta = &sdata->u.sta;
+        if (ifmgd->ssid_len)
+                ifmgd->flags |= IEEE80211_STA_SSID_SET;
+        else
+                ifmgd->flags &= ~IEEE80211_STA_SSID_SET;
 
-        if (ifsta->ssid_len != len || memcmp(ifsta->ssid, ssid, len) != 0) {
-                memset(ifsta->ssid, 0, sizeof(ifsta->ssid));
-                memcpy(ifsta->ssid, ssid, len);
-                ifsta->ssid_len = len;
-        }
+        return 0;
+}
 
-        ifsta->flags &= ~IEEE80211_STA_PREV_BSSID_SET;
+int ieee80211_sta_set_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t len)
+{
+        struct ieee80211_if_managed *ifmgd;
 
-        if (len)
-                ifsta->flags |= IEEE80211_STA_SSID_SET;
-        else
-                ifsta->flags &= ~IEEE80211_STA_SSID_SET;
+        if (len > IEEE80211_MAX_SSID_LEN)
+                return -EINVAL;
+
+        ifmgd = &sdata->u.mgd;
 
-        if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
-                ifsta->ibss_join_req = jiffies;
-                ifsta->state = IEEE80211_STA_MLME_IBSS_SEARCH;
-                return ieee80211_sta_find_ibss(sdata, ifsta);
+        if (ifmgd->ssid_len != len || memcmp(ifmgd->ssid, ssid, len) != 0) {
+                memset(ifmgd->ssid, 0, sizeof(ifmgd->ssid));
+                memcpy(ifmgd->ssid, ssid, len);
+                ifmgd->ssid_len = len;
         }
 
-        return 0;
+        return ieee80211_sta_commit(sdata);
 }
 
 int ieee80211_sta_get_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t *len)
 {
-        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
-        memcpy(ssid, ifsta->ssid, ifsta->ssid_len);
-        *len = ifsta->ssid_len;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        memcpy(ssid, ifmgd->ssid, ifmgd->ssid_len);
+        *len = ifmgd->ssid_len;
         return 0;
 }
 
 int ieee80211_sta_set_bssid(struct ieee80211_sub_if_data *sdata, u8 *bssid)
 {
-        struct ieee80211_if_sta *ifsta;
-
-        ifsta = &sdata->u.sta;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
         if (is_valid_ether_addr(bssid)) {
-                memcpy(ifsta->bssid, bssid, ETH_ALEN);
-                ifsta->flags |= IEEE80211_STA_BSSID_SET;
+                memcpy(ifmgd->bssid, bssid, ETH_ALEN);
+                ifmgd->flags |= IEEE80211_STA_BSSID_SET;
         } else {
-                memset(ifsta->bssid, 0, ETH_ALEN);
-                ifsta->flags &= ~IEEE80211_STA_BSSID_SET;
+                memset(ifmgd->bssid, 0, ETH_ALEN);
+                ifmgd->flags &= ~IEEE80211_STA_BSSID_SET;
         }
 
         if (netif_running(sdata->dev)) {
@@ -2729,47 +1914,44 @@ int ieee80211_sta_set_bssid(struct ieee80211_sub_if_data *sdata, u8 *bssid)
                 }
         }
 
-        return ieee80211_sta_set_ssid(sdata, ifsta->ssid, ifsta->ssid_len);
+        return ieee80211_sta_commit(sdata);
 }
 
 int ieee80211_sta_set_extra_ie(struct ieee80211_sub_if_data *sdata, char *ie, size_t len)
 {
-        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
-        kfree(ifsta->extra_ie);
+        kfree(ifmgd->extra_ie);
         if (len == 0) {
-                ifsta->extra_ie = NULL;
-                ifsta->extra_ie_len = 0;
+                ifmgd->extra_ie = NULL;
+                ifmgd->extra_ie_len = 0;
                 return 0;
         }
-        ifsta->extra_ie = kmalloc(len, GFP_KERNEL);
-        if (!ifsta->extra_ie) {
-                ifsta->extra_ie_len = 0;
+        ifmgd->extra_ie = kmalloc(len, GFP_KERNEL);
+        if (!ifmgd->extra_ie) {
+                ifmgd->extra_ie_len = 0;
                 return -ENOMEM;
         }
-        memcpy(ifsta->extra_ie, ie, len);
-        ifsta->extra_ie_len = len;
+        memcpy(ifmgd->extra_ie, ie, len);
+        ifmgd->extra_ie_len = len;
         return 0;
 }
 
 int ieee80211_sta_deauthenticate(struct ieee80211_sub_if_data *sdata, u16 reason)
 {
-        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
-
         printk(KERN_DEBUG "%s: deauthenticating by local choice (reason=%d)\n",
                sdata->dev->name, reason);
 
-        if (sdata->vif.type != NL80211_IFTYPE_STATION &&
-            sdata->vif.type != NL80211_IFTYPE_ADHOC)
+        if (sdata->vif.type != NL80211_IFTYPE_STATION)
                 return -EINVAL;
 
-        ieee80211_set_disassoc(sdata, ifsta, true, true, reason);
+        ieee80211_set_disassoc(sdata, true, true, reason);
         return 0;
 }
 
 int ieee80211_sta_disassociate(struct ieee80211_sub_if_data *sdata, u16 reason)
 {
-        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
         printk(KERN_DEBUG "%s: disassociating by local choice (reason=%d)\n",
                sdata->dev->name, reason);
@@ -2777,10 +1959,10 @@ int ieee80211_sta_disassociate(struct ieee80211_sub_if_data *sdata, u16 reason)
         if (sdata->vif.type != NL80211_IFTYPE_STATION)
                 return -EINVAL;
 
-        if (!(ifsta->flags & IEEE80211_STA_ASSOCIATED))
-                return -1;
+        if (!(ifmgd->flags & IEEE80211_STA_ASSOCIATED))
+                return -ENOLINK;
 
-        ieee80211_set_disassoc(sdata, ifsta, false, true, reason);
+        ieee80211_set_disassoc(sdata, false, true, reason);
         return 0;
 }
 
@@ -2788,14 +1970,6 @@ int ieee80211_sta_disassociate(struct ieee80211_sub_if_data *sdata, u16 reason)
 void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
 {
         struct ieee80211_sub_if_data *sdata = local->scan_sdata;
-        struct ieee80211_if_sta *ifsta;
-
-        if (sdata && sdata->vif.type == NL80211_IFTYPE_ADHOC) {
-                ifsta = &sdata->u.sta;
-                if ((!(ifsta->flags & IEEE80211_STA_PREV_BSSID_SET)) ||
-                    !ieee80211_sta_active_ibss(sdata))
-                        ieee80211_sta_find_ibss(sdata, ifsta);
-        }
 
         /* Restart STA timers */
         rcu_read_lock();
@@ -2842,3 +2016,36 @@ void ieee80211_dynamic_ps_timer(unsigned long data)
 
         queue_work(local->hw.workqueue, &local->dynamic_ps_enable_work);
 }
+
+void ieee80211_send_nullfunc(struct ieee80211_local *local,
+                             struct ieee80211_sub_if_data *sdata,
+                             int powersave)
+{
+        struct sk_buff *skb;
+        struct ieee80211_hdr *nullfunc;
+        __le16 fc;
+
+        if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
+                return;
+
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom + 24);
+        if (!skb) {
+                printk(KERN_DEBUG "%s: failed to allocate buffer for nullfunc "
+                       "frame\n", sdata->dev->name);
+                return;
+        }
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+
+        nullfunc = (struct ieee80211_hdr *) skb_put(skb, 24);
+        memset(nullfunc, 0, 24);
+        fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
+                         IEEE80211_FCTL_TODS);
+        if (powersave)
+                fc |= cpu_to_le16(IEEE80211_FCTL_PM);
+        nullfunc->frame_control = fc;
+        memcpy(nullfunc->addr1, sdata->u.mgd.bssid, ETH_ALEN);
+        memcpy(nullfunc->addr2, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(nullfunc->addr3, sdata->u.mgd.bssid, ETH_ALEN);
+
+        ieee80211_tx_skb(sdata, skb, 0);
+}
diff --git a/net/mac80211/rate.h b/net/mac80211/rate.h
index 928da625e281..b9164c9a9563 100644
--- a/net/mac80211/rate.h
+++ b/net/mac80211/rate.h
@@ -62,6 +62,18 @@ static inline void rate_control_rate_init(struct sta_info *sta)
         ref->ops->rate_init(ref->priv, sband, ista, priv_sta);
 }
 
+static inline void rate_control_rate_update(struct ieee80211_local *local,
+                                    struct ieee80211_supported_band *sband,
+                                    struct sta_info *sta, u32 changed)
+{
+        struct rate_control_ref *ref = local->rate_ctrl;
+        struct ieee80211_sta *ista = &sta->sta;
+        void *priv_sta = sta->rate_ctrl_priv;
+
+        if (ref->ops->rate_update)
+                ref->ops->rate_update(ref->priv, sband, ista,
+                                      priv_sta, changed);
+}
 
 static inline void *rate_control_alloc_sta(struct rate_control_ref *ref,
                                            struct ieee80211_sta *sta,
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 1327d424bf31..66f7ecf51b92 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -838,7 +838,7 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
         if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
                 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
                                                 NL80211_IFTYPE_ADHOC);
-                if (compare_ether_addr(bssid, rx->sdata->u.sta.bssid) == 0)
+                if (compare_ether_addr(bssid, rx->sdata->u.ibss.bssid) == 0)
                         sta->last_rx = jiffies;
         } else
         if (!is_multicast_ether_addr(hdr->addr1) ||
@@ -1702,13 +1702,13 @@ static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
                 return;
         }
 
-        if (compare_ether_addr(mgmt->sa, sdata->u.sta.bssid) != 0 ||
-            compare_ether_addr(mgmt->bssid, sdata->u.sta.bssid) != 0) {
+        if (compare_ether_addr(mgmt->sa, sdata->u.mgd.bssid) != 0 ||
+            compare_ether_addr(mgmt->bssid, sdata->u.mgd.bssid) != 0) {
                 /* Not from the current AP. */
                 return;
         }
 
-        if (sdata->u.sta.state == IEEE80211_STA_MLME_ASSOCIATE) {
+        if (sdata->u.mgd.state == IEEE80211_STA_MLME_ASSOCIATE) {
                 /* Association in progress; ignore SA Query */
                 return;
         }
@@ -1727,7 +1727,7 @@ static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
         memset(resp, 0, 24);
         memcpy(resp->da, mgmt->sa, ETH_ALEN);
         memcpy(resp->sa, sdata->dev->dev_addr, ETH_ALEN);
-        memcpy(resp->bssid, sdata->u.sta.bssid, ETH_ALEN);
+        memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN);
         resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                           IEEE80211_STYPE_ACTION);
         skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query));
@@ -1745,7 +1745,6 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
 {
         struct ieee80211_local *local = rx->local;
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
-        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
         struct ieee80211_bss *bss;
         int len = rx->skb->len;
@@ -1803,6 +1802,10 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
         case WLAN_CATEGORY_SPECTRUM_MGMT:
                 if (local->hw.conf.channel->band != IEEE80211_BAND_5GHZ)
                         return RX_DROP_MONITOR;
+
+                if (sdata->vif.type != NL80211_IFTYPE_STATION)
+                        return RX_DROP_MONITOR;
+
                 switch (mgmt->u.action.u.measurement.action_code) {
                 case WLAN_ACTION_SPCT_MSR_REQ:
                         if (len < (IEEE80211_MIN_ACTION_SIZE +
@@ -1815,12 +1818,13 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                                    sizeof(mgmt->u.action.u.chan_switch)))
                                 return RX_DROP_MONITOR;
 
-                        if (memcmp(mgmt->bssid, ifsta->bssid, ETH_ALEN) != 0)
+                        if (memcmp(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN))
                                 return RX_DROP_MONITOR;
 
-                        bss = ieee80211_rx_bss_get(local, ifsta->bssid,
+                        bss = ieee80211_rx_bss_get(local, sdata->u.mgd.bssid,
                                            local->hw.conf.channel->center_freq,
-                                           ifsta->ssid, ifsta->ssid_len);
+                                           sdata->u.mgd.ssid,
+                                           sdata->u.mgd.ssid_len);
                         if (!bss)
                                 return RX_DROP_MONITOR;
 
@@ -1876,11 +1880,14 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
             sdata->vif.type != NL80211_IFTYPE_ADHOC)
                 return RX_DROP_MONITOR;
 
-        if (sdata->flags & IEEE80211_SDATA_USERSPACE_MLME)
-                return RX_DROP_MONITOR;
 
-        ieee80211_sta_rx_mgmt(sdata, rx->skb, rx->status);
-        return RX_QUEUED;
+        if (sdata->vif.type == NL80211_IFTYPE_STATION) {
+                if (sdata->flags & IEEE80211_SDATA_USERSPACE_MLME)
+                        return RX_DROP_MONITOR;
+                return ieee80211_sta_rx_mgmt(sdata, rx->skb, rx->status);
+        }
+
+        return ieee80211_ibss_rx_mgmt(sdata, rx->skb, rx->status);
 }
 
 static void ieee80211_rx_michael_mic_report(struct net_device *dev,
@@ -2083,7 +2090,7 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
         case NL80211_IFTYPE_STATION:
                 if (!bssid)
                         return 0;
-                if (!ieee80211_bssid_match(bssid, sdata->u.sta.bssid)) {
+                if (!ieee80211_bssid_match(bssid, sdata->u.mgd.bssid)) {
                         if (!(rx->flags & IEEE80211_RX_IN_SCAN))
                                 return 0;
                         rx->flags &= ~IEEE80211_RX_RA_MATCH;
@@ -2101,7 +2108,7 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
                 if (ieee80211_is_beacon(hdr->frame_control)) {
                         return 1;
                 }
-                else if (!ieee80211_bssid_match(bssid, sdata->u.sta.bssid)) {
+                else if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) {
                         if (!(rx->flags & IEEE80211_RX_IN_SCAN))
                                 return 0;
                         rx->flags &= ~IEEE80211_RX_RA_MATCH;
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index f883ab9f1e6e..0e81e1633a66 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -63,20 +63,15 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
 {
         struct ieee80211_bss *bss;
         int clen;
-        enum cfg80211_signal_type sigtype = CFG80211_SIGNAL_TYPE_NONE;
         s32 signal = 0;
 
-        if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM) {
-                sigtype = CFG80211_SIGNAL_TYPE_MBM;
+        if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
                 signal = rx_status->signal * 100;
-        } else if (local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC) {
-                sigtype = CFG80211_SIGNAL_TYPE_UNSPEC;
+        else if (local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC)
                 signal = (rx_status->signal * 100) / local->hw.max_signal;
-        }
 
         bss = (void *)cfg80211_inform_bss_frame(local->hw.wiphy, channel,
-                                                mgmt, len, signal, sigtype,
-                                                GFP_ATOMIC);
+                                                mgmt, len, signal, GFP_ATOMIC);
 
         if (!bss)
                 return NULL;
@@ -207,36 +202,6 @@ ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
         return RX_QUEUED;
 }
 
-void ieee80211_send_nullfunc(struct ieee80211_local *local,
-                                    struct ieee80211_sub_if_data *sdata,
-                                    int powersave)
-{
-        struct sk_buff *skb;
-        struct ieee80211_hdr *nullfunc;
-        __le16 fc;
-
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom + 24);
-        if (!skb) {
-                printk(KERN_DEBUG "%s: failed to allocate buffer for nullfunc "
-                       "frame\n", sdata->dev->name);
-                return;
-        }
-        skb_reserve(skb, local->hw.extra_tx_headroom);
-
-        nullfunc = (struct ieee80211_hdr *) skb_put(skb, 24);
-        memset(nullfunc, 0, 24);
-        fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
-                         IEEE80211_FCTL_TODS);
-        if (powersave)
-                fc |= cpu_to_le16(IEEE80211_FCTL_PM);
-        nullfunc->frame_control = fc;
-        memcpy(nullfunc->addr1, sdata->u.sta.bssid, ETH_ALEN);
-        memcpy(nullfunc->addr2, sdata->dev->dev_addr, ETH_ALEN);
-        memcpy(nullfunc->addr3, sdata->u.sta.bssid, ETH_ALEN);
-
-        ieee80211_tx_skb(sdata, skb, 0);
-}
-
 void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
 {
         struct ieee80211_local *local = hw_to_local(hw);
@@ -280,6 +245,9 @@ void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
         netif_addr_unlock(local->mdev);
         netif_tx_unlock_bh(local->mdev);
 
+        if (local->ops->sw_scan_complete)
+                local->ops->sw_scan_complete(local_to_hw(local));
+
         mutex_lock(&local->iflist_mtx);
         list_for_each_entry(sdata, &local->interfaces, list) {
                 if (!netif_running(sdata->dev))
@@ -287,7 +255,7 @@ void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
 
                 /* Tell AP we're back */
                 if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                        if (sdata->u.sta.flags & IEEE80211_STA_ASSOCIATED) {
+                        if (sdata->u.mgd.flags & IEEE80211_STA_ASSOCIATED) {
                                 ieee80211_send_nullfunc(local, sdata, 0);
                                 netif_tx_wake_all_queues(sdata->dev);
                         }
@@ -305,6 +273,7 @@ void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
 
  done:
         ieee80211_mlme_notify_scan_completed(local);
+        ieee80211_ibss_notify_scan_completed(local);
         ieee80211_mesh_notify_scan_completed(local);
 }
 EXPORT_SYMBOL(ieee80211_scan_completed);
@@ -367,7 +336,8 @@ void ieee80211_scan_work(struct work_struct *work)
                         ieee80211_send_probe_req(
                                 sdata, NULL,
                                 local->scan_req->ssids[i].ssid,
-                                local->scan_req->ssids[i].ssid_len);
+                                local->scan_req->ssids[i].ssid_len,
+                                local->scan_req->ie, local->scan_req->ie_len);
                 next_delay = IEEE80211_CHANNEL_TIME;
                 break;
         }
@@ -428,6 +398,8 @@ int ieee80211_start_scan(struct ieee80211_sub_if_data *scan_sdata,
         }
 
         local->sw_scanning = true;
+        if (local->ops->sw_scan_start)
+                local->ops->sw_scan_start(local_to_hw(local));
 
         mutex_lock(&local->iflist_mtx);
         list_for_each_entry(sdata, &local->interfaces, list) {
@@ -442,7 +414,7 @@ int ieee80211_start_scan(struct ieee80211_sub_if_data *scan_sdata,
                                             IEEE80211_IFCC_BEACON_ENABLED);
 
                 if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                        if (sdata->u.sta.flags & IEEE80211_STA_ASSOCIATED) {
+                        if (sdata->u.mgd.flags & IEEE80211_STA_ASSOCIATED) {
                                 netif_tx_stop_all_queues(sdata->dev);
                                 ieee80211_send_nullfunc(local, sdata, 1);
                         }
@@ -477,7 +449,7 @@ int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
                            struct cfg80211_scan_request *req)
 {
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_if_sta *ifsta;
+        struct ieee80211_if_managed *ifmgd;
 
         if (!req)
                 return -EINVAL;
@@ -502,9 +474,9 @@ int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
                 return -EBUSY;
         }
 
-        ifsta = &sdata->u.sta;
-        set_bit(IEEE80211_STA_REQ_SCAN, &ifsta->request);
-        queue_work(local->hw.workqueue, &ifsta->work);
+        ifmgd = &sdata->u.mgd;
+        set_bit(IEEE80211_STA_REQ_SCAN, &ifmgd->request);
+        queue_work(local->hw.workqueue, &ifmgd->work);
 
         return 0;
 }
diff --git a/net/mac80211/spectmgmt.c b/net/mac80211/spectmgmt.c
index 47bb2aed2813..5f7a2624ed74 100644
--- a/net/mac80211/spectmgmt.c
+++ b/net/mac80211/spectmgmt.c
@@ -88,16 +88,16 @@ void ieee80211_process_measurement_req(struct ieee80211_sub_if_data *sdata,
 void ieee80211_chswitch_work(struct work_struct *work)
 {
         struct ieee80211_sub_if_data *sdata =
-                container_of(work, struct ieee80211_sub_if_data, u.sta.chswitch_work);
+                container_of(work, struct ieee80211_sub_if_data, u.mgd.chswitch_work);
         struct ieee80211_bss *bss;
-        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
         if (!netif_running(sdata->dev))
                 return;
 
-        bss = ieee80211_rx_bss_get(sdata->local, ifsta->bssid,
+        bss = ieee80211_rx_bss_get(sdata->local, ifmgd->bssid,
                                    sdata->local->hw.conf.channel->center_freq,
-                                   ifsta->ssid, ifsta->ssid_len);
+                                   ifmgd->ssid, ifmgd->ssid_len);
         if (!bss)
                 goto exit;
 
@@ -108,7 +108,7 @@ void ieee80211_chswitch_work(struct work_struct *work)
 
         ieee80211_rx_bss_put(sdata->local, bss);
 exit:
-        ifsta->flags &= ~IEEE80211_STA_CSA_RECEIVED;
+        ifmgd->flags &= ~IEEE80211_STA_CSA_RECEIVED;
         ieee80211_wake_queues_by_reason(&sdata->local->hw,
                                         IEEE80211_QUEUE_STOP_REASON_CSA);
 }
@@ -117,9 +117,9 @@ void ieee80211_chswitch_timer(unsigned long data)
 {
         struct ieee80211_sub_if_data *sdata =
                 (struct ieee80211_sub_if_data *) data;
-        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
-        queue_work(sdata->local->hw.workqueue, &ifsta->chswitch_work);
+        queue_work(sdata->local->hw.workqueue, &ifmgd->chswitch_work);
 }
 
 void ieee80211_process_chanswitch(struct ieee80211_sub_if_data *sdata,
@@ -127,14 +127,14 @@ void ieee80211_process_chanswitch(struct ieee80211_sub_if_data *sdata,
                                   struct ieee80211_bss *bss)
 {
         struct ieee80211_channel *new_ch;
-        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         int new_freq = ieee80211_channel_to_frequency(sw_elem->new_ch_num);
 
         /* FIXME: Handle ADHOC later */
         if (sdata->vif.type != NL80211_IFTYPE_STATION)
                 return;
 
-        if (ifsta->state != IEEE80211_STA_MLME_ASSOCIATED)
+        if (ifmgd->state != IEEE80211_STA_MLME_ASSOCIATED)
                 return;
 
         if (sdata->local->sw_scanning || sdata->local->hw_scanning)
@@ -143,7 +143,7 @@ void ieee80211_process_chanswitch(struct ieee80211_sub_if_data *sdata,
         /* Disregard subsequent beacons if we are already running a timer
            processing a CSA */
 
-        if (ifsta->flags & IEEE80211_STA_CSA_RECEIVED)
+        if (ifmgd->flags & IEEE80211_STA_CSA_RECEIVED)
                 return;
 
         new_ch = ieee80211_get_channel(sdata->local->hw.wiphy, new_freq);
@@ -153,12 +153,12 @@ void ieee80211_process_chanswitch(struct ieee80211_sub_if_data *sdata,
         sdata->local->csa_channel = new_ch;
 
         if (sw_elem->count <= 1) {
-                queue_work(sdata->local->hw.workqueue, &ifsta->chswitch_work);
+                queue_work(sdata->local->hw.workqueue, &ifmgd->chswitch_work);
         } else {
                 ieee80211_stop_queues_by_reason(&sdata->local->hw,
                                                 IEEE80211_QUEUE_STOP_REASON_CSA);
-                ifsta->flags |= IEEE80211_STA_CSA_RECEIVED;
-                mod_timer(&ifsta->chswitch_timer,
+                ifmgd->flags |= IEEE80211_STA_CSA_RECEIVED;
+                mod_timer(&ifmgd->chswitch_timer,
                           jiffies +
                           msecs_to_jiffies(sw_elem->count *
                                            bss->cbss.beacon_interval));
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 634f65c0130e..4ba3c540fcf3 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -202,6 +202,18 @@ void sta_info_destroy(struct sta_info *sta)
                 /* Make sure timer won't free the tid_rx struct, see below */
                 if (tid_rx)
                         tid_rx->shutdown = true;
+
+                /*
+                 * The stop callback cannot find this station any more, but
+                 * it didn't complete its work -- start the queue if necessary
+                 */
+                if (sta->ampdu_mlme.tid_state_tx[i] & HT_AGG_STATE_INITIATOR_MSK &&
+                    sta->ampdu_mlme.tid_state_tx[i] & HT_AGG_STATE_REQ_STOP_BA_MSK &&
+                    local->hw.ampdu_queues)
+                        ieee80211_wake_queue_by_reason(&local->hw,
+                                local->hw.queues + sta->tid_to_tx_q[i],
+                                IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
+
                 spin_unlock_bh(&sta->lock);
 
                 /*
@@ -275,8 +287,7 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
                  * enable session_timer's data differentiation. refer to
                  * sta_rx_agg_session_timer_expired for useage */
                 sta->timer_to_tid[i] = i;
-                /* tid to tx queue: initialize according to HW (0 is valid) */
-                sta->tid_to_tx_q[i] = ieee80211_num_queues(&local->hw);
+                sta->tid_to_tx_q[i] = -1;
                 /* rx */
                 sta->ampdu_mlme.tid_state_rx[i] = HT_AGG_STATE_IDLE;
                 sta->ampdu_mlme.tid_rx[i] = NULL;
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index d9653231992f..1f45573c580c 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -90,6 +90,7 @@ struct tid_ampdu_tx {
  * @buf_size: buffer size for incoming A-MPDUs
  * @timeout: reset timer value (in TUs).
  * @dialog_token: dialog token for aggregation session
+ * @shutdown: this session is being shut down due to STA removal
  */
 struct tid_ampdu_rx {
         struct sk_buff **reorder_buf;
@@ -200,7 +201,7 @@ struct sta_ampdu_mlme {
  * @tid_seq: per-TID sequence numbers for sending to this STA
  * @ampdu_mlme: A-MPDU state machine state
  * @timer_to_tid: identity mapping to ID timers
- * @tid_to_tx_q: map tid to tx queue
+ * @tid_to_tx_q: map tid to tx queue (invalid == negative values)
  * @llid: Local link ID
  * @plid: Peer link ID
  * @reason: Cancel reason on PLINK_HOLDING state
@@ -275,7 +276,7 @@ struct sta_info {
          */
         struct sta_ampdu_mlme ampdu_mlme;
         u8 timer_to_tid[STA_TID_NUM];
-        u8 tid_to_tx_q[STA_TID_NUM];
+        s8 tid_to_tx_q[STA_TID_NUM];
 
 #ifdef CONFIG_MAC80211_MESH
         /*
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 33926831c648..c3f0e950125b 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -876,7 +876,6 @@ ieee80211_tx_h_stats(struct ieee80211_tx_data *tx)
         return TX_CONTINUE;
 }
 
-
 /* actual transmit path */
 
 /*
@@ -1016,12 +1015,20 @@ __ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
         tx->sta = sta_info_get(local, hdr->addr1);
 
         if (tx->sta && ieee80211_is_data_qos(hdr->frame_control)) {
+                unsigned long flags;
                 qc = ieee80211_get_qos_ctl(hdr);
                 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
 
+                spin_lock_irqsave(&tx->sta->lock, flags);
                 state = &tx->sta->ampdu_mlme.tid_state_tx[tid];
-                if (*state == HT_AGG_STATE_OPERATIONAL)
+                if (*state == HT_AGG_STATE_OPERATIONAL) {
                         info->flags |= IEEE80211_TX_CTL_AMPDU;
+                        if (local->hw.ampdu_queues)
+                                skb_set_queue_mapping(
+                                        skb, tx->local->hw.queues +
+                                             tx->sta->tid_to_tx_q[tid]);
+                }
+                spin_unlock_irqrestore(&tx->sta->lock, flags);
         }
 
         if (is_multicast_ether_addr(hdr->addr1)) {
@@ -1085,7 +1092,8 @@ static int __ieee80211_tx(struct ieee80211_local *local, struct sk_buff *skb,
         int ret, i;
 
         if (skb) {
-                if (netif_subqueue_stopped(local->mdev, skb))
+                if (ieee80211_queue_stopped(&local->hw,
+                                            skb_get_queue_mapping(skb)))
                         return IEEE80211_TX_PENDING;
 
                 ret = local->ops->tx(local_to_hw(local), skb);
@@ -1101,8 +1109,8 @@ static int __ieee80211_tx(struct ieee80211_local *local, struct sk_buff *skb,
                         info = IEEE80211_SKB_CB(tx->extra_frag[i]);
                         info->flags &= ~(IEEE80211_TX_CTL_CLEAR_PS_FILT |
                                          IEEE80211_TX_CTL_FIRST_FRAGMENT);
-                        if (netif_subqueue_stopped(local->mdev,
-                                                   tx->extra_frag[i]))
+                        if (ieee80211_queue_stopped(&local->hw,
+                                        skb_get_queue_mapping(tx->extra_frag[i])))
                                 return IEEE80211_TX_FRAG_AGAIN;
 
                         ret = local->ops->tx(local_to_hw(local),
@@ -1625,7 +1633,7 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
         case NL80211_IFTYPE_STATION:
                 fc |= cpu_to_le16(IEEE80211_FCTL_TODS);
                 /* BSSID SA DA */
-                memcpy(hdr.addr1, sdata->u.sta.bssid, ETH_ALEN);
+                memcpy(hdr.addr1, sdata->u.mgd.bssid, ETH_ALEN);
                 memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
                 memcpy(hdr.addr3, skb->data, ETH_ALEN);
                 hdrlen = 24;
@@ -1634,7 +1642,7 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
                 /* DA SA BSSID */
                 memcpy(hdr.addr1, skb->data, ETH_ALEN);
                 memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
-                memcpy(hdr.addr3, sdata->u.sta.bssid, ETH_ALEN);
+                memcpy(hdr.addr3, sdata->u.ibss.bssid, ETH_ALEN);
                 hdrlen = 24;
                 break;
         default:
@@ -1920,7 +1928,6 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
         struct ieee80211_tx_info *info;
         struct ieee80211_sub_if_data *sdata = NULL;
         struct ieee80211_if_ap *ap = NULL;
-        struct ieee80211_if_sta *ifsta = NULL;
         struct beacon_data *beacon;
         struct ieee80211_supported_band *sband;
         enum ieee80211_band band = local->hw.conf.channel->band;
@@ -1972,13 +1979,13 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
                 } else
                         goto out;
         } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+                struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
                 struct ieee80211_hdr *hdr;
-                ifsta = &sdata->u.sta;
 
-                if (!ifsta->probe_resp)
+                if (!ifibss->probe_resp)
                         goto out;
 
-                skb = skb_copy(ifsta->probe_resp, GFP_ATOMIC);
+                skb = skb_copy(ifibss->probe_resp, GFP_ATOMIC);
                 if (!skb)
                         goto out;
 
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 73c7d7345abd..e0431a1d218b 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -344,15 +344,36 @@ static void __ieee80211_wake_queue(struct ieee80211_hw *hw, int queue,
 {
         struct ieee80211_local *local = hw_to_local(hw);
 
-        /* we don't need to track ampdu queues */
-        if (queue < ieee80211_num_regular_queues(hw)) {
-                __clear_bit(reason, &local->queue_stop_reasons[queue]);
+        if (queue >= hw->queues) {
+                if (local->ampdu_ac_queue[queue - hw->queues] < 0)
+                        return;
+
+                /*
+                 * for virtual aggregation queues, we need to refcount the
+                 * internal mac80211 disable (multiple times!), keep track of
+                 * driver disable _and_ make sure the regular queue is
+                 * actually enabled.
+                 */
+                if (reason == IEEE80211_QUEUE_STOP_REASON_AGGREGATION)
+                        local->amdpu_ac_stop_refcnt[queue - hw->queues]--;
+                else
+                        __clear_bit(reason, &local->queue_stop_reasons[queue]);
 
-                if (local->queue_stop_reasons[queue] != 0)
-                        /* someone still has this queue stopped */
+                if (local->queue_stop_reasons[queue] ||
+                    local->amdpu_ac_stop_refcnt[queue - hw->queues])
                         return;
+
+                /* now go on to treat the corresponding regular queue */
+                queue = local->ampdu_ac_queue[queue - hw->queues];
+                reason = IEEE80211_QUEUE_STOP_REASON_AGGREGATION;
         }
 
+        __clear_bit(reason, &local->queue_stop_reasons[queue]);
+
+        if (local->queue_stop_reasons[queue] != 0)
+                /* someone still has this queue stopped */
+                return;
+
         if (test_bit(queue, local->queues_pending)) {
                 set_bit(queue, local->queues_pending_run);
                 tasklet_schedule(&local->tx_pending_tasklet);
@@ -361,8 +382,8 @@ static void __ieee80211_wake_queue(struct ieee80211_hw *hw, int queue,
         }
 }
 
-static void ieee80211_wake_queue_by_reason(struct ieee80211_hw *hw, int queue,
-                                           enum queue_stop_reason reason)
+void ieee80211_wake_queue_by_reason(struct ieee80211_hw *hw, int queue,
+                                    enum queue_stop_reason reason)
 {
         struct ieee80211_local *local = hw_to_local(hw);
         unsigned long flags;
@@ -384,15 +405,33 @@ static void __ieee80211_stop_queue(struct ieee80211_hw *hw, int queue,
 {
         struct ieee80211_local *local = hw_to_local(hw);
 
-        /* we don't need to track ampdu queues */
-        if (queue < ieee80211_num_regular_queues(hw))
-                __set_bit(reason, &local->queue_stop_reasons[queue]);
+        if (queue >= hw->queues) {
+                if (local->ampdu_ac_queue[queue - hw->queues] < 0)
+                        return;
+
+                /*
+                 * for virtual aggregation queues, we need to refcount the
+                 * internal mac80211 disable (multiple times!), keep track of
+                 * driver disable _and_ make sure the regular queue is
+                 * actually enabled.
+                 */
+                if (reason == IEEE80211_QUEUE_STOP_REASON_AGGREGATION)
+                        local->amdpu_ac_stop_refcnt[queue - hw->queues]++;
+                else
+                        __set_bit(reason, &local->queue_stop_reasons[queue]);
+
+                /* now go on to treat the corresponding regular queue */
+                queue = local->ampdu_ac_queue[queue - hw->queues];
+                reason = IEEE80211_QUEUE_STOP_REASON_AGGREGATION;
+        }
+
+        __set_bit(reason, &local->queue_stop_reasons[queue]);
 
         netif_stop_subqueue(local->mdev, queue);
 }
 
-static void ieee80211_stop_queue_by_reason(struct ieee80211_hw *hw, int queue,
-                                           enum queue_stop_reason reason)
+void ieee80211_stop_queue_by_reason(struct ieee80211_hw *hw, int queue,
+                                    enum queue_stop_reason reason)
 {
         struct ieee80211_local *local = hw_to_local(hw);
         unsigned long flags;
@@ -418,7 +457,7 @@ void ieee80211_stop_queues_by_reason(struct ieee80211_hw *hw,
 
         spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
 
-        for (i = 0; i < ieee80211_num_queues(hw); i++)
+        for (i = 0; i < hw->queues; i++)
                 __ieee80211_stop_queue(hw, i, reason);
 
         spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
@@ -434,6 +473,16 @@ EXPORT_SYMBOL(ieee80211_stop_queues);
 int ieee80211_queue_stopped(struct ieee80211_hw *hw, int queue)
 {
         struct ieee80211_local *local = hw_to_local(hw);
+        unsigned long flags;
+
+        if (queue >= hw->queues) {
+                spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
+                queue = local->ampdu_ac_queue[queue - hw->queues];
+                spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+                if (queue < 0)
+                        return true;
+        }
+
         return __netif_subqueue_stopped(local->mdev, queue);
 }
 EXPORT_SYMBOL(ieee80211_queue_stopped);
@@ -701,6 +750,27 @@ void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata)
                 local->ops->conf_tx(local_to_hw(local), i, &qparam);
 }
 
+void ieee80211_sta_def_wmm_params(struct ieee80211_sub_if_data *sdata,
+                                  const size_t supp_rates_len,
+                                  const u8 *supp_rates)
+{
+        struct ieee80211_local *local = sdata->local;
+        int i, have_higher_than_11mbit = 0;
+
+        /* cf. IEEE 802.11 9.2.12 */
+        for (i = 0; i < supp_rates_len; i++)
+                if ((supp_rates[i] & 0x7f) * 5 > 110)
+                        have_higher_than_11mbit = 1;
+
+        if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ &&
+            have_higher_than_11mbit)
+                sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
+        else
+                sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
+
+        ieee80211_set_wmm_default(sdata);
+}
+
 void ieee80211_tx_skb(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
                       int encrypt)
 {
@@ -767,3 +837,161 @@ u32 ieee80211_mandatory_rates(struct ieee80211_local *local,
                         mandatory_rates |= BIT(i);
         return mandatory_rates;
 }
+
+void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
+                         u16 transaction, u16 auth_alg,
+                         u8 *extra, size_t extra_len,
+                         const u8 *bssid, int encrypt)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct sk_buff *skb;
+        struct ieee80211_mgmt *mgmt;
+        const u8 *ie_auth = NULL;
+        int ie_auth_len = 0;
+
+        if (sdata->vif.type == NL80211_IFTYPE_STATION) {
+                ie_auth_len = sdata->u.mgd.ie_auth_len;
+                ie_auth = sdata->u.mgd.ie_auth;
+        }
+
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom +
+                            sizeof(*mgmt) + 6 + extra_len + ie_auth_len);
+        if (!skb) {
+                printk(KERN_DEBUG "%s: failed to allocate buffer for auth "
+                       "frame\n", sdata->dev->name);
+                return;
+        }
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+
+        mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24 + 6);
+        memset(mgmt, 0, 24 + 6);
+        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                          IEEE80211_STYPE_AUTH);
+        if (encrypt)
+                mgmt->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
+        memcpy(mgmt->da, bssid, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(mgmt->bssid, bssid, ETH_ALEN);
+        mgmt->u.auth.auth_alg = cpu_to_le16(auth_alg);
+        mgmt->u.auth.auth_transaction = cpu_to_le16(transaction);
+        mgmt->u.auth.status_code = cpu_to_le16(0);
+        if (extra)
+                memcpy(skb_put(skb, extra_len), extra, extra_len);
+        if (ie_auth)
+                memcpy(skb_put(skb, ie_auth_len), ie_auth, ie_auth_len);
+
+        ieee80211_tx_skb(sdata, skb, encrypt);
+}
+
+void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
+                              u8 *ssid, size_t ssid_len,
+                              u8 *ie, size_t ie_len)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_supported_band *sband;
+        struct sk_buff *skb;
+        struct ieee80211_mgmt *mgmt;
+        u8 *pos, *supp_rates, *esupp_rates = NULL, *extra_preq_ie = NULL;
+        int i, extra_preq_ie_len = 0;
+
+        switch (sdata->vif.type) {
+        case NL80211_IFTYPE_STATION:
+                extra_preq_ie_len = sdata->u.mgd.ie_probereq_len;
+                extra_preq_ie = sdata->u.mgd.ie_probereq;
+                break;
+        default:
+                break;
+        }
+
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt) + 200 +
+                            ie_len + extra_preq_ie_len);
+        if (!skb) {
+                printk(KERN_DEBUG "%s: failed to allocate buffer for probe "
+                       "request\n", sdata->dev->name);
+                return;
+        }
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+
+        mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
+        memset(mgmt, 0, 24);
+        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                          IEEE80211_STYPE_PROBE_REQ);
+        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
+        if (dst) {
+                memcpy(mgmt->da, dst, ETH_ALEN);
+                memcpy(mgmt->bssid, dst, ETH_ALEN);
+        } else {
+                memset(mgmt->da, 0xff, ETH_ALEN);
+                memset(mgmt->bssid, 0xff, ETH_ALEN);
+        }
+        pos = skb_put(skb, 2 + ssid_len);
+        *pos++ = WLAN_EID_SSID;
+        *pos++ = ssid_len;
+        memcpy(pos, ssid, ssid_len);
+
+        supp_rates = skb_put(skb, 2);
+        supp_rates[0] = WLAN_EID_SUPP_RATES;
+        supp_rates[1] = 0;
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+
+        for (i = 0; i < sband->n_bitrates; i++) {
+                struct ieee80211_rate *rate = &sband->bitrates[i];
+                if (esupp_rates) {
+                        pos = skb_put(skb, 1);
+                        esupp_rates[1]++;
+                } else if (supp_rates[1] == 8) {
+                        esupp_rates = skb_put(skb, 3);
+                        esupp_rates[0] = WLAN_EID_EXT_SUPP_RATES;
+                        esupp_rates[1] = 1;
+                        pos = &esupp_rates[2];
+                } else {
+                        pos = skb_put(skb, 1);
+                        supp_rates[1]++;
+                }
+                *pos = rate->bitrate / 5;
+        }
+
+        if (ie)
+                memcpy(skb_put(skb, ie_len), ie, ie_len);
+        if (extra_preq_ie)
+                memcpy(skb_put(skb, extra_preq_ie_len), extra_preq_ie,
+                       extra_preq_ie_len);
+
+        ieee80211_tx_skb(sdata, skb, 0);
+}
+
+u32 ieee80211_sta_get_rates(struct ieee80211_local *local,
+                            struct ieee802_11_elems *elems,
+                            enum ieee80211_band band)
+{
+        struct ieee80211_supported_band *sband;
+        struct ieee80211_rate *bitrates;
+        size_t num_rates;
+        u32 supp_rates;
+        int i, j;
+        sband = local->hw.wiphy->bands[band];
+
+        if (!sband) {
+                WARN_ON(1);
+                sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+        }
+
+        bitrates = sband->bitrates;
+        num_rates = sband->n_bitrates;
+        supp_rates = 0;
+        for (i = 0; i < elems->supp_rates_len +
+                     elems->ext_supp_rates_len; i++) {
+                u8 rate = 0;
+                int own_rate;
+                if (i < elems->supp_rates_len)
+                        rate = elems->supp_rates[i];
+                else if (elems->ext_supp_rates)
+                        rate = elems->ext_supp_rates
+                                [i - elems->supp_rates_len];
+                own_rate = 5 * (rate & 0x7f);
+                for (j = 0; j < num_rates; j++)
+                        if (bitrates[j].bitrate == own_rate)
+                                supp_rates |= BIT(j);
+        }
+        return supp_rates;
+}
diff --git a/net/mac80211/wext.c b/net/mac80211/wext.c
index 2b023dce8b24..f6924fc065d3 100644
--- a/net/mac80211/wext.c
+++ b/net/mac80211/wext.c
@@ -132,139 +132,37 @@ static int ieee80211_ioctl_siwgenie(struct net_device *dev,
         if (sdata->flags & IEEE80211_SDATA_USERSPACE_MLME)
                 return -EOPNOTSUPP;
 
-        if (sdata->vif.type == NL80211_IFTYPE_STATION ||
-            sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+        if (sdata->vif.type == NL80211_IFTYPE_STATION) {
                 int ret = ieee80211_sta_set_extra_ie(sdata, extra, data->length);
                 if (ret)
                         return ret;
-                sdata->u.sta.flags &= ~IEEE80211_STA_AUTO_BSSID_SEL;
-                ieee80211_sta_req_auth(sdata, &sdata->u.sta);
+                sdata->u.mgd.flags &= ~IEEE80211_STA_AUTO_BSSID_SEL;
+                ieee80211_sta_req_auth(sdata);
                 return 0;
         }
 
         return -EOPNOTSUPP;
 }
 
-static u8 ieee80211_get_wstats_flags(struct ieee80211_local *local)
-{
-        u8 wstats_flags = 0;
-
-        wstats_flags |= local->hw.flags & (IEEE80211_HW_SIGNAL_UNSPEC |
-                                           IEEE80211_HW_SIGNAL_DBM) ?
-                                IW_QUAL_QUAL_UPDATED : IW_QUAL_QUAL_INVALID;
-        wstats_flags |= local->hw.flags & IEEE80211_HW_NOISE_DBM ?
-                                IW_QUAL_NOISE_UPDATED : IW_QUAL_NOISE_INVALID;
-        if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
-                wstats_flags |= IW_QUAL_DBM;
-
-        return wstats_flags;
-}
-
-static int ieee80211_ioctl_giwrange(struct net_device *dev,
-                                 struct iw_request_info *info,
-                                 struct iw_point *data, char *extra)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct iw_range *range = (struct iw_range *) extra;
-        enum ieee80211_band band;
-        int c = 0;
-
-        data->length = sizeof(struct iw_range);
-        memset(range, 0, sizeof(struct iw_range));
-
-        range->we_version_compiled = WIRELESS_EXT;
-        range->we_version_source = 21;
-        range->retry_capa = IW_RETRY_LIMIT;
-        range->retry_flags = IW_RETRY_LIMIT;
-        range->min_retry = 0;
-        range->max_retry = 255;
-        range->min_rts = 0;
-        range->max_rts = 2347;
-        range->min_frag = 256;
-        range->max_frag = 2346;
-
-        range->encoding_size[0] = 5;
-        range->encoding_size[1] = 13;
-        range->num_encoding_sizes = 2;
-        range->max_encoding_tokens = NUM_DEFAULT_KEYS;
-
-        /* cfg80211 requires this, and enforces 0..100 */
-        if (local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC)
-                range->max_qual.level = 100;
-        else if  (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
-                range->max_qual.level = -110;
-        else
-                range->max_qual.level = 0;
-
-        if (local->hw.flags & IEEE80211_HW_NOISE_DBM)
-                range->max_qual.noise = -110;
-        else
-                range->max_qual.noise = 0;
-
-        range->max_qual.qual = 100;
-        range->max_qual.updated = ieee80211_get_wstats_flags(local);
-
-        range->avg_qual.qual = 50;
-        /* not always true but better than nothing */
-        range->avg_qual.level = range->max_qual.level / 2;
-        range->avg_qual.noise = range->max_qual.noise / 2;
-        range->avg_qual.updated = ieee80211_get_wstats_flags(local);
-
-        range->enc_capa = IW_ENC_CAPA_WPA | IW_ENC_CAPA_WPA2 |
-                          IW_ENC_CAPA_CIPHER_TKIP | IW_ENC_CAPA_CIPHER_CCMP;
-
-
-        for (band = 0; band < IEEE80211_NUM_BANDS; band ++) {
-                int i;
-                struct ieee80211_supported_band *sband;
-
-                sband = local->hw.wiphy->bands[band];
-
-                if (!sband)
-                        continue;
-
-                for (i = 0; i < sband->n_channels && c < IW_MAX_FREQUENCIES; i++) {
-                        struct ieee80211_channel *chan = &sband->channels[i];
-
-                        if (!(chan->flags & IEEE80211_CHAN_DISABLED)) {
-                                range->freq[c].i =
-                                        ieee80211_frequency_to_channel(
-                                                chan->center_freq);
-                                range->freq[c].m = chan->center_freq;
-                                range->freq[c].e = 6;
-                                c++;
-                        }
-                }
-        }
-        range->num_channels = c;
-        range->num_frequency = c;
-
-        IW_EVENT_CAPA_SET_KERNEL(range->event_capa);
-        IW_EVENT_CAPA_SET(range->event_capa, SIOCGIWAP);
-        IW_EVENT_CAPA_SET(range->event_capa, SIOCGIWSCAN);
-
-        range->scan_capa |= IW_SCAN_CAPA_ESSID;
-
-        return 0;
-}
-
-
 static int ieee80211_ioctl_siwfreq(struct net_device *dev,
                                    struct iw_request_info *info,
                                    struct iw_freq *freq, char *extra)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        if (sdata->vif.type == NL80211_IFTYPE_ADHOC ||
-            sdata->vif.type == NL80211_IFTYPE_STATION)
-                sdata->u.sta.flags &= ~IEEE80211_STA_AUTO_CHANNEL_SEL;
+        if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
+                sdata->u.ibss.flags &= ~IEEE80211_IBSS_AUTO_CHANNEL_SEL;
+        else if (sdata->vif.type == NL80211_IFTYPE_STATION)
+                sdata->u.mgd.flags &= ~IEEE80211_STA_AUTO_CHANNEL_SEL;
 
         /* freq->e == 0: freq->m = channel; otherwise freq = m * 10^e */
         if (freq->e == 0) {
                 if (freq->m < 0) {
-                        if (sdata->vif.type == NL80211_IFTYPE_ADHOC ||
-                            sdata->vif.type == NL80211_IFTYPE_STATION)
-                                sdata->u.sta.flags |=
+                        if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
+                                sdata->u.ibss.flags |=
+                                        IEEE80211_IBSS_AUTO_CHANNEL_SEL;
+                        else if (sdata->vif.type == NL80211_IFTYPE_STATION)
+                                sdata->u.mgd.flags |=
                                         IEEE80211_STA_AUTO_CHANNEL_SEL;
                         return 0;
                 } else
@@ -301,32 +199,35 @@ static int ieee80211_ioctl_siwessid(struct net_device *dev,
 {
         struct ieee80211_sub_if_data *sdata;
         size_t len = data->length;
+        int ret;
 
         /* iwconfig uses nul termination in SSID.. */
         if (len > 0 && ssid[len - 1] == '\0')
                 len--;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        if (sdata->vif.type == NL80211_IFTYPE_STATION ||
-            sdata->vif.type == NL80211_IFTYPE_ADHOC) {
-                int ret;
+        if (sdata->vif.type == NL80211_IFTYPE_STATION) {
                 if (sdata->flags & IEEE80211_SDATA_USERSPACE_MLME) {
                         if (len > IEEE80211_MAX_SSID_LEN)
                                 return -EINVAL;
-                        memcpy(sdata->u.sta.ssid, ssid, len);
-                        sdata->u.sta.ssid_len = len;
+                        memcpy(sdata->u.mgd.ssid, ssid, len);
+                        sdata->u.mgd.ssid_len = len;
                         return 0;
                 }
+
                 if (data->flags)
-                        sdata->u.sta.flags &= ~IEEE80211_STA_AUTO_SSID_SEL;
+                        sdata->u.mgd.flags &= ~IEEE80211_STA_AUTO_SSID_SEL;
                 else
-                        sdata->u.sta.flags |= IEEE80211_STA_AUTO_SSID_SEL;
+                        sdata->u.mgd.flags |= IEEE80211_STA_AUTO_SSID_SEL;
+
                 ret = ieee80211_sta_set_ssid(sdata, ssid, len);
                 if (ret)
                         return ret;
-                ieee80211_sta_req_auth(sdata, &sdata->u.sta);
+
+                ieee80211_sta_req_auth(sdata);
                 return 0;
-        }
+        } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
+                return ieee80211_ibss_set_ssid(sdata, ssid, len);
 
         return -EOPNOTSUPP;
 }
@@ -340,8 +241,7 @@ static int ieee80211_ioctl_giwessid(struct net_device *dev,
 
         struct ieee80211_sub_if_data *sdata;
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        if (sdata->vif.type == NL80211_IFTYPE_STATION ||
-            sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+        if (sdata->vif.type == NL80211_IFTYPE_STATION) {
                 int res = ieee80211_sta_get_ssid(sdata, ssid, &len);
                 if (res == 0) {
                         data->length = len;
@@ -349,6 +249,14 @@ static int ieee80211_ioctl_giwessid(struct net_device *dev,
                 } else
                         data->flags = 0;
                 return res;
+        } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+                int res = ieee80211_ibss_get_ssid(sdata, ssid, &len);
+                if (res == 0) {
+                        data->length = len;
+                        data->flags = 1;
+                } else
+                        data->flags = 0;
+                return res;
         }
 
         return -EOPNOTSUPP;
@@ -362,26 +270,35 @@ static int ieee80211_ioctl_siwap(struct net_device *dev,
         struct ieee80211_sub_if_data *sdata;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        if (sdata->vif.type == NL80211_IFTYPE_STATION ||
-            sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+        if (sdata->vif.type == NL80211_IFTYPE_STATION) {
                 int ret;
                 if (sdata->flags & IEEE80211_SDATA_USERSPACE_MLME) {
-                        memcpy(sdata->u.sta.bssid, (u8 *) &ap_addr->sa_data,
+                        memcpy(sdata->u.mgd.bssid, (u8 *) &ap_addr->sa_data,
                                ETH_ALEN);
                         return 0;
                 }
                 if (is_zero_ether_addr((u8 *) &ap_addr->sa_data))
-                        sdata->u.sta.flags |= IEEE80211_STA_AUTO_BSSID_SEL |
+                        sdata->u.mgd.flags |= IEEE80211_STA_AUTO_BSSID_SEL |
                                 IEEE80211_STA_AUTO_CHANNEL_SEL;
                 else if (is_broadcast_ether_addr((u8 *) &ap_addr->sa_data))
-                        sdata->u.sta.flags |= IEEE80211_STA_AUTO_BSSID_SEL;
+                        sdata->u.mgd.flags |= IEEE80211_STA_AUTO_BSSID_SEL;
                 else
-                        sdata->u.sta.flags &= ~IEEE80211_STA_AUTO_BSSID_SEL;
+                        sdata->u.mgd.flags &= ~IEEE80211_STA_AUTO_BSSID_SEL;
                 ret = ieee80211_sta_set_bssid(sdata, (u8 *) &ap_addr->sa_data);
                 if (ret)
                         return ret;
-                ieee80211_sta_req_auth(sdata, &sdata->u.sta);
+                ieee80211_sta_req_auth(sdata);
                 return 0;
+        } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+                if (is_zero_ether_addr((u8 *) &ap_addr->sa_data))
+                        sdata->u.ibss.flags |= IEEE80211_IBSS_AUTO_BSSID_SEL |
+                                               IEEE80211_IBSS_AUTO_CHANNEL_SEL;
+                else if (is_broadcast_ether_addr((u8 *) &ap_addr->sa_data))
+                        sdata->u.ibss.flags |= IEEE80211_IBSS_AUTO_BSSID_SEL;
+                else
+                        sdata->u.ibss.flags &= ~IEEE80211_IBSS_AUTO_BSSID_SEL;
+
+                return ieee80211_ibss_set_bssid(sdata, (u8 *) &ap_addr->sa_data);
         } else if (sdata->vif.type == NL80211_IFTYPE_WDS) {
                 /*
                  * If it is necessary to update the WDS peer address
@@ -410,17 +327,20 @@ static int ieee80211_ioctl_giwap(struct net_device *dev,
         struct ieee80211_sub_if_data *sdata;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        if (sdata->vif.type == NL80211_IFTYPE_STATION ||
-            sdata->vif.type == NL80211_IFTYPE_ADHOC) {
-                if (sdata->u.sta.state == IEEE80211_STA_MLME_ASSOCIATED ||
-                    sdata->u.sta.state == IEEE80211_STA_MLME_IBSS_JOINED) {
+        if (sdata->vif.type == NL80211_IFTYPE_STATION) {
+                if (sdata->u.mgd.state == IEEE80211_STA_MLME_ASSOCIATED) {
                         ap_addr->sa_family = ARPHRD_ETHER;
-                        memcpy(&ap_addr->sa_data, sdata->u.sta.bssid, ETH_ALEN);
-                        return 0;
-                } else {
+                        memcpy(&ap_addr->sa_data, sdata->u.mgd.bssid, ETH_ALEN);
+                } else
                         memset(&ap_addr->sa_data, 0, ETH_ALEN);
-                        return 0;
-                }
+                return 0;
+        } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+                if (sdata->u.ibss.state == IEEE80211_IBSS_MLME_JOINED) {
+                        ap_addr->sa_family = ARPHRD_ETHER;
+                        memcpy(&ap_addr->sa_data, sdata->u.ibss.bssid, ETH_ALEN);
+                } else
+                        memset(&ap_addr->sa_data, 0, ETH_ALEN);
+                return 0;
         } else if (sdata->vif.type == NL80211_IFTYPE_WDS) {
                 ap_addr->sa_family = ARPHRD_ETHER;
                 memcpy(&ap_addr->sa_data, sdata->u.wds.remote_addr, ETH_ALEN);
@@ -486,7 +406,7 @@ static int ieee80211_ioctl_giwrate(struct net_device *dev,
 
         rcu_read_lock();
 
-        sta = sta_info_get(local, sdata->u.sta.bssid);
+        sta = sta_info_get(local, sdata->u.mgd.bssid);
 
         if (sta && !(sta->last_tx_rate.flags & IEEE80211_TX_RC_MCS))
                 rate->value = sband->bitrates[sta->last_tx_rate.idx].bitrate;
@@ -687,8 +607,7 @@ static int ieee80211_ioctl_siwmlme(struct net_device *dev,
         struct iw_mlme *mlme = (struct iw_mlme *) extra;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        if (sdata->vif.type != NL80211_IFTYPE_STATION &&
-            sdata->vif.type != NL80211_IFTYPE_ADHOC)
+        if (!(sdata->vif.type == NL80211_IFTYPE_STATION))
                 return -EINVAL;
 
         switch (mlme->cmd) {
@@ -784,8 +703,7 @@ static int ieee80211_ioctl_giwencode(struct net_device *dev,
         erq->flags |= IW_ENCODE_ENABLED;
 
         if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                struct ieee80211_if_sta *ifsta = &sdata->u.sta;
-                switch (ifsta->auth_alg) {
+                switch (sdata->u.mgd.auth_alg) {
                 case WLAN_AUTH_OPEN:
                 case WLAN_AUTH_LEAP:
                         erq->flags |= IW_ENCODE_OPEN;
@@ -849,7 +767,7 @@ static int ieee80211_ioctl_siwpower(struct net_device *dev,
                 ret = ieee80211_hw_config(local,
                                           IEEE80211_CONF_CHANGE_DYNPS_TIMEOUT);
 
-        if (!(sdata->u.sta.flags & IEEE80211_STA_ASSOCIATED))
+        if (!(sdata->u.mgd.flags & IEEE80211_STA_ASSOCIATED))
                 return ret;
 
         if (conf->dynamic_ps_timeout > 0 &&
@@ -908,10 +826,10 @@ static int ieee80211_ioctl_siwauth(struct net_device *dev,
                 if (sdata->vif.type == NL80211_IFTYPE_STATION) {
                         if (data->value & (IW_AUTH_CIPHER_WEP40 |
                             IW_AUTH_CIPHER_WEP104 | IW_AUTH_CIPHER_TKIP))
-                                sdata->u.sta.flags |=
+                                sdata->u.mgd.flags |=
                                         IEEE80211_STA_TKIP_WEP_USED;
                         else
-                                sdata->u.sta.flags &=
+                                sdata->u.mgd.flags &=
                                         ~IEEE80211_STA_TKIP_WEP_USED;
                 }
                 break;
@@ -922,21 +840,20 @@ static int ieee80211_ioctl_siwauth(struct net_device *dev,
                 if (sdata->vif.type != NL80211_IFTYPE_STATION)
                         ret = -EINVAL;
                 else {
-                        sdata->u.sta.flags &= ~IEEE80211_STA_PRIVACY_INVOKED;
+                        sdata->u.mgd.flags &= ~IEEE80211_STA_PRIVACY_INVOKED;
                         /*
                          * Privacy invoked by wpa_supplicant, store the
                          * value and allow associating to a protected
                          * network without having a key up front.
                          */
                         if (data->value)
-                                sdata->u.sta.flags |=
+                                sdata->u.mgd.flags |=
                                         IEEE80211_STA_PRIVACY_INVOKED;
                 }
                 break;
         case IW_AUTH_80211_AUTH_ALG:
-                if (sdata->vif.type == NL80211_IFTYPE_STATION ||
-                    sdata->vif.type == NL80211_IFTYPE_ADHOC)
-                        sdata->u.sta.auth_algs = data->value;
+                if (sdata->vif.type == NL80211_IFTYPE_STATION)
+                        sdata->u.mgd.auth_algs = data->value;
                 else
                         ret = -EOPNOTSUPP;
                 break;
@@ -945,17 +862,16 @@ static int ieee80211_ioctl_siwauth(struct net_device *dev,
                         ret = -EOPNOTSUPP;
                         break;
                 }
-                if (sdata->vif.type == NL80211_IFTYPE_STATION ||
-                    sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
                         switch (data->value) {
                         case IW_AUTH_MFP_DISABLED:
-                                sdata->u.sta.mfp = IEEE80211_MFP_DISABLED;
+                                sdata->u.mgd.mfp = IEEE80211_MFP_DISABLED;
                                 break;
                         case IW_AUTH_MFP_OPTIONAL:
-                                sdata->u.sta.mfp = IEEE80211_MFP_OPTIONAL;
+                                sdata->u.mgd.mfp = IEEE80211_MFP_OPTIONAL;
                                 break;
                         case IW_AUTH_MFP_REQUIRED:
-                                sdata->u.sta.mfp = IEEE80211_MFP_REQUIRED;
+                                sdata->u.mgd.mfp = IEEE80211_MFP_REQUIRED;
                                 break;
                         default:
                                 ret = -EINVAL;
@@ -970,6 +886,21 @@ static int ieee80211_ioctl_siwauth(struct net_device *dev,
         return ret;
 }
 
+static u8 ieee80211_get_wstats_flags(struct ieee80211_local *local)
+{
+        u8 wstats_flags = 0;
+
+        wstats_flags |= local->hw.flags & (IEEE80211_HW_SIGNAL_UNSPEC |
+                                           IEEE80211_HW_SIGNAL_DBM) ?
+                                IW_QUAL_QUAL_UPDATED : IW_QUAL_QUAL_INVALID;
+        wstats_flags |= local->hw.flags & IEEE80211_HW_NOISE_DBM ?
+                                IW_QUAL_NOISE_UPDATED : IW_QUAL_NOISE_INVALID;
+        if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
+                wstats_flags |= IW_QUAL_DBM;
+
+        return wstats_flags;
+}
+
 /* Get wireless statistics.  Called by /proc/net/wireless and by SIOCGIWSTATS */
 static struct iw_statistics *ieee80211_get_wireless_stats(struct net_device *dev)
 {
@@ -980,9 +911,9 @@ static struct iw_statistics *ieee80211_get_wireless_stats(struct net_device *dev
 
         rcu_read_lock();
 
-        if (sdata->vif.type == NL80211_IFTYPE_STATION ||
-            sdata->vif.type == NL80211_IFTYPE_ADHOC)
-                sta = sta_info_get(local, sdata->u.sta.bssid);
+        if (sdata->vif.type == NL80211_IFTYPE_STATION)
+                sta = sta_info_get(local, sdata->u.mgd.bssid);
+
         if (!sta) {
                 wstats->discard.fragment = 0;
                 wstats->discard.misc = 0;
@@ -1011,9 +942,8 @@ static int ieee80211_ioctl_giwauth(struct net_device *dev,
 
         switch (data->flags & IW_AUTH_INDEX) {
         case IW_AUTH_80211_AUTH_ALG:
-                if (sdata->vif.type == NL80211_IFTYPE_STATION ||
-                    sdata->vif.type == NL80211_IFTYPE_ADHOC)
-                        data->value = sdata->u.sta.auth_algs;
+                if (sdata->vif.type == NL80211_IFTYPE_STATION)
+                        data->value = sdata->u.mgd.auth_algs;
                 else
                         ret = -EOPNOTSUPP;
                 break;
@@ -1116,7 +1046,7 @@ static const iw_handler ieee80211_handler[] =
         (iw_handler) NULL,                              /* SIOCSIWSENS */
         (iw_handler) NULL,                              /* SIOCGIWSENS */
         (iw_handler) NULL /* not used */,               /* SIOCSIWRANGE */
-        (iw_handler) ieee80211_ioctl_giwrange,          /* SIOCGIWRANGE */
+        (iw_handler) cfg80211_wext_giwrange,            /* SIOCGIWRANGE */
         (iw_handler) NULL /* not used */,               /* SIOCSIWPRIV */
         (iw_handler) NULL /* kernel code */,            /* SIOCGIWPRIV */
         (iw_handler) NULL /* not used */,               /* SIOCSIWSTATS */
diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c
index ac71b38f7cb5..093a4ab7f28b 100644
--- a/net/mac80211/wme.c
+++ b/net/mac80211/wme.c
@@ -114,9 +114,7 @@ u16 ieee80211_select_queue(struct net_device *dev, struct sk_buff *skb)
 {
         struct ieee80211_master_priv *mpriv = netdev_priv(dev);
         struct ieee80211_local *local = mpriv->local;
-        struct ieee80211_hw *hw = &local->hw;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        struct sta_info *sta;
         u16 queue;
         u8 tid;
 
@@ -124,29 +122,11 @@ u16 ieee80211_select_queue(struct net_device *dev, struct sk_buff *skb)
         if (unlikely(queue >= local->hw.queues))
                 queue = local->hw.queues - 1;
 
-        if (skb->requeue) {
-                if (!hw->ampdu_queues)
-                        return queue;
-
-                rcu_read_lock();
-                sta = sta_info_get(local, hdr->addr1);
-                tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
-                if (sta) {
-                        int ampdu_queue = sta->tid_to_tx_q[tid];
-
-                        if ((ampdu_queue < ieee80211_num_queues(hw)) &&
-                            test_bit(ampdu_queue, local->queue_pool))
-                                queue = ampdu_queue;
-                }
-                rcu_read_unlock();
-
-                return queue;
-        }
-
-        /* Now we know the 1d priority, fill in the QoS header if
-         * there is one.
+        /*
+         * Now we know the 1d priority, fill in the QoS header if
+         * there is one (and we haven't done this before).
          */
-        if (ieee80211_is_data_qos(hdr->frame_control)) {
+        if (!skb->requeue && ieee80211_is_data_qos(hdr->frame_control)) {
                 u8 *p = ieee80211_get_qos_ctl(hdr);
                 u8 ack_policy = 0;
                 tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
@@ -156,140 +136,7 @@ u16 ieee80211_select_queue(struct net_device *dev, struct sk_buff *skb)
                 /* qos header is 2 bytes, second reserved */
                 *p++ = ack_policy | tid;
                 *p = 0;
-
-                if (!hw->ampdu_queues)
-                        return queue;
-
-                rcu_read_lock();
-
-                sta = sta_info_get(local, hdr->addr1);
-                if (sta) {
-                        int ampdu_queue = sta->tid_to_tx_q[tid];
-
-                        if ((ampdu_queue < ieee80211_num_queues(hw)) &&
-                            test_bit(ampdu_queue, local->queue_pool))
-                                queue = ampdu_queue;
-                }
-
-                rcu_read_unlock();
         }
 
         return queue;
 }
-
-int ieee80211_ht_agg_queue_add(struct ieee80211_local *local,
-                               struct sta_info *sta, u16 tid)
-{
-        int i;
-
-        /* XXX: currently broken due to cb/requeue use */
-        return -EPERM;
-
-        /* prepare the filter and save it for the SW queue
-         * matching the received HW queue */
-
-        if (!local->hw.ampdu_queues)
-                return -EPERM;
-
-        /* try to get a Qdisc from the pool */
-        for (i = local->hw.queues; i < ieee80211_num_queues(&local->hw); i++)
-                if (!test_and_set_bit(i, local->queue_pool)) {
-                        ieee80211_stop_queue(local_to_hw(local), i);
-                        sta->tid_to_tx_q[tid] = i;
-
-                        /* IF there are already pending packets
-                         * on this tid first we need to drain them
-                         * on the previous queue
-                         * since HT is strict in order */
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                        if (net_ratelimit())
-                                printk(KERN_DEBUG "allocated aggregation queue"
-                                        " %d tid %d addr %pM pool=0x%lX\n",
-                                        i, tid, sta->sta.addr,
-                                        local->queue_pool[0]);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-                        return 0;
-                }
-
-        return -EAGAIN;
-}
-
-/**
- * the caller needs to hold netdev_get_tx_queue(local->mdev, X)->lock
- */
-void ieee80211_ht_agg_queue_remove(struct ieee80211_local *local,
-                                   struct sta_info *sta, u16 tid,
-                                   u8 requeue)
-{
-        int agg_queue = sta->tid_to_tx_q[tid];
-        struct ieee80211_hw *hw = &local->hw;
-
-        /* return the qdisc to the pool */
-        clear_bit(agg_queue, local->queue_pool);
-        sta->tid_to_tx_q[tid] = ieee80211_num_queues(hw);
-
-        if (requeue) {
-                ieee80211_requeue(local, agg_queue);
-        } else {
-                struct netdev_queue *txq;
-                spinlock_t *root_lock;
-                struct Qdisc *q;
-
-                txq = netdev_get_tx_queue(local->mdev, agg_queue);
-                q = rcu_dereference(txq->qdisc);
-                root_lock = qdisc_lock(q);
-
-                spin_lock_bh(root_lock);
-                qdisc_reset(q);
-                spin_unlock_bh(root_lock);
-        }
-}
-
-void ieee80211_requeue(struct ieee80211_local *local, int queue)
-{
-        struct netdev_queue *txq = netdev_get_tx_queue(local->mdev, queue);
-        struct sk_buff_head list;
-        spinlock_t *root_lock;
-        struct Qdisc *qdisc;
-        u32 len;
-
-        rcu_read_lock_bh();
-
-        qdisc = rcu_dereference(txq->qdisc);
-        if (!qdisc || !qdisc->dequeue)
-                goto out_unlock;
-
-        skb_queue_head_init(&list);
-
-        root_lock = qdisc_root_lock(qdisc);
-        spin_lock(root_lock);
-        for (len = qdisc->q.qlen; len > 0; len--) {
-                struct sk_buff *skb = qdisc->dequeue(qdisc);
-
-                if (skb)
-                        __skb_queue_tail(&list, skb);
-        }
-        spin_unlock(root_lock);
-
-        for (len = list.qlen; len > 0; len--) {
-                struct sk_buff *skb = __skb_dequeue(&list);
-                u16 new_queue;
-
-                BUG_ON(!skb);
-                new_queue = ieee80211_select_queue(local->mdev, skb);
-                skb_set_queue_mapping(skb, new_queue);
-
-                txq = netdev_get_tx_queue(local->mdev, new_queue);
-
-
-                qdisc = rcu_dereference(txq->qdisc);
-                root_lock = qdisc_root_lock(qdisc);
-
-                spin_lock(root_lock);
-                qdisc_enqueue_root(skb, qdisc);
-                spin_unlock(root_lock);
-        }
-
-out_unlock:
-        rcu_read_unlock_bh();
-}
diff --git a/net/mac80211/wme.h b/net/mac80211/wme.h
index bc62f28a4d3d..7520d2e014dc 100644
--- a/net/mac80211/wme.h
+++ b/net/mac80211/wme.h
@@ -21,11 +21,5 @@
 extern const int ieee802_1d_to_ac[8];
 
 u16 ieee80211_select_queue(struct net_device *dev, struct sk_buff *skb);
-int ieee80211_ht_agg_queue_add(struct ieee80211_local *local,
-                               struct sta_info *sta, u16 tid);
-void ieee80211_ht_agg_queue_remove(struct ieee80211_local *local,
-                                   struct sta_info *sta, u16 tid,
-                                   u8 requeue);
-void ieee80211_requeue(struct ieee80211_local *local, int queue);
 
 #endif /* _WME_H */
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 0668b2bfc1da..dd7f222919fe 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -7,7 +7,6 @@
 #include <linux/if.h>
 #include <linux/module.h>
 #include <linux/err.h>
-#include <linux/mutex.h>
 #include <linux/list.h>
 #include <linux/nl80211.h>
 #include <linux/debugfs.h>
@@ -31,18 +30,29 @@ MODULE_DESCRIPTION("wireless configuration support");
  * only read the list, and that can happen quite
  * often because we need to do it for each command */
 LIST_HEAD(cfg80211_drv_list);
-DEFINE_MUTEX(cfg80211_drv_mutex);
+
+/*
+ * This is used to protect the cfg80211_drv_list, cfg80211_regdomain,
+ * country_ie_regdomain, the reg_beacon_list and the the last regulatory
+ * request receipt (last_request).
+ */
+DEFINE_MUTEX(cfg80211_mutex);
 
 /* for debugfs */
 static struct dentry *ieee80211_debugfs_dir;
 
-/* requires cfg80211_drv_mutex to be held! */
-static struct cfg80211_registered_device *cfg80211_drv_by_wiphy(int wiphy)
+/* requires cfg80211_mutex to be held! */
+struct cfg80211_registered_device *cfg80211_drv_by_wiphy_idx(int wiphy_idx)
 {
         struct cfg80211_registered_device *result = NULL, *drv;
 
+        if (!wiphy_idx_valid(wiphy_idx))
+                return NULL;
+
+        assert_cfg80211_lock();
+
         list_for_each_entry(drv, &cfg80211_drv_list, list) {
-                if (drv->idx == wiphy) {
+                if (drv->wiphy_idx == wiphy_idx) {
                         result = drv;
                         break;
                 }
@@ -51,17 +61,44 @@ static struct cfg80211_registered_device *cfg80211_drv_by_wiphy(int wiphy)
         return result;
 }
 
+int get_wiphy_idx(struct wiphy *wiphy)
+{
+        struct cfg80211_registered_device *drv;
+        if (!wiphy)
+                return WIPHY_IDX_STALE;
+        drv = wiphy_to_dev(wiphy);
+        return drv->wiphy_idx;
+}
+
 /* requires cfg80211_drv_mutex to be held! */
+struct wiphy *wiphy_idx_to_wiphy(int wiphy_idx)
+{
+        struct cfg80211_registered_device *drv;
+
+        if (!wiphy_idx_valid(wiphy_idx))
+                return NULL;
+
+        assert_cfg80211_lock();
+
+        drv = cfg80211_drv_by_wiphy_idx(wiphy_idx);
+        if (!drv)
+                return NULL;
+        return &drv->wiphy;
+}
+
+/* requires cfg80211_mutex to be held! */
 static struct cfg80211_registered_device *
 __cfg80211_drv_from_info(struct genl_info *info)
 {
         int ifindex;
-        struct cfg80211_registered_device *bywiphy = NULL, *byifidx = NULL;
+        struct cfg80211_registered_device *bywiphyidx = NULL, *byifidx = NULL;
         struct net_device *dev;
         int err = -EINVAL;
 
+        assert_cfg80211_lock();
+
         if (info->attrs[NL80211_ATTR_WIPHY]) {
-                bywiphy = cfg80211_drv_by_wiphy(
+                bywiphyidx = cfg80211_drv_by_wiphy_idx(
                                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY]));
                 err = -ENODEV;
         }
@@ -78,14 +115,14 @@ __cfg80211_drv_from_info(struct genl_info *info)
                 err = -ENODEV;
         }
 
-        if (bywiphy && byifidx) {
-                if (bywiphy != byifidx)
+        if (bywiphyidx && byifidx) {
+                if (bywiphyidx != byifidx)
                         return ERR_PTR(-EINVAL);
                 else
-                        return bywiphy; /* == byifidx */
+                        return bywiphyidx; /* == byifidx */
         }
-        if (bywiphy)
-                return bywiphy;
+        if (bywiphyidx)
+                return bywiphyidx;
 
         if (byifidx)
                 return byifidx;
@@ -98,7 +135,7 @@ cfg80211_get_dev_from_info(struct genl_info *info)
 {
         struct cfg80211_registered_device *drv;
 
-        mutex_lock(&cfg80211_drv_mutex);
+        mutex_lock(&cfg80211_mutex);
         drv = __cfg80211_drv_from_info(info);
 
         /* if it is not an error we grab the lock on
@@ -107,7 +144,7 @@ cfg80211_get_dev_from_info(struct genl_info *info)
         if (!IS_ERR(drv))
                 mutex_lock(&drv->mtx);
 
-        mutex_unlock(&cfg80211_drv_mutex);
+        mutex_unlock(&cfg80211_mutex);
 
         return drv;
 }
@@ -118,7 +155,7 @@ cfg80211_get_dev_from_ifindex(int ifindex)
         struct cfg80211_registered_device *drv = ERR_PTR(-ENODEV);
         struct net_device *dev;
 
-        mutex_lock(&cfg80211_drv_mutex);
+        mutex_lock(&cfg80211_mutex);
         dev = dev_get_by_index(&init_net, ifindex);
         if (!dev)
                 goto out;
@@ -129,7 +166,7 @@ cfg80211_get_dev_from_ifindex(int ifindex)
                 drv = ERR_PTR(-ENODEV);
         dev_put(dev);
  out:
-        mutex_unlock(&cfg80211_drv_mutex);
+        mutex_unlock(&cfg80211_mutex);
         return drv;
 }
 
@@ -143,16 +180,16 @@ int cfg80211_dev_rename(struct cfg80211_registered_device *rdev,
                         char *newname)
 {
         struct cfg80211_registered_device *drv;
-        int idx, taken = -1, result, digits;
+        int wiphy_idx, taken = -1, result, digits;
 
-        mutex_lock(&cfg80211_drv_mutex);
+        mutex_lock(&cfg80211_mutex);
 
         /* prohibit calling the thing phy%d when %d is not its number */
-        sscanf(newname, PHY_NAME "%d%n", &idx, &taken);
-        if (taken == strlen(newname) && idx != rdev->idx) {
-                /* count number of places needed to print idx */
+        sscanf(newname, PHY_NAME "%d%n", &wiphy_idx, &taken);
+        if (taken == strlen(newname) && wiphy_idx != rdev->wiphy_idx) {
+                /* count number of places needed to print wiphy_idx */
                 digits = 1;
-                while (idx /= 10)
+                while (wiphy_idx /= 10)
                         digits++;
                 /*
                  * deny the name if it is phy<idx> where <idx> is printed
@@ -193,7 +230,7 @@ int cfg80211_dev_rename(struct cfg80211_registered_device *rdev,
 
         result = 0;
 out_unlock:
-        mutex_unlock(&cfg80211_drv_mutex);
+        mutex_unlock(&cfg80211_mutex);
         if (result == 0)
                 nl80211_notify_dev_rename(rdev);
 
@@ -220,22 +257,22 @@ struct wiphy *wiphy_new(struct cfg80211_ops *ops, int sizeof_priv)
 
         drv->ops = ops;
 
-        mutex_lock(&cfg80211_drv_mutex);
+        mutex_lock(&cfg80211_mutex);
 
-        drv->idx = wiphy_counter++;
+        drv->wiphy_idx = wiphy_counter++;
 
-        if (unlikely(drv->idx < 0)) {
+        if (unlikely(!wiphy_idx_valid(drv->wiphy_idx))) {
                 wiphy_counter--;
-                mutex_unlock(&cfg80211_drv_mutex);
+                mutex_unlock(&cfg80211_mutex);
                 /* ugh, wrapped! */
                 kfree(drv);
                 return NULL;
         }
 
-        mutex_unlock(&cfg80211_drv_mutex);
+        mutex_unlock(&cfg80211_mutex);
 
         /* give it a proper name */
-        dev_set_name(&drv->wiphy.dev, PHY_NAME "%d", drv->idx);
+        dev_set_name(&drv->wiphy.dev, PHY_NAME "%d", drv->wiphy_idx);
 
         mutex_init(&drv->mtx);
         mutex_init(&drv->devlist_mtx);
@@ -310,7 +347,7 @@ int wiphy_register(struct wiphy *wiphy)
         /* check and set up bitrates */
         ieee80211_set_bitrate_flags(wiphy);
 
-        mutex_lock(&cfg80211_drv_mutex);
+        mutex_lock(&cfg80211_mutex);
 
         /* set up regulatory info */
         wiphy_update_regulatory(wiphy, REGDOM_SET_BY_CORE);
@@ -330,7 +367,7 @@ int wiphy_register(struct wiphy *wiphy)
 
         res = 0;
 out_unlock:
-        mutex_unlock(&cfg80211_drv_mutex);
+        mutex_unlock(&cfg80211_mutex);
         return res;
 }
 EXPORT_SYMBOL(wiphy_register);
@@ -340,7 +377,7 @@ void wiphy_unregister(struct wiphy *wiphy)
         struct cfg80211_registered_device *drv = wiphy_to_dev(wiphy);
 
         /* protect the device list */
-        mutex_lock(&cfg80211_drv_mutex);
+        mutex_lock(&cfg80211_mutex);
 
         BUG_ON(!list_empty(&drv->netdev_list));
 
@@ -366,7 +403,7 @@ void wiphy_unregister(struct wiphy *wiphy)
         device_del(&drv->wiphy.dev);
         debugfs_remove(drv->wiphy.debugfsdir);
 
-        mutex_unlock(&cfg80211_drv_mutex);
+        mutex_unlock(&cfg80211_mutex);
 }
 EXPORT_SYMBOL(wiphy_unregister);
 
diff --git a/net/wireless/core.h b/net/wireless/core.h
index e29ad4cd464f..f6c53f5807f4 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -10,6 +10,7 @@
 #include <linux/netdevice.h>
 #include <linux/kref.h>
 #include <linux/rbtree.h>
+#include <linux/mutex.h>
 #include <net/genetlink.h>
 #include <net/wireless.h>
 #include <net/cfg80211.h>
@@ -37,7 +38,7 @@ struct cfg80211_registered_device {
         enum environment_cap env;
 
         /* wiphy index, internal only */
-        int idx;
+        int wiphy_idx;
 
         /* associate netdev list */
         struct mutex devlist_mtx;
@@ -49,6 +50,7 @@ struct cfg80211_registered_device {
         struct rb_root bss_tree;
         u32 bss_generation;
         struct cfg80211_scan_request *scan_req; /* protected by RTNL */
+        unsigned long suspend_at;
 
         /* must be last because of the way we do wiphy_priv(),
          * and it should at least be aligned to NETDEV_ALIGN */
@@ -62,9 +64,27 @@ struct cfg80211_registered_device *wiphy_to_dev(struct wiphy *wiphy)
         return container_of(wiphy, struct cfg80211_registered_device, wiphy);
 }
 
-extern struct mutex cfg80211_drv_mutex;
+/* Note 0 is valid, hence phy0 */
+static inline
+bool wiphy_idx_valid(int wiphy_idx)
+{
+        return (wiphy_idx >= 0);
+}
+
+extern struct mutex cfg80211_mutex;
 extern struct list_head cfg80211_drv_list;
 
+static inline void assert_cfg80211_lock(void)
+{
+        WARN_ON(!mutex_is_locked(&cfg80211_mutex));
+}
+
+/*
+ * You can use this to mark a wiphy_idx as not having an associated wiphy.
+ * It guarantees cfg80211_drv_by_wiphy_idx(wiphy_idx) will return NULL
+ */
+#define WIPHY_IDX_STALE -1
+
 struct cfg80211_internal_bss {
         struct list_head list;
         struct rb_node rbn;
@@ -74,6 +94,9 @@ struct cfg80211_internal_bss {
         struct cfg80211_bss pub;
 };
 
+struct cfg80211_registered_device *cfg80211_drv_by_wiphy_idx(int wiphy_idx);
+int get_wiphy_idx(struct wiphy *wiphy);
+
 /*
  * This function returns a pointer to the driver
  * that the genl_info item that is passed refers to.
@@ -81,13 +104,13 @@ struct cfg80211_internal_bss {
  * the driver's mutex!
  *
  * This means that you need to call cfg80211_put_dev()
- * before being allowed to acquire &cfg80211_drv_mutex!
+ * before being allowed to acquire &cfg80211_mutex!
  *
  * This is necessary because we need to lock the global
  * mutex to get an item off the list safely, and then
  * we lock the drv mutex so it doesn't go away under us.
  *
- * We don't want to keep cfg80211_drv_mutex locked
+ * We don't want to keep cfg80211_mutex locked
  * for all the time in order to allow requests on
  * other interfaces to go through at the same time.
  *
@@ -97,6 +120,9 @@ struct cfg80211_internal_bss {
 extern struct cfg80211_registered_device *
 cfg80211_get_dev_from_info(struct genl_info *info);
 
+/* requires cfg80211_drv_mutex to be held! */
+struct wiphy *wiphy_idx_to_wiphy(int wiphy_idx);
+
 /* identical to cfg80211_get_dev_from_info but only operate on ifindex */
 extern struct cfg80211_registered_device *
 cfg80211_get_dev_from_ifindex(int ifindex);
@@ -113,5 +139,7 @@ void ieee80211_set_bitrate_flags(struct wiphy *wiphy);
 void wiphy_update_regulatory(struct wiphy *wiphy, enum reg_set_by setby);
 
 void cfg80211_bss_expire(struct cfg80211_registered_device *dev);
+void cfg80211_bss_age(struct cfg80211_registered_device *dev,
+                      unsigned long age_secs);
 
 #endif /* __NET_WIRELESS_CORE_H */
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 298a4de59948..531bb67cf502 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -7,7 +7,6 @@
 #include <linux/if.h>
 #include <linux/module.h>
 #include <linux/err.h>
-#include <linux/mutex.h>
 #include <linux/list.h>
 #include <linux/if_ether.h>
 #include <linux/ieee80211.h>
@@ -142,7 +141,7 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
         if (!hdr)
                 return -1;
 
-        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->idx);
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
                    dev->wiphy.max_scan_ssids);
@@ -256,7 +255,7 @@ static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
         int start = cb->args[0];
         struct cfg80211_registered_device *dev;
 
-        mutex_lock(&cfg80211_drv_mutex);
+        mutex_lock(&cfg80211_mutex);
         list_for_each_entry(dev, &cfg80211_drv_list, list) {
                 if (++idx <= start)
                         continue;
@@ -267,7 +266,7 @@ static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
                         break;
                 }
         }
-        mutex_unlock(&cfg80211_drv_mutex);
+        mutex_unlock(&cfg80211_mutex);
 
         cb->args[0] = idx;
 
@@ -470,7 +469,7 @@ static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *
         struct cfg80211_registered_device *dev;
         struct wireless_dev *wdev;
 
-        mutex_lock(&cfg80211_drv_mutex);
+        mutex_lock(&cfg80211_mutex);
         list_for_each_entry(dev, &cfg80211_drv_list, list) {
                 if (wp_idx < wp_start) {
                         wp_idx++;
@@ -497,7 +496,7 @@ static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *
                 wp_idx++;
         }
  out:
-        mutex_unlock(&cfg80211_drv_mutex);
+        mutex_unlock(&cfg80211_mutex);
 
         cb->args[0] = wp_idx;
         cb->args[1] = if_idx;
@@ -1206,6 +1205,12 @@ static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
 
                 nla_nest_end(msg, txrate);
         }
+        if (sinfo->filled & STATION_INFO_RX_PACKETS)
+                NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
+                            sinfo->rx_packets);
+        if (sinfo->filled & STATION_INFO_TX_PACKETS)
+                NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
+                            sinfo->tx_packets);
         nla_nest_end(msg, sinfoattr);
 
         return genlmsg_end(msg, hdr);
@@ -1900,6 +1905,19 @@ static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
         int r;
         char *data = NULL;
 
+        /*
+         * You should only get this when cfg80211 hasn't yet initialized
+         * completely when built-in to the kernel right between the time
+         * window between nl80211_init() and regulatory_init(), if that is
+         * even possible.
+         */
+        mutex_lock(&cfg80211_mutex);
+        if (unlikely(!cfg80211_regdomain)) {
+                mutex_unlock(&cfg80211_mutex);
+                return -EINPROGRESS;
+        }
+        mutex_unlock(&cfg80211_mutex);
+
         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
                 return -EINVAL;
 
@@ -1910,14 +1928,9 @@ static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
         if (is_world_regdom(data))
                 return -EINVAL;
 #endif
-        mutex_lock(&cfg80211_drv_mutex);
-        r = __regulatory_hint(NULL, REGDOM_SET_BY_USER, data, 0, ENVIRON_ANY);
-        mutex_unlock(&cfg80211_drv_mutex);
-        /* This means the regulatory domain was already set, however
-         * we don't want to confuse userspace with a "successful error"
-         * message so lets just treat it as a success */
-        if (r == -EALREADY)
-                r = 0;
+
+        r = regulatory_hint_user(data);
+
         return r;
 }
 
@@ -2106,7 +2119,7 @@ static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
         unsigned int i;
         int err = -EINVAL;
 
-        mutex_lock(&cfg80211_drv_mutex);
+        mutex_lock(&cfg80211_mutex);
 
         if (!cfg80211_regdomain)
                 goto out;
@@ -2169,7 +2182,7 @@ nla_put_failure:
         genlmsg_cancel(msg, hdr);
         err = -EMSGSIZE;
 out:
-        mutex_unlock(&cfg80211_drv_mutex);
+        mutex_unlock(&cfg80211_mutex);
         return err;
 }
 
@@ -2228,9 +2241,9 @@ static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
 
         BUG_ON(rule_idx != num_rules);
 
-        mutex_lock(&cfg80211_drv_mutex);
+        mutex_lock(&cfg80211_mutex);
         r = set_regdom(rd);
-        mutex_unlock(&cfg80211_drv_mutex);
+        mutex_unlock(&cfg80211_mutex);
         return r;
 
  bad_reg:
@@ -2286,6 +2299,7 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
         struct wiphy *wiphy;
         int err, tmp, n_ssids = 0, n_channels = 0, i;
         enum ieee80211_band band;
+        size_t ie_len;
 
         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
         if (err)
@@ -2327,9 +2341,15 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
                 goto out_unlock;
         }
 
+        if (info->attrs[NL80211_ATTR_IE])
+                ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
+        else
+                ie_len = 0;
+
         request = kzalloc(sizeof(*request)
                         + sizeof(*ssid) * n_ssids
-                        + sizeof(channel) * n_channels, GFP_KERNEL);
+                        + sizeof(channel) * n_channels
+                        + ie_len, GFP_KERNEL);
         if (!request) {
                 err = -ENOMEM;
                 goto out_unlock;
@@ -2340,6 +2360,12 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
         if (n_ssids)
                 request->ssids = (void *)(request->channels + n_channels);
         request->n_ssids = n_ssids;
+        if (ie_len) {
+                if (request->ssids)
+                        request->ie = (void *)(request->ssids + n_ssids);
+                else
+                        request->ie = (void *)(request->channels + n_channels);
+        }
 
         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
                 /* user specified, bail out if channel not found */
@@ -2380,6 +2406,12 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
                 }
         }
 
+        if (info->attrs[NL80211_ATTR_IE]) {
+                request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
+                memcpy(request->ie, nla_data(info->attrs[NL80211_ATTR_IE]),
+                       request->ie_len);
+        }
+
         request->ifidx = dev->ifindex;
         request->wiphy = &drv->wiphy;
 
@@ -2432,7 +2464,7 @@ static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
 
-        switch (res->signal_type) {
+        switch (rdev->wiphy.signal_type) {
         case CFG80211_SIGNAL_TYPE_MBM:
                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
                 break;
@@ -2601,7 +2633,6 @@ static struct genl_ops nl80211_ops[] = {
                 .doit = nl80211_get_station,
                 .dumpit = nl80211_dump_station,
                 .policy = nl80211_policy,
-                .flags = GENL_ADMIN_PERM,
         },
         {
                 .cmd = NL80211_CMD_SET_STATION,
@@ -2739,7 +2770,7 @@ static int nl80211_send_scan_donemsg(struct sk_buff *msg,
         if (!hdr)
                 return -1;
 
-        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->idx);
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
 
         /* XXX: we should probably bounce back the request? */
diff --git a/net/wireless/nl80211.h b/net/wireless/nl80211.h
index b565a5f84e97..69787b621365 100644
--- a/net/wireless/nl80211.h
+++ b/net/wireless/nl80211.h
@@ -27,6 +27,10 @@ static inline void
 nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
                        struct net_device *netdev)
 {}
+static inline void nl80211_send_scan_aborted(
+                                        struct cfg80211_registered_device *rdev,
+                                        struct net_device *netdev)
+{}
 #endif /* CONFIG_NL80211 */
 
 #endif /* __NET_WIRELESS_NL80211_H */
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 2323644330cd..ce66bfdf57ec 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -54,22 +54,52 @@ static u32 supported_bandwidths[] = {
         MHZ_TO_KHZ(20),
 };
 
-/* Central wireless core regulatory domains, we only need two,
+/*
+ * Central wireless core regulatory domains, we only need two,
  * the current one and a world regulatory domain in case we have no
- * information to give us an alpha2 */
+ * information to give us an alpha2
+ */
 const struct ieee80211_regdomain *cfg80211_regdomain;
 
-/* We use this as a place for the rd structure built from the
+/*
+ * We use this as a place for the rd structure built from the
  * last parsed country IE to rest until CRDA gets back to us with
- * what it thinks should apply for the same country */
+ * what it thinks should apply for the same country
+ */
 static const struct ieee80211_regdomain *country_ie_regdomain;
 
+/* Used to queue up regulatory hints */
+static LIST_HEAD(reg_requests_list);
+static spinlock_t reg_requests_lock;
+
+/* Used to queue up beacon hints for review */
+static LIST_HEAD(reg_pending_beacons);
+static spinlock_t reg_pending_beacons_lock;
+
+/* Used to keep track of processed beacon hints */
+static LIST_HEAD(reg_beacon_list);
+
+struct reg_beacon {
+        struct list_head list;
+        struct ieee80211_channel chan;
+};
+
 /* We keep a static world regulatory domain in case of the absence of CRDA */
 static const struct ieee80211_regdomain world_regdom = {
-        .n_reg_rules = 1,
+        .n_reg_rules = 3,
         .alpha2 =  "00",
         .reg_rules = {
-                REG_RULE(2412-10, 2462+10, 40, 6, 20,
+                /* IEEE 802.11b/g, channels 1..11 */
+                REG_RULE(2412-10, 2462+10, 40, 6, 20, 0),
+                /* IEEE 802.11a, channel 36..48 */
+                REG_RULE(5180-10, 5240+10, 40, 6, 23,
+                        NL80211_RRF_PASSIVE_SCAN |
+                        NL80211_RRF_NO_IBSS),
+
+                /* NB: 5260 MHz - 5700 MHz requies DFS */
+
+                /* IEEE 802.11a, channel 149..165 */
+                REG_RULE(5745-10, 5825+10, 40, 6, 23,
                         NL80211_RRF_PASSIVE_SCAN |
                         NL80211_RRF_NO_IBSS),
         }
@@ -83,9 +113,11 @@ static char *ieee80211_regdom = "US";
 module_param(ieee80211_regdom, charp, 0444);
 MODULE_PARM_DESC(ieee80211_regdom, "IEEE 802.11 regulatory domain code");
 
-/* We assume 40 MHz bandwidth for the old regulatory work.
+/*
+ * We assume 40 MHz bandwidth for the old regulatory work.
  * We make emphasis we are using the exact same frequencies
- * as before */
+ * as before
+ */
 
 static const struct ieee80211_regdomain us_regdom = {
         .n_reg_rules = 6,
@@ -124,8 +156,10 @@ static const struct ieee80211_regdomain jp_regdom = {
 
 static const struct ieee80211_regdomain eu_regdom = {
         .n_reg_rules = 6,
-        /* This alpha2 is bogus, we leave it here just for stupid
-         * backward compatibility */
+        /*
+         * This alpha2 is bogus, we leave it here just for stupid
+         * backward compatibility
+         */
         .alpha2 =  "EU",
         .reg_rules = {
                 /* IEEE 802.11b/g, channels 1..13 */
@@ -194,8 +228,10 @@ static void reset_regdomains(void)
         cfg80211_regdomain = NULL;
 }
 
-/* Dynamic world regulatory domain requested by the wireless
- * core upon initialization */
+/*
+ * Dynamic world regulatory domain requested by the wireless
+ * core upon initialization
+ */
 static void update_world_regdomain(const struct ieee80211_regdomain *rd)
 {
         BUG_ON(!last_request);
@@ -236,8 +272,10 @@ static bool is_unknown_alpha2(const char *alpha2)
 {
         if (!alpha2)
                 return false;
-        /* Special case where regulatory domain was built by driver
-         * but a specific alpha2 cannot be determined */
+        /*
+         * Special case where regulatory domain was built by driver
+         * but a specific alpha2 cannot be determined
+         */
         if (alpha2[0] == '9' && alpha2[1] == '9')
                 return true;
         return false;
@@ -247,9 +285,11 @@ static bool is_intersected_alpha2(const char *alpha2)
 {
         if (!alpha2)
                 return false;
-        /* Special case where regulatory domain is the
+        /*
+         * Special case where regulatory domain is the
          * result of an intersection between two regulatory domain
-         * structures */
+         * structures
+         */
         if (alpha2[0] == '9' && alpha2[1] == '8')
                 return true;
         return false;
@@ -274,8 +314,10 @@ static bool alpha2_equal(const char *alpha2_x, const char *alpha2_y)
         return false;
 }
 
-static bool regdom_changed(const char *alpha2)
+static bool regdom_changes(const char *alpha2)
 {
+        assert_cfg80211_lock();
+
         if (!cfg80211_regdomain)
                 return true;
         if (alpha2_equal(cfg80211_regdomain->alpha2, alpha2))
@@ -302,8 +344,10 @@ static bool country_ie_integrity_changes(u32 checksum)
         return false;
 }
 
-/* This lets us keep regulatory code which is updated on a regulatory
- * basis in userspace. */
+/*
+ * This lets us keep regulatory code which is updated on a regulatory
+ * basis in userspace.
+ */
 static int call_crda(const char *alpha2)
 {
         char country_env[9 + 2] = "COUNTRY=";
@@ -414,10 +458,12 @@ static bool freq_in_rule_band(const struct ieee80211_freq_range *freq_range,
 #undef ONE_GHZ_IN_KHZ
 }
 
-/* Converts a country IE to a regulatory domain. A regulatory domain
+/*
+ * Converts a country IE to a regulatory domain. A regulatory domain
  * structure has a lot of information which the IE doesn't yet have,
  * so for the other values we use upper max values as we will intersect
- * with our userspace regulatory agent to get lower bounds. */
+ * with our userspace regulatory agent to get lower bounds.
+ */
 static struct ieee80211_regdomain *country_ie_2_rd(
                                 u8 *country_ie,
                                 u8 country_ie_len,
@@ -462,9 +508,11 @@ static struct ieee80211_regdomain *country_ie_2_rd(
 
         *checksum ^= ((flags ^ alpha2[0] ^ alpha2[1]) << 8);
 
-        /* We need to build a reg rule for each triplet, but first we must
+        /*
+         * We need to build a reg rule for each triplet, but first we must
          * calculate the number of reg rules we will need. We will need one
-         * for each channel subband */
+         * for each channel subband
+         */
         while (country_ie_len >= 3) {
                 int end_channel = 0;
                 struct ieee80211_country_ie_triplet *triplet =
@@ -502,9 +550,11 @@ static struct ieee80211_regdomain *country_ie_2_rd(
                 if (cur_sub_max_channel < cur_channel)
                         return NULL;
 
-                /* Do not allow overlapping channels. Also channels
+                /*
+                 * Do not allow overlapping channels. Also channels
                  * passed in each subband must be monotonically
-                 * increasing */
+                 * increasing
+                 */
                 if (last_sub_max_channel) {
                         if (cur_channel <= last_sub_max_channel)
                                 return NULL;
@@ -512,10 +562,12 @@ static struct ieee80211_regdomain *country_ie_2_rd(
                                 return NULL;
                 }
 
-                /* When dot11RegulatoryClassesRequired is supported
+                /*
+                 * When dot11RegulatoryClassesRequired is supported
                  * we can throw ext triplets as part of this soup,
                  * for now we don't care when those change as we
-                 * don't support them */
+                 * don't support them
+                 */
                 *checksum ^= ((cur_channel ^ cur_sub_max_channel) << 8) |
                   ((cur_sub_max_channel ^ cur_sub_max_channel) << 16) |
                   ((triplet->chans.max_power ^ cur_sub_max_channel) << 24);
@@ -526,8 +578,10 @@ static struct ieee80211_regdomain *country_ie_2_rd(
                 country_ie_len -= 3;
                 num_rules++;
 
-                /* Note: this is not a IEEE requirement but
-                 * simply a memory requirement */
+                /*
+                 * Note: this is not a IEEE requirement but
+                 * simply a memory requirement
+                 */
                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
                         return NULL;
         }
@@ -555,8 +609,10 @@ static struct ieee80211_regdomain *country_ie_2_rd(
                 struct ieee80211_freq_range *freq_range = NULL;
                 struct ieee80211_power_rule *power_rule = NULL;
 
-                /* Must parse if dot11RegulatoryClassesRequired is true,
-                 * we don't support this yet */
+                /*
+                 * Must parse if dot11RegulatoryClassesRequired is true,
+                 * we don't support this yet
+                 */
                 if (triplet->ext.reg_extension_id >=
                                 IEEE80211_COUNTRY_EXTENSION_ID) {
                         country_ie += 3;
@@ -578,10 +634,12 @@ static struct ieee80211_regdomain *country_ie_2_rd(
                         end_channel =  triplet->chans.first_channel +
                                 (4 * (triplet->chans.num_channels - 1));
 
-                /* The +10 is since the regulatory domain expects
+                /*
+                 * The +10 is since the regulatory domain expects
                  * the actual band edge, not the center of freq for
                  * its start and end freqs, assuming 20 MHz bandwidth on
-                 * the channels passed */
+                 * the channels passed
+                 */
                 freq_range->start_freq_khz =
                         MHZ_TO_KHZ(ieee80211_channel_to_frequency(
                                 triplet->chans.first_channel) - 10);
@@ -589,9 +647,11 @@ static struct ieee80211_regdomain *country_ie_2_rd(
                         MHZ_TO_KHZ(ieee80211_channel_to_frequency(
                                 end_channel) + 10);
 
-                /* Large arbitrary values, we intersect later */
-                /* Increment this if we ever support >= 40 MHz channels
-                 * in IEEE 802.11 */
+                /*
+                 * These are large arbitrary values we use to intersect later.
+                 * Increment this if we ever support >= 40 MHz channels
+                 * in IEEE 802.11
+                 */
                 freq_range->max_bandwidth_khz = MHZ_TO_KHZ(40);
                 power_rule->max_antenna_gain = DBI_TO_MBI(100);
                 power_rule->max_eirp = DBM_TO_MBM(100);
@@ -607,8 +667,10 @@ static struct ieee80211_regdomain *country_ie_2_rd(
 }
 
 
-/* Helper for regdom_intersect(), this does the real
- * mathematical intersection fun */
+/*
+ * Helper for regdom_intersect(), this does the real
+ * mathematical intersection fun
+ */
 static int reg_rules_intersect(
         const struct ieee80211_reg_rule *rule1,
         const struct ieee80211_reg_rule *rule2,
@@ -686,11 +748,13 @@ static struct ieee80211_regdomain *regdom_intersect(
         if (!rd1 || !rd2)
                 return NULL;
 
-        /* First we get a count of the rules we'll need, then we actually
+        /*
+         * First we get a count of the rules we'll need, then we actually
          * build them. This is to so we can malloc() and free() a
          * regdomain once. The reason we use reg_rules_intersect() here
          * is it will return -EINVAL if the rule computed makes no sense.
-         * All rules that do check out OK are valid. */
+         * All rules that do check out OK are valid.
+         */
 
         for (x = 0; x < rd1->n_reg_rules; x++) {
                 rule1 = &rd1->reg_rules[x];
@@ -718,14 +782,18 @@ static struct ieee80211_regdomain *regdom_intersect(
                 rule1 = &rd1->reg_rules[x];
                 for (y = 0; y < rd2->n_reg_rules; y++) {
                         rule2 = &rd2->reg_rules[y];
-                        /* This time around instead of using the stack lets
+                        /*
+                         * This time around instead of using the stack lets
                          * write to the target rule directly saving ourselves
-                         * a memcpy() */
+                         * a memcpy()
+                         */
                         intersected_rule = &rd->reg_rules[rule_idx];
                         r = reg_rules_intersect(rule1, rule2,
                                 intersected_rule);
-                        /* No need to memset here the intersected rule here as
-                         * we're not using the stack anymore */
+                        /*
+                         * No need to memset here the intersected rule here as
+                         * we're not using the stack anymore
+                         */
                         if (r)
                                 continue;
                         rule_idx++;
@@ -744,8 +812,10 @@ static struct ieee80211_regdomain *regdom_intersect(
         return rd;
 }
 
-/* XXX: add support for the rest of enum nl80211_reg_rule_flags, we may
- * want to just have the channel structure use these */
+/*
+ * XXX: add support for the rest of enum nl80211_reg_rule_flags, we may
+ * want to just have the channel structure use these
+ */
 static u32 map_regdom_flags(u32 rd_flags)
 {
         u32 channel_flags = 0;
@@ -771,8 +841,10 @@ static int freq_reg_info_regd(struct wiphy *wiphy,
 
         regd = custom_regd ? custom_regd : cfg80211_regdomain;
 
-        /* Follow the driver's regulatory domain, if present, unless a country
-         * IE has been processed or a user wants to help complaince further */
+        /*
+         * Follow the driver's regulatory domain, if present, unless a country
+         * IE has been processed or a user wants to help complaince further
+         */
         if (last_request->initiator != REGDOM_SET_BY_COUNTRY_IE &&
             last_request->initiator != REGDOM_SET_BY_USER &&
             wiphy->regd)
@@ -790,9 +862,11 @@ static int freq_reg_info_regd(struct wiphy *wiphy,
                 fr = &rr->freq_range;
                 pr = &rr->power_rule;
 
-                /* We only need to know if one frequency rule was
+                /*
+                 * We only need to know if one frequency rule was
                  * was in center_freq's band, that's enough, so lets
-                 * not overwrite it once found */
+                 * not overwrite it once found
+                 */
                 if (!band_rule_found)
                         band_rule_found = freq_in_rule_band(fr, center_freq);
 
@@ -829,6 +903,11 @@ static void handle_channel(struct wiphy *wiphy, enum ieee80211_band band,
         const struct ieee80211_power_rule *power_rule = NULL;
         struct ieee80211_supported_band *sband;
         struct ieee80211_channel *chan;
+        struct wiphy *request_wiphy = NULL;
+
+        assert_cfg80211_lock();
+
+        request_wiphy = wiphy_idx_to_wiphy(last_request->wiphy_idx);
 
         sband = wiphy->bands[band];
         BUG_ON(chan_idx >= sband->n_channels);
@@ -840,7 +919,8 @@ static void handle_channel(struct wiphy *wiphy, enum ieee80211_band band,
                 &max_bandwidth, &reg_rule);
 
         if (r) {
-                /* This means no regulatory rule was found in the country IE
+                /*
+                 * This means no regulatory rule was found in the country IE
                  * with a frequency range on the center_freq's band, since
                  * IEEE-802.11 allows for a country IE to have a subset of the
                  * regulatory information provided in a country we ignore
@@ -859,8 +939,10 @@ static void handle_channel(struct wiphy *wiphy, enum ieee80211_band band,
                                 chan->center_freq, wiphy_name(wiphy));
 #endif
                 } else {
-                /* In this case we know the country IE has at least one reg rule
-                 * for the band so we respect its band definitions */
+                /*
+                 * In this case we know the country IE has at least one reg rule
+                 * for the band so we respect its band definitions
+                 */
 #ifdef CONFIG_CFG80211_REG_DEBUG
                         if (last_request->initiator == REGDOM_SET_BY_COUNTRY_IE)
                                 printk(KERN_DEBUG "cfg80211: Disabling "
@@ -877,11 +959,13 @@ static void handle_channel(struct wiphy *wiphy, enum ieee80211_band band,
         power_rule = &reg_rule->power_rule;
 
         if (last_request->initiator == REGDOM_SET_BY_DRIVER &&
-            last_request->wiphy && last_request->wiphy == wiphy &&
-            last_request->wiphy->strict_regulatory) {
-                /* This gaurantees the driver's requested regulatory domain
+            request_wiphy && request_wiphy == wiphy &&
+            request_wiphy->strict_regulatory) {
+                /*
+                 * This gaurantees the driver's requested regulatory domain
                  * will always be used as a base for further regulatory
-                 * settings */
+                 * settings
+                 */
                 chan->flags = chan->orig_flags =
                         map_regdom_flags(reg_rule->flags);
                 chan->max_antenna_gain = chan->orig_mag =
@@ -922,8 +1006,10 @@ static bool ignore_reg_update(struct wiphy *wiphy, enum reg_set_by setby)
         if (setby == REGDOM_SET_BY_CORE &&
                   wiphy->custom_regulatory)
                 return true;
-        /* wiphy->regd will be set once the device has its own
-         * desired regulatory domain set */
+        /*
+         * wiphy->regd will be set once the device has its own
+         * desired regulatory domain set
+         */
         if (wiphy->strict_regulatory && !wiphy->regd &&
             !is_world_regdom(last_request->alpha2))
                 return true;
@@ -938,16 +1024,120 @@ static void update_all_wiphy_regulatory(enum reg_set_by setby)
                 wiphy_update_regulatory(&drv->wiphy, setby);
 }
 
+static void handle_reg_beacon(struct wiphy *wiphy,
+                              unsigned int chan_idx,
+                              struct reg_beacon *reg_beacon)
+{
+#ifdef CONFIG_CFG80211_REG_DEBUG
+#define REG_DEBUG_BEACON_FLAG(desc) \
+        printk(KERN_DEBUG "cfg80211: Enabling " desc " on " \
+                "frequency: %d MHz (Ch %d) on %s\n", \
+                reg_beacon->chan.center_freq, \
+                ieee80211_frequency_to_channel(reg_beacon->chan.center_freq), \
+                wiphy_name(wiphy));
+#else
+#define REG_DEBUG_BEACON_FLAG(desc) do {} while (0)
+#endif
+        struct ieee80211_supported_band *sband;
+        struct ieee80211_channel *chan;
+
+        assert_cfg80211_lock();
+
+        sband = wiphy->bands[reg_beacon->chan.band];
+        chan = &sband->channels[chan_idx];
+
+        if (likely(chan->center_freq != reg_beacon->chan.center_freq))
+                return;
+
+        if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) {
+                chan->flags &= ~IEEE80211_CHAN_PASSIVE_SCAN;
+                REG_DEBUG_BEACON_FLAG("active scanning");
+        }
+
+        if (chan->flags & IEEE80211_CHAN_NO_IBSS) {
+                chan->flags &= ~IEEE80211_CHAN_NO_IBSS;
+                REG_DEBUG_BEACON_FLAG("beaconing");
+        }
+
+        chan->beacon_found = true;
+#undef REG_DEBUG_BEACON_FLAG
+}
+
+/*
+ * Called when a scan on a wiphy finds a beacon on
+ * new channel
+ */
+static void wiphy_update_new_beacon(struct wiphy *wiphy,
+                                    struct reg_beacon *reg_beacon)
+{
+        unsigned int i;
+        struct ieee80211_supported_band *sband;
+
+        assert_cfg80211_lock();
+
+        if (!wiphy->bands[reg_beacon->chan.band])
+                return;
+
+        sband = wiphy->bands[reg_beacon->chan.band];
+
+        for (i = 0; i < sband->n_channels; i++)
+                handle_reg_beacon(wiphy, i, reg_beacon);
+}
+
+/*
+ * Called upon reg changes or a new wiphy is added
+ */
+static void wiphy_update_beacon_reg(struct wiphy *wiphy)
+{
+        unsigned int i;
+        struct ieee80211_supported_band *sband;
+        struct reg_beacon *reg_beacon;
+
+        assert_cfg80211_lock();
+
+        if (list_empty(&reg_beacon_list))
+                return;
+
+        list_for_each_entry(reg_beacon, &reg_beacon_list, list) {
+                if (!wiphy->bands[reg_beacon->chan.band])
+                        continue;
+                sband = wiphy->bands[reg_beacon->chan.band];
+                for (i = 0; i < sband->n_channels; i++)
+                        handle_reg_beacon(wiphy, i, reg_beacon);
+        }
+}
+
+static bool reg_is_world_roaming(struct wiphy *wiphy)
+{
+        if (is_world_regdom(cfg80211_regdomain->alpha2) ||
+            (wiphy->regd && is_world_regdom(wiphy->regd->alpha2)))
+                return true;
+        if (last_request->initiator != REGDOM_SET_BY_COUNTRY_IE &&
+            wiphy->custom_regulatory)
+                return true;
+        return false;
+}
+
+/* Reap the advantages of previously found beacons */
+static void reg_process_beacons(struct wiphy *wiphy)
+{
+        if (!reg_is_world_roaming(wiphy))
+                return;
+        wiphy_update_beacon_reg(wiphy);
+}
+
 void wiphy_update_regulatory(struct wiphy *wiphy, enum reg_set_by setby)
 {
         enum ieee80211_band band;
 
         if (ignore_reg_update(wiphy, setby))
-                return;
+                goto out;
         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                 if (wiphy->bands[band])
                         handle_band(wiphy, band);
         }
+out:
+        reg_process_beacons(wiphy);
         if (wiphy->reg_notifier)
                 wiphy->reg_notifier(wiphy, last_request);
 }
@@ -1033,48 +1223,53 @@ static int reg_copy_regd(const struct ieee80211_regdomain **dst_regd,
         return 0;
 }
 
-/* Return value which can be used by ignore_request() to indicate
- * it has been determined we should intersect two regulatory domains */
+/*
+ * Return value which can be used by ignore_request() to indicate
+ * it has been determined we should intersect two regulatory domains
+ */
 #define REG_INTERSECT   1
 
 /* This has the logic which determines when a new request
  * should be ignored. */
-static int ignore_request(struct wiphy *wiphy, enum reg_set_by set_by,
-                          const char *alpha2)
+static int ignore_request(struct wiphy *wiphy,
+                          struct regulatory_request *pending_request)
 {
+        struct wiphy *last_wiphy = NULL;
+
+        assert_cfg80211_lock();
+
         /* All initial requests are respected */
         if (!last_request)
                 return 0;
 
-        switch (set_by) {
+        switch (pending_request->initiator) {
         case REGDOM_SET_BY_INIT:
                 return -EINVAL;
         case REGDOM_SET_BY_CORE:
-                /*
-                 * Always respect new wireless core hints, should only happen
-                 * when updating the world regulatory domain at init.
-                 */
-                return 0;
+                return -EINVAL;
         case REGDOM_SET_BY_COUNTRY_IE:
-                if (unlikely(!is_an_alpha2(alpha2)))
+
+                last_wiphy = wiphy_idx_to_wiphy(last_request->wiphy_idx);
+
+                if (unlikely(!is_an_alpha2(pending_request->alpha2)))
                         return -EINVAL;
                 if (last_request->initiator == REGDOM_SET_BY_COUNTRY_IE) {
-                        if (last_request->wiphy != wiphy) {
+                        if (last_wiphy != wiphy) {
                                 /*
                                  * Two cards with two APs claiming different
                                  * different Country IE alpha2s. We could
                                  * intersect them, but that seems unlikely
                                  * to be correct. Reject second one for now.
                                  */
-                                if (!alpha2_equal(alpha2,
-                                                  cfg80211_regdomain->alpha2))
+                                if (regdom_changes(pending_request->alpha2))
                                         return -EOPNOTSUPP;
                                 return -EALREADY;
                         }
-                        /* Two consecutive Country IE hints on the same wiphy.
-                         * This should be picked up early by the driver/stack */
-                        if (WARN_ON(!alpha2_equal(cfg80211_regdomain->alpha2,
-                                  alpha2)))
+                        /*
+                         * Two consecutive Country IE hints on the same wiphy.
+                         * This should be picked up early by the driver/stack
+                         */
+                        if (WARN_ON(regdom_changes(pending_request->alpha2)))
                                 return 0;
                         return -EALREADY;
                 }
@@ -1083,31 +1278,44 @@ static int ignore_request(struct wiphy *wiphy, enum reg_set_by set_by,
                 if (last_request->initiator == REGDOM_SET_BY_CORE) {
                         if (is_old_static_regdom(cfg80211_regdomain))
                                 return 0;
-                        if (!alpha2_equal(cfg80211_regdomain->alpha2, alpha2))
+                        if (regdom_changes(pending_request->alpha2))
                                 return 0;
                         return -EALREADY;
                 }
+
+                /*
+                 * This would happen if you unplug and plug your card
+                 * back in or if you add a new device for which the previously
+                 * loaded card also agrees on the regulatory domain.
+                 */
+                if (last_request->initiator == REGDOM_SET_BY_DRIVER &&
+                    !regdom_changes(pending_request->alpha2))
+                        return -EALREADY;
+
                 return REG_INTERSECT;
         case REGDOM_SET_BY_USER:
                 if (last_request->initiator == REGDOM_SET_BY_COUNTRY_IE)
                         return REG_INTERSECT;
-                /* If the user knows better the user should set the regdom
-                 * to their country before the IE is picked up */
+                /*
+                 * If the user knows better the user should set the regdom
+                 * to their country before the IE is picked up
+                 */
                 if (last_request->initiator == REGDOM_SET_BY_USER &&
                           last_request->intersect)
                         return -EOPNOTSUPP;
-                /* Process user requests only after previous user/driver/core
-                 * requests have been processed */
+                /*
+                 * Process user requests only after previous user/driver/core
+                 * requests have been processed
+                 */
                 if (last_request->initiator == REGDOM_SET_BY_CORE ||
                     last_request->initiator == REGDOM_SET_BY_DRIVER ||
                     last_request->initiator == REGDOM_SET_BY_USER) {
-                        if (!alpha2_equal(last_request->alpha2,
-                            cfg80211_regdomain->alpha2))
+                        if (regdom_changes(last_request->alpha2))
                                 return -EAGAIN;
                 }
 
                 if (!is_old_static_regdom(cfg80211_regdomain) &&
-                    alpha2_equal(cfg80211_regdomain->alpha2, alpha2))
+                    !regdom_changes(pending_request->alpha2))
                         return -EALREADY;
 
                 return 0;
@@ -1116,55 +1324,66 @@ static int ignore_request(struct wiphy *wiphy, enum reg_set_by set_by,
         return -EINVAL;
 }
 
-/* Caller must hold &cfg80211_drv_mutex */
-int __regulatory_hint(struct wiphy *wiphy, enum reg_set_by set_by,
-                        const char *alpha2,
-                        u32 country_ie_checksum,
-                        enum environment_cap env)
+/**
+ * __regulatory_hint - hint to the wireless core a regulatory domain
+ * @wiphy: if the hint comes from country information from an AP, this
+ *      is required to be set to the wiphy that received the information
+ * @pending_request: the regulatory request currently being processed
+ *
+ * The Wireless subsystem can use this function to hint to the wireless core
+ * what it believes should be the current regulatory domain.
+ *
+ * Returns zero if all went fine, %-EALREADY if a regulatory domain had
+ * already been set or other standard error codes.
+ *
+ * Caller must hold &cfg80211_mutex
+ */
+static int __regulatory_hint(struct wiphy *wiphy,
+                             struct regulatory_request *pending_request)
 {
-        struct regulatory_request *request;
         bool intersect = false;
         int r = 0;
 
-        r = ignore_request(wiphy, set_by, alpha2);
+        assert_cfg80211_lock();
+
+        r = ignore_request(wiphy, pending_request);
 
         if (r == REG_INTERSECT) {
-                if (set_by == REGDOM_SET_BY_DRIVER) {
+                if (pending_request->initiator == REGDOM_SET_BY_DRIVER) {
                         r = reg_copy_regd(&wiphy->regd, cfg80211_regdomain);
-                        if (r)
+                        if (r) {
+                                kfree(pending_request);
                                 return r;
+                        }
                 }
                 intersect = true;
         } else if (r) {
-                /* If the regulatory domain being requested by the
+                /*
+                 * If the regulatory domain being requested by the
                  * driver has already been set just copy it to the
-                 * wiphy */
-                if (r == -EALREADY && set_by == REGDOM_SET_BY_DRIVER) {
+                 * wiphy
+                 */
+                if (r == -EALREADY &&
+                    pending_request->initiator == REGDOM_SET_BY_DRIVER) {
                         r = reg_copy_regd(&wiphy->regd, cfg80211_regdomain);
-                        if (r)
+                        if (r) {
+                                kfree(pending_request);
                                 return r;
+                        }
                         r = -EALREADY;
                         goto new_request;
                 }
+                kfree(pending_request);
                 return r;
         }
 
 new_request:
-        request = kzalloc(sizeof(struct regulatory_request),
-                          GFP_KERNEL);
-        if (!request)
-                return -ENOMEM;
+        kfree(last_request);
 
-        request->alpha2[0] = alpha2[0];
-        request->alpha2[1] = alpha2[1];
-        request->initiator = set_by;
-        request->wiphy = wiphy;
-        request->intersect = intersect;
-        request->country_ie_checksum = country_ie_checksum;
-        request->country_ie_env = env;
+        last_request = pending_request;
+        last_request->intersect = intersect;
 
-        kfree(last_request);
-        last_request = request;
+        pending_request = NULL;
 
         /* When r == REG_INTERSECT we do need to call CRDA */
         if (r < 0)
@@ -1180,34 +1399,194 @@ new_request:
          *
          * to intersect with the static rd
          */
-        return call_crda(alpha2);
+        return call_crda(last_request->alpha2);
 }
 
-void regulatory_hint(struct wiphy *wiphy, const char *alpha2)
+/* This currently only processes user and driver regulatory hints */
+static void reg_process_hint(struct regulatory_request *reg_request)
 {
-        int r;
-        BUG_ON(!alpha2);
+        int r = 0;
+        struct wiphy *wiphy = NULL;
+
+        BUG_ON(!reg_request->alpha2);
+
+        mutex_lock(&cfg80211_mutex);
+
+        if (wiphy_idx_valid(reg_request->wiphy_idx))
+                wiphy = wiphy_idx_to_wiphy(reg_request->wiphy_idx);
+
+        if (reg_request->initiator == REGDOM_SET_BY_DRIVER &&
+            !wiphy) {
+                kfree(reg_request);
+                goto out;
+        }
 
-        mutex_lock(&cfg80211_drv_mutex);
-        r = __regulatory_hint(wiphy, REGDOM_SET_BY_DRIVER,
-                alpha2, 0, ENVIRON_ANY);
+        r = __regulatory_hint(wiphy, reg_request);
         /* This is required so that the orig_* parameters are saved */
-        if (r == -EALREADY && wiphy->strict_regulatory)
-                wiphy_update_regulatory(wiphy, REGDOM_SET_BY_DRIVER);
-        mutex_unlock(&cfg80211_drv_mutex);
+        if (r == -EALREADY && wiphy && wiphy->strict_regulatory)
+                wiphy_update_regulatory(wiphy, reg_request->initiator);
+out:
+        mutex_unlock(&cfg80211_mutex);
+}
+
+/* Processes regulatory hints, this is all the REGDOM_SET_BY_* */
+static void reg_process_pending_hints(void)
+        {
+        struct regulatory_request *reg_request;
+
+        spin_lock(&reg_requests_lock);
+        while (!list_empty(&reg_requests_list)) {
+                reg_request = list_first_entry(&reg_requests_list,
+                                               struct regulatory_request,
+                                               list);
+                list_del_init(&reg_request->list);
+
+                spin_unlock(&reg_requests_lock);
+                reg_process_hint(reg_request);
+                spin_lock(&reg_requests_lock);
+        }
+        spin_unlock(&reg_requests_lock);
+}
+
+/* Processes beacon hints -- this has nothing to do with country IEs */
+static void reg_process_pending_beacon_hints(void)
+{
+        struct cfg80211_registered_device *drv;
+        struct reg_beacon *pending_beacon, *tmp;
+
+        mutex_lock(&cfg80211_mutex);
+
+        /* This goes through the _pending_ beacon list */
+        spin_lock_bh(&reg_pending_beacons_lock);
+
+        if (list_empty(&reg_pending_beacons)) {
+                spin_unlock_bh(&reg_pending_beacons_lock);
+                goto out;
+        }
+
+        list_for_each_entry_safe(pending_beacon, tmp,
+                                 &reg_pending_beacons, list) {
+
+                list_del_init(&pending_beacon->list);
+
+                /* Applies the beacon hint to current wiphys */
+                list_for_each_entry(drv, &cfg80211_drv_list, list)
+                        wiphy_update_new_beacon(&drv->wiphy, pending_beacon);
+
+                /* Remembers the beacon hint for new wiphys or reg changes */
+                list_add_tail(&pending_beacon->list, &reg_beacon_list);
+        }
+
+        spin_unlock_bh(&reg_pending_beacons_lock);
+out:
+        mutex_unlock(&cfg80211_mutex);
+}
+
+static void reg_todo(struct work_struct *work)
+{
+        reg_process_pending_hints();
+        reg_process_pending_beacon_hints();
+}
+
+static DECLARE_WORK(reg_work, reg_todo);
+
+static void queue_regulatory_request(struct regulatory_request *request)
+{
+        spin_lock(&reg_requests_lock);
+        list_add_tail(&request->list, &reg_requests_list);
+        spin_unlock(&reg_requests_lock);
+
+        schedule_work(&reg_work);
+}
+
+/* Core regulatory hint -- happens once during cfg80211_init() */
+static int regulatory_hint_core(const char *alpha2)
+{
+        struct regulatory_request *request;
+
+        BUG_ON(last_request);
+
+        request = kzalloc(sizeof(struct regulatory_request),
+                          GFP_KERNEL);
+        if (!request)
+                return -ENOMEM;
+
+        request->alpha2[0] = alpha2[0];
+        request->alpha2[1] = alpha2[1];
+        request->initiator = REGDOM_SET_BY_CORE;
+
+        queue_regulatory_request(request);
+
+        return 0;
+}
+
+/* User hints */
+int regulatory_hint_user(const char *alpha2)
+{
+        struct regulatory_request *request;
+
+        BUG_ON(!alpha2);
+
+        request = kzalloc(sizeof(struct regulatory_request), GFP_KERNEL);
+        if (!request)
+                return -ENOMEM;
+
+        request->wiphy_idx = WIPHY_IDX_STALE;
+        request->alpha2[0] = alpha2[0];
+        request->alpha2[1] = alpha2[1];
+        request->initiator = REGDOM_SET_BY_USER,
+
+        queue_regulatory_request(request);
+
+        return 0;
+}
+
+/* Driver hints */
+int regulatory_hint(struct wiphy *wiphy, const char *alpha2)
+{
+        struct regulatory_request *request;
+
+        BUG_ON(!alpha2);
+        BUG_ON(!wiphy);
+
+        request = kzalloc(sizeof(struct regulatory_request), GFP_KERNEL);
+        if (!request)
+                return -ENOMEM;
+
+        request->wiphy_idx = get_wiphy_idx(wiphy);
+
+        /* Must have registered wiphy first */
+        BUG_ON(!wiphy_idx_valid(request->wiphy_idx));
+
+        request->alpha2[0] = alpha2[0];
+        request->alpha2[1] = alpha2[1];
+        request->initiator = REGDOM_SET_BY_DRIVER;
+
+        queue_regulatory_request(request);
+
+        return 0;
 }
 EXPORT_SYMBOL(regulatory_hint);
 
 static bool reg_same_country_ie_hint(struct wiphy *wiphy,
                         u32 country_ie_checksum)
 {
-        if (!last_request->wiphy)
+        struct wiphy *request_wiphy;
+
+        assert_cfg80211_lock();
+
+        request_wiphy = wiphy_idx_to_wiphy(last_request->wiphy_idx);
+
+        if (!request_wiphy)
                 return false;
-        if (likely(last_request->wiphy != wiphy))
+
+        if (likely(request_wiphy != wiphy))
                 return !country_ie_integrity_changes(country_ie_checksum);
-        /* We should not have let these through at this point, they
+        /*
+         * We should not have let these through at this point, they
          * should have been picked up earlier by the first alpha2 check
-         * on the device */
+         * on the device
+         */
         if (WARN_ON(!country_ie_integrity_changes(country_ie_checksum)))
                 return true;
         return false;
@@ -1221,11 +1600,14 @@ void regulatory_hint_11d(struct wiphy *wiphy,
         char alpha2[2];
         u32 checksum = 0;
         enum environment_cap env = ENVIRON_ANY;
+        struct regulatory_request *request;
 
-        if (!last_request)
-                return;
+        mutex_lock(&cfg80211_mutex);
 
-        mutex_lock(&cfg80211_drv_mutex);
+        if (unlikely(!last_request)) {
+                mutex_unlock(&cfg80211_mutex);
+                return;
+        }
 
         /* IE len must be evenly divisible by 2 */
         if (country_ie_len & 0x01)
@@ -1234,9 +1616,11 @@ void regulatory_hint_11d(struct wiphy *wiphy,
         if (country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
                 goto out;
 
-        /* Pending country IE processing, this can happen after we
+        /*
+         * Pending country IE processing, this can happen after we
          * call CRDA and wait for a response if a beacon was received before
-         * we were able to process the last regulatory_hint_11d() call */
+         * we were able to process the last regulatory_hint_11d() call
+         */
         if (country_ie_regdomain)
                 goto out;
 
@@ -1248,33 +1632,44 @@ void regulatory_hint_11d(struct wiphy *wiphy,
         else if (country_ie[2] == 'O')
                 env = ENVIRON_OUTDOOR;
 
-        /* We will run this for *every* beacon processed for the BSSID, so
+        /*
+         * We will run this for *every* beacon processed for the BSSID, so
          * we optimize an early check to exit out early if we don't have to
-         * do anything */
-        if (likely(last_request->wiphy)) {
+         * do anything
+         */
+        if (likely(wiphy_idx_valid(last_request->wiphy_idx))) {
                 struct cfg80211_registered_device *drv_last_ie;
 
-                drv_last_ie = wiphy_to_dev(last_request->wiphy);
+                drv_last_ie =
+                        cfg80211_drv_by_wiphy_idx(last_request->wiphy_idx);
 
-                /* Lets keep this simple -- we trust the first AP
-                 * after we intersect with CRDA */
-                if (likely(last_request->wiphy == wiphy)) {
-                        /* Ignore IEs coming in on this wiphy with
-                         * the same alpha2 and environment cap */
+                /*
+                 * Lets keep this simple -- we trust the first AP
+                 * after we intersect with CRDA
+                 */
+                if (likely(&drv_last_ie->wiphy == wiphy)) {
+                        /*
+                         * Ignore IEs coming in on this wiphy with
+                         * the same alpha2 and environment cap
+                         */
                         if (likely(alpha2_equal(drv_last_ie->country_ie_alpha2,
                                   alpha2) &&
                                   env == drv_last_ie->env)) {
                                 goto out;
                         }
-                        /* the wiphy moved on to another BSSID or the AP
+                        /*
+                         * the wiphy moved on to another BSSID or the AP
                          * was reconfigured. XXX: We need to deal with the
                          * case where the user suspends and goes to goes
                          * to another country, and then gets IEs from an
-                         * AP with different settings */
+                         * AP with different settings
+                         */
                         goto out;
                 } else {
-                        /* Ignore IEs coming in on two separate wiphys with
-                         * the same alpha2 and environment cap */
+                        /*
+                         * Ignore IEs coming in on two separate wiphys with
+                         * the same alpha2 and environment cap
+                         */
                         if (likely(alpha2_equal(drv_last_ie->country_ie_alpha2,
                                   alpha2) &&
                                   env == drv_last_ie->env)) {
@@ -1289,28 +1684,97 @@ void regulatory_hint_11d(struct wiphy *wiphy,
         if (!rd)
                 goto out;
 
-        /* This will not happen right now but we leave it here for the
+        /*
+         * This will not happen right now but we leave it here for the
          * the future when we want to add suspend/resume support and having
          * the user move to another country after doing so, or having the user
-         * move to another AP. Right now we just trust the first AP. This is why
-         * this is marked as likley(). If we hit this before we add this support
-         * we want to be informed of it as it would indicate a mistake in the
-         * current design  */
-        if (likely(WARN_ON(reg_same_country_ie_hint(wiphy, checksum))))
-                goto out;
+         * move to another AP. Right now we just trust the first AP.
+         *
+         * If we hit this before we add this support we want to be informed of
+         * it as it would indicate a mistake in the current design
+         */
+        if (WARN_ON(reg_same_country_ie_hint(wiphy, checksum)))
+                goto free_rd_out;
+
+        request = kzalloc(sizeof(struct regulatory_request), GFP_KERNEL);
+        if (!request)
+                goto free_rd_out;
 
-        /* We keep this around for when CRDA comes back with a response so
-         * we can intersect with that */
+        /*
+         * We keep this around for when CRDA comes back with a response so
+         * we can intersect with that
+         */
         country_ie_regdomain = rd;
 
-        __regulatory_hint(wiphy, REGDOM_SET_BY_COUNTRY_IE,
-                country_ie_regdomain->alpha2, checksum, env);
+        request->wiphy_idx = get_wiphy_idx(wiphy);
+        request->alpha2[0] = rd->alpha2[0];
+        request->alpha2[1] = rd->alpha2[1];
+        request->initiator = REGDOM_SET_BY_COUNTRY_IE;
+        request->country_ie_checksum = checksum;
+        request->country_ie_env = env;
+
+        mutex_unlock(&cfg80211_mutex);
+
+        queue_regulatory_request(request);
 
+        return;
+
+free_rd_out:
+        kfree(rd);
 out:
-        mutex_unlock(&cfg80211_drv_mutex);
+        mutex_unlock(&cfg80211_mutex);
 }
 EXPORT_SYMBOL(regulatory_hint_11d);
 
+static bool freq_is_chan_12_13_14(u16 freq)
+{
+        if (freq == ieee80211_channel_to_frequency(12) ||
+            freq == ieee80211_channel_to_frequency(13) ||
+            freq == ieee80211_channel_to_frequency(14))
+                return true;
+        return false;
+}
+
+int regulatory_hint_found_beacon(struct wiphy *wiphy,
+                                 struct ieee80211_channel *beacon_chan,
+                                 gfp_t gfp)
+{
+        struct reg_beacon *reg_beacon;
+
+        if (likely((beacon_chan->beacon_found ||
+            (beacon_chan->flags & IEEE80211_CHAN_RADAR) ||
+            (beacon_chan->band == IEEE80211_BAND_2GHZ &&
+             !freq_is_chan_12_13_14(beacon_chan->center_freq)))))
+                return 0;
+
+        reg_beacon = kzalloc(sizeof(struct reg_beacon), gfp);
+        if (!reg_beacon)
+                return -ENOMEM;
+
+#ifdef CONFIG_CFG80211_REG_DEBUG
+        printk(KERN_DEBUG "cfg80211: Found new beacon on "
+                "frequency: %d MHz (Ch %d) on %s\n",
+                beacon_chan->center_freq,
+                ieee80211_frequency_to_channel(beacon_chan->center_freq),
+                wiphy_name(wiphy));
+#endif
+        memcpy(&reg_beacon->chan, beacon_chan,
+                sizeof(struct ieee80211_channel));
+
+
+        /*
+         * Since we can be called from BH or and non-BH context
+         * we must use spin_lock_bh()
+         */
+        spin_lock_bh(&reg_pending_beacons_lock);
+        list_add_tail(&reg_beacon->list, &reg_pending_beacons);
+        spin_unlock_bh(&reg_pending_beacons_lock);
+
+        schedule_work(&reg_work);
+
+        return 0;
+}
+
 static void print_rd_rules(const struct ieee80211_regdomain *rd)
 {
         unsigned int i;
@@ -1326,8 +1790,10 @@ static void print_rd_rules(const struct ieee80211_regdomain *rd)
                 freq_range = &reg_rule->freq_range;
                 power_rule = &reg_rule->power_rule;
 
-                /* There may not be documentation for max antenna gain
-                 * in certain regions */
+                /*
+                 * There may not be documentation for max antenna gain
+                 * in certain regions
+                 */
                 if (power_rule->max_antenna_gain)
                         printk(KERN_INFO "\t(%d KHz - %d KHz @ %d KHz), "
                                 "(%d mBi, %d mBm)\n",
@@ -1350,13 +1816,12 @@ static void print_regdomain(const struct ieee80211_regdomain *rd)
 {
 
         if (is_intersected_alpha2(rd->alpha2)) {
-                struct wiphy *wiphy = NULL;
-                struct cfg80211_registered_device *drv;
 
                 if (last_request->initiator == REGDOM_SET_BY_COUNTRY_IE) {
-                        if (last_request->wiphy) {
-                                wiphy = last_request->wiphy;
-                                drv = wiphy_to_dev(wiphy);
+                        struct cfg80211_registered_device *drv;
+                        drv = cfg80211_drv_by_wiphy_idx(
+                                last_request->wiphy_idx);
+                        if (drv) {
                                 printk(KERN_INFO "cfg80211: Current regulatory "
                                         "domain updated by AP to: %c%c\n",
                                         drv->country_ie_alpha2[0],
@@ -1422,7 +1887,7 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
 {
         const struct ieee80211_regdomain *intersected_rd = NULL;
         struct cfg80211_registered_device *drv = NULL;
-        struct wiphy *wiphy = NULL;
+        struct wiphy *request_wiphy;
         /* Some basic sanity checks first */
 
         if (is_world_regdom(rd->alpha2)) {
@@ -1439,23 +1904,27 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
         if (!last_request)
                 return -EINVAL;
 
-        /* Lets only bother proceeding on the same alpha2 if the current
+        /*
+         * Lets only bother proceeding on the same alpha2 if the current
          * rd is non static (it means CRDA was present and was used last)
-         * and the pending request came in from a country IE */
+         * and the pending request came in from a country IE
+         */
         if (last_request->initiator != REGDOM_SET_BY_COUNTRY_IE) {
-                /* If someone else asked us to change the rd lets only bother
-                 * checking if the alpha2 changes if CRDA was already called */
+                /*
+                 * If someone else asked us to change the rd lets only bother
+                 * checking if the alpha2 changes if CRDA was already called
+                 */
                 if (!is_old_static_regdom(cfg80211_regdomain) &&
-                    !regdom_changed(rd->alpha2))
+                    !regdom_changes(rd->alpha2))
                         return -EINVAL;
         }
 
-        wiphy = last_request->wiphy;
-
-        /* Now lets set the regulatory domain, update all driver channels
+        /*
+         * Now lets set the regulatory domain, update all driver channels
          * and finally inform them of what we have done, in case they want
          * to review or adjust their own settings based on their own
-         * internal EEPROM data */
+         * internal EEPROM data
+         */
 
         if (WARN_ON(!reg_is_valid_request(rd->alpha2)))
                 return -EINVAL;
@@ -1467,6 +1936,8 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
                 return -EINVAL;
         }
 
+        request_wiphy = wiphy_idx_to_wiphy(last_request->wiphy_idx);
+
         if (!last_request->intersect) {
                 int r;
 
@@ -1476,12 +1947,14 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
                         return 0;
                 }
 
-                /* For a driver hint, lets copy the regulatory domain the
-                 * driver wanted to the wiphy to deal with conflicts */
+                /*
+                 * For a driver hint, lets copy the regulatory domain the
+                 * driver wanted to the wiphy to deal with conflicts
+                 */
 
-                BUG_ON(last_request->wiphy->regd);
+                BUG_ON(request_wiphy->regd);
 
-                r = reg_copy_regd(&last_request->wiphy->regd, rd);
+                r = reg_copy_regd(&request_wiphy->regd, rd);
                 if (r)
                         return r;
 
@@ -1498,11 +1971,13 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
                 if (!intersected_rd)
                         return -EINVAL;
 
-                /* We can trash what CRDA provided now.
+                /*
+                 * We can trash what CRDA provided now.
                  * However if a driver requested this specific regulatory
-                 * domain we keep it for its private use */
+                 * domain we keep it for its private use
+                 */
                 if (last_request->initiator == REGDOM_SET_BY_DRIVER)
-                        last_request->wiphy->regd = rd;
+                        request_wiphy->regd = rd;
                 else
                         kfree(rd);
 
@@ -1522,8 +1997,10 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
         BUG_ON(!country_ie_regdomain);
 
         if (rd != country_ie_regdomain) {
-                /* Intersect what CRDA returned and our what we
-                 * had built from the Country IE received */
+                /*
+                 * Intersect what CRDA returned and our what we
+                 * had built from the Country IE received
+                 */
 
                 intersected_rd = regdom_intersect(rd, country_ie_regdomain);
 
@@ -1533,16 +2010,18 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
                 kfree(country_ie_regdomain);
                 country_ie_regdomain = NULL;
         } else {
-                /* This would happen when CRDA was not present and
+                /*
+                 * This would happen when CRDA was not present and
                  * OLD_REGULATORY was enabled. We intersect our Country
-                 * IE rd and what was set on cfg80211 originally */
+                 * IE rd and what was set on cfg80211 originally
+                 */
                 intersected_rd = regdom_intersect(rd, cfg80211_regdomain);
         }
 
         if (!intersected_rd)
                 return -EINVAL;
 
-        drv = wiphy_to_dev(wiphy);
+        drv = wiphy_to_dev(request_wiphy);
 
         drv->country_ie_alpha2[0] = rd->alpha2[0];
         drv->country_ie_alpha2[1] = rd->alpha2[1];
@@ -1560,13 +2039,17 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
 }
 
 
-/* Use this call to set the current regulatory domain. Conflicts with
+/*
+ * Use this call to set the current regulatory domain. Conflicts with
  * multiple drivers can be ironed out later. Caller must've already
- * kmalloc'd the rd structure. Caller must hold cfg80211_drv_mutex */
+ * kmalloc'd the rd structure. Caller must hold cfg80211_mutex
+ */
 int set_regdom(const struct ieee80211_regdomain *rd)
 {
         int r;
 
+        assert_cfg80211_lock();
+
         /* Note that this doesn't update the wiphys, this is done below */
         r = __set_regdom(rd);
         if (r) {
@@ -1586,54 +2069,82 @@ int set_regdom(const struct ieee80211_regdomain *rd)
         return r;
 }
 
-/* Caller must hold cfg80211_drv_mutex */
+/* Caller must hold cfg80211_mutex */
 void reg_device_remove(struct wiphy *wiphy)
 {
+        struct wiphy *request_wiphy;
+
+        assert_cfg80211_lock();
+
+        request_wiphy = wiphy_idx_to_wiphy(last_request->wiphy_idx);
+
         kfree(wiphy->regd);
-        if (!last_request || !last_request->wiphy)
+        if (!last_request || !request_wiphy)
                 return;
-        if (last_request->wiphy != wiphy)
+        if (request_wiphy != wiphy)
                 return;
-        last_request->wiphy = NULL;
+        last_request->wiphy_idx = WIPHY_IDX_STALE;
         last_request->country_ie_env = ENVIRON_ANY;
 }
 
 int regulatory_init(void)
 {
-        int err;
+        int err = 0;
 
         reg_pdev = platform_device_register_simple("regulatory", 0, NULL, 0);
         if (IS_ERR(reg_pdev))
                 return PTR_ERR(reg_pdev);
 
+        spin_lock_init(&reg_requests_lock);
+        spin_lock_init(&reg_pending_beacons_lock);
+
 #ifdef CONFIG_WIRELESS_OLD_REGULATORY
         cfg80211_regdomain = static_regdom(ieee80211_regdom);
 
         printk(KERN_INFO "cfg80211: Using static regulatory domain info\n");
         print_regdomain_info(cfg80211_regdomain);
-        /* The old code still requests for a new regdomain and if
+        /*
+         * The old code still requests for a new regdomain and if
          * you have CRDA you get it updated, otherwise you get
          * stuck with the static values. We ignore "EU" code as
-         * that is not a valid ISO / IEC 3166 alpha2 */
+         * that is not a valid ISO / IEC 3166 alpha2
+         */
         if (ieee80211_regdom[0] != 'E' || ieee80211_regdom[1] != 'U')
-                err = __regulatory_hint(NULL, REGDOM_SET_BY_CORE,
-                                        ieee80211_regdom, 0, ENVIRON_ANY);
+                err = regulatory_hint_core(ieee80211_regdom);
 #else
         cfg80211_regdomain = cfg80211_world_regdom;
 
-        err = __regulatory_hint(NULL, REGDOM_SET_BY_CORE, "00", 0, ENVIRON_ANY);
-        if (err)
-                printk(KERN_ERR "cfg80211: calling CRDA failed - "
-                       "unable to update world regulatory domain, "
-                       "using static definition\n");
+        err = regulatory_hint_core("00");
 #endif
+        if (err) {
+                if (err == -ENOMEM)
+                        return err;
+                /*
+                 * N.B. kobject_uevent_env() can fail mainly for when we're out
+                 * memory which is handled and propagated appropriately above
+                 * but it can also fail during a netlink_broadcast() or during
+                 * early boot for call_usermodehelper(). For now treat these
+                 * errors as non-fatal.
+                 */
+                printk(KERN_ERR "cfg80211: kobject_uevent_env() was unable "
+                        "to call CRDA during init");
+#ifdef CONFIG_CFG80211_REG_DEBUG
+                /* We want to find out exactly why when debugging */
+                WARN_ON(err);
+#endif
+        }
 
         return 0;
 }
 
 void regulatory_exit(void)
 {
-        mutex_lock(&cfg80211_drv_mutex);
+        struct regulatory_request *reg_request, *tmp;
+        struct reg_beacon *reg_beacon, *btmp;
+
+        cancel_work_sync(&reg_work);
+
+        mutex_lock(&cfg80211_mutex);
 
         reset_regdomains();
 
@@ -1644,5 +2155,33 @@ void regulatory_exit(void)
 
         platform_device_unregister(reg_pdev);
 
-        mutex_unlock(&cfg80211_drv_mutex);
+        spin_lock_bh(&reg_pending_beacons_lock);
+        if (!list_empty(&reg_pending_beacons)) {
+                list_for_each_entry_safe(reg_beacon, btmp,
+                                         &reg_pending_beacons, list) {
+                        list_del(&reg_beacon->list);
+                        kfree(reg_beacon);
+                }
+        }
+        spin_unlock_bh(&reg_pending_beacons_lock);
+
+        if (!list_empty(&reg_beacon_list)) {
+                list_for_each_entry_safe(reg_beacon, btmp,
+                                         &reg_beacon_list, list) {
+                        list_del(&reg_beacon->list);
+                        kfree(reg_beacon);
+                }
+        }
+
+        spin_lock(&reg_requests_lock);
+        if (!list_empty(&reg_requests_list)) {
+                list_for_each_entry_safe(reg_request, tmp,
+                                         &reg_requests_list, list) {
+                        list_del(&reg_request->list);
+                        kfree(reg_request);
+                }
+        }
+        spin_unlock(&reg_requests_lock);
+
+        mutex_unlock(&cfg80211_mutex);
 }
diff --git a/net/wireless/reg.h b/net/wireless/reg.h
index fe8c83f34fb7..e37829a49dc4 100644
--- a/net/wireless/reg.h
+++ b/net/wireless/reg.h
@@ -6,6 +6,8 @@ extern const struct ieee80211_regdomain *cfg80211_regdomain;
 bool is_world_regdom(const char *alpha2);
 bool reg_is_valid_request(const char *alpha2);
 
+int regulatory_hint_user(const char *alpha2);
+
 void reg_device_remove(struct wiphy *wiphy);
 
 int regulatory_init(void);
@@ -14,26 +16,24 @@ void regulatory_exit(void);
 int set_regdom(const struct ieee80211_regdomain *rd);
 
 /**
- * __regulatory_hint - hint to the wireless core a regulatory domain
- * @wiphy: if the hint comes from country information from an AP, this
- *      is required to be set to the wiphy that received the information
- * @alpha2: the ISO/IEC 3166 alpha2 being claimed the regulatory domain
- *      should be in.
- * @country_ie_checksum: checksum of processed country IE, set this to 0
- *      if the hint did not come from a country IE
- * @country_ie_env: the environment the IE told us we are in, %ENVIRON_*
- *
- * The Wireless subsystem can use this function to hint to the wireless core
- * what it believes should be the current regulatory domain by giving it an
- * ISO/IEC 3166 alpha2 country code it knows its regulatory domain should be
- * in.
+ * regulatory_hint_found_beacon - hints a beacon was found on a channel
+ * @wiphy: the wireless device where the beacon was found on
+ * @beacon_chan: the channel on which the beacon was found on
+ * @gfp: context flags
  *
- * Returns zero if all went fine, %-EALREADY if a regulatory domain had
- * already been set or other standard error codes.
+ * This informs the wireless core that a beacon from an AP was found on
+ * the channel provided. This allows the wireless core to make educated
+ * guesses on regulatory to help with world roaming. This is only used for
+ * world roaming -- when we do not know our current location. This is
+ * only useful on channels 12, 13 and 14 on the 2 GHz band as channels
+ * 1-11 are already enabled by the world regulatory domain; and on
+ * non-radar 5 GHz channels.
  *
+ * Drivers do not need to call this, cfg80211 will do it for after a scan
+ * on a newly found BSS.
  */
-extern int __regulatory_hint(struct wiphy *wiphy, enum reg_set_by set_by,
-                             const char *alpha2, u32 country_ie_checksum,
-                             enum environment_cap country_ie_env);
+int regulatory_hint_found_beacon(struct wiphy *wiphy,
+                                        struct ieee80211_channel *beacon_chan,
+                                        gfp_t gfp);
 
 #endif  /* __NET_WIRELESS_REG_H */
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index b1893c863b97..280dbcd02c15 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -62,6 +62,18 @@ static void bss_release(struct kref *ref)
 }
 
 /* must hold dev->bss_lock! */
+void cfg80211_bss_age(struct cfg80211_registered_device *dev,
+                      unsigned long age_secs)
+{
+        struct cfg80211_internal_bss *bss;
+        unsigned long age_jiffies = msecs_to_jiffies(age_secs * MSEC_PER_SEC);
+
+        list_for_each_entry(bss, &dev->bss_list, list) {
+                bss->ts -= age_jiffies;
+        }
+}
+
+/* must hold dev->bss_lock! */
 void cfg80211_bss_expire(struct cfg80211_registered_device *dev)
 {
         struct cfg80211_internal_bss *bss, *tmp;
@@ -358,7 +370,6 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
                 found->pub.beacon_interval = res->pub.beacon_interval;
                 found->pub.tsf = res->pub.tsf;
                 found->pub.signal = res->pub.signal;
-                found->pub.signal_type = res->pub.signal_type;
                 found->pub.capability = res->pub.capability;
                 found->ts = res->ts;
                 kref_put(&res->ref, bss_release);
@@ -380,8 +391,7 @@ struct cfg80211_bss *
 cfg80211_inform_bss_frame(struct wiphy *wiphy,
                           struct ieee80211_channel *channel,
                           struct ieee80211_mgmt *mgmt, size_t len,
-                          s32 signal, enum cfg80211_signal_type sigtype,
-                          gfp_t gfp)
+                          s32 signal, gfp_t gfp)
 {
         struct cfg80211_internal_bss *res;
         size_t ielen = len - offsetof(struct ieee80211_mgmt,
@@ -389,7 +399,7 @@ cfg80211_inform_bss_frame(struct wiphy *wiphy,
         bool overwrite;
         size_t privsz = wiphy->bss_priv_size;
 
-        if (WARN_ON(sigtype == NL80211_BSS_SIGNAL_UNSPEC &&
+        if (WARN_ON(wiphy->signal_type == NL80211_BSS_SIGNAL_UNSPEC &&
                     (signal < 0 || signal > 100)))
                 return NULL;
 
@@ -403,7 +413,6 @@ cfg80211_inform_bss_frame(struct wiphy *wiphy,
 
         memcpy(res->pub.bssid, mgmt->bssid, ETH_ALEN);
         res->pub.channel = channel;
-        res->pub.signal_type = sigtype;
         res->pub.signal = signal;
         res->pub.tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
         res->pub.beacon_interval = le16_to_cpu(mgmt->u.probe_resp.beacon_int);
@@ -421,6 +430,9 @@ cfg80211_inform_bss_frame(struct wiphy *wiphy,
         if (!res)
                 return NULL;
 
+        if (res->pub.capability & WLAN_CAPABILITY_ESS)
+                regulatory_hint_found_beacon(wiphy, channel, gfp);
+
         /* cfg80211_bss_update gives us a referenced result */
         return &res->pub;
 }
@@ -584,16 +596,25 @@ static void ieee80211_scan_add_ies(struct iw_request_info *info,
         }
 }
 
+static inline unsigned int elapsed_jiffies_msecs(unsigned long start)
+{
+        unsigned long end = jiffies;
+
+        if (end >= start)
+                return jiffies_to_msecs(end - start);
+
+        return jiffies_to_msecs(end + (MAX_JIFFY_OFFSET - start) + 1);
+}
 
 static char *
-ieee80211_bss(struct iw_request_info *info,
-                      struct cfg80211_internal_bss *bss,
-                      char *current_ev, char *end_buf)
+ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
+              struct cfg80211_internal_bss *bss, char *current_ev,
+              char *end_buf)
 {
         struct iw_event iwe;
         u8 *buf, *cfg, *p;
         u8 *ie = bss->pub.information_elements;
-        int rem = bss->pub.len_information_elements, i;
+        int rem = bss->pub.len_information_elements, i, sig;
         bool ismesh = false;
 
         memset(&iwe, 0, sizeof(iwe));
@@ -617,19 +638,28 @@ ieee80211_bss(struct iw_request_info *info,
         current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
                                           IW_EV_FREQ_LEN);
 
-        if (bss->pub.signal_type != CFG80211_SIGNAL_TYPE_NONE) {
+        if (wiphy->signal_type != CFG80211_SIGNAL_TYPE_NONE) {
                 memset(&iwe, 0, sizeof(iwe));
                 iwe.cmd = IWEVQUAL;
                 iwe.u.qual.updated = IW_QUAL_LEVEL_UPDATED |
                                      IW_QUAL_NOISE_INVALID |
-                                     IW_QUAL_QUAL_INVALID;
-                switch (bss->pub.signal_type) {
+                                     IW_QUAL_QUAL_UPDATED;
+                switch (wiphy->signal_type) {
                 case CFG80211_SIGNAL_TYPE_MBM:
-                        iwe.u.qual.level = bss->pub.signal / 100;
+                        sig = bss->pub.signal / 100;
+                        iwe.u.qual.level = sig;
                         iwe.u.qual.updated |= IW_QUAL_DBM;
+                        if (sig < -110)         /* rather bad */
+                                sig = -110;
+                        else if (sig > -40)     /* perfect */
+                                sig = -40;
+                        /* will give a range of 0 .. 70 */
+                        iwe.u.qual.qual = sig + 110;
                         break;
                 case CFG80211_SIGNAL_TYPE_UNSPEC:
                         iwe.u.qual.level = bss->pub.signal;
+                        /* will give range 0 .. 100 */
+                        iwe.u.qual.qual = bss->pub.signal;
                         break;
                 default:
                         /* not reached */
@@ -763,8 +793,8 @@ ieee80211_bss(struct iw_request_info *info,
                                                   &iwe, buf);
                 memset(&iwe, 0, sizeof(iwe));
                 iwe.cmd = IWEVCUSTOM;
-                sprintf(buf, " Last beacon: %dms ago",
-                        jiffies_to_msecs(jiffies - bss->ts));
+                sprintf(buf, " Last beacon: %ums ago",
+                        elapsed_jiffies_msecs(bss->ts));
                 iwe.u.data.length = strlen(buf);
                 current_ev = iwe_stream_add_point(info, current_ev,
                                                   end_buf, &iwe, buf);
@@ -793,8 +823,8 @@ static int ieee80211_scan_results(struct cfg80211_registered_device *dev,
                         spin_unlock_bh(&dev->bss_lock);
                         return -E2BIG;
                 }
-                current_ev = ieee80211_bss(info, bss,
-                                                   current_ev, end_buf);
+                current_ev = ieee80211_bss(&dev->wiphy, info, bss,
+                                           current_ev, end_buf);
         }
         spin_unlock_bh(&dev->bss_lock);
         return current_ev - buf;
diff --git a/net/wireless/sysfs.c b/net/wireless/sysfs.c
index 26a72b0797a0..efe3c5c92b2d 100644
--- a/net/wireless/sysfs.c
+++ b/net/wireless/sysfs.c
@@ -31,7 +31,7 @@ static ssize_t name ## _show(struct device *dev,			\
         return sprintf(buf, fmt "\n", dev_to_rdev(dev)->member);        \
 }
 
-SHOW_FMT(index, "%d", idx);
+SHOW_FMT(index, "%d", wiphy_idx);
 SHOW_FMT(macaddress, "%pM", wiphy.perm_addr);
 
 static struct device_attribute ieee80211_dev_attrs[] = {
@@ -60,6 +60,8 @@ static int wiphy_suspend(struct device *dev, pm_message_t state)
         struct cfg80211_registered_device *rdev = dev_to_rdev(dev);
         int ret = 0;
 
+        rdev->suspend_at = get_seconds();
+
         if (rdev->ops->suspend) {
                 rtnl_lock();
                 ret = rdev->ops->suspend(&rdev->wiphy);
@@ -74,6 +76,11 @@ static int wiphy_resume(struct device *dev)
         struct cfg80211_registered_device *rdev = dev_to_rdev(dev);
         int ret = 0;
 
+        /* Age scan results with time spent in suspend */
+        spin_lock_bh(&rdev->bss_lock);
+        cfg80211_bss_age(rdev, get_seconds() - rdev->suspend_at);
+        spin_unlock_bh(&rdev->bss_lock);
+
         if (rdev->ops->resume) {
                 rtnl_lock();
                 ret = rdev->ops->resume(&rdev->wiphy);
diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c
index 58e489fd4aed..b84a9b4fe96a 100644
--- a/net/wireless/wext-compat.c
+++ b/net/wireless/wext-compat.c
@@ -137,3 +137,100 @@ int cfg80211_wext_giwmode(struct net_device *dev, struct iw_request_info *info,
         return 0;
 }
 EXPORT_SYMBOL(cfg80211_wext_giwmode);
+
+
+int cfg80211_wext_giwrange(struct net_device *dev,
+                           struct iw_request_info *info,
+                           struct iw_point *data, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct iw_range *range = (struct iw_range *) extra;
+        enum ieee80211_band band;
+        int c = 0;
+
+        if (!wdev)
+                return -EOPNOTSUPP;
+
+        data->length = sizeof(struct iw_range);
+        memset(range, 0, sizeof(struct iw_range));
+
+        range->we_version_compiled = WIRELESS_EXT;
+        range->we_version_source = 21;
+        range->retry_capa = IW_RETRY_LIMIT;
+        range->retry_flags = IW_RETRY_LIMIT;
+        range->min_retry = 0;
+        range->max_retry = 255;
+        range->min_rts = 0;
+        range->max_rts = 2347;
+        range->min_frag = 256;
+        range->max_frag = 2346;
+
+        range->encoding_size[0] = 5;
+        range->encoding_size[1] = 13;
+        range->num_encoding_sizes = 2;
+        range->max_encoding_tokens = 4;
+
+        range->max_qual.updated = IW_QUAL_NOISE_INVALID;
+
+        switch (wdev->wiphy->signal_type) {
+        case CFG80211_SIGNAL_TYPE_NONE:
+                break;
+        case CFG80211_SIGNAL_TYPE_MBM:
+                range->max_qual.level = -110;
+                range->max_qual.qual = 70;
+                range->avg_qual.qual = 35;
+                range->max_qual.updated |= IW_QUAL_DBM;
+                range->max_qual.updated |= IW_QUAL_QUAL_UPDATED;
+                range->max_qual.updated |= IW_QUAL_LEVEL_UPDATED;
+                break;
+        case CFG80211_SIGNAL_TYPE_UNSPEC:
+                range->max_qual.level = 100;
+                range->max_qual.qual = 100;
+                range->avg_qual.qual = 50;
+                range->max_qual.updated |= IW_QUAL_QUAL_UPDATED;
+                range->max_qual.updated |= IW_QUAL_LEVEL_UPDATED;
+                break;
+        }
+
+        range->avg_qual.level = range->max_qual.level / 2;
+        range->avg_qual.noise = range->max_qual.noise / 2;
+        range->avg_qual.updated = range->max_qual.updated;
+
+        range->enc_capa = IW_ENC_CAPA_WPA | IW_ENC_CAPA_WPA2 |
+                          IW_ENC_CAPA_CIPHER_TKIP | IW_ENC_CAPA_CIPHER_CCMP;
+
+
+        for (band = 0; band < IEEE80211_NUM_BANDS; band ++) {
+                int i;
+                struct ieee80211_supported_band *sband;
+
+                sband = wdev->wiphy->bands[band];
+
+                if (!sband)
+                        continue;
+
+                for (i = 0; i < sband->n_channels && c < IW_MAX_FREQUENCIES; i++) {
+                        struct ieee80211_channel *chan = &sband->channels[i];
+
+                        if (!(chan->flags & IEEE80211_CHAN_DISABLED)) {
+                                range->freq[c].i =
+                                        ieee80211_frequency_to_channel(
+                                                chan->center_freq);
+                                range->freq[c].m = chan->center_freq;
+                                range->freq[c].e = 6;
+                                c++;
+                        }
+                }
+        }
+        range->num_channels = c;
+        range->num_frequency = c;
+
+        IW_EVENT_CAPA_SET_KERNEL(range->event_capa);
+        IW_EVENT_CAPA_SET(range->event_capa, SIOCGIWAP);
+        IW_EVENT_CAPA_SET(range->event_capa, SIOCGIWSCAN);
+
+        range->scan_capa |= IW_SCAN_CAPA_ESSID;
+
+        return 0;
+}
+EXPORT_SYMBOL(cfg80211_wext_giwrange);