Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem

Conflicts:
	net/wireless/nl80211.c

119 files changed, 3772 insertions, 3098 deletions

diff --git a/drivers/bcma/bcma_private.h b/drivers/bcma/bcma_private.h
index 79595a001204..0215f9ad755c 100644
--- a/drivers/bcma/bcma_private.h
+++ b/drivers/bcma/bcma_private.h
@@ -22,6 +22,8 @@
 struct bcma_bus;
 
 /* main.c */
+bool bcma_wait_value(struct bcma_device *core, u16 reg, u32 mask, u32 value,
+                     int timeout);
 int bcma_bus_register(struct bcma_bus *bus);
 void bcma_bus_unregister(struct bcma_bus *bus);
 int __init bcma_bus_early_register(struct bcma_bus *bus,
diff --git a/drivers/bcma/driver_chipcommon.c b/drivers/bcma/driver_chipcommon.c
index 036c6744b39b..b068f98920a8 100644
--- a/drivers/bcma/driver_chipcommon.c
+++ b/drivers/bcma/driver_chipcommon.c
@@ -140,8 +140,15 @@ void bcma_core_chipcommon_init(struct bcma_drv_cc *cc)
         bcma_core_chipcommon_early_init(cc);
 
         if (cc->core->id.rev >= 20) {
-                bcma_cc_write32(cc, BCMA_CC_GPIOPULLUP, 0);
-                bcma_cc_write32(cc, BCMA_CC_GPIOPULLDOWN, 0);
+                u32 pullup = 0, pulldown = 0;
+
+                if (cc->core->bus->chipinfo.id == BCMA_CHIP_ID_BCM43142) {
+                        pullup = 0x402e0;
+                        pulldown = 0x20500;
+                }
+
+                bcma_cc_write32(cc, BCMA_CC_GPIOPULLUP, pullup);
+                bcma_cc_write32(cc, BCMA_CC_GPIOPULLDOWN, pulldown);
         }
 
         if (cc->capabilities & BCMA_CC_CAP_PMU)
diff --git a/drivers/bcma/driver_chipcommon_pmu.c b/drivers/bcma/driver_chipcommon_pmu.c
index edca73af3cc0..5081a8c439cc 100644
--- a/drivers/bcma/driver_chipcommon_pmu.c
+++ b/drivers/bcma/driver_chipcommon_pmu.c
@@ -56,6 +56,109 @@ void bcma_chipco_regctl_maskset(struct bcma_drv_cc *cc, u32 offset, u32 mask,
 }
 EXPORT_SYMBOL_GPL(bcma_chipco_regctl_maskset);
 
+static u32 bcma_pmu_xtalfreq(struct bcma_drv_cc *cc)
+{
+        u32 ilp_ctl, alp_hz;
+
+        if (!(bcma_cc_read32(cc, BCMA_CC_PMU_STAT) &
+              BCMA_CC_PMU_STAT_EXT_LPO_AVAIL))
+                return 0;
+
+        bcma_cc_write32(cc, BCMA_CC_PMU_XTAL_FREQ,
+                        BIT(BCMA_CC_PMU_XTAL_FREQ_MEASURE_SHIFT));
+        usleep_range(1000, 2000);
+
+        ilp_ctl = bcma_cc_read32(cc, BCMA_CC_PMU_XTAL_FREQ);
+        ilp_ctl &= BCMA_CC_PMU_XTAL_FREQ_ILPCTL_MASK;
+
+        bcma_cc_write32(cc, BCMA_CC_PMU_XTAL_FREQ, 0);
+
+        alp_hz = ilp_ctl * 32768 / 4;
+        return (alp_hz + 50000) / 100000 * 100;
+}
+
+static void bcma_pmu2_pll_init0(struct bcma_drv_cc *cc, u32 xtalfreq)
+{
+        struct bcma_bus *bus = cc->core->bus;
+        u32 freq_tgt_target = 0, freq_tgt_current;
+        u32 pll0, mask;
+
+        switch (bus->chipinfo.id) {
+        case BCMA_CHIP_ID_BCM43142:
+                /* pmu2_xtaltab0_adfll_485 */
+                switch (xtalfreq) {
+                case 12000:
+                        freq_tgt_target = 0x50D52;
+                        break;
+                case 20000:
+                        freq_tgt_target = 0x307FE;
+                        break;
+                case 26000:
+                        freq_tgt_target = 0x254EA;
+                        break;
+                case 37400:
+                        freq_tgt_target = 0x19EF8;
+                        break;
+                case 52000:
+                        freq_tgt_target = 0x12A75;
+                        break;
+                }
+                break;
+        }
+
+        if (!freq_tgt_target) {
+                bcma_err(bus, "Unknown TGT frequency for xtalfreq %d\n",
+                         xtalfreq);
+                return;
+        }
+
+        pll0 = bcma_chipco_pll_read(cc, BCMA_CC_PMU15_PLL_PLLCTL0);
+        freq_tgt_current = (pll0 & BCMA_CC_PMU15_PLL_PC0_FREQTGT_MASK) >>
+                BCMA_CC_PMU15_PLL_PC0_FREQTGT_SHIFT;
+
+        if (freq_tgt_current == freq_tgt_target) {
+                bcma_debug(bus, "Target TGT frequency already set\n");
+                return;
+        }
+
+        /* Turn off PLL */
+        switch (bus->chipinfo.id) {
+        case BCMA_CHIP_ID_BCM43142:
+                mask = (u32)~(BCMA_RES_4314_HT_AVAIL |
+                              BCMA_RES_4314_MACPHY_CLK_AVAIL);
+
+                bcma_cc_mask32(cc, BCMA_CC_PMU_MINRES_MSK, mask);
+                bcma_cc_mask32(cc, BCMA_CC_PMU_MAXRES_MSK, mask);
+                bcma_wait_value(cc->core, BCMA_CLKCTLST,
+                                BCMA_CLKCTLST_HAVEHT, 0, 20000);
+                break;
+        }
+
+        pll0 &= ~BCMA_CC_PMU15_PLL_PC0_FREQTGT_MASK;
+        pll0 |= freq_tgt_target << BCMA_CC_PMU15_PLL_PC0_FREQTGT_SHIFT;
+        bcma_chipco_pll_write(cc, BCMA_CC_PMU15_PLL_PLLCTL0, pll0);
+
+        /* Flush */
+        if (cc->pmu.rev >= 2)
+                bcma_cc_set32(cc, BCMA_CC_PMU_CTL, BCMA_CC_PMU_CTL_PLL_UPD);
+
+        /* TODO: Do we need to update OTP? */
+}
+
+static void bcma_pmu_pll_init(struct bcma_drv_cc *cc)
+{
+        struct bcma_bus *bus = cc->core->bus;
+        u32 xtalfreq = bcma_pmu_xtalfreq(cc);
+
+        switch (bus->chipinfo.id) {
+        case BCMA_CHIP_ID_BCM43142:
+                if (xtalfreq == 0)
+                        xtalfreq = 20000;
+                bcma_pmu2_pll_init0(cc, xtalfreq);
+                break;
+        }
+}
+
 static void bcma_pmu_resources_init(struct bcma_drv_cc *cc)
 {
         struct bcma_bus *bus = cc->core->bus;
@@ -66,6 +169,25 @@ static void bcma_pmu_resources_init(struct bcma_drv_cc *cc)
                 min_msk = 0x200D;
                 max_msk = 0xFFFF;
                 break;
+        case BCMA_CHIP_ID_BCM43142:
+                min_msk = BCMA_RES_4314_LPLDO_PU |
+                          BCMA_RES_4314_PMU_SLEEP_DIS |
+                          BCMA_RES_4314_PMU_BG_PU |
+                          BCMA_RES_4314_CBUCK_LPOM_PU |
+                          BCMA_RES_4314_CBUCK_PFM_PU |
+                          BCMA_RES_4314_CLDO_PU |
+                          BCMA_RES_4314_LPLDO2_LVM |
+                          BCMA_RES_4314_WL_PMU_PU |
+                          BCMA_RES_4314_LDO3P3_PU |
+                          BCMA_RES_4314_OTP_PU |
+                          BCMA_RES_4314_WL_PWRSW_PU |
+                          BCMA_RES_4314_LQ_AVAIL |
+                          BCMA_RES_4314_LOGIC_RET |
+                          BCMA_RES_4314_MEM_SLEEP |
+                          BCMA_RES_4314_MACPHY_RET |
+                          BCMA_RES_4314_WL_CORE_READY;
+                max_msk = 0x3FFFFFFF;
+                break;
         default:
                 bcma_debug(bus, "PMU resource config unknown or not needed for device 0x%04X\n",
                            bus->chipinfo.id);
@@ -165,6 +287,7 @@ void bcma_pmu_init(struct bcma_drv_cc *cc)
                 bcma_cc_set32(cc, BCMA_CC_PMU_CTL,
                              BCMA_CC_PMU_CTL_NOILPONW);
 
+        bcma_pmu_pll_init(cc);
         bcma_pmu_resources_init(cc);
         bcma_pmu_workarounds(cc);
 }
diff --git a/drivers/bcma/host_pci.c b/drivers/bcma/host_pci.c
index fbf2759e7e4e..a355e63a3838 100644
--- a/drivers/bcma/host_pci.c
+++ b/drivers/bcma/host_pci.c
@@ -275,6 +275,7 @@ static DEFINE_PCI_DEVICE_TABLE(bcma_pci_bridge_tbl) = {
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4357) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4358) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4359) },
+        { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4365) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4727) },
         { 0, },
 };
diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c
index f72f52b4b1dd..0067422ec17d 100644
--- a/drivers/bcma/main.c
+++ b/drivers/bcma/main.c
@@ -93,6 +93,25 @@ struct bcma_device *bcma_find_core_unit(struct bcma_bus *bus, u16 coreid,
         return NULL;
 }
 
+bool bcma_wait_value(struct bcma_device *core, u16 reg, u32 mask, u32 value,
+                     int timeout)
+{
+        unsigned long deadline = jiffies + timeout;
+        u32 val;
+
+        do {
+                val = bcma_read32(core, reg);
+                if ((val & mask) == value)
+                        return true;
+                cpu_relax();
+                udelay(10);
+        } while (!time_after_eq(jiffies, deadline));
+
+        bcma_warn(core->bus, "Timeout waiting for register 0x%04X!\n", reg);
+
+        return false;
+}
+
 static void bcma_release_core_dev(struct device *dev)
 {
         struct bcma_device *core = container_of(dev, struct bcma_device, dev);
diff --git a/drivers/bcma/sprom.c b/drivers/bcma/sprom.c
index de15b4f4b237..72bf4540f565 100644
--- a/drivers/bcma/sprom.c
+++ b/drivers/bcma/sprom.c
@@ -503,6 +503,7 @@ static bool bcma_sprom_onchip_available(struct bcma_bus *bus)
         case BCMA_CHIP_ID_BCM4331:
                 present = chip_status & BCMA_CC_CHIPST_4331_OTP_PRESENT;
                 break;
+        case BCMA_CHIP_ID_BCM43142:
         case BCMA_CHIP_ID_BCM43224:
         case BCMA_CHIP_ID_BCM43225:
                 /* for these chips OTP is always available */
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 81f12757a842..de4cf4daa2f4 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -1619,6 +1619,7 @@ static struct usb_driver btusb_driver = {
 #ifdef CONFIG_PM
         .suspend        = btusb_suspend,
         .resume         = btusb_resume,
+        .reset_resume   = btusb_resume,
 #endif
         .id_table       = btusb_table,
         .supports_autosuspend = 1,
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index 3446c989d6a6..da5c333d0d4b 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -54,7 +54,6 @@ static int ath10k_send_key(struct ath10k_vif *arvif,
                 key->flags |= IEEE80211_KEY_FLAG_SW_MGMT_TX;
                 break;
         case WLAN_CIPHER_SUITE_TKIP:
-                key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
                 arg.key_cipher = WMI_CIPHER_TKIP;
                 arg.key_txmic_len = 8;
                 arg.key_rxmic_len = 8;
@@ -237,6 +236,8 @@ chan_to_phymode(const struct cfg80211_chan_def *chandef)
                 case NL80211_CHAN_WIDTH_40:
                         phymode = MODE_11NG_HT40;
                         break;
+                case NL80211_CHAN_WIDTH_5:
+                case NL80211_CHAN_WIDTH_10:
                 case NL80211_CHAN_WIDTH_80:
                 case NL80211_CHAN_WIDTH_80P80:
                 case NL80211_CHAN_WIDTH_160:
@@ -258,6 +259,8 @@ chan_to_phymode(const struct cfg80211_chan_def *chandef)
                 case NL80211_CHAN_WIDTH_80:
                         phymode = MODE_11AC_VHT80;
                         break;
+                case NL80211_CHAN_WIDTH_5:
+                case NL80211_CHAN_WIDTH_10:
                 case NL80211_CHAN_WIDTH_80P80:
                 case NL80211_CHAN_WIDTH_160:
                         phymode = MODE_UNKNOWN;
@@ -2721,30 +2724,30 @@ static const struct ieee80211_channel ath10k_2ghz_channels[] = {
 };
 
 static const struct ieee80211_channel ath10k_5ghz_channels[] = {
-        CHAN5G(36, 5180, 14),
-        CHAN5G(40, 5200, 15),
-        CHAN5G(44, 5220, 16),
-        CHAN5G(48, 5240, 17),
-        CHAN5G(52, 5260, 18),
-        CHAN5G(56, 5280, 19),
-        CHAN5G(60, 5300, 20),
-        CHAN5G(64, 5320, 21),
-        CHAN5G(100, 5500, 22),
-        CHAN5G(104, 5520, 23),
-        CHAN5G(108, 5540, 24),
-        CHAN5G(112, 5560, 25),
-        CHAN5G(116, 5580, 26),
-        CHAN5G(120, 5600, 27),
-        CHAN5G(124, 5620, 28),
-        CHAN5G(128, 5640, 29),
-        CHAN5G(132, 5660, 30),
-        CHAN5G(136, 5680, 31),
-        CHAN5G(140, 5700, 32),
-        CHAN5G(149, 5745, 33),
-        CHAN5G(153, 5765, 34),
-        CHAN5G(157, 5785, 35),
-        CHAN5G(161, 5805, 36),
-        CHAN5G(165, 5825, 37),
+        CHAN5G(36, 5180, 0),
+        CHAN5G(40, 5200, 0),
+        CHAN5G(44, 5220, 0),
+        CHAN5G(48, 5240, 0),
+        CHAN5G(52, 5260, 0),
+        CHAN5G(56, 5280, 0),
+        CHAN5G(60, 5300, 0),
+        CHAN5G(64, 5320, 0),
+        CHAN5G(100, 5500, 0),
+        CHAN5G(104, 5520, 0),
+        CHAN5G(108, 5540, 0),
+        CHAN5G(112, 5560, 0),
+        CHAN5G(116, 5580, 0),
+        CHAN5G(120, 5600, 0),
+        CHAN5G(124, 5620, 0),
+        CHAN5G(128, 5640, 0),
+        CHAN5G(132, 5660, 0),
+        CHAN5G(136, 5680, 0),
+        CHAN5G(140, 5700, 0),
+        CHAN5G(149, 5745, 0),
+        CHAN5G(153, 5765, 0),
+        CHAN5G(157, 5785, 0),
+        CHAN5G(161, 5805, 0),
+        CHAN5G(165, 5825, 0),
 };
 
 static struct ieee80211_rate ath10k_rates[] = {
diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
index c8e905669701..33af4672c909 100644
--- a/drivers/net/wireless/ath/ath10k/pci.c
+++ b/drivers/net/wireless/ath/ath10k/pci.c
@@ -1883,9 +1883,10 @@ static int ath10k_pci_start_intr_msix(struct ath10k *ar, int num)
                         ath10k_warn("request_irq(%d) failed %d\n",
                                     ar_pci->pdev->irq + i, ret);
 
-                        for (; i >= MSI_ASSIGN_CE_INITIAL; i--)
-                                free_irq(ar_pci->pdev->irq, ar);
+                        for (i--; i >= MSI_ASSIGN_CE_INITIAL; i--)
+                                free_irq(ar_pci->pdev->irq + i, ar);
 
+                        free_irq(ar_pci->pdev->irq + MSI_ASSIGN_FW, ar);
                         pci_disable_msi(ar_pci->pdev);
                         return ret;
                 }
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index 1e86977d3322..d105e43d22e1 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -3606,7 +3606,7 @@ static void ar9003_hw_ant_ctrl_apply(struct ath_hw *ah, bool is2ghz)
          *   7:4 R/W  SWITCH_TABLE_COM_SPDT_WLAN_IDLE
          * SWITCH_TABLE_COM_SPDT_WLAN_IDLE
          */
-        if (AR_SREV_9462_20(ah) || AR_SREV_9565(ah)) {
+        if (AR_SREV_9462_20_OR_LATER(ah) || AR_SREV_9565(ah)) {
                 value = ar9003_switch_com_spdt_get(ah, is2ghz);
                 REG_RMW_FIELD(ah, AR_PHY_GLB_CONTROL,
                                 AR_SWITCH_TABLE_COM_SPDT_ALL, value);
@@ -4059,8 +4059,9 @@ static void ar9003_hw_thermo_cal_apply(struct ath_hw *ah)
 {
         u32 data, ko, kg;
 
-        if (!AR_SREV_9462_20(ah))
+        if (!AR_SREV_9462_20_OR_LATER(ah))
                 return;
+
         ar9300_otp_read_word(ah, 1, &data);
         ko = data & 0xff;
         kg = (data >> 8) & 0xff;
@@ -4752,7 +4753,7 @@ tempslope:
                               AR_PHY_TPC_19_ALPHA_THERM, temp_slope);
         }
 
-        if (AR_SREV_9462_20(ah))
+        if (AR_SREV_9462_20_OR_LATER(ah))
                 REG_RMW_FIELD(ah, AR_PHY_TPC_19_B1,
                               AR_PHY_TPC_19_B1_ALPHA_THERM, temp_slope);
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_hw.c b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
index 671aaa7e7337..d402cb32283f 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
@@ -24,6 +24,7 @@
 #include "ar955x_1p0_initvals.h"
 #include "ar9580_1p0_initvals.h"
 #include "ar9462_2p0_initvals.h"
+#include "ar9462_2p1_initvals.h"
 #include "ar9565_1p0_initvals.h"
 
 /* General hardware code for the AR9003 hadware family */
@@ -197,6 +198,31 @@ static void ar9003_hw_init_mode_regs(struct ath_hw *ah)
 
                 INIT_INI_ARRAY(&ah->iniPcieSerdesLowPower,
                                 ar9485_1_1_pcie_phy_clkreq_disable_L1);
+        } else if (AR_SREV_9462_21(ah)) {
+                INIT_INI_ARRAY(&ah->iniMac[ATH_INI_CORE],
+                               ar9462_2p1_mac_core);
+                INIT_INI_ARRAY(&ah->iniMac[ATH_INI_POST],
+                               ar9462_2p1_mac_postamble);
+                INIT_INI_ARRAY(&ah->iniBB[ATH_INI_CORE],
+                               ar9462_2p1_baseband_core);
+                INIT_INI_ARRAY(&ah->iniBB[ATH_INI_POST],
+                               ar9462_2p1_baseband_postamble);
+                INIT_INI_ARRAY(&ah->iniRadio[ATH_INI_CORE],
+                               ar9462_2p1_radio_core);
+                INIT_INI_ARRAY(&ah->iniRadio[ATH_INI_POST],
+                               ar9462_2p1_radio_postamble);
+                INIT_INI_ARRAY(&ah->ini_radio_post_sys2ant,
+                               ar9462_2p1_radio_postamble_sys2ant);
+                INIT_INI_ARRAY(&ah->iniSOC[ATH_INI_PRE],
+                               ar9462_2p1_soc_preamble);
+                INIT_INI_ARRAY(&ah->iniSOC[ATH_INI_POST],
+                               ar9462_2p1_soc_postamble);
+                INIT_INI_ARRAY(&ah->iniModesRxGain,
+                               ar9462_2p1_common_rx_gain);
+                INIT_INI_ARRAY(&ah->iniModesFastClock,
+                               ar9462_2p1_modes_fast_clock);
+                INIT_INI_ARRAY(&ah->iniCckfirJapan2484,
+                               ar9462_2p1_baseband_core_txfir_coeff_japan_2484);
         } else if (AR_SREV_9462_20(ah)) {
 
                 INIT_INI_ARRAY(&ah->iniMac[ATH_INI_CORE], ar9462_2p0_mac_core);
@@ -407,6 +433,9 @@ static void ar9003_tx_gain_table_mode0(struct ath_hw *ah)
         else if (AR_SREV_9580(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9580_1p0_lowest_ob_db_tx_gain_table);
+        else if (AR_SREV_9462_21(ah))
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                        ar9462_2p1_modes_low_ob_db_tx_gain);
         else if (AR_SREV_9462_20(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9462_modes_low_ob_db_tx_gain_table_2p0);
@@ -438,6 +467,9 @@ static void ar9003_tx_gain_table_mode1(struct ath_hw *ah)
         else if (AR_SREV_9550(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar955x_1p0_modes_no_xpa_tx_gain_table);
+        else if (AR_SREV_9462_21(ah))
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                        ar9462_2p1_modes_high_ob_db_tx_gain);
         else if (AR_SREV_9462_20(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9462_modes_high_ob_db_tx_gain_table_2p0);
@@ -507,6 +539,12 @@ static void ar9003_tx_gain_table_mode4(struct ath_hw *ah)
         else if (AR_SREV_9580(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9580_1p0_mixed_ob_db_tx_gain_table);
+        else if (AR_SREV_9462_21(ah))
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                       ar9462_2p1_modes_mix_ob_db_tx_gain);
+        else if (AR_SREV_9462_20(ah))
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                       ar9462_modes_mix_ob_db_tx_gain_table_2p0);
         else
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9300Modes_mixed_ob_db_tx_gain_table_2p2);
@@ -584,6 +622,9 @@ static void ar9003_rx_gain_table_mode0(struct ath_hw *ah)
         } else if (AR_SREV_9580(ah))
                 INIT_INI_ARRAY(&ah->iniModesRxGain,
                                 ar9580_1p0_rx_gain_table);
+        else if (AR_SREV_9462_21(ah))
+                INIT_INI_ARRAY(&ah->iniModesRxGain,
+                                ar9462_2p1_common_rx_gain);
         else if (AR_SREV_9462_20(ah))
                 INIT_INI_ARRAY(&ah->iniModesRxGain,
                                 ar9462_common_rx_gain_table_2p0);
@@ -606,6 +647,9 @@ static void ar9003_rx_gain_table_mode1(struct ath_hw *ah)
         else if (AR_SREV_9485_11(ah))
                 INIT_INI_ARRAY(&ah->iniModesRxGain,
                         ar9485Common_wo_xlna_rx_gain_1_1);
+        else if (AR_SREV_9462_21(ah))
+                INIT_INI_ARRAY(&ah->iniModesRxGain,
+                        ar9462_2p1_common_wo_xlna_rx_gain);
         else if (AR_SREV_9462_20(ah))
                 INIT_INI_ARRAY(&ah->iniModesRxGain,
                         ar9462_common_wo_xlna_rx_gain_table_2p0);
@@ -627,7 +671,16 @@ static void ar9003_rx_gain_table_mode1(struct ath_hw *ah)
 
 static void ar9003_rx_gain_table_mode2(struct ath_hw *ah)
 {
-        if (AR_SREV_9462_20(ah)) {
+        if (AR_SREV_9462_21(ah)) {
+                INIT_INI_ARRAY(&ah->iniModesRxGain,
+                               ar9462_2p1_common_mixed_rx_gain);
+                INIT_INI_ARRAY(&ah->ini_modes_rxgain_bb_core,
+                               ar9462_2p1_baseband_core_mix_rxgain);
+                INIT_INI_ARRAY(&ah->ini_modes_rxgain_bb_postamble,
+                               ar9462_2p1_baseband_postamble_mix_rxgain);
+                INIT_INI_ARRAY(&ah->ini_modes_rxgain_5g_xlna,
+                               ar9462_2p1_baseband_postamble_5g_xlna);
+        } else if (AR_SREV_9462_20(ah)) {
                 INIT_INI_ARRAY(&ah->iniModesRxGain,
                                ar9462_common_mixed_rx_gain_table_2p0);
                 INIT_INI_ARRAY(&ah->ini_modes_rxgain_bb_core,
@@ -641,7 +694,12 @@ static void ar9003_rx_gain_table_mode2(struct ath_hw *ah)
 
 static void ar9003_rx_gain_table_mode3(struct ath_hw *ah)
 {
-        if (AR_SREV_9462_20(ah)) {
+        if (AR_SREV_9462_21(ah)) {
+                INIT_INI_ARRAY(&ah->iniModesRxGain,
+                               ar9462_2p1_common_5g_xlna_only_rx_gain);
+                INIT_INI_ARRAY(&ah->ini_modes_rxgain_5g_xlna,
+                               ar9462_2p1_baseband_postamble_5g_xlna);
+        } else if (AR_SREV_9462_20(ah)) {
                 INIT_INI_ARRAY(&ah->iniModesRxGain,
                                ar9462_2p0_5g_xlna_only_rxgain);
                 INIT_INI_ARRAY(&ah->ini_modes_rxgain_5g_xlna,
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index df84d20e1092..1f694ab3cc78 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -743,7 +743,7 @@ static int ar9003_hw_process_ini(struct ath_hw *ah,
                 ar9003_hw_prog_ini(ah, &ah->iniMac[i], modesIndex);
                 ar9003_hw_prog_ini(ah, &ah->iniBB[i], modesIndex);
                 ar9003_hw_prog_ini(ah, &ah->iniRadio[i], modesIndex);
-                if (i == ATH_INI_POST && AR_SREV_9462_20(ah))
+                if (i == ATH_INI_POST && AR_SREV_9462_20_OR_LATER(ah))
                         ar9003_hw_prog_ini(ah,
                                            &ah->ini_radio_post_sys2ant,
                                            modesIndex);
@@ -754,7 +754,7 @@ static int ar9003_hw_process_ini(struct ath_hw *ah,
          */
         REG_WRITE_ARRAY(&ah->iniModesRxGain, 1, regWrites);
 
-        if (AR_SREV_9462_20(ah)) {
+        if (AR_SREV_9462_20_OR_LATER(ah)) {
                 /*
                  * CUS217 mix LNA mode.
                  */
@@ -1512,7 +1512,7 @@ static int ar9003_hw_fast_chan_change(struct ath_hw *ah,
         ar9003_hw_prog_ini(ah, &ah->iniBB[ATH_INI_POST], modesIndex);
         ar9003_hw_prog_ini(ah, &ah->iniRadio[ATH_INI_POST], modesIndex);
 
-        if (AR_SREV_9462_20(ah))
+        if (AR_SREV_9462_20_OR_LATER(ah))
                 ar9003_hw_prog_ini(ah, &ah->ini_radio_post_sys2ant,
                                    modesIndex);
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.h b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
index 5013c731f9f6..d4d39f305a0b 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
@@ -954,7 +954,7 @@
 #define AR_PHY_TPC_5_B1         (AR_SM1_BASE + 0x208)
 #define AR_PHY_TPC_6_B1         (AR_SM1_BASE + 0x20c)
 #define AR_PHY_TPC_11_B1        (AR_SM1_BASE + 0x220)
-#define AR_PHY_PDADC_TAB_1      (AR_SM1_BASE + (AR_SREV_AR9462(ah) ? \
+#define AR_PHY_PDADC_TAB_1      (AR_SM1_BASE + (AR_SREV_9462_20_OR_LATER(ah) ? \
                                         0x280 : 0x240))
 #define AR_PHY_TPC_19_B1        (AR_SM1_BASE + 0x240)
 #define AR_PHY_TPC_19_B1_ALPHA_THERM            0xff
@@ -1048,7 +1048,7 @@
 #define AR_GLB_GPIO_CONTROL     (AR_GLB_BASE)
 #define AR_PHY_GLB_CONTROL      (AR_GLB_BASE + 0x44)
 #define AR_GLB_SCRATCH(_ah)     (AR_GLB_BASE + \
-                                        (AR_SREV_9462_20(_ah) ? 0x4c : 0x50))
+                                        (AR_SREV_9462_20_OR_LATER(_ah) ? 0x4c : 0x50))
 #define AR_GLB_STATUS           (AR_GLB_BASE + 0x48)
 
 /*
diff --git a/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h b/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h
index 1d6b705ba110..092b9d412e7f 100644
--- a/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h
@@ -879,6 +879,69 @@ static const u32 ar9462_2p0_radio_postamble[][5] = {
         {0x0001650c, 0x48000000, 0x40000000, 0x40000000, 0x40000000},
 };
 
+static const u32 ar9462_modes_mix_ob_db_tx_gain_table_2p0[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x000098bc, 0x00000002, 0x00000002, 0x00000002, 0x00000002},
+        {0x0000a2dc, 0x01feee00, 0x01feee00, 0x03aaa352, 0x03aaa352},
+        {0x0000a2e0, 0x0000f000, 0x0000f000, 0x03ccc584, 0x03ccc584},
+        {0x0000a2e4, 0x01ff0000, 0x01ff0000, 0x03f0f800, 0x03f0f800},
+        {0x0000a2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
+        {0x0000a410, 0x0000d0da, 0x0000d0da, 0x0000d0de, 0x0000d0de},
+        {0x0000a458, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a500, 0x00002220, 0x00002220, 0x00000000, 0x00000000},
+        {0x0000a504, 0x06002223, 0x06002223, 0x04000002, 0x04000002},
+        {0x0000a508, 0x0a022220, 0x0a022220, 0x08000004, 0x08000004},
+        {0x0000a50c, 0x0f022223, 0x0f022223, 0x0b000200, 0x0b000200},
+        {0x0000a510, 0x14022620, 0x14022620, 0x0f000202, 0x0f000202},
+        {0x0000a514, 0x18022622, 0x18022622, 0x12000400, 0x12000400},
+        {0x0000a518, 0x1b022822, 0x1b022822, 0x16000402, 0x16000402},
+        {0x0000a51c, 0x20022842, 0x20022842, 0x19000404, 0x19000404},
+        {0x0000a520, 0x22022c41, 0x22022c41, 0x1c000603, 0x1c000603},
+        {0x0000a524, 0x28023042, 0x28023042, 0x21000a02, 0x21000a02},
+        {0x0000a528, 0x2c023044, 0x2c023044, 0x25000a04, 0x25000a04},
+        {0x0000a52c, 0x2f023644, 0x2f023644, 0x28000a20, 0x28000a20},
+        {0x0000a530, 0x34025643, 0x34025643, 0x2c000e20, 0x2c000e20},
+        {0x0000a534, 0x38025a44, 0x38025a44, 0x30000e22, 0x30000e22},
+        {0x0000a538, 0x3b025e45, 0x3b025e45, 0x34000e24, 0x34000e24},
+        {0x0000a53c, 0x41025e4a, 0x41025e4a, 0x38001640, 0x38001640},
+        {0x0000a540, 0x48025e6c, 0x48025e6c, 0x3c001660, 0x3c001660},
+        {0x0000a544, 0x4e025e8e, 0x4e025e8e, 0x3f001861, 0x3f001861},
+        {0x0000a548, 0x55025eb3, 0x55025eb3, 0x43001a81, 0x43001a81},
+        {0x0000a54c, 0x58025ef3, 0x58025ef3, 0x47001a83, 0x47001a83},
+        {0x0000a550, 0x5d025ef6, 0x5d025ef6, 0x4a001c84, 0x4a001c84},
+        {0x0000a554, 0x62025f56, 0x62025f56, 0x4e001ce3, 0x4e001ce3},
+        {0x0000a558, 0x66027f56, 0x66027f56, 0x52001ce5, 0x52001ce5},
+        {0x0000a55c, 0x6a029f56, 0x6a029f56, 0x56001ce9, 0x56001ce9},
+        {0x0000a560, 0x70049f56, 0x70049f56, 0x5a001ceb, 0x5a001ceb},
+        {0x0000a564, 0x751ffff6, 0x751ffff6, 0x5c001eec, 0x5c001eec},
+        {0x0000a568, 0x751ffff6, 0x751ffff6, 0x5e001ef0, 0x5e001ef0},
+        {0x0000a56c, 0x751ffff6, 0x751ffff6, 0x60001ef4, 0x60001ef4},
+        {0x0000a570, 0x751ffff6, 0x751ffff6, 0x62001ff6, 0x62001ff6},
+        {0x0000a574, 0x751ffff6, 0x751ffff6, 0x62001ff6, 0x62001ff6},
+        {0x0000a578, 0x751ffff6, 0x751ffff6, 0x62001ff6, 0x62001ff6},
+        {0x0000a57c, 0x751ffff6, 0x751ffff6, 0x62001ff6, 0x62001ff6},
+        {0x0000a600, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a604, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a608, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a60c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a610, 0x00804000, 0x00804000, 0x00000000, 0x00000000},
+        {0x0000a614, 0x00804201, 0x00804201, 0x01404000, 0x01404000},
+        {0x0000a618, 0x0280c802, 0x0280c802, 0x01404501, 0x01404501},
+        {0x0000a61c, 0x0280ca03, 0x0280ca03, 0x02008501, 0x02008501},
+        {0x0000a620, 0x04c15104, 0x04c15104, 0x0280ca03, 0x0280ca03},
+        {0x0000a624, 0x04c15305, 0x04c15305, 0x03010c04, 0x03010c04},
+        {0x0000a628, 0x04c15305, 0x04c15305, 0x04014c04, 0x04014c04},
+        {0x0000a62c, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
+        {0x0000a630, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
+        {0x0000a634, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
+        {0x0000a638, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
+        {0x0000a63c, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
+        {0x0000b2dc, 0x01feee00, 0x01feee00, 0x03aaa352, 0x03aaa352},
+        {0x0000b2e0, 0x0000f000, 0x0000f000, 0x03ccc584, 0x03ccc584},
+        {0x0000b2e4, 0x01ff0000, 0x01ff0000, 0x03f0f800, 0x03f0f800},
+        {0x0000b2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
+};
+
 static const u32 ar9462_modes_high_ob_db_tx_gain_table_2p0[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
         {0x000098bc, 0x00000002, 0x00000002, 0x00000002, 0x00000002},
diff --git a/drivers/net/wireless/ath/ath9k/ar9462_2p1_initvals.h b/drivers/net/wireless/ath/ath9k/ar9462_2p1_initvals.h
new file mode 100644
index 000000000000..4dbc294df7e3
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/ar9462_2p1_initvals.h
@@ -0,0 +1,1774 @@
+/*
+ * Copyright (c) 2010-2011 Atheros Communications Inc.
+ * Copyright (c) 2011-2012 Qualcomm Atheros Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef INITVALS_9462_2P1_H
+#define INITVALS_9462_2P1_H
+
+/* AR9462 2.1 */
+
+static const u32 ar9462_2p1_mac_core[][2] = {
+        /* Addr      allmodes  */
+        {0x00000008, 0x00000000},
+        {0x00000030, 0x000e0085},
+        {0x00000034, 0x00000005},
+        {0x00000040, 0x00000000},
+        {0x00000044, 0x00000000},
+        {0x00000048, 0x00000008},
+        {0x0000004c, 0x00000010},
+        {0x00000050, 0x00000000},
+        {0x00001040, 0x002ffc0f},
+        {0x00001044, 0x002ffc0f},
+        {0x00001048, 0x002ffc0f},
+        {0x0000104c, 0x002ffc0f},
+        {0x00001050, 0x002ffc0f},
+        {0x00001054, 0x002ffc0f},
+        {0x00001058, 0x002ffc0f},
+        {0x0000105c, 0x002ffc0f},
+        {0x00001060, 0x002ffc0f},
+        {0x00001064, 0x002ffc0f},
+        {0x000010f0, 0x00000100},
+        {0x00001270, 0x00000000},
+        {0x000012b0, 0x00000000},
+        {0x000012f0, 0x00000000},
+        {0x0000143c, 0x00000000},
+        {0x0000147c, 0x00000000},
+        {0x00001810, 0x0f000003},
+        {0x00008000, 0x00000000},
+        {0x00008004, 0x00000000},
+        {0x00008008, 0x00000000},
+        {0x0000800c, 0x00000000},
+        {0x00008018, 0x00000000},
+        {0x00008020, 0x00000000},
+        {0x00008038, 0x00000000},
+        {0x0000803c, 0x00080000},
+        {0x00008040, 0x00000000},
+        {0x00008044, 0x00000000},
+        {0x00008048, 0x00000000},
+        {0x0000804c, 0xffffffff},
+        {0x00008054, 0x00000000},
+        {0x00008058, 0x00000000},
+        {0x0000805c, 0x000fc78f},
+        {0x00008060, 0x0000000f},
+        {0x00008064, 0x00000000},
+        {0x00008070, 0x00000310},
+        {0x00008074, 0x00000020},
+        {0x00008078, 0x00000000},
+        {0x0000809c, 0x0000000f},
+        {0x000080a0, 0x00000000},
+        {0x000080a4, 0x02ff0000},
+        {0x000080a8, 0x0e070605},
+        {0x000080ac, 0x0000000d},
+        {0x000080b0, 0x00000000},
+        {0x000080b4, 0x00000000},
+        {0x000080b8, 0x00000000},
+        {0x000080bc, 0x00000000},
+        {0x000080c0, 0x2a800000},
+        {0x000080c4, 0x06900168},
+        {0x000080c8, 0x13881c20},
+        {0x000080cc, 0x01f40000},
+        {0x000080d0, 0x00252500},
+        {0x000080d4, 0x00b00005},
+        {0x000080d8, 0x00400002},
+        {0x000080dc, 0x00000000},
+        {0x000080e0, 0xffffffff},
+        {0x000080e4, 0x0000ffff},
+        {0x000080e8, 0x3f3f3f3f},
+        {0x000080ec, 0x00000000},
+        {0x000080f0, 0x00000000},
+        {0x000080f4, 0x00000000},
+        {0x000080fc, 0x00020000},
+        {0x00008100, 0x00000000},
+        {0x00008108, 0x00000052},
+        {0x0000810c, 0x00000000},
+        {0x00008110, 0x00000000},
+        {0x00008114, 0x000007ff},
+        {0x00008118, 0x000000aa},
+        {0x0000811c, 0x00003210},
+        {0x00008124, 0x00000000},
+        {0x00008128, 0x00000000},
+        {0x0000812c, 0x00000000},
+        {0x00008130, 0x00000000},
+        {0x00008134, 0x00000000},
+        {0x00008138, 0x00000000},
+        {0x0000813c, 0x0000ffff},
+        {0x00008144, 0xffffffff},
+        {0x00008168, 0x00000000},
+        {0x0000816c, 0x00000000},
+        {0x00008170, 0x18486e00},
+        {0x00008174, 0x33332210},
+        {0x00008178, 0x00000000},
+        {0x0000817c, 0x00020000},
+        {0x000081c4, 0x33332210},
+        {0x000081c8, 0x00000000},
+        {0x000081cc, 0x00000000},
+        {0x000081d4, 0x00000000},
+        {0x000081ec, 0x00000000},
+        {0x000081f0, 0x00000000},
+        {0x000081f4, 0x00000000},
+        {0x000081f8, 0x00000000},
+        {0x000081fc, 0x00000000},
+        {0x00008240, 0x00100000},
+        {0x00008244, 0x0010f400},
+        {0x00008248, 0x00000800},
+        {0x0000824c, 0x0001e800},
+        {0x00008250, 0x00000000},
+        {0x00008254, 0x00000000},
+        {0x00008258, 0x00000000},
+        {0x0000825c, 0x40000000},
+        {0x00008260, 0x00080922},
+        {0x00008264, 0x99c00010},
+        {0x00008268, 0xffffffff},
+        {0x0000826c, 0x0000ffff},
+        {0x00008270, 0x00000000},
+        {0x00008274, 0x40000000},
+        {0x00008278, 0x003e4180},
+        {0x0000827c, 0x00000004},
+        {0x00008284, 0x0000002c},
+        {0x00008288, 0x0000002c},
+        {0x0000828c, 0x000000ff},
+        {0x00008294, 0x00000000},
+        {0x00008298, 0x00000000},
+        {0x0000829c, 0x00000000},
+        {0x00008300, 0x00000140},
+        {0x00008314, 0x00000000},
+        {0x0000831c, 0x0000010d},
+        {0x00008328, 0x00000000},
+        {0x0000832c, 0x0000001f},
+        {0x00008330, 0x00000302},
+        {0x00008334, 0x00000700},
+        {0x00008338, 0xffff0000},
+        {0x0000833c, 0x02400000},
+        {0x00008340, 0x000107ff},
+        {0x00008344, 0xaa48107b},
+        {0x00008348, 0x008f0000},
+        {0x0000835c, 0x00000000},
+        {0x00008360, 0xffffffff},
+        {0x00008364, 0xffffffff},
+        {0x00008368, 0x00000000},
+        {0x00008370, 0x00000000},
+        {0x00008374, 0x000000ff},
+        {0x00008378, 0x00000000},
+        {0x0000837c, 0x00000000},
+        {0x00008380, 0xffffffff},
+        {0x00008384, 0xffffffff},
+        {0x00008390, 0xffffffff},
+        {0x00008394, 0xffffffff},
+        {0x00008398, 0x00000000},
+        {0x0000839c, 0x00000000},
+        {0x000083a4, 0x0000fa14},
+        {0x000083a8, 0x000f0c00},
+        {0x000083ac, 0x33332210},
+        {0x000083b0, 0x33332210},
+        {0x000083b4, 0x33332210},
+        {0x000083b8, 0x33332210},
+        {0x000083bc, 0x00000000},
+        {0x000083c0, 0x00000000},
+        {0x000083c4, 0x00000000},
+        {0x000083c8, 0x00000000},
+        {0x000083cc, 0x00000200},
+        {0x000083d0, 0x000301ff},
+};
+
+static const u32 ar9462_2p1_mac_postamble[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x00001030, 0x00000230, 0x00000460, 0x000002c0, 0x00000160},
+        {0x00001070, 0x00000168, 0x000002d0, 0x00000318, 0x0000018c},
+        {0x000010b0, 0x00000e60, 0x00001cc0, 0x00007c70, 0x00003e38},
+        {0x00008014, 0x03e803e8, 0x07d007d0, 0x10801600, 0x08400b00},
+        {0x0000801c, 0x128d8027, 0x128d804f, 0x12e00057, 0x12e0002b},
+        {0x00008120, 0x08f04800, 0x08f04800, 0x08f04810, 0x08f04810},
+        {0x000081d0, 0x00003210, 0x00003210, 0x0000320a, 0x0000320a},
+        {0x00008318, 0x00003e80, 0x00007d00, 0x00006880, 0x00003440},
+};
+
+static const u32 ar9462_2p1_baseband_core[][2] = {
+        /* Addr      allmodes  */
+        {0x00009800, 0xafe68e30},
+        {0x00009804, 0xfd14e000},
+        {0x00009808, 0x9c0a9f6b},
+        {0x0000980c, 0x04900000},
+        {0x00009814, 0x9280c00a},
+        {0x00009818, 0x00000000},
+        {0x0000981c, 0x00020028},
+        {0x00009834, 0x6400a290},
+        {0x00009838, 0x0108ecff},
+        {0x0000983c, 0x0d000600},
+        {0x00009880, 0x201fff00},
+        {0x00009884, 0x00001042},
+        {0x000098a4, 0x00200400},
+        {0x000098b0, 0x32440bbe},
+        {0x000098d0, 0x004b6a8e},
+        {0x000098d4, 0x00000820},
+        {0x000098dc, 0x00000000},
+        {0x000098e4, 0x01ffffff},
+        {0x000098e8, 0x01ffffff},
+        {0x000098ec, 0x01ffffff},
+        {0x000098f0, 0x00000000},
+        {0x000098f4, 0x00000000},
+        {0x00009bf0, 0x80000000},
+        {0x00009c04, 0xff55ff55},
+        {0x00009c08, 0x0320ff55},
+        {0x00009c0c, 0x00000000},
+        {0x00009c10, 0x00000000},
+        {0x00009c14, 0x00046384},
+        {0x00009c18, 0x05b6b440},
+        {0x00009c1c, 0x00b6b440},
+        {0x00009d00, 0xc080a333},
+        {0x00009d04, 0x40206c10},
+        {0x00009d08, 0x009c4060},
+        {0x00009d0c, 0x9883800a},
+        {0x00009d10, 0x01834061},
+        {0x00009d14, 0x00c0040b},
+        {0x00009d18, 0x00000000},
+        {0x00009e08, 0x0038230c},
+        {0x00009e24, 0x990bb515},
+        {0x00009e28, 0x0c6f0000},
+        {0x00009e30, 0x06336f77},
+        {0x00009e34, 0x6af6532f},
+        {0x00009e38, 0x0cc80c00},
+        {0x00009e40, 0x15262820},
+        {0x00009e4c, 0x00001004},
+        {0x00009e50, 0x00ff03f1},
+        {0x00009e54, 0xe4c555c2},
+        {0x00009e58, 0xfd857722},
+        {0x00009e5c, 0xe9198724},
+        {0x00009fc0, 0x803e4788},
+        {0x00009fc4, 0x0001efb5},
+        {0x00009fcc, 0x40000014},
+        {0x00009fd0, 0x0a193b93},
+        {0x0000a20c, 0x00000000},
+        {0x0000a220, 0x00000000},
+        {0x0000a224, 0x00000000},
+        {0x0000a228, 0x10002310},
+        {0x0000a23c, 0x00000000},
+        {0x0000a244, 0x0c000000},
+        {0x0000a2a0, 0x00000001},
+        {0x0000a2c0, 0x00000001},
+        {0x0000a2c8, 0x00000000},
+        {0x0000a2cc, 0x18c43433},
+        {0x0000a2d4, 0x00000000},
+        {0x0000a2ec, 0x00000000},
+        {0x0000a2f0, 0x00000000},
+        {0x0000a2f4, 0x00000000},
+        {0x0000a2f8, 0x00000000},
+        {0x0000a344, 0x00000000},
+        {0x0000a34c, 0x00000000},
+        {0x0000a350, 0x0000a000},
+        {0x0000a364, 0x00000000},
+        {0x0000a370, 0x00000000},
+        {0x0000a390, 0x00000001},
+        {0x0000a394, 0x00000444},
+        {0x0000a398, 0x001f0e0f},
+        {0x0000a39c, 0x0075393f},
+        {0x0000a3a0, 0xb79f6427},
+        {0x0000a3c0, 0x20202020},
+        {0x0000a3c4, 0x22222220},
+        {0x0000a3c8, 0x20200020},
+        {0x0000a3cc, 0x20202020},
+        {0x0000a3d0, 0x20202020},
+        {0x0000a3d4, 0x20202020},
+        {0x0000a3d8, 0x20202020},
+        {0x0000a3dc, 0x20202020},
+        {0x0000a3e0, 0x20202020},
+        {0x0000a3e4, 0x20202020},
+        {0x0000a3e8, 0x20202020},
+        {0x0000a3ec, 0x20202020},
+        {0x0000a3f0, 0x00000000},
+        {0x0000a3f4, 0x00000006},
+        {0x0000a3f8, 0x0c9bd380},
+        {0x0000a3fc, 0x000f0f01},
+        {0x0000a400, 0x8fa91f01},
+        {0x0000a404, 0x00000000},
+        {0x0000a408, 0x0e79e5c6},
+        {0x0000a40c, 0x00820820},
+        {0x0000a414, 0x1ce739ce},
+        {0x0000a418, 0x2d001dce},
+        {0x0000a434, 0x00000000},
+        {0x0000a438, 0x00001801},
+        {0x0000a43c, 0x00100000},
+        {0x0000a444, 0x00000000},
+        {0x0000a448, 0x05000080},
+        {0x0000a44c, 0x00000001},
+        {0x0000a450, 0x00010000},
+        {0x0000a454, 0x07000000},
+        {0x0000a644, 0xbfad9d74},
+        {0x0000a648, 0x0048060a},
+        {0x0000a64c, 0x00002037},
+        {0x0000a670, 0x03020100},
+        {0x0000a674, 0x09080504},
+        {0x0000a678, 0x0d0c0b0a},
+        {0x0000a67c, 0x13121110},
+        {0x0000a680, 0x31301514},
+        {0x0000a684, 0x35343332},
+        {0x0000a688, 0x00000036},
+        {0x0000a690, 0x00000838},
+        {0x0000a6b0, 0x0000000a},
+        {0x0000a6b4, 0x00512c01},
+        {0x0000a7c0, 0x00000000},
+        {0x0000a7c4, 0xfffffffc},
+        {0x0000a7c8, 0x00000000},
+        {0x0000a7cc, 0x00000000},
+        {0x0000a7d0, 0x00000000},
+        {0x0000a7d4, 0x00000004},
+        {0x0000a7dc, 0x00000000},
+        {0x0000a7f0, 0x80000000},
+        {0x0000a8d0, 0x004b6a8e},
+        {0x0000a8d4, 0x00000820},
+        {0x0000a8dc, 0x00000000},
+        {0x0000a8f0, 0x00000000},
+        {0x0000a8f4, 0x00000000},
+        {0x0000abf0, 0x80000000},
+        {0x0000b2d0, 0x00000080},
+        {0x0000b2d4, 0x00000000},
+        {0x0000b2ec, 0x00000000},
+        {0x0000b2f0, 0x00000000},
+        {0x0000b2f4, 0x00000000},
+        {0x0000b2f8, 0x00000000},
+        {0x0000b408, 0x0e79e5c0},
+        {0x0000b40c, 0x00820820},
+        {0x0000b420, 0x00000000},
+        {0x0000b6b0, 0x0000000a},
+        {0x0000b6b4, 0x00000001},
+};
+
+static const u32 ar9462_2p1_baseband_postamble[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x00009810, 0xd00a8005, 0xd00a8005, 0xd00a8011, 0xd00a800d},
+        {0x00009820, 0x206a022e, 0x206a022e, 0x206a012e, 0x206a01ae},
+        {0x00009824, 0x63c640de, 0x5ac640d0, 0x5ac640d0, 0x63c640da},
+        {0x00009828, 0x0796be89, 0x0696b081, 0x0696b881, 0x09143e81},
+        {0x0000982c, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4},
+        {0x00009830, 0x0000059c, 0x0000059c, 0x0000119c, 0x0000119c},
+        {0x00009c00, 0x000000c4, 0x000000c4, 0x000000c4, 0x000000c4},
+        {0x00009e00, 0x0372111a, 0x0372111a, 0x037216a0, 0x037216a2},
+        {0x00009e04, 0x001c2020, 0x001c2020, 0x001c2020, 0x001c2020},
+        {0x00009e0c, 0x6c4000e2, 0x6d4000e2, 0x6d4000e2, 0x6c4000d8},
+        {0x00009e10, 0x92c88d2e, 0x7ec88d2e, 0x7ec84d2e, 0x7ec86d2e},
+        {0x00009e14, 0x37b95d5e, 0x37b9605e, 0x3236605e, 0x32365a5e},
+        {0x00009e18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x00009e1c, 0x0001cf9c, 0x0001cf9c, 0x00021f9c, 0x00021f9c},
+        {0x00009e20, 0x000003b5, 0x000003b5, 0x000003ce, 0x000003ce},
+        {0x00009e2c, 0x0000001c, 0x0000001c, 0x00000021, 0x00000021},
+        {0x00009e3c, 0xcf946220, 0xcf946220, 0xcfd5c782, 0xcfd5c282},
+        {0x00009e44, 0x62321e27, 0x62321e27, 0xfe291e27, 0xfe291e27},
+        {0x00009e48, 0x5030201a, 0x5030201a, 0x50302012, 0x50302012},
+        {0x00009fc8, 0x0003f000, 0x0003f000, 0x0001a000, 0x0001a000},
+        {0x0000a204, 0x01318fc0, 0x01318fc4, 0x01318fc4, 0x01318fc0},
+        {0x0000a208, 0x00000104, 0x00000104, 0x00000004, 0x00000004},
+        {0x0000a22c, 0x01026a2f, 0x01026a27, 0x01026a2f, 0x01026a2f},
+        {0x0000a230, 0x0000400a, 0x00004014, 0x00004016, 0x0000400b},
+        {0x0000a234, 0x00000fff, 0x10000fff, 0x10000fff, 0x00000fff},
+        {0x0000a238, 0xffb81018, 0xffb81018, 0xffb81018, 0xffb81018},
+        {0x0000a250, 0x00000000, 0x00000000, 0x00000210, 0x00000108},
+        {0x0000a254, 0x000007d0, 0x00000fa0, 0x00001130, 0x00000898},
+        {0x0000a258, 0x02020002, 0x02020002, 0x02020002, 0x02020002},
+        {0x0000a25c, 0x01000e0e, 0x01000e0e, 0x01000e0e, 0x01000e0e},
+        {0x0000a260, 0x0a021501, 0x0a021501, 0x3a021501, 0x3a021501},
+        {0x0000a264, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e},
+        {0x0000a280, 0x00000007, 0x00000007, 0x0000000b, 0x0000000b},
+        {0x0000a284, 0x00000000, 0x00000000, 0x00000150, 0x00000150},
+        {0x0000a288, 0x00000110, 0x00000110, 0x00000110, 0x00000110},
+        {0x0000a28c, 0x00022222, 0x00022222, 0x00022222, 0x00022222},
+        {0x0000a2c4, 0x00158d18, 0x00158d18, 0x00158d18, 0x00158d18},
+        {0x0000a2d0, 0x00041981, 0x00041981, 0x00041981, 0x00041982},
+        {0x0000a2d8, 0x7999a83b, 0x7999a83b, 0x7999a83b, 0x7999a83b},
+        {0x0000a358, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a3a4, 0x00000050, 0x00000050, 0x00000000, 0x00000000},
+        {0x0000a3a8, 0xaaaaaaaa, 0xaaaaaaaa, 0xaaaaaaaa, 0xaaaaaaaa},
+        {0x0000a3ac, 0xaaaaaa00, 0xaa30aa30, 0xaaaaaa00, 0xaaaaaa00},
+        {0x0000a41c, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce},
+        {0x0000a420, 0x000001ce, 0x000001ce, 0x000001ce, 0x000001ce},
+        {0x0000a424, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce},
+        {0x0000a428, 0x000001ce, 0x000001ce, 0x000001ce, 0x000001ce},
+        {0x0000a42c, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce},
+        {0x0000a430, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce},
+        {0x0000a830, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
+        {0x0000ae04, 0x001c0000, 0x001c0000, 0x001c0000, 0x00100000},
+        {0x0000ae18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000ae1c, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
+        {0x0000ae20, 0x000001b5, 0x000001b5, 0x000001ce, 0x000001ce},
+        {0x0000b284, 0x00000000, 0x00000000, 0x00000550, 0x00000550},
+};
+
+static const u32 ar9462_2p1_radio_core[][2] = {
+        /* Addr      allmodes  */
+        {0x00016000, 0x36db6db6},
+        {0x00016004, 0x6db6db40},
+        {0x00016008, 0x73f00000},
+        {0x0001600c, 0x00000000},
+        {0x00016010, 0x6d820001},
+        {0x00016040, 0x7f80fff8},
+        {0x0001604c, 0x2699e04f},
+        {0x00016050, 0x6db6db6c},
+        {0x00016058, 0x6c200000},
+        {0x00016080, 0x000c0000},
+        {0x00016084, 0x9a68048c},
+        {0x00016088, 0x54214514},
+        {0x0001608c, 0x1203040b},
+        {0x00016090, 0x24926490},
+        {0x00016098, 0xd2888888},
+        {0x000160a0, 0x0a108ffe},
+        {0x000160a4, 0x812fc491},
+        {0x000160a8, 0x423c8000},
+        {0x000160b4, 0x92000000},
+        {0x000160b8, 0x0285dddc},
+        {0x000160bc, 0x02908888},
+        {0x000160c0, 0x00adb6d0},
+        {0x000160c4, 0x6db6db60},
+        {0x000160c8, 0x6db6db6c},
+        {0x000160cc, 0x0de6c1b0},
+        {0x00016100, 0x3fffbe04},
+        {0x00016104, 0xfff80000},
+        {0x00016108, 0x00200400},
+        {0x00016110, 0x00000000},
+        {0x00016144, 0x02084080},
+        {0x00016148, 0x000080c0},
+        {0x00016280, 0x050a0001},
+        {0x00016284, 0x3d841418},
+        {0x00016288, 0x00000000},
+        {0x0001628c, 0xe3000000},
+        {0x00016290, 0xa1005080},
+        {0x00016294, 0x00000020},
+        {0x00016298, 0x54a82900},
+        {0x00016340, 0x121e4276},
+        {0x00016344, 0x00300000},
+        {0x00016400, 0x36db6db6},
+        {0x00016404, 0x6db6db40},
+        {0x00016408, 0x73f00000},
+        {0x0001640c, 0x00000000},
+        {0x00016410, 0x6c800001},
+        {0x00016440, 0x7f80fff8},
+        {0x0001644c, 0x4699e04f},
+        {0x00016450, 0x6db6db6c},
+        {0x00016500, 0x3fffbe04},
+        {0x00016504, 0xfff80000},
+        {0x00016508, 0x00200400},
+        {0x00016510, 0x00000000},
+        {0x00016544, 0x02084080},
+        {0x00016548, 0x000080c0},
+};
+
+static const u32 ar9462_2p1_radio_postamble[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x0001609c, 0x0b8ee524, 0x0b8ee524, 0x0b8ee524, 0x0b8ee524},
+        {0x000160b0, 0x01d67f70, 0x01d67f70, 0x01d67f70, 0x01d67f70},
+        {0x0001610c, 0x48000000, 0x40000000, 0x40000000, 0x40000000},
+        {0x0001650c, 0x48000000, 0x40000000, 0x40000000, 0x40000000},
+};
+
+static const u32 ar9462_2p1_soc_preamble[][2] = {
+        /* Addr      allmodes  */
+        {0x000040a4, 0x00a0c1c9},
+        {0x00007020, 0x00000000},
+        {0x00007034, 0x00000002},
+        {0x00007038, 0x000004c2},
+};
+
+static const u32 ar9462_2p1_soc_postamble[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x00007010, 0x00000033, 0x00000033, 0x00000033, 0x00000033},
+};
+
+static const u32 ar9462_2p1_radio_postamble_sys2ant[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x000160ac, 0xa4646c08, 0xa4646c08, 0x24645808, 0x24645808},
+        {0x00016140, 0x10804008, 0x10804008, 0x50804008, 0x50804008},
+        {0x00016540, 0x10804008, 0x10804008, 0x50804008, 0x50804008},
+};
+
+static const u32 ar9462_2p1_common_rx_gain[][2] = {
+        /* Addr      allmodes  */
+        {0x0000a000, 0x00010000},
+        {0x0000a004, 0x00030002},
+        {0x0000a008, 0x00050004},
+        {0x0000a00c, 0x00810080},
+        {0x0000a010, 0x00830082},
+        {0x0000a014, 0x01810180},
+        {0x0000a018, 0x01830182},
+        {0x0000a01c, 0x01850184},
+        {0x0000a020, 0x01890188},
+        {0x0000a024, 0x018b018a},
+        {0x0000a028, 0x018d018c},
+        {0x0000a02c, 0x01910190},
+        {0x0000a030, 0x01930192},
+        {0x0000a034, 0x01950194},
+        {0x0000a038, 0x038a0196},
+        {0x0000a03c, 0x038c038b},
+        {0x0000a040, 0x0390038d},
+        {0x0000a044, 0x03920391},
+        {0x0000a048, 0x03940393},
+        {0x0000a04c, 0x03960395},
+        {0x0000a050, 0x00000000},
+        {0x0000a054, 0x00000000},
+        {0x0000a058, 0x00000000},
+        {0x0000a05c, 0x00000000},
+        {0x0000a060, 0x00000000},
+        {0x0000a064, 0x00000000},
+        {0x0000a068, 0x00000000},
+        {0x0000a06c, 0x00000000},
+        {0x0000a070, 0x00000000},
+        {0x0000a074, 0x00000000},
+        {0x0000a078, 0x00000000},
+        {0x0000a07c, 0x00000000},
+        {0x0000a080, 0x22222229},
+        {0x0000a084, 0x1d1d1d1d},
+        {0x0000a088, 0x1d1d1d1d},
+        {0x0000a08c, 0x1d1d1d1d},
+        {0x0000a090, 0x171d1d1d},
+        {0x0000a094, 0x11111717},
+        {0x0000a098, 0x00030311},
+        {0x0000a09c, 0x00000000},
+        {0x0000a0a0, 0x00000000},
+        {0x0000a0a4, 0x00000000},
+        {0x0000a0a8, 0x00000000},
+        {0x0000a0ac, 0x00000000},
+        {0x0000a0b0, 0x00000000},
+        {0x0000a0b4, 0x00000000},
+        {0x0000a0b8, 0x00000000},
+        {0x0000a0bc, 0x00000000},
+        {0x0000a0c0, 0x001f0000},
+        {0x0000a0c4, 0x01000101},
+        {0x0000a0c8, 0x011e011f},
+        {0x0000a0cc, 0x011c011d},
+        {0x0000a0d0, 0x02030204},
+        {0x0000a0d4, 0x02010202},
+        {0x0000a0d8, 0x021f0200},
+        {0x0000a0dc, 0x0302021e},
+        {0x0000a0e0, 0x03000301},
+        {0x0000a0e4, 0x031e031f},
+        {0x0000a0e8, 0x0402031d},
+        {0x0000a0ec, 0x04000401},
+        {0x0000a0f0, 0x041e041f},
+        {0x0000a0f4, 0x0502041d},
+        {0x0000a0f8, 0x05000501},
+        {0x0000a0fc, 0x051e051f},
+        {0x0000a100, 0x06010602},
+        {0x0000a104, 0x061f0600},
+        {0x0000a108, 0x061d061e},
+        {0x0000a10c, 0x07020703},
+        {0x0000a110, 0x07000701},
+        {0x0000a114, 0x00000000},
+        {0x0000a118, 0x00000000},
+        {0x0000a11c, 0x00000000},
+        {0x0000a120, 0x00000000},
+        {0x0000a124, 0x00000000},
+        {0x0000a128, 0x00000000},
+        {0x0000a12c, 0x00000000},
+        {0x0000a130, 0x00000000},
+        {0x0000a134, 0x00000000},
+        {0x0000a138, 0x00000000},
+        {0x0000a13c, 0x00000000},
+        {0x0000a140, 0x001f0000},
+        {0x0000a144, 0x01000101},
+        {0x0000a148, 0x011e011f},
+        {0x0000a14c, 0x011c011d},
+        {0x0000a150, 0x02030204},
+        {0x0000a154, 0x02010202},
+        {0x0000a158, 0x021f0200},
+        {0x0000a15c, 0x0302021e},
+        {0x0000a160, 0x03000301},
+        {0x0000a164, 0x031e031f},
+        {0x0000a168, 0x0402031d},
+        {0x0000a16c, 0x04000401},
+        {0x0000a170, 0x041e041f},
+        {0x0000a174, 0x0502041d},
+        {0x0000a178, 0x05000501},
+        {0x0000a17c, 0x051e051f},
+        {0x0000a180, 0x06010602},
+        {0x0000a184, 0x061f0600},
+        {0x0000a188, 0x061d061e},
+        {0x0000a18c, 0x07020703},
+        {0x0000a190, 0x07000701},
+        {0x0000a194, 0x00000000},
+        {0x0000a198, 0x00000000},
+        {0x0000a19c, 0x00000000},
+        {0x0000a1a0, 0x00000000},
+        {0x0000a1a4, 0x00000000},
+        {0x0000a1a8, 0x00000000},
+        {0x0000a1ac, 0x00000000},
+        {0x0000a1b0, 0x00000000},
+        {0x0000a1b4, 0x00000000},
+        {0x0000a1b8, 0x00000000},
+        {0x0000a1bc, 0x00000000},
+        {0x0000a1c0, 0x00000000},
+        {0x0000a1c4, 0x00000000},
+        {0x0000a1c8, 0x00000000},
+        {0x0000a1cc, 0x00000000},
+        {0x0000a1d0, 0x00000000},
+        {0x0000a1d4, 0x00000000},
+        {0x0000a1d8, 0x00000000},
+        {0x0000a1dc, 0x00000000},
+        {0x0000a1e0, 0x00000000},
+        {0x0000a1e4, 0x00000000},
+        {0x0000a1e8, 0x00000000},
+        {0x0000a1ec, 0x00000000},
+        {0x0000a1f0, 0x00000396},
+        {0x0000a1f4, 0x00000396},
+        {0x0000a1f8, 0x00000396},
+        {0x0000a1fc, 0x00000196},
+        {0x0000b000, 0x00010000},
+        {0x0000b004, 0x00030002},
+        {0x0000b008, 0x00050004},
+        {0x0000b00c, 0x00810080},
+        {0x0000b010, 0x00830082},
+        {0x0000b014, 0x01810180},
+        {0x0000b018, 0x01830182},
+        {0x0000b01c, 0x01850184},
+        {0x0000b020, 0x02810280},
+        {0x0000b024, 0x02830282},
+        {0x0000b028, 0x02850284},
+        {0x0000b02c, 0x02890288},
+        {0x0000b030, 0x028b028a},
+        {0x0000b034, 0x0388028c},
+        {0x0000b038, 0x038a0389},
+        {0x0000b03c, 0x038c038b},
+        {0x0000b040, 0x0390038d},
+        {0x0000b044, 0x03920391},
+        {0x0000b048, 0x03940393},
+        {0x0000b04c, 0x03960395},
+        {0x0000b050, 0x00000000},
+        {0x0000b054, 0x00000000},
+        {0x0000b058, 0x00000000},
+        {0x0000b05c, 0x00000000},
+        {0x0000b060, 0x00000000},
+        {0x0000b064, 0x00000000},
+        {0x0000b068, 0x00000000},
+        {0x0000b06c, 0x00000000},
+        {0x0000b070, 0x00000000},
+        {0x0000b074, 0x00000000},
+        {0x0000b078, 0x00000000},
+        {0x0000b07c, 0x00000000},
+        {0x0000b080, 0x2a2d2f32},
+        {0x0000b084, 0x21232328},
+        {0x0000b088, 0x19191c1e},
+        {0x0000b08c, 0x12141417},
+        {0x0000b090, 0x07070e0e},
+        {0x0000b094, 0x03030305},
+        {0x0000b098, 0x00000003},
+        {0x0000b09c, 0x00000000},
+        {0x0000b0a0, 0x00000000},
+        {0x0000b0a4, 0x00000000},
+        {0x0000b0a8, 0x00000000},
+        {0x0000b0ac, 0x00000000},
+        {0x0000b0b0, 0x00000000},
+        {0x0000b0b4, 0x00000000},
+        {0x0000b0b8, 0x00000000},
+        {0x0000b0bc, 0x00000000},
+        {0x0000b0c0, 0x003f0020},
+        {0x0000b0c4, 0x00400041},
+        {0x0000b0c8, 0x0140005f},
+        {0x0000b0cc, 0x0160015f},
+        {0x0000b0d0, 0x017e017f},
+        {0x0000b0d4, 0x02410242},
+        {0x0000b0d8, 0x025f0240},
+        {0x0000b0dc, 0x027f0260},
+        {0x0000b0e0, 0x0341027e},
+        {0x0000b0e4, 0x035f0340},
+        {0x0000b0e8, 0x037f0360},
+        {0x0000b0ec, 0x04400441},
+        {0x0000b0f0, 0x0460045f},
+        {0x0000b0f4, 0x0541047f},
+        {0x0000b0f8, 0x055f0540},
+        {0x0000b0fc, 0x057f0560},
+        {0x0000b100, 0x06400641},
+        {0x0000b104, 0x0660065f},
+        {0x0000b108, 0x067e067f},
+        {0x0000b10c, 0x07410742},
+        {0x0000b110, 0x075f0740},
+        {0x0000b114, 0x077f0760},
+        {0x0000b118, 0x07800781},
+        {0x0000b11c, 0x07a0079f},
+        {0x0000b120, 0x07c107bf},
+        {0x0000b124, 0x000007c0},
+        {0x0000b128, 0x00000000},
+        {0x0000b12c, 0x00000000},
+        {0x0000b130, 0x00000000},
+        {0x0000b134, 0x00000000},
+        {0x0000b138, 0x00000000},
+        {0x0000b13c, 0x00000000},
+        {0x0000b140, 0x003f0020},
+        {0x0000b144, 0x00400041},
+        {0x0000b148, 0x0140005f},
+        {0x0000b14c, 0x0160015f},
+        {0x0000b150, 0x017e017f},
+        {0x0000b154, 0x02410242},
+        {0x0000b158, 0x025f0240},
+        {0x0000b15c, 0x027f0260},
+        {0x0000b160, 0x0341027e},
+        {0x0000b164, 0x035f0340},
+        {0x0000b168, 0x037f0360},
+        {0x0000b16c, 0x04400441},
+        {0x0000b170, 0x0460045f},
+        {0x0000b174, 0x0541047f},
+        {0x0000b178, 0x055f0540},
+        {0x0000b17c, 0x057f0560},
+        {0x0000b180, 0x06400641},
+        {0x0000b184, 0x0660065f},
+        {0x0000b188, 0x067e067f},
+        {0x0000b18c, 0x07410742},
+        {0x0000b190, 0x075f0740},
+        {0x0000b194, 0x077f0760},
+        {0x0000b198, 0x07800781},
+        {0x0000b19c, 0x07a0079f},
+        {0x0000b1a0, 0x07c107bf},
+        {0x0000b1a4, 0x000007c0},
+        {0x0000b1a8, 0x00000000},
+        {0x0000b1ac, 0x00000000},
+        {0x0000b1b0, 0x00000000},
+        {0x0000b1b4, 0x00000000},
+        {0x0000b1b8, 0x00000000},
+        {0x0000b1bc, 0x00000000},
+        {0x0000b1c0, 0x00000000},
+        {0x0000b1c4, 0x00000000},
+        {0x0000b1c8, 0x00000000},
+        {0x0000b1cc, 0x00000000},
+        {0x0000b1d0, 0x00000000},
+        {0x0000b1d4, 0x00000000},
+        {0x0000b1d8, 0x00000000},
+        {0x0000b1dc, 0x00000000},
+        {0x0000b1e0, 0x00000000},
+        {0x0000b1e4, 0x00000000},
+        {0x0000b1e8, 0x00000000},
+        {0x0000b1ec, 0x00000000},
+        {0x0000b1f0, 0x00000396},
+        {0x0000b1f4, 0x00000396},
+        {0x0000b1f8, 0x00000396},
+        {0x0000b1fc, 0x00000196},
+};
+
+static const u32 ar9462_2p1_common_mixed_rx_gain[][2] = {
+        /* Addr      allmodes  */
+        {0x0000a000, 0x00010000},
+        {0x0000a004, 0x00030002},
+        {0x0000a008, 0x00050004},
+        {0x0000a00c, 0x00810080},
+        {0x0000a010, 0x00830082},
+        {0x0000a014, 0x01810180},
+        {0x0000a018, 0x01830182},
+        {0x0000a01c, 0x01850184},
+        {0x0000a020, 0x01890188},
+        {0x0000a024, 0x018b018a},
+        {0x0000a028, 0x018d018c},
+        {0x0000a02c, 0x03820190},
+        {0x0000a030, 0x03840383},
+        {0x0000a034, 0x03880385},
+        {0x0000a038, 0x038a0389},
+        {0x0000a03c, 0x038c038b},
+        {0x0000a040, 0x0390038d},
+        {0x0000a044, 0x03920391},
+        {0x0000a048, 0x03940393},
+        {0x0000a04c, 0x03960395},
+        {0x0000a050, 0x00000000},
+        {0x0000a054, 0x00000000},
+        {0x0000a058, 0x00000000},
+        {0x0000a05c, 0x00000000},
+        {0x0000a060, 0x00000000},
+        {0x0000a064, 0x00000000},
+        {0x0000a068, 0x00000000},
+        {0x0000a06c, 0x00000000},
+        {0x0000a070, 0x00000000},
+        {0x0000a074, 0x00000000},
+        {0x0000a078, 0x00000000},
+        {0x0000a07c, 0x00000000},
+        {0x0000a080, 0x29292929},
+        {0x0000a084, 0x29292929},
+        {0x0000a088, 0x29292929},
+        {0x0000a08c, 0x29292929},
+        {0x0000a090, 0x22292929},
+        {0x0000a094, 0x1d1d2222},
+        {0x0000a098, 0x0c111117},
+        {0x0000a09c, 0x00030303},
+        {0x0000a0a0, 0x00000000},
+        {0x0000a0a4, 0x00000000},
+        {0x0000a0a8, 0x00000000},
+        {0x0000a0ac, 0x00000000},
+        {0x0000a0b0, 0x00000000},
+        {0x0000a0b4, 0x00000000},
+        {0x0000a0b8, 0x00000000},
+        {0x0000a0bc, 0x00000000},
+        {0x0000a0c0, 0x001f0000},
+        {0x0000a0c4, 0x01000101},
+        {0x0000a0c8, 0x011e011f},
+        {0x0000a0cc, 0x011c011d},
+        {0x0000a0d0, 0x02030204},
+        {0x0000a0d4, 0x02010202},
+        {0x0000a0d8, 0x021f0200},
+        {0x0000a0dc, 0x0302021e},
+        {0x0000a0e0, 0x03000301},
+        {0x0000a0e4, 0x031e031f},
+        {0x0000a0e8, 0x0402031d},
+        {0x0000a0ec, 0x04000401},
+        {0x0000a0f0, 0x041e041f},
+        {0x0000a0f4, 0x0502041d},
+        {0x0000a0f8, 0x05000501},
+        {0x0000a0fc, 0x051e051f},
+        {0x0000a100, 0x06010602},
+        {0x0000a104, 0x061f0600},
+        {0x0000a108, 0x061d061e},
+        {0x0000a10c, 0x07020703},
+        {0x0000a110, 0x07000701},
+        {0x0000a114, 0x00000000},
+        {0x0000a118, 0x00000000},
+        {0x0000a11c, 0x00000000},
+        {0x0000a120, 0x00000000},
+        {0x0000a124, 0x00000000},
+        {0x0000a128, 0x00000000},
+        {0x0000a12c, 0x00000000},
+        {0x0000a130, 0x00000000},
+        {0x0000a134, 0x00000000},
+        {0x0000a138, 0x00000000},
+        {0x0000a13c, 0x00000000},
+        {0x0000a140, 0x001f0000},
+        {0x0000a144, 0x01000101},
+        {0x0000a148, 0x011e011f},
+        {0x0000a14c, 0x011c011d},
+        {0x0000a150, 0x02030204},
+        {0x0000a154, 0x02010202},
+        {0x0000a158, 0x021f0200},
+        {0x0000a15c, 0x0302021e},
+        {0x0000a160, 0x03000301},
+        {0x0000a164, 0x031e031f},
+        {0x0000a168, 0x0402031d},
+        {0x0000a16c, 0x04000401},
+        {0x0000a170, 0x041e041f},
+        {0x0000a174, 0x0502041d},
+        {0x0000a178, 0x05000501},
+        {0x0000a17c, 0x051e051f},
+        {0x0000a180, 0x06010602},
+        {0x0000a184, 0x061f0600},
+        {0x0000a188, 0x061d061e},
+        {0x0000a18c, 0x07020703},
+        {0x0000a190, 0x07000701},
+        {0x0000a194, 0x00000000},
+        {0x0000a198, 0x00000000},
+        {0x0000a19c, 0x00000000},
+        {0x0000a1a0, 0x00000000},
+        {0x0000a1a4, 0x00000000},
+        {0x0000a1a8, 0x00000000},
+        {0x0000a1ac, 0x00000000},
+        {0x0000a1b0, 0x00000000},
+        {0x0000a1b4, 0x00000000},
+        {0x0000a1b8, 0x00000000},
+        {0x0000a1bc, 0x00000000},
+        {0x0000a1c0, 0x00000000},
+        {0x0000a1c4, 0x00000000},
+        {0x0000a1c8, 0x00000000},
+        {0x0000a1cc, 0x00000000},
+        {0x0000a1d0, 0x00000000},
+        {0x0000a1d4, 0x00000000},
+        {0x0000a1d8, 0x00000000},
+        {0x0000a1dc, 0x00000000},
+        {0x0000a1e0, 0x00000000},
+        {0x0000a1e4, 0x00000000},
+        {0x0000a1e8, 0x00000000},
+        {0x0000a1ec, 0x00000000},
+        {0x0000a1f0, 0x00000396},
+        {0x0000a1f4, 0x00000396},
+        {0x0000a1f8, 0x00000396},
+        {0x0000a1fc, 0x00000196},
+        {0x0000b000, 0x00010000},
+        {0x0000b004, 0x00030002},
+        {0x0000b008, 0x00050004},
+        {0x0000b00c, 0x00810080},
+        {0x0000b010, 0x00830082},
+        {0x0000b014, 0x01810180},
+        {0x0000b018, 0x01830182},
+        {0x0000b01c, 0x01850184},
+        {0x0000b020, 0x02810280},
+        {0x0000b024, 0x02830282},
+        {0x0000b028, 0x02850284},
+        {0x0000b02c, 0x02890288},
+        {0x0000b030, 0x028b028a},
+        {0x0000b034, 0x0388028c},
+        {0x0000b038, 0x038a0389},
+        {0x0000b03c, 0x038c038b},
+        {0x0000b040, 0x0390038d},
+        {0x0000b044, 0x03920391},
+        {0x0000b048, 0x03940393},
+        {0x0000b04c, 0x03960395},
+        {0x0000b050, 0x00000000},
+        {0x0000b054, 0x00000000},
+        {0x0000b058, 0x00000000},
+        {0x0000b05c, 0x00000000},
+        {0x0000b060, 0x00000000},
+        {0x0000b064, 0x00000000},
+        {0x0000b068, 0x00000000},
+        {0x0000b06c, 0x00000000},
+        {0x0000b070, 0x00000000},
+        {0x0000b074, 0x00000000},
+        {0x0000b078, 0x00000000},
+        {0x0000b07c, 0x00000000},
+        {0x0000b080, 0x2a2d2f32},
+        {0x0000b084, 0x21232328},
+        {0x0000b088, 0x19191c1e},
+        {0x0000b08c, 0x12141417},
+        {0x0000b090, 0x07070e0e},
+        {0x0000b094, 0x03030305},
+        {0x0000b098, 0x00000003},
+        {0x0000b09c, 0x00000000},
+        {0x0000b0a0, 0x00000000},
+        {0x0000b0a4, 0x00000000},
+        {0x0000b0a8, 0x00000000},
+        {0x0000b0ac, 0x00000000},
+        {0x0000b0b0, 0x00000000},
+        {0x0000b0b4, 0x00000000},
+        {0x0000b0b8, 0x00000000},
+        {0x0000b0bc, 0x00000000},
+        {0x0000b0c0, 0x003f0020},
+        {0x0000b0c4, 0x00400041},
+        {0x0000b0c8, 0x0140005f},
+        {0x0000b0cc, 0x0160015f},
+        {0x0000b0d0, 0x017e017f},
+        {0x0000b0d4, 0x02410242},
+        {0x0000b0d8, 0x025f0240},
+        {0x0000b0dc, 0x027f0260},
+        {0x0000b0e0, 0x0341027e},
+        {0x0000b0e4, 0x035f0340},
+        {0x0000b0e8, 0x037f0360},
+        {0x0000b0ec, 0x04400441},
+        {0x0000b0f0, 0x0460045f},
+        {0x0000b0f4, 0x0541047f},
+        {0x0000b0f8, 0x055f0540},
+        {0x0000b0fc, 0x057f0560},
+        {0x0000b100, 0x06400641},
+        {0x0000b104, 0x0660065f},
+        {0x0000b108, 0x067e067f},
+        {0x0000b10c, 0x07410742},
+        {0x0000b110, 0x075f0740},
+        {0x0000b114, 0x077f0760},
+        {0x0000b118, 0x07800781},
+        {0x0000b11c, 0x07a0079f},
+        {0x0000b120, 0x07c107bf},
+        {0x0000b124, 0x000007c0},
+        {0x0000b128, 0x00000000},
+        {0x0000b12c, 0x00000000},
+        {0x0000b130, 0x00000000},
+        {0x0000b134, 0x00000000},
+        {0x0000b138, 0x00000000},
+        {0x0000b13c, 0x00000000},
+        {0x0000b140, 0x003f0020},
+        {0x0000b144, 0x00400041},
+        {0x0000b148, 0x0140005f},
+        {0x0000b14c, 0x0160015f},
+        {0x0000b150, 0x017e017f},
+        {0x0000b154, 0x02410242},
+        {0x0000b158, 0x025f0240},
+        {0x0000b15c, 0x027f0260},
+        {0x0000b160, 0x0341027e},
+        {0x0000b164, 0x035f0340},
+        {0x0000b168, 0x037f0360},
+        {0x0000b16c, 0x04400441},
+        {0x0000b170, 0x0460045f},
+        {0x0000b174, 0x0541047f},
+        {0x0000b178, 0x055f0540},
+        {0x0000b17c, 0x057f0560},
+        {0x0000b180, 0x06400641},
+        {0x0000b184, 0x0660065f},
+        {0x0000b188, 0x067e067f},
+        {0x0000b18c, 0x07410742},
+        {0x0000b190, 0x075f0740},
+        {0x0000b194, 0x077f0760},
+        {0x0000b198, 0x07800781},
+        {0x0000b19c, 0x07a0079f},
+        {0x0000b1a0, 0x07c107bf},
+        {0x0000b1a4, 0x000007c0},
+        {0x0000b1a8, 0x00000000},
+        {0x0000b1ac, 0x00000000},
+        {0x0000b1b0, 0x00000000},
+        {0x0000b1b4, 0x00000000},
+        {0x0000b1b8, 0x00000000},
+        {0x0000b1bc, 0x00000000},
+        {0x0000b1c0, 0x00000000},
+        {0x0000b1c4, 0x00000000},
+        {0x0000b1c8, 0x00000000},
+        {0x0000b1cc, 0x00000000},
+        {0x0000b1d0, 0x00000000},
+        {0x0000b1d4, 0x00000000},
+        {0x0000b1d8, 0x00000000},
+        {0x0000b1dc, 0x00000000},
+        {0x0000b1e0, 0x00000000},
+        {0x0000b1e4, 0x00000000},
+        {0x0000b1e8, 0x00000000},
+        {0x0000b1ec, 0x00000000},
+        {0x0000b1f0, 0x00000396},
+        {0x0000b1f4, 0x00000396},
+        {0x0000b1f8, 0x00000396},
+        {0x0000b1fc, 0x00000196},
+};
+
+static const u32 ar9462_2p1_baseband_core_mix_rxgain[][2] = {
+        /* Addr      allmodes  */
+        {0x00009fd0, 0x0a2d6b93},
+};
+
+static const u32 ar9462_2p1_baseband_postamble_mix_rxgain[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x00009820, 0x206a022e, 0x206a022e, 0x206a01ae, 0x206a01ae},
+        {0x00009824, 0x63c640de, 0x5ac640d0, 0x63c640da, 0x63c640da},
+        {0x00009828, 0x0796be89, 0x0696b081, 0x0916be81, 0x0916be81},
+        {0x00009e0c, 0x6c4000e2, 0x6d4000e2, 0x6d4000d8, 0x6c4000d8},
+        {0x00009e10, 0x92c88d2e, 0x7ec88d2e, 0x7ec86d2e, 0x7ec86d2e},
+        {0x00009e14, 0x37b95d5e, 0x37b9605e, 0x3236605e, 0x32395c5e},
+};
+
+static const u32 ar9462_2p1_baseband_postamble_5g_xlna[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x00009e3c, 0xcf946220, 0xcf946220, 0xcfd5c782, 0xcfd5c282},
+};
+
+static const u32 ar9462_2p1_common_wo_xlna_rx_gain[][2] = {
+        /* Addr      allmodes  */
+        {0x0000a000, 0x00010000},
+        {0x0000a004, 0x00030002},
+        {0x0000a008, 0x00050004},
+        {0x0000a00c, 0x00810080},
+        {0x0000a010, 0x00830082},
+        {0x0000a014, 0x01810180},
+        {0x0000a018, 0x01830182},
+        {0x0000a01c, 0x01850184},
+        {0x0000a020, 0x01890188},
+        {0x0000a024, 0x018b018a},
+        {0x0000a028, 0x018d018c},
+        {0x0000a02c, 0x03820190},
+        {0x0000a030, 0x03840383},
+        {0x0000a034, 0x03880385},
+        {0x0000a038, 0x038a0389},
+        {0x0000a03c, 0x038c038b},
+        {0x0000a040, 0x0390038d},
+        {0x0000a044, 0x03920391},
+        {0x0000a048, 0x03940393},
+        {0x0000a04c, 0x03960395},
+        {0x0000a050, 0x00000000},
+        {0x0000a054, 0x00000000},
+        {0x0000a058, 0x00000000},
+        {0x0000a05c, 0x00000000},
+        {0x0000a060, 0x00000000},
+        {0x0000a064, 0x00000000},
+        {0x0000a068, 0x00000000},
+        {0x0000a06c, 0x00000000},
+        {0x0000a070, 0x00000000},
+        {0x0000a074, 0x00000000},
+        {0x0000a078, 0x00000000},
+        {0x0000a07c, 0x00000000},
+        {0x0000a080, 0x29292929},
+        {0x0000a084, 0x29292929},
+        {0x0000a088, 0x29292929},
+        {0x0000a08c, 0x29292929},
+        {0x0000a090, 0x22292929},
+        {0x0000a094, 0x1d1d2222},
+        {0x0000a098, 0x0c111117},
+        {0x0000a09c, 0x00030303},
+        {0x0000a0a0, 0x00000000},
+        {0x0000a0a4, 0x00000000},
+        {0x0000a0a8, 0x00000000},
+        {0x0000a0ac, 0x00000000},
+        {0x0000a0b0, 0x00000000},
+        {0x0000a0b4, 0x00000000},
+        {0x0000a0b8, 0x00000000},
+        {0x0000a0bc, 0x00000000},
+        {0x0000a0c0, 0x001f0000},
+        {0x0000a0c4, 0x01000101},
+        {0x0000a0c8, 0x011e011f},
+        {0x0000a0cc, 0x011c011d},
+        {0x0000a0d0, 0x02030204},
+        {0x0000a0d4, 0x02010202},
+        {0x0000a0d8, 0x021f0200},
+        {0x0000a0dc, 0x0302021e},
+        {0x0000a0e0, 0x03000301},
+        {0x0000a0e4, 0x031e031f},
+        {0x0000a0e8, 0x0402031d},
+        {0x0000a0ec, 0x04000401},
+        {0x0000a0f0, 0x041e041f},
+        {0x0000a0f4, 0x0502041d},
+        {0x0000a0f8, 0x05000501},
+        {0x0000a0fc, 0x051e051f},
+        {0x0000a100, 0x06010602},
+        {0x0000a104, 0x061f0600},
+        {0x0000a108, 0x061d061e},
+        {0x0000a10c, 0x07020703},
+        {0x0000a110, 0x07000701},
+        {0x0000a114, 0x00000000},
+        {0x0000a118, 0x00000000},
+        {0x0000a11c, 0x00000000},
+        {0x0000a120, 0x00000000},
+        {0x0000a124, 0x00000000},
+        {0x0000a128, 0x00000000},
+        {0x0000a12c, 0x00000000},
+        {0x0000a130, 0x00000000},
+        {0x0000a134, 0x00000000},
+        {0x0000a138, 0x00000000},
+        {0x0000a13c, 0x00000000},
+        {0x0000a140, 0x001f0000},
+        {0x0000a144, 0x01000101},
+        {0x0000a148, 0x011e011f},
+        {0x0000a14c, 0x011c011d},
+        {0x0000a150, 0x02030204},
+        {0x0000a154, 0x02010202},
+        {0x0000a158, 0x021f0200},
+        {0x0000a15c, 0x0302021e},
+        {0x0000a160, 0x03000301},
+        {0x0000a164, 0x031e031f},
+        {0x0000a168, 0x0402031d},
+        {0x0000a16c, 0x04000401},
+        {0x0000a170, 0x041e041f},
+        {0x0000a174, 0x0502041d},
+        {0x0000a178, 0x05000501},
+        {0x0000a17c, 0x051e051f},
+        {0x0000a180, 0x06010602},
+        {0x0000a184, 0x061f0600},
+        {0x0000a188, 0x061d061e},
+        {0x0000a18c, 0x07020703},
+        {0x0000a190, 0x07000701},
+        {0x0000a194, 0x00000000},
+        {0x0000a198, 0x00000000},
+        {0x0000a19c, 0x00000000},
+        {0x0000a1a0, 0x00000000},
+        {0x0000a1a4, 0x00000000},
+        {0x0000a1a8, 0x00000000},
+        {0x0000a1ac, 0x00000000},
+        {0x0000a1b0, 0x00000000},
+        {0x0000a1b4, 0x00000000},
+        {0x0000a1b8, 0x00000000},
+        {0x0000a1bc, 0x00000000},
+        {0x0000a1c0, 0x00000000},
+        {0x0000a1c4, 0x00000000},
+        {0x0000a1c8, 0x00000000},
+        {0x0000a1cc, 0x00000000},
+        {0x0000a1d0, 0x00000000},
+        {0x0000a1d4, 0x00000000},
+        {0x0000a1d8, 0x00000000},
+        {0x0000a1dc, 0x00000000},
+        {0x0000a1e0, 0x00000000},
+        {0x0000a1e4, 0x00000000},
+        {0x0000a1e8, 0x00000000},
+        {0x0000a1ec, 0x00000000},
+        {0x0000a1f0, 0x00000396},
+        {0x0000a1f4, 0x00000396},
+        {0x0000a1f8, 0x00000396},
+        {0x0000a1fc, 0x00000196},
+        {0x0000b000, 0x00010000},
+        {0x0000b004, 0x00030002},
+        {0x0000b008, 0x00050004},
+        {0x0000b00c, 0x00810080},
+        {0x0000b010, 0x00830082},
+        {0x0000b014, 0x01810180},
+        {0x0000b018, 0x01830182},
+        {0x0000b01c, 0x01850184},
+        {0x0000b020, 0x02810280},
+        {0x0000b024, 0x02830282},
+        {0x0000b028, 0x02850284},
+        {0x0000b02c, 0x02890288},
+        {0x0000b030, 0x028b028a},
+        {0x0000b034, 0x0388028c},
+        {0x0000b038, 0x038a0389},
+        {0x0000b03c, 0x038c038b},
+        {0x0000b040, 0x0390038d},
+        {0x0000b044, 0x03920391},
+        {0x0000b048, 0x03940393},
+        {0x0000b04c, 0x03960395},
+        {0x0000b050, 0x00000000},
+        {0x0000b054, 0x00000000},
+        {0x0000b058, 0x00000000},
+        {0x0000b05c, 0x00000000},
+        {0x0000b060, 0x00000000},
+        {0x0000b064, 0x00000000},
+        {0x0000b068, 0x00000000},
+        {0x0000b06c, 0x00000000},
+        {0x0000b070, 0x00000000},
+        {0x0000b074, 0x00000000},
+        {0x0000b078, 0x00000000},
+        {0x0000b07c, 0x00000000},
+        {0x0000b080, 0x32323232},
+        {0x0000b084, 0x2f2f3232},
+        {0x0000b088, 0x23282a2d},
+        {0x0000b08c, 0x1c1e2123},
+        {0x0000b090, 0x14171919},
+        {0x0000b094, 0x0e0e1214},
+        {0x0000b098, 0x03050707},
+        {0x0000b09c, 0x00030303},
+        {0x0000b0a0, 0x00000000},
+        {0x0000b0a4, 0x00000000},
+        {0x0000b0a8, 0x00000000},
+        {0x0000b0ac, 0x00000000},
+        {0x0000b0b0, 0x00000000},
+        {0x0000b0b4, 0x00000000},
+        {0x0000b0b8, 0x00000000},
+        {0x0000b0bc, 0x00000000},
+        {0x0000b0c0, 0x003f0020},
+        {0x0000b0c4, 0x00400041},
+        {0x0000b0c8, 0x0140005f},
+        {0x0000b0cc, 0x0160015f},
+        {0x0000b0d0, 0x017e017f},
+        {0x0000b0d4, 0x02410242},
+        {0x0000b0d8, 0x025f0240},
+        {0x0000b0dc, 0x027f0260},
+        {0x0000b0e0, 0x0341027e},
+        {0x0000b0e4, 0x035f0340},
+        {0x0000b0e8, 0x037f0360},
+        {0x0000b0ec, 0x04400441},
+        {0x0000b0f0, 0x0460045f},
+        {0x0000b0f4, 0x0541047f},
+        {0x0000b0f8, 0x055f0540},
+        {0x0000b0fc, 0x057f0560},
+        {0x0000b100, 0x06400641},
+        {0x0000b104, 0x0660065f},
+        {0x0000b108, 0x067e067f},
+        {0x0000b10c, 0x07410742},
+        {0x0000b110, 0x075f0740},
+        {0x0000b114, 0x077f0760},
+        {0x0000b118, 0x07800781},
+        {0x0000b11c, 0x07a0079f},
+        {0x0000b120, 0x07c107bf},
+        {0x0000b124, 0x000007c0},
+        {0x0000b128, 0x00000000},
+        {0x0000b12c, 0x00000000},
+        {0x0000b130, 0x00000000},
+        {0x0000b134, 0x00000000},
+        {0x0000b138, 0x00000000},
+        {0x0000b13c, 0x00000000},
+        {0x0000b140, 0x003f0020},
+        {0x0000b144, 0x00400041},
+        {0x0000b148, 0x0140005f},
+        {0x0000b14c, 0x0160015f},
+        {0x0000b150, 0x017e017f},
+        {0x0000b154, 0x02410242},
+        {0x0000b158, 0x025f0240},
+        {0x0000b15c, 0x027f0260},
+        {0x0000b160, 0x0341027e},
+        {0x0000b164, 0x035f0340},
+        {0x0000b168, 0x037f0360},
+        {0x0000b16c, 0x04400441},
+        {0x0000b170, 0x0460045f},
+        {0x0000b174, 0x0541047f},
+        {0x0000b178, 0x055f0540},
+        {0x0000b17c, 0x057f0560},
+        {0x0000b180, 0x06400641},
+        {0x0000b184, 0x0660065f},
+        {0x0000b188, 0x067e067f},
+        {0x0000b18c, 0x07410742},
+        {0x0000b190, 0x075f0740},
+        {0x0000b194, 0x077f0760},
+        {0x0000b198, 0x07800781},
+        {0x0000b19c, 0x07a0079f},
+        {0x0000b1a0, 0x07c107bf},
+        {0x0000b1a4, 0x000007c0},
+        {0x0000b1a8, 0x00000000},
+        {0x0000b1ac, 0x00000000},
+        {0x0000b1b0, 0x00000000},
+        {0x0000b1b4, 0x00000000},
+        {0x0000b1b8, 0x00000000},
+        {0x0000b1bc, 0x00000000},
+        {0x0000b1c0, 0x00000000},
+        {0x0000b1c4, 0x00000000},
+        {0x0000b1c8, 0x00000000},
+        {0x0000b1cc, 0x00000000},
+        {0x0000b1d0, 0x00000000},
+        {0x0000b1d4, 0x00000000},
+        {0x0000b1d8, 0x00000000},
+        {0x0000b1dc, 0x00000000},
+        {0x0000b1e0, 0x00000000},
+        {0x0000b1e4, 0x00000000},
+        {0x0000b1e8, 0x00000000},
+        {0x0000b1ec, 0x00000000},
+        {0x0000b1f0, 0x00000396},
+        {0x0000b1f4, 0x00000396},
+        {0x0000b1f8, 0x00000396},
+        {0x0000b1fc, 0x00000196},
+};
+
+static const u32 ar9462_2p1_common_5g_xlna_only_rx_gain[][2] = {
+        /* Addr      allmodes  */
+        {0x0000a000, 0x00010000},
+        {0x0000a004, 0x00030002},
+        {0x0000a008, 0x00050004},
+        {0x0000a00c, 0x00810080},
+        {0x0000a010, 0x00830082},
+        {0x0000a014, 0x01810180},
+        {0x0000a018, 0x01830182},
+        {0x0000a01c, 0x01850184},
+        {0x0000a020, 0x01890188},
+        {0x0000a024, 0x018b018a},
+        {0x0000a028, 0x018d018c},
+        {0x0000a02c, 0x03820190},
+        {0x0000a030, 0x03840383},
+        {0x0000a034, 0x03880385},
+        {0x0000a038, 0x038a0389},
+        {0x0000a03c, 0x038c038b},
+        {0x0000a040, 0x0390038d},
+        {0x0000a044, 0x03920391},
+        {0x0000a048, 0x03940393},
+        {0x0000a04c, 0x03960395},
+        {0x0000a050, 0x00000000},
+        {0x0000a054, 0x00000000},
+        {0x0000a058, 0x00000000},
+        {0x0000a05c, 0x00000000},
+        {0x0000a060, 0x00000000},
+        {0x0000a064, 0x00000000},
+        {0x0000a068, 0x00000000},
+        {0x0000a06c, 0x00000000},
+        {0x0000a070, 0x00000000},
+        {0x0000a074, 0x00000000},
+        {0x0000a078, 0x00000000},
+        {0x0000a07c, 0x00000000},
+        {0x0000a080, 0x29292929},
+        {0x0000a084, 0x29292929},
+        {0x0000a088, 0x29292929},
+        {0x0000a08c, 0x29292929},
+        {0x0000a090, 0x22292929},
+        {0x0000a094, 0x1d1d2222},
+        {0x0000a098, 0x0c111117},
+        {0x0000a09c, 0x00030303},
+        {0x0000a0a0, 0x00000000},
+        {0x0000a0a4, 0x00000000},
+        {0x0000a0a8, 0x00000000},
+        {0x0000a0ac, 0x00000000},
+        {0x0000a0b0, 0x00000000},
+        {0x0000a0b4, 0x00000000},
+        {0x0000a0b8, 0x00000000},
+        {0x0000a0bc, 0x00000000},
+        {0x0000a0c0, 0x001f0000},
+        {0x0000a0c4, 0x01000101},
+        {0x0000a0c8, 0x011e011f},
+        {0x0000a0cc, 0x011c011d},
+        {0x0000a0d0, 0x02030204},
+        {0x0000a0d4, 0x02010202},
+        {0x0000a0d8, 0x021f0200},
+        {0x0000a0dc, 0x0302021e},
+        {0x0000a0e0, 0x03000301},
+        {0x0000a0e4, 0x031e031f},
+        {0x0000a0e8, 0x0402031d},
+        {0x0000a0ec, 0x04000401},
+        {0x0000a0f0, 0x041e041f},
+        {0x0000a0f4, 0x0502041d},
+        {0x0000a0f8, 0x05000501},
+        {0x0000a0fc, 0x051e051f},
+        {0x0000a100, 0x06010602},
+        {0x0000a104, 0x061f0600},
+        {0x0000a108, 0x061d061e},
+        {0x0000a10c, 0x07020703},
+        {0x0000a110, 0x07000701},
+        {0x0000a114, 0x00000000},
+        {0x0000a118, 0x00000000},
+        {0x0000a11c, 0x00000000},
+        {0x0000a120, 0x00000000},
+        {0x0000a124, 0x00000000},
+        {0x0000a128, 0x00000000},
+        {0x0000a12c, 0x00000000},
+        {0x0000a130, 0x00000000},
+        {0x0000a134, 0x00000000},
+        {0x0000a138, 0x00000000},
+        {0x0000a13c, 0x00000000},
+        {0x0000a140, 0x001f0000},
+        {0x0000a144, 0x01000101},
+        {0x0000a148, 0x011e011f},
+        {0x0000a14c, 0x011c011d},
+        {0x0000a150, 0x02030204},
+        {0x0000a154, 0x02010202},
+        {0x0000a158, 0x021f0200},
+        {0x0000a15c, 0x0302021e},
+        {0x0000a160, 0x03000301},
+        {0x0000a164, 0x031e031f},
+        {0x0000a168, 0x0402031d},
+        {0x0000a16c, 0x04000401},
+        {0x0000a170, 0x041e041f},
+        {0x0000a174, 0x0502041d},
+        {0x0000a178, 0x05000501},
+        {0x0000a17c, 0x051e051f},
+        {0x0000a180, 0x06010602},
+        {0x0000a184, 0x061f0600},
+        {0x0000a188, 0x061d061e},
+        {0x0000a18c, 0x07020703},
+        {0x0000a190, 0x07000701},
+        {0x0000a194, 0x00000000},
+        {0x0000a198, 0x00000000},
+        {0x0000a19c, 0x00000000},
+        {0x0000a1a0, 0x00000000},
+        {0x0000a1a4, 0x00000000},
+        {0x0000a1a8, 0x00000000},
+        {0x0000a1ac, 0x00000000},
+        {0x0000a1b0, 0x00000000},
+        {0x0000a1b4, 0x00000000},
+        {0x0000a1b8, 0x00000000},
+        {0x0000a1bc, 0x00000000},
+        {0x0000a1c0, 0x00000000},
+        {0x0000a1c4, 0x00000000},
+        {0x0000a1c8, 0x00000000},
+        {0x0000a1cc, 0x00000000},
+        {0x0000a1d0, 0x00000000},
+        {0x0000a1d4, 0x00000000},
+        {0x0000a1d8, 0x00000000},
+        {0x0000a1dc, 0x00000000},
+        {0x0000a1e0, 0x00000000},
+        {0x0000a1e4, 0x00000000},
+        {0x0000a1e8, 0x00000000},
+        {0x0000a1ec, 0x00000000},
+        {0x0000a1f0, 0x00000396},
+        {0x0000a1f4, 0x00000396},
+        {0x0000a1f8, 0x00000396},
+        {0x0000a1fc, 0x00000196},
+        {0x0000b000, 0x00010000},
+        {0x0000b004, 0x00030002},
+        {0x0000b008, 0x00050004},
+        {0x0000b00c, 0x00810080},
+        {0x0000b010, 0x00830082},
+        {0x0000b014, 0x01810180},
+        {0x0000b018, 0x01830182},
+        {0x0000b01c, 0x01850184},
+        {0x0000b020, 0x02810280},
+        {0x0000b024, 0x02830282},
+        {0x0000b028, 0x02850284},
+        {0x0000b02c, 0x02890288},
+        {0x0000b030, 0x028b028a},
+        {0x0000b034, 0x0388028c},
+        {0x0000b038, 0x038a0389},
+        {0x0000b03c, 0x038c038b},
+        {0x0000b040, 0x0390038d},
+        {0x0000b044, 0x03920391},
+        {0x0000b048, 0x03940393},
+        {0x0000b04c, 0x03960395},
+        {0x0000b050, 0x00000000},
+        {0x0000b054, 0x00000000},
+        {0x0000b058, 0x00000000},
+        {0x0000b05c, 0x00000000},
+        {0x0000b060, 0x00000000},
+        {0x0000b064, 0x00000000},
+        {0x0000b068, 0x00000000},
+        {0x0000b06c, 0x00000000},
+        {0x0000b070, 0x00000000},
+        {0x0000b074, 0x00000000},
+        {0x0000b078, 0x00000000},
+        {0x0000b07c, 0x00000000},
+        {0x0000b080, 0x2a2d2f32},
+        {0x0000b084, 0x21232328},
+        {0x0000b088, 0x19191c1e},
+        {0x0000b08c, 0x12141417},
+        {0x0000b090, 0x07070e0e},
+        {0x0000b094, 0x03030305},
+        {0x0000b098, 0x00000003},
+        {0x0000b09c, 0x00000000},
+        {0x0000b0a0, 0x00000000},
+        {0x0000b0a4, 0x00000000},
+        {0x0000b0a8, 0x00000000},
+        {0x0000b0ac, 0x00000000},
+        {0x0000b0b0, 0x00000000},
+        {0x0000b0b4, 0x00000000},
+        {0x0000b0b8, 0x00000000},
+        {0x0000b0bc, 0x00000000},
+        {0x0000b0c0, 0x003f0020},
+        {0x0000b0c4, 0x00400041},
+        {0x0000b0c8, 0x0140005f},
+        {0x0000b0cc, 0x0160015f},
+        {0x0000b0d0, 0x017e017f},
+        {0x0000b0d4, 0x02410242},
+        {0x0000b0d8, 0x025f0240},
+        {0x0000b0dc, 0x027f0260},
+        {0x0000b0e0, 0x0341027e},
+        {0x0000b0e4, 0x035f0340},
+        {0x0000b0e8, 0x037f0360},
+        {0x0000b0ec, 0x04400441},
+        {0x0000b0f0, 0x0460045f},
+        {0x0000b0f4, 0x0541047f},
+        {0x0000b0f8, 0x055f0540},
+        {0x0000b0fc, 0x057f0560},
+        {0x0000b100, 0x06400641},
+        {0x0000b104, 0x0660065f},
+        {0x0000b108, 0x067e067f},
+        {0x0000b10c, 0x07410742},
+        {0x0000b110, 0x075f0740},
+        {0x0000b114, 0x077f0760},
+        {0x0000b118, 0x07800781},
+        {0x0000b11c, 0x07a0079f},
+        {0x0000b120, 0x07c107bf},
+        {0x0000b124, 0x000007c0},
+        {0x0000b128, 0x00000000},
+        {0x0000b12c, 0x00000000},
+        {0x0000b130, 0x00000000},
+        {0x0000b134, 0x00000000},
+        {0x0000b138, 0x00000000},
+        {0x0000b13c, 0x00000000},
+        {0x0000b140, 0x003f0020},
+        {0x0000b144, 0x00400041},
+        {0x0000b148, 0x0140005f},
+        {0x0000b14c, 0x0160015f},
+        {0x0000b150, 0x017e017f},
+        {0x0000b154, 0x02410242},
+        {0x0000b158, 0x025f0240},
+        {0x0000b15c, 0x027f0260},
+        {0x0000b160, 0x0341027e},
+        {0x0000b164, 0x035f0340},
+        {0x0000b168, 0x037f0360},
+        {0x0000b16c, 0x04400441},
+        {0x0000b170, 0x0460045f},
+        {0x0000b174, 0x0541047f},
+        {0x0000b178, 0x055f0540},
+        {0x0000b17c, 0x057f0560},
+        {0x0000b180, 0x06400641},
+        {0x0000b184, 0x0660065f},
+        {0x0000b188, 0x067e067f},
+        {0x0000b18c, 0x07410742},
+        {0x0000b190, 0x075f0740},
+        {0x0000b194, 0x077f0760},
+        {0x0000b198, 0x07800781},
+        {0x0000b19c, 0x07a0079f},
+        {0x0000b1a0, 0x07c107bf},
+        {0x0000b1a4, 0x000007c0},
+        {0x0000b1a8, 0x00000000},
+        {0x0000b1ac, 0x00000000},
+        {0x0000b1b0, 0x00000000},
+        {0x0000b1b4, 0x00000000},
+        {0x0000b1b8, 0x00000000},
+        {0x0000b1bc, 0x00000000},
+        {0x0000b1c0, 0x00000000},
+        {0x0000b1c4, 0x00000000},
+        {0x0000b1c8, 0x00000000},
+        {0x0000b1cc, 0x00000000},
+        {0x0000b1d0, 0x00000000},
+        {0x0000b1d4, 0x00000000},
+        {0x0000b1d8, 0x00000000},
+        {0x0000b1dc, 0x00000000},
+        {0x0000b1e0, 0x00000000},
+        {0x0000b1e4, 0x00000000},
+        {0x0000b1e8, 0x00000000},
+        {0x0000b1ec, 0x00000000},
+        {0x0000b1f0, 0x00000396},
+        {0x0000b1f4, 0x00000396},
+        {0x0000b1f8, 0x00000396},
+        {0x0000b1fc, 0x00000196},
+};
+
+static const u32 ar9462_2p1_modes_low_ob_db_tx_gain[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x000098bc, 0x00000002, 0x00000002, 0x00000002, 0x00000002},
+        {0x0000a2dc, 0x0380c7fc, 0x0380c7fc, 0x03aaa352, 0x03aaa352},
+        {0x0000a2e0, 0x0000f800, 0x0000f800, 0x03ccc584, 0x03ccc584},
+        {0x0000a2e4, 0x03ff0000, 0x03ff0000, 0x03f0f800, 0x03f0f800},
+        {0x0000a2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
+        {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d9, 0x000050d9},
+        {0x0000a458, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a500, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a504, 0x06000003, 0x06000003, 0x04000002, 0x04000002},
+        {0x0000a508, 0x0a000020, 0x0a000020, 0x08000004, 0x08000004},
+        {0x0000a50c, 0x10000023, 0x10000023, 0x0b000200, 0x0b000200},
+        {0x0000a510, 0x16000220, 0x16000220, 0x0f000202, 0x0f000202},
+        {0x0000a514, 0x1c000223, 0x1c000223, 0x12000400, 0x12000400},
+        {0x0000a518, 0x21020220, 0x21020220, 0x16000402, 0x16000402},
+        {0x0000a51c, 0x27020223, 0x27020223, 0x19000404, 0x19000404},
+        {0x0000a520, 0x2b022220, 0x2b022220, 0x1c000603, 0x1c000603},
+        {0x0000a524, 0x2f022222, 0x2f022222, 0x21000a02, 0x21000a02},
+        {0x0000a528, 0x34022225, 0x34022225, 0x25000a04, 0x25000a04},
+        {0x0000a52c, 0x3a02222a, 0x3a02222a, 0x28000a20, 0x28000a20},
+        {0x0000a530, 0x3e02222c, 0x3e02222c, 0x2c000e20, 0x2c000e20},
+        {0x0000a534, 0x4202242a, 0x4202242a, 0x30000e22, 0x30000e22},
+        {0x0000a538, 0x4702244a, 0x4702244a, 0x34000e24, 0x34000e24},
+        {0x0000a53c, 0x4b02244c, 0x4b02244c, 0x38001640, 0x38001640},
+        {0x0000a540, 0x4e02246c, 0x4e02246c, 0x3c001660, 0x3c001660},
+        {0x0000a544, 0x5302266c, 0x5302266c, 0x3f001861, 0x3f001861},
+        {0x0000a548, 0x5702286c, 0x5702286c, 0x43001a81, 0x43001a81},
+        {0x0000a54c, 0x5c04286b, 0x5c04286b, 0x47001a83, 0x47001a83},
+        {0x0000a550, 0x61042a6c, 0x61042a6c, 0x4a001c84, 0x4a001c84},
+        {0x0000a554, 0x66062a6c, 0x66062a6c, 0x4e001ce3, 0x4e001ce3},
+        {0x0000a558, 0x6b062e6c, 0x6b062e6c, 0x52001ce5, 0x52001ce5},
+        {0x0000a55c, 0x7006308c, 0x7006308c, 0x56001ce9, 0x56001ce9},
+        {0x0000a560, 0x730a308a, 0x730a308a, 0x5a001ceb, 0x5a001ceb},
+        {0x0000a564, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
+        {0x0000a568, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
+        {0x0000a56c, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
+        {0x0000a570, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
+        {0x0000a574, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
+        {0x0000a578, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
+        {0x0000a57c, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
+        {0x0000a600, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a604, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a608, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a60c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a610, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a614, 0x01404000, 0x01404000, 0x01404000, 0x01404000},
+        {0x0000a618, 0x01404501, 0x01404501, 0x01404501, 0x01404501},
+        {0x0000a61c, 0x02008802, 0x02008802, 0x02008501, 0x02008501},
+        {0x0000a620, 0x0300cc03, 0x0300cc03, 0x0280ca03, 0x0280ca03},
+        {0x0000a624, 0x0300cc03, 0x0300cc03, 0x03010c04, 0x03010c04},
+        {0x0000a628, 0x0300cc03, 0x0300cc03, 0x04014c04, 0x04014c04},
+        {0x0000a62c, 0x03810c03, 0x03810c03, 0x04015005, 0x04015005},
+        {0x0000a630, 0x03810e04, 0x03810e04, 0x04015005, 0x04015005},
+        {0x0000a634, 0x03810e04, 0x03810e04, 0x04015005, 0x04015005},
+        {0x0000a638, 0x03810e04, 0x03810e04, 0x04015005, 0x04015005},
+        {0x0000a63c, 0x03810e04, 0x03810e04, 0x04015005, 0x04015005},
+        {0x0000b2dc, 0x0380c7fc, 0x0380c7fc, 0x03aaa352, 0x03aaa352},
+        {0x0000b2e0, 0x0000f800, 0x0000f800, 0x03ccc584, 0x03ccc584},
+        {0x0000b2e4, 0x03ff0000, 0x03ff0000, 0x03f0f800, 0x03f0f800},
+        {0x0000b2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
+        {0x00016044, 0x012482d4, 0x012482d4, 0x012482d4, 0x012482d4},
+        {0x00016048, 0x64992060, 0x64992060, 0x64992060, 0x64992060},
+        {0x00016054, 0x6db60000, 0x6db60000, 0x6db60000, 0x6db60000},
+        {0x00016444, 0x012482d4, 0x012482d4, 0x012482d4, 0x012482d4},
+        {0x00016448, 0x64992000, 0x64992000, 0x64992000, 0x64992000},
+        {0x00016454, 0x6db60000, 0x6db60000, 0x6db60000, 0x6db60000},
+};
+
+static const u32 ar9462_2p1_modes_high_ob_db_tx_gain[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x000098bc, 0x00000002, 0x00000002, 0x00000002, 0x00000002},
+        {0x0000a2dc, 0x01feee00, 0x01feee00, 0x03aaa352, 0x03aaa352},
+        {0x0000a2e0, 0x0000f000, 0x0000f000, 0x03ccc584, 0x03ccc584},
+        {0x0000a2e4, 0x01ff0000, 0x01ff0000, 0x03f0f800, 0x03f0f800},
+        {0x0000a2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
+        {0x0000a410, 0x000050da, 0x000050da, 0x000050de, 0x000050de},
+        {0x0000a458, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a500, 0x00002220, 0x00002220, 0x00000000, 0x00000000},
+        {0x0000a504, 0x06002223, 0x06002223, 0x04000002, 0x04000002},
+        {0x0000a508, 0x0a022220, 0x0a022220, 0x08000004, 0x08000004},
+        {0x0000a50c, 0x0f022223, 0x0f022223, 0x0b000200, 0x0b000200},
+        {0x0000a510, 0x14022620, 0x14022620, 0x0f000202, 0x0f000202},
+        {0x0000a514, 0x18022622, 0x18022622, 0x11000400, 0x11000400},
+        {0x0000a518, 0x1b022822, 0x1b022822, 0x15000402, 0x15000402},
+        {0x0000a51c, 0x20022842, 0x20022842, 0x19000404, 0x19000404},
+        {0x0000a520, 0x22022c41, 0x22022c41, 0x1b000603, 0x1b000603},
+        {0x0000a524, 0x28023042, 0x28023042, 0x1f000a02, 0x1f000a02},
+        {0x0000a528, 0x2c023044, 0x2c023044, 0x23000a04, 0x23000a04},
+        {0x0000a52c, 0x2f023644, 0x2f023644, 0x26000a20, 0x26000a20},
+        {0x0000a530, 0x34025643, 0x34025643, 0x2a000e20, 0x2a000e20},
+        {0x0000a534, 0x38025a44, 0x38025a44, 0x2e000e22, 0x2e000e22},
+        {0x0000a538, 0x3b025e45, 0x3b025e45, 0x31000e24, 0x31000e24},
+        {0x0000a53c, 0x41025e4a, 0x41025e4a, 0x34001640, 0x34001640},
+        {0x0000a540, 0x48025e6c, 0x48025e6c, 0x38001660, 0x38001660},
+        {0x0000a544, 0x4e025e8e, 0x4e025e8e, 0x3b001861, 0x3b001861},
+        {0x0000a548, 0x55025eb3, 0x55025eb3, 0x3e001a81, 0x3e001a81},
+        {0x0000a54c, 0x58025ef3, 0x58025ef3, 0x42001a83, 0x42001a83},
+        {0x0000a550, 0x5d025ef6, 0x5d025ef6, 0x44001a84, 0x44001a84},
+        {0x0000a554, 0x62025f56, 0x62025f56, 0x48001ce3, 0x48001ce3},
+        {0x0000a558, 0x66027f56, 0x66027f56, 0x4c001ce5, 0x4c001ce5},
+        {0x0000a55c, 0x6a029f56, 0x6a029f56, 0x50001ce9, 0x50001ce9},
+        {0x0000a560, 0x70049f56, 0x70049f56, 0x54001ceb, 0x54001ceb},
+        {0x0000a564, 0x751ffff6, 0x751ffff6, 0x56001eec, 0x56001eec},
+        {0x0000a568, 0x751ffff6, 0x751ffff6, 0x58001ef0, 0x58001ef0},
+        {0x0000a56c, 0x751ffff6, 0x751ffff6, 0x5a001ef4, 0x5a001ef4},
+        {0x0000a570, 0x751ffff6, 0x751ffff6, 0x5c001ff6, 0x5c001ff6},
+        {0x0000a574, 0x751ffff6, 0x751ffff6, 0x5c001ff6, 0x5c001ff6},
+        {0x0000a578, 0x751ffff6, 0x751ffff6, 0x5c001ff6, 0x5c001ff6},
+        {0x0000a57c, 0x751ffff6, 0x751ffff6, 0x5c001ff6, 0x5c001ff6},
+        {0x0000a600, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a604, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a608, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a60c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a610, 0x00804000, 0x00804000, 0x00000000, 0x00000000},
+        {0x0000a614, 0x00804201, 0x00804201, 0x01404000, 0x01404000},
+        {0x0000a618, 0x0280c802, 0x0280c802, 0x01404501, 0x01404501},
+        {0x0000a61c, 0x0280ca03, 0x0280ca03, 0x02008501, 0x02008501},
+        {0x0000a620, 0x04c15104, 0x04c15104, 0x0280ca03, 0x0280ca03},
+        {0x0000a624, 0x04c15305, 0x04c15305, 0x03010c04, 0x03010c04},
+        {0x0000a628, 0x04c15305, 0x04c15305, 0x04014c04, 0x04014c04},
+        {0x0000a62c, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
+        {0x0000a630, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
+        {0x0000a634, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
+        {0x0000a638, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
+        {0x0000a63c, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
+        {0x0000b2dc, 0x01feee00, 0x01feee00, 0x03aaa352, 0x03aaa352},
+        {0x0000b2e0, 0x0000f000, 0x0000f000, 0x03ccc584, 0x03ccc584},
+        {0x0000b2e4, 0x01ff0000, 0x01ff0000, 0x03f0f800, 0x03f0f800},
+        {0x0000b2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
+        {0x00016044, 0x056d82e4, 0x056d82e4, 0x056d82e4, 0x056d82e4},
+        {0x00016048, 0x8db49060, 0x8db49060, 0x8db49060, 0x8db49060},
+        {0x00016054, 0x6db60000, 0x6db60000, 0x6db60000, 0x6db60000},
+        {0x00016444, 0x056d82e4, 0x056d82e4, 0x056d82e4, 0x056d82e4},
+        {0x00016448, 0x8db49000, 0x8db49000, 0x8db49000, 0x8db49000},
+        {0x00016454, 0x6db60000, 0x6db60000, 0x6db60000, 0x6db60000},
+};
+
+static const u32 ar9462_2p1_modes_mix_ob_db_tx_gain[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x000098bc, 0x00000002, 0x00000002, 0x00000002, 0x00000002},
+        {0x0000a2dc, 0x01feee00, 0x01feee00, 0x03aaa352, 0x03aaa352},
+        {0x0000a2e0, 0x0000f000, 0x0000f000, 0x03ccc584, 0x03ccc584},
+        {0x0000a2e4, 0x01ff0000, 0x01ff0000, 0x03f0f800, 0x03f0f800},
+        {0x0000a2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
+        {0x0000a410, 0x0000d0da, 0x0000d0da, 0x0000d0de, 0x0000d0de},
+        {0x0000a458, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a500, 0x00002220, 0x00002220, 0x00000000, 0x00000000},
+        {0x0000a504, 0x06002223, 0x06002223, 0x04000002, 0x04000002},
+        {0x0000a508, 0x0a022220, 0x0a022220, 0x08000004, 0x08000004},
+        {0x0000a50c, 0x0f022223, 0x0f022223, 0x0b000200, 0x0b000200},
+        {0x0000a510, 0x14022620, 0x14022620, 0x0f000202, 0x0f000202},
+        {0x0000a514, 0x18022622, 0x18022622, 0x12000400, 0x12000400},
+        {0x0000a518, 0x1b022822, 0x1b022822, 0x16000402, 0x16000402},
+        {0x0000a51c, 0x20022842, 0x20022842, 0x19000404, 0x19000404},
+        {0x0000a520, 0x22022c41, 0x22022c41, 0x1c000603, 0x1c000603},
+        {0x0000a524, 0x28023042, 0x28023042, 0x21000a02, 0x21000a02},
+        {0x0000a528, 0x2c023044, 0x2c023044, 0x25000a04, 0x25000a04},
+        {0x0000a52c, 0x2f023644, 0x2f023644, 0x28000a20, 0x28000a20},
+        {0x0000a530, 0x34025643, 0x34025643, 0x2c000e20, 0x2c000e20},
+        {0x0000a534, 0x38025a44, 0x38025a44, 0x30000e22, 0x30000e22},
+        {0x0000a538, 0x3b025e45, 0x3b025e45, 0x34000e24, 0x34000e24},
+        {0x0000a53c, 0x41025e4a, 0x41025e4a, 0x38001640, 0x38001640},
+        {0x0000a540, 0x48025e6c, 0x48025e6c, 0x3c001660, 0x3c001660},
+        {0x0000a544, 0x4e025e8e, 0x4e025e8e, 0x3f001861, 0x3f001861},
+        {0x0000a548, 0x55025eb3, 0x55025eb3, 0x43001a81, 0x43001a81},
+        {0x0000a54c, 0x58025ef3, 0x58025ef3, 0x47001a83, 0x47001a83},
+        {0x0000a550, 0x5d025ef6, 0x5d025ef6, 0x4a001c84, 0x4a001c84},
+        {0x0000a554, 0x62025f56, 0x62025f56, 0x4e001ce3, 0x4e001ce3},
+        {0x0000a558, 0x66027f56, 0x66027f56, 0x52001ce5, 0x52001ce5},
+        {0x0000a55c, 0x6a029f56, 0x6a029f56, 0x56001ce9, 0x56001ce9},
+        {0x0000a560, 0x70049f56, 0x70049f56, 0x5a001ceb, 0x5a001ceb},
+        {0x0000a564, 0x751ffff6, 0x751ffff6, 0x5c001eec, 0x5c001eec},
+        {0x0000a568, 0x751ffff6, 0x751ffff6, 0x5e001ef0, 0x5e001ef0},
+        {0x0000a56c, 0x751ffff6, 0x751ffff6, 0x60001ef4, 0x60001ef4},
+        {0x0000a570, 0x751ffff6, 0x751ffff6, 0x62001ff6, 0x62001ff6},
+        {0x0000a574, 0x751ffff6, 0x751ffff6, 0x62001ff6, 0x62001ff6},
+        {0x0000a578, 0x751ffff6, 0x751ffff6, 0x62001ff6, 0x62001ff6},
+        {0x0000a57c, 0x751ffff6, 0x751ffff6, 0x62001ff6, 0x62001ff6},
+        {0x0000a600, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a604, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a608, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a60c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a610, 0x00804000, 0x00804000, 0x00000000, 0x00000000},
+        {0x0000a614, 0x00804201, 0x00804201, 0x01404000, 0x01404000},
+        {0x0000a618, 0x0280c802, 0x0280c802, 0x01404501, 0x01404501},
+        {0x0000a61c, 0x0280ca03, 0x0280ca03, 0x02008501, 0x02008501},
+        {0x0000a620, 0x04c15104, 0x04c15104, 0x0280ca03, 0x0280ca03},
+        {0x0000a624, 0x04c15305, 0x04c15305, 0x03010c04, 0x03010c04},
+        {0x0000a628, 0x04c15305, 0x04c15305, 0x04014c04, 0x04014c04},
+        {0x0000a62c, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
+        {0x0000a630, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
+        {0x0000a634, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
+        {0x0000a638, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
+        {0x0000a63c, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
+        {0x0000b2dc, 0x01feee00, 0x01feee00, 0x03aaa352, 0x03aaa352},
+        {0x0000b2e0, 0x0000f000, 0x0000f000, 0x03ccc584, 0x03ccc584},
+        {0x0000b2e4, 0x01ff0000, 0x01ff0000, 0x03f0f800, 0x03f0f800},
+        {0x0000b2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
+};
+
+static const u32 ar9462_2p1_modes_fast_clock[][3] = {
+        /* Addr      5G_HT20     5G_HT40   */
+        {0x00001030, 0x00000268, 0x000004d0},
+        {0x00001070, 0x0000018c, 0x00000318},
+        {0x000010b0, 0x00000fd0, 0x00001fa0},
+        {0x00008014, 0x044c044c, 0x08980898},
+        {0x0000801c, 0x148ec02b, 0x148ec057},
+        {0x00008318, 0x000044c0, 0x00008980},
+        {0x00009e00, 0x0372131c, 0x0372131c},
+        {0x0000a230, 0x0000400b, 0x00004016},
+        {0x0000a254, 0x00000898, 0x00001130},
+};
+
+static const u32 ar9462_2p1_baseband_core_txfir_coeff_japan_2484[][2] = {
+        /* Addr      allmodes  */
+        {0x0000a398, 0x00000000},
+        {0x0000a39c, 0x6f7f0301},
+        {0x0000a3a0, 0xca9228ee},
+};
+
+#endif /* INITVALS_9462_2P1_H */
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 04b2d3ea728f..c1224b5a257b 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -634,6 +634,7 @@ void ath_ant_comb_update(struct ath_softc *sc);
 #define ATH9K_PCI_CUS198 0x0001
 #define ATH9K_PCI_CUS230 0x0002
 #define ATH9K_PCI_CUS217 0x0004
+#define ATH9K_PCI_WOW    0x0008
 
 /*
  * Default cache line size, in bytes.
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index f5dda84176c3..9e582e14da74 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -234,10 +234,15 @@ static inline void ath9k_skb_queue_complete(struct hif_device_usb *hif_dev,
         struct sk_buff *skb;
 
         while ((skb = __skb_dequeue(queue)) != NULL) {
+#ifdef CONFIG_ATH9K_HTC_DEBUGFS
+                int ln = skb->len;
+#endif
                 ath9k_htc_txcompletion_cb(hif_dev->htc_handle,
                                           skb, txok);
-                if (txok)
+                if (txok) {
                         TX_STAT_INC(skb_success);
+                        TX_STAT_ADD(skb_success_bytes, ln);
+                }
                 else
                         TX_STAT_INC(skb_failed);
         }
@@ -620,6 +625,7 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,
 
 err:
         for (i = 0; i < pool_index; i++) {
+                RX_STAT_ADD(skb_completed_bytes, skb_pool[i]->len);
                 ath9k_htc_rx_msg(hif_dev->htc_handle, skb_pool[i],
                                  skb_pool[i]->len, USB_WLAN_RX_PIPE);
                 RX_STAT_INC(skb_completed);
diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
index 69581031f2cd..055d7c25e090 100644
--- a/drivers/net/wireless/ath/ath9k/htc.h
+++ b/drivers/net/wireless/ath/ath9k/htc.h
@@ -324,7 +324,9 @@ static inline struct ath9k_htc_tx_ctl *HTC_SKB_CB(struct sk_buff *skb)
 #ifdef CONFIG_ATH9K_HTC_DEBUGFS
 
 #define TX_STAT_INC(c) (hif_dev->htc_handle->drv_priv->debug.tx_stats.c++)
+#define TX_STAT_ADD(c, a) (hif_dev->htc_handle->drv_priv->debug.tx_stats.c += a)
 #define RX_STAT_INC(c) (hif_dev->htc_handle->drv_priv->debug.rx_stats.c++)
+#define RX_STAT_ADD(c, a) (hif_dev->htc_handle->drv_priv->debug.rx_stats.c += a)
 #define CAB_STAT_INC   priv->debug.tx_stats.cab_queued++
 
 #define TX_QSTAT_INC(q) (priv->debug.tx_stats.queue_stats[q]++)
@@ -337,6 +339,7 @@ struct ath_tx_stats {
         u32 buf_completed;
         u32 skb_queued;
         u32 skb_success;
+        u32 skb_success_bytes;
         u32 skb_failed;
         u32 cab_queued;
         u32 queue_stats[IEEE80211_NUM_ACS];
@@ -345,6 +348,7 @@ struct ath_tx_stats {
 struct ath_rx_stats {
         u32 skb_allocated;
         u32 skb_completed;
+        u32 skb_completed_bytes;
         u32 skb_dropped;
         u32 err_crc;
         u32 err_decrypt_crc;
@@ -362,10 +366,20 @@ struct ath9k_debug {
         struct ath_rx_stats rx_stats;
 };
 
+void ath9k_htc_get_et_strings(struct ieee80211_hw *hw,
+                              struct ieee80211_vif *vif,
+                              u32 sset, u8 *data);
+int ath9k_htc_get_et_sset_count(struct ieee80211_hw *hw,
+                                struct ieee80211_vif *vif, int sset);
+void ath9k_htc_get_et_stats(struct ieee80211_hw *hw,
+                            struct ieee80211_vif *vif,
+                            struct ethtool_stats *stats, u64 *data);
 #else
 
 #define TX_STAT_INC(c) do { } while (0)
+#define TX_STAT_ADD(c, a) do { } while (0)
 #define RX_STAT_INC(c) do { } while (0)
+#define RX_STAT_ADD(c, a) do { } while (0)
 #define CAB_STAT_INC   do { } while (0)
 
 #define TX_QSTAT_INC(c) do { } while (0)
@@ -583,6 +597,8 @@ bool ath9k_htc_setpower(struct ath9k_htc_priv *priv,
 void ath9k_start_rfkill_poll(struct ath9k_htc_priv *priv);
 void ath9k_htc_rfkill_poll_state(struct ieee80211_hw *hw);
 
+struct base_eep_header *ath9k_htc_get_eeprom_base(struct ath9k_htc_priv *priv);
+
 #ifdef CONFIG_MAC80211_LEDS
 void ath9k_init_leds(struct ath9k_htc_priv *priv);
 void ath9k_deinit_leds(struct ath9k_htc_priv *priv);
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
index d08ef24e9696..c1b45e2f8481 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
@@ -496,21 +496,7 @@ static ssize_t read_file_base_eeprom(struct file *file, char __user *user_buf,
         ssize_t retval = 0;
         char *buf;
 
-        /*
-         * This can be done since all the 3 EEPROM families have the
-         * same base header upto a certain point, and we are interested in
-         * the data only upto that point.
-         */
-
-        if (AR_SREV_9271(priv->ah))
-                pBase = (struct base_eep_header *)
-                        &priv->ah->eeprom.map4k.baseEepHeader;
-        else if (priv->ah->hw_version.usbdev == AR9280_USB)
-                pBase = (struct base_eep_header *)
-                        &priv->ah->eeprom.def.baseEepHeader;
-        else if (priv->ah->hw_version.usbdev == AR9287_USB)
-                pBase = (struct base_eep_header *)
-                        &priv->ah->eeprom.map9287.baseEepHeader;
+        pBase = ath9k_htc_get_eeprom_base(priv);
 
         if (pBase == NULL) {
                 ath_err(common, "Unknown EEPROM type\n");
@@ -916,6 +902,87 @@ static const struct file_operations fops_modal_eeprom = {
         .llseek = default_llseek,
 };
 
+
+/* Ethtool support for get-stats */
+#define AMKSTR(nm) #nm "_BE", #nm "_BK", #nm "_VI", #nm "_VO"
+static const char ath9k_htc_gstrings_stats[][ETH_GSTRING_LEN] = {
+        "tx_pkts_nic",
+        "tx_bytes_nic",
+        "rx_pkts_nic",
+        "rx_bytes_nic",
+
+        AMKSTR(d_tx_pkts),
+
+        "d_rx_crc_err",
+        "d_rx_decrypt_crc_err",
+        "d_rx_phy_err",
+        "d_rx_mic_err",
+        "d_rx_pre_delim_crc_err",
+        "d_rx_post_delim_crc_err",
+        "d_rx_decrypt_busy_err",
+
+        "d_rx_phyerr_radar",
+        "d_rx_phyerr_ofdm_timing",
+        "d_rx_phyerr_cck_timing",
+
+};
+#define ATH9K_HTC_SSTATS_LEN ARRAY_SIZE(ath9k_htc_gstrings_stats)
+
+void ath9k_htc_get_et_strings(struct ieee80211_hw *hw,
+                              struct ieee80211_vif *vif,
+                              u32 sset, u8 *data)
+{
+        if (sset == ETH_SS_STATS)
+                memcpy(data, *ath9k_htc_gstrings_stats,
+                       sizeof(ath9k_htc_gstrings_stats));
+}
+
+int ath9k_htc_get_et_sset_count(struct ieee80211_hw *hw,
+                                struct ieee80211_vif *vif, int sset)
+{
+        if (sset == ETH_SS_STATS)
+                return ATH9K_HTC_SSTATS_LEN;
+        return 0;
+}
+
+#define STXBASE priv->debug.tx_stats
+#define SRXBASE priv->debug.rx_stats
+#define ASTXQ(a)                                        \
+        data[i++] = STXBASE.a[IEEE80211_AC_BE];         \
+        data[i++] = STXBASE.a[IEEE80211_AC_BK];         \
+        data[i++] = STXBASE.a[IEEE80211_AC_VI];         \
+        data[i++] = STXBASE.a[IEEE80211_AC_VO]
+
+void ath9k_htc_get_et_stats(struct ieee80211_hw *hw,
+                            struct ieee80211_vif *vif,
+                            struct ethtool_stats *stats, u64 *data)
+{
+        struct ath9k_htc_priv *priv = hw->priv;
+        int i = 0;
+
+        data[i++] = STXBASE.skb_success;
+        data[i++] = STXBASE.skb_success_bytes;
+        data[i++] = SRXBASE.skb_completed;
+        data[i++] = SRXBASE.skb_completed_bytes;
+
+        ASTXQ(queue_stats);
+
+        data[i++] = SRXBASE.err_crc;
+        data[i++] = SRXBASE.err_decrypt_crc;
+        data[i++] = SRXBASE.err_phy;
+        data[i++] = SRXBASE.err_mic;
+        data[i++] = SRXBASE.err_pre_delim;
+        data[i++] = SRXBASE.err_post_delim;
+        data[i++] = SRXBASE.err_decrypt_busy;
+
+        data[i++] = SRXBASE.err_phy_stats[ATH9K_PHYERR_RADAR];
+        data[i++] = SRXBASE.err_phy_stats[ATH9K_PHYERR_OFDM_TIMING];
+        data[i++] = SRXBASE.err_phy_stats[ATH9K_PHYERR_CCK_TIMING];
+
+        WARN_ON(i != ATH9K_HTC_SSTATS_LEN);
+}
+
+
 int ath9k_htc_init_debug(struct ath_hw *ah)
 {
         struct ath_common *common = ath9k_hw_common(ah);
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index bb0ba9e3e083..71a183ffc77f 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -701,8 +701,10 @@ static const struct ieee80211_iface_limit if_limits[] = {
         { .max = 2,     .types = BIT(NL80211_IFTYPE_STATION) |
                                  BIT(NL80211_IFTYPE_P2P_CLIENT) },
         { .max = 2,     .types = BIT(NL80211_IFTYPE_AP) |
-                                 BIT(NL80211_IFTYPE_P2P_GO) |
-                                 BIT(NL80211_IFTYPE_MESH_POINT) },
+#ifdef CONFIG_MAC80211_MESH
+                                 BIT(NL80211_IFTYPE_MESH_POINT) |
+#endif
+                                 BIT(NL80211_IFTYPE_P2P_GO) },
 };
 
 static const struct ieee80211_iface_combination if_comb = {
@@ -716,6 +718,7 @@ static void ath9k_set_hw_capab(struct ath9k_htc_priv *priv,
                                struct ieee80211_hw *hw)
 {
         struct ath_common *common = ath9k_hw_common(priv->ah);
+        struct base_eep_header *pBase;
 
         hw->flags = IEEE80211_HW_SIGNAL_DBM |
                 IEEE80211_HW_AMPDU_AGGREGATION |
@@ -771,6 +774,12 @@ static void ath9k_set_hw_capab(struct ath9k_htc_priv *priv,
                                      &priv->sbands[IEEE80211_BAND_5GHZ].ht_cap);
         }
 
+        pBase = ath9k_htc_get_eeprom_base(priv);
+        if (pBase) {
+                hw->wiphy->available_antennas_rx = pBase->rxMask;
+                hw->wiphy->available_antennas_tx = pBase->txMask;
+        }
+
         SET_IEEE80211_PERM_ADDR(hw, common->macaddr);
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
index eaa94feb4333..5c1bec18c9e3 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
@@ -1183,7 +1183,7 @@ static int ath9k_htc_config(struct ieee80211_hw *hw, u32 changed)
                 mutex_lock(&priv->htc_pm_lock);
 
                 priv->ps_idle = !!(conf->flags & IEEE80211_CONF_IDLE);
-                if (priv->ps_idle)
+                if (!priv->ps_idle)
                         chip_reset = true;
 
                 mutex_unlock(&priv->htc_pm_lock);
@@ -1774,6 +1774,43 @@ static int ath9k_htc_get_stats(struct ieee80211_hw *hw,
         return 0;
 }
 
+struct base_eep_header *ath9k_htc_get_eeprom_base(struct ath9k_htc_priv *priv)
+{
+        struct base_eep_header *pBase = NULL;
+        /*
+         * This can be done since all the 3 EEPROM families have the
+         * same base header upto a certain point, and we are interested in
+         * the data only upto that point.
+         */
+
+        if (AR_SREV_9271(priv->ah))
+                pBase = (struct base_eep_header *)
+                        &priv->ah->eeprom.map4k.baseEepHeader;
+        else if (priv->ah->hw_version.usbdev == AR9280_USB)
+                pBase = (struct base_eep_header *)
+                        &priv->ah->eeprom.def.baseEepHeader;
+        else if (priv->ah->hw_version.usbdev == AR9287_USB)
+                pBase = (struct base_eep_header *)
+                        &priv->ah->eeprom.map9287.baseEepHeader;
+        return pBase;
+}
+
+
+static int ath9k_htc_get_antenna(struct ieee80211_hw *hw, u32 *tx_ant,
+                                 u32 *rx_ant)
+{
+        struct ath9k_htc_priv *priv = hw->priv;
+        struct base_eep_header *pBase = ath9k_htc_get_eeprom_base(priv);
+        if (pBase) {
+                *tx_ant = pBase->txMask;
+                *rx_ant = pBase->rxMask;
+        } else {
+                *tx_ant = 0;
+                *rx_ant = 0;
+        }
+        return 0;
+}
+
 struct ieee80211_ops ath9k_htc_ops = {
         .tx                 = ath9k_htc_tx,
         .start              = ath9k_htc_start,
@@ -1799,4 +1836,11 @@ struct ieee80211_ops ath9k_htc_ops = {
         .set_coverage_class = ath9k_htc_set_coverage_class,
         .set_bitrate_mask   = ath9k_htc_set_bitrate_mask,
         .get_stats          = ath9k_htc_get_stats,
+        .get_antenna        = ath9k_htc_get_antenna,
+
+#ifdef CONFIG_ATH9K_HTC_DEBUGFS
+        .get_et_sset_count  = ath9k_htc_get_et_sset_count,
+        .get_et_stats       = ath9k_htc_get_et_stats,
+        .get_et_strings     = ath9k_htc_get_et_strings,
+#endif
 };
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 5324c3346af8..4ca0cb060106 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -2599,7 +2599,7 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
                 if (!(ah->ent_mode & AR_ENT_OTP_49GHZ_DISABLE))
                         pCap->hw_caps |= ATH9K_HW_CAP_MCI;
 
-                if (AR_SREV_9462_20(ah))
+                if (AR_SREV_9462_20_OR_LATER(ah))
                         pCap->hw_caps |= ATH9K_HW_CAP_RTT;
         }
 
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index 1e555d899469..16f8b201642b 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -837,6 +837,7 @@ void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
 
 #ifdef CONFIG_PM_SLEEP
         if ((ah->caps.hw_caps & ATH9K_HW_WOW_DEVICE_CAPABLE) &&
+            (sc->driver_data & ATH9K_PCI_WOW) &&
             device_can_wakeup(sc->dev))
                 hw->wiphy->wowlan = &ath9k_wowlan_support;
 
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index b096bb2c28c8..c585c9b35973 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -79,6 +79,63 @@ static DEFINE_PCI_DEVICE_TABLE(ath_pci_id_table) = {
                          0x6661),
           .driver_data = ATH9K_PCI_CUS217 },
 
+        /* AR9462 with WoW support */
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0034,
+                         PCI_VENDOR_ID_ATHEROS,
+                         0x3117),
+          .driver_data = ATH9K_PCI_WOW },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0034,
+                         PCI_VENDOR_ID_LENOVO,
+                         0x3214),
+          .driver_data = ATH9K_PCI_WOW },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0034,
+                         PCI_VENDOR_ID_ATTANSIC,
+                         0x0091),
+          .driver_data = ATH9K_PCI_WOW },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0034,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x2110),
+          .driver_data = ATH9K_PCI_WOW },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0034,
+                         PCI_VENDOR_ID_ASUSTEK,
+                         0x850E),
+          .driver_data = ATH9K_PCI_WOW },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0034,
+                         0x11AD, /* LITEON */
+                         0x6631),
+          .driver_data = ATH9K_PCI_WOW },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0034,
+                         0x11AD, /* LITEON */
+                         0x6641),
+          .driver_data = ATH9K_PCI_WOW },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0034,
+                         PCI_VENDOR_ID_HP,
+                         0x1864),
+          .driver_data = ATH9K_PCI_WOW },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0034,
+                         0x14CD, /* USI */
+                         0x0063),
+          .driver_data = ATH9K_PCI_WOW },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0034,
+                         0x14CD, /* USI */
+                         0x0064),
+          .driver_data = ATH9K_PCI_WOW },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0034,
+                         0x10CF, /* Fujitsu */
+                         0x1783),
+          .driver_data = ATH9K_PCI_WOW },
+
         { PCI_VDEVICE(ATHEROS, 0x0034) }, /* PCI-E  AR9462 */
         { PCI_VDEVICE(ATHEROS, 0x0037) }, /* PCI-E  AR1111/AR9485 */
         { PCI_VDEVICE(ATHEROS, 0x0036) }, /* PCI-E  AR9565 */
diff --git a/drivers/net/wireless/ath/ath9k/reg.h b/drivers/net/wireless/ath/ath9k/reg.h
index f7c90cc58d56..5af97442ac37 100644
--- a/drivers/net/wireless/ath/ath9k/reg.h
+++ b/drivers/net/wireless/ath/ath9k/reg.h
@@ -806,6 +806,7 @@
 #define AR_SREV_REVISION_9580_10        4 /* AR9580 1.0 */
 #define AR_SREV_VERSION_9462            0x280
 #define AR_SREV_REVISION_9462_20        2
+#define AR_SREV_REVISION_9462_21        3
 #define AR_SREV_VERSION_9565            0x2C0
 #define AR_SREV_REVISION_9565_10        0
 #define AR_SREV_VERSION_9550            0x400
@@ -911,10 +912,18 @@
 
 #define AR_SREV_9462(_ah) \
         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9462))
-
 #define AR_SREV_9462_20(_ah) \
         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9462) && \
-        ((_ah)->hw_version.macRev == AR_SREV_REVISION_9462_20))
+         ((_ah)->hw_version.macRev == AR_SREV_REVISION_9462_20))
+#define AR_SREV_9462_21(_ah) \
+        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9462) && \
+         ((_ah)->hw_version.macRev == AR_SREV_REVISION_9462_21))
+#define AR_SREV_9462_20_OR_LATER(_ah) \
+        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9462) && \
+         ((_ah)->hw_version.macRev >= AR_SREV_REVISION_9462_20))
+#define AR_SREV_9462_21_OR_LATER(_ah) \
+        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9462) && \
+         ((_ah)->hw_version.macRev >= AR_SREV_REVISION_9462_21))
 
 #define AR_SREV_9565(_ah) \
         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9565))
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 7e19d9b5214e..c59ae43b9b35 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1673,6 +1673,8 @@ void ath_txq_schedule(struct ath_softc *sc, struct ath_txq *txq)
             txq->axq_ampdu_depth >= ATH_AGGR_MIN_QDEPTH)
                 return;
 
+        rcu_read_lock();
+
         ac = list_first_entry(&txq->axq_acq, struct ath_atx_ac, list);
         last_ac = list_entry(txq->axq_acq.prev, struct ath_atx_ac, list);
 
@@ -1711,8 +1713,10 @@ void ath_txq_schedule(struct ath_softc *sc, struct ath_txq *txq)
 
                 if (ac == last_ac ||
                     txq->axq_ampdu_depth >= ATH_AGGR_MIN_QDEPTH)
-                        return;
+                        break;
         }
+
+        rcu_read_unlock();
 }
 
 /***********/
@@ -1778,9 +1782,13 @@ static void ath_tx_txqaddbuf(struct ath_softc *sc, struct ath_txq *txq,
         }
 
         if (!internal) {
-                txq->axq_depth++;
-                if (bf_is_ampdu_not_probing(bf))
-                        txq->axq_ampdu_depth++;
+                while (bf) {
+                        txq->axq_depth++;
+                        if (bf_is_ampdu_not_probing(bf))
+                                txq->axq_ampdu_depth++;
+
+                        bf = bf->bf_lastbf->bf_next;
+                }
         }
 }
 
diff --git a/drivers/net/wireless/ath/wil6210/txrx.c b/drivers/net/wireless/ath/wil6210/txrx.c
index e1c492b9dfef..d240b24e1ccf 100644
--- a/drivers/net/wireless/ath/wil6210/txrx.c
+++ b/drivers/net/wireless/ath/wil6210/txrx.c
@@ -621,7 +621,8 @@ static struct vring *wil_find_tx_vring(struct wil6210_priv *wil,
         return NULL;
 }
 
-static int wil_tx_desc_map(struct vring_tx_desc *d, dma_addr_t pa, u32 len)
+static int wil_tx_desc_map(struct vring_tx_desc *d, dma_addr_t pa, u32 len,
+                           int vring_index)
 {
         wil_desc_addr_set(&d->dma.addr, pa);
         d->dma.ip_length = 0;
@@ -630,7 +631,7 @@ static int wil_tx_desc_map(struct vring_tx_desc *d, dma_addr_t pa, u32 len)
         d->dma.error = 0;
         d->dma.status = 0; /* BIT(0) should be 0 for HW_OWNED */
         d->dma.length = cpu_to_le16((u16)len);
-        d->dma.d0 = 0;
+        d->dma.d0 = (vring_index << DMA_CFG_DESC_TX_0_QID_POS);
         d->mac.d[0] = 0;
         d->mac.d[1] = 0;
         d->mac.d[2] = 0;
@@ -684,7 +685,7 @@ static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
         if (unlikely(dma_mapping_error(dev, pa)))
                 return -EINVAL;
         /* 1-st segment */
-        wil_tx_desc_map(d, pa, skb_headlen(skb));
+        wil_tx_desc_map(d, pa, skb_headlen(skb), vring_index);
         d->mac.d[2] |= ((nr_frags + 1) <<
                        MAC_CFG_DESC_TX_2_NUM_OF_DESCRIPTORS_POS);
         if (nr_frags)
@@ -701,15 +702,14 @@ static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
                                 DMA_TO_DEVICE);
                 if (unlikely(dma_mapping_error(dev, pa)))
                         goto dma_error;
-                wil_tx_desc_map(d, pa, len);
+                wil_tx_desc_map(d, pa, len, vring_index);
                 vring->ctx[i] = NULL;
                 *_d = *d;
         }
         /* for the last seg only */
         d->dma.d0 |= BIT(DMA_CFG_DESC_TX_0_CMD_EOP_POS);
-        d->dma.d0 |= BIT(9); /* BUG: undocumented bit */
+        d->dma.d0 |= BIT(DMA_CFG_DESC_TX_0_CMD_MARK_WB_POS);
         d->dma.d0 |= BIT(DMA_CFG_DESC_TX_0_CMD_DMA_IT_POS);
-        d->dma.d0 |= (vring_index << DMA_CFG_DESC_TX_0_QID_POS);
         *_d = *d;
 
         wil_hex_dump_txrx("Tx ", DUMP_PREFIX_NONE, 32, 4,
diff --git a/drivers/net/wireless/ath/wil6210/txrx.h b/drivers/net/wireless/ath/wil6210/txrx.h
index 23c0781cdb93..859aea68a1fa 100644
--- a/drivers/net/wireless/ath/wil6210/txrx.h
+++ b/drivers/net/wireless/ath/wil6210/txrx.h
@@ -201,6 +201,10 @@ struct vring_tx_mac {
 #define DMA_CFG_DESC_TX_0_CMD_EOP_LEN 1
 #define DMA_CFG_DESC_TX_0_CMD_EOP_MSK 0x100
 
+#define DMA_CFG_DESC_TX_0_CMD_MARK_WB_POS 9
+#define DMA_CFG_DESC_TX_0_CMD_MARK_WB_LEN 1
+#define DMA_CFG_DESC_TX_0_CMD_MARK_WB_MSK 0x200
+
 #define DMA_CFG_DESC_TX_0_CMD_DMA_IT_POS 10
 #define DMA_CFG_DESC_TX_0_CMD_DMA_IT_LEN 1
 #define DMA_CFG_DESC_TX_0_CMD_DMA_IT_MSK 0x400
diff --git a/drivers/net/wireless/b43/Kconfig b/drivers/net/wireless/b43/Kconfig
index 3f21e0ba39ba..51ff0b198d0a 100644
--- a/drivers/net/wireless/b43/Kconfig
+++ b/drivers/net/wireless/b43/Kconfig
@@ -31,12 +31,6 @@ config B43_BCMA
         depends on B43 && (BCMA = y || BCMA = B43)
         default y
 
-config B43_BCMA_EXTRA
-        bool "Hardware support that overlaps with the brcmsmac driver"
-        depends on B43_BCMA
-        default n if BRCMSMAC
-        default y
-
 config B43_SSB
         bool
         depends on B43 && (SSB = y || SSB = B43)
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index a95b77ab360e..0e933bb71543 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -113,13 +113,15 @@ static int b43_modparam_pio = 0;
 module_param_named(pio, b43_modparam_pio, int, 0644);
 MODULE_PARM_DESC(pio, "Use PIO accesses by default: 0=DMA, 1=PIO");
 
+static int modparam_allhwsupport = !IS_ENABLED(CONFIG_BRCMSMAC);
+module_param_named(allhwsupport, modparam_allhwsupport, int, 0444);
+MODULE_PARM_DESC(allhwsupport, "Enable support for all hardware (even it if overlaps with the brcmsmac driver)");
+
 #ifdef CONFIG_B43_BCMA
 static const struct bcma_device_id b43_bcma_tbl[] = {
         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x11, BCMA_ANY_CLASS),
-#ifdef CONFIG_B43_BCMA_EXTRA
         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x17, BCMA_ANY_CLASS),
         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x18, BCMA_ANY_CLASS),
-#endif
         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x1D, BCMA_ANY_CLASS),
         BCMA_CORETABLE_END
 };
@@ -5396,6 +5398,12 @@ static int b43_bcma_probe(struct bcma_device *core)
         struct b43_wl *wl;
         int err;
 
+        if (!modparam_allhwsupport &&
+            (core->id.rev == 0x17 || core->id.rev == 0x18)) {
+                pr_err("Support for cores revisions 0x17 and 0x18 disabled by module param allhwsupport=0. Try b43.allhwsupport=1\n");
+                return -ENOTSUPP;
+        }
+
         dev = b43_bus_dev_bcma_init(core);
         if (!dev)
                 return -ENODEV;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
index 3f8e69c29146..e3f3c48f86d4 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
@@ -162,7 +162,7 @@ int brcmf_sdio_intr_unregister(struct brcmf_sdio_dev *sdiodev)
         return 0;
 }
 
-int
+static int
 brcmf_sdcard_set_sbaddr_window(struct brcmf_sdio_dev *sdiodev, u32 address)
 {
         int err = 0, i;
@@ -193,12 +193,33 @@ brcmf_sdcard_set_sbaddr_window(struct brcmf_sdio_dev *sdiodev, u32 address)
         return err;
 }
 
+static int
+brcmf_sdio_addrprep(struct brcmf_sdio_dev *sdiodev, uint width, u32 *addr)
+{
+        uint bar0 = *addr & ~SBSDIO_SB_OFT_ADDR_MASK;
+        int err = 0;
+
+        if (bar0 != sdiodev->sbwad) {
+                err = brcmf_sdcard_set_sbaddr_window(sdiodev, bar0);
+                if (err)
+                        return err;
+
+                sdiodev->sbwad = bar0;
+        }
+
+        *addr &= SBSDIO_SB_OFT_ADDR_MASK;
+
+        if (width == 4)
+                *addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+
+        return 0;
+}
+
 int
 brcmf_sdio_regrw_helper(struct brcmf_sdio_dev *sdiodev, u32 addr,
                         void *data, bool write)
 {
         u8 func_num, reg_size;
-        u32 bar;
         s32 retry = 0;
         int ret;
 
@@ -218,18 +239,7 @@ brcmf_sdio_regrw_helper(struct brcmf_sdio_dev *sdiodev, u32 addr,
                 func_num = SDIO_FUNC_1;
                 reg_size = 4;
 
-                /* Set the window for SB core register */
-                bar = addr & ~SBSDIO_SB_OFT_ADDR_MASK;
-                if (bar != sdiodev->sbwad) {
-                        ret = brcmf_sdcard_set_sbaddr_window(sdiodev, bar);
-                        if (ret != 0) {
-                                memset(data, 0xFF, reg_size);
-                                return ret;
-                        }
-                        sdiodev->sbwad = bar;
-                }
-                addr &= SBSDIO_SB_OFT_ADDR_MASK;
-                addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+                brcmf_sdio_addrprep(sdiodev, reg_size, &addr);
         }
 
         do {
@@ -321,10 +331,11 @@ static int brcmf_sdio_buffrw(struct brcmf_sdio_dev *sdiodev, uint fn,
                              bool write, u32 addr, struct sk_buff_head *pktlist)
 {
         unsigned int req_sz, func_blk_sz, sg_cnt, sg_data_sz, pkt_offset;
-        unsigned int max_blks, max_req_sz;
+        unsigned int max_blks, max_req_sz, orig_offset, dst_offset;
         unsigned short max_seg_sz, seg_sz;
-        unsigned char *pkt_data;
-        struct sk_buff *pkt_next = NULL;
+        unsigned char *pkt_data, *orig_data, *dst_data;
+        struct sk_buff *pkt_next = NULL, *local_pkt_next;
+        struct sk_buff_head local_list, *target_list;
         struct mmc_request mmc_req;
         struct mmc_command mmc_cmd;
         struct mmc_data mmc_dat;
@@ -361,6 +372,32 @@ static int brcmf_sdio_buffrw(struct brcmf_sdio_dev *sdiodev, uint fn,
                                            req_sz);
         }
 
+        target_list = pktlist;
+        /* for host with broken sg support, prepare a page aligned list */
+        __skb_queue_head_init(&local_list);
+        if (sdiodev->pdata && sdiodev->pdata->broken_sg_support && !write) {
+                req_sz = 0;
+                skb_queue_walk(pktlist, pkt_next)
+                        req_sz += pkt_next->len;
+                req_sz = ALIGN(req_sz, sdiodev->func[fn]->cur_blksize);
+                while (req_sz > PAGE_SIZE) {
+                        pkt_next = brcmu_pkt_buf_get_skb(PAGE_SIZE);
+                        if (pkt_next == NULL) {
+                                ret = -ENOMEM;
+                                goto exit;
+                        }
+                        __skb_queue_tail(&local_list, pkt_next);
+                        req_sz -= PAGE_SIZE;
+                }
+                pkt_next = brcmu_pkt_buf_get_skb(req_sz);
+                if (pkt_next == NULL) {
+                        ret = -ENOMEM;
+                        goto exit;
+                }
+                __skb_queue_tail(&local_list, pkt_next);
+                target_list = &local_list;
+        }
+
         host = sdiodev->func[fn]->card->host;
         func_blk_sz = sdiodev->func[fn]->cur_blksize;
         /* Blocks per command is limited by host count, host transfer
@@ -370,13 +407,15 @@ static int brcmf_sdio_buffrw(struct brcmf_sdio_dev *sdiodev, uint fn,
         max_req_sz = min_t(unsigned int, host->max_req_size,
                            max_blks * func_blk_sz);
         max_seg_sz = min_t(unsigned short, host->max_segs, SG_MAX_SINGLE_ALLOC);
-        max_seg_sz = min_t(unsigned short, max_seg_sz, pktlist->qlen);
-        seg_sz = pktlist->qlen;
+        max_seg_sz = min_t(unsigned short, max_seg_sz, target_list->qlen);
+        seg_sz = target_list->qlen;
         pkt_offset = 0;
-        pkt_next = pktlist->next;
+        pkt_next = target_list->next;
 
-        if (sg_alloc_table(&st, max_seg_sz, GFP_KERNEL))
-                return -ENOMEM;
+        if (sg_alloc_table(&st, max_seg_sz, GFP_KERNEL)) {
+                ret = -ENOMEM;
+                goto exit;
+        }
 
         while (seg_sz) {
                 req_sz = 0;
@@ -386,7 +425,7 @@ static int brcmf_sdio_buffrw(struct brcmf_sdio_dev *sdiodev, uint fn,
                 memset(&mmc_dat, 0, sizeof(struct mmc_data));
                 sgl = st.sgl;
                 /* prep sg table */
-                while (pkt_next != (struct sk_buff *)pktlist) {
+                while (pkt_next != (struct sk_buff *)target_list) {
                         pkt_data = pkt_next->data + pkt_offset;
                         sg_data_sz = pkt_next->len - pkt_offset;
                         if (sg_data_sz > host->max_seg_size)
@@ -413,8 +452,8 @@ static int brcmf_sdio_buffrw(struct brcmf_sdio_dev *sdiodev, uint fn,
                 if (req_sz % func_blk_sz != 0) {
                         brcmf_err("sg request length %u is not %u aligned\n",
                                   req_sz, func_blk_sz);
-                        sg_free_table(&st);
-                        return -ENOTBLK;
+                        ret = -ENOTBLK;
+                        goto exit;
                 }
                 mmc_dat.sg = st.sgl;
                 mmc_dat.sg_len = sg_cnt;
@@ -447,35 +486,36 @@ static int brcmf_sdio_buffrw(struct brcmf_sdio_dev *sdiodev, uint fn,
                 }
         }
 
-        sg_free_table(&st);
-
-        return ret;
-}
-
-static int brcmf_sdcard_recv_prepare(struct brcmf_sdio_dev *sdiodev, uint fn,
-                                     uint flags, uint width, u32 *addr)
-{
-        uint bar0 = *addr & ~SBSDIO_SB_OFT_ADDR_MASK;
-        int err = 0;
-
-        /* Async not implemented yet */
-        if (flags & SDIO_REQ_ASYNC)
-                return -ENOTSUPP;
-
-        if (bar0 != sdiodev->sbwad) {
-                err = brcmf_sdcard_set_sbaddr_window(sdiodev, bar0);
-                if (err)
-                        return err;
-
-                sdiodev->sbwad = bar0;
+        if (sdiodev->pdata && sdiodev->pdata->broken_sg_support && !write) {
+                local_pkt_next = local_list.next;
+                orig_offset = 0;
+                skb_queue_walk(pktlist, pkt_next) {
+                        dst_offset = 0;
+                        do {
+                                req_sz = local_pkt_next->len - orig_offset;
+                                req_sz = min_t(uint, pkt_next->len - dst_offset,
+                                               req_sz);
+                                orig_data = local_pkt_next->data + orig_offset;
+                                dst_data = pkt_next->data + dst_offset;
+                                memcpy(dst_data, orig_data, req_sz);
+                                orig_offset += req_sz;
+                                dst_offset += req_sz;
+                                if (orig_offset == local_pkt_next->len) {
+                                        orig_offset = 0;
+                                        local_pkt_next = local_pkt_next->next;
+                                }
+                                if (dst_offset == pkt_next->len)
+                                        break;
+                        } while (!skb_queue_empty(&local_list));
+                }
         }
 
-        *addr &= SBSDIO_SB_OFT_ADDR_MASK;
-
-        if (width == 4)
-                *addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+exit:
+        sg_free_table(&st);
+        while ((pkt_next = __skb_dequeue(&local_list)) != NULL)
+                brcmu_pkt_buf_free_skb(pkt_next);
 
-        return 0;
+        return ret;
 }
 
 int
@@ -512,7 +552,7 @@ brcmf_sdcard_recv_pkt(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
                   fn, addr, pkt->len);
 
         width = (flags & SDIO_REQ_4BYTE) ? 4 : 2;
-        err = brcmf_sdcard_recv_prepare(sdiodev, fn, flags, width, &addr);
+        err = brcmf_sdio_addrprep(sdiodev, width, &addr);
         if (err)
                 goto done;
 
@@ -536,7 +576,7 @@ int brcmf_sdcard_recv_chain(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
                   fn, addr, pktq->qlen);
 
         width = (flags & SDIO_REQ_4BYTE) ? 4 : 2;
-        err = brcmf_sdcard_recv_prepare(sdiodev, fn, flags, width, &addr);
+        err = brcmf_sdio_addrprep(sdiodev, width, &addr);
         if (err)
                 goto done;
 
@@ -574,37 +614,20 @@ brcmf_sdcard_send_pkt(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
                       uint flags, struct sk_buff *pkt)
 {
         uint width;
-        uint bar0 = addr & ~SBSDIO_SB_OFT_ADDR_MASK;
         int err = 0;
         struct sk_buff_head pkt_list;
 
         brcmf_dbg(SDIO, "fun = %d, addr = 0x%x, size = %d\n",
                   fn, addr, pkt->len);
 
-        /* Async not implemented yet */
-        if (flags & SDIO_REQ_ASYNC)
-                return -ENOTSUPP;
-
-        if (bar0 != sdiodev->sbwad) {
-                err = brcmf_sdcard_set_sbaddr_window(sdiodev, bar0);
-                if (err)
-                        goto done;
-
-                sdiodev->sbwad = bar0;
-        }
-
-        addr &= SBSDIO_SB_OFT_ADDR_MASK;
-
         width = (flags & SDIO_REQ_4BYTE) ? 4 : 2;
-        if (width == 4)
-                addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+        brcmf_sdio_addrprep(sdiodev, width, &addr);
 
         skb_queue_head_init(&pkt_list);
         skb_queue_tail(&pkt_list, pkt);
         err = brcmf_sdio_buffrw(sdiodev, fn, true, addr, &pkt_list);
         skb_dequeue_tail(&pkt_list);
 
-done:
         return err;
 }
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
index 8c402e7b97eb..8e8975562ec3 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
@@ -281,8 +281,6 @@ void brcmf_txflowblock(struct device *dev, bool state)
 
 void brcmf_rx_frames(struct device *dev, struct sk_buff_head *skb_list)
 {
-        unsigned char *eth;
-        uint len;
         struct sk_buff *skb, *pnext;
         struct brcmf_if *ifp;
         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
@@ -306,33 +304,12 @@ void brcmf_rx_frames(struct device *dev, struct sk_buff_head *skb_list)
                         continue;
                 }
 
-                /* Get the protocol, maintain skb around eth_type_trans()
-                 * The main reason for this hack is for the limitation of
-                 * Linux 2.4 where 'eth_type_trans' uses the
-                 * 'net->hard_header_len'
-                 * to perform skb_pull inside vs ETH_HLEN. Since to avoid
-                 * coping of the packet coming from the network stack to add
-                 * BDC, Hardware header etc, during network interface
-                 * registration
-                 * we set the 'net->hard_header_len' to ETH_HLEN + extra space
-                 * required
-                 * for BDC, Hardware header etc. and not just the ETH_HLEN
-                 */
-                eth = skb->data;
-                len = skb->len;
-
                 skb->dev = ifp->ndev;
                 skb->protocol = eth_type_trans(skb, skb->dev);
 
                 if (skb->pkt_type == PACKET_MULTICAST)
                         ifp->stats.multicast++;
 
-                skb->data = eth;
-                skb->len = len;
-
-                /* Strip header, count, deliver upward */
-                skb_pull(skb, ETH_HLEN);
-
                 /* Process special event packets */
                 brcmf_fweh_process_skb(drvr, skb);
 
@@ -348,10 +325,8 @@ void brcmf_rx_frames(struct device *dev, struct sk_buff_head *skb_list)
                         netif_rx(skb);
                 else
                         /* If the receive is not processed inside an ISR,
-                         * the softirqd must be woken explicitly to service
-                         * the NET_RX_SOFTIRQ.  In 2.6 kernels, this is handled
-                         * by netif_rx_ni(), but in earlier kernels, we need
-                         * to do it manually.
+                         * the softirqd must be woken explicitly to service the
+                         * NET_RX_SOFTIRQ. This is handled by netif_rx_ni().
                          */
                         netif_rx_ni(skb);
         }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
index 13e75c4b1a6b..f0d9f7f6c83d 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
@@ -796,9 +796,8 @@ static int brcmf_fws_hdrpush(struct brcmf_fws_info *fws, struct sk_buff *skb)
         u8 fillers;
         __le32 pkttag = cpu_to_le32(brcmf_skbcb(skb)->htod);
 
-        brcmf_dbg(TRACE, "enter: ea=%pM, ifidx=%u (%u), pkttag=0x%08X, hslot=%d\n",
-                  entry->ea, entry->interface_id,
-                  brcmf_skb_if_flags_get_field(skb, INDEX),
+        brcmf_dbg(TRACE, "enter: %s, idx=%d pkttag=0x%08X, hslot=%d\n",
+                  entry->name, brcmf_skb_if_flags_get_field(skb, INDEX),
                   le32_to_cpu(pkttag), (le32_to_cpu(pkttag) >> 8) & 0xffff);
         if (entry->send_tim_signal)
                 data_offset += 2 + BRCMF_FWS_TYPE_PENDING_TRAFFIC_BMP_LEN;
@@ -822,8 +821,8 @@ static int brcmf_fws_hdrpush(struct brcmf_fws_info *fws, struct sk_buff *skb)
                 wlh[1] = BRCMF_FWS_TYPE_PENDING_TRAFFIC_BMP_LEN;
                 wlh[2] = entry->mac_handle;
                 wlh[3] = entry->traffic_pending_bmp;
-                brcmf_dbg(TRACE, "adding TIM info: %02X:%02X:%02X:%02X\n",
-                          wlh[0], wlh[1], wlh[2], wlh[3]);
+                brcmf_dbg(TRACE, "adding TIM info: handle %d bmp 0x%X\n",
+                          entry->mac_handle, entry->traffic_pending_bmp);
                 wlh += BRCMF_FWS_TYPE_PENDING_TRAFFIC_BMP_LEN + 2;
                 entry->traffic_lastreported_bmp = entry->traffic_pending_bmp;
         }
@@ -906,10 +905,26 @@ static int brcmf_fws_rssi_indicate(struct brcmf_fws_info *fws, s8 rssi)
         return 0;
 }
 
+/* using macro so sparse checking does not complain
+ * about locking imbalance.
+ */
+#define brcmf_fws_lock(drvr, flags)                             \
+do {                                                            \
+        flags = 0;                                              \
+        spin_lock_irqsave(&((drvr)->fws_spinlock), (flags));    \
+} while (0)
+
+/* using macro so sparse checking does not complain
+ * about locking imbalance.
+ */
+#define brcmf_fws_unlock(drvr, flags) \
+        spin_unlock_irqrestore(&((drvr)->fws_spinlock), (flags))
+
 static
 int brcmf_fws_macdesc_indicate(struct brcmf_fws_info *fws, u8 type, u8 *data)
 {
         struct brcmf_fws_mac_descriptor *entry, *existing;
+        ulong flags;
         u8 mac_handle;
         u8 ifidx;
         u8 *addr;
@@ -923,8 +938,10 @@ int brcmf_fws_macdesc_indicate(struct brcmf_fws_info *fws, u8 type, u8 *data)
                 if (entry->occupied) {
                         brcmf_dbg(TRACE, "deleting %s mac %pM\n",
                                   entry->name, addr);
+                        brcmf_fws_lock(fws->drvr, flags);
                         brcmf_fws_macdesc_cleanup(fws, entry, -1);
                         brcmf_fws_macdesc_deinit(entry);
+                        brcmf_fws_unlock(fws->drvr, flags);
                 } else
                         fws->stats.mac_update_failed++;
                 return 0;
@@ -933,11 +950,13 @@ int brcmf_fws_macdesc_indicate(struct brcmf_fws_info *fws, u8 type, u8 *data)
         existing = brcmf_fws_macdesc_lookup(fws, addr);
         if (IS_ERR(existing)) {
                 if (!entry->occupied) {
+                        brcmf_fws_lock(fws->drvr, flags);
                         entry->mac_handle = mac_handle;
                         brcmf_fws_macdesc_init(entry, addr, ifidx);
                         brcmf_fws_macdesc_set_name(fws, entry);
                         brcmu_pktq_init(&entry->psq, BRCMF_FWS_PSQ_PREC_COUNT,
                                         BRCMF_FWS_PSQ_LEN);
+                        brcmf_fws_unlock(fws->drvr, flags);
                         brcmf_dbg(TRACE, "add %s mac %pM\n", entry->name, addr);
                 } else {
                         fws->stats.mac_update_failed++;
@@ -945,11 +964,13 @@ int brcmf_fws_macdesc_indicate(struct brcmf_fws_info *fws, u8 type, u8 *data)
         } else {
                 if (entry != existing) {
                         brcmf_dbg(TRACE, "copy mac %s\n", existing->name);
+                        brcmf_fws_lock(fws->drvr, flags);
                         memcpy(entry, existing,
                                offsetof(struct brcmf_fws_mac_descriptor, psq));
                         entry->mac_handle = mac_handle;
                         brcmf_fws_macdesc_deinit(existing);
                         brcmf_fws_macdesc_set_name(fws, entry);
+                        brcmf_fws_unlock(fws->drvr, flags);
                         brcmf_dbg(TRACE, "relocate %s mac %pM\n", entry->name,
                                   addr);
                 } else {
@@ -965,7 +986,9 @@ static int brcmf_fws_macdesc_state_indicate(struct brcmf_fws_info *fws,
                                             u8 type, u8 *data)
 {
         struct brcmf_fws_mac_descriptor *entry;
+        ulong flags;
         u8 mac_handle;
+        int ret;
 
         mac_handle = data[0];
         entry = &fws->desc.nodes[mac_handle & 0x1F];
@@ -973,26 +996,30 @@ static int brcmf_fws_macdesc_state_indicate(struct brcmf_fws_info *fws,
                 fws->stats.mac_ps_update_failed++;
                 return -ESRCH;
         }
+        brcmf_fws_lock(fws->drvr, flags);
         /* a state update should wipe old credits */
         entry->requested_credit = 0;
         entry->requested_packet = 0;
         if (type == BRCMF_FWS_TYPE_MAC_OPEN) {
                 entry->state = BRCMF_FWS_STATE_OPEN;
-                return BRCMF_FWS_RET_OK_SCHEDULE;
+                ret = BRCMF_FWS_RET_OK_SCHEDULE;
         } else {
                 entry->state = BRCMF_FWS_STATE_CLOSE;
                 brcmf_fws_tim_update(fws, entry, BRCMF_FWS_FIFO_AC_BK, false);
                 brcmf_fws_tim_update(fws, entry, BRCMF_FWS_FIFO_AC_BE, false);
                 brcmf_fws_tim_update(fws, entry, BRCMF_FWS_FIFO_AC_VI, false);
                 brcmf_fws_tim_update(fws, entry, BRCMF_FWS_FIFO_AC_VO, true);
+                ret = BRCMF_FWS_RET_OK_NOSCHEDULE;
         }
-        return BRCMF_FWS_RET_OK_NOSCHEDULE;
+        brcmf_fws_unlock(fws->drvr, flags);
+        return ret;
 }
 
 static int brcmf_fws_interface_state_indicate(struct brcmf_fws_info *fws,
                                               u8 type, u8 *data)
 {
         struct brcmf_fws_mac_descriptor *entry;
+        ulong flags;
         u8 ifidx;
         int ret;
 
@@ -1011,17 +1038,24 @@ static int brcmf_fws_interface_state_indicate(struct brcmf_fws_info *fws,
 
         brcmf_dbg(TRACE, "%s (%d): %s\n", brcmf_fws_get_tlv_name(type), type,
                   entry->name);
+        brcmf_fws_lock(fws->drvr, flags);
         switch (type) {
         case BRCMF_FWS_TYPE_INTERFACE_OPEN:
                 entry->state = BRCMF_FWS_STATE_OPEN;
-                return BRCMF_FWS_RET_OK_SCHEDULE;
+                ret = BRCMF_FWS_RET_OK_SCHEDULE;
+                break;
         case BRCMF_FWS_TYPE_INTERFACE_CLOSE:
                 entry->state = BRCMF_FWS_STATE_CLOSE;
-                return BRCMF_FWS_RET_OK_NOSCHEDULE;
+                ret = BRCMF_FWS_RET_OK_NOSCHEDULE;
+                break;
         default:
                 ret = -EINVAL;
-                break;
+                brcmf_fws_unlock(fws->drvr, flags);
+                goto fail;
         }
+        brcmf_fws_unlock(fws->drvr, flags);
+        return ret;
+
 fail:
         fws->stats.if_update_failed++;
         return ret;
@@ -1031,6 +1065,7 @@ static int brcmf_fws_request_indicate(struct brcmf_fws_info *fws, u8 type,
                                       u8 *data)
 {
         struct brcmf_fws_mac_descriptor *entry;
+        ulong flags;
 
         entry = &fws->desc.nodes[data[1] & 0x1F];
         if (!entry->occupied) {
@@ -1044,12 +1079,14 @@ static int brcmf_fws_request_indicate(struct brcmf_fws_info *fws, u8 type,
         brcmf_dbg(TRACE, "%s (%d): %s cnt %d bmp %d\n",
                   brcmf_fws_get_tlv_name(type), type, entry->name,
                   data[0], data[2]);
+        brcmf_fws_lock(fws->drvr, flags);
         if (type == BRCMF_FWS_TYPE_MAC_REQUEST_CREDIT)
                 entry->requested_credit = data[0];
         else
                 entry->requested_packet = data[0];
 
         entry->ac_bitmap = data[2];
+        brcmf_fws_unlock(fws->drvr, flags);
         return BRCMF_FWS_RET_OK_SCHEDULE;
 }
 
@@ -1346,6 +1383,7 @@ brcmf_fws_txs_process(struct brcmf_fws_info *fws, u8 flags, u32 hslot,
 static int brcmf_fws_fifocreditback_indicate(struct brcmf_fws_info *fws,
                                              u8 *data)
 {
+        ulong flags;
         int i;
 
         if (fws->fcmode != BRCMF_FWS_FCMODE_EXPLICIT_CREDIT) {
@@ -1354,16 +1392,19 @@ static int brcmf_fws_fifocreditback_indicate(struct brcmf_fws_info *fws,
         }
 
         brcmf_dbg(DATA, "enter: data %pM\n", data);
+        brcmf_fws_lock(fws->drvr, flags);
         for (i = 0; i < BRCMF_FWS_FIFO_COUNT; i++)
                 brcmf_fws_return_credits(fws, i, data[i]);
 
         brcmf_dbg(DATA, "map: credit %x delay %x\n", fws->fifo_credit_map,
                   fws->fifo_delay_map);
+        brcmf_fws_unlock(fws->drvr, flags);
         return BRCMF_FWS_RET_OK_SCHEDULE;
 }
 
 static int brcmf_fws_txstatus_indicate(struct brcmf_fws_info *fws, u8 *data)
 {
+        ulong lflags;
         __le32 status_le;
         u32 status;
         u32 hslot;
@@ -1377,7 +1418,10 @@ static int brcmf_fws_txstatus_indicate(struct brcmf_fws_info *fws, u8 *data)
         hslot = brcmf_txstatus_get_field(status, HSLOT);
         genbit = brcmf_txstatus_get_field(status, GENERATION);
 
-        return brcmf_fws_txs_process(fws, flags, hslot, genbit);
+        brcmf_fws_lock(fws->drvr, lflags);
+        brcmf_fws_txs_process(fws, flags, hslot, genbit);
+        brcmf_fws_unlock(fws->drvr, lflags);
+        return BRCMF_FWS_RET_OK_NOSCHEDULE;
 }
 
 static int brcmf_fws_dbg_seqnum_check(struct brcmf_fws_info *fws, u8 *data)
@@ -1390,21 +1434,6 @@ static int brcmf_fws_dbg_seqnum_check(struct brcmf_fws_info *fws, u8 *data)
         return 0;
 }
 
-/* using macro so sparse checking does not complain
- * about locking imbalance.
- */
-#define brcmf_fws_lock(drvr, flags)                             \
-do {                                                            \
-        flags = 0;                                              \
-        spin_lock_irqsave(&((drvr)->fws_spinlock), (flags));    \
-} while (0)
-
-/* using macro so sparse checking does not complain
- * about locking imbalance.
- */
-#define brcmf_fws_unlock(drvr, flags) \
-        spin_unlock_irqrestore(&((drvr)->fws_spinlock), (flags))
-
 static int brcmf_fws_notify_credit_map(struct brcmf_if *ifp,
                                        const struct brcmf_event_msg *e,
                                        void *data)
@@ -1455,7 +1484,6 @@ int brcmf_fws_hdrpull(struct brcmf_pub *drvr, int ifidx, s16 signal_len,
                       struct sk_buff *skb)
 {
         struct brcmf_fws_info *fws = drvr->fws;
-        ulong flags;
         u8 *signal_data;
         s16 data_len;
         u8 type;
@@ -1475,9 +1503,6 @@ int brcmf_fws_hdrpull(struct brcmf_pub *drvr, int ifidx, s16 signal_len,
                 return 0;
         }
 
-        /* lock during tlv parsing */
-        brcmf_fws_lock(drvr, flags);
-
         fws->stats.header_pulls++;
         data_len = signal_len;
         signal_data = skb->data;
@@ -1571,25 +1596,17 @@ int brcmf_fws_hdrpull(struct brcmf_pub *drvr, int ifidx, s16 signal_len,
         if (skb->len == 0)
                 fws->stats.header_only_pkt++;
 
-        brcmf_fws_unlock(drvr, flags);
         return 0;
 }
 
-static int brcmf_fws_precommit_skb(struct brcmf_fws_info *fws, int fifo,
+static void brcmf_fws_precommit_skb(struct brcmf_fws_info *fws, int fifo,
                                    struct sk_buff *p)
 {
         struct brcmf_skbuff_cb *skcb = brcmf_skbcb(p);
         struct brcmf_fws_mac_descriptor *entry = skcb->mac;
-        int rc = 0;
-        bool first_time;
-        int hslot = BRCMF_FWS_HANGER_MAXITEMS;
-        u8 free_ctr;
         u8 flags;
 
-        first_time = skcb->state != BRCMF_FWS_SKBSTATE_SUPPRESSED;
-
         brcmf_skb_if_flags_set_field(p, TRANSMIT, 1);
-        brcmf_skb_htod_tag_set_field(p, FIFO, fifo);
         brcmf_skb_htod_tag_set_field(p, GENERATION, entry->generation);
         flags = BRCMF_FWS_HTOD_FLAG_PKTFROMHOST;
         if (brcmf_skb_if_flags_get_field(p, REQUESTED)) {
@@ -1600,80 +1617,36 @@ static int brcmf_fws_precommit_skb(struct brcmf_fws_info *fws, int fifo,
                 flags |= BRCMF_FWS_HTOD_FLAG_PKT_REQUESTED;
         }
         brcmf_skb_htod_tag_set_field(p, FLAGS, flags);
-        if (first_time) {
-                /* obtaining free slot may fail, but that will be caught
-                 * by the hanger push. This assures the packet has a BDC
-                 * header upon return.
-                 */
-                hslot = brcmf_fws_hanger_get_free_slot(&fws->hanger);
-                free_ctr = entry->seq[fifo];
-                brcmf_skb_htod_tag_set_field(p, HSLOT, hslot);
-                brcmf_skb_htod_tag_set_field(p, FREERUN, free_ctr);
-                rc = brcmf_fws_hanger_pushpkt(&fws->hanger, p, hslot);
-                if (rc)
-                        brcmf_err("hanger push failed: rc=%d\n", rc);
-        }
-
-        if (rc == 0)
-                brcmf_fws_hdrpush(fws, p);
-
-        return rc;
+        brcmf_fws_hdrpush(fws, p);
 }
 
-static void
-brcmf_fws_rollback_toq(struct brcmf_fws_info *fws,
-                       struct sk_buff *skb, int fifo)
+static void brcmf_fws_rollback_toq(struct brcmf_fws_info *fws,
+                                   struct sk_buff *skb, int fifo)
 {
-        /*
-        put the packet back to the head of queue
-
-        - suppressed packet goes back to suppress sub-queue
-        - pull out the header, if new or delayed packet
-
-        Note: hslot is used only when header removal is done.
-        */
         struct brcmf_fws_mac_descriptor *entry;
-        enum brcmf_fws_skb_state state;
         struct sk_buff *pktout;
+        int qidx, hslot;
         int rc = 0;
-        int hslot;
 
-        state = brcmf_skbcb(skb)->state;
         entry = brcmf_skbcb(skb)->mac;
-        hslot = brcmf_skb_htod_tag_get_field(skb, HSLOT);
-
-        if (entry != NULL) {
-                if (state == BRCMF_FWS_SKBSTATE_SUPPRESSED) {
-                        /* wl-header is saved for suppressed packets */
-                        pktout = brcmu_pktq_penq_head(&entry->psq, 2 * fifo + 1,
-                                                      skb);
-                        if (pktout == NULL) {
-                                brcmf_err("suppress queue full\n");
-                                rc = -ENOSPC;
-                        }
-                } else {
-                        /* delay-q packets are going to delay-q */
-                        pktout = brcmu_pktq_penq_head(&entry->psq,
-                                                      2 * fifo, skb);
-                        if (pktout == NULL) {
-                                brcmf_err("delay queue full\n");
-                                rc = -ENOSPC;
-                        }
-
-                        /* free the hanger slot */
-                        brcmf_fws_hanger_poppkt(&fws->hanger, hslot, &pktout,
-                                                true);
-
-                        /* decrement sequence count */
-                        entry->seq[fifo]--;
+        if (entry->occupied) {
+                qidx = 2 * fifo;
+                if (brcmf_skbcb(skb)->state == BRCMF_FWS_SKBSTATE_SUPPRESSED)
+                        qidx++;
+
+                pktout = brcmu_pktq_penq_head(&entry->psq, qidx, skb);
+                if (pktout == NULL) {
+                        brcmf_err("%s queue %d full\n", entry->name, qidx);
+                        rc = -ENOSPC;
                 }
         } else {
-                brcmf_err("no mac entry linked\n");
+                brcmf_err("%s entry removed\n", entry->name);
                 rc = -ENOENT;
         }
 
         if (rc) {
                 fws->stats.rollback_failed++;
+                hslot = brcmf_skb_htod_tag_get_field(skb, HSLOT);
                 brcmf_fws_txs_process(fws, BRCMF_FWS_TXSTATUS_HOST_TOSSED,
                                       hslot, 0);
         } else {
@@ -1707,37 +1680,6 @@ static int brcmf_fws_borrow_credit(struct brcmf_fws_info *fws)
         return -ENAVAIL;
 }
 
-static int brcmf_fws_consume_credit(struct brcmf_fws_info *fws, int fifo,
-                                    struct sk_buff *skb)
-{
-        struct brcmf_fws_mac_descriptor *entry = brcmf_skbcb(skb)->mac;
-        int *credit = &fws->fifo_credit[fifo];
-
-        if (fifo != BRCMF_FWS_FIFO_AC_BE)
-                fws->borrow_defer_timestamp = jiffies +
-                                              BRCMF_FWS_BORROW_DEFER_PERIOD;
-
-        if (!(*credit)) {
-                /* Try to borrow a credit from other queue */
-                if (fifo != BRCMF_FWS_FIFO_AC_BE ||
-                    (brcmf_fws_borrow_credit(fws) != 0)) {
-                        brcmf_dbg(DATA, "ac=%d, credits depleted\n", fifo);
-                        return -ENAVAIL;
-                }
-        } else {
-                (*credit)--;
-                if (!(*credit))
-                        fws->fifo_credit_map &= ~(1 << fifo);
-        }
-
-        brcmf_fws_macdesc_use_req_credit(entry, skb);
-
-        brcmf_dbg(DATA, "ac=%d, credits=%02d:%02d:%02d:%02d\n", fifo,
-                  fws->fifo_credit[0], fws->fifo_credit[1],
-                  fws->fifo_credit[2], fws->fifo_credit[3]);
-        return 0;
-}
-
 static int brcmf_fws_commit_skb(struct brcmf_fws_info *fws, int fifo,
                                 struct sk_buff *skb)
 {
@@ -1751,15 +1693,10 @@ static int brcmf_fws_commit_skb(struct brcmf_fws_info *fws, int fifo,
         if (IS_ERR(entry))
                 return PTR_ERR(entry);
 
-        rc = brcmf_fws_precommit_skb(fws, fifo, skb);
-        if (rc < 0) {
-                fws->stats.generic_error++;
-                goto rollback;
-        }
-
-        brcmf_dbg(DATA, "%s flags %X htod %X\n", entry->name, skcb->if_flags,
-                  skcb->htod);
+        brcmf_fws_precommit_skb(fws, fifo, skb);
         rc = brcmf_bus_txdata(bus, skb);
+        brcmf_dbg(DATA, "%s flags %X htod %X bus_tx %d\n", entry->name,
+                  skcb->if_flags, skcb->htod, rc);
         if (rc < 0) {
                 brcmf_proto_hdrpull(fws->drvr, false, &ifidx, skb);
                 goto rollback;
@@ -1768,7 +1705,6 @@ static int brcmf_fws_commit_skb(struct brcmf_fws_info *fws, int fifo,
         entry->transit_count++;
         if (entry->suppressed)
                 entry->suppr_transit_count++;
-        entry->seq[fifo]++;
         fws->stats.pkt2bus++;
         fws->stats.send_pkts[fifo]++;
         if (brcmf_skb_if_flags_get_field(skb, REQUESTED))
@@ -1781,6 +1717,24 @@ rollback:
         return rc;
 }
 
+static int brcmf_fws_assign_htod(struct brcmf_fws_info *fws, struct sk_buff *p,
+                                  int fifo)
+{
+        struct brcmf_skbuff_cb *skcb = brcmf_skbcb(p);
+        int rc, hslot;
+
+        hslot = brcmf_fws_hanger_get_free_slot(&fws->hanger);
+        brcmf_skb_htod_tag_set_field(p, HSLOT, hslot);
+        brcmf_skb_htod_tag_set_field(p, FREERUN, skcb->mac->seq[fifo]);
+        brcmf_skb_htod_tag_set_field(p, FIFO, fifo);
+        rc = brcmf_fws_hanger_pushpkt(&fws->hanger, p, hslot);
+        if (!rc)
+                skcb->mac->seq[fifo]++;
+        else
+                fws->stats.generic_error++;
+        return rc;
+}
+
 int brcmf_fws_process_skb(struct brcmf_if *ifp, struct sk_buff *skb)
 {
         struct brcmf_pub *drvr = ifp->drvr;
@@ -1809,33 +1763,25 @@ int brcmf_fws_process_skb(struct brcmf_if *ifp, struct sk_buff *skb)
 
         /* set control buffer information */
         skcb->if_flags = 0;
-        skcb->mac = brcmf_fws_macdesc_find(fws, ifp, eh->h_dest);
         skcb->state = BRCMF_FWS_SKBSTATE_NEW;
         brcmf_skb_if_flags_set_field(skb, INDEX, ifp->ifidx);
         if (!multicast)
                 fifo = brcmf_fws_prio2fifo[skb->priority];
 
+        brcmf_fws_lock(drvr, flags);
+        if (fifo != BRCMF_FWS_FIFO_AC_BE && fifo < BRCMF_FWS_FIFO_BCMC)
+                fws->borrow_defer_timestamp = jiffies +
+                                              BRCMF_FWS_BORROW_DEFER_PERIOD;
+
+        skcb->mac = brcmf_fws_macdesc_find(fws, ifp, eh->h_dest);
         brcmf_dbg(DATA, "%s mac %pM multi %d fifo %d\n", skcb->mac->name,
                   eh->h_dest, multicast, fifo);
-
-        brcmf_fws_lock(drvr, flags);
-        /* multicast credit support is conditional, setting
-         * flag to false to assure credit is consumed below.
-         */
-        if (fws->bcmc_credit_check)
-                multicast = false;
-
-        if (skcb->mac->suppressed ||
-            fws->bus_flow_blocked ||
-            brcmf_fws_macdesc_closed(fws, skcb->mac, fifo) ||
-            brcmu_pktq_mlen(&skcb->mac->psq, 3 << (fifo * 2)) ||
-            (!multicast &&
-             brcmf_fws_consume_credit(fws, fifo, skb) < 0)) {
-                /* enqueue the packet in delayQ */
-                drvr->fws->fifo_delay_map |= 1 << fifo;
+        if (!brcmf_fws_assign_htod(fws, skb, fifo)) {
                 brcmf_fws_enq(fws, BRCMF_FWS_SKBSTATE_DELAYED, fifo, skb);
+                brcmf_fws_schedule_deq(fws);
         } else {
-                brcmf_fws_commit_skb(fws, fifo, skb);
+                brcmf_err("drop skb: no hanger slot\n");
+                brcmu_pkt_buf_free_skb(skb);
         }
         brcmf_fws_unlock(drvr, flags);
         return 0;
@@ -1895,7 +1841,7 @@ static void brcmf_fws_dequeue_worker(struct work_struct *worker)
         fws = container_of(worker, struct brcmf_fws_info, fws_dequeue_work);
 
         brcmf_fws_lock(fws->drvr, flags);
-        for (fifo = NL80211_NUM_ACS; fifo >= 0 && !fws->bus_flow_blocked;
+        for (fifo = BRCMF_FWS_FIFO_BCMC; fifo >= 0 && !fws->bus_flow_blocked;
              fifo--) {
                 while ((fws->fifo_credit[fifo]) || ((!fws->bcmc_credit_check) &&
                        (fifo == BRCMF_FWS_FIFO_BCMC))) {
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/sdio_host.h b/drivers/net/wireless/brcm80211/brcmfmac/sdio_host.h
index 793df66fe0bf..09786a539950 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/sdio_host.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio_host.h
@@ -229,8 +229,6 @@ brcmf_sdcard_recv_chain(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
 #define SDIO_REQ_4BYTE  0x1
 /* Fixed address (FIFO) (vs. incrementing address) */
 #define SDIO_REQ_FIXED  0x2
-/* Async request (vs. sync request) */
-#define SDIO_REQ_ASYNC  0x4
 
 /* Read/write to memory block (F1, no FIFO) via CMD53 (sync only).
  *   rw:       read or write (0/1)
@@ -251,9 +249,6 @@ extern int brcmf_sdcard_abort(struct brcmf_sdio_dev *sdiodev, uint fn);
 extern int brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev);
 extern int brcmf_sdio_remove(struct brcmf_sdio_dev *sdiodev);
 
-extern int brcmf_sdcard_set_sbaddr_window(struct brcmf_sdio_dev *sdiodev,
-                                          u32 address);
-
 /* attach, return handler on success, NULL if failed.
  *  The handler shall be provided by all subsequent calls. No local cache
  *  cfghdl points to the starting address of pci device mapped memory
diff --git a/drivers/net/wireless/cw1200/cw1200.h b/drivers/net/wireless/cw1200/cw1200.h
index 243e96353d13..1ad7d3602520 100644
--- a/drivers/net/wireless/cw1200/cw1200.h
+++ b/drivers/net/wireless/cw1200/cw1200.h
@@ -267,7 +267,7 @@ struct cw1200_common {
         struct delayed_work     bss_loss_work;
         spinlock_t              bss_loss_lock; /* Protect BSS loss state */
         int                     bss_loss_state;
-        int                     bss_loss_confirm_id;
+        u32                     bss_loss_confirm_id;
         int                     delayed_link_loss;
         struct work_struct      bss_params_work;
 
diff --git a/drivers/net/wireless/cw1200/cw1200_spi.c b/drivers/net/wireless/cw1200/cw1200_spi.c
index 953bd1904d3d..d06376014bcd 100644
--- a/drivers/net/wireless/cw1200/cw1200_spi.c
+++ b/drivers/net/wireless/cw1200/cw1200_spi.c
@@ -61,7 +61,7 @@ static int cw1200_spi_memcpy_fromio(struct hwbus_priv *self,
                                      void *dst, int count)
 {
         int ret, i;
-        uint16_t regaddr;
+        u16 regaddr;
         struct spi_message      m;
 
         struct spi_transfer     t_addr = {
@@ -76,15 +76,18 @@ static int cw1200_spi_memcpy_fromio(struct hwbus_priv *self,
         regaddr = (SDIO_TO_SPI_ADDR(addr))<<12;
         regaddr |= SET_READ;
         regaddr |= (count>>1);
-        regaddr = cpu_to_le16(regaddr);
 
 #ifdef SPI_DEBUG
-        pr_info("READ : %04d from 0x%02x (%04x)\n", count, addr,
-                le16_to_cpu(regaddr));
+        pr_info("READ : %04d from 0x%02x (%04x)\n", count, addr, regaddr);
 #endif
 
+        /* Header is LE16 */
+        regaddr = cpu_to_le16(regaddr);
+
+        /* We have to byteswap if the SPI bus is limited to 8b operation
+           or we are running on a Big Endian system
+        */
 #if defined(__LITTLE_ENDIAN)
-        /* We have to byteswap if the SPI bus is limited to 8b operation */
         if (self->func->bits_per_word == 8)
 #endif
                 regaddr = swab16(regaddr);
@@ -104,8 +107,10 @@ static int cw1200_spi_memcpy_fromio(struct hwbus_priv *self,
         printk("\n");
 #endif
 
+        /* We have to byteswap if the SPI bus is limited to 8b operation
+           or we are running on a Big Endian system
+        */
 #if defined(__LITTLE_ENDIAN)
-        /* We have to byteswap if the SPI bus is limited to 8b operation */
         if (self->func->bits_per_word == 8)
 #endif
         {
@@ -122,7 +127,7 @@ static int cw1200_spi_memcpy_toio(struct hwbus_priv *self,
                                    const void *src, int count)
 {
         int rval, i;
-        uint16_t regaddr;
+        u16 regaddr;
         struct spi_transfer     t_addr = {
                 .tx_buf         = &regaddr,
                 .len            = sizeof(regaddr),
@@ -136,20 +141,23 @@ static int cw1200_spi_memcpy_toio(struct hwbus_priv *self,
         regaddr = (SDIO_TO_SPI_ADDR(addr))<<12;
         regaddr &= SET_WRITE;
         regaddr |= (count>>1);
-        regaddr = cpu_to_le16(regaddr);
 
 #ifdef SPI_DEBUG
-        pr_info("WRITE: %04d  to  0x%02x (%04x)\n", count, addr,
-                le16_to_cpu(regaddr));
+        pr_info("WRITE: %04d  to  0x%02x (%04x)\n", count, addr, regaddr);
 #endif
 
+        /* Header is LE16 */
+        regaddr = cpu_to_le16(regaddr);
+
+        /* We have to byteswap if the SPI bus is limited to 8b operation
+           or we are running on a Big Endian system
+        */
 #if defined(__LITTLE_ENDIAN)
-        /* We have to byteswap if the SPI bus is limited to 8b operation */
         if (self->func->bits_per_word == 8)
 #endif
         {
                 uint16_t *buf = (uint16_t *)src;
-                regaddr = swab16(regaddr);
+                regaddr = swab16(regaddr);
                 for (i = 0; i < ((count + 1) >> 1); i++)
                         buf[i] = swab16(buf[i]);
         }
diff --git a/drivers/net/wireless/cw1200/hwio.c b/drivers/net/wireless/cw1200/hwio.c
index dad3fb331818..ff230b7aeedd 100644
--- a/drivers/net/wireless/cw1200/hwio.c
+++ b/drivers/net/wireless/cw1200/hwio.c
@@ -69,31 +69,33 @@ static int __cw1200_reg_write(struct cw1200_common *priv, u16 addr,
 static inline int __cw1200_reg_read_32(struct cw1200_common *priv,
                                         u16 addr, u32 *val)
 {
-        int i = __cw1200_reg_read(priv, addr, val, sizeof(*val), 0);
-        *val = le32_to_cpu(*val);
+        __le32 tmp;
+        int i = __cw1200_reg_read(priv, addr, &tmp, sizeof(tmp), 0);
+        *val = le32_to_cpu(tmp);
         return i;
 }
 
 static inline int __cw1200_reg_write_32(struct cw1200_common *priv,
                                         u16 addr, u32 val)
 {
-        val = cpu_to_le32(val);
-        return __cw1200_reg_write(priv, addr, &val, sizeof(val), 0);
+        __le32 tmp = cpu_to_le32(val);
+        return __cw1200_reg_write(priv, addr, &tmp, sizeof(tmp), 0);
 }
 
 static inline int __cw1200_reg_read_16(struct cw1200_common *priv,
                                         u16 addr, u16 *val)
 {
-        int i = __cw1200_reg_read(priv, addr, val, sizeof(*val), 0);
-        *val = le16_to_cpu(*val);
+        __le16 tmp;
+        int i = __cw1200_reg_read(priv, addr, &tmp, sizeof(tmp), 0);
+        *val = le16_to_cpu(tmp);
         return i;
 }
 
 static inline int __cw1200_reg_write_16(struct cw1200_common *priv,
                                         u16 addr, u16 val)
 {
-        val = cpu_to_le16(val);
-        return __cw1200_reg_write(priv, addr, &val, sizeof(val), 0);
+        __le16 tmp = cpu_to_le16(val);
+        return __cw1200_reg_write(priv, addr, &tmp, sizeof(tmp), 0);
 }
 
 int cw1200_reg_read(struct cw1200_common *priv, u16 addr, void *buf,
diff --git a/drivers/net/wireless/cw1200/hwio.h b/drivers/net/wireless/cw1200/hwio.h
index 563329cfead6..ddf52669dc5b 100644
--- a/drivers/net/wireless/cw1200/hwio.h
+++ b/drivers/net/wireless/cw1200/hwio.h
@@ -169,35 +169,34 @@ int cw1200_reg_write(struct cw1200_common *priv, u16 addr,
 static inline int cw1200_reg_read_16(struct cw1200_common *priv,
                                      u16 addr, u16 *val)
 {
-        u32 tmp;
+        __le32 tmp;
         int i;
         i = cw1200_reg_read(priv, addr, &tmp, sizeof(tmp));
-        tmp = le32_to_cpu(tmp);
-        *val = tmp & 0xffff;
+        *val = le32_to_cpu(tmp) & 0xfffff;
         return i;
 }
 
 static inline int cw1200_reg_write_16(struct cw1200_common *priv,
                                       u16 addr, u16 val)
 {
-        u32 tmp = val;
-        tmp = cpu_to_le32(tmp);
+        __le32 tmp = cpu_to_le32((u32)val);
         return cw1200_reg_write(priv, addr, &tmp, sizeof(tmp));
 }
 
 static inline int cw1200_reg_read_32(struct cw1200_common *priv,
                                      u16 addr, u32 *val)
 {
-        int i = cw1200_reg_read(priv, addr, val, sizeof(*val));
-        *val = le32_to_cpu(*val);
+        __le32 tmp;
+        int i = cw1200_reg_read(priv, addr, &tmp, sizeof(tmp));
+        *val = le32_to_cpu(tmp);
         return i;
 }
 
 static inline int cw1200_reg_write_32(struct cw1200_common *priv,
                                       u16 addr, u32 val)
 {
-        val = cpu_to_le32(val);
-        return cw1200_reg_write(priv, addr, &val, sizeof(val));
+        __le32 tmp = cpu_to_le32(val);
+        return cw1200_reg_write(priv, addr, &tmp, sizeof(val));
 }
 
 int cw1200_indirect_read(struct cw1200_common *priv, u32 addr, void *buf,
@@ -224,22 +223,24 @@ static inline int cw1200_ahb_read(struct cw1200_common *priv, u32 addr,
 static inline int cw1200_apb_read_32(struct cw1200_common *priv,
                                      u32 addr, u32 *val)
 {
-        int i = cw1200_apb_read(priv, addr, val, sizeof(*val));
-        *val = le32_to_cpu(*val);
+        __le32 tmp;
+        int i = cw1200_apb_read(priv, addr, &tmp, sizeof(tmp));
+        *val = le32_to_cpu(tmp);
         return i;
 }
 
 static inline int cw1200_apb_write_32(struct cw1200_common *priv,
                                       u32 addr, u32 val)
 {
-        val = cpu_to_le32(val);
-        return cw1200_apb_write(priv, addr, &val, sizeof(val));
+        __le32 tmp = cpu_to_le32(val);
+        return cw1200_apb_write(priv, addr, &tmp, sizeof(val));
 }
 static inline int cw1200_ahb_read_32(struct cw1200_common *priv,
                                      u32 addr, u32 *val)
 {
-        int i = cw1200_ahb_read(priv, addr, val, sizeof(*val));
-        *val = le32_to_cpu(*val);
+        __le32 tmp;
+        int i = cw1200_ahb_read(priv, addr, &tmp, sizeof(tmp));
+        *val = le32_to_cpu(tmp);
         return i;
 }
 
diff --git a/drivers/net/wireless/cw1200/main.c b/drivers/net/wireless/cw1200/main.c
index da885036ca5f..3724e739cbf4 100644
--- a/drivers/net/wireless/cw1200/main.c
+++ b/drivers/net/wireless/cw1200/main.c
@@ -238,8 +238,8 @@ static const struct ieee80211_ops cw1200_ops = {
         /*.cancel_remain_on_channel = cw1200_cancel_remain_on_channel,  */
 };
 
-int cw1200_ba_rx_tids = -1;
-int cw1200_ba_tx_tids = -1;
+static int cw1200_ba_rx_tids = -1;
+static int cw1200_ba_tx_tids = -1;
 module_param(cw1200_ba_rx_tids, int, 0644);
 module_param(cw1200_ba_tx_tids, int, 0644);
 MODULE_PARM_DESC(cw1200_ba_rx_tids, "Block ACK RX TIDs");
diff --git a/drivers/net/wireless/cw1200/queue.c b/drivers/net/wireless/cw1200/queue.c
index 8510454d5db1..9c3925f58d79 100644
--- a/drivers/net/wireless/cw1200/queue.c
+++ b/drivers/net/wireless/cw1200/queue.c
@@ -355,7 +355,7 @@ int cw1200_queue_get(struct cw1200_queue *queue,
                 *tx = (struct wsm_tx *)item->skb->data;
                 *tx_info = IEEE80211_SKB_CB(item->skb);
                 *txpriv = &item->txpriv;
-                (*tx)->packet_id = __cpu_to_le32(item->packet_id);
+                (*tx)->packet_id = item->packet_id;
                 list_move_tail(&item->head, &queue->pending);
                 ++queue->num_pending;
                 --queue->link_map_cache[item->txpriv.link_id];
diff --git a/drivers/net/wireless/cw1200/sta.c b/drivers/net/wireless/cw1200/sta.c
index 4cd0352b508d..7365674366f4 100644
--- a/drivers/net/wireless/cw1200/sta.c
+++ b/drivers/net/wireless/cw1200/sta.c
@@ -621,7 +621,7 @@ int cw1200_conf_tx(struct ieee80211_hw *dev, struct ieee80211_vif *vif,
         mutex_lock(&priv->conf_mutex);
 
         if (queue < dev->queues) {
-                old_uapsd_flags = priv->uapsd_info.uapsd_flags;
+                old_uapsd_flags = le16_to_cpu(priv->uapsd_info.uapsd_flags);
 
                 WSM_TX_QUEUE_SET(&priv->tx_queue_params, queue, 0, 0, 0);
                 ret = wsm_set_tx_queue_params(priv,
@@ -645,7 +645,7 @@ int cw1200_conf_tx(struct ieee80211_hw *dev, struct ieee80211_vif *vif,
                         ret = cw1200_set_uapsd_param(priv, &priv->edca);
                         if (!ret && priv->setbssparams_done &&
                             (priv->join_status == CW1200_JOIN_STATUS_STA) &&
-                            (old_uapsd_flags != priv->uapsd_info.uapsd_flags))
+                            (old_uapsd_flags != le16_to_cpu(priv->uapsd_info.uapsd_flags)))
                                 ret = cw1200_set_pm(priv, &priv->powersave_mode);
                 }
         } else {
@@ -1089,18 +1089,18 @@ static int cw1200_parse_sdd_file(struct cw1200_common *priv)
                                 ret = -1;
                                 break;
                         }
-                        v = le16_to_cpu(*((u16 *)(p + 2)));
+                        v = le16_to_cpu(*((__le16 *)(p + 2)));
                         if (!v)  /* non-zero means this is enabled */
                                 break;
 
-                        v = le16_to_cpu(*((u16 *)(p + 4)));
+                        v = le16_to_cpu(*((__le16 *)(p + 4)));
                         priv->conf_listen_interval = (v >> 7) & 0x1F;
                         pr_debug("PTA found; Listen Interval %d\n",
                                  priv->conf_listen_interval);
                         break;
                 }
                 case SDD_REFERENCE_FREQUENCY_ELT_ID: {
-                        u16 clk = le16_to_cpu(*((u16 *)(p + 2)));
+                        u16 clk = le16_to_cpu(*((__le16 *)(p + 2)));
                         if (clk != priv->hw_refclk)
                                 pr_warn("SDD file doesn't match configured refclk (%d vs %d)\n",
                                         clk, priv->hw_refclk);
@@ -1785,9 +1785,9 @@ static int cw1200_set_btcoexinfo(struct cw1200_common *priv)
                 } else {
                         pr_debug("[STA] STA has non ERP rates\n");
                         /* B only mode */
-                        arg.internalTxRate = (__ffs(priv->association_mode.basic_rate_set));
+                        arg.internalTxRate = (__ffs(le32_to_cpu(priv->association_mode.basic_rate_set)));
                 }
-                arg.nonErpInternalTxRate = (__ffs(priv->association_mode.basic_rate_set));
+                arg.nonErpInternalTxRate = (__ffs(le32_to_cpu(priv->association_mode.basic_rate_set)));
         } else {
                 /* P2P mode */
                 arg.internalTxRate = (__ffs(priv->bss_params.operational_rate_set & ~0xF));
@@ -1908,7 +1908,7 @@ void cw1200_bss_info_changed(struct ieee80211_hw *dev,
 
                 if (info->assoc || info->ibss_joined) {
                         struct ieee80211_sta *sta = NULL;
-                        u32 val = 0;
+                        __le32 htprot = 0;
 
                         if (info->dtim_period)
                                 priv->join_dtim_period = info->dtim_period;
@@ -1935,19 +1935,18 @@ void cw1200_bss_info_changed(struct ieee80211_hw *dev,
                         /* Non Greenfield stations present */
                         if (priv->ht_info.operation_mode &
                             IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT)
-                                val |= WSM_NON_GREENFIELD_STA_PRESENT;
+                                htprot |= cpu_to_le32(WSM_NON_GREENFIELD_STA_PRESENT);
 
                         /* Set HT protection method */
-                        val |= (priv->ht_info.operation_mode & IEEE80211_HT_OP_MODE_PROTECTION) << 2;
+                        htprot |= cpu_to_le32((priv->ht_info.operation_mode & IEEE80211_HT_OP_MODE_PROTECTION) << 2);
 
                         /* TODO:
                          * STBC_param.dual_cts
                          *  STBC_param.LSIG_TXOP_FILL
                          */
 
-                        val = cpu_to_le32(val);
                         wsm_write_mib(priv, WSM_MIB_ID_SET_HT_PROTECTION,
-                                      &val, sizeof(val));
+                                      &htprot, sizeof(htprot));
 
                         priv->association_mode.greenfield =
                                 cw1200_ht_greenfield(&priv->ht_info);
diff --git a/drivers/net/wireless/cw1200/txrx.c b/drivers/net/wireless/cw1200/txrx.c
index 44ca10cb0d39..5862c373d714 100644
--- a/drivers/net/wireless/cw1200/txrx.c
+++ b/drivers/net/wireless/cw1200/txrx.c
@@ -599,15 +599,15 @@ cw1200_tx_h_bt(struct cw1200_common *priv,
         } else if (ieee80211_is_data(t->hdr->frame_control)) {
                 /* Skip LLC SNAP header (+6) */
                 u8 *payload = &t->skb->data[t->hdrlen];
-                u16 *ethertype = (u16 *)&payload[6];
-                if (*ethertype == __be16_to_cpu(ETH_P_PAE))
+                __be16 *ethertype = (__be16 *)&payload[6];
+                if (be16_to_cpu(*ethertype) == ETH_P_PAE)
                         priority = WSM_EPTA_PRIORITY_EAPOL;
         } else if (ieee80211_is_assoc_req(t->hdr->frame_control) ||
                 ieee80211_is_reassoc_req(t->hdr->frame_control)) {
                 struct ieee80211_mgmt *mgt_frame =
                                 (struct ieee80211_mgmt *)t->hdr;
 
-                if (mgt_frame->u.assoc_req.listen_interval <
+                if (le16_to_cpu(mgt_frame->u.assoc_req.listen_interval) <
                                                 priv->listen_interval) {
                         pr_debug("Modified Listen Interval to %d from %d\n",
                                  priv->listen_interval,
@@ -615,8 +615,7 @@ cw1200_tx_h_bt(struct cw1200_common *priv,
                         /* Replace listen interval derieved from
                          * the one read from SDD
                          */
-                        mgt_frame->u.assoc_req.listen_interval =
-                                priv->listen_interval;
+                        mgt_frame->u.assoc_req.listen_interval = cpu_to_le16(priv->listen_interval);
                 }
         }
 
diff --git a/drivers/net/wireless/cw1200/wsm.c b/drivers/net/wireless/cw1200/wsm.c
index d95094fdcc50..cbb74d7a9be5 100644
--- a/drivers/net/wireless/cw1200/wsm.c
+++ b/drivers/net/wireless/cw1200/wsm.c
@@ -42,19 +42,19 @@
                 (buf)->data += size;                                    \
         } while (0)
 
-#define __WSM_GET(buf, type, cvt)                                       \
+#define __WSM_GET(buf, type, type2, cvt)                                \
         ({                                                              \
                 type val;                                               \
                 if ((buf)->data + sizeof(type) > (buf)->end)            \
                         goto underflow;                                 \
-                val = cvt(*(type *)(buf)->data);                        \
+                val = cvt(*(type2 *)(buf)->data);                       \
                 (buf)->data += sizeof(type);                            \
                 val;                                                    \
         })
 
-#define WSM_GET8(buf)  __WSM_GET(buf, u8, (u8))
-#define WSM_GET16(buf) __WSM_GET(buf, u16, __le16_to_cpu)
-#define WSM_GET32(buf) __WSM_GET(buf, u32, __le32_to_cpu)
+#define WSM_GET8(buf)  __WSM_GET(buf, u8, u8, (u8))
+#define WSM_GET16(buf) __WSM_GET(buf, u16, __le16, __le16_to_cpu)
+#define WSM_GET32(buf) __WSM_GET(buf, u32, __le32, __le32_to_cpu)
 
 #define WSM_PUT(buf, ptr, size)                                         \
         do {                                                            \
@@ -65,18 +65,18 @@
                 (buf)->data += size;                                    \
         } while (0)
 
-#define __WSM_PUT(buf, val, type, cvt)                                  \
+#define __WSM_PUT(buf, val, type, type2, cvt)                           \
         do {                                                            \
                 if ((buf)->data + sizeof(type) > (buf)->end)            \
                         if (wsm_buf_reserve((buf), sizeof(type))) \
                                 goto nomem;                             \
-                *(type *)(buf)->data = cvt(val);                        \
+                *(type2 *)(buf)->data = cvt(val);                       \
                 (buf)->data += sizeof(type);                            \
         } while (0)
 
-#define WSM_PUT8(buf, val)  __WSM_PUT(buf, val, u8, (u8))
-#define WSM_PUT16(buf, val) __WSM_PUT(buf, val, u16, __cpu_to_le16)
-#define WSM_PUT32(buf, val) __WSM_PUT(buf, val, u32, __cpu_to_le32)
+#define WSM_PUT8(buf, val)  __WSM_PUT(buf, val, u8, u8, (u8))
+#define WSM_PUT16(buf, val) __WSM_PUT(buf, val, u16, __le16, __cpu_to_le16)
+#define WSM_PUT32(buf, val) __WSM_PUT(buf, val, u32, __le32, __cpu_to_le32)
 
 static void wsm_buf_reset(struct wsm_buf *buf);
 static int wsm_buf_reserve(struct wsm_buf *buf, size_t extra_size);
@@ -931,8 +931,8 @@ static int wsm_event_indication(struct cw1200_common *priv, struct wsm_buf *buf)
         if (!event)
                 return -ENOMEM;
 
-        event->evt.id = __le32_to_cpu(WSM_GET32(buf));
-        event->evt.data = __le32_to_cpu(WSM_GET32(buf));
+        event->evt.id = WSM_GET32(buf);
+        event->evt.data = WSM_GET32(buf);
 
         pr_debug("[WSM] Event: %d(%d)\n",
                  event->evt.id, event->evt.data);
@@ -1311,7 +1311,7 @@ int wsm_handle_rx(struct cw1200_common *priv, u16 id,
 
         wsm_buf.begin = (u8 *)&wsm[0];
         wsm_buf.data = (u8 *)&wsm[1];
-        wsm_buf.end = &wsm_buf.begin[__le32_to_cpu(wsm->len)];
+        wsm_buf.end = &wsm_buf.begin[__le16_to_cpu(wsm->len)];
 
         pr_debug("[WSM] <<< 0x%.4X (%td)\n", id,
                  wsm_buf.end - wsm_buf.begin);
@@ -1550,7 +1550,7 @@ static bool wsm_handle_tx_data(struct cw1200_common *priv,
                  */
                 pr_debug("[WSM] Convert probe request to scan.\n");
                 wsm_lock_tx_async(priv);
-                priv->pending_frame_id = __le32_to_cpu(wsm->packet_id);
+                priv->pending_frame_id = wsm->packet_id;
                 if (queue_delayed_work(priv->workqueue,
                                        &priv->scan.probe_work, 0) <= 0)
                         wsm_unlock_tx(priv);
@@ -1558,15 +1558,14 @@ static bool wsm_handle_tx_data(struct cw1200_common *priv,
                 break;
         case do_drop:
                 pr_debug("[WSM] Drop frame (0x%.4X).\n", fctl);
-                BUG_ON(cw1200_queue_remove(queue,
-                                           __le32_to_cpu(wsm->packet_id)));
+                BUG_ON(cw1200_queue_remove(queue, wsm->packet_id));
                 handled = true;
                 break;
         case do_wep:
                 pr_debug("[WSM] Issue set_default_wep_key.\n");
                 wsm_lock_tx_async(priv);
                 priv->wep_default_key_id = tx_info->control.hw_key->keyidx;
-                priv->pending_frame_id = __le32_to_cpu(wsm->packet_id);
+                priv->pending_frame_id = wsm->packet_id;
                 if (queue_work(priv->workqueue, &priv->wep_key_work) <= 0)
                         wsm_unlock_tx(priv);
                 handled = true;
diff --git a/drivers/net/wireless/cw1200/wsm.h b/drivers/net/wireless/cw1200/wsm.h
index 2816171f7a1d..7afc613c3706 100644
--- a/drivers/net/wireless/cw1200/wsm.h
+++ b/drivers/net/wireless/cw1200/wsm.h
@@ -806,7 +806,7 @@ struct wsm_tx {
         struct wsm_hdr hdr;
 
         /* Packet identifier that meant to be used in completion. */
-        __le32 packet_id;
+        u32 packet_id;  /* Note this is actually a cookie */
 
         /* WSM_TRANSMIT_RATE_... */
         u8 max_tx_rate;
@@ -825,18 +825,18 @@ struct wsm_tx {
         u8 flags;
 
         /* Should be 0. */
-        __le32 reserved;
+        u32 reserved;
 
         /* The elapsed time in TUs, after the initial transmission */
         /* of an MSDU, after which further attempts to transmit */
         /* the MSDU shall be terminated. Overrides the global */
         /* dot11MaxTransmitMsduLifeTime setting [optional] */
         /* Device will set the default value if this is 0. */
-        __le32 expire_time;
+        u32 expire_time;
 
         /* WSM_HT_TX_... */
         __le32 ht_tx_parameters;
-};
+} __packed;
 
 /* = sizeof(generic hi hdr) + sizeof(wsm hdr) + sizeof(alignment) */
 #define WSM_TX_EXTRA_HEADROOM (28)
@@ -846,10 +846,10 @@ struct wsm_tx {
 
 struct wsm_rx {
         /* WSM_STATUS_... */
-        __le32 status;
+        u32 status;
 
         /* Specifies the channel of the received packet. */
-        __le16 channel_number;
+        u16 channel_number;
 
         /* WSM_TRANSMIT_RATE_... */
         u8 rx_rate;
@@ -859,11 +859,8 @@ struct wsm_rx {
         u8 rcpi_rssi;
 
         /* WSM_RX_STATUS_... */
-        __le32 flags;
-
-        /* Payload */
-        u8 data[0];
-} __packed;
+        u32 flags;
+};
 
 /* = sizeof(generic hi hdr) + sizeof(wsm hdr) */
 #define WSM_RX_EXTRA_HEADROOM (16)
@@ -1119,22 +1116,22 @@ int wsm_set_tx_queue_params(struct cw1200_common *priv,
 #define WSM_EDCA_PARAMS_RESP_ID 0x0413
 struct wsm_edca_queue_params {
         /* CWmin (in slots) for the access class. */
-        __le16 cwmin;
+        u16 cwmin;
 
         /* CWmax (in slots) for the access class. */
-        __le16 cwmax;
+        u16 cwmax;
 
         /* AIFS (in slots) for the access class. */
-        __le16 aifns;
+        u16 aifns;
 
         /* TX OP Limit (in microseconds) for the access class. */
-        __le16 txop_limit;
+        u16 txop_limit;
 
         /* dot11MaxReceiveLifetime to be used for the specified */
         /* the access class. Overrides the global */
         /* dot11MaxReceiveLifetime value */
-        __le32 max_rx_lifetime;
-} __packed;
+        u32 max_rx_lifetime;
+};
 
 struct wsm_edca_params {
         /* NOTE: index is a linux queue id. */
@@ -1147,12 +1144,12 @@ struct wsm_edca_params {
                      __uapsd) \
         do {                                                    \
                 struct wsm_edca_queue_params *p = &(__edca)->params[__queue]; \
-                p->cwmin = (__cw_min);                          \
-                p->cwmax = (__cw_max);                          \
-                p->aifns = (__aifs);                            \
-                p->txop_limit = ((__txop) * TXOP_UNIT);         \
-                p->max_rx_lifetime = (__lifetime);              \
-                (__edca)->uapsd_enable[__queue] = (__uapsd);    \
+                p->cwmin = __cw_min;                                    \
+                p->cwmax = __cw_max;                                    \
+                p->aifns = __aifs;                                      \
+                p->txop_limit = ((__txop) * TXOP_UNIT);                 \
+                p->max_rx_lifetime = __lifetime;                        \
+                (__edca)->uapsd_enable[__queue] = (__uapsd);            \
         } while (0)
 
 int wsm_set_edca_params(struct cw1200_common *priv,
@@ -1475,7 +1472,7 @@ static inline int wsm_set_template_frame(struct cw1200_common *priv,
         u8 *p = skb_push(arg->skb, 4);
         p[0] = arg->frame_type;
         p[1] = arg->rate;
-        ((u16 *)p)[1] = __cpu_to_le16(arg->skb->len - 4);
+        ((__le16 *)p)[1] = __cpu_to_le16(arg->skb->len - 4);
         ret = wsm_write_mib(priv, WSM_MIB_ID_TEMPLATE_FRAME, p, arg->skb->len);
         skb_pull(arg->skb, 4);
         return ret;
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index d96257b79a84..312fa0e42e6f 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -3548,6 +3548,7 @@ static int ipw_load(struct ipw_priv *priv)
                 ipw_rx_queue_reset(priv, priv->rxq);
         if (!priv->rxq) {
                 IPW_ERROR("Unable to initialize Rx queue\n");
+                rc = -ENOMEM;
                 goto error;
         }
 
diff --git a/drivers/net/wireless/ipw2x00/libipw_rx.c b/drivers/net/wireless/ipw2x00/libipw_rx.c
index 95a1ca1e895c..9ffe65931b29 100644
--- a/drivers/net/wireless/ipw2x00/libipw_rx.c
+++ b/drivers/net/wireless/ipw2x00/libipw_rx.c
@@ -1195,7 +1195,7 @@ static int libipw_parse_info_param(struct libipw_info_element
 #ifdef CONFIG_LIBIPW_DEBUG
                                 p += snprintf(p, sizeof(rates_str) -
                                               (p - rates_str), "%02X ",
-                                              network->rates[i]);
+                                              network->rates_ex[i]);
 #endif
                                 if (libipw_is_ofdm_rate
                                     (info_element->data[i])) {
diff --git a/drivers/net/wireless/iwlwifi/Kconfig b/drivers/net/wireless/iwlwifi/Kconfig
index 56c2040a955b..cbaa5c2c410f 100644
--- a/drivers/net/wireless/iwlwifi/Kconfig
+++ b/drivers/net/wireless/iwlwifi/Kconfig
@@ -128,16 +128,6 @@ config IWLWIFI_DEVICE_TRACING
           occur.
 endmenu
 
-config IWLWIFI_DEVICE_TESTMODE
-        def_bool y
-        depends on IWLWIFI
-        depends on NL80211_TESTMODE
-        help
-          This option enables the testmode support for iwlwifi device through
-          NL80211_TESTMODE. This provide the capabilities of enable user space
-          validation applications to interacts with the device through the
-          generic netlink message via NL80211_TESTMODE channel.
-
 config IWLWIFI_P2P
         def_bool y
         bool "iwlwifi experimental P2P support"
diff --git a/drivers/net/wireless/iwlwifi/Makefile b/drivers/net/wireless/iwlwifi/Makefile
index f55a758b87f6..1fa64429bcc2 100644
--- a/drivers/net/wireless/iwlwifi/Makefile
+++ b/drivers/net/wireless/iwlwifi/Makefile
@@ -13,7 +13,6 @@ iwlwifi-$(CONFIG_IWLMVM) += iwl-7000.o
 iwlwifi-objs += $(iwlwifi-m)
 
 iwlwifi-$(CONFIG_IWLWIFI_DEVICE_TRACING) += iwl-devtrace.o
-iwlwifi-$(CONFIG_IWLWIFI_DEVICE_TESTMODE) += iwl-test.o
 
 ccflags-y += -D__CHECK_ENDIAN__ -I$(src)
 
diff --git a/drivers/net/wireless/iwlwifi/dvm/Makefile b/drivers/net/wireless/iwlwifi/dvm/Makefile
index 5ff76b204141..dce7ab2e0c4b 100644
--- a/drivers/net/wireless/iwlwifi/dvm/Makefile
+++ b/drivers/net/wireless/iwlwifi/dvm/Makefile
@@ -8,6 +8,5 @@ iwldvm-objs		+= scan.o led.o
 iwldvm-objs             += rxon.o devices.o
 
 iwldvm-$(CONFIG_IWLWIFI_DEBUGFS) += debugfs.o
-iwldvm-$(CONFIG_IWLWIFI_DEVICE_TESTMODE) += testmode.o
 
 ccflags-y += -D__CHECK_ENDIAN__ -I$(src)/../
diff --git a/drivers/net/wireless/iwlwifi/dvm/agn.h b/drivers/net/wireless/iwlwifi/dvm/agn.h
index de2c9514bef6..18355110deff 100644
--- a/drivers/net/wireless/iwlwifi/dvm/agn.h
+++ b/drivers/net/wireless/iwlwifi/dvm/agn.h
@@ -405,43 +405,6 @@ static inline __le32 iwl_hw_set_rate_n_flags(u8 rate, u32 flags)
 
 extern int iwl_alive_start(struct iwl_priv *priv);
 
-/* testmode support */
-#ifdef CONFIG_IWLWIFI_DEVICE_TESTMODE
-
-extern int iwlagn_mac_testmode_cmd(struct ieee80211_hw *hw, void *data,
-                                   int len);
-extern int iwlagn_mac_testmode_dump(struct ieee80211_hw *hw,
-                                    struct sk_buff *skb,
-                                    struct netlink_callback *cb,
-                                    void *data, int len);
-extern void iwl_testmode_init(struct iwl_priv *priv);
-extern void iwl_testmode_free(struct iwl_priv *priv);
-
-#else
-
-static inline
-int iwlagn_mac_testmode_cmd(struct ieee80211_hw *hw, void *data, int len)
-{
-        return -ENOSYS;
-}
-
-static inline
-int iwlagn_mac_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *skb,
-                      struct netlink_callback *cb,
-                      void *data, int len)
-{
-        return -ENOSYS;
-}
-
-static inline void iwl_testmode_init(struct iwl_priv *priv)
-{
-}
-
-static inline void iwl_testmode_free(struct iwl_priv *priv)
-{
-}
-#endif
-
 #ifdef CONFIG_IWLWIFI_DEBUG
 void iwl_print_rx_config_cmd(struct iwl_priv *priv,
                              enum iwl_rxon_context_id ctxid);
diff --git a/drivers/net/wireless/iwlwifi/dvm/dev.h b/drivers/net/wireless/iwlwifi/dvm/dev.h
index 5cd87f949266..60a4e0d15715 100644
--- a/drivers/net/wireless/iwlwifi/dvm/dev.h
+++ b/drivers/net/wireless/iwlwifi/dvm/dev.h
@@ -52,8 +52,6 @@
 #include "rs.h"
 #include "tt.h"
 
-#include "iwl-test.h"
-
 /* CT-KILL constants */
 #define CT_KILL_THRESHOLD_LEGACY   110 /* in Celsius */
 #define CT_KILL_THRESHOLD          114 /* in Celsius */
@@ -691,10 +689,6 @@ struct iwl_priv {
         struct iwl_spectrum_notification measure_report;
         u8 measurement_status;
 
-#define IWL_OWNERSHIP_DRIVER    0
-#define IWL_OWNERSHIP_TM        1
-        u8 ucode_owner;
-
         /* ucode beacon time */
         u32 ucode_beacon_time;
         int missed_beacon_threshold;
@@ -889,7 +883,7 @@ struct iwl_priv {
 #endif /* CONFIG_IWLWIFI_DEBUGFS */
 
         struct iwl_nvm_data *nvm_data;
-        /* eeprom blob for debugfs/testmode */
+        /* eeprom blob for debugfs */
         u8 *eeprom_blob;
         size_t eeprom_blob_size;
 
@@ -905,11 +899,6 @@ struct iwl_priv {
         unsigned long blink_on, blink_off;
         bool led_registered;
 
-#ifdef CONFIG_IWLWIFI_DEVICE_TESTMODE
-        struct iwl_test tst;
-        u32 tm_fixed_rate;
-#endif
-
         /* WoWLAN GTK rekey data */
         u8 kck[NL80211_KCK_LEN], kek[NL80211_KEK_LEN];
         __le64 replay_ctr;
diff --git a/drivers/net/wireless/iwlwifi/dvm/lib.c b/drivers/net/wireless/iwlwifi/dvm/lib.c
index 9879550a0fea..3d5bdc4217a8 100644
--- a/drivers/net/wireless/iwlwifi/dvm/lib.c
+++ b/drivers/net/wireless/iwlwifi/dvm/lib.c
@@ -1288,12 +1288,6 @@ int iwl_dvm_send_cmd(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
         if (!(cmd->flags & CMD_ASYNC))
                 lockdep_assert_held(&priv->mutex);
 
-        if (priv->ucode_owner == IWL_OWNERSHIP_TM &&
-            !(cmd->flags & CMD_ON_DEMAND)) {
-                IWL_DEBUG_HC(priv, "tm own the uCode, no regular hcmd send\n");
-                return -EIO;
-        }
-
         return iwl_trans_send_cmd(priv->trans, cmd);
 }
 
diff --git a/drivers/net/wireless/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
index eef64bb854f7..822f1a00efbb 100644
--- a/drivers/net/wireless/iwlwifi/dvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
@@ -1766,8 +1766,6 @@ struct ieee80211_ops iwlagn_hw_ops = {
         .remain_on_channel = iwlagn_mac_remain_on_channel,
         .cancel_remain_on_channel = iwlagn_mac_cancel_remain_on_channel,
         .rssi_callback = iwlagn_mac_rssi_callback,
-        CFG80211_TESTMODE_CMD(iwlagn_mac_testmode_cmd)
-        CFG80211_TESTMODE_DUMP(iwlagn_mac_testmode_dump)
         .set_tim = iwlagn_mac_set_tim,
 };
 
diff --git a/drivers/net/wireless/iwlwifi/dvm/main.c b/drivers/net/wireless/iwlwifi/dvm/main.c
index 7aa9c8dc33ef..3952ddf2ddb2 100644
--- a/drivers/net/wireless/iwlwifi/dvm/main.c
+++ b/drivers/net/wireless/iwlwifi/dvm/main.c
@@ -1105,8 +1105,6 @@ static int iwl_init_drv(struct iwl_priv *priv)
         priv->missed_beacon_threshold = IWL_MISSED_BEACON_THRESHOLD_DEF;
         priv->agg_tids_count = 0;
 
-        priv->ucode_owner = IWL_OWNERSHIP_DRIVER;
-
         priv->rx_statistics_jiffies = jiffies;
 
         /* Choose which receivers/antennas to use */
@@ -1172,12 +1170,6 @@ static void iwl_option_config(struct iwl_priv *priv)
         IWL_INFO(priv, "CONFIG_IWLWIFI_DEVICE_TRACING disabled\n");
 #endif
 
-#ifdef CONFIG_IWLWIFI_DEVICE_TESTMODE
-        IWL_INFO(priv, "CONFIG_IWLWIFI_DEVICE_TESTMODE enabled\n");
-#else
-        IWL_INFO(priv, "CONFIG_IWLWIFI_DEVICE_TESTMODE disabled\n");
-#endif
-
 #ifdef CONFIG_IWLWIFI_P2P
         IWL_INFO(priv, "CONFIG_IWLWIFI_P2P enabled\n");
 #else
@@ -1355,8 +1347,8 @@ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans,
                         IWL_BT_ANTENNA_COUPLING_THRESHOLD) ?
                         true : false;
 
-        /* enable/disable bt channel inhibition */
-        priv->bt_ch_announce = iwlwifi_mod_params.bt_ch_announce;
+        /* bt channel inhibition enabled*/
+        priv->bt_ch_announce = true;
         IWL_DEBUG_INFO(priv, "BT channel inhibition is %s\n",
                        (priv->bt_ch_announce) ? "On" : "Off");
 
@@ -1451,7 +1443,6 @@ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans,
          ********************/
         iwl_setup_deferred_work(priv);
         iwl_setup_rx_handlers(priv);
-        iwl_testmode_init(priv);
 
         iwl_power_initialize(priv);
         iwl_tt_initialize(priv);
@@ -1488,7 +1479,6 @@ out_mac80211_unregister:
         iwlagn_mac_unregister(priv);
 out_destroy_workqueue:
         iwl_tt_exit(priv);
-        iwl_testmode_free(priv);
         iwl_cancel_deferred_work(priv);
         destroy_workqueue(priv->workqueue);
         priv->workqueue = NULL;
@@ -1510,7 +1500,6 @@ static void iwl_op_mode_dvm_stop(struct iwl_op_mode *op_mode)
 
         IWL_DEBUG_INFO(priv, "*** UNLOAD DRIVER ***\n");
 
-        iwl_testmode_free(priv);
         iwlagn_mac_unregister(priv);
 
         iwl_tt_exit(priv);
diff --git a/drivers/net/wireless/iwlwifi/dvm/rs.c b/drivers/net/wireless/iwlwifi/dvm/rs.c
index 8fe76dc4f373..1b693944123b 100644
--- a/drivers/net/wireless/iwlwifi/dvm/rs.c
+++ b/drivers/net/wireless/iwlwifi/dvm/rs.c
@@ -351,12 +351,6 @@ static void rs_program_fix_rate(struct iwl_priv *priv,
         lq_sta->active_mimo2_rate  = 0x1FD0;    /* 6 - 60 MBits, no 9, no CCK */
         lq_sta->active_mimo3_rate  = 0x1FD0;    /* 6 - 60 MBits, no 9, no CCK */
 
-#ifdef CONFIG_IWLWIFI_DEVICE_TESTMODE
-        /* testmode has higher priority to overwirte the fixed rate */
-        if (priv->tm_fixed_rate)
-                lq_sta->dbg_fixed_rate = priv->tm_fixed_rate;
-#endif
-
         IWL_DEBUG_RATE(priv, "sta_id %d rate 0x%X\n",
                 lq_sta->lq.sta_id, lq_sta->dbg_fixed_rate);
 
@@ -419,23 +413,18 @@ static int rs_tl_turn_on_agg_for_tid(struct iwl_priv *priv,
 
         load = rs_tl_get_load(lq_data, tid);
 
-        if ((iwlwifi_mod_params.auto_agg) || (load > IWL_AGG_LOAD_THRESHOLD)) {
-                IWL_DEBUG_HT(priv, "Starting Tx agg: STA: %pM tid: %d\n",
-                                sta->addr, tid);
-                ret = ieee80211_start_tx_ba_session(sta, tid, 5000);
-                if (ret == -EAGAIN) {
-                        /*
-                         * driver and mac80211 is out of sync
-                         * this might be cause by reloading firmware
-                         * stop the tx ba session here
-                         */
-                        IWL_ERR(priv, "Fail start Tx agg on tid: %d\n",
-                                tid);
-                        ieee80211_stop_tx_ba_session(sta, tid);
-                }
-        } else {
-                IWL_DEBUG_HT(priv, "Aggregation not enabled for tid %d "
-                        "because load = %u\n", tid, load);
+        IWL_DEBUG_HT(priv, "Starting Tx agg: STA: %pM tid: %d\n",
+                        sta->addr, tid);
+        ret = ieee80211_start_tx_ba_session(sta, tid, 5000);
+        if (ret == -EAGAIN) {
+                /*
+                 * driver and mac80211 is out of sync
+                 * this might be cause by reloading firmware
+                 * stop the tx ba session here
+                 */
+                IWL_ERR(priv, "Fail start Tx agg on tid: %d\n",
+                        tid);
+                ieee80211_stop_tx_ba_session(sta, tid);
         }
         return ret;
 }
@@ -1083,11 +1072,6 @@ done:
         if (sta && sta->supp_rates[sband->band])
                 rs_rate_scale_perform(priv, skb, sta, lq_sta);
 
-#if defined(CONFIG_MAC80211_DEBUGFS) && defined(CONFIG_IWLWIFI_DEVICE_TESTMODE)
-        if ((priv->tm_fixed_rate) &&
-            (priv->tm_fixed_rate != lq_sta->dbg_fixed_rate))
-                rs_program_fix_rate(priv, lq_sta);
-#endif
         if (priv->lib->bt_params && priv->lib->bt_params->advanced_bt_coexist)
                 rs_bt_update_lq(priv, ctx, lq_sta);
 }
@@ -2913,9 +2897,6 @@ void iwl_rs_rate_init(struct iwl_priv *priv, struct ieee80211_sta *sta, u8 sta_i
         if (sband->band == IEEE80211_BAND_5GHZ)
                 lq_sta->last_txrate_idx += IWL_FIRST_OFDM_RATE;
         lq_sta->is_agg = 0;
-#ifdef CONFIG_IWLWIFI_DEVICE_TESTMODE
-        priv->tm_fixed_rate = 0;
-#endif
 #ifdef CONFIG_MAC80211_DEBUGFS
         lq_sta->dbg_fixed_rate = 0;
 #endif
diff --git a/drivers/net/wireless/iwlwifi/dvm/rx.c b/drivers/net/wireless/iwlwifi/dvm/rx.c
index 2f3fd160ab44..d71776dd1e6a 100644
--- a/drivers/net/wireless/iwlwifi/dvm/rx.c
+++ b/drivers/net/wireless/iwlwifi/dvm/rx.c
@@ -335,8 +335,7 @@ static void iwlagn_recover_from_statistics(struct iwl_priv *priv,
         if (msecs < 99)
                 return;
 
-        if (iwlwifi_mod_params.plcp_check &&
-            !iwlagn_good_plcp_health(priv, cur_ofdm, cur_ofdm_ht, msecs))
+        if (!iwlagn_good_plcp_health(priv, cur_ofdm, cur_ofdm_ht, msecs))
                 iwl_force_rf_reset(priv, false);
 }
 
@@ -1120,32 +1119,17 @@ int iwl_rx_dispatch(struct iwl_op_mode *op_mode, struct iwl_rx_cmd_buffer *rxb,
          */
         iwl_notification_wait_notify(&priv->notif_wait, pkt);
 
-#ifdef CONFIG_IWLWIFI_DEVICE_TESTMODE
-        /*
-         * RX data may be forwarded to userspace in one
-         * of two cases: the user owns the fw through testmode or when
-         * the user requested to monitor the rx w/o affecting the regular flow.
-         * In these cases the iwl_test object will handle forwarding the rx
-         * data to user space.
-         * Note that if the ownership flag != IWL_OWNERSHIP_TM the flow
-         * continues.
-         */
-        iwl_test_rx(&priv->tst, rxb);
-#endif
-
-        if (priv->ucode_owner != IWL_OWNERSHIP_TM) {
-                /* Based on type of command response or notification,
-                 *   handle those that need handling via function in
-                 *   rx_handlers table.  See iwl_setup_rx_handlers() */
-                if (priv->rx_handlers[pkt->hdr.cmd]) {
-                        priv->rx_handlers_stats[pkt->hdr.cmd]++;
-                        err = priv->rx_handlers[pkt->hdr.cmd] (priv, rxb, cmd);
-                } else {
-                        /* No handling needed */
-                        IWL_DEBUG_RX(priv, "No handler needed for %s, 0x%02x\n",
-                                     iwl_dvm_get_cmd_string(pkt->hdr.cmd),
-                                     pkt->hdr.cmd);
-                }
+        /* Based on type of command response or notification,
+         *   handle those that need handling via function in
+         *   rx_handlers table.  See iwl_setup_rx_handlers() */
+        if (priv->rx_handlers[pkt->hdr.cmd]) {
+                priv->rx_handlers_stats[pkt->hdr.cmd]++;
+                err = priv->rx_handlers[pkt->hdr.cmd] (priv, rxb, cmd);
+        } else {
+                /* No handling needed */
+                IWL_DEBUG_RX(priv, "No handler needed for %s, 0x%02x\n",
+                             iwl_dvm_get_cmd_string(pkt->hdr.cmd),
+                             pkt->hdr.cmd);
         }
         return err;
 }
diff --git a/drivers/net/wireless/iwlwifi/dvm/testmode.c b/drivers/net/wireless/iwlwifi/dvm/testmode.c
deleted file mode 100644
index b89b9d9b9969..000000000000
--- a/drivers/net/wireless/iwlwifi/dvm/testmode.c
+++ /dev/null
@@ -1,471 +0,0 @@
-/******************************************************************************
- *
- * This file is provided under a dual BSD/GPLv2 license.  When using or
- * redistributing this file, you may do so under either license.
- *
- * GPL LICENSE SUMMARY
- *
- * Copyright(c) 2010 - 2013 Intel Corporation. All rights reserved.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of version 2 of the GNU General Public License as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
- * USA
- *
- * The full GNU General Public License is included in this distribution
- * in the file called COPYING.
- *
- * Contact Information:
- *  Intel Linux Wireless <ilw@linux.intel.com>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- * BSD LICENSE
- *
- * Copyright(c) 2010 - 2013 Intel Corporation. All rights reserved.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *  * Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *  * Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *  * Neither the name Intel Corporation nor the names of its
- *    contributors may be used to endorse or promote products derived
- *    from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- *****************************************************************************/
-
-#include <linux/init.h>
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/dma-mapping.h>
-#include <net/net_namespace.h>
-#include <linux/netdevice.h>
-#include <net/cfg80211.h>
-#include <net/mac80211.h>
-#include <net/netlink.h>
-
-#include "iwl-debug.h"
-#include "iwl-trans.h"
-#include "dev.h"
-#include "agn.h"
-#include "iwl-test.h"
-#include "iwl-testmode.h"
-
-static int iwl_testmode_send_cmd(struct iwl_op_mode *op_mode,
-                                 struct iwl_host_cmd *cmd)
-{
-        struct iwl_priv *priv = IWL_OP_MODE_GET_DVM(op_mode);
-        return iwl_dvm_send_cmd(priv, cmd);
-}
-
-static bool iwl_testmode_valid_hw_addr(u32 addr)
-{
-        if (iwlagn_hw_valid_rtc_data_addr(addr))
-                return true;
-
-        if (IWLAGN_RTC_INST_LOWER_BOUND <= addr &&
-            addr < IWLAGN_RTC_INST_UPPER_BOUND)
-                return true;
-
-        return false;
-}
-
-static u32 iwl_testmode_get_fw_ver(struct iwl_op_mode *op_mode)
-{
-        struct iwl_priv *priv = IWL_OP_MODE_GET_DVM(op_mode);
-        return priv->fw->ucode_ver;
-}
-
-static struct sk_buff*
-iwl_testmode_alloc_reply(struct iwl_op_mode *op_mode, int len)
-{
-        struct iwl_priv *priv = IWL_OP_MODE_GET_DVM(op_mode);
-        return cfg80211_testmode_alloc_reply_skb(priv->hw->wiphy, len);
-}
-
-static int iwl_testmode_reply(struct iwl_op_mode *op_mode, struct sk_buff *skb)
-{
-        return cfg80211_testmode_reply(skb);
-}
-
-static struct sk_buff *iwl_testmode_alloc_event(struct iwl_op_mode *op_mode,
-                                                int len)
-{
-        struct iwl_priv *priv = IWL_OP_MODE_GET_DVM(op_mode);
-        return cfg80211_testmode_alloc_event_skb(priv->hw->wiphy, len,
-                                                 GFP_ATOMIC);
-}
-
-static void iwl_testmode_event(struct iwl_op_mode *op_mode, struct sk_buff *skb)
-{
-        return cfg80211_testmode_event(skb, GFP_ATOMIC);
-}
-
-static struct iwl_test_ops tst_ops = {
-        .send_cmd = iwl_testmode_send_cmd,
-        .valid_hw_addr = iwl_testmode_valid_hw_addr,
-        .get_fw_ver = iwl_testmode_get_fw_ver,
-        .alloc_reply = iwl_testmode_alloc_reply,
-        .reply = iwl_testmode_reply,
-        .alloc_event = iwl_testmode_alloc_event,
-        .event = iwl_testmode_event,
-};
-
-void iwl_testmode_init(struct iwl_priv *priv)
-{
-        iwl_test_init(&priv->tst, priv->trans, &tst_ops);
-}
-
-void iwl_testmode_free(struct iwl_priv *priv)
-{
-        iwl_test_free(&priv->tst);
-}
-
-static int iwl_testmode_cfg_init_calib(struct iwl_priv *priv)
-{
-        struct iwl_notification_wait calib_wait;
-        static const u8 calib_complete[] = {
-                CALIBRATION_COMPLETE_NOTIFICATION
-        };
-        int ret;
-
-        iwl_init_notification_wait(&priv->notif_wait, &calib_wait,
-                                   calib_complete, ARRAY_SIZE(calib_complete),
-                                   NULL, NULL);
-        ret = iwl_init_alive_start(priv);
-        if (ret) {
-                IWL_ERR(priv, "Fail init calibration: %d\n", ret);
-                goto cfg_init_calib_error;
-        }
-
-        ret = iwl_wait_notification(&priv->notif_wait, &calib_wait, 2 * HZ);
-        if (ret)
-                IWL_ERR(priv, "Error detecting"
-                        " CALIBRATION_COMPLETE_NOTIFICATION: %d\n", ret);
-        return ret;
-
-cfg_init_calib_error:
-        iwl_remove_notification(&priv->notif_wait, &calib_wait);
-        return ret;
-}
-
-/*
- * This function handles the user application commands for driver.
- *
- * It retrieves command ID carried with IWL_TM_ATTR_COMMAND and calls to the
- * handlers respectively.
- *
- * If it's an unknown commdn ID, -ENOSYS is replied; otherwise, the returned
- * value of the actual command execution is replied to the user application.
- *
- * If there's any message responding to the user space, IWL_TM_ATTR_SYNC_RSP
- * is used for carry the message while IWL_TM_ATTR_COMMAND must set to
- * IWL_TM_CMD_DEV2APP_SYNC_RSP.
- *
- * @hw: ieee80211_hw object that represents the device
- * @tb: gnl message fields from the user space
- */
-static int iwl_testmode_driver(struct ieee80211_hw *hw, struct nlattr **tb)
-{
-        struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
-        struct iwl_trans *trans = priv->trans;
-        struct sk_buff *skb;
-        unsigned char *rsp_data_ptr = NULL;
-        int status = 0, rsp_data_len = 0;
-        u32 inst_size = 0, data_size = 0;
-        const struct fw_img *img;
-
-        switch (nla_get_u32(tb[IWL_TM_ATTR_COMMAND])) {
-        case IWL_TM_CMD_APP2DEV_GET_DEVICENAME:
-                rsp_data_ptr = (unsigned char *)priv->cfg->name;
-                rsp_data_len = strlen(priv->cfg->name);
-                skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy,
-                                                        rsp_data_len + 20);
-                if (!skb) {
-                        IWL_ERR(priv, "Memory allocation fail\n");
-                        return -ENOMEM;
-                }
-                if (nla_put_u32(skb, IWL_TM_ATTR_COMMAND,
-                                IWL_TM_CMD_DEV2APP_SYNC_RSP) ||
-                    nla_put(skb, IWL_TM_ATTR_SYNC_RSP,
-                            rsp_data_len, rsp_data_ptr))
-                        goto nla_put_failure;
-                status = cfg80211_testmode_reply(skb);
-                if (status < 0)
-                        IWL_ERR(priv, "Error sending msg : %d\n", status);
-                break;
-
-        case IWL_TM_CMD_APP2DEV_LOAD_INIT_FW:
-                status = iwl_load_ucode_wait_alive(priv, IWL_UCODE_INIT);
-                if (status)
-                        IWL_ERR(priv, "Error loading init ucode: %d\n", status);
-                break;
-
-        case IWL_TM_CMD_APP2DEV_CFG_INIT_CALIB:
-                iwl_testmode_cfg_init_calib(priv);
-                priv->ucode_loaded = false;
-                iwl_trans_stop_device(trans);
-                break;
-
-        case IWL_TM_CMD_APP2DEV_LOAD_RUNTIME_FW:
-                status = iwl_load_ucode_wait_alive(priv, IWL_UCODE_REGULAR);
-                if (status) {
-                        IWL_ERR(priv,
-                                "Error loading runtime ucode: %d\n", status);
-                        break;
-                }
-                status = iwl_alive_start(priv);
-                if (status)
-                        IWL_ERR(priv,
-                                "Error starting the device: %d\n", status);
-                break;
-
-        case IWL_TM_CMD_APP2DEV_LOAD_WOWLAN_FW:
-                iwl_scan_cancel_timeout(priv, 200);
-                priv->ucode_loaded = false;
-                iwl_trans_stop_device(trans);
-                status = iwl_load_ucode_wait_alive(priv, IWL_UCODE_WOWLAN);
-                if (status) {
-                        IWL_ERR(priv,
-                                "Error loading WOWLAN ucode: %d\n", status);
-                        break;
-                }
-                status = iwl_alive_start(priv);
-                if (status)
-                        IWL_ERR(priv,
-                                "Error starting the device: %d\n", status);
-                break;
-
-        case IWL_TM_CMD_APP2DEV_GET_EEPROM:
-                if (priv->eeprom_blob) {
-                        skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy,
-                                priv->eeprom_blob_size + 20);
-                        if (!skb) {
-                                IWL_ERR(priv, "Memory allocation fail\n");
-                                return -ENOMEM;
-                        }
-                        if (nla_put_u32(skb, IWL_TM_ATTR_COMMAND,
-                                        IWL_TM_CMD_DEV2APP_EEPROM_RSP) ||
-                            nla_put(skb, IWL_TM_ATTR_EEPROM,
-                                    priv->eeprom_blob_size,
-                                    priv->eeprom_blob))
-                                goto nla_put_failure;
-                        status = cfg80211_testmode_reply(skb);
-                        if (status < 0)
-                                IWL_ERR(priv, "Error sending msg : %d\n",
-                                        status);
-                } else
-                        return -ENODATA;
-                break;
-
-        case IWL_TM_CMD_APP2DEV_FIXRATE_REQ:
-                if (!tb[IWL_TM_ATTR_FIXRATE]) {
-                        IWL_ERR(priv, "Missing fixrate setting\n");
-                        return -ENOMSG;
-                }
-                priv->tm_fixed_rate = nla_get_u32(tb[IWL_TM_ATTR_FIXRATE]);
-                break;
-
-        case IWL_TM_CMD_APP2DEV_GET_FW_INFO:
-                skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, 20 + 8);
-                if (!skb) {
-                        IWL_ERR(priv, "Memory allocation fail\n");
-                        return -ENOMEM;
-                }
-                if (!priv->ucode_loaded) {
-                        IWL_ERR(priv, "No uCode has not been loaded\n");
-                        return -EINVAL;
-                } else {
-                        img = &priv->fw->img[priv->cur_ucode];
-                        inst_size = img->sec[IWL_UCODE_SECTION_INST].len;
-                        data_size = img->sec[IWL_UCODE_SECTION_DATA].len;
-                }
-                if (nla_put_u32(skb, IWL_TM_ATTR_FW_TYPE, priv->cur_ucode) ||
-                    nla_put_u32(skb, IWL_TM_ATTR_FW_INST_SIZE, inst_size) ||
-                    nla_put_u32(skb, IWL_TM_ATTR_FW_DATA_SIZE, data_size))
-                        goto nla_put_failure;
-                status = cfg80211_testmode_reply(skb);
-                if (status < 0)
-                        IWL_ERR(priv, "Error sending msg : %d\n", status);
-                break;
-
-        default:
-                IWL_ERR(priv, "Unknown testmode driver command ID\n");
-                return -ENOSYS;
-        }
-        return status;
-
-nla_put_failure:
-        kfree_skb(skb);
-        return -EMSGSIZE;
-}
-
-/*
- * This function handles the user application switch ucode ownership.
- *
- * It retrieves the mandatory fields IWL_TM_ATTR_UCODE_OWNER and
- * decide who the current owner of the uCode
- *
- * If the current owner is OWNERSHIP_TM, then the only host command
- * can deliver to uCode is from testmode, all the other host commands
- * will dropped.
- *
- * default driver is the owner of uCode in normal operational mode
- *
- * @hw: ieee80211_hw object that represents the device
- * @tb: gnl message fields from the user space
- */
-static int iwl_testmode_ownership(struct ieee80211_hw *hw, struct nlattr **tb)
-{
-        struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
-        u8 owner;
-
-        if (!tb[IWL_TM_ATTR_UCODE_OWNER]) {
-                IWL_ERR(priv, "Missing ucode owner\n");
-                return -ENOMSG;
-        }
-
-        owner = nla_get_u8(tb[IWL_TM_ATTR_UCODE_OWNER]);
-        if (owner == IWL_OWNERSHIP_DRIVER) {
-                priv->ucode_owner = owner;
-                iwl_test_enable_notifications(&priv->tst, false);
-        } else if (owner == IWL_OWNERSHIP_TM) {
-                priv->ucode_owner = owner;
-                iwl_test_enable_notifications(&priv->tst, true);
-        } else {
-                IWL_ERR(priv, "Invalid owner\n");
-                return -EINVAL;
-        }
-        return 0;
-}
-
-/* The testmode gnl message handler that takes the gnl message from the
- * user space and parses it per the policy iwl_testmode_gnl_msg_policy, then
- * invoke the corresponding handlers.
- *
- * This function is invoked when there is user space application sending
- * gnl message through the testmode tunnel NL80211_CMD_TESTMODE regulated
- * by nl80211.
- *
- * It retrieves the mandatory field, IWL_TM_ATTR_COMMAND, before
- * dispatching it to the corresponding handler.
- *
- * If IWL_TM_ATTR_COMMAND is missing, -ENOMSG is replied to user application;
- * -ENOSYS is replied to the user application if the command is unknown;
- * Otherwise, the command is dispatched to the respective handler.
- *
- * @hw: ieee80211_hw object that represents the device
- * @data: pointer to user space message
- * @len: length in byte of @data
- */
-int iwlagn_mac_testmode_cmd(struct ieee80211_hw *hw, void *data, int len)
-{
-        struct nlattr *tb[IWL_TM_ATTR_MAX];
-        struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
-        int result;
-
-        result = iwl_test_parse(&priv->tst, tb, data, len);
-        if (result)
-                return result;
-
-        /* in case multiple accesses to the device happens */
-        mutex_lock(&priv->mutex);
-        switch (nla_get_u32(tb[IWL_TM_ATTR_COMMAND])) {
-        case IWL_TM_CMD_APP2DEV_UCODE:
-        case IWL_TM_CMD_APP2DEV_DIRECT_REG_READ32:
-        case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE32:
-        case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE8:
-        case IWL_TM_CMD_APP2DEV_BEGIN_TRACE:
-        case IWL_TM_CMD_APP2DEV_END_TRACE:
-        case IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_READ:
-        case IWL_TM_CMD_APP2DEV_NOTIFICATIONS:
-        case IWL_TM_CMD_APP2DEV_GET_FW_VERSION:
-        case IWL_TM_CMD_APP2DEV_GET_DEVICE_ID:
-        case IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_WRITE:
-                result = iwl_test_handle_cmd(&priv->tst, tb);
-                break;
-
-        case IWL_TM_CMD_APP2DEV_GET_DEVICENAME:
-        case IWL_TM_CMD_APP2DEV_LOAD_INIT_FW:
-        case IWL_TM_CMD_APP2DEV_CFG_INIT_CALIB:
-        case IWL_TM_CMD_APP2DEV_LOAD_RUNTIME_FW:
-        case IWL_TM_CMD_APP2DEV_GET_EEPROM:
-        case IWL_TM_CMD_APP2DEV_FIXRATE_REQ:
-        case IWL_TM_CMD_APP2DEV_LOAD_WOWLAN_FW:
-        case IWL_TM_CMD_APP2DEV_GET_FW_INFO:
-                IWL_DEBUG_INFO(priv, "testmode cmd to driver\n");
-                result = iwl_testmode_driver(hw, tb);
-                break;
-
-        case IWL_TM_CMD_APP2DEV_OWNERSHIP:
-                IWL_DEBUG_INFO(priv, "testmode change uCode ownership\n");
-                result = iwl_testmode_ownership(hw, tb);
-                break;
-
-        default:
-                IWL_ERR(priv, "Unknown testmode command\n");
-                result = -ENOSYS;
-                break;
-        }
-        mutex_unlock(&priv->mutex);
-
-        if (result)
-                IWL_ERR(priv, "Test cmd failed result=%d\n", result);
-        return result;
-}
-
-int iwlagn_mac_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *skb,
-                      struct netlink_callback *cb,
-                      void *data, int len)
-{
-        struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
-        int result;
-        u32 cmd;
-
-        if (cb->args[3]) {
-                /* offset by 1 since commands start at 0 */
-                cmd = cb->args[3] - 1;
-        } else {
-                struct nlattr *tb[IWL_TM_ATTR_MAX];
-
-                result = iwl_test_parse(&priv->tst, tb, data, len);
-                if (result)
-                        return result;
-
-                cmd = nla_get_u32(tb[IWL_TM_ATTR_COMMAND]);
-                cb->args[3] = cmd + 1;
-        }
-
-        /* in case multiple accesses to the device happens */
-        mutex_lock(&priv->mutex);
-        result = iwl_test_dump(&priv->tst, cmd, skb, cb);
-        mutex_unlock(&priv->mutex);
-        return result;
-}
diff --git a/drivers/net/wireless/iwlwifi/dvm/tx.c b/drivers/net/wireless/iwlwifi/dvm/tx.c
index 353a053b4eb1..5ee983faa679 100644
--- a/drivers/net/wireless/iwlwifi/dvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/dvm/tx.c
@@ -162,18 +162,6 @@ static void iwlagn_tx_cmd_build_rate(struct iwl_priv *priv,
         if (ieee80211_is_data(fc)) {
                 tx_cmd->initial_rate_index = 0;
                 tx_cmd->tx_flags |= TX_CMD_FLG_STA_RATE_MSK;
-#ifdef CONFIG_IWLWIFI_DEVICE_TESTMODE
-                if (priv->tm_fixed_rate) {
-                        /*
-                         * rate overwrite by testmode
-                         * we not only send lq command to change rate
-                         * we also re-enforce per data pkt base.
-                         */
-                        tx_cmd->tx_flags &= ~TX_CMD_FLG_STA_RATE_MSK;
-                        memcpy(&tx_cmd->rate_n_flags, &priv->tm_fixed_rate,
-                               sizeof(tx_cmd->rate_n_flags));
-                }
-#endif
                 return;
         } else if (ieee80211_is_back_req(fc))
                 tx_cmd->tx_flags |= TX_CMD_FLG_STA_RATE_MSK;
diff --git a/drivers/net/wireless/iwlwifi/iwl-7000.c b/drivers/net/wireless/iwlwifi/iwl-7000.c
index d4f3b4864ab1..22b7fa5b971a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-7000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-7000.c
@@ -67,16 +67,16 @@
 #include "iwl-agn-hw.h"
 
 /* Highest firmware API version supported */
-#define IWL7260_UCODE_API_MAX   6
-#define IWL3160_UCODE_API_MAX   6
+#define IWL7260_UCODE_API_MAX   7
+#define IWL3160_UCODE_API_MAX   7
 
 /* Oldest version we won't warn about */
-#define IWL7260_UCODE_API_OK    6
-#define IWL3160_UCODE_API_OK    6
+#define IWL7260_UCODE_API_OK    7
+#define IWL3160_UCODE_API_OK    7
 
 /* Lowest firmware API version supported */
-#define IWL7260_UCODE_API_MIN   6
-#define IWL3160_UCODE_API_MIN   6
+#define IWL7260_UCODE_API_MIN   7
+#define IWL3160_UCODE_API_MIN   7
 
 /* NVM versions */
 #define IWL7260_NVM_VERSION             0x0a1d
diff --git a/drivers/net/wireless/iwlwifi/iwl-config.h b/drivers/net/wireless/iwlwifi/iwl-config.h
index 0189b9050f22..83b9ff6ff3ad 100644
--- a/drivers/net/wireless/iwlwifi/iwl-config.h
+++ b/drivers/net/wireless/iwlwifi/iwl-config.h
@@ -222,6 +222,7 @@ struct iwl_cfg {
         const u32 max_inst_size;
         u8   valid_tx_ant;
         u8   valid_rx_ant;
+        bool bt_shared_single_ant;
         u16  nvm_ver;
         u16  nvm_calib_ver;
         /* params not likely to change within a device family */
diff --git a/drivers/net/wireless/iwlwifi/iwl-drv.c b/drivers/net/wireless/iwlwifi/iwl-drv.c
index 2f690e578b5c..d0162d426f88 100644
--- a/drivers/net/wireless/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/iwlwifi/iwl-drv.c
@@ -1111,11 +1111,8 @@ void iwl_drv_stop(struct iwl_drv *drv)
 /* shared module parameters */
 struct iwl_mod_params iwlwifi_mod_params = {
         .restart_fw = true,
-        .plcp_check = true,
         .bt_coex_active = true,
         .power_level = IWL_POWER_INDEX_1,
-        .bt_ch_announce = true,
-        .auto_agg = true,
         .wd_disable = true,
         /* the rest are 0 by default */
 };
@@ -1223,14 +1220,6 @@ module_param_named(antenna_coupling, iwlwifi_mod_params.ant_coupling,
 MODULE_PARM_DESC(antenna_coupling,
                  "specify antenna coupling in dB (defualt: 0 dB)");
 
-module_param_named(bt_ch_inhibition, iwlwifi_mod_params.bt_ch_announce,
-                   bool, S_IRUGO);
-MODULE_PARM_DESC(bt_ch_inhibition,
-                 "Enable BT channel inhibition (default: enable)");
-
-module_param_named(plcp_check, iwlwifi_mod_params.plcp_check, bool, S_IRUGO);
-MODULE_PARM_DESC(plcp_check, "Check plcp health (default: 1 [enabled])");
-
 module_param_named(wd_disable, iwlwifi_mod_params.wd_disable, int, S_IRUGO);
 MODULE_PARM_DESC(wd_disable,
                 "Disable stuck queue watchdog timer 0=system default, "
@@ -1272,8 +1261,3 @@ module_param_named(power_level, iwlwifi_mod_params.power_level,
                 int, S_IRUGO);
 MODULE_PARM_DESC(power_level,
                  "default power save level (range from 1 - 5, default: 1)");
-
-module_param_named(auto_agg, iwlwifi_mod_params.auto_agg,
-                bool, S_IRUGO);
-MODULE_PARM_DESC(auto_agg,
-                 "enable agg w/o check traffic load (default: enable)");
diff --git a/drivers/net/wireless/iwlwifi/iwl-modparams.h b/drivers/net/wireless/iwlwifi/iwl-modparams.h
index d4ad505b0a4b..a1f580c0c6c6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-modparams.h
+++ b/drivers/net/wireless/iwlwifi/iwl-modparams.h
@@ -93,7 +93,6 @@ enum iwl_power_level {
  *      use IWL_DISABLE_HT_* constants
  * @amsdu_size_8K: enable 8K amsdu size, default = 0
  * @restart_fw: restart firmware, default = 1
- * @plcp_check: enable plcp health check, default = true
  * @wd_disable: enable stuck queue check, default = 0
  * @bt_coex_active: enable bt coex, default = true
  * @led_mode: system default, default = 0
@@ -101,15 +100,12 @@ enum iwl_power_level {
  * @power_level: power level, default = 1
  * @debug_level: levels are IWL_DL_*
  * @ant_coupling: antenna coupling in dB, default = 0
- * @bt_ch_announce: BT channel inhibition, default = enable
- * @auto_agg: enable agg. without check, default = true
  */
 struct iwl_mod_params {
         int sw_crypto;
         unsigned int disable_11n;
         int amsdu_size_8K;
         bool restart_fw;
-        bool plcp_check;
         int  wd_disable;
         bool bt_coex_active;
         int led_mode;
@@ -119,8 +115,6 @@ struct iwl_mod_params {
         u32 debug_level;
 #endif
         int ant_coupling;
-        bool bt_ch_announce;
-        bool auto_agg;
         char *nvm_file;
 };
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-test.c b/drivers/net/wireless/iwlwifi/iwl-test.c
deleted file mode 100644
index 5cfd55b86ed3..000000000000
--- a/drivers/net/wireless/iwlwifi/iwl-test.c
+++ /dev/null
@@ -1,852 +0,0 @@
-/******************************************************************************
- *
- * This file is provided under a dual BSD/GPLv2 license.  When using or
- * redistributing this file, you may do so under either license.
- *
- * GPL LICENSE SUMMARY
- *
- * Copyright(c) 2010 - 2013 Intel Corporation. All rights reserved.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of version 2 of the GNU General Public License as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
- * USA
- *
- * The full GNU General Public License is included in this distribution
- * in the file called COPYING.
- *
- * Contact Information:
- *  Intel Linux Wireless <ilw@linux.intel.com>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- * BSD LICENSE
- *
- * Copyright(c) 2010 - 2013 Intel Corporation. All rights reserved.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *  * Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *  * Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *  * Neither the name Intel Corporation nor the names of its
- *    contributors may be used to endorse or promote products derived
- *    from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- *****************************************************************************/
-
-#include <linux/export.h>
-#include <net/netlink.h>
-
-#include "iwl-drv.h"
-#include "iwl-io.h"
-#include "iwl-fh.h"
-#include "iwl-prph.h"
-#include "iwl-trans.h"
-#include "iwl-test.h"
-#include "iwl-csr.h"
-#include "iwl-testmode.h"
-
-/*
- * Periphery registers absolute lower bound. This is used in order to
- * differentiate registery access through HBUS_TARG_PRPH_* and
- * HBUS_TARG_MEM_* accesses.
- */
-#define IWL_ABS_PRPH_START (0xA00000)
-
-/*
- * The TLVs used in the gnl message policy between the kernel module and
- * user space application. iwl_testmode_gnl_msg_policy is to be carried
- * through the NL80211_CMD_TESTMODE channel regulated by nl80211.
- * See iwl-testmode.h
- */
-static
-struct nla_policy iwl_testmode_gnl_msg_policy[IWL_TM_ATTR_MAX] = {
-        [IWL_TM_ATTR_COMMAND] = { .type = NLA_U32, },
-
-        [IWL_TM_ATTR_UCODE_CMD_ID] = { .type = NLA_U8, },
-        [IWL_TM_ATTR_UCODE_CMD_DATA] = { .type = NLA_UNSPEC, },
-
-        [IWL_TM_ATTR_REG_OFFSET] = { .type = NLA_U32, },
-        [IWL_TM_ATTR_REG_VALUE8] = { .type = NLA_U8, },
-        [IWL_TM_ATTR_REG_VALUE32] = { .type = NLA_U32, },
-
-        [IWL_TM_ATTR_SYNC_RSP] = { .type = NLA_UNSPEC, },
-        [IWL_TM_ATTR_UCODE_RX_PKT] = { .type = NLA_UNSPEC, },
-
-        [IWL_TM_ATTR_EEPROM] = { .type = NLA_UNSPEC, },
-
-        [IWL_TM_ATTR_TRACE_ADDR] = { .type = NLA_UNSPEC, },
-        [IWL_TM_ATTR_TRACE_DUMP] = { .type = NLA_UNSPEC, },
-        [IWL_TM_ATTR_TRACE_SIZE] = { .type = NLA_U32, },
-
-        [IWL_TM_ATTR_FIXRATE] = { .type = NLA_U32, },
-
-        [IWL_TM_ATTR_UCODE_OWNER] = { .type = NLA_U8, },
-
-        [IWL_TM_ATTR_MEM_ADDR] = { .type = NLA_U32, },
-        [IWL_TM_ATTR_BUFFER_SIZE] = { .type = NLA_U32, },
-        [IWL_TM_ATTR_BUFFER_DUMP] = { .type = NLA_UNSPEC, },
-
-        [IWL_TM_ATTR_FW_VERSION] = { .type = NLA_U32, },
-        [IWL_TM_ATTR_DEVICE_ID] = { .type = NLA_U32, },
-        [IWL_TM_ATTR_FW_TYPE] = { .type = NLA_U32, },
-        [IWL_TM_ATTR_FW_INST_SIZE] = { .type = NLA_U32, },
-        [IWL_TM_ATTR_FW_DATA_SIZE] = { .type = NLA_U32, },
-
-        [IWL_TM_ATTR_ENABLE_NOTIFICATION] = {.type = NLA_FLAG, },
-};
-
-static inline void iwl_test_trace_clear(struct iwl_test *tst)
-{
-        memset(&tst->trace, 0, sizeof(struct iwl_test_trace));
-}
-
-static void iwl_test_trace_stop(struct iwl_test *tst)
-{
-        if (!tst->trace.enabled)
-                return;
-
-        if (tst->trace.cpu_addr && tst->trace.dma_addr)
-                dma_free_coherent(tst->trans->dev,
-                                  tst->trace.tsize,
-                                  tst->trace.cpu_addr,
-                                  tst->trace.dma_addr);
-
-        iwl_test_trace_clear(tst);
-}
-
-static inline void iwl_test_mem_clear(struct iwl_test *tst)
-{
-        memset(&tst->mem, 0, sizeof(struct iwl_test_mem));
-}
-
-static inline void iwl_test_mem_stop(struct iwl_test *tst)
-{
-        if (!tst->mem.in_read)
-                return;
-
-        iwl_test_mem_clear(tst);
-}
-
-/*
- * Initializes the test object
- * During the lifetime of the test object it is assumed that the transport is
- * started. The test object should be stopped before the transport is stopped.
- */
-void iwl_test_init(struct iwl_test *tst, struct iwl_trans *trans,
-                   struct iwl_test_ops *ops)
-{
-        tst->trans = trans;
-        tst->ops = ops;
-
-        iwl_test_trace_clear(tst);
-        iwl_test_mem_clear(tst);
-}
-EXPORT_SYMBOL_GPL(iwl_test_init);
-
-/*
- * Stop the test object
- */
-void iwl_test_free(struct iwl_test *tst)
-{
-        iwl_test_mem_stop(tst);
-        iwl_test_trace_stop(tst);
-}
-EXPORT_SYMBOL_GPL(iwl_test_free);
-
-static inline int iwl_test_send_cmd(struct iwl_test *tst,
-                                    struct iwl_host_cmd *cmd)
-{
-        return tst->ops->send_cmd(tst->trans->op_mode, cmd);
-}
-
-static inline bool iwl_test_valid_hw_addr(struct iwl_test *tst, u32 addr)
-{
-        return tst->ops->valid_hw_addr(addr);
-}
-
-static inline u32 iwl_test_fw_ver(struct iwl_test *tst)
-{
-        return tst->ops->get_fw_ver(tst->trans->op_mode);
-}
-
-static inline struct sk_buff*
-iwl_test_alloc_reply(struct iwl_test *tst, int len)
-{
-        return tst->ops->alloc_reply(tst->trans->op_mode, len);
-}
-
-static inline int iwl_test_reply(struct iwl_test *tst, struct sk_buff *skb)
-{
-        return tst->ops->reply(tst->trans->op_mode, skb);
-}
-
-static inline struct sk_buff*
-iwl_test_alloc_event(struct iwl_test *tst, int len)
-{
-        return tst->ops->alloc_event(tst->trans->op_mode, len);
-}
-
-static inline void
-iwl_test_event(struct iwl_test *tst, struct sk_buff *skb)
-{
-        return tst->ops->event(tst->trans->op_mode, skb);
-}
-
-/*
- * This function handles the user application commands to the fw. The fw
- * commands are sent in a synchronuous manner. In case that the user requested
- * to get commands response, it is send to the user.
- */
-static int iwl_test_fw_cmd(struct iwl_test *tst, struct nlattr **tb)
-{
-        struct iwl_host_cmd cmd;
-        struct iwl_rx_packet *pkt;
-        struct sk_buff *skb;
-        void *reply_buf;
-        u32 reply_len;
-        int ret;
-        bool cmd_want_skb;
-
-        memset(&cmd, 0, sizeof(struct iwl_host_cmd));
-
-        if (!tb[IWL_TM_ATTR_UCODE_CMD_ID] ||
-            !tb[IWL_TM_ATTR_UCODE_CMD_DATA]) {
-                IWL_ERR(tst->trans, "Missing fw command mandatory fields\n");
-                return -ENOMSG;
-        }
-
-        cmd.flags = CMD_ON_DEMAND | CMD_SYNC;
-        cmd_want_skb = nla_get_flag(tb[IWL_TM_ATTR_UCODE_CMD_SKB]);
-        if (cmd_want_skb)
-                cmd.flags |= CMD_WANT_SKB;
-
-        cmd.id = nla_get_u8(tb[IWL_TM_ATTR_UCODE_CMD_ID]);
-        cmd.data[0] = nla_data(tb[IWL_TM_ATTR_UCODE_CMD_DATA]);
-        cmd.len[0] = nla_len(tb[IWL_TM_ATTR_UCODE_CMD_DATA]);
-        cmd.dataflags[0] = IWL_HCMD_DFL_NOCOPY;
-        IWL_DEBUG_INFO(tst->trans, "test fw cmd=0x%x, flags 0x%x, len %d\n",
-                       cmd.id, cmd.flags, cmd.len[0]);
-
-        ret = iwl_test_send_cmd(tst, &cmd);
-        if (ret) {
-                IWL_ERR(tst->trans, "Failed to send hcmd\n");
-                return ret;
-        }
-        if (!cmd_want_skb)
-                return ret;
-
-        /* Handling return of SKB to the user */
-        pkt = cmd.resp_pkt;
-        if (!pkt) {
-                IWL_ERR(tst->trans, "HCMD received a null response packet\n");
-                return ret;
-        }
-
-        reply_len = le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
-        skb = iwl_test_alloc_reply(tst, reply_len + 20);
-        reply_buf = kmemdup(&pkt->hdr, reply_len, GFP_KERNEL);
-        if (!skb || !reply_buf) {
-                kfree_skb(skb);
-                kfree(reply_buf);
-                return -ENOMEM;
-        }
-
-        /* The reply is in a page, that we cannot send to user space. */
-        iwl_free_resp(&cmd);
-
-        if (nla_put_u32(skb, IWL_TM_ATTR_COMMAND,
-                        IWL_TM_CMD_DEV2APP_UCODE_RX_PKT) ||
-            nla_put(skb, IWL_TM_ATTR_UCODE_RX_PKT, reply_len, reply_buf))
-                goto nla_put_failure;
-        return iwl_test_reply(tst, skb);
-
-nla_put_failure:
-        IWL_DEBUG_INFO(tst->trans, "Failed creating NL attributes\n");
-        kfree(reply_buf);
-        kfree_skb(skb);
-        return -ENOMSG;
-}
-
-/*
- * Handles the user application commands for register access.
- */
-static int iwl_test_reg(struct iwl_test *tst, struct nlattr **tb)
-{
-        u32 ofs, val32, cmd;
-        u8 val8;
-        struct sk_buff *skb;
-        int status = 0;
-        struct iwl_trans *trans = tst->trans;
-
-        if (!tb[IWL_TM_ATTR_REG_OFFSET]) {
-                IWL_ERR(trans, "Missing reg offset\n");
-                return -ENOMSG;
-        }
-
-        ofs = nla_get_u32(tb[IWL_TM_ATTR_REG_OFFSET]);
-        IWL_DEBUG_INFO(trans, "test reg access cmd offset=0x%x\n", ofs);
-
-        cmd = nla_get_u32(tb[IWL_TM_ATTR_COMMAND]);
-
-        /*
-         * Allow access only to FH/CSR/HBUS in direct mode.
-         * Since we don't have the upper bounds for the CSR and HBUS segments,
-         * we will use only the upper bound of FH for sanity check.
-         */
-        if (ofs >= FH_MEM_UPPER_BOUND) {
-                IWL_ERR(trans, "offset out of segment (0x0 - 0x%x)\n",
-                        FH_MEM_UPPER_BOUND);
-                return -EINVAL;
-        }
-
-        switch (cmd) {
-        case IWL_TM_CMD_APP2DEV_DIRECT_REG_READ32:
-                val32 = iwl_read_direct32(tst->trans, ofs);
-                IWL_DEBUG_INFO(trans, "32 value to read 0x%x\n", val32);
-
-                skb = iwl_test_alloc_reply(tst, 20);
-                if (!skb) {
-                        IWL_ERR(trans, "Memory allocation fail\n");
-                        return -ENOMEM;
-                }
-                if (nla_put_u32(skb, IWL_TM_ATTR_REG_VALUE32, val32))
-                        goto nla_put_failure;
-                status = iwl_test_reply(tst, skb);
-                if (status < 0)
-                        IWL_ERR(trans, "Error sending msg : %d\n", status);
-                break;
-
-        case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE32:
-                if (!tb[IWL_TM_ATTR_REG_VALUE32]) {
-                        IWL_ERR(trans, "Missing value to write\n");
-                        return -ENOMSG;
-                } else {
-                        val32 = nla_get_u32(tb[IWL_TM_ATTR_REG_VALUE32]);
-                        IWL_DEBUG_INFO(trans, "32b write val=0x%x\n", val32);
-                        iwl_write_direct32(tst->trans, ofs, val32);
-                }
-                break;
-
-        case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE8:
-                if (!tb[IWL_TM_ATTR_REG_VALUE8]) {
-                        IWL_ERR(trans, "Missing value to write\n");
-                        return -ENOMSG;
-                } else {
-                        val8 = nla_get_u8(tb[IWL_TM_ATTR_REG_VALUE8]);
-                        IWL_DEBUG_INFO(trans, "8b write val=0x%x\n", val8);
-                        iwl_write8(tst->trans, ofs, val8);
-                }
-                break;
-
-        default:
-                IWL_ERR(trans, "Unknown test register cmd ID\n");
-                return -ENOMSG;
-        }
-
-        return status;
-
-nla_put_failure:
-        kfree_skb(skb);
-        return -EMSGSIZE;
-}
-
-/*
- * Handles the request to start FW tracing. Allocates of the trace buffer
- * and sends a reply to user space with the address of the allocated buffer.
- */
-static int iwl_test_trace_begin(struct iwl_test *tst, struct nlattr **tb)
-{
-        struct sk_buff *skb;
-        int status = 0;
-
-        if (tst->trace.enabled)
-                return -EBUSY;
-
-        if (!tb[IWL_TM_ATTR_TRACE_SIZE])
-                tst->trace.size = TRACE_BUFF_SIZE_DEF;
-        else
-                tst->trace.size =
-                        nla_get_u32(tb[IWL_TM_ATTR_TRACE_SIZE]);
-
-        if (!tst->trace.size)
-                return -EINVAL;
-
-        if (tst->trace.size < TRACE_BUFF_SIZE_MIN ||
-            tst->trace.size > TRACE_BUFF_SIZE_MAX)
-                return -EINVAL;
-
-        tst->trace.tsize = tst->trace.size + TRACE_BUFF_PADD;
-        tst->trace.cpu_addr = dma_alloc_coherent(tst->trans->dev,
-                                                 tst->trace.tsize,
-                                                 &tst->trace.dma_addr,
-                                                 GFP_KERNEL);
-        if (!tst->trace.cpu_addr)
-                return -ENOMEM;
-
-        tst->trace.enabled = true;
-        tst->trace.trace_addr = (u8 *)PTR_ALIGN(tst->trace.cpu_addr, 0x100);
-
-        memset(tst->trace.trace_addr, 0x03B, tst->trace.size);
-
-        skb = iwl_test_alloc_reply(tst, sizeof(tst->trace.dma_addr) + 20);
-        if (!skb) {
-                IWL_ERR(tst->trans, "Memory allocation fail\n");
-                iwl_test_trace_stop(tst);
-                return -ENOMEM;
-        }
-
-        if (nla_put(skb, IWL_TM_ATTR_TRACE_ADDR,
-                    sizeof(tst->trace.dma_addr),
-                    (u64 *)&tst->trace.dma_addr))
-                goto nla_put_failure;
-
-        status = iwl_test_reply(tst, skb);
-        if (status < 0)
-                IWL_ERR(tst->trans, "Error sending msg : %d\n", status);
-
-        tst->trace.nchunks = DIV_ROUND_UP(tst->trace.size,
-                                          DUMP_CHUNK_SIZE);
-
-        return status;
-
-nla_put_failure:
-        kfree_skb(skb);
-        if (nla_get_u32(tb[IWL_TM_ATTR_COMMAND]) ==
-            IWL_TM_CMD_APP2DEV_BEGIN_TRACE)
-                iwl_test_trace_stop(tst);
-        return -EMSGSIZE;
-}
-
-/*
- * Handles indirect read from the periphery or the SRAM. The read is performed
- * to a temporary buffer. The user space application should later issue a dump
- */
-static int iwl_test_indirect_read(struct iwl_test *tst, u32 addr, u32 size)
-{
-        struct iwl_trans *trans = tst->trans;
-        unsigned long flags;
-        int i;
-
-        if (size & 0x3)
-                return -EINVAL;
-
-        tst->mem.size = size;
-        tst->mem.addr = kmalloc(tst->mem.size, GFP_KERNEL);
-        if (tst->mem.addr == NULL)
-                return -ENOMEM;
-
-        /* Hard-coded periphery absolute address */
-        if (IWL_ABS_PRPH_START <= addr &&
-            addr < IWL_ABS_PRPH_START + PRPH_END) {
-                        if (!iwl_trans_grab_nic_access(trans, false, &flags)) {
-                                return -EIO;
-                        }
-                        iwl_write32(trans, HBUS_TARG_PRPH_RADDR,
-                                    addr | (3 << 24));
-                        for (i = 0; i < size; i += 4)
-                                *(u32 *)(tst->mem.addr + i) =
-                                        iwl_read32(trans, HBUS_TARG_PRPH_RDAT);
-                        iwl_trans_release_nic_access(trans, &flags);
-        } else { /* target memory (SRAM) */
-                iwl_trans_read_mem(trans, addr, tst->mem.addr,
-                                   tst->mem.size / 4);
-        }
-
-        tst->mem.nchunks =
-                DIV_ROUND_UP(tst->mem.size, DUMP_CHUNK_SIZE);
-        tst->mem.in_read = true;
-        return 0;
-
-}
-
-/*
- * Handles indirect write to the periphery or SRAM. The  is performed to a
- * temporary buffer.
- */
-static int iwl_test_indirect_write(struct iwl_test *tst, u32 addr,
-        u32 size, unsigned char *buf)
-{
-        struct iwl_trans *trans = tst->trans;
-        u32 val, i;
-        unsigned long flags;
-
-        if (IWL_ABS_PRPH_START <= addr &&
-            addr < IWL_ABS_PRPH_START + PRPH_END) {
-                /* Periphery writes can be 1-3 bytes long, or DWORDs */
-                if (size < 4) {
-                        memcpy(&val, buf, size);
-                        if (!iwl_trans_grab_nic_access(trans, false, &flags))
-                                        return -EIO;
-                        iwl_write32(trans, HBUS_TARG_PRPH_WADDR,
-                                    (addr & 0x0000FFFF) |
-                                    ((size - 1) << 24));
-                        iwl_write32(trans, HBUS_TARG_PRPH_WDAT, val);
-                        iwl_trans_release_nic_access(trans, &flags);
-                } else {
-                        if (size % 4)
-                                return -EINVAL;
-                        for (i = 0; i < size; i += 4)
-                                iwl_write_prph(trans, addr+i,
-                                               *(u32 *)(buf+i));
-                }
-        } else if (iwl_test_valid_hw_addr(tst, addr)) {
-                iwl_trans_write_mem(trans, addr, buf, size / 4);
-        } else {
-                return -EINVAL;
-        }
-        return 0;
-}
-
-/*
- * Handles the user application commands for indirect read/write
- * to/from the periphery or the SRAM.
- */
-static int iwl_test_indirect_mem(struct iwl_test *tst, struct nlattr **tb)
-{
-        u32 addr, size, cmd;
-        unsigned char *buf;
-
-        /* Both read and write should be blocked, for atomicity */
-        if (tst->mem.in_read)
-                return -EBUSY;
-
-        cmd = nla_get_u32(tb[IWL_TM_ATTR_COMMAND]);
-        if (!tb[IWL_TM_ATTR_MEM_ADDR]) {
-                IWL_ERR(tst->trans, "Error finding memory offset address\n");
-                return -ENOMSG;
-        }
-        addr = nla_get_u32(tb[IWL_TM_ATTR_MEM_ADDR]);
-        if (!tb[IWL_TM_ATTR_BUFFER_SIZE]) {
-                IWL_ERR(tst->trans, "Error finding size for memory reading\n");
-                return -ENOMSG;
-        }
-        size = nla_get_u32(tb[IWL_TM_ATTR_BUFFER_SIZE]);
-
-        if (cmd == IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_READ) {
-                return iwl_test_indirect_read(tst, addr,  size);
-        } else {
-                if (!tb[IWL_TM_ATTR_BUFFER_DUMP])
-                        return -EINVAL;
-                buf = (unsigned char *)nla_data(tb[IWL_TM_ATTR_BUFFER_DUMP]);
-                return iwl_test_indirect_write(tst, addr, size, buf);
-        }
-}
-
-/*
- * Enable notifications to user space
- */
-static int iwl_test_notifications(struct iwl_test *tst,
-                                  struct nlattr **tb)
-{
-        tst->notify = nla_get_flag(tb[IWL_TM_ATTR_ENABLE_NOTIFICATION]);
-        return 0;
-}
-
-/*
- * Handles the request to get the device id
- */
-static int iwl_test_get_dev_id(struct iwl_test *tst, struct nlattr **tb)
-{
-        u32 devid = tst->trans->hw_id;
-        struct sk_buff *skb;
-        int status;
-
-        IWL_DEBUG_INFO(tst->trans, "hw version: 0x%x\n", devid);
-
-        skb = iwl_test_alloc_reply(tst, 20);
-        if (!skb) {
-                IWL_ERR(tst->trans, "Memory allocation fail\n");
-                return -ENOMEM;
-        }
-
-        if (nla_put_u32(skb, IWL_TM_ATTR_DEVICE_ID, devid))
-                goto nla_put_failure;
-        status = iwl_test_reply(tst, skb);
-        if (status < 0)
-                IWL_ERR(tst->trans, "Error sending msg : %d\n", status);
-
-        return 0;
-
-nla_put_failure:
-        kfree_skb(skb);
-        return -EMSGSIZE;
-}
-
-/*
- * Handles the request to get the FW version
- */
-static int iwl_test_get_fw_ver(struct iwl_test *tst, struct nlattr **tb)
-{
-        struct sk_buff *skb;
-        int status;
-        u32 ver = iwl_test_fw_ver(tst);
-
-        IWL_DEBUG_INFO(tst->trans, "uCode version raw: 0x%x\n", ver);
-
-        skb = iwl_test_alloc_reply(tst, 20);
-        if (!skb) {
-                IWL_ERR(tst->trans, "Memory allocation fail\n");
-                return -ENOMEM;
-        }
-
-        if (nla_put_u32(skb, IWL_TM_ATTR_FW_VERSION, ver))
-                goto nla_put_failure;
-
-        status = iwl_test_reply(tst, skb);
-        if (status < 0)
-                IWL_ERR(tst->trans, "Error sending msg : %d\n", status);
-
-        return 0;
-
-nla_put_failure:
-        kfree_skb(skb);
-        return -EMSGSIZE;
-}
-
-/*
- * Parse the netlink message and validate that the IWL_TM_ATTR_CMD exists
- */
-int iwl_test_parse(struct iwl_test *tst, struct nlattr **tb,
-                   void *data, int len)
-{
-        int result;
-
-        result = nla_parse(tb, IWL_TM_ATTR_MAX - 1, data, len,
-                        iwl_testmode_gnl_msg_policy);
-        if (result) {
-                IWL_ERR(tst->trans, "Fail parse gnl msg: %d\n", result);
-                return result;
-        }
-
-        /* IWL_TM_ATTR_COMMAND is absolutely mandatory */
-        if (!tb[IWL_TM_ATTR_COMMAND]) {
-                IWL_ERR(tst->trans, "Missing testmode command type\n");
-                return -ENOMSG;
-        }
-        return 0;
-}
-IWL_EXPORT_SYMBOL(iwl_test_parse);
-
-/*
- * Handle test commands.
- * Returns 1 for unknown commands (not handled by the test object); negative
- * value in case of error.
- */
-int iwl_test_handle_cmd(struct iwl_test *tst, struct nlattr **tb)
-{
-        int result;
-
-        switch (nla_get_u32(tb[IWL_TM_ATTR_COMMAND])) {
-        case IWL_TM_CMD_APP2DEV_UCODE:
-                IWL_DEBUG_INFO(tst->trans, "test cmd to uCode\n");
-                result = iwl_test_fw_cmd(tst, tb);
-                break;
-
-        case IWL_TM_CMD_APP2DEV_DIRECT_REG_READ32:
-        case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE32:
-        case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE8:
-                IWL_DEBUG_INFO(tst->trans, "test cmd to register\n");
-                result = iwl_test_reg(tst, tb);
-                break;
-
-        case IWL_TM_CMD_APP2DEV_BEGIN_TRACE:
-                IWL_DEBUG_INFO(tst->trans, "test uCode trace cmd to driver\n");
-                result = iwl_test_trace_begin(tst, tb);
-                break;
-
-        case IWL_TM_CMD_APP2DEV_END_TRACE:
-                iwl_test_trace_stop(tst);
-                result = 0;
-                break;
-
-        case IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_READ:
-        case IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_WRITE:
-                IWL_DEBUG_INFO(tst->trans, "test indirect memory cmd\n");
-                result = iwl_test_indirect_mem(tst, tb);
-                break;
-
-        case IWL_TM_CMD_APP2DEV_NOTIFICATIONS:
-                IWL_DEBUG_INFO(tst->trans, "test notifications cmd\n");
-                result = iwl_test_notifications(tst, tb);
-                break;
-
-        case IWL_TM_CMD_APP2DEV_GET_FW_VERSION:
-                IWL_DEBUG_INFO(tst->trans, "test get FW ver cmd\n");
-                result = iwl_test_get_fw_ver(tst, tb);
-                break;
-
-        case IWL_TM_CMD_APP2DEV_GET_DEVICE_ID:
-                IWL_DEBUG_INFO(tst->trans, "test Get device ID cmd\n");
-                result = iwl_test_get_dev_id(tst, tb);
-                break;
-
-        default:
-                IWL_DEBUG_INFO(tst->trans, "Unknown test command\n");
-                result = 1;
-                break;
-        }
-        return result;
-}
-IWL_EXPORT_SYMBOL(iwl_test_handle_cmd);
-
-static int iwl_test_trace_dump(struct iwl_test *tst, struct sk_buff *skb,
-                               struct netlink_callback *cb)
-{
-        int idx, length;
-
-        if (!tst->trace.enabled || !tst->trace.trace_addr)
-                return -EFAULT;
-
-        idx = cb->args[4];
-        if (idx >= tst->trace.nchunks)
-                return -ENOENT;
-
-        length = DUMP_CHUNK_SIZE;
-        if (((idx + 1) == tst->trace.nchunks) &&
-            (tst->trace.size % DUMP_CHUNK_SIZE))
-                length = tst->trace.size %
-                        DUMP_CHUNK_SIZE;
-
-        if (nla_put(skb, IWL_TM_ATTR_TRACE_DUMP, length,
-                    tst->trace.trace_addr + (DUMP_CHUNK_SIZE * idx)))
-                goto nla_put_failure;
-
-        cb->args[4] = ++idx;
-        return 0;
-
- nla_put_failure:
-        return -ENOBUFS;
-}
-
-static int iwl_test_buffer_dump(struct iwl_test *tst, struct sk_buff *skb,
-                                struct netlink_callback *cb)
-{
-        int idx, length;
-
-        if (!tst->mem.in_read)
-                return -EFAULT;
-
-        idx = cb->args[4];
-        if (idx >= tst->mem.nchunks) {
-                iwl_test_mem_stop(tst);
-                return -ENOENT;
-        }
-
-        length = DUMP_CHUNK_SIZE;
-        if (((idx + 1) == tst->mem.nchunks) &&
-            (tst->mem.size % DUMP_CHUNK_SIZE))
-                length = tst->mem.size % DUMP_CHUNK_SIZE;
-
-        if (nla_put(skb, IWL_TM_ATTR_BUFFER_DUMP, length,
-                    tst->mem.addr + (DUMP_CHUNK_SIZE * idx)))
-                goto nla_put_failure;
-
-        cb->args[4] = ++idx;
-        return 0;
-
- nla_put_failure:
-        return -ENOBUFS;
-}
-
-/*
- * Handle dump commands.
- * Returns 1 for unknown commands (not handled by the test object); negative
- * value in case of error.
- */
-int iwl_test_dump(struct iwl_test *tst, u32 cmd, struct sk_buff *skb,
-                  struct netlink_callback *cb)
-{
-        int result;
-
-        switch (cmd) {
-        case IWL_TM_CMD_APP2DEV_READ_TRACE:
-                IWL_DEBUG_INFO(tst->trans, "uCode trace cmd\n");
-                result = iwl_test_trace_dump(tst, skb, cb);
-                break;
-
-        case IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_DUMP:
-                IWL_DEBUG_INFO(tst->trans, "testmode sram dump cmd\n");
-                result = iwl_test_buffer_dump(tst, skb, cb);
-                break;
-
-        default:
-                result = 1;
-                break;
-        }
-        return result;
-}
-IWL_EXPORT_SYMBOL(iwl_test_dump);
-
-/*
- * Multicast a spontaneous messages from the device to the user space.
- */
-static void iwl_test_send_rx(struct iwl_test *tst,
-                             struct iwl_rx_cmd_buffer *rxb)
-{
-        struct sk_buff *skb;
-        struct iwl_rx_packet *data;
-        int length;
-
-        data = rxb_addr(rxb);
-        length = le32_to_cpu(data->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
-
-        /* the length doesn't include len_n_flags field, so add it manually */
-        length += sizeof(__le32);
-
-        skb = iwl_test_alloc_event(tst, length + 20);
-        if (skb == NULL) {
-                IWL_ERR(tst->trans, "Out of memory for message to user\n");
-                return;
-        }
-
-        if (nla_put_u32(skb, IWL_TM_ATTR_COMMAND,
-                        IWL_TM_CMD_DEV2APP_UCODE_RX_PKT) ||
-            nla_put(skb, IWL_TM_ATTR_UCODE_RX_PKT, length, data))
-                goto nla_put_failure;
-
-        iwl_test_event(tst, skb);
-        return;
-
-nla_put_failure:
-        kfree_skb(skb);
-        IWL_ERR(tst->trans, "Ouch, overran buffer, check allocation!\n");
-}
-
-/*
- * Called whenever a Rx frames is recevied from the device. If notifications to
- * the user space are requested, sends the frames to the user.
- */
-void iwl_test_rx(struct iwl_test *tst, struct iwl_rx_cmd_buffer *rxb)
-{
-        if (tst->notify)
-                iwl_test_send_rx(tst, rxb);
-}
-IWL_EXPORT_SYMBOL(iwl_test_rx);
diff --git a/drivers/net/wireless/iwlwifi/iwl-test.h b/drivers/net/wireless/iwlwifi/iwl-test.h
deleted file mode 100644
index 8fbd21704840..000000000000
--- a/drivers/net/wireless/iwlwifi/iwl-test.h
+++ /dev/null
@@ -1,161 +0,0 @@
-/******************************************************************************
- *
- * This file is provided under a dual BSD/GPLv2 license.  When using or
- * redistributing this file, you may do so under either license.
- *
- * GPL LICENSE SUMMARY
- *
- * Copyright(c) 2010 - 2013 Intel Corporation. All rights reserved.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of version 2 of the GNU General Public License as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
- * USA
- *
- * The full GNU General Public License is included in this distribution
- * in the file called COPYING.
- *
- * Contact Information:
- *  Intel Linux Wireless <ilw@linux.intel.com>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- * BSD LICENSE
- *
- * Copyright(c) 2010 - 2013 Intel Corporation. All rights reserved.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *  * Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *  * Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *  * Neither the name Intel Corporation nor the names of its
- *    contributors may be used to endorse or promote products derived
- *    from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- *****************************************************************************/
-
-#ifndef __IWL_TEST_H__
-#define __IWL_TEST_H__
-
-#include <linux/types.h>
-#include "iwl-trans.h"
-
-struct iwl_test_trace {
-        u32 size;
-        u32 tsize;
-        u32 nchunks;
-        u8 *cpu_addr;
-        u8 *trace_addr;
-        dma_addr_t dma_addr;
-        bool enabled;
-};
-
-struct iwl_test_mem {
-        u32 size;
-        u32 nchunks;
-        u8 *addr;
-        bool in_read;
-};
-
-/*
- * struct iwl_test_ops: callback to the op mode
- *
- * The structure defines the callbacks that the op_mode should handle,
- * inorder to handle logic that is out of the scope of iwl_test. The
- * op_mode must set all the callbacks.
-
- * @send_cmd: handler that is used by the test object to request the
- *  op_mode to send a command to the fw.
- *
- * @valid_hw_addr: handler that is used by the test object to request the
- *  op_mode to check if the given address is a valid address.
- *
- * @get_fw_ver: handler used to get the FW version.
- *
- * @alloc_reply: handler used by the test object to request the op_mode
- *  to allocate an skb for sending a reply to the user, and initialize
- *  the skb. It is assumed that the test object only fills the required
- *  attributes.
- *
- * @reply: handler used by the test object to request the op_mode to reply
- *  to a request. The skb is an skb previously allocated by the the
- *  alloc_reply callback.
- I
- * @alloc_event: handler used by the test object to request the op_mode
- *  to allocate an skb for sending an event, and initialize
- *  the skb. It is assumed that the test object only fills the required
- *  attributes.
- *
- * @reply: handler used by the test object to request the op_mode to send
- *  an event. The skb is an skb previously allocated by the the
- *  alloc_event callback.
- */
-struct iwl_test_ops {
-        int (*send_cmd)(struct iwl_op_mode *op_modes,
-                        struct iwl_host_cmd *cmd);
-        bool (*valid_hw_addr)(u32 addr);
-        u32 (*get_fw_ver)(struct iwl_op_mode *op_mode);
-
-        struct sk_buff *(*alloc_reply)(struct iwl_op_mode *op_mode, int len);
-        int (*reply)(struct iwl_op_mode *op_mode, struct sk_buff *skb);
-        struct sk_buff* (*alloc_event)(struct iwl_op_mode *op_mode, int len);
-        void (*event)(struct iwl_op_mode *op_mode, struct sk_buff *skb);
-};
-
-struct iwl_test {
-        struct iwl_trans *trans;
-        struct iwl_test_ops *ops;
-        struct iwl_test_trace trace;
-        struct iwl_test_mem mem;
-        bool notify;
-};
-
-void iwl_test_init(struct iwl_test *tst, struct iwl_trans *trans,
-                   struct iwl_test_ops *ops);
-
-void iwl_test_free(struct iwl_test *tst);
-
-int iwl_test_parse(struct iwl_test *tst, struct nlattr **tb,
-                   void *data, int len);
-
-int iwl_test_handle_cmd(struct iwl_test *tst, struct nlattr **tb);
-
-int iwl_test_dump(struct iwl_test *tst, u32 cmd, struct sk_buff *skb,
-                  struct netlink_callback *cb);
-
-void iwl_test_rx(struct iwl_test *tst, struct iwl_rx_cmd_buffer *rxb);
-
-static inline void iwl_test_enable_notifications(struct iwl_test *tst,
-                                                 bool enable)
-{
-        tst->notify = enable;
-}
-
-#endif
diff --git a/drivers/net/wireless/iwlwifi/iwl-testmode.h b/drivers/net/wireless/iwlwifi/iwl-testmode.h
deleted file mode 100644
index 98f48a9afc98..000000000000
--- a/drivers/net/wireless/iwlwifi/iwl-testmode.h
+++ /dev/null
@@ -1,309 +0,0 @@
-/******************************************************************************
- *
- * This file is provided under a dual BSD/GPLv2 license.  When using or
- * redistributing this file, you may do so under either license.
- *
- * GPL LICENSE SUMMARY
- *
- * Copyright(c) 2010 - 2013 Intel Corporation. All rights reserved.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of version 2 of the GNU General Public License as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
- * USA
- *
- * The full GNU General Public License is included in this distribution
- * in the file called COPYING.
- *
- * Contact Information:
- *  Intel Linux Wireless <ilw@linux.intel.com>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- * BSD LICENSE
- *
- * Copyright(c) 2010 - 2013 Intel Corporation. All rights reserved.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *  * Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *  * Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *  * Neither the name Intel Corporation nor the names of its
- *    contributors may be used to endorse or promote products derived
- *    from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- *****************************************************************************/
-#ifndef __IWL_TESTMODE_H__
-#define __IWL_TESTMODE_H__
-
-#include <linux/types.h>
-
-
-/*
- * Commands from user space to kernel space(IWL_TM_CMD_ID_APP2DEV_XX) and
- * from and kernel space to user space(IWL_TM_CMD_ID_DEV2APP_XX).
- * The command ID is carried with IWL_TM_ATTR_COMMAND.
- *
- * @IWL_TM_CMD_APP2DEV_UCODE:
- *      commands from user application to the uCode,
- *      the actual uCode host command ID is carried with
- *      IWL_TM_ATTR_UCODE_CMD_ID
- *
- * @IWL_TM_CMD_APP2DEV_DIRECT_REG_READ32:
- * @IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE32:
- * @IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE8:
- *      commands from user applicaiton to access register
- *
- * @IWL_TM_CMD_APP2DEV_GET_DEVICENAME: retrieve device name
- * @IWL_TM_CMD_APP2DEV_LOAD_INIT_FW: load initial uCode image
- * @IWL_TM_CMD_APP2DEV_CFG_INIT_CALIB: perform calibration
- * @IWL_TM_CMD_APP2DEV_LOAD_RUNTIME_FW: load runtime uCode image
- * @IWL_TM_CMD_APP2DEV_GET_EEPROM: request EEPROM data
- * @IWL_TM_CMD_APP2DEV_FIXRATE_REQ: set fix MCS
- *      commands fom user space for pure driver level operations
- *
- * @IWL_TM_CMD_APP2DEV_BEGIN_TRACE:
- * @IWL_TM_CMD_APP2DEV_END_TRACE:
- * @IWL_TM_CMD_APP2DEV_READ_TRACE:
- *      commands fom user space for uCode trace operations
- *
- * @IWL_TM_CMD_DEV2APP_SYNC_RSP:
- *      commands from kernel space to carry the synchronous response
- *      to user application
- * @IWL_TM_CMD_DEV2APP_UCODE_RX_PKT:
- *      commands from kernel space to multicast the spontaneous messages
- *      to user application, or reply of host commands
- * @IWL_TM_CMD_DEV2APP_EEPROM_RSP:
- *      commands from kernel space to carry the eeprom response
- *      to user application
- *
- * @IWL_TM_CMD_APP2DEV_OWNERSHIP:
- *      commands from user application to own change the ownership of the uCode
- *      if application has the ownership, the only host command from
- *      testmode will deliver to uCode. Default owner is driver
- *
- * @IWL_TM_CMD_APP2DEV_LOAD_WOWLAN_FW: load Wake On Wireless LAN uCode image
- * @IWL_TM_CMD_APP2DEV_GET_FW_VERSION: retrieve uCode version
- * @IWL_TM_CMD_APP2DEV_GET_DEVICE_ID: retrieve ID information in device
- * @IWL_TM_CMD_APP2DEV_GET_FW_INFO:
- *      retrieve information of existing loaded uCode image
- *
- * @IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_READ:
- * @IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_DUMP:
- * @IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_WRITE:
- *      Commands to read/write data from periphery or SRAM memory ranges.
- *      Fore reading, a READ command is sent from the userspace and the data
- *      is returned when the user calls a DUMP command.
- *      For writing, only a WRITE command is used.
- * @IWL_TM_CMD_APP2DEV_NOTIFICATIONS:
- *      Command to enable/disable notifications (currently RX packets) from the
- *      driver to userspace.
- */
-enum iwl_tm_cmd_t {
-        IWL_TM_CMD_APP2DEV_UCODE                = 1,
-        IWL_TM_CMD_APP2DEV_DIRECT_REG_READ32    = 2,
-        IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE32   = 3,
-        IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE8    = 4,
-        IWL_TM_CMD_APP2DEV_GET_DEVICENAME       = 5,
-        IWL_TM_CMD_APP2DEV_LOAD_INIT_FW         = 6,
-        IWL_TM_CMD_APP2DEV_CFG_INIT_CALIB       = 7,
-        IWL_TM_CMD_APP2DEV_LOAD_RUNTIME_FW      = 8,
-        IWL_TM_CMD_APP2DEV_GET_EEPROM           = 9,
-        IWL_TM_CMD_APP2DEV_FIXRATE_REQ          = 10,
-        IWL_TM_CMD_APP2DEV_BEGIN_TRACE          = 11,
-        IWL_TM_CMD_APP2DEV_END_TRACE            = 12,
-        IWL_TM_CMD_APP2DEV_READ_TRACE           = 13,
-        IWL_TM_CMD_DEV2APP_SYNC_RSP             = 14,
-        IWL_TM_CMD_DEV2APP_UCODE_RX_PKT         = 15,
-        IWL_TM_CMD_DEV2APP_EEPROM_RSP           = 16,
-        IWL_TM_CMD_APP2DEV_OWNERSHIP            = 17,
-        RESERVED_18                             = 18,
-        RESERVED_19                             = 19,
-        RESERVED_20                             = 20,
-        RESERVED_21                             = 21,
-        IWL_TM_CMD_APP2DEV_LOAD_WOWLAN_FW       = 22,
-        IWL_TM_CMD_APP2DEV_GET_FW_VERSION       = 23,
-        IWL_TM_CMD_APP2DEV_GET_DEVICE_ID        = 24,
-        IWL_TM_CMD_APP2DEV_GET_FW_INFO          = 25,
-        IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_READ = 26,
-        IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_DUMP = 27,
-        IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_WRITE = 28,
-        IWL_TM_CMD_APP2DEV_NOTIFICATIONS        = 29,
-        IWL_TM_CMD_MAX                          = 30,
-};
-
-/*
- * Atrribute filed in testmode command
- * See enum iwl_tm_cmd_t.
- *
- * @IWL_TM_ATTR_NOT_APPLICABLE:
- *      The attribute is not applicable or invalid
- * @IWL_TM_ATTR_COMMAND:
- *      From user space to kernel space:
- *      the command either destines to ucode, driver, or register;
- *      From kernel space to user space:
- *      the command either carries synchronous response,
- *      or the spontaneous message multicast from the device;
- *
- * @IWL_TM_ATTR_UCODE_CMD_ID:
- * @IWL_TM_ATTR_UCODE_CMD_DATA:
- *      When IWL_TM_ATTR_COMMAND is IWL_TM_CMD_APP2DEV_UCODE,
- *      The mandatory fields are :
- *      IWL_TM_ATTR_UCODE_CMD_ID for recognizable command ID;
- *      IWL_TM_ATTR_UCODE_CMD_DATA for the actual command payload
- *      to the ucode
- *
- * @IWL_TM_ATTR_REG_OFFSET:
- * @IWL_TM_ATTR_REG_VALUE8:
- * @IWL_TM_ATTR_REG_VALUE32:
- *      When IWL_TM_ATTR_COMMAND is IWL_TM_CMD_APP2DEV_REG_XXX,
- *      The mandatory fields are:
- *      IWL_TM_ATTR_REG_OFFSET for the offset of the target register;
- *      IWL_TM_ATTR_REG_VALUE8 or IWL_TM_ATTR_REG_VALUE32 for value
- *
- * @IWL_TM_ATTR_SYNC_RSP:
- *      When IWL_TM_ATTR_COMMAND is IWL_TM_CMD_DEV2APP_SYNC_RSP,
- *      The mandatory fields are:
- *      IWL_TM_ATTR_SYNC_RSP for the data content responding to the user
- *      application command
- *
- * @IWL_TM_ATTR_UCODE_RX_PKT:
- *      When IWL_TM_ATTR_COMMAND is IWL_TM_CMD_DEV2APP_UCODE_RX_PKT,
- *      The mandatory fields are:
- *      IWL_TM_ATTR_UCODE_RX_PKT for the data content multicast to the user
- *      application
- *
- * @IWL_TM_ATTR_EEPROM:
- *      When IWL_TM_ATTR_COMMAND is IWL_TM_CMD_DEV2APP_EEPROM,
- *      The mandatory fields are:
- *      IWL_TM_ATTR_EEPROM for the data content responging to the user
- *      application
- *
- * @IWL_TM_ATTR_TRACE_ADDR:
- * @IWL_TM_ATTR_TRACE_SIZE:
- * @IWL_TM_ATTR_TRACE_DUMP:
- *      When IWL_TM_ATTR_COMMAND is IWL_TM_CMD_APP2DEV_XXX_TRACE,
- *      The mandatory fields are:
- *      IWL_TM_ATTR_MEM_TRACE_ADDR for the trace address
- *      IWL_TM_ATTR_MEM_TRACE_SIZE for the trace buffer size
- *      IWL_TM_ATTR_MEM_TRACE_DUMP for the trace dump
- *
- * @IWL_TM_ATTR_FIXRATE:
- *      When IWL_TM_ATTR_COMMAND is IWL_TM_CMD_APP2DEV_FIXRATE_REQ,
- *      The mandatory fields are:
- *      IWL_TM_ATTR_FIXRATE for the fixed rate
- *
- * @IWL_TM_ATTR_UCODE_OWNER:
- *      When IWL_TM_ATTR_COMMAND is IWL_TM_CMD_APP2DEV_OWNERSHIP,
- *      The mandatory fields are:
- *      IWL_TM_ATTR_UCODE_OWNER for the new owner
- *
- * @IWL_TM_ATTR_MEM_ADDR:
- * @IWL_TM_ATTR_BUFFER_SIZE:
- *      When IWL_TM_ATTR_COMMAND is IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_READ
- *      or IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_WRITE.
- *      The mandatory fields are:
- *      IWL_TM_ATTR_MEM_ADDR for the address in SRAM/periphery to read/write
- *      IWL_TM_ATTR_BUFFER_SIZE for the buffer size of data to read/write.
- *
- * @IWL_TM_ATTR_BUFFER_DUMP:
- *      When IWL_TM_ATTR_COMMAND is IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_DUMP,
- *      IWL_TM_ATTR_BUFFER_DUMP is used for the data that was read.
- *      When IWL_TM_ATTR_COMMAND is IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_WRITE,
- *      this attribute contains the data to write.
- *
- * @IWL_TM_ATTR_FW_VERSION:
- *      When IWL_TM_ATTR_COMMAND is IWL_TM_CMD_APP2DEV_GET_FW_VERSION,
- *      IWL_TM_ATTR_FW_VERSION for the uCode version
- *
- * @IWL_TM_ATTR_DEVICE_ID:
- *      When IWL_TM_ATTR_COMMAND is IWL_TM_CMD_APP2DEV_GET_DEVICE_ID,
- *      IWL_TM_ATTR_DEVICE_ID for the device ID information
- *
- * @IWL_TM_ATTR_FW_TYPE:
- * @IWL_TM_ATTR_FW_INST_SIZE:
- * @IWL_TM_ATTR_FW_DATA_SIZE:
- *      When IWL_TM_ATTR_COMMAND is IWL_TM_CMD_APP2DEV_GET_FW_INFO,
- *      The mandatory fields are:
- *      IWL_TM_ATTR_FW_TYPE for the uCode type (INIT/RUNTIME/...)
- *      IWL_TM_ATTR_FW_INST_SIZE for the size of instruction section
- *      IWL_TM_ATTR_FW_DATA_SIZE for the size of data section
- *
- * @IWL_TM_ATTR_UCODE_CMD_SKB:
- *      When IWL_TM_ATTR_COMMAND is IWL_TM_CMD_APP2DEV_UCODE this flag
- *      indicates that the user wants to receive the response of the command
- *      in a reply SKB. If it's not present, the response is not returned.
- * @IWL_TM_ATTR_ENABLE_NOTIFICATIONS:
- *      When IWL_TM_ATTR_COMMAND is IWL_TM_CMD_APP2DEV_NOTIFICATIONS, this
- *      flag enables (if present) or disables (if not) the forwarding
- *      to userspace.
- */
-enum iwl_tm_attr_t {
-        IWL_TM_ATTR_NOT_APPLICABLE              = 0,
-        IWL_TM_ATTR_COMMAND                     = 1,
-        IWL_TM_ATTR_UCODE_CMD_ID                = 2,
-        IWL_TM_ATTR_UCODE_CMD_DATA              = 3,
-        IWL_TM_ATTR_REG_OFFSET                  = 4,
-        IWL_TM_ATTR_REG_VALUE8                  = 5,
-        IWL_TM_ATTR_REG_VALUE32                 = 6,
-        IWL_TM_ATTR_SYNC_RSP                    = 7,
-        IWL_TM_ATTR_UCODE_RX_PKT                = 8,
-        IWL_TM_ATTR_EEPROM                      = 9,
-        IWL_TM_ATTR_TRACE_ADDR                  = 10,
-        IWL_TM_ATTR_TRACE_SIZE                  = 11,
-        IWL_TM_ATTR_TRACE_DUMP                  = 12,
-        IWL_TM_ATTR_FIXRATE                     = 13,
-        IWL_TM_ATTR_UCODE_OWNER                 = 14,
-        IWL_TM_ATTR_MEM_ADDR                    = 15,
-        IWL_TM_ATTR_BUFFER_SIZE                 = 16,
-        IWL_TM_ATTR_BUFFER_DUMP                 = 17,
-        IWL_TM_ATTR_FW_VERSION                  = 18,
-        IWL_TM_ATTR_DEVICE_ID                   = 19,
-        IWL_TM_ATTR_FW_TYPE                     = 20,
-        IWL_TM_ATTR_FW_INST_SIZE                = 21,
-        IWL_TM_ATTR_FW_DATA_SIZE                = 22,
-        IWL_TM_ATTR_UCODE_CMD_SKB               = 23,
-        IWL_TM_ATTR_ENABLE_NOTIFICATION         = 24,
-        IWL_TM_ATTR_MAX                         = 25,
-};
-
-/* uCode trace buffer */
-#define TRACE_BUFF_SIZE_MAX     0x200000
-#define TRACE_BUFF_SIZE_MIN     0x20000
-#define TRACE_BUFF_SIZE_DEF     TRACE_BUFF_SIZE_MIN
-#define TRACE_BUFF_PADD         0x2000
-
-/* Maximum data size of each dump it packet */
-#define DUMP_CHUNK_SIZE         (PAGE_SIZE - 1024)
-
-/* Address offset of data segment in SRAM */
-#define SRAM_DATA_SEG_OFFSET   0x800000
-
-#endif
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans.h b/drivers/net/wireless/iwlwifi/iwl-trans.h
index be4b2ac3dbbf..8d91422c5982 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans.h
+++ b/drivers/net/wireless/iwlwifi/iwl-trans.h
@@ -183,14 +183,12 @@ struct iwl_rx_packet {
  * @CMD_ASYNC: Return right away and don't want for the response
  * @CMD_WANT_SKB: valid only with CMD_SYNC. The caller needs the buffer of the
  *      response. The caller needs to call iwl_free_resp when done.
- * @CMD_ON_DEMAND: This command is sent by the test mode pipe.
  */
 enum CMD_MODE {
         CMD_SYNC                = 0,
         CMD_ASYNC               = BIT(0),
         CMD_WANT_SKB            = BIT(1),
         CMD_SEND_IN_RFKILL      = BIT(2),
-        CMD_ON_DEMAND           = BIT(3),
 };
 
 #define DEF_CMD_PAYLOAD_SIZE 320
diff --git a/drivers/net/wireless/iwlwifi/mvm/bt-coex.c b/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
index 9a4d94a1f90d..dbd622a3929c 100644
--- a/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
+++ b/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
@@ -202,6 +202,22 @@ static const __le32 iwl_concurrent_lookup[BT_COEX_LUT_SIZE] = {
         cpu_to_le32(0x00000000),
 };
 
+/* single shared antenna */
+static const __le32 iwl_single_shared_ant_lookup[BT_COEX_LUT_SIZE] = {
+        cpu_to_le32(0x40000000),
+        cpu_to_le32(0x00000000),
+        cpu_to_le32(0x44000000),
+        cpu_to_le32(0x00000000),
+        cpu_to_le32(0x40000000),
+        cpu_to_le32(0x00000000),
+        cpu_to_le32(0x44000000),
+        cpu_to_le32(0x00000000),
+        cpu_to_le32(0xC0004000),
+        cpu_to_le32(0xF0005000),
+        cpu_to_le32(0xC0004000),
+        cpu_to_le32(0xF0005000),
+};
+
 int iwl_send_bt_init_conf(struct iwl_mvm *mvm)
 {
         struct iwl_bt_coex_cmd cmd = {
@@ -225,7 +241,10 @@ int iwl_send_bt_init_conf(struct iwl_mvm *mvm)
                                         BT_VALID_REDUCED_TX_POWER |
                                         BT_VALID_LUT);
 
-        if (is_loose_coex())
+        if (mvm->cfg->bt_shared_single_ant)
+                memcpy(&cmd.decision_lut, iwl_single_shared_ant_lookup,
+                       sizeof(iwl_single_shared_ant_lookup));
+        else if (is_loose_coex())
                 memcpy(&cmd.decision_lut, iwl_loose_lookup,
                        sizeof(iwl_tight_lookup));
         else
diff --git a/drivers/net/wireless/iwlwifi/mvm/d3.c b/drivers/net/wireless/iwlwifi/mvm/d3.c
index 8c49db02c9c1..7e5e5c2f9f87 100644
--- a/drivers/net/wireless/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/iwlwifi/mvm/d3.c
@@ -1026,6 +1026,12 @@ static int __iwl_mvm_suspend(struct ieee80211_hw *hw,
         if (ret)
                 goto out;
 
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+        if (mvm->d3_wake_sysassert)
+                d3_cfg_cmd_data.wakeup_flags |=
+                        cpu_to_le32(IWL_WAKEUP_D3_CONFIG_FW_ERROR);
+#endif
+
         /* must be last -- this switches firmware state */
         ret = iwl_mvm_send_cmd(mvm, &d3_cfg_cmd);
         if (ret)
diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
index b7643c16201f..e56ed2a84888 100644
--- a/drivers/net/wireless/iwlwifi/mvm/debugfs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
@@ -344,6 +344,13 @@ static void iwl_dbgfs_update_pm(struct iwl_mvm *mvm,
         case MVM_DEBUGFS_PM_DISABLE_POWER_OFF:
                 IWL_DEBUG_POWER(mvm, "disable_power_off=%d\n", val);
                 dbgfs_pm->disable_power_off = val;
+        case MVM_DEBUGFS_PM_LPRX_ENA:
+                IWL_DEBUG_POWER(mvm, "lprx %s\n", val ? "enabled" : "disabled");
+                dbgfs_pm->lprx_ena = val;
+                break;
+        case MVM_DEBUGFS_PM_LPRX_RSSI_THRESHOLD:
+                IWL_DEBUG_POWER(mvm, "lprx_rssi_threshold=%d\n", val);
+                dbgfs_pm->lprx_rssi_threshold = val;
                 break;
         }
 }
@@ -387,6 +394,17 @@ static ssize_t iwl_dbgfs_pm_params_write(struct file *file,
                 if (sscanf(buf + 18, "%d", &val) != 1)
                         return -EINVAL;
                 param = MVM_DEBUGFS_PM_DISABLE_POWER_OFF;
+        } else if (!strncmp("lprx=", buf, 5)) {
+                if (sscanf(buf + 5, "%d", &val) != 1)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_PM_LPRX_ENA;
+        } else if (!strncmp("lprx_rssi_threshold=", buf, 20)) {
+                if (sscanf(buf + 20, "%d", &val) != 1)
+                        return -EINVAL;
+                if (val > POWER_LPRX_RSSI_THRESHOLD_MAX || val <
+                    POWER_LPRX_RSSI_THRESHOLD_MIN)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_PM_LPRX_RSSI_THRESHOLD;
         } else {
                 return -EINVAL;
         }
@@ -421,7 +439,7 @@ static ssize_t iwl_dbgfs_pm_params_read(struct file *file,
                          le32_to_cpu(cmd.skip_dtim_periods));
         pos += scnprintf(buf+pos, bufsz-pos, "power_scheme = %d\n",
                          iwlmvm_mod_params.power_scheme);
-        pos += scnprintf(buf+pos, bufsz-pos, "flags = %d\n",
+        pos += scnprintf(buf+pos, bufsz-pos, "flags = 0x%x\n",
                          le16_to_cpu(cmd.flags));
         pos += scnprintf(buf+pos, bufsz-pos, "keep_alive = %d\n",
                          cmd.keep_alive_seconds);
@@ -435,6 +453,10 @@ static ssize_t iwl_dbgfs_pm_params_read(struct file *file,
                                  le32_to_cpu(cmd.rx_data_timeout));
                 pos += scnprintf(buf+pos, bufsz-pos, "tx_data_timeout = %d\n",
                                  le32_to_cpu(cmd.tx_data_timeout));
+                if (cmd.flags & cpu_to_le16(POWER_FLAGS_LPRX_ENA_MSK))
+                        pos += scnprintf(buf+pos, bufsz-pos,
+                                         "lprx_rssi_threshold = %d\n",
+                                         le32_to_cpu(cmd.lprx_rssi_threshold));
         }
 
         return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
@@ -939,6 +961,9 @@ int iwl_mvm_dbgfs_register(struct iwl_mvm *mvm, struct dentry *dbgfs_dir)
 #ifdef CONFIG_PM_SLEEP
         MVM_DEBUGFS_ADD_FILE(d3_sram, mvm->debugfs_dir, S_IRUSR | S_IWUSR);
         MVM_DEBUGFS_ADD_FILE(d3_test, mvm->debugfs_dir, S_IRUSR);
+        if (!debugfs_create_bool("d3_wake_sysassert", S_IRUSR | S_IWUSR,
+                                 mvm->debugfs_dir, &mvm->d3_wake_sysassert))
+                goto err;
 #endif
 
         /*
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h
index d8e19290b0f3..a6da359a80c3 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h
@@ -66,6 +66,11 @@
 
 /* Power Management Commands, Responses, Notifications */
 
+/* Radio LP RX Energy Threshold measured in dBm */
+#define POWER_LPRX_RSSI_THRESHOLD       75
+#define POWER_LPRX_RSSI_THRESHOLD_MAX   94
+#define POWER_LPRX_RSSI_THRESHOLD_MIN   30
+
 /**
  * enum iwl_scan_flags - masks for power table command flags
  * @POWER_FLAGS_POWER_SAVE_ENA_MSK: '1' Allow to save power by turning off
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
index 273b0cc197ab..94aae9c8562c 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
@@ -865,6 +865,30 @@ int iwl_mvm_mac_ctxt_beacon_changed(struct iwl_mvm *mvm,
         return ret;
 }
 
+struct iwl_mvm_mac_ap_iterator_data {
+        struct iwl_mvm *mvm;
+        struct ieee80211_vif *vif;
+        u32 beacon_device_ts;
+        u16 beacon_int;
+};
+
+/* Find the beacon_device_ts and beacon_int for a managed interface */
+static void iwl_mvm_mac_ap_iterator(void *_data, u8 *mac,
+                                    struct ieee80211_vif *vif)
+{
+        struct iwl_mvm_mac_ap_iterator_data *data = _data;
+
+        if (vif->type != NL80211_IFTYPE_STATION || !vif->bss_conf.assoc)
+                return;
+
+        /* Station client has higher priority over P2P client*/
+        if (vif->p2p && data->beacon_device_ts)
+                return;
+
+        data->beacon_device_ts = vif->bss_conf.sync_device_ts;
+        data->beacon_int = vif->bss_conf.beacon_int;
+}
+
 /*
  * Fill the specific data for mac context of type AP of P2P GO
  */
@@ -874,6 +898,11 @@ static void iwl_mvm_mac_ctxt_cmd_fill_ap(struct iwl_mvm *mvm,
                                          bool add)
 {
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        struct iwl_mvm_mac_ap_iterator_data data = {
+                .mvm = mvm,
+                .vif = vif,
+                .beacon_device_ts = 0
+        };
 
         ctxt_ap->bi = cpu_to_le32(vif->bss_conf.beacon_int);
         ctxt_ap->bi_reciprocal =
@@ -887,16 +916,33 @@ static void iwl_mvm_mac_ctxt_cmd_fill_ap(struct iwl_mvm *mvm,
         ctxt_ap->mcast_qid = cpu_to_le32(vif->cab_queue);
 
         /*
-         * Only read the system time when the MAC is being added, when we
+         * Only set the beacon time when the MAC is being added, when we
          * just modify the MAC then we should keep the time -- the firmware
          * can otherwise have a "jumping" TBTT.
          */
-        if (add)
-                mvmvif->ap_beacon_time =
-                        iwl_read_prph(mvm->trans, DEVICE_SYSTEM_TIME_REG);
+        if (add) {
+                /*
+                 * If there is a station/P2P client interface which is
+                 * associated, set the AP's TBTT far enough from the station's
+                 * TBTT. Otherwise, set it to the current system time
+                 */
+                ieee80211_iterate_active_interfaces_atomic(
+                        mvm->hw, IEEE80211_IFACE_ITER_RESUME_ALL,
+                        iwl_mvm_mac_ap_iterator, &data);
+
+                if (data.beacon_device_ts) {
+                        u32 rand = (prandom_u32() % (80 - 20)) + 20;
+                        mvmvif->ap_beacon_time = data.beacon_device_ts +
+                                ieee80211_tu_to_usec(data.beacon_int * rand /
+                                                     100);
+                } else {
+                        mvmvif->ap_beacon_time =
+                                iwl_read_prph(mvm->trans,
+                                              DEVICE_SYSTEM_TIME_REG);
+                }
+        }
 
         ctxt_ap->beacon_time = cpu_to_le32(mvmvif->ap_beacon_time);
-
         ctxt_ap->beacon_tsf = 0; /* unused */
 
         /* TODO: Assume that the beacon id == mac context id */
diff --git a/drivers/net/wireless/iwlwifi/mvm/mvm.h b/drivers/net/wireless/iwlwifi/mvm/mvm.h
index c7409f159a36..d40d7db185d6 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h
@@ -73,7 +73,6 @@
 #include "iwl-trans.h"
 #include "iwl-notif-wait.h"
 #include "iwl-eeprom-parse.h"
-#include "iwl-test.h"
 #include "iwl-trans.h"
 #include "sta.h"
 #include "fw-api.h"
@@ -159,6 +158,8 @@ enum iwl_dbgfs_pm_mask {
         MVM_DEBUGFS_PM_RX_DATA_TIMEOUT = BIT(3),
         MVM_DEBUGFS_PM_TX_DATA_TIMEOUT = BIT(4),
         MVM_DEBUGFS_PM_DISABLE_POWER_OFF = BIT(5),
+        MVM_DEBUGFS_PM_LPRX_ENA = BIT(6),
+        MVM_DEBUGFS_PM_LPRX_RSSI_THRESHOLD = BIT(7),
 };
 
 struct iwl_dbgfs_pm {
@@ -168,6 +169,8 @@ struct iwl_dbgfs_pm {
         bool skip_over_dtim;
         u8 skip_dtim_periods;
         bool disable_power_off;
+        bool lprx_ena;
+        u32 lprx_rssi_threshold;
         int mask;
 };
 
@@ -353,12 +356,14 @@ struct iwl_tt_params {
  * @dynamic_smps: Is thermal throttling enabled dynamic_smps?
  * @tx_backoff: The current thremal throttling tx backoff in uSec.
  * @params: Parameters to configure the thermal throttling algorithm.
+ * @throttle: Is thermal throttling is active?
  */
 struct iwl_mvm_tt_mgmt {
         struct delayed_work ct_kill_exit;
         bool dynamic_smps;
         u32 tx_backoff;
         const struct iwl_tt_params *params;
+        bool throttle;
 };
 
 struct iwl_mvm {
@@ -461,6 +466,7 @@ struct iwl_mvm {
         struct wiphy_wowlan_support wowlan;
         int gtk_ivlen, gtk_icvlen, ptk_ivlen, ptk_icvlen;
 #ifdef CONFIG_IWLWIFI_DEBUGFS
+        u32 d3_wake_sysassert; /* must be u32 for debugfs_create_bool */
         bool d3_test_active;
         bool store_d3_resume_sram;
         void *d3_resume_sram;
diff --git a/drivers/net/wireless/iwlwifi/mvm/power.c b/drivers/net/wireless/iwlwifi/mvm/power.c
index 3760a33ca3a4..e7ca965a89b8 100644
--- a/drivers/net/wireless/iwlwifi/mvm/power.c
+++ b/drivers/net/wireless/iwlwifi/mvm/power.c
@@ -137,11 +137,12 @@ static void iwl_mvm_power_log(struct iwl_mvm *mvm,
                                 le32_to_cpu(cmd->rx_data_timeout));
                 IWL_DEBUG_POWER(mvm, "Tx timeout = %u usec\n",
                                 le32_to_cpu(cmd->tx_data_timeout));
-                IWL_DEBUG_POWER(mvm, "LP RX RSSI threshold = %u\n",
-                                cmd->lprx_rssi_threshold);
                 if (cmd->flags & cpu_to_le16(POWER_FLAGS_SKIP_OVER_DTIM_MSK))
                         IWL_DEBUG_POWER(mvm, "DTIM periods to skip = %u\n",
                                         le32_to_cpu(cmd->skip_dtim_periods));
+                if (cmd->flags & cpu_to_le16(POWER_FLAGS_LPRX_ENA_MSK))
+                        IWL_DEBUG_POWER(mvm, "LP RX RSSI threshold = %u\n",
+                                        le32_to_cpu(cmd->lprx_rssi_threshold));
         }
 }
 
@@ -181,6 +182,14 @@ void iwl_mvm_power_build_cmd(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 
         cmd->flags |= cpu_to_le16(POWER_FLAGS_POWER_MANAGEMENT_ENA_MSK);
 
+        if (vif->bss_conf.beacon_rate &&
+            (vif->bss_conf.beacon_rate->bitrate == 10 ||
+             vif->bss_conf.beacon_rate->bitrate == 60)) {
+                cmd->flags |= cpu_to_le16(POWER_FLAGS_LPRX_ENA_MSK);
+                cmd->lprx_rssi_threshold =
+                        cpu_to_le32(POWER_LPRX_RSSI_THRESHOLD);
+        }
+
         dtimper = hw->conf.ps_dtim_period ?: 1;
 
         /* Check if radar detection is required on current channel */
@@ -236,6 +245,15 @@ void iwl_mvm_power_build_cmd(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
         if (mvmvif->dbgfs_pm.mask & MVM_DEBUGFS_PM_SKIP_DTIM_PERIODS)
                 cmd->skip_dtim_periods =
                         cpu_to_le32(mvmvif->dbgfs_pm.skip_dtim_periods);
+        if (mvmvif->dbgfs_pm.mask & MVM_DEBUGFS_PM_LPRX_ENA) {
+                if (mvmvif->dbgfs_pm.lprx_ena)
+                        cmd->flags |= cpu_to_le16(POWER_FLAGS_LPRX_ENA_MSK);
+                else
+                        cmd->flags &= cpu_to_le16(~POWER_FLAGS_LPRX_ENA_MSK);
+        }
+        if (mvmvif->dbgfs_pm.mask & MVM_DEBUGFS_PM_LPRX_RSSI_THRESHOLD)
+                cmd->lprx_rssi_threshold =
+                        cpu_to_le32(mvmvif->dbgfs_pm.lprx_rssi_threshold);
 #endif /* CONFIG_IWLWIFI_DEBUGFS */
 }
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.c b/drivers/net/wireless/iwlwifi/mvm/rs.c
index 31587a318f8b..b328a988c130 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/rs.c
@@ -412,24 +412,18 @@ static int rs_tl_turn_on_agg_for_tid(struct iwl_mvm *mvm,
                 return ret;
         }
 
-        if ((iwlwifi_mod_params.auto_agg) || (load > IWL_AGG_LOAD_THRESHOLD)) {
-                IWL_DEBUG_HT(mvm, "Starting Tx agg: STA: %pM tid: %d\n",
-                             sta->addr, tid);
-                ret = ieee80211_start_tx_ba_session(sta, tid, 5000);
-                if (ret == -EAGAIN) {
-                        /*
-                         * driver and mac80211 is out of sync
-                         * this might be cause by reloading firmware
-                         * stop the tx ba session here
-                         */
-                        IWL_ERR(mvm, "Fail start Tx agg on tid: %d\n",
-                                tid);
-                        ieee80211_stop_tx_ba_session(sta, tid);
-                }
-        } else {
-                IWL_DEBUG_HT(mvm,
-                             "Aggregation not enabled for tid %d because load = %u\n",
-                             tid, load);
+        IWL_DEBUG_HT(mvm, "Starting Tx agg: STA: %pM tid: %d\n",
+                     sta->addr, tid);
+        ret = ieee80211_start_tx_ba_session(sta, tid, 5000);
+        if (ret == -EAGAIN) {
+                /*
+                 * driver and mac80211 is out of sync
+                 * this might be cause by reloading firmware
+                 * stop the tx ba session here
+                 */
+                IWL_ERR(mvm, "Fail start Tx agg on tid: %d\n",
+                        tid);
+                ieee80211_stop_tx_ba_session(sta, tid);
         }
         return ret;
 }
diff --git a/drivers/net/wireless/iwlwifi/mvm/tt.c b/drivers/net/wireless/iwlwifi/mvm/tt.c
index a7e3b8ddf22b..d6ae7f16ac11 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tt.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tt.c
@@ -427,6 +427,7 @@ void iwl_mvm_tt_handler(struct iwl_mvm *mvm)
         const struct iwl_tt_params *params = mvm->thermal_throttle.params;
         struct iwl_mvm_tt_mgmt *tt = &mvm->thermal_throttle;
         s32 temperature = mvm->temperature;
+        bool throttle_enable = false;
         int i;
         u32 tx_backoff;
 
@@ -445,6 +446,7 @@ void iwl_mvm_tt_handler(struct iwl_mvm *mvm)
                         ieee80211_iterate_active_interfaces_atomic(
                                         mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
                                         iwl_mvm_tt_smps_iterator, mvm);
+                        throttle_enable = true;
                 } else if (tt->dynamic_smps &&
                            temperature <= params->dynamic_smps_exit) {
                         IWL_DEBUG_TEMP(mvm, "Disable dynamic SMPS\n");
@@ -456,10 +458,12 @@ void iwl_mvm_tt_handler(struct iwl_mvm *mvm)
         }
 
         if (params->support_tx_protection) {
-                if (temperature >= params->tx_protection_entry)
+                if (temperature >= params->tx_protection_entry) {
                         iwl_mvm_tt_tx_protection(mvm, true);
-                else if (temperature <= params->tx_protection_exit)
+                        throttle_enable = true;
+                } else if (temperature <= params->tx_protection_exit) {
                         iwl_mvm_tt_tx_protection(mvm, false);
+                }
         }
 
         if (params->support_tx_backoff) {
@@ -469,9 +473,22 @@ void iwl_mvm_tt_handler(struct iwl_mvm *mvm)
                                 break;
                         tx_backoff = params->tx_backoff[i].backoff;
                 }
+                if (tx_backoff != 0)
+                        throttle_enable = true;
                 if (tt->tx_backoff != tx_backoff)
                         iwl_mvm_tt_tx_backoff(mvm, tx_backoff);
         }
+
+        if (!tt->throttle && throttle_enable) {
+                IWL_WARN(mvm,
+                         "Due to high temperature thermal throttling initiated\n");
+                tt->throttle = true;
+        } else if (tt->throttle && !tt->dynamic_smps && tt->tx_backoff == 0 &&
+                   temperature <= params->tx_protection_exit) {
+                IWL_WARN(mvm,
+                         "Temperature is back to normal thermal throttling stopped\n");
+                tt->throttle = false;
+        }
 }
 
 static const struct iwl_tt_params iwl7000_tt_params = {
@@ -502,6 +519,7 @@ void iwl_mvm_tt_initialize(struct iwl_mvm *mvm)
 
         IWL_DEBUG_TEMP(mvm, "Initialize Thermal Throttling\n");
         tt->params = &iwl7000_tt_params;
+        tt->throttle = false;
         INIT_DELAYED_WORK(&tt->ct_kill_exit, check_exit_ctkill);
 }
 
diff --git a/drivers/net/wireless/iwlwifi/pcie/rx.c b/drivers/net/wireless/iwlwifi/pcie/rx.c
index 3688dc5ba1ac..fd848cd1583e 100644
--- a/drivers/net/wireless/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/rx.c
@@ -110,9 +110,10 @@
 /*
  * iwl_rxq_space - Return number of free slots available in queue.
  */
-static int iwl_rxq_space(const struct iwl_rxq *q)
+static int iwl_rxq_space(const struct iwl_rxq *rxq)
 {
-        int s = q->read - q->write;
+        int s = rxq->read - rxq->write;
+
         if (s <= 0)
                 s += RX_QUEUE_SIZE;
         /* keep some buffer to not confuse full and empty queue */
@@ -143,21 +144,22 @@ int iwl_pcie_rx_stop(struct iwl_trans *trans)
 /*
  * iwl_pcie_rxq_inc_wr_ptr - Update the write pointer for the RX queue
  */
-static void iwl_pcie_rxq_inc_wr_ptr(struct iwl_trans *trans, struct iwl_rxq *q)
+static void iwl_pcie_rxq_inc_wr_ptr(struct iwl_trans *trans,
+                                    struct iwl_rxq *rxq)
 {
         unsigned long flags;
         u32 reg;
 
-        spin_lock_irqsave(&q->lock, flags);
+        spin_lock_irqsave(&rxq->lock, flags);
 
-        if (q->need_update == 0)
+        if (rxq->need_update == 0)
                 goto exit_unlock;
 
         if (trans->cfg->base_params->shadow_reg_enable) {
                 /* shadow register enabled */
                 /* Device expects a multiple of 8 */
-                q->write_actual = (q->write & ~0x7);
-                iwl_write32(trans, FH_RSCSR_CHNL0_WPTR, q->write_actual);
+                rxq->write_actual = (rxq->write & ~0x7);
+                iwl_write32(trans, FH_RSCSR_CHNL0_WPTR, rxq->write_actual);
         } else {
                 struct iwl_trans_pcie *trans_pcie =
                         IWL_TRANS_GET_PCIE_TRANS(trans);
@@ -175,22 +177,22 @@ static void iwl_pcie_rxq_inc_wr_ptr(struct iwl_trans *trans, struct iwl_rxq *q)
                                 goto exit_unlock;
                         }
 
-                        q->write_actual = (q->write & ~0x7);
+                        rxq->write_actual = (rxq->write & ~0x7);
                         iwl_write_direct32(trans, FH_RSCSR_CHNL0_WPTR,
-                                        q->write_actual);
+                                           rxq->write_actual);
 
                 /* Else device is assumed to be awake */
                 } else {
                         /* Device expects a multiple of 8 */
-                        q->write_actual = (q->write & ~0x7);
+                        rxq->write_actual = (rxq->write & ~0x7);
                         iwl_write_direct32(trans, FH_RSCSR_CHNL0_WPTR,
-                                q->write_actual);
+                                           rxq->write_actual);
                 }
         }
-        q->need_update = 0;
+        rxq->need_update = 0;
 
  exit_unlock:
-        spin_unlock_irqrestore(&q->lock, flags);
+        spin_unlock_irqrestore(&rxq->lock, flags);
 }
 
 /*
@@ -355,19 +357,16 @@ static void iwl_pcie_rxq_free_rbs(struct iwl_trans *trans)
         struct iwl_rxq *rxq = &trans_pcie->rxq;
         int i;
 
-        /* Fill the rx_used queue with _all_ of the Rx buffers */
+        lockdep_assert_held(&rxq->lock);
+
         for (i = 0; i < RX_FREE_BUFFERS + RX_QUEUE_SIZE; i++) {
-                /* In the reset function, these buffers may have been allocated
-                 * to an SKB, so we need to unmap and free potential storage */
-                if (rxq->pool[i].page != NULL) {
-                        dma_unmap_page(trans->dev, rxq->pool[i].page_dma,
-                                       PAGE_SIZE << trans_pcie->rx_page_order,
-                                       DMA_FROM_DEVICE);
-                        __free_pages(rxq->pool[i].page,
-                                     trans_pcie->rx_page_order);
-                        rxq->pool[i].page = NULL;
-                }
-                list_add_tail(&rxq->pool[i].list, &rxq->rx_used);
+                if (!rxq->pool[i].page)
+                        continue;
+                dma_unmap_page(trans->dev, rxq->pool[i].page_dma,
+                               PAGE_SIZE << trans_pcie->rx_page_order,
+                               DMA_FROM_DEVICE);
+                __free_pages(rxq->pool[i].page, trans_pcie->rx_page_order);
+                rxq->pool[i].page = NULL;
         }
 }
 
@@ -491,6 +490,20 @@ static void iwl_pcie_rx_hw_init(struct iwl_trans *trans, struct iwl_rxq *rxq)
         iwl_write8(trans, CSR_INT_COALESCING, IWL_HOST_INT_TIMEOUT_DEF);
 }
 
+static void iwl_pcie_rx_init_rxb_lists(struct iwl_rxq *rxq)
+{
+        int i;
+
+        lockdep_assert_held(&rxq->lock);
+
+        INIT_LIST_HEAD(&rxq->rx_free);
+        INIT_LIST_HEAD(&rxq->rx_used);
+        rxq->free_count = 0;
+
+        for (i = 0; i < RX_FREE_BUFFERS + RX_QUEUE_SIZE; i++)
+                list_add(&rxq->pool[i].list, &rxq->rx_used);
+}
+
 int iwl_pcie_rx_init(struct iwl_trans *trans)
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
@@ -505,13 +518,12 @@ int iwl_pcie_rx_init(struct iwl_trans *trans)
         }
 
         spin_lock_irqsave(&rxq->lock, flags);
-        INIT_LIST_HEAD(&rxq->rx_free);
-        INIT_LIST_HEAD(&rxq->rx_used);
 
-        INIT_WORK(&trans_pcie->rx_replenish,
-                  iwl_pcie_rx_replenish_work);
+        INIT_WORK(&trans_pcie->rx_replenish, iwl_pcie_rx_replenish_work);
 
+        /* free all first - we might be reconfigured for a different size */
         iwl_pcie_rxq_free_rbs(trans);
+        iwl_pcie_rx_init_rxb_lists(rxq);
 
         for (i = 0; i < RX_QUEUE_SIZE; i++)
                 rxq->queue[i] = NULL;
@@ -520,7 +532,6 @@ int iwl_pcie_rx_init(struct iwl_trans *trans)
          * not restocked the Rx queue with fresh buffers */
         rxq->read = rxq->write = 0;
         rxq->write_actual = 0;
-        rxq->free_count = 0;
         memset(rxq->rb_stts, 0, sizeof(*rxq->rb_stts));
         spin_unlock_irqrestore(&rxq->lock, flags);
 
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 197dbe0a868c..826c15602c46 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -838,8 +838,9 @@ static bool iwl_trans_pcie_grab_nic_access(struct iwl_trans *trans, bool silent,
                                                 unsigned long *flags)
 {
         int ret;
-        struct iwl_trans_pcie *pcie_trans = IWL_TRANS_GET_PCIE_TRANS(trans);
-        spin_lock_irqsave(&pcie_trans->reg_lock, *flags);
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+
+        spin_lock_irqsave(&trans_pcie->reg_lock, *flags);
 
         /* this bit wakes up the NIC */
         __iwl_trans_pcie_set_bit(trans, CSR_GP_CNTRL,
@@ -875,7 +876,7 @@ static bool iwl_trans_pcie_grab_nic_access(struct iwl_trans *trans, bool silent,
                         WARN_ONCE(1,
                                   "Timeout waiting for hardware access (CSR_GP_CNTRL 0x%08x)\n",
                                   val);
-                        spin_unlock_irqrestore(&pcie_trans->reg_lock, *flags);
+                        spin_unlock_irqrestore(&trans_pcie->reg_lock, *flags);
                         return false;
                 }
         }
@@ -884,22 +885,22 @@ static bool iwl_trans_pcie_grab_nic_access(struct iwl_trans *trans, bool silent,
          * Fool sparse by faking we release the lock - sparse will
          * track nic_access anyway.
          */
-        __release(&pcie_trans->reg_lock);
+        __release(&trans_pcie->reg_lock);
         return true;
 }
 
 static void iwl_trans_pcie_release_nic_access(struct iwl_trans *trans,
                                               unsigned long *flags)
 {
-        struct iwl_trans_pcie *pcie_trans = IWL_TRANS_GET_PCIE_TRANS(trans);
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
 
-        lockdep_assert_held(&pcie_trans->reg_lock);
+        lockdep_assert_held(&trans_pcie->reg_lock);
 
         /*
          * Fool sparse by faking we acquiring the lock - sparse will
          * track nic_access anyway.
          */
-        __acquire(&pcie_trans->reg_lock);
+        __acquire(&trans_pcie->reg_lock);
 
         __iwl_trans_pcie_clear_bit(trans, CSR_GP_CNTRL,
                                    CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
@@ -910,7 +911,7 @@ static void iwl_trans_pcie_release_nic_access(struct iwl_trans *trans,
          * scheduled on different CPUs (after we drop reg_lock).
          */
         mmiowb();
-        spin_unlock_irqrestore(&pcie_trans->reg_lock, *flags);
+        spin_unlock_irqrestore(&trans_pcie->reg_lock, *flags);
 }
 
 static int iwl_trans_pcie_read_mem(struct iwl_trans *trans, u32 addr,
diff --git a/drivers/net/wireless/rt2x00/rt2800.h b/drivers/net/wireless/rt2x00/rt2800.h
index a7630d5ec892..d78c495a86a0 100644
--- a/drivers/net/wireless/rt2x00/rt2800.h
+++ b/drivers/net/wireless/rt2x00/rt2800.h
@@ -100,7 +100,7 @@
 #define CSR_REG_BASE                    0x1000
 #define CSR_REG_SIZE                    0x0800
 #define EEPROM_BASE                     0x0000
-#define EEPROM_SIZE                     0x0110
+#define EEPROM_SIZE                     0x0200
 #define BBP_BASE                        0x0000
 #define BBP_SIZE                        0x00ff
 #define RF_BASE                         0x0004
@@ -2625,11 +2625,13 @@ struct mac_iveiv_entry {
 /*
  * DMA descriptor defines.
  */
-#define TXWI_DESC_SIZE                  (4 * sizeof(__le32))
-#define RXWI_DESC_SIZE                  (4 * sizeof(__le32))
 
-#define TXWI_DESC_SIZE_5592             (5 * sizeof(__le32))
-#define RXWI_DESC_SIZE_5592             (6 * sizeof(__le32))
+#define TXWI_DESC_SIZE_4WORDS           (4 * sizeof(__le32))
+#define TXWI_DESC_SIZE_5WORDS           (5 * sizeof(__le32))
+
+#define RXWI_DESC_SIZE_4WORDS           (4 * sizeof(__le32))
+#define RXWI_DESC_SIZE_6WORDS           (6 * sizeof(__le32))
+
 /*
  * TX WI structure
  */
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index 3aa30ddcbfea..1f80ea5e29dd 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -2392,7 +2392,7 @@ static void rt2800_config_channel_rf55xx(struct rt2x00_dev *rt2x00dev,
         rt2800_rfcsr_write(rt2x00dev, 49, rfcsr);
 
         rt2800_rfcsr_read(rt2x00dev, 50, &rfcsr);
-        if (info->default_power1 > power_bound)
+        if (info->default_power2 > power_bound)
                 rt2x00_set_field8(&rfcsr, RFCSR50_TX, power_bound);
         else
                 rt2x00_set_field8(&rfcsr, RFCSR50_TX, info->default_power2);
@@ -2678,30 +2678,53 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,
 
         tx_pin = 0;
 
-        /* Turn on unused PA or LNA when not using 1T or 1R */
-        if (rt2x00dev->default_ant.tx_chain_num == 2) {
+        switch (rt2x00dev->default_ant.tx_chain_num) {
+        case 3:
+                /* Turn on tertiary PAs */
+                rt2x00_set_field32(&tx_pin, TX_PIN_CFG_PA_PE_A2_EN,
+                                   rf->channel > 14);
+                rt2x00_set_field32(&tx_pin, TX_PIN_CFG_PA_PE_G2_EN,
+                                   rf->channel <= 14);
+                /* fall-through */
+        case 2:
+                /* Turn on secondary PAs */
                 rt2x00_set_field32(&tx_pin, TX_PIN_CFG_PA_PE_A1_EN,
                                    rf->channel > 14);
                 rt2x00_set_field32(&tx_pin, TX_PIN_CFG_PA_PE_G1_EN,
                                    rf->channel <= 14);
+                /* fall-through */
+        case 1:
+                /* Turn on primary PAs */
+                rt2x00_set_field32(&tx_pin, TX_PIN_CFG_PA_PE_A0_EN,
+                                   rf->channel > 14);
+                if (test_bit(CAPABILITY_BT_COEXIST, &rt2x00dev->cap_flags))
+                        rt2x00_set_field32(&tx_pin, TX_PIN_CFG_PA_PE_G0_EN, 1);
+                else
+                        rt2x00_set_field32(&tx_pin, TX_PIN_CFG_PA_PE_G0_EN,
+                                           rf->channel <= 14);
+                break;
         }
 
-        /* Turn on unused PA or LNA when not using 1T or 1R */
-        if (rt2x00dev->default_ant.rx_chain_num == 2) {
+        switch (rt2x00dev->default_ant.rx_chain_num) {
+        case 3:
+                /* Turn on tertiary LNAs */
+                rt2x00_set_field32(&tx_pin, TX_PIN_CFG_LNA_PE_A2_EN, 1);
+                rt2x00_set_field32(&tx_pin, TX_PIN_CFG_LNA_PE_G2_EN, 1);
+                /* fall-through */
+        case 2:
+                /* Turn on secondary LNAs */
                 rt2x00_set_field32(&tx_pin, TX_PIN_CFG_LNA_PE_A1_EN, 1);
                 rt2x00_set_field32(&tx_pin, TX_PIN_CFG_LNA_PE_G1_EN, 1);
+                /* fall-through */
+        case 1:
+                /* Turn on primary LNAs */
+                rt2x00_set_field32(&tx_pin, TX_PIN_CFG_LNA_PE_A0_EN, 1);
+                rt2x00_set_field32(&tx_pin, TX_PIN_CFG_LNA_PE_G0_EN, 1);
+                break;
         }
 
-        rt2x00_set_field32(&tx_pin, TX_PIN_CFG_LNA_PE_A0_EN, 1);
-        rt2x00_set_field32(&tx_pin, TX_PIN_CFG_LNA_PE_G0_EN, 1);
         rt2x00_set_field32(&tx_pin, TX_PIN_CFG_RFTR_EN, 1);
         rt2x00_set_field32(&tx_pin, TX_PIN_CFG_TRSW_EN, 1);
-        if (test_bit(CAPABILITY_BT_COEXIST, &rt2x00dev->cap_flags))
-                rt2x00_set_field32(&tx_pin, TX_PIN_CFG_PA_PE_G0_EN, 1);
-        else
-                rt2x00_set_field32(&tx_pin, TX_PIN_CFG_PA_PE_G0_EN,
-                                   rf->channel <= 14);
-        rt2x00_set_field32(&tx_pin, TX_PIN_CFG_PA_PE_A0_EN, rf->channel > 14);
 
         rt2800_register_write(rt2x00dev, TX_PIN_CFG, tx_pin);
 
@@ -6254,8 +6277,8 @@ static int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
                 default_power2 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A2);
 
                 for (i = 14; i < spec->num_channels; i++) {
-                        info[i].default_power1 = default_power1[i];
-                        info[i].default_power2 = default_power2[i];
+                        info[i].default_power1 = default_power1[i - 14];
+                        info[i].default_power2 = default_power2[i - 14];
                 }
         }
 
diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
index 7c7478219bbc..00055627eb8d 100644
--- a/drivers/net/wireless/rt2x00/rt2800pci.c
+++ b/drivers/net/wireless/rt2x00/rt2800pci.c
@@ -637,6 +637,7 @@ static void rt2800pci_write_tx_desc(struct queue_entry *entry,
         struct queue_entry_priv_mmio *entry_priv = entry->priv_data;
         __le32 *txd = entry_priv->desc;
         u32 word;
+        const unsigned int txwi_size = entry->queue->winfo_size;
 
         /*
          * The buffers pointed by SD_PTR0/SD_LEN0 and SD_PTR1/SD_LEN1
@@ -659,14 +660,14 @@ static void rt2800pci_write_tx_desc(struct queue_entry *entry,
                            !test_bit(ENTRY_TXD_MORE_FRAG, &txdesc->flags));
         rt2x00_set_field32(&word, TXD_W1_BURST,
                            test_bit(ENTRY_TXD_BURST, &txdesc->flags));
-        rt2x00_set_field32(&word, TXD_W1_SD_LEN0, TXWI_DESC_SIZE);
+        rt2x00_set_field32(&word, TXD_W1_SD_LEN0, txwi_size);
         rt2x00_set_field32(&word, TXD_W1_LAST_SEC0, 0);
         rt2x00_set_field32(&word, TXD_W1_DMA_DONE, 0);
         rt2x00_desc_write(txd, 1, word);
 
         word = 0;
         rt2x00_set_field32(&word, TXD_W2_SD_PTR1,
-                           skbdesc->skb_dma + TXWI_DESC_SIZE);
+                           skbdesc->skb_dma + txwi_size);
         rt2x00_desc_write(txd, 2, word);
 
         word = 0;
@@ -1193,7 +1194,7 @@ static void rt2800pci_queue_init(struct data_queue *queue)
                 queue->limit = 128;
                 queue->data_size = AGGREGATION_SIZE;
                 queue->desc_size = RXD_DESC_SIZE;
-                queue->winfo_size = RXWI_DESC_SIZE;
+                queue->winfo_size = RXWI_DESC_SIZE_4WORDS;
                 queue->priv_size = sizeof(struct queue_entry_priv_mmio);
                 break;
 
@@ -1204,7 +1205,7 @@ static void rt2800pci_queue_init(struct data_queue *queue)
                 queue->limit = 64;
                 queue->data_size = AGGREGATION_SIZE;
                 queue->desc_size = TXD_DESC_SIZE;
-                queue->winfo_size = TXWI_DESC_SIZE;
+                queue->winfo_size = TXWI_DESC_SIZE_4WORDS;
                 queue->priv_size = sizeof(struct queue_entry_priv_mmio);
                 break;
 
@@ -1212,7 +1213,7 @@ static void rt2800pci_queue_init(struct data_queue *queue)
                 queue->limit = 8;
                 queue->data_size = 0; /* No DMA required for beacons */
                 queue->desc_size = TXD_DESC_SIZE;
-                queue->winfo_size = TXWI_DESC_SIZE;
+                queue->winfo_size = TXWI_DESC_SIZE_4WORDS;
                 queue->priv_size = sizeof(struct queue_entry_priv_mmio);
                 break;
 
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index 7edd903dd749..840833b26bfa 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -855,11 +855,11 @@ static void rt2800usb_queue_init(struct data_queue *queue)
         unsigned short txwi_size, rxwi_size;
 
         if (rt2x00_rt(rt2x00dev, RT5592)) {
-                txwi_size = TXWI_DESC_SIZE_5592;
-                rxwi_size = RXWI_DESC_SIZE_5592;
+                txwi_size = TXWI_DESC_SIZE_5WORDS;
+                rxwi_size = RXWI_DESC_SIZE_6WORDS;
         } else {
-                txwi_size = TXWI_DESC_SIZE;
-                rxwi_size = RXWI_DESC_SIZE;
+                txwi_size = TXWI_DESC_SIZE_4WORDS;
+                rxwi_size = RXWI_DESC_SIZE_4WORDS;
         }
 
         switch (queue->qid) {
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index 53754bc66d05..54d3ddfc9888 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -2825,7 +2825,8 @@ static int rt61pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
                 tx_power = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A_START);
                 for (i = 14; i < spec->num_channels; i++) {
                         info[i].max_power = MAX_TXPOWER;
-                        info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+                        info[i].default_power1 =
+                                        TXPOWER_FROM_DEV(tx_power[i - 14]);
                 }
         }
 
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index 1616ed484ceb..1d3880e09a13 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -2167,7 +2167,8 @@ static int rt73usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
                 tx_power = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A_START);
                 for (i = 14; i < spec->num_channels; i++) {
                         info[i].max_power = MAX_TXPOWER;
-                        info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+                        info[i].default_power1 =
+                                        TXPOWER_FROM_DEV(tx_power[i - 14]);
                 }
         }
 
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/sw.c b/drivers/net/wireless/rtlwifi/rtl8723ae/sw.c
index e4c4cdc3eb67..d9ee2efffe5f 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/sw.c
@@ -251,7 +251,7 @@ static struct rtl_hal_cfg rtl8723ae_hal_cfg = {
         .bar_id = 2,
         .write_readback = true,
         .name = "rtl8723ae_pci",
-        .fw_name = "rtlwifi/rtl8723aefw.bin",
+        .fw_name = "rtlwifi/rtl8723fw.bin",
         .ops = &rtl8723ae_hal_ops,
         .mod_params = &rtl8723ae_mod_params,
         .maps[SYS_ISO_CTRL] = REG_SYS_ISO_CTRL,
@@ -353,8 +353,8 @@ MODULE_AUTHOR("Realtek WlanFAE	<wlanfae@realtek.com>");
 MODULE_AUTHOR("Larry Finger     <Larry.Finger@lwfinger.net>");
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Realtek 8723E 802.11n PCI wireless");
-MODULE_FIRMWARE("rtlwifi/rtl8723aefw.bin");
-MODULE_FIRMWARE("rtlwifi/rtl8723aefw_B.bin");
+MODULE_FIRMWARE("rtlwifi/rtl8723fw.bin");
+MODULE_FIRMWARE("rtlwifi/rtl8723fw_B.bin");
 
 module_param_named(swenc, rtl8723ae_mod_params.sw_crypto, bool, 0444);
 module_param_named(debug, rtl8723ae_mod_params.debug, int, 0444);
diff --git a/include/linux/bcma/bcma.h b/include/linux/bcma/bcma.h
index 2e34db82a643..622fc505d3e1 100644
--- a/include/linux/bcma/bcma.h
+++ b/include/linux/bcma/bcma.h
@@ -144,6 +144,7 @@ struct bcma_host_ops {
 
 /* Chip IDs of PCIe devices */
 #define BCMA_CHIP_ID_BCM4313    0x4313
+#define BCMA_CHIP_ID_BCM43142   43142
 #define BCMA_CHIP_ID_BCM43224   43224
 #define  BCMA_PKG_ID_BCM43224_FAB_CSM   0x8
 #define  BCMA_PKG_ID_BCM43224_FAB_SMIC  0xa
diff --git a/include/linux/bcma/bcma_driver_chipcommon.h b/include/linux/bcma/bcma_driver_chipcommon.h
index b8b09eac60a4..c49e1a159e6e 100644
--- a/include/linux/bcma/bcma_driver_chipcommon.h
+++ b/include/linux/bcma/bcma_driver_chipcommon.h
@@ -330,6 +330,8 @@
 #define BCMA_CC_PMU_CAP                 0x0604 /* PMU capabilities */
 #define  BCMA_CC_PMU_CAP_REVISION       0x000000FF /* Revision mask */
 #define BCMA_CC_PMU_STAT                0x0608 /* PMU status */
+#define  BCMA_CC_PMU_STAT_EXT_LPO_AVAIL 0x00000100
+#define  BCMA_CC_PMU_STAT_WDRESET       0x00000080
 #define  BCMA_CC_PMU_STAT_INTPEND       0x00000040 /* Interrupt pending */
 #define  BCMA_CC_PMU_STAT_SBCLKST       0x00000030 /* Backplane clock status? */
 #define  BCMA_CC_PMU_STAT_HAVEALP       0x00000008 /* ALP available */
@@ -355,6 +357,11 @@
 #define BCMA_CC_REGCTL_DATA             0x065C
 #define BCMA_CC_PLLCTL_ADDR             0x0660
 #define BCMA_CC_PLLCTL_DATA             0x0664
+#define BCMA_CC_PMU_STRAPOPT            0x0668 /* (corerev >= 28) */
+#define BCMA_CC_PMU_XTAL_FREQ           0x066C /* (pmurev >= 10) */
+#define  BCMA_CC_PMU_XTAL_FREQ_ILPCTL_MASK      0x00001FFF
+#define  BCMA_CC_PMU_XTAL_FREQ_MEASURE_MASK     0x80000000
+#define  BCMA_CC_PMU_XTAL_FREQ_MEASURE_SHIFT    31
 #define BCMA_CC_SPROM                   0x0800 /* SPROM beginning */
 /* NAND flash MLC controller registers (corerev >= 38) */
 #define BCMA_CC_NAND_REVISION           0x0C00
@@ -435,6 +442,23 @@
 #define  BCMA_CC_PMU6_4706_PROC_NDIV_MODE_MASK  0x00000007
 #define  BCMA_CC_PMU6_4706_PROC_NDIV_MODE_SHIFT 0
 
+/* PMU rev 15 */
+#define BCMA_CC_PMU15_PLL_PLLCTL0       0
+#define  BCMA_CC_PMU15_PLL_PC0_CLKSEL_MASK      0x00000003
+#define  BCMA_CC_PMU15_PLL_PC0_CLKSEL_SHIFT     0
+#define  BCMA_CC_PMU15_PLL_PC0_FREQTGT_MASK     0x003FFFFC
+#define  BCMA_CC_PMU15_PLL_PC0_FREQTGT_SHIFT    2
+#define  BCMA_CC_PMU15_PLL_PC0_PRESCALE_MASK    0x00C00000
+#define  BCMA_CC_PMU15_PLL_PC0_PRESCALE_SHIFT   22
+#define  BCMA_CC_PMU15_PLL_PC0_KPCTRL_MASK      0x07000000
+#define  BCMA_CC_PMU15_PLL_PC0_KPCTRL_SHIFT     24
+#define  BCMA_CC_PMU15_PLL_PC0_FCNTCTRL_MASK    0x38000000
+#define  BCMA_CC_PMU15_PLL_PC0_FCNTCTRL_SHIFT   27
+#define  BCMA_CC_PMU15_PLL_PC0_FDCMODE_MASK     0x40000000
+#define  BCMA_CC_PMU15_PLL_PC0_FDCMODE_SHIFT    30
+#define  BCMA_CC_PMU15_PLL_PC0_CTRLBIAS_MASK    0x80000000
+#define  BCMA_CC_PMU15_PLL_PC0_CTRLBIAS_SHIFT   31
+
 /* ALP clock on pre-PMU chips */
 #define BCMA_CC_PMU_ALP_CLOCK           20000000
 /* HT clock for systems with PMU-enabled chipcommon */
@@ -507,6 +531,37 @@
 #define BCMA_CHIPCTL_5357_I2S_PINS_ENABLE       BIT(18)
 #define BCMA_CHIPCTL_5357_I2CSPI_PINS_ENABLE    BIT(19)
 
+#define BCMA_RES_4314_LPLDO_PU                  BIT(0)
+#define BCMA_RES_4314_PMU_SLEEP_DIS             BIT(1)
+#define BCMA_RES_4314_PMU_BG_PU                 BIT(2)
+#define BCMA_RES_4314_CBUCK_LPOM_PU             BIT(3)
+#define BCMA_RES_4314_CBUCK_PFM_PU              BIT(4)
+#define BCMA_RES_4314_CLDO_PU                   BIT(5)
+#define BCMA_RES_4314_LPLDO2_LVM                BIT(6)
+#define BCMA_RES_4314_WL_PMU_PU                 BIT(7)
+#define BCMA_RES_4314_LNLDO_PU                  BIT(8)
+#define BCMA_RES_4314_LDO3P3_PU                 BIT(9)
+#define BCMA_RES_4314_OTP_PU                    BIT(10)
+#define BCMA_RES_4314_XTAL_PU                   BIT(11)
+#define BCMA_RES_4314_WL_PWRSW_PU               BIT(12)
+#define BCMA_RES_4314_LQ_AVAIL                  BIT(13)
+#define BCMA_RES_4314_LOGIC_RET                 BIT(14)
+#define BCMA_RES_4314_MEM_SLEEP                 BIT(15)
+#define BCMA_RES_4314_MACPHY_RET                BIT(16)
+#define BCMA_RES_4314_WL_CORE_READY             BIT(17)
+#define BCMA_RES_4314_ILP_REQ                   BIT(18)
+#define BCMA_RES_4314_ALP_AVAIL                 BIT(19)
+#define BCMA_RES_4314_MISC_PWRSW_PU             BIT(20)
+#define BCMA_RES_4314_SYNTH_PWRSW_PU            BIT(21)
+#define BCMA_RES_4314_RX_PWRSW_PU               BIT(22)
+#define BCMA_RES_4314_RADIO_PU                  BIT(23)
+#define BCMA_RES_4314_VCO_LDO_PU                BIT(24)
+#define BCMA_RES_4314_AFE_LDO_PU                BIT(25)
+#define BCMA_RES_4314_RX_LDO_PU                 BIT(26)
+#define BCMA_RES_4314_TX_LDO_PU                 BIT(27)
+#define BCMA_RES_4314_HT_AVAIL                  BIT(28)
+#define BCMA_RES_4314_MACPHY_CLK_AVAIL          BIT(29)
+
 /* Data for the PMU, if available.
  * Check availability with ((struct bcma_chipcommon)->capabilities & BCMA_CC_CAP_PMU)
  */
diff --git a/include/linux/platform_data/brcmfmac-sdio.h b/include/linux/platform_data/brcmfmac-sdio.h
index 1ade657d5fc1..b7174998c24a 100644
--- a/include/linux/platform_data/brcmfmac-sdio.h
+++ b/include/linux/platform_data/brcmfmac-sdio.h
@@ -90,6 +90,10 @@ void __init brcmfmac_init_pdata(void)
  * oob_irq_nr, oob_irq_flags: the OOB interrupt information. The values are
  * used for registering the irq using request_irq function.
  *
+ * broken_sg_support: flag for broken sg list support of SDIO host controller.
+ * Set this to true if the SDIO host controller has higher align requirement
+ * than 32 bytes for each scatterlist item.
+ *
  * power_on: This function is called by the brcmfmac when the module gets
  * loaded. This can be particularly useful for low power devices. The platform
  * spcific routine may for example decide to power up the complete device.
@@ -116,6 +120,7 @@ struct brcmfmac_sdio_platform_data {
         bool oob_irq_supported;
         unsigned int oob_irq_nr;
         unsigned long oob_irq_flags;
+        bool broken_sg_support;
         void (*power_on)(void);
         void (*power_off)(void);
         void (*reset)(void);
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index e0512aaef4b8..3c592cf473da 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -107,7 +107,6 @@ enum {
         HCI_MGMT,
         HCI_PAIRABLE,
         HCI_SERVICE_CACHE,
-        HCI_LINK_KEYS,
         HCI_DEBUG_KEYS,
         HCI_UNREGISTER,
 
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 7cb6d360d147..f77885ea78c2 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -117,13 +117,6 @@ struct oob_data {
         u8 randomizer[16];
 };
 
-struct le_scan_params {
-        u8 type;
-        u16 interval;
-        u16 window;
-        int timeout;
-};
-
 #define HCI_MAX_SHORT_NAME_LENGTH       10
 
 struct amp_assoc {
@@ -283,9 +276,6 @@ struct hci_dev {
 
         struct delayed_work     le_scan_disable;
 
-        struct work_struct      le_scan;
-        struct le_scan_params   le_scan_params;
-
         __s8                    adv_tx_power;
         __u8                    adv_data[HCI_MAX_AD_LENGTH];
         __u8                    adv_data_len;
@@ -432,6 +422,7 @@ void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
                                       struct inquiry_entry *ie);
 bool hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
                               bool name_known, bool *ssp);
+void hci_inquiry_cache_flush(struct hci_dev *hdev);
 
 /* ----- HCI Connections ----- */
 enum {
@@ -1114,6 +1105,16 @@ void hci_sock_dev_event(struct hci_dev *hdev, int event);
                                          BIT(BDADDR_LE_PUBLIC) | \
                                          BIT(BDADDR_LE_RANDOM))
 
+/* These LE scan and inquiry parameters were chosen according to LE General
+ * Discovery Procedure specification.
+ */
+#define DISCOV_LE_SCAN_WIN              0x12
+#define DISCOV_LE_SCAN_INT              0x12
+#define DISCOV_LE_TIMEOUT               msecs_to_jiffies(10240)
+#define DISCOV_INTERLEAVED_TIMEOUT      msecs_to_jiffies(5120)
+#define DISCOV_INTERLEAVED_INQUIRY_LEN  0x04
+#define DISCOV_BREDR_INQUIRY_LEN        0x08
+
 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t len);
 int mgmt_index_added(struct hci_dev *hdev);
 int mgmt_index_removed(struct hci_dev *hdev);
@@ -1169,10 +1170,7 @@ int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
                       u8 ssp, u8 *eir, u16 eir_len);
 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
                      u8 addr_type, s8 rssi, u8 *name, u8 name_len);
-int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status);
-int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status);
 int mgmt_discovering(struct hci_dev *hdev, u8 discovering);
-int mgmt_interleaved_discovery(struct hci_dev *hdev);
 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type);
 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type);
 bool mgmt_valid_hdev(struct hci_dev *hdev);
@@ -1212,11 +1210,6 @@ void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
                                         u16 latency, u16 to_multiplier);
 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
                                                         __u8 ltk[16]);
-int hci_do_inquiry(struct hci_dev *hdev, u8 length);
-int hci_cancel_inquiry(struct hci_dev *hdev);
-int hci_le_scan(struct hci_dev *hdev, u8 type, u16 interval, u16 window,
-                int timeout);
-int hci_cancel_le_scan(struct hci_dev *hdev);
 
 u8 bdaddr_to_le(u8 bdaddr_type);
 
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index fb94cf13c777..1a966afbbfa8 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -242,7 +242,7 @@ struct l2cap_conn_rsp {
 #define L2CAP_CID_SIGNALING     0x0001
 #define L2CAP_CID_CONN_LESS     0x0002
 #define L2CAP_CID_A2MP          0x0003
-#define L2CAP_CID_LE_DATA       0x0004
+#define L2CAP_CID_ATT           0x0004
 #define L2CAP_CID_LE_SIGNALING  0x0005
 #define L2CAP_CID_SMP           0x0006
 #define L2CAP_CID_DYN_START     0x0040
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 6a43c34ce96f..7b0730aeb892 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -188,6 +188,8 @@ struct ieee80211_channel {
  *      when used with 802.11g (on the 2.4 GHz band); filled by the
  *      core code when registering the wiphy.
  * @IEEE80211_RATE_ERP_G: This is an ERP rate in 802.11g mode.
+ * @IEEE80211_RATE_SUPPORTS_5MHZ: Rate can be used in 5 MHz mode
+ * @IEEE80211_RATE_SUPPORTS_10MHZ: Rate can be used in 10 MHz mode
  */
 enum ieee80211_rate_flags {
         IEEE80211_RATE_SHORT_PREAMBLE   = 1<<0,
@@ -195,6 +197,8 @@ enum ieee80211_rate_flags {
         IEEE80211_RATE_MANDATORY_B      = 1<<2,
         IEEE80211_RATE_MANDATORY_G      = 1<<3,
         IEEE80211_RATE_ERP_G            = 1<<4,
+        IEEE80211_RATE_SUPPORTS_5MHZ    = 1<<5,
+        IEEE80211_RATE_SUPPORTS_10MHZ   = 1<<6,
 };
 
 /**
@@ -433,6 +437,30 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy,
                              u32 prohibited_flags);
 
 /**
+ * ieee80211_chandef_rate_flags - returns rate flags for a channel
+ *
+ * In some channel types, not all rates may be used - for example CCK
+ * rates may not be used in 5/10 MHz channels.
+ *
+ * @chandef: channel definition for the channel
+ *
+ * Returns: rate flags which apply for this channel
+ */
+static inline enum ieee80211_rate_flags
+ieee80211_chandef_rate_flags(struct cfg80211_chan_def *chandef)
+{
+        switch (chandef->width) {
+        case NL80211_CHAN_WIDTH_5:
+                return IEEE80211_RATE_SUPPORTS_5MHZ;
+        case NL80211_CHAN_WIDTH_10:
+                return IEEE80211_RATE_SUPPORTS_10MHZ;
+        default:
+                break;
+        }
+        return 0;
+}
+
+/**
  * enum survey_info_flags - survey information flags
  *
  * @SURVEY_INFO_NOISE_DBM: noise (in dBm) was filled in
@@ -1431,7 +1459,8 @@ const u8 *ieee80211_bss_get_ie(struct cfg80211_bss *bss, u8 ie);
  * This structure provides information needed to complete IEEE 802.11
  * authentication.
  *
- * @bss: The BSS to authenticate with.
+ * @bss: The BSS to authenticate with, the callee must obtain a reference
+ *      to it if it needs to keep it.
  * @auth_type: Authentication type (algorithm)
  * @ie: Extra IEs to add to Authentication frame or %NULL
  * @ie_len: Length of ie buffer in octets
@@ -1469,11 +1498,10 @@ enum cfg80211_assoc_req_flags {
  *
  * This structure provides information needed to complete IEEE 802.11
  * (re)association.
- * @bss: The BSS to associate with. If the call is successful the driver
- *      is given a reference that it must release, normally via a call to
- *      cfg80211_send_rx_assoc(), or, if association timed out, with a
- *      call to cfg80211_put_bss() (in addition to calling
- *      cfg80211_send_assoc_timeout())
+ * @bss: The BSS to associate with. If the call is successful the driver is
+ *      given a reference that it must give back to cfg80211_send_rx_assoc()
+ *      or to cfg80211_assoc_timeout(). To ensure proper refcounting, new
+ *      association requests while already associating must be rejected.
  * @ie: Extra IEs to add to (Re)Association Request frame or %NULL
  * @ie_len: Length of ie buffer in octets
  * @use_mfp: Use management frame protection (IEEE 802.11w) in this association
@@ -2342,6 +2370,7 @@ struct cfg80211_ops {
  *      responds to probe-requests in hardware.
  * @WIPHY_FLAG_OFFCHAN_TX: Device supports direct off-channel TX.
  * @WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL: Device supports remain-on-channel call.
+ * @WIPHY_FLAG_SUPPORTS_5_10_MHZ: Device supports 5 MHz and 10 MHz channels.
  */
 enum wiphy_flags {
         WIPHY_FLAG_CUSTOM_REGULATORY            = BIT(0),
@@ -2365,6 +2394,7 @@ enum wiphy_flags {
         WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD        = BIT(19),
         WIPHY_FLAG_OFFCHAN_TX                   = BIT(20),
         WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL        = BIT(21),
+        WIPHY_FLAG_SUPPORTS_5_10_MHZ            = BIT(22),
 };
 
 /**
@@ -3492,11 +3522,11 @@ void cfg80211_rx_assoc_resp(struct net_device *dev,
 /**
  * cfg80211_assoc_timeout - notification of timed out association
  * @dev: network device
- * @addr: The MAC address of the device with which the association timed out
+ * @bss: The BSS entry with which association timed out.
  *
  * This function may sleep. The caller must hold the corresponding wdev's mutex.
  */
-void cfg80211_assoc_timeout(struct net_device *dev, const u8 *addr);
+void cfg80211_assoc_timeout(struct net_device *dev, struct cfg80211_bss *bss);
 
 /**
  * cfg80211_tx_mlme_mgmt - notification of transmitted deauth/disassoc frame
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index a405a7a9775c..5b7a3dadadde 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -305,6 +305,7 @@ enum ieee80211_rssi_event {
  * @basic_rates: bitmap of basic rates, each bit stands for an
  *      index into the rate table configured by the driver in
  *      the current band.
+ * @beacon_rate: associated AP's beacon TX rate
  * @mcast_rate: per-band multicast rate index + 1 (0: disabled)
  * @bssid: The BSSID for this BSS
  * @enable_beacon: whether beaconing should be enabled or not
@@ -352,6 +353,7 @@ struct ieee80211_bss_conf {
         u32 sync_device_ts;
         u8 sync_dtim_count;
         u32 basic_rates;
+        struct ieee80211_rate *beacon_rate;
         int mcast_rate[IEEE80211_NUM_BANDS];
         u16 ht_operation_mode;
         s32 cqm_rssi_thold;
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index ca6facf4df0c..861e5eba3953 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -2758,6 +2758,8 @@ enum nl80211_channel_type {
  *      and %NL80211_ATTR_CENTER_FREQ2 attributes must be provided as well
  * @NL80211_CHAN_WIDTH_160: 160 MHz channel, the %NL80211_ATTR_CENTER_FREQ1
  *      attribute must be provided as well
+ * @NL80211_CHAN_WIDTH_5: 5 MHz OFDM channel
+ * @NL80211_CHAN_WIDTH_10: 10 MHz OFDM channel
  */
 enum nl80211_chan_width {
         NL80211_CHAN_WIDTH_20_NOHT,
@@ -2766,6 +2768,8 @@ enum nl80211_chan_width {
         NL80211_CHAN_WIDTH_80,
         NL80211_CHAN_WIDTH_80P80,
         NL80211_CHAN_WIDTH_160,
+        NL80211_CHAN_WIDTH_5,
+        NL80211_CHAN_WIDTH_10,
 };
 
 /**
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index ace5e55fe5a3..061523eb52a1 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -597,7 +597,15 @@ static void hci_init3_req(struct hci_request *req, unsigned long opt)
         struct hci_dev *hdev = req->hdev;
         u8 p;
 
-        /* Only send HCI_Delete_Stored_Link_Key if it is supported */
+        /* Some Broadcom based Bluetooth controllers do not support the
+         * Delete Stored Link Key command. They are clearly indicating its
+         * absence in the bit mask of supported commands.
+         *
+         * Check the supported commands and only if the the command is marked
+         * as supported send it. If not supported assume that the controller
+         * does not have actual support for stored link keys which makes this
+         * command redundant anyway.
+         */
         if (hdev->commands[6] & 0x80) {
                 struct hci_cp_delete_stored_link_key cp;
 
@@ -751,7 +759,7 @@ void hci_discovery_set_state(struct hci_dev *hdev, int state)
         hdev->discovery.state = state;
 }
 
-static void inquiry_cache_flush(struct hci_dev *hdev)
+void hci_inquiry_cache_flush(struct hci_dev *hdev)
 {
         struct discovery_state *cache = &hdev->discovery;
         struct inquiry_entry *p, *n;
@@ -964,7 +972,7 @@ int hci_inquiry(void __user *arg)
         hci_dev_lock(hdev);
         if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
             inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
-                inquiry_cache_flush(hdev);
+                hci_inquiry_cache_flush(hdev);
                 do_inquiry = 1;
         }
         hci_dev_unlock(hdev);
@@ -1201,8 +1209,6 @@ static int hci_dev_do_close(struct hci_dev *hdev)
 {
         BT_DBG("%s %p", hdev->name, hdev);
 
-        cancel_work_sync(&hdev->le_scan);
-
         cancel_delayed_work(&hdev->power_off);
 
         hci_req_cancel(hdev, ENODEV);
@@ -1230,7 +1236,7 @@ static int hci_dev_do_close(struct hci_dev *hdev)
         cancel_delayed_work_sync(&hdev->le_scan_disable);
 
         hci_dev_lock(hdev);
-        inquiry_cache_flush(hdev);
+        hci_inquiry_cache_flush(hdev);
         hci_conn_hash_flush(hdev);
         hci_dev_unlock(hdev);
 
@@ -1331,7 +1337,7 @@ int hci_dev_reset(__u16 dev)
         skb_queue_purge(&hdev->cmd_q);
 
         hci_dev_lock(hdev);
-        inquiry_cache_flush(hdev);
+        hci_inquiry_cache_flush(hdev);
         hci_conn_hash_flush(hdev);
         hci_dev_unlock(hdev);
 
@@ -1991,80 +1997,59 @@ int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
         return mgmt_device_unblocked(hdev, bdaddr, type);
 }
 
-static void le_scan_param_req(struct hci_request *req, unsigned long opt)
+static void inquiry_complete(struct hci_dev *hdev, u8 status)
 {
-        struct le_scan_params *param =  (struct le_scan_params *) opt;
-        struct hci_cp_le_set_scan_param cp;
-
-        memset(&cp, 0, sizeof(cp));
-        cp.type = param->type;
-        cp.interval = cpu_to_le16(param->interval);
-        cp.window = cpu_to_le16(param->window);
+        if (status) {
+                BT_ERR("Failed to start inquiry: status %d", status);
 
-        hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(cp), &cp);
-}
-
-static void le_scan_enable_req(struct hci_request *req, unsigned long opt)
-{
-        struct hci_cp_le_set_scan_enable cp;
-
-        memset(&cp, 0, sizeof(cp));
-        cp.enable = LE_SCAN_ENABLE;
-        cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
-
-        hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
+                hci_dev_lock(hdev);
+                hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
+                hci_dev_unlock(hdev);
+                return;
+        }
 }
 
-static int hci_do_le_scan(struct hci_dev *hdev, u8 type, u16 interval,
-                          u16 window, int timeout)
+static void le_scan_disable_work_complete(struct hci_dev *hdev, u8 status)
 {
-        long timeo = msecs_to_jiffies(3000);
-        struct le_scan_params param;
+        /* General inquiry access code (GIAC) */
+        u8 lap[3] = { 0x33, 0x8b, 0x9e };
+        struct hci_request req;
+        struct hci_cp_inquiry cp;
         int err;
 
-        BT_DBG("%s", hdev->name);
-
-        if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
-                return -EINPROGRESS;
-
-        param.type = type;
-        param.interval = interval;
-        param.window = window;
-
-        hci_req_lock(hdev);
-
-        err = __hci_req_sync(hdev, le_scan_param_req, (unsigned long) &param,
-                             timeo);
-        if (!err)
-                err = __hci_req_sync(hdev, le_scan_enable_req, 0, timeo);
-
-        hci_req_unlock(hdev);
+        if (status) {
+                BT_ERR("Failed to disable LE scanning: status %d", status);
+                return;
+        }
 
-        if (err < 0)
-                return err;
+        switch (hdev->discovery.type) {
+        case DISCOV_TYPE_LE:
+                hci_dev_lock(hdev);
+                hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
+                hci_dev_unlock(hdev);
+                break;
 
-        queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
-                           timeout);
+        case DISCOV_TYPE_INTERLEAVED:
+                hci_req_init(&req, hdev);
 
-        return 0;
-}
+                memset(&cp, 0, sizeof(cp));
+                memcpy(&cp.lap, lap, sizeof(cp.lap));
+                cp.length = DISCOV_INTERLEAVED_INQUIRY_LEN;
+                hci_req_add(&req, HCI_OP_INQUIRY, sizeof(cp), &cp);
 
-int hci_cancel_le_scan(struct hci_dev *hdev)
-{
-        BT_DBG("%s", hdev->name);
+                hci_dev_lock(hdev);
 
-        if (!test_bit(HCI_LE_SCAN, &hdev->dev_flags))
-                return -EALREADY;
+                hci_inquiry_cache_flush(hdev);
 
-        if (cancel_delayed_work(&hdev->le_scan_disable)) {
-                struct hci_cp_le_set_scan_enable cp;
+                err = hci_req_run(&req, inquiry_complete);
+                if (err) {
+                        BT_ERR("Inquiry request failed: err %d", err);
+                        hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
+                }
 
-                /* Send HCI command to disable LE Scan */
-                memset(&cp, 0, sizeof(cp));
-                hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
+                hci_dev_unlock(hdev);
+                break;
         }
-
-        return 0;
 }
 
 static void le_scan_disable_work(struct work_struct *work)
@@ -2072,46 +2057,20 @@ static void le_scan_disable_work(struct work_struct *work)
         struct hci_dev *hdev = container_of(work, struct hci_dev,
                                             le_scan_disable.work);
         struct hci_cp_le_set_scan_enable cp;
+        struct hci_request req;
+        int err;
 
         BT_DBG("%s", hdev->name);
 
-        memset(&cp, 0, sizeof(cp));
-
-        hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
-}
-
-static void le_scan_work(struct work_struct *work)
-{
-        struct hci_dev *hdev = container_of(work, struct hci_dev, le_scan);
-        struct le_scan_params *param = &hdev->le_scan_params;
+        hci_req_init(&req, hdev);
 
-        BT_DBG("%s", hdev->name);
+        memset(&cp, 0, sizeof(cp));
+        cp.enable = LE_SCAN_DISABLE;
+        hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
 
-        hci_do_le_scan(hdev, param->type, param->interval, param->window,
-                       param->timeout);
-}
-
-int hci_le_scan(struct hci_dev *hdev, u8 type, u16 interval, u16 window,
-                int timeout)
-{
-        struct le_scan_params *param = &hdev->le_scan_params;
-
-        BT_DBG("%s", hdev->name);
-
-        if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags))
-                return -ENOTSUPP;
-
-        if (work_busy(&hdev->le_scan))
-                return -EINPROGRESS;
-
-        param->type = type;
-        param->interval = interval;
-        param->window = window;
-        param->timeout = timeout;
-
-        queue_work(system_long_wq, &hdev->le_scan);
-
-        return 0;
+        err = hci_req_run(&req, le_scan_disable_work_complete);
+        if (err)
+                BT_ERR("Disable LE scanning request failed: err %d", err);
 }
 
 /* Alloc HCI device */
@@ -2148,7 +2107,6 @@ struct hci_dev *hci_alloc_dev(void)
         INIT_WORK(&hdev->cmd_work, hci_cmd_work);
         INIT_WORK(&hdev->tx_work, hci_tx_work);
         INIT_WORK(&hdev->power_on, hci_power_on);
-        INIT_WORK(&hdev->le_scan, le_scan_work);
 
         INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
         INIT_DELAYED_WORK(&hdev->discov_off, hci_discov_off);
@@ -3551,36 +3509,6 @@ static void hci_cmd_work(struct work_struct *work)
         }
 }
 
-int hci_do_inquiry(struct hci_dev *hdev, u8 length)
-{
-        /* General inquiry access code (GIAC) */
-        u8 lap[3] = { 0x33, 0x8b, 0x9e };
-        struct hci_cp_inquiry cp;
-
-        BT_DBG("%s", hdev->name);
-
-        if (test_bit(HCI_INQUIRY, &hdev->flags))
-                return -EINPROGRESS;
-
-        inquiry_cache_flush(hdev);
-
-        memset(&cp, 0, sizeof(cp));
-        memcpy(&cp.lap, lap, sizeof(cp.lap));
-        cp.length  = length;
-
-        return hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
-}
-
-int hci_cancel_inquiry(struct hci_dev *hdev)
-{
-        BT_DBG("%s", hdev->name);
-
-        if (!test_bit(HCI_INQUIRY, &hdev->flags))
-                return -EALREADY;
-
-        return hci_send_cmd(hdev, HCI_OP_INQUIRY_CANCEL, 0, NULL);
-}
-
 u8 bdaddr_to_le(u8 bdaddr_type)
 {
         switch (bdaddr_type) {
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index b93cd2eb5d58..0437200d92f4 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -40,21 +40,13 @@ static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
 
         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 
-        if (status) {
-                hci_dev_lock(hdev);
-                mgmt_stop_discovery_failed(hdev, status);
-                hci_dev_unlock(hdev);
+        if (status)
                 return;
-        }
 
         clear_bit(HCI_INQUIRY, &hdev->flags);
         smp_mb__after_clear_bit(); /* wake_up_bit advises about this barrier */
         wake_up_bit(&hdev->flags, HCI_INQUIRY);
 
-        hci_dev_lock(hdev);
-        hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
-        hci_dev_unlock(hdev);
-
         hci_conn_check_pending(hdev);
 }
 
@@ -937,20 +929,6 @@ static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
         hci_dev_unlock(hdev);
 }
 
-static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
-{
-        __u8 status = *((__u8 *) skb->data);
-
-        BT_DBG("%s status 0x%2.2x", hdev->name, status);
-
-        if (status) {
-                hci_dev_lock(hdev);
-                mgmt_start_discovery_failed(hdev, status);
-                hci_dev_unlock(hdev);
-                return;
-        }
-}
-
 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
                                       struct sk_buff *skb)
 {
@@ -963,41 +941,16 @@ static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
         if (!cp)
                 return;
 
+        if (status)
+                return;
+
         switch (cp->enable) {
         case LE_SCAN_ENABLE:
-                if (status) {
-                        hci_dev_lock(hdev);
-                        mgmt_start_discovery_failed(hdev, status);
-                        hci_dev_unlock(hdev);
-                        return;
-                }
-
                 set_bit(HCI_LE_SCAN, &hdev->dev_flags);
-
-                hci_dev_lock(hdev);
-                hci_discovery_set_state(hdev, DISCOVERY_FINDING);
-                hci_dev_unlock(hdev);
                 break;
 
         case LE_SCAN_DISABLE:
-                if (status) {
-                        hci_dev_lock(hdev);
-                        mgmt_stop_discovery_failed(hdev, status);
-                        hci_dev_unlock(hdev);
-                        return;
-                }
-
                 clear_bit(HCI_LE_SCAN, &hdev->dev_flags);
-
-                if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
-                    hdev->discovery.state == DISCOVERY_FINDING) {
-                        mgmt_interleaved_discovery(hdev);
-                } else {
-                        hci_dev_lock(hdev);
-                        hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
-                        hci_dev_unlock(hdev);
-                }
-
                 break;
 
         default:
@@ -1077,18 +1030,10 @@ static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
 
         if (status) {
                 hci_conn_check_pending(hdev);
-                hci_dev_lock(hdev);
-                if (test_bit(HCI_MGMT, &hdev->dev_flags))
-                        mgmt_start_discovery_failed(hdev, status);
-                hci_dev_unlock(hdev);
                 return;
         }
 
         set_bit(HCI_INQUIRY, &hdev->flags);
-
-        hci_dev_lock(hdev);
-        hci_discovery_set_state(hdev, DISCOVERY_FINDING);
-        hci_dev_unlock(hdev);
 }
 
 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
@@ -2298,10 +2243,6 @@ static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 hci_cc_user_passkey_neg_reply(hdev, skb);
                 break;
 
-        case HCI_OP_LE_SET_SCAN_PARAM:
-                hci_cc_le_set_scan_param(hdev, skb);
-                break;
-
         case HCI_OP_LE_SET_ADV_ENABLE:
                 hci_cc_le_set_adv_enable(hdev, skb);
                 break;
@@ -2670,7 +2611,7 @@ static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
 
         BT_DBG("%s", hdev->name);
 
-        if (!test_bit(HCI_LINK_KEYS, &hdev->dev_flags))
+        if (!test_bit(HCI_MGMT, &hdev->dev_flags))
                 return;
 
         hci_dev_lock(hdev);
@@ -2746,7 +2687,7 @@ static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 hci_conn_drop(conn);
         }
 
-        if (test_bit(HCI_LINK_KEYS, &hdev->dev_flags))
+        if (test_bit(HCI_MGMT, &hdev->dev_flags))
                 hci_add_link_key(hdev, conn, 1, &ev->bdaddr, ev->link_key,
                                  ev->key_type, pin_len);
 
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 940f5acb6694..f13a8da441a8 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -76,25 +76,19 @@ static void hidp_copy_session(struct hidp_session *session, struct hidp_conninfo
         ci->flags = session->flags;
         ci->state = BT_CONNECTED;
 
-        ci->vendor  = 0x0000;
-        ci->product = 0x0000;
-        ci->version = 0x0000;
-
         if (session->input) {
                 ci->vendor  = session->input->id.vendor;
                 ci->product = session->input->id.product;
                 ci->version = session->input->id.version;
                 if (session->input->name)
-                        strncpy(ci->name, session->input->name, 128);
+                        strlcpy(ci->name, session->input->name, 128);
                 else
-                        strncpy(ci->name, "HID Boot Device", 128);
-        }
-
-        if (session->hid) {
+                        strlcpy(ci->name, "HID Boot Device", 128);
+        } else if (session->hid) {
                 ci->vendor  = session->hid->vendor;
                 ci->product = session->hid->product;
                 ci->version = session->hid->version;
-                strncpy(ci->name, session->hid->name, 128);
+                strlcpy(ci->name, session->hid->name, 128);
         }
 }
 
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 4be6a264b475..8c3499bec893 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -504,8 +504,10 @@ void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
                 if (conn->hcon->type == LE_LINK) {
                         /* LE connection */
                         chan->omtu = L2CAP_DEFAULT_MTU;
-                        chan->scid = L2CAP_CID_LE_DATA;
-                        chan->dcid = L2CAP_CID_LE_DATA;
+                        if (chan->dcid == L2CAP_CID_ATT)
+                                chan->scid = L2CAP_CID_ATT;
+                        else
+                                chan->scid = l2cap_alloc_cid(conn);
                 } else {
                         /* Alloc CID for connection-oriented socket */
                         chan->scid = l2cap_alloc_cid(conn);
@@ -543,6 +545,8 @@ void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
 
         l2cap_chan_hold(chan);
 
+        hci_conn_hold(conn->hcon);
+
         list_add(&chan->list, &conn->chan_l);
 }
 
@@ -1338,17 +1342,21 @@ static struct l2cap_chan *l2cap_global_chan_by_scid(int state, u16 cid,
 
 static void l2cap_le_conn_ready(struct l2cap_conn *conn)
 {
-        struct sock *parent, *sk;
+        struct sock *parent;
         struct l2cap_chan *chan, *pchan;
 
         BT_DBG("");
 
         /* Check if we have socket listening on cid */
-        pchan = l2cap_global_chan_by_scid(BT_LISTEN, L2CAP_CID_LE_DATA,
+        pchan = l2cap_global_chan_by_scid(BT_LISTEN, L2CAP_CID_ATT,
                                           conn->src, conn->dst);
         if (!pchan)
                 return;
 
+        /* Client ATT sockets should override the server one */
+        if (__l2cap_get_chan_by_dcid(conn, L2CAP_CID_ATT))
+                return;
+
         parent = pchan->sk;
 
         lock_sock(parent);
@@ -1357,17 +1365,12 @@ static void l2cap_le_conn_ready(struct l2cap_conn *conn)
         if (!chan)
                 goto clean;
 
-        sk = chan->sk;
+        chan->dcid = L2CAP_CID_ATT;
 
-        hci_conn_hold(conn->hcon);
-        conn->hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
+        bacpy(&bt_sk(chan->sk)->src, conn->src);
+        bacpy(&bt_sk(chan->sk)->dst, conn->dst);
 
-        bacpy(&bt_sk(sk)->src, conn->src);
-        bacpy(&bt_sk(sk)->dst, conn->dst);
-
-        l2cap_chan_add(conn, chan);
-
-        l2cap_chan_ready(chan);
+        __l2cap_chan_add(conn, chan);
 
 clean:
         release_sock(parent);
@@ -1380,14 +1383,17 @@ static void l2cap_conn_ready(struct l2cap_conn *conn)
 
         BT_DBG("conn %p", conn);
 
-        if (!hcon->out && hcon->type == LE_LINK)
-                l2cap_le_conn_ready(conn);
-
+        /* For outgoing pairing which doesn't necessarily have an
+         * associated socket (e.g. mgmt_pair_device).
+         */
         if (hcon->out && hcon->type == LE_LINK)
                 smp_conn_security(hcon, hcon->pending_sec_level);
 
         mutex_lock(&conn->chan_lock);
 
+        if (hcon->type == LE_LINK)
+                l2cap_le_conn_ready(conn);
+
         list_for_each_entry(chan, &conn->chan_l, list) {
 
                 l2cap_chan_lock(chan);
@@ -1792,7 +1798,7 @@ int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
 
         auth_type = l2cap_get_auth_type(chan);
 
-        if (chan->dcid == L2CAP_CID_LE_DATA)
+        if (bdaddr_type_is_le(dst_type))
                 hcon = hci_connect(hdev, LE_LINK, dst, dst_type,
                                    chan->sec_level, auth_type);
         else
@@ -1811,16 +1817,10 @@ int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
                 goto done;
         }
 
-        if (hcon->type == LE_LINK) {
-                err = 0;
-
-                if (!list_empty(&conn->chan_l)) {
-                        err = -EBUSY;
-                        hci_conn_drop(hcon);
-                }
-
-                if (err)
-                        goto done;
+        if (cid && __l2cap_get_chan_by_dcid(conn, cid)) {
+                hci_conn_drop(hcon);
+                err = -EBUSY;
+                goto done;
         }
 
         /* Update source addr of the socket */
@@ -1830,6 +1830,9 @@ int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
         l2cap_chan_add(conn, chan);
         l2cap_chan_lock(chan);
 
+        /* l2cap_chan_add takes its own ref so we can drop this one */
+        hci_conn_drop(hcon);
+
         l2cap_state_change(chan, BT_CONNECT);
         __set_chan_timer(chan, sk->sk_sndtimeo);
 
@@ -3751,8 +3754,6 @@ static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn,
 
         sk = chan->sk;
 
-        hci_conn_hold(conn->hcon);
-
         bacpy(&bt_sk(sk)->src, conn->src);
         bacpy(&bt_sk(sk)->dst, conn->dst);
         chan->psm  = psm;
@@ -4333,7 +4334,7 @@ static inline int l2cap_information_rsp(struct l2cap_conn *conn,
         struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
         u16 type, result;
 
-        if (cmd_len != sizeof(*rsp))
+        if (cmd_len < sizeof(*rsp))
                 return -EPROTO;
 
         type   = __le16_to_cpu(rsp->type);
@@ -5292,6 +5293,51 @@ static inline int l2cap_le_sig_cmd(struct l2cap_conn *conn,
         }
 }
 
+static inline void l2cap_le_sig_channel(struct l2cap_conn *conn,
+                                        struct sk_buff *skb)
+{
+        u8 *data = skb->data;
+        int len = skb->len;
+        struct l2cap_cmd_hdr cmd;
+        int err;
+
+        l2cap_raw_recv(conn, skb);
+
+        while (len >= L2CAP_CMD_HDR_SIZE) {
+                u16 cmd_len;
+                memcpy(&cmd, data, L2CAP_CMD_HDR_SIZE);
+                data += L2CAP_CMD_HDR_SIZE;
+                len  -= L2CAP_CMD_HDR_SIZE;
+
+                cmd_len = le16_to_cpu(cmd.len);
+
+                BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd.code, cmd_len,
+                       cmd.ident);
+
+                if (cmd_len > len || !cmd.ident) {
+                        BT_DBG("corrupted command");
+                        break;
+                }
+
+                err = l2cap_le_sig_cmd(conn, &cmd, data);
+                if (err) {
+                        struct l2cap_cmd_rej_unk rej;
+
+                        BT_ERR("Wrong link type (%d)", err);
+
+                        /* FIXME: Map err to a valid reason */
+                        rej.reason = __constant_cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
+                        l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ,
+                                       sizeof(rej), &rej);
+                }
+
+                data += cmd_len;
+                len  -= cmd_len;
+        }
+
+        kfree_skb(skb);
+}
+
 static inline void l2cap_sig_channel(struct l2cap_conn *conn,
                                      struct sk_buff *skb)
 {
@@ -5318,11 +5364,7 @@ static inline void l2cap_sig_channel(struct l2cap_conn *conn,
                         break;
                 }
 
-                if (conn->hcon->type == LE_LINK)
-                        err = l2cap_le_sig_cmd(conn, &cmd, data);
-                else
-                        err = l2cap_bredr_sig_cmd(conn, &cmd, cmd_len, data);
-
+                err = l2cap_bredr_sig_cmd(conn, &cmd, cmd_len, data);
                 if (err) {
                         struct l2cap_cmd_rej_unk rej;
 
@@ -6356,16 +6398,13 @@ static void l2cap_att_channel(struct l2cap_conn *conn,
 {
         struct l2cap_chan *chan;
 
-        chan = l2cap_global_chan_by_scid(0, L2CAP_CID_LE_DATA,
+        chan = l2cap_global_chan_by_scid(BT_CONNECTED, L2CAP_CID_ATT,
                                          conn->src, conn->dst);
         if (!chan)
                 goto drop;
 
         BT_DBG("chan %p, len %d", chan, skb->len);
 
-        if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
-                goto drop;
-
         if (chan->imtu < skb->len)
                 goto drop;
 
@@ -6395,6 +6434,8 @@ static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
 
         switch (cid) {
         case L2CAP_CID_LE_SIGNALING:
+                l2cap_le_sig_channel(conn, skb);
+                break;
         case L2CAP_CID_SIGNALING:
                 l2cap_sig_channel(conn, skb);
                 break;
@@ -6405,7 +6446,7 @@ static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
                 l2cap_conless_channel(conn, psm, skb);
                 break;
 
-        case L2CAP_CID_LE_DATA:
+        case L2CAP_CID_ATT:
                 l2cap_att_channel(conn, skb);
                 break;
 
@@ -6531,7 +6572,7 @@ int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
                         continue;
                 }
 
-                if (chan->scid == L2CAP_CID_LE_DATA) {
+                if (chan->scid == L2CAP_CID_ATT) {
                         if (!status && encrypt) {
                                 chan->sec_level = hcon->sec_level;
                                 l2cap_chan_ready(chan);
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 36fed40c162c..0098af80b213 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -466,7 +466,7 @@ static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
 static bool l2cap_valid_mtu(struct l2cap_chan *chan, u16 mtu)
 {
         switch (chan->scid) {
-        case L2CAP_CID_LE_DATA:
+        case L2CAP_CID_ATT:
                 if (mtu < L2CAP_LE_MIN_MTU)
                         return false;
                 break;
@@ -630,7 +630,7 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
                 conn = chan->conn;
 
                 /*change security for LE channels */
-                if (chan->scid == L2CAP_CID_LE_DATA) {
+                if (chan->scid == L2CAP_CID_ATT) {
                         if (!conn->hcon->out) {
                                 err = -EINVAL;
                                 break;
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index f8ecbc70293d..fedc5399d465 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -102,18 +102,6 @@ static const u16 mgmt_events[] = {
         MGMT_EV_PASSKEY_NOTIFY,
 };
 
-/*
- * These LE scan and inquiry parameters were chosen according to LE General
- * Discovery Procedure specification.
- */
-#define LE_SCAN_WIN                     0x12
-#define LE_SCAN_INT                     0x12
-#define LE_SCAN_TIMEOUT_LE_ONLY         msecs_to_jiffies(10240)
-#define LE_SCAN_TIMEOUT_BREDR_LE        msecs_to_jiffies(5120)
-
-#define INQUIRY_LEN_BREDR               0x08    /* TGAP(100) */
-#define INQUIRY_LEN_BREDR_LE            0x04    /* TGAP(100)/2 */
-
 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 
 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
@@ -1748,8 +1736,6 @@ static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
 
         hci_link_keys_clear(hdev);
 
-        set_bit(HCI_LINK_KEYS, &hdev->dev_flags);
-
         if (cp->debug_keys)
                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
         else
@@ -2633,28 +2619,72 @@ static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
         return err;
 }
 
-int mgmt_interleaved_discovery(struct hci_dev *hdev)
+static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
 {
+        struct pending_cmd *cmd;
+        u8 type;
         int err;
 
-        BT_DBG("%s", hdev->name);
+        hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
 
-        hci_dev_lock(hdev);
+        cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
+        if (!cmd)
+                return -ENOENT;
 
-        err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE);
-        if (err < 0)
-                hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
+        type = hdev->discovery.type;
 
-        hci_dev_unlock(hdev);
+        err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
+                           &type, sizeof(type));
+        mgmt_pending_remove(cmd);
 
         return err;
 }
 
+static void start_discovery_complete(struct hci_dev *hdev, u8 status)
+{
+        BT_DBG("status %d", status);
+
+        if (status) {
+                hci_dev_lock(hdev);
+                mgmt_start_discovery_failed(hdev, status);
+                hci_dev_unlock(hdev);
+                return;
+        }
+
+        hci_dev_lock(hdev);
+        hci_discovery_set_state(hdev, DISCOVERY_FINDING);
+        hci_dev_unlock(hdev);
+
+        switch (hdev->discovery.type) {
+        case DISCOV_TYPE_LE:
+                queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
+                                   DISCOV_LE_TIMEOUT);
+                break;
+
+        case DISCOV_TYPE_INTERLEAVED:
+                queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
+                                   DISCOV_INTERLEAVED_TIMEOUT);
+                break;
+
+        case DISCOV_TYPE_BREDR:
+                break;
+
+        default:
+                BT_ERR("Invalid discovery type %d", hdev->discovery.type);
+        }
+}
+
 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
                            void *data, u16 len)
 {
         struct mgmt_cp_start_discovery *cp = data;
         struct pending_cmd *cmd;
+        struct hci_cp_le_set_scan_param param_cp;
+        struct hci_cp_le_set_scan_enable enable_cp;
+        struct hci_cp_inquiry inq_cp;
+        struct hci_request req;
+        /* General inquiry access code (GIAC) */
+        u8 lap[3] = { 0x33, 0x8b, 0x9e };
         int err;
 
         BT_DBG("%s", hdev->name);
@@ -2687,6 +2717,8 @@ static int start_discovery(struct sock *sk, struct hci_dev *hdev,
 
         hdev->discovery.type = cp->type;
 
+        hci_req_init(&req, hdev);
+
         switch (hdev->discovery.type) {
         case DISCOV_TYPE_BREDR:
                 if (!lmp_bredr_capable(hdev)) {
@@ -2696,10 +2728,23 @@ static int start_discovery(struct sock *sk, struct hci_dev *hdev,
                         goto failed;
                 }
 
-                err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
+                if (test_bit(HCI_INQUIRY, &hdev->flags)) {
+                        err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
+                                         MGMT_STATUS_BUSY);
+                        mgmt_pending_remove(cmd);
+                        goto failed;
+                }
+
+                hci_inquiry_cache_flush(hdev);
+
+                memset(&inq_cp, 0, sizeof(inq_cp));
+                memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
+                inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
+                hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
                 break;
 
         case DISCOV_TYPE_LE:
+        case DISCOV_TYPE_INTERLEAVED:
                 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
                                          MGMT_STATUS_NOT_SUPPORTED);
@@ -2707,20 +2752,40 @@ static int start_discovery(struct sock *sk, struct hci_dev *hdev,
                         goto failed;
                 }
 
-                err = hci_le_scan(hdev, LE_SCAN_ACTIVE, LE_SCAN_INT,
-                                  LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
-                break;
-
-        case DISCOV_TYPE_INTERLEAVED:
-                if (!lmp_host_le_capable(hdev) || !lmp_bredr_capable(hdev)) {
+                if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
+                    !lmp_bredr_capable(hdev)) {
                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
                                          MGMT_STATUS_NOT_SUPPORTED);
                         mgmt_pending_remove(cmd);
                         goto failed;
                 }
 
-                err = hci_le_scan(hdev, LE_SCAN_ACTIVE, LE_SCAN_INT,
-                                  LE_SCAN_WIN, LE_SCAN_TIMEOUT_BREDR_LE);
+                if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags)) {
+                        err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
+                                         MGMT_STATUS_REJECTED);
+                        mgmt_pending_remove(cmd);
+                        goto failed;
+                }
+
+                if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
+                        err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
+                                         MGMT_STATUS_BUSY);
+                        mgmt_pending_remove(cmd);
+                        goto failed;
+                }
+
+                memset(&param_cp, 0, sizeof(param_cp));
+                param_cp.type = LE_SCAN_ACTIVE;
+                param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
+                param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
+                hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
+                            &param_cp);
+
+                memset(&enable_cp, 0, sizeof(enable_cp));
+                enable_cp.enable = LE_SCAN_ENABLE;
+                enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
+                hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
+                            &enable_cp);
                 break;
 
         default:
@@ -2730,6 +2795,7 @@ static int start_discovery(struct sock *sk, struct hci_dev *hdev,
                 goto failed;
         }
 
+        err = hci_req_run(&req, start_discovery_complete);
         if (err < 0)
                 mgmt_pending_remove(cmd);
         else
@@ -2740,6 +2806,39 @@ failed:
         return err;
 }
 
+static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
+{
+        struct pending_cmd *cmd;
+        int err;
+
+        cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
+        if (!cmd)
+                return -ENOENT;
+
+        err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
+                           &hdev->discovery.type, sizeof(hdev->discovery.type));
+        mgmt_pending_remove(cmd);
+
+        return err;
+}
+
+static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
+{
+        BT_DBG("status %d", status);
+
+        hci_dev_lock(hdev);
+
+        if (status) {
+                mgmt_stop_discovery_failed(hdev, status);
+                goto unlock;
+        }
+
+        hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
+
+unlock:
+        hci_dev_unlock(hdev);
+}
+
 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
                           u16 len)
 {
@@ -2747,6 +2846,8 @@ static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
         struct pending_cmd *cmd;
         struct hci_cp_remote_name_req_cancel cp;
         struct inquiry_entry *e;
+        struct hci_request req;
+        struct hci_cp_le_set_scan_enable enable_cp;
         int err;
 
         BT_DBG("%s", hdev->name);
@@ -2773,12 +2874,20 @@ static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
                 goto unlock;
         }
 
+        hci_req_init(&req, hdev);
+
         switch (hdev->discovery.state) {
         case DISCOVERY_FINDING:
-                if (test_bit(HCI_INQUIRY, &hdev->flags))
-                        err = hci_cancel_inquiry(hdev);
-                else
-                        err = hci_cancel_le_scan(hdev);
+                if (test_bit(HCI_INQUIRY, &hdev->flags)) {
+                        hci_req_add(&req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
+                } else {
+                        cancel_delayed_work(&hdev->le_scan_disable);
+
+                        memset(&enable_cp, 0, sizeof(enable_cp));
+                        enable_cp.enable = LE_SCAN_DISABLE;
+                        hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE,
+                                    sizeof(enable_cp), &enable_cp);
+                }
 
                 break;
 
@@ -2796,16 +2905,22 @@ static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
                 }
 
                 bacpy(&cp.bdaddr, &e->data.bdaddr);
-                err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL,
-                                   sizeof(cp), &cp);
+                hci_req_add(&req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
+                            &cp);
 
                 break;
 
         default:
                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
-                err = -EFAULT;
+
+                mgmt_pending_remove(cmd);
+                err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
+                                   MGMT_STATUS_FAILED, &mgmt_cp->type,
+                                   sizeof(mgmt_cp->type));
+                goto unlock;
         }
 
+        err = hci_req_run(&req, stop_discovery_complete);
         if (err < 0)
                 mgmt_pending_remove(cmd);
         else
@@ -4063,6 +4178,9 @@ int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
         struct mgmt_ev_device_found *ev = (void *) buf;
         size_t ev_size;
 
+        if (!hci_discovery_active(hdev))
+                return -EPERM;
+
         /* Leave 5 bytes for a potential CoD field */
         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
                 return -EINVAL;
@@ -4114,43 +4232,6 @@ int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
                           sizeof(*ev) + eir_len, NULL);
 }
 
-int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
-{
-        struct pending_cmd *cmd;
-        u8 type;
-        int err;
-
-        hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
-
-        cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
-        if (!cmd)
-                return -ENOENT;
-
-        type = hdev->discovery.type;
-
-        err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
-                           &type, sizeof(type));
-        mgmt_pending_remove(cmd);
-
-        return err;
-}
-
-int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
-{
-        struct pending_cmd *cmd;
-        int err;
-
-        cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
-        if (!cmd)
-                return -ENOENT;
-
-        err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
-                           &hdev->discovery.type, sizeof(hdev->discovery.type));
-        mgmt_pending_remove(cmd);
-
-        return err;
-}
-
 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
 {
         struct mgmt_ev_discovering ev;
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 082f270b5912..8184d121ff09 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -2827,7 +2827,8 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
                     !rcu_access_pointer(sdata->bss->beacon))
                         need_offchan = true;
                 if (!ieee80211_is_action(mgmt->frame_control) ||
-                    mgmt->u.action.category == WLAN_CATEGORY_PUBLIC)
+                    mgmt->u.action.category == WLAN_CATEGORY_PUBLIC ||
+                    mgmt->u.action.category == WLAN_CATEGORY_SELF_PROTECTED)
                         break;
                 rcu_read_lock();
                 sta = sta_info_get(sdata, mgmt->da);
@@ -2930,19 +2931,8 @@ static void ieee80211_mgmt_frame_register(struct wiphy *wiphy,
                                           u16 frame_type, bool reg)
 {
         struct ieee80211_local *local = wiphy_priv(wiphy);
-        struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
 
         switch (frame_type) {
-        case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_AUTH:
-                if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
-                        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
-
-                        if (reg)
-                                ifibss->auth_frame_registrations++;
-                        else
-                                ifibss->auth_frame_registrations--;
-                }
-                break;
         case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_PROBE_REQ:
                 if (reg)
                         local->probe_req_reg++;
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index 75dff338f581..f83534f6a2ee 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -281,13 +281,14 @@ void ieee80211_ba_session_work(struct work_struct *work)
                                 sta, tid, WLAN_BACK_RECIPIENT,
                                 WLAN_REASON_UNSPECIFIED, true);
 
+                spin_lock_bh(&sta->lock);
+
                 tid_tx = sta->ampdu_mlme.tid_start_tx[tid];
                 if (tid_tx) {
                         /*
                          * Assign it over to the normal tid_tx array
                          * where it "goes live".
                          */
-                        spin_lock_bh(&sta->lock);
 
                         sta->ampdu_mlme.tid_start_tx[tid] = NULL;
                         /* could there be a race? */
@@ -300,6 +301,7 @@ void ieee80211_ba_session_work(struct work_struct *work)
                         ieee80211_tx_ba_session_handle_start(sta, tid);
                         continue;
                 }
+                spin_unlock_bh(&sta->lock);
 
                 tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
                 if (tid_tx && test_and_clear_bit(HT_AGG_STATE_WANT_STOP,
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index caa4b4f7f6e4..ea7b9c2c7e66 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -81,7 +81,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
 
         sdata->drop_unencrypted = capability & WLAN_CAPABILITY_PRIVACY ? 1 : 0;
 
-        cfg80211_chandef_create(&chandef, chan, ifibss->channel_type);
+        chandef = ifibss->chandef;
         if (!cfg80211_reg_can_beacon(local->hw.wiphy, &chandef)) {
                 chandef.width = NL80211_CHAN_WIDTH_20;
                 chandef.center_freq1 = chan->center_freq;
@@ -176,6 +176,8 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
 
         /* add HT capability and information IEs */
         if (chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
+            chandef.width != NL80211_CHAN_WIDTH_5 &&
+            chandef.width != NL80211_CHAN_WIDTH_10 &&
             sband->ht_cap.ht_supported) {
                 pos = ieee80211_ie_build_ht_cap(pos, &sband->ht_cap,
                                                 sband->ht_cap.cap);
@@ -298,8 +300,7 @@ static void ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
                                   tsf, false);
 }
 
-static struct sta_info *ieee80211_ibss_finish_sta(struct sta_info *sta,
-                                                  bool auth)
+static struct sta_info *ieee80211_ibss_finish_sta(struct sta_info *sta)
         __acquires(RCU)
 {
         struct ieee80211_sub_if_data *sdata = sta->sdata;
@@ -321,20 +322,12 @@ static struct sta_info *ieee80211_ibss_finish_sta(struct sta_info *sta,
         /* If it fails, maybe we raced another insertion? */
         if (sta_info_insert_rcu(sta))
                 return sta_info_get(sdata, addr);
-        if (auth && !sdata->u.ibss.auth_frame_registrations) {
-                ibss_dbg(sdata,
-                         "TX Auth SA=%pM DA=%pM BSSID=%pM (auth_transaction=1)\n",
-                         sdata->vif.addr, addr, sdata->u.ibss.bssid);
-                ieee80211_send_auth(sdata, 1, WLAN_AUTH_OPEN, 0, NULL, 0,
-                                    addr, sdata->u.ibss.bssid, NULL, 0, 0, 0);
-        }
         return sta;
 }
 
 static struct sta_info *
-ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
-                       const u8 *bssid, const u8 *addr,
-                       u32 supp_rates, bool auth)
+ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata, const u8 *bssid,
+                       const u8 *addr, u32 supp_rates)
         __acquires(RCU)
 {
         struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
@@ -385,7 +378,7 @@ ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
         sta->sta.supp_rates[band] = supp_rates |
                         ieee80211_mandatory_rates(sband);
 
-        return ieee80211_ibss_finish_sta(sta, auth);
+        return ieee80211_ibss_finish_sta(sta);
 }
 
 static void ieee80211_rx_mgmt_deauth_ibss(struct ieee80211_sub_if_data *sdata,
@@ -407,8 +400,6 @@ static void ieee80211_rx_mgmt_auth_ibss(struct ieee80211_sub_if_data *sdata,
                                         size_t len)
 {
         u16 auth_alg, auth_transaction;
-        struct sta_info *sta;
-        u8 deauth_frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
 
         sdata_assert_lock(sdata);
 
@@ -425,22 +416,6 @@ static void ieee80211_rx_mgmt_auth_ibss(struct ieee80211_sub_if_data *sdata,
         if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1)
                 return;
 
-        sta_info_destroy_addr(sdata, mgmt->sa);
-        sta = ieee80211_ibss_add_sta(sdata, mgmt->bssid, mgmt->sa, 0, false);
-        rcu_read_unlock();
-
-        /*
-         * if we have any problem in allocating the new station, we reply with a
-         * DEAUTH frame to tell the other end that we had a problem
-         */
-        if (!sta) {
-                ieee80211_send_deauth_disassoc(sdata, sdata->u.ibss.bssid,
-                                               IEEE80211_STYPE_DEAUTH,
-                                               WLAN_REASON_UNSPECIFIED, true,
-                                               deauth_frame_buf);
-                return;
-        }
-
         /*
          * IEEE 802.11 standard does not require authentication in IBSS
          * networks and most implementations do not seem to use it.
@@ -506,7 +481,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                         } else {
                                 rcu_read_unlock();
                                 sta = ieee80211_ibss_add_sta(sdata, mgmt->bssid,
-                                                mgmt->sa, supp_rates, true);
+                                                mgmt->sa, supp_rates);
                         }
                 }
 
@@ -514,7 +489,9 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                         set_sta_flag(sta, WLAN_STA_WME);
 
                 if (sta && elems->ht_operation && elems->ht_cap_elem &&
-                    sdata->u.ibss.channel_type != NL80211_CHAN_NO_HT) {
+                    sdata->u.ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
+                    sdata->u.ibss.chandef.width != NL80211_CHAN_WIDTH_5 &&
+                    sdata->u.ibss.chandef.width != NL80211_CHAN_WIDTH_10) {
                         /* we both use HT */
                         struct ieee80211_ht_cap htcap_ie;
                         struct cfg80211_chan_def chandef;
@@ -529,8 +506,8 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                          * fall back to HT20 if we don't use or use
                          * the other extension channel
                          */
-                        if (cfg80211_get_chandef_type(&chandef) !=
-                                                sdata->u.ibss.channel_type)
+                        if (chandef.center_freq1 !=
+                            sdata->u.ibss.chandef.center_freq1)
                                 htcap_ie.cap_info &=
                                         cpu_to_le16(~IEEE80211_HT_CAP_SUP_WIDTH_20_40);
 
@@ -569,7 +546,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
 
         /* different channel */
         if (sdata->u.ibss.fixed_channel &&
-            sdata->u.ibss.channel != cbss->channel)
+            sdata->u.ibss.chandef.chan != cbss->channel)
                 goto put_bss;
 
         /* different SSID */
@@ -610,7 +587,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                 ieee80211_sta_join_ibss(sdata, bss);
                 supp_rates = ieee80211_sta_get_rates(local, elems, band, NULL);
                 ieee80211_ibss_add_sta(sdata, mgmt->bssid, mgmt->sa,
-                                       supp_rates, true);
+                                       supp_rates);
                 rcu_read_unlock();
         }
 
@@ -759,7 +736,7 @@ static void ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
                 sdata->drop_unencrypted = 0;
 
         __ieee80211_sta_join_ibss(sdata, bssid, sdata->vif.bss_conf.beacon_int,
-                                  ifibss->channel, ifibss->basic_rates,
+                                  ifibss->chandef.chan, ifibss->basic_rates,
                                   capability, 0, true);
 }
 
@@ -791,7 +768,7 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
         if (ifibss->fixed_bssid)
                 bssid = ifibss->bssid;
         if (ifibss->fixed_channel)
-                chan = ifibss->channel;
+                chan = ifibss->chandef.chan;
         if (!is_zero_ether_addr(ifibss->bssid))
                 bssid = ifibss->bssid;
         cbss = cfg80211_get_bss(local->hw.wiphy, chan, bssid,
@@ -982,7 +959,7 @@ void ieee80211_ibss_work(struct ieee80211_sub_if_data *sdata)
                 list_del(&sta->list);
                 spin_unlock_bh(&ifibss->incomplete_lock);
 
-                ieee80211_ibss_finish_sta(sta, true);
+                ieee80211_ibss_finish_sta(sta);
                 rcu_read_unlock();
                 spin_lock_bh(&ifibss->incomplete_lock);
         }
@@ -1058,9 +1035,7 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
 
         sdata->vif.bss_conf.beacon_int = params->beacon_interval;
 
-        sdata->u.ibss.channel = params->chandef.chan;
-        sdata->u.ibss.channel_type =
-                cfg80211_get_chandef_type(&params->chandef);
+        sdata->u.ibss.chandef = params->chandef;
         sdata->u.ibss.fixed_channel = params->channel_fixed;
 
         if (params->ie) {
@@ -1119,7 +1094,7 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
                 if (ifibss->privacy)
                         capability |= WLAN_CAPABILITY_PRIVACY;
 
-                cbss = cfg80211_get_bss(local->hw.wiphy, ifibss->channel,
+                cbss = cfg80211_get_bss(local->hw.wiphy, ifibss->chandef.chan,
                                         ifibss->bssid, ifibss->ssid,
                                         ifibss->ssid_len, WLAN_CAPABILITY_IBSS |
                                         WLAN_CAPABILITY_PRIVACY,
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index f97cd9d9105f..8412a303993a 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -94,6 +94,7 @@ struct ieee80211_bss {
 #define IEEE80211_MAX_SUPP_RATES 32
         u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
         size_t supp_rates_len;
+        struct ieee80211_rate *beacon_rate;
 
         /*
          * During association, we save an ERP value from a probe response so
@@ -497,14 +498,12 @@ struct ieee80211_if_ibss {
         bool privacy;
 
         bool control_port;
-        unsigned int auth_frame_registrations;
 
         u8 bssid[ETH_ALEN] __aligned(2);
         u8 ssid[IEEE80211_MAX_SSID_LEN];
         u8 ssid_len, ie_len;
         u8 *ie;
-        struct ieee80211_channel *channel;
-        enum nl80211_channel_type channel_type;
+        struct cfg80211_chan_def chandef;
 
         unsigned long ibss_join_req;
         /* probe response/beacon for IBSS */
@@ -543,6 +542,7 @@ struct ieee80211_if_mesh {
         struct timer_list mesh_path_root_timer;
 
         unsigned long wrkq_flags;
+        unsigned long mbss_changed;
 
         u8 mesh_id[IEEE80211_MAX_MESH_ID_LEN];
         size_t mesh_id_len;
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 6c33af482df4..447f41bbe744 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -161,11 +161,8 @@ void mesh_sta_cleanup(struct sta_info *sta)
                 del_timer_sync(&sta->plink_timer);
         }
 
-        if (changed) {
-                sdata_lock(sdata);
+        if (changed)
                 ieee80211_mbss_info_change_notify(sdata, changed);
-                sdata_unlock(sdata);
-        }
 }
 
 int mesh_rmc_init(struct ieee80211_sub_if_data *sdata)
@@ -419,7 +416,9 @@ int mesh_add_ht_cap_ie(struct ieee80211_sub_if_data *sdata,
 
         sband = local->hw.wiphy->bands[band];
         if (!sband->ht_cap.ht_supported ||
-            sdata->vif.bss_conf.chandef.width == NL80211_CHAN_WIDTH_20_NOHT)
+            sdata->vif.bss_conf.chandef.width == NL80211_CHAN_WIDTH_20_NOHT ||
+            sdata->vif.bss_conf.chandef.width == NL80211_CHAN_WIDTH_5 ||
+            sdata->vif.bss_conf.chandef.width == NL80211_CHAN_WIDTH_10)
                 return 0;
 
         if (skb_tailroom(skb) < 2 + sizeof(struct ieee80211_ht_cap))
@@ -719,14 +718,18 @@ ieee80211_mesh_rebuild_beacon(struct ieee80211_sub_if_data *sdata)
 void ieee80211_mbss_info_change_notify(struct ieee80211_sub_if_data *sdata,
                                        u32 changed)
 {
-        if (sdata->vif.bss_conf.enable_beacon &&
-            (changed & (BSS_CHANGED_BEACON |
-                        BSS_CHANGED_HT |
-                        BSS_CHANGED_BASIC_RATES |
-                        BSS_CHANGED_BEACON_INT)))
-                if (ieee80211_mesh_rebuild_beacon(sdata))
-                        return;
-        ieee80211_bss_info_change_notify(sdata, changed);
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        unsigned long bits = changed;
+        u32 bit;
+
+        if (!bits)
+                return;
+
+        /* if we race with running work, worst case this work becomes a noop */
+        for_each_set_bit(bit, &bits, sizeof(changed) * BITS_PER_BYTE)
+                set_bit(bit, &ifmsh->mbss_changed);
+        set_bit(MESH_WORK_MBSS_CHANGED, &ifmsh->wrkq_flags);
+        ieee80211_queue_work(&sdata->local->hw, &sdata->work);
 }
 
 int ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
@@ -799,6 +802,10 @@ void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
         del_timer_sync(&sdata->u.mesh.mesh_path_root_timer);
         del_timer_sync(&sdata->u.mesh.mesh_path_timer);
 
+        /* clear any mesh work (for next join) we may have accrued */
+        ifmsh->wrkq_flags = 0;
+        ifmsh->mbss_changed = 0;
+
         local->fif_other_bss--;
         atomic_dec(&local->iff_allmultis);
         ieee80211_configure_filter(local);
@@ -965,6 +972,28 @@ out:
         sdata_unlock(sdata);
 }
 
+static void mesh_bss_info_changed(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        u32 bit, changed = 0;
+
+        for_each_set_bit(bit, &ifmsh->mbss_changed,
+                         sizeof(changed) * BITS_PER_BYTE) {
+                clear_bit(bit, &ifmsh->mbss_changed);
+                changed |= BIT(bit);
+        }
+
+        if (sdata->vif.bss_conf.enable_beacon &&
+            (changed & (BSS_CHANGED_BEACON |
+                        BSS_CHANGED_HT |
+                        BSS_CHANGED_BASIC_RATES |
+                        BSS_CHANGED_BEACON_INT)))
+                if (ieee80211_mesh_rebuild_beacon(sdata))
+                        return;
+
+        ieee80211_bss_info_change_notify(sdata, changed);
+}
+
 void ieee80211_mesh_work(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
@@ -995,6 +1024,8 @@ void ieee80211_mesh_work(struct ieee80211_sub_if_data *sdata)
         if (test_and_clear_bit(MESH_WORK_DRIFT_ADJUST, &ifmsh->wrkq_flags))
                 mesh_sync_adjust_tbtt(sdata);
 
+        if (test_and_clear_bit(MESH_WORK_MBSS_CHANGED, &ifmsh->wrkq_flags))
+                mesh_bss_info_changed(sdata);
 out:
         sdata_unlock(sdata);
 }
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index 01a28bca6e9b..2bc7fd2f787d 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -58,6 +58,7 @@ enum mesh_path_flags {
  * @MESH_WORK_ROOT: the mesh root station needs to send a frame
  * @MESH_WORK_DRIFT_ADJUST: time to compensate for clock drift relative to other
  * mesh nodes
+ * @MESH_WORK_MBSS_CHANGED: rebuild beacon and notify driver of BSS changes
  */
 enum mesh_deferred_task_flags {
         MESH_WORK_HOUSEKEEPING,
@@ -65,6 +66,7 @@ enum mesh_deferred_task_flags {
         MESH_WORK_GROW_MPP_TABLE,
         MESH_WORK_ROOT,
         MESH_WORK_DRIFT_ADJUST,
+        MESH_WORK_MBSS_CHANGED,
 };
 
 /**
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 09bebed99416..02c05fa15c20 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -154,8 +154,14 @@ static u32 mesh_set_ht_prot_mode(struct ieee80211_sub_if_data *sdata)
         u16 ht_opmode;
         bool non_ht_sta = false, ht20_sta = false;
 
-        if (sdata->vif.bss_conf.chandef.width == NL80211_CHAN_WIDTH_20_NOHT)
+        switch (sdata->vif.bss_conf.chandef.width) {
+        case NL80211_CHAN_WIDTH_20_NOHT:
+        case NL80211_CHAN_WIDTH_5:
+        case NL80211_CHAN_WIDTH_10:
                 return 0;
+        default:
+                break;
+        }
 
         rcu_read_lock();
         list_for_each_entry_rcu(sta, &local->sta_list, list) {
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 9e49f557fa5c..ae31968d42d3 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -190,6 +190,12 @@ static u32 chandef_downgrade(struct cfg80211_chan_def *c)
                 c->width = NL80211_CHAN_WIDTH_20_NOHT;
                 ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
                 break;
+        case NL80211_CHAN_WIDTH_5:
+        case NL80211_CHAN_WIDTH_10:
+                WARN_ON_ONCE(1);
+                /* keep c->width */
+                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
+                break;
         }
 
         WARN_ON_ONCE(!cfg80211_chandef_valid(c));
@@ -1779,8 +1785,10 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
                  * probably just won't work at all.
                  */
                 bss_conf->dtim_period = sdata->u.mgd.dtim_period ?: 1;
+                bss_conf->beacon_rate = bss->beacon_rate;
                 bss_info_changed |= BSS_CHANGED_BEACON_INFO;
         } else {
+                bss_conf->beacon_rate = NULL;
                 bss_conf->dtim_period = 0;
         }
 
@@ -1903,6 +1911,8 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         del_timer_sync(&sdata->u.mgd.chswitch_timer);
 
         sdata->vif.bss_conf.dtim_period = 0;
+        sdata->vif.bss_conf.beacon_rate = NULL;
+
         ifmgd->have_beacon = false;
 
         ifmgd->flags = 0;
@@ -2785,8 +2795,7 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
                 if (!ieee80211_assoc_success(sdata, bss, mgmt, len)) {
                         /* oops -- internal error -- send timeout for now */
                         ieee80211_destroy_assoc_data(sdata, false);
-                        cfg80211_put_bss(sdata->local->hw.wiphy, bss);
-                        cfg80211_assoc_timeout(sdata->dev, mgmt->bssid);
+                        cfg80211_assoc_timeout(sdata->dev, bss);
                         return;
                 }
                 sdata_info(sdata, "associated\n");
@@ -2827,8 +2836,10 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
 
         bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, elems,
                                         channel);
-        if (bss)
+        if (bss) {
                 ieee80211_rx_bss_put(local, bss);
+                sdata->vif.bss_conf.beacon_rate = bss->beacon_rate;
+        }
 
         if (!sdata->u.mgd.associated ||
             !ether_addr_equal(mgmt->bssid, sdata->u.mgd.associated->bssid))
@@ -3501,13 +3512,10 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
             time_after(jiffies, ifmgd->assoc_data->timeout)) {
                 if ((ifmgd->assoc_data->need_beacon && !ifmgd->have_beacon) ||
                     ieee80211_do_assoc(sdata)) {
-                        u8 bssid[ETH_ALEN];
-
-                        memcpy(bssid, ifmgd->assoc_data->bss->bssid, ETH_ALEN);
+                        struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
 
                         ieee80211_destroy_assoc_data(sdata, false);
-
-                        cfg80211_assoc_timeout(sdata->dev, bssid);
+                        cfg80211_assoc_timeout(sdata->dev, bss);
                 }
         } else if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started)
                 run_again(sdata, ifmgd->assoc_data->timeout);
@@ -3838,6 +3846,12 @@ static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
          */
         ret = ieee80211_vif_use_channel(sdata, &chandef,
                                         IEEE80211_CHANCTX_SHARED);
+
+        /* don't downgrade for 5 and 10 MHz channels, though. */
+        if (chandef.width == NL80211_CHAN_WIDTH_5 ||
+            chandef.width == NL80211_CHAN_WIDTH_10)
+                return ret;
+
         while (ret && chandef.width != NL80211_CHAN_WIDTH_20_NOHT) {
                 ifmgd->flags |= chandef_downgrade(&chandef);
                 ret = ieee80211_vif_use_channel(sdata, &chandef,
@@ -4427,8 +4441,11 @@ void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata)
         cancel_work_sync(&ifmgd->chswitch_work);
 
         sdata_lock(sdata);
-        if (ifmgd->assoc_data)
+        if (ifmgd->assoc_data) {
+                struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
                 ieee80211_destroy_assoc_data(sdata, false);
+                cfg80211_assoc_timeout(sdata->dev, bss);
+        }
         if (ifmgd->auth_data)
                 ieee80211_destroy_auth_data(sdata, false);
         del_timer_sync(&ifmgd->timer);
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index a02bef35b134..30d58d2d13e2 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -397,8 +397,14 @@ static void rate_idx_match_mask(struct ieee80211_tx_rate *rate,
                         return;
 
                 /* if HT BSS, and we handle a data frame, also try HT rates */
-                if (chan_width == NL80211_CHAN_WIDTH_20_NOHT)
+                switch (chan_width) {
+                case NL80211_CHAN_WIDTH_20_NOHT:
+                case NL80211_CHAN_WIDTH_5:
+                case NL80211_CHAN_WIDTH_10:
                         return;
+                default:
+                        break;
+                }
 
                 alt_rate.idx = 0;
                 /* keep protection flags */
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 99b103921a4b..1b122a79b0d8 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -140,6 +140,15 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
                         bss->valid_data |= IEEE80211_BSS_VALID_WMM;
         }
 
+        if (beacon) {
+                struct ieee80211_supported_band *sband =
+                        local->hw.wiphy->bands[rx_status->band];
+                if (!(rx_status->flag & RX_FLAG_HT) &&
+                    !(rx_status->flag & RX_FLAG_VHT))
+                        bss->beacon_rate =
+                                &sband->bitrates[rx_status->rate_idx];
+        }
+
         return bss;
 }
 
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index b4297982d34a..aeb967a0aeed 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -149,6 +149,7 @@ static void cleanup_single_sta(struct sta_info *sta)
          * directly by station destruction.
          */
         for (i = 0; i < IEEE80211_NUM_TIDS; i++) {
+                kfree(sta->ampdu_mlme.tid_start_tx[i]);
                 tid_tx = rcu_dereference_raw(sta->ampdu_mlme.tid_tx[i]);
                 if (!tid_tx)
                         continue;
@@ -346,6 +347,7 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
         if (ieee80211_vif_is_mesh(&sdata->vif) &&
             !sdata->u.mesh.user_mpm)
                 init_timer(&sta->plink_timer);
+        sta->nonpeer_pm = NL80211_MESH_POWER_ACTIVE;
 #endif
 
         memcpy(sta->sta.addr, addr, ETH_ALEN);
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index bd12fc54266c..4208dbd5861f 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -203,6 +203,7 @@ struct tid_ampdu_rx {
  *      driver requested to close until the work for it runs
  * @mtx: mutex to protect all TX data (except non-NULL assignments
  *      to tid_tx[idx], which are protected by the sta spinlock)
+ *      tid_start_tx is also protected by sta->lock.
  */
 struct sta_ampdu_mlme {
         struct mutex mtx;
diff --git a/net/mac80211/vht.c b/net/mac80211/vht.c
index 171344d4eb7c..97c289414e32 100644
--- a/net/mac80211/vht.c
+++ b/net/mac80211/vht.c
@@ -396,7 +396,7 @@ void ieee80211_vht_handle_opmode(struct ieee80211_sub_if_data *sdata,
         new_bw = ieee80211_sta_cur_vht_bw(sta);
         if (new_bw != sta->sta.bandwidth) {
                 sta->sta.bandwidth = new_bw;
-                changed |= IEEE80211_RC_NSS_CHANGED;
+                changed |= IEEE80211_RC_BW_CHANGED;
         }
 
  change:
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index fd556ac05fdb..50f6195c8b70 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -54,6 +54,8 @@ bool cfg80211_chandef_valid(const struct cfg80211_chan_def *chandef)
         control_freq = chandef->chan->center_freq;
 
         switch (chandef->width) {
+        case NL80211_CHAN_WIDTH_5:
+        case NL80211_CHAN_WIDTH_10:
         case NL80211_CHAN_WIDTH_20:
         case NL80211_CHAN_WIDTH_20_NOHT:
                 if (chandef->center_freq1 != control_freq)
@@ -152,6 +154,12 @@ static int cfg80211_chandef_get_width(const struct cfg80211_chan_def *c)
         int width;
 
         switch (c->width) {
+        case NL80211_CHAN_WIDTH_5:
+                width = 5;
+                break;
+        case NL80211_CHAN_WIDTH_10:
+                width = 10;
+                break;
         case NL80211_CHAN_WIDTH_20:
         case NL80211_CHAN_WIDTH_20_NOHT:
                 width = 20;
@@ -194,6 +202,16 @@ cfg80211_chandef_compatible(const struct cfg80211_chan_def *c1,
         if (c1->width == c2->width)
                 return NULL;
 
+        /*
+         * can't be compatible if one of them is 5 or 10 MHz,
+         * but they don't have the same width.
+         */
+        if (c1->width == NL80211_CHAN_WIDTH_5 ||
+            c1->width == NL80211_CHAN_WIDTH_10 ||
+            c2->width == NL80211_CHAN_WIDTH_5 ||
+            c2->width == NL80211_CHAN_WIDTH_10)
+                return NULL;
+
         if (c1->width == NL80211_CHAN_WIDTH_20_NOHT ||
             c1->width == NL80211_CHAN_WIDTH_20)
                 return c2;
@@ -264,11 +282,17 @@ static int cfg80211_get_chans_dfs_required(struct wiphy *wiphy,
                                             u32 bandwidth)
 {
         struct ieee80211_channel *c;
-        u32 freq;
+        u32 freq, start_freq, end_freq;
+
+        if (bandwidth <= 20) {
+                start_freq = center_freq;
+                end_freq = center_freq;
+        } else {
+                start_freq = center_freq - bandwidth/2 + 10;
+                end_freq = center_freq + bandwidth/2 - 10;
+        }
 
-        for (freq = center_freq - bandwidth/2 + 10;
-             freq <= center_freq + bandwidth/2 - 10;
-             freq += 20) {
+        for (freq = start_freq; freq <= end_freq; freq += 20) {
                 c = ieee80211_get_channel(wiphy, freq);
                 if (!c)
                         return -EINVAL;
@@ -310,11 +334,17 @@ static bool cfg80211_secondary_chans_ok(struct wiphy *wiphy,
                                         u32 prohibited_flags)
 {
         struct ieee80211_channel *c;
-        u32 freq;
+        u32 freq, start_freq, end_freq;
+
+        if (bandwidth <= 20) {
+                start_freq = center_freq;
+                end_freq = center_freq;
+        } else {
+                start_freq = center_freq - bandwidth/2 + 10;
+                end_freq = center_freq + bandwidth/2 - 10;
+        }
 
-        for (freq = center_freq - bandwidth/2 + 10;
-             freq <= center_freq + bandwidth/2 - 10;
-             freq += 20) {
+        for (freq = start_freq; freq <= end_freq; freq += 20) {
                 c = ieee80211_get_channel(wiphy, freq);
                 if (!c)
                         return false;
@@ -349,6 +379,12 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy,
         control_freq = chandef->chan->center_freq;
 
         switch (chandef->width) {
+        case NL80211_CHAN_WIDTH_5:
+                width = 5;
+                break;
+        case NL80211_CHAN_WIDTH_10:
+                width = 10;
+                break;
         case NL80211_CHAN_WIDTH_20:
                 if (!ht_cap->ht_supported)
                         return false;
@@ -405,6 +441,11 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy,
         if (width > 20)
                 prohibited_flags |= IEEE80211_CHAN_NO_OFDM;
 
+        /* 5 and 10 MHz are only defined for the OFDM PHY */
+        if (width < 20)
+                prohibited_flags |= IEEE80211_CHAN_NO_OFDM;
+
+
         if (!cfg80211_secondary_chans_ok(wiphy, chandef->center_freq1,
                                          width, prohibited_flags))
                 return false;
diff --git a/net/wireless/core.c b/net/wireless/core.c
index f277246080b5..4f9f216665e9 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -933,6 +933,12 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
                  * freed.
                  */
                 cfg80211_process_wdev_events(wdev);
+
+                if (WARN_ON(wdev->current_bss)) {
+                        cfg80211_unhold_bss(wdev->current_bss);
+                        cfg80211_put_bss(wdev->wiphy, &wdev->current_bss->pub);
+                        wdev->current_bss = NULL;
+                }
                 break;
         case NETDEV_PRE_UP:
                 if (!(wdev->wiphy->interface_modes & BIT(wdev->iftype)))
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index a61a44bc6cf0..bfac5e186f57 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -38,6 +38,7 @@ void cfg80211_rx_assoc_resp(struct net_device *dev, struct cfg80211_bss *bss,
          * frame instead of reassoc.
          */
         if (cfg80211_sme_rx_assoc_resp(wdev, status_code)) {
+                cfg80211_unhold_bss(bss_from_pub(bss));
                 cfg80211_put_bss(wiphy, bss);
                 return;
         }
@@ -131,16 +132,19 @@ void cfg80211_auth_timeout(struct net_device *dev, const u8 *addr)
 }
 EXPORT_SYMBOL(cfg80211_auth_timeout);
 
-void cfg80211_assoc_timeout(struct net_device *dev, const u8 *addr)
+void cfg80211_assoc_timeout(struct net_device *dev, struct cfg80211_bss *bss)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct wiphy *wiphy = wdev->wiphy;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 
-        trace_cfg80211_send_assoc_timeout(dev, addr);
+        trace_cfg80211_send_assoc_timeout(dev, bss->bssid);
 
-        nl80211_send_assoc_timeout(rdev, dev, addr, GFP_KERNEL);
+        nl80211_send_assoc_timeout(rdev, dev, bss->bssid, GFP_KERNEL);
         cfg80211_sme_assoc_timeout(wdev);
+
+        cfg80211_unhold_bss(bss_from_pub(bss));
+        cfg80211_put_bss(wiphy, bss);
 }
 EXPORT_SYMBOL(cfg80211_assoc_timeout);
 
@@ -307,6 +311,8 @@ int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
                 goto out;
 
         err = rdev_assoc(rdev, dev, req);
+        if (!err)
+                cfg80211_hold_bss(bss_from_pub(req->bss));
 
 out:
         if (err)
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index e545023e2871..1cc47aca7f05 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -1111,10 +1111,16 @@ nl80211_send_mgmt_stypes(struct sk_buff *msg,
         return 0;
 }
 
+struct nl80211_dump_wiphy_state {
+        s64 filter_wiphy;
+        long start;
+        long split_start, band_start, chan_start;
+        bool split;
+};
+
 static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
                               struct sk_buff *msg, u32 portid, u32 seq,
-                              int flags, bool split, long *split_start,
-                              long *band_start, long *chan_start)
+                              int flags, struct nl80211_dump_wiphy_state *state)
 {
         void *hdr;
         struct nlattr *nl_bands, *nl_band;
@@ -1125,19 +1131,14 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
         int i;
         const struct ieee80211_txrx_stypes *mgmt_stypes =
                                 dev->wiphy.mgmt_stypes;
-        long start = 0, start_chan = 0, start_band = 0;
         u32 features;
 
         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_WIPHY);
         if (!hdr)
                 return -ENOBUFS;
 
-        /* allow always using the variables */
-        if (!split) {
-                split_start = &start;
-                band_start = &start_band;
-                chan_start = &start_chan;
-        }
+        if (WARN_ON(!state))
+                return -EINVAL;
 
         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx) ||
             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
@@ -1146,7 +1147,7 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
                         cfg80211_rdev_list_generation))
                 goto nla_put_failure;
 
-        switch (*split_start) {
+        switch (state->split_start) {
         case 0:
                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
                                dev->wiphy.retry_short) ||
@@ -1188,9 +1189,12 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
                 if ((dev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
                         goto nla_put_failure;
+                if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
+                    nla_put_flag(msg, WIPHY_FLAG_SUPPORTS_5_10_MHZ))
+                        goto nla_put_failure;
 
-                (*split_start)++;
-                if (split)
+                state->split_start++;
+                if (state->split)
                         break;
         case 1:
                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
@@ -1234,22 +1238,23 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
                         }
                 }
 
-                (*split_start)++;
-                if (split)
+                state->split_start++;
+                if (state->split)
                         break;
         case 2:
                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
                                         dev->wiphy.interface_modes))
                                 goto nla_put_failure;
-                (*split_start)++;
-                if (split)
+                state->split_start++;
+                if (state->split)
                         break;
         case 3:
                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
                 if (!nl_bands)
                         goto nla_put_failure;
 
-                for (band = *band_start; band < IEEE80211_NUM_BANDS; band++) {
+                for (band = state->band_start;
+                     band < IEEE80211_NUM_BANDS; band++) {
                         struct ieee80211_supported_band *sband;
 
                         sband = dev->wiphy.bands[band];
@@ -1261,12 +1266,12 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
                         if (!nl_band)
                                 goto nla_put_failure;
 
-                        switch (*chan_start) {
+                        switch (state->chan_start) {
                         case 0:
                                 if (nl80211_send_band_rateinfo(msg, sband))
                                         goto nla_put_failure;
-                                (*chan_start)++;
-                                if (split)
+                                state->chan_start++;
+                                if (state->split)
                                         break;
                         default:
                                 /* add frequencies */
@@ -1275,7 +1280,7 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
                                 if (!nl_freqs)
                                         goto nla_put_failure;
 
-                                for (i = *chan_start - 1;
+                                for (i = state->chan_start - 1;
                                      i < sband->n_channels;
                                      i++) {
                                         nl_freq = nla_nest_start(msg, i);
@@ -1284,26 +1289,27 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
 
                                         chan = &sband->channels[i];
 
-                                        if (nl80211_msg_put_channel(msg, chan,
-                                                                    split))
+                                        if (nl80211_msg_put_channel(
+                                                        msg, chan,
+                                                        state->split))
                                                 goto nla_put_failure;
 
                                         nla_nest_end(msg, nl_freq);
-                                        if (split)
+                                        if (state->split)
                                                 break;
                                 }
                                 if (i < sband->n_channels)
-                                        *chan_start = i + 2;
+                                        state->chan_start = i + 2;
                                 else
-                                        *chan_start = 0;
+                                        state->chan_start = 0;
                                 nla_nest_end(msg, nl_freqs);
                         }
 
                         nla_nest_end(msg, nl_band);
 
-                        if (split) {
+                        if (state->split) {
                                 /* start again here */
-                                if (*chan_start)
+                                if (state->chan_start)
                                         band--;
                                 break;
                         }
@@ -1311,14 +1317,14 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
                 nla_nest_end(msg, nl_bands);
 
                 if (band < IEEE80211_NUM_BANDS)
-                        *band_start = band + 1;
+                        state->band_start = band + 1;
                 else
-                        *band_start = 0;
+                        state->band_start = 0;
 
                 /* if bands & channels are done, continue outside */
-                if (*band_start == 0 && *chan_start == 0)
-                        (*split_start)++;
-                if (split)
+                if (state->band_start == 0 && state->chan_start == 0)
+                        state->split_start++;
+                if (state->split)
                         break;
         case 4:
                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
@@ -1384,7 +1390,7 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
                 }
                 CMD(start_p2p_device, START_P2P_DEVICE);
                 CMD(set_mcast_rate, SET_MCAST_RATE);
-                if (split) {
+                if (state->split) {
                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
                 }
@@ -1408,8 +1414,8 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
                 }
 
                 nla_nest_end(msg, nl_cmds);
-                (*split_start)++;
-                if (split)
+                state->split_start++;
+                if (state->split)
                         break;
         case 5:
                 if (dev->ops->remain_on_channel &&
@@ -1425,29 +1431,30 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
 
                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
                         goto nla_put_failure;
-                (*split_start)++;
-                if (split)
+                state->split_start++;
+                if (state->split)
                         break;
         case 6:
 #ifdef CONFIG_PM
-                if (nl80211_send_wowlan(msg, dev, split))
+                if (nl80211_send_wowlan(msg, dev, state->split))
                         goto nla_put_failure;
-                (*split_start)++;
-                if (split)
+                state->split_start++;
+                if (state->split)
                         break;
 #else
-                (*split_start)++;
+                state->split_start++;
 #endif
         case 7:
                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
                                         dev->wiphy.software_iftypes))
                         goto nla_put_failure;
 
-                if (nl80211_put_iface_combinations(&dev->wiphy, msg, split))
+                if (nl80211_put_iface_combinations(&dev->wiphy, msg,
+                                                   state->split))
                         goto nla_put_failure;
 
-                (*split_start)++;
-                if (split)
+                state->split_start++;
+                if (state->split)
                         break;
         case 8:
                 if ((dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
@@ -1461,7 +1468,7 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
                  * dump is split, otherwise it makes it too big. Therefore
                  * only advertise it in that case.
                  */
-                if (split)
+                if (state->split)
                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
                         goto nla_put_failure;
@@ -1488,7 +1495,7 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
                  * case we'll continue with more data in the next round,
                  * but break unconditionally so unsplit data stops here.
                  */
-                (*split_start)++;
+                state->split_start++;
                 break;
         case 9:
                 if (dev->wiphy.extended_capabilities &&
@@ -1507,7 +1514,7 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
                         goto nla_put_failure;
 
                 /* done */
-                *split_start = 0;
+                state->split_start = 0;
                 break;
         }
         return genlmsg_end(msg, hdr);
@@ -1517,67 +1524,78 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
         return -EMSGSIZE;
 }
 
+static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
+                                    struct netlink_callback *cb,
+                                    struct nl80211_dump_wiphy_state *state)
+{
+        struct nlattr **tb = nl80211_fam.attrbuf;
+        int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
+                              tb, nl80211_fam.maxattr, nl80211_policy);
+        /* ignore parse errors for backward compatibility */
+        if (ret)
+                return 0;
+
+        state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
+        if (tb[NL80211_ATTR_WIPHY])
+                state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
+        if (tb[NL80211_ATTR_WDEV])
+                state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
+        if (tb[NL80211_ATTR_IFINDEX]) {
+                struct net_device *netdev;
+                struct cfg80211_registered_device *rdev;
+                int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
+
+                netdev = dev_get_by_index(sock_net(skb->sk), ifidx);
+                if (!netdev)
+                        return -ENODEV;
+                if (netdev->ieee80211_ptr) {
+                        rdev = wiphy_to_dev(
+                                netdev->ieee80211_ptr->wiphy);
+                        state->filter_wiphy = rdev->wiphy_idx;
+                }
+                dev_put(netdev);
+        }
+
+        return 0;
+}
+
 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 {
         int idx = 0, ret;
-        int start = cb->args[0];
+        struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
         struct cfg80211_registered_device *dev;
-        s64 filter_wiphy = -1;
-        bool split = false;
-        struct nlattr **tb;
-        int res;
-
-        /* will be zeroed in nlmsg_parse() */
-        tb = kmalloc(sizeof(*tb) * (NL80211_ATTR_MAX + 1), GFP_KERNEL);
-        if (!tb)
-                return -ENOMEM;
 
         rtnl_lock();
-
-        res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
-                          tb, NL80211_ATTR_MAX, nl80211_policy);
-        if (res == 0) {
-                split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
-                if (tb[NL80211_ATTR_WIPHY])
-                        filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
-                if (tb[NL80211_ATTR_WDEV])
-                        filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
-                if (tb[NL80211_ATTR_IFINDEX]) {
-                        struct net_device *netdev;
-                        int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
-
-                        netdev = dev_get_by_index(sock_net(skb->sk), ifidx);
-                        if (!netdev) {
-                                rtnl_unlock();
-                                kfree(tb);
-                                return -ENODEV;
-                        }
-                        if (netdev->ieee80211_ptr) {
-                                dev = wiphy_to_dev(
-                                        netdev->ieee80211_ptr->wiphy);
-                                filter_wiphy = dev->wiphy_idx;
-                        }
-                        dev_put(netdev);
+        if (!state) {
+                state = kzalloc(sizeof(*state), GFP_KERNEL);
+                if (!state) {
+                        rtnl_unlock();
+                        return -ENOMEM;
                 }
+                state->filter_wiphy = -1;
+                ret = nl80211_dump_wiphy_parse(skb, cb, state);
+                if (ret) {
+                        kfree(state);
+                        rtnl_unlock();
+                        return ret;
+                }
+                cb->args[0] = (long)state;
         }
-        kfree(tb);
 
         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
                         continue;
-                if (++idx <= start)
+                if (++idx <= state->start)
                         continue;
-                if (filter_wiphy != -1 && dev->wiphy_idx != filter_wiphy)
+                if (state->filter_wiphy != -1 &&
+                    state->filter_wiphy != dev->wiphy_idx)
                         continue;
                 /* attempt to fit multiple wiphy data chunks into the skb */
                 do {
                         ret = nl80211_send_wiphy(dev, skb,
                                                  NETLINK_CB(cb->skb).portid,
                                                  cb->nlh->nlmsg_seq,
-                                                 NLM_F_MULTI,
-                                                 split, &cb->args[1],
-                                                 &cb->args[2],
-                                                 &cb->args[3]);
+                                                 NLM_F_MULTI, state);
                         if (ret < 0) {
                                 /*
                                  * If sending the wiphy data didn't fit (ENOBUFS
@@ -1602,27 +1620,34 @@ static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
                                 idx--;
                                 break;
                         }
-                } while (cb->args[1] > 0);
+                } while (state->split_start > 0);
                 break;
         }
         rtnl_unlock();
 
-        cb->args[0] = idx;
+        state->start = idx;
 
         return skb->len;
 }
 
+static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
+{
+        kfree((void *)cb->args[0]);
+        return 0;
+}
+
 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
 {
         struct sk_buff *msg;
         struct cfg80211_registered_device *dev = info->user_ptr[0];
+        struct nl80211_dump_wiphy_state state = {};
 
         msg = nlmsg_new(4096, GFP_KERNEL);
         if (!msg)
                 return -ENOMEM;
 
         if (nl80211_send_wiphy(dev, msg, info->snd_portid, info->snd_seq, 0,
-                               false, NULL, NULL, NULL) < 0) {
+                               &state) < 0) {
                 nlmsg_free(msg);
                 return -ENOBUFS;
         }
@@ -1739,6 +1764,11 @@ static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
                                      IEEE80211_CHAN_DISABLED))
                 return -EINVAL;
 
+        if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
+             chandef->width == NL80211_CHAN_WIDTH_10) &&
+            !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
+                return -EINVAL;
+
         return 0;
 }
 
@@ -2890,61 +2920,58 @@ static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
         return err;
 }
 
-static int nl80211_parse_beacon(struct genl_info *info,
+static int nl80211_parse_beacon(struct nlattr *attrs[],
                                 struct cfg80211_beacon_data *bcn)
 {
         bool haveinfo = false;
 
-        if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]) ||
-            !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]) ||
-            !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
-            !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]))
+        if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
+            !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
+            !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
+            !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
                 return -EINVAL;
 
         memset(bcn, 0, sizeof(*bcn));
 
-        if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
-                bcn->head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
-                bcn->head_len = nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
+        if (attrs[NL80211_ATTR_BEACON_HEAD]) {
+                bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
+                bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
                 if (!bcn->head_len)
                         return -EINVAL;
                 haveinfo = true;
         }
 
-        if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
-                bcn->tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
-                bcn->tail_len =
-                    nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
+        if (attrs[NL80211_ATTR_BEACON_TAIL]) {
+                bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
+                bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
                 haveinfo = true;
         }
 
         if (!haveinfo)
                 return -EINVAL;
 
-        if (info->attrs[NL80211_ATTR_IE]) {
-                bcn->beacon_ies = nla_data(info->attrs[NL80211_ATTR_IE]);
-                bcn->beacon_ies_len = nla_len(info->attrs[NL80211_ATTR_IE]);
+        if (attrs[NL80211_ATTR_IE]) {
+                bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
+                bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
         }
 
-        if (info->attrs[NL80211_ATTR_IE_PROBE_RESP]) {
+        if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
                 bcn->proberesp_ies =
-                        nla_data(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
+                        nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
                 bcn->proberesp_ies_len =
-                        nla_len(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
+                        nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
         }
 
-        if (info->attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
+        if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
                 bcn->assocresp_ies =
-                        nla_data(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
+                        nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
                 bcn->assocresp_ies_len =
-                        nla_len(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
+                        nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
         }
 
-        if (info->attrs[NL80211_ATTR_PROBE_RESP]) {
-                bcn->probe_resp =
-                        nla_data(info->attrs[NL80211_ATTR_PROBE_RESP]);
-                bcn->probe_resp_len =
-                        nla_len(info->attrs[NL80211_ATTR_PROBE_RESP]);
+        if (attrs[NL80211_ATTR_PROBE_RESP]) {
+                bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
+                bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
         }
 
         return 0;
@@ -3023,7 +3050,7 @@ static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
             !info->attrs[NL80211_ATTR_BEACON_HEAD])
                 return -EINVAL;
 
-        err = nl80211_parse_beacon(info, &params.beacon);
+        err = nl80211_parse_beacon(info->attrs, &params.beacon);
         if (err)
                 return err;
 
@@ -3175,7 +3202,7 @@ static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
         if (!wdev->beacon_interval)
                 return -EINVAL;
 
-        err = nl80211_parse_beacon(info, &params);
+        err = nl80211_parse_beacon(info->attrs, &params);
         if (err)
                 return err;
 
@@ -6291,11 +6318,16 @@ static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef))
                 return -EINVAL;
 
-        if (ibss.chandef.width > NL80211_CHAN_WIDTH_40)
-                return -EINVAL;
-        if (ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
-            !(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
+        switch (ibss.chandef.width) {
+        case NL80211_CHAN_WIDTH_20_NOHT:
+                break;
+        case NL80211_CHAN_WIDTH_20:
+        case NL80211_CHAN_WIDTH_40:
+                if (rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)
+                        break;
+        default:
                 return -EINVAL;
+        }
 
         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
@@ -8409,6 +8441,7 @@ static struct genl_ops nl80211_ops[] = {
                 .cmd = NL80211_CMD_GET_WIPHY,
                 .doit = nl80211_get_wiphy,
                 .dumpit = nl80211_dump_wiphy,
+                .done = nl80211_dump_wiphy_done,
                 .policy = nl80211_policy,
                 /* can be retrieved by unprivileged users */
                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
@@ -9029,13 +9062,13 @@ static struct genl_multicast_group nl80211_regulatory_mcgrp = {
 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
 {
         struct sk_buff *msg;
+        struct nl80211_dump_wiphy_state state = {};
 
         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
         if (!msg)
                 return;
 
-        if (nl80211_send_wiphy(rdev, msg, 0, 0, 0,
-                               false, NULL, NULL, NULL) < 0) {
+        if (nl80211_send_wiphy(rdev, msg, 0, 0, 0, &state) < 0) {
                 nlmsg_free(msg);
                 return;
         }
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index dd01b58fa78c..ae8c186b50d6 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -523,6 +523,7 @@ static int cmp_bss(struct cfg80211_bss *a,
         }
 }
 
+/* Returned bss is reference counted and must be cleaned up appropriately. */
 struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy,
                                       struct ieee80211_channel *channel,
                                       const u8 *bssid,
@@ -678,6 +679,7 @@ static bool cfg80211_combine_bsses(struct cfg80211_registered_device *dev,
         return true;
 }
 
+/* Returned bss is reference counted and must be cleaned up appropriately. */
 static struct cfg80211_internal_bss *
 cfg80211_bss_update(struct cfg80211_registered_device *dev,
                     struct cfg80211_internal_bss *tmp)
@@ -866,6 +868,7 @@ cfg80211_get_bss_channel(struct wiphy *wiphy, const u8 *ie, size_t ielen,
         return channel;
 }
 
+/* Returned bss is reference counted and must be cleaned up appropriately. */
 struct cfg80211_bss*
 cfg80211_inform_bss(struct wiphy *wiphy,
                     struct ieee80211_channel *channel,
@@ -923,6 +926,7 @@ cfg80211_inform_bss(struct wiphy *wiphy,
 }
 EXPORT_SYMBOL(cfg80211_inform_bss);
 
+/* Returned bss is reference counted and must be cleaned up appropriately. */
 struct cfg80211_bss *
 cfg80211_inform_bss_frame(struct wiphy *wiphy,
                           struct ieee80211_channel *channel,
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index ae7e2cbf45cb..1d3cfb1a3f28 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -239,6 +239,7 @@ void cfg80211_conn_work(struct work_struct *work)
         rtnl_unlock();
 }
 
+/* Returned bss is reference counted and must be cleaned up appropriately. */
 static struct cfg80211_bss *cfg80211_get_conn_bss(struct wireless_dev *wdev)
 {
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
@@ -557,6 +558,7 @@ static DECLARE_WORK(cfg80211_disconnect_work, disconnect_work);
  * SME event handling
  */
 
+/* This method must consume bss one way or another */
 void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
                                const u8 *req_ie, size_t req_ie_len,
                                const u8 *resp_ie, size_t resp_ie_len,
@@ -572,8 +574,10 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
         ASSERT_WDEV_LOCK(wdev);
 
         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION &&
-                    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT))
+                    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)) {
+                cfg80211_put_bss(wdev->wiphy, bss);
                 return;
+        }
 
         nl80211_send_connect_result(wiphy_to_dev(wdev->wiphy), dev,
                                     bssid, req_ie, req_ie_len,
@@ -615,19 +619,24 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
                 kfree(wdev->connect_keys);
                 wdev->connect_keys = NULL;
                 wdev->ssid_len = 0;
-                cfg80211_put_bss(wdev->wiphy, bss);
+                if (bss) {
+                        cfg80211_unhold_bss(bss_from_pub(bss));
+                        cfg80211_put_bss(wdev->wiphy, bss);
+                }
                 return;
         }
 
-        if (!bss)
+        if (!bss) {
+                WARN_ON_ONCE(!wiphy_to_dev(wdev->wiphy)->ops->connect);
                 bss = cfg80211_get_bss(wdev->wiphy, NULL, bssid,
                                        wdev->ssid, wdev->ssid_len,
                                        WLAN_CAPABILITY_ESS,
                                        WLAN_CAPABILITY_ESS);
-        if (WARN_ON(!bss))
-                return;
+                if (WARN_ON(!bss))
+                        return;
+                cfg80211_hold_bss(bss_from_pub(bss));
+        }
 
-        cfg80211_hold_bss(bss_from_pub(bss));
         wdev->current_bss = bss_from_pub(bss);
 
         cfg80211_upload_connect_keys(wdev);
@@ -691,6 +700,7 @@ void cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
 }
 EXPORT_SYMBOL(cfg80211_connect_result);
 
+/* Consumes bss object one way or another */
 void __cfg80211_roamed(struct wireless_dev *wdev,
                        struct cfg80211_bss *bss,
                        const u8 *req_ie, size_t req_ie_len,
@@ -767,6 +777,7 @@ void cfg80211_roamed(struct net_device *dev,
 }
 EXPORT_SYMBOL(cfg80211_roamed);
 
+/* Consumes bss object one way or another */
 void cfg80211_roamed_bss(struct net_device *dev,
                          struct cfg80211_bss *bss, const u8 *req_ie,
                          size_t req_ie_len, const u8 *resp_ie,
diff --git a/net/wireless/sysfs.c b/net/wireless/sysfs.c
index 360a42c6f694..a23253e06358 100644
--- a/net/wireless/sysfs.c
+++ b/net/wireless/sysfs.c
@@ -83,6 +83,7 @@ static int wiphy_uevent(struct device *dev, struct kobj_uevent_env *env)
         return 0;
 }
 
+#ifdef CONFIG_PM
 static void cfg80211_leave_all(struct cfg80211_registered_device *rdev)
 {
         struct wireless_dev *wdev;
@@ -91,7 +92,6 @@ static void cfg80211_leave_all(struct cfg80211_registered_device *rdev)
                 cfg80211_leave(rdev, wdev);
 }
 
-#ifdef CONFIG_PM
 static int wiphy_suspend(struct device *dev, pm_message_t state)
 {
         struct cfg80211_registered_device *rdev = dev_to_rdev(dev);